Inside Microsoft’s August Patch Tuesday
Microsoft has released their planned 14 bulletins fixing 34 vulnerabilities today. There are four bulletins that administrators should look at patching as soon as possible.
Malware
Foxit Plugs iPhone Jailbreak Vulnerability
The Foxit document reader has been updated to fix the same critical bug
that currently leaves iPhones, iPads, and iPod touches wide open to
malware attacks. Read the full article. [The Register]
A Closer Look at Crimepack’s Exploit Stats
One of the best-selling exploit packs on the market today is called Crimepack. Here is a closer look at the “exploit stats”
sections of a few working Crimepack installations to get a better sense
of which software vulnerabilities are most productive for Crimepack
customers. Read the full article. [Krebs on Security]
Significant weaknesses in the common
configuration of Kerberos-based authentication servers could allow
attackers to more easily circumvent security measures in networks that
rely on the open authentication standard, according to research
presented at Black Hat. Read the full article. [Dark Reading]
Federal prosecutors say they have have extradited one of the leaders of
an international crime ring accused of hacking in to bank card processor
RBS WorldPay and stealing more than $9.4m in a 12-hour period. Read the full article. [The Register]
USA Today’s Byron Acohido is reporting that Apple plans to rush out a patch for the drive-by download flaw that allows jailbreaking if an iPhone, iPad or iPod Touch device simply surfs to a web site.
Microsoft’s security response team is investigating the release of a new zero-day flaw that exposes Windows 7 users to blue-screen crashes or code execution attacks.
The U.S. Computer Emergency Readiness Team has issued two warnings on flaws in the embedded systems’ OS technology VxWorks as discovered by researcher HD Moore. One flaw deals with weakness in the hashing algorithm of the API authentication; The second regards debug settings being enabled by default and affects nearly 60 vendors’ products. Read the algorithm warning here. Read the debug warning here. [US CERT]
Researchers at Def Con created a handful of virtual server instances on
Amazon’s EC2 and used a homemade program to attack the network of a
client — a small business that wanted its connectivity tested. They took the company off the
Internet. The price? Six dollars. Read the full article. [Dark Reading]
On the heels of a Black Hat conference presentation where researcher Charlie Miller provided details of an exploitable vulnerability in Adobe’s PDF Reader software, the company plans to ship an out-of-band patch to ward off malicious hacker attacks.
