Twitter Closes Web Hole After Attack Hits Up to 500,000
UPDATE: Engineers at social network Twitter.com plugged a vulnerability in the company’s main Web page after attacks that exploited the hole may have hit more than 500,000 users.
Malware
Open Source Vendors Closing Kernel Hole
Canonical has released updated kernels for Ubuntu versions 10.04 LTS, 9.10, 9.04, 8.04 LTS and 6.06 LTS to close the recently discovered holes in the Linux kernel. The updates are also for the equivalent versions of Kubuntu, Edubuntu and Xubuntu and should be available through Ubuntu’s Software Update system. Read the full article. [The H Security]
Microsoft issues Advisory on ASP.NET Hole
Microsoft has issued a security advisory for a recently disclosed vulnerability in the ASP.NET that could leave millions of Web pages vulnerable to attack.
Threatpost editors Dennis Fisher and Paul Roberts talk about the revelation that Stuxnet included four previously unknown flaws, the padding oracle attack on ASP.NET Web apps and the return of unofficial patches for zero
days.
[swf
file=”http://www.threatpost.com/sites/default/files/newswrap_23.mp3]
Web insecurity was in the news this week, with a major flaw in the security of ASP.NET and some sobering statistics on Web site infections. When your bank account gets hacked – is it your fault? And, with a patch out for one of four (!) zero day exploits used by Stuxnet, security experts wonder if its the most sophisticated malware…ever!?
Adobe is cautioning its users about installing an unofficial patch for the Reader CoolType.dll bug that was released on Wednesday, saying that although the patch appears to prevent the crash in Reader, installing it could have some unintended consequences.
The Linux kernel has been purged of a bug that gave root access to
untrusted users – again. Read the full article. [The Register]
The U.S. and its NATO allies should build a ‘cyber shield’ to protect against future attacks, the Pentagon’s #2 man said in a speech in Brussels.
As users await the Oct. 4 release of a patch for the CoolType.dll vulnerability in Adobe Reader, a software and security company has published an unofficial patch for the bug that essentially replaces the vulnerable DLL with a patched one.
A sophisticated worm designed to steal industrial secrets and disrupt
operations has infected at least 14 plants, according to Siemens. Read the full article. [IDG News Service]
