About
Dennis Fisher is a journalist with more than 13 years of experience covering information security.
Microsoft plans to issue seven security bulletins in the January Patch Tuesday release next week, fixing six vulnerabilities rated important and one rated critical. The bugs affect a variety of products, including Windows XP, Vista, Windows 7, Server 2003 and 2008 and Microsoft Developer Tools and Software.
Google has released a new version of its Chrome browser, fixing just a small handful of vulnerabilities in the process. All three of the bugs fixed in Chrome were rated high.
The Ramnit worm, which was first detected more than 18 months ago, has continued to evolve and now has spawned a version that is targeting victims’ Facebook credentials, and with great success. Researchers at Seculert in Israel have found a variant of Ramnit that is stealing those credentials and then trying to compromise other accounts belonging to the victims, including VPNs, email and other sensitive accounts.
A new version of the OpenSSL package has been released, fixing six vulnerabilities, including a plaintext recovery attack on the DTLS implementation. There are two other cryptographic flaws fixed in OpenSSL 1.0.0f, and a few other less-serious problems.
Privacy experts at the EFF are warning users not to upgrade to the new version of the venerable AOL Instant Messenger chat client because of some serious privacy concerns with the application. The main concern is that the new version of AIM automatically logs all user conversations by default, but there also are issues with the way that AIM scans all links in chats and pre-fetches the URLs.
At any given time, there are probably dozens of somewhat serious SQL injection attacks going on in various portions of the Internet. But many of them never get noticed by most people, either because they’re not widespread enough or they’re not hitting high-profile targets. There’s one that’s been ongoing for several weeks now that has hit a threshold that commands some attention: more than a million infected URLs.
A pair of researchers have identified a cross-site scripting vulnerability in WordPress 3.3, however the bug is only reproducible on installations that were installed using an IP address rather than a domain.
A security researcher has released a tool that will untether iPhones and other devices running iOS 5.01, allowing them to run unsigned code. The tool relies on a pair of exploits, one in an iOS binary and another in the kernel, and the jailbreak will survive after a reboot.
It’s that most un-wonderful time of the year: the time when everyone writes fluffy articles full of lists, retrospectives and look-aheads. Even we did it. Many of these lists involve some variation on the theme of most overhyped or least organic or or most awesomest or lowest fat content. This article is not those articles.
UPDATED Microsoft on Thursday plans to release an emergency out-of-band update to address a vulnerability in ASP.NET that could allow an attacker to consume all of the resources on a vulnerable server with a single specially designed HTTP request. The vulnerability affects a wide range of Web platforms are vulnerable to this attack, and Microsoft officials said they’re releasing the patch now because they’re expecting exploit code to be released in the near future.
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
