FDA Warns Medical Device Manufacturers to Take Security More Seriously
The FDA today handed out general cybersecurity guidelines for medical device manufacturers.
Vulnerabilities
CSP 1.0 Added to Firefox to Block XSS Attacks
After years of discussion and waiting, Mozilla has finally added Content Security Policy 1.0, a defense against some common attacks such as XSS, to its Firefox browser. CSP already has been implemented in Google Chrome and Internet Explorer and there was a limited implementation of it in Firefox previously, beginning in 2011, but this is the first time the approved 1.0 specification has been implemented in Firefox.
Microsoft FixIt Tool Blocks Java Attacks in IE
Java is a security headache, not just for users and Oracle, its provider, but also for other software companies that have to deal with it, as well. Microsoft has taken steps to address this problem by releasing a FixIt tool that is designed to block all of the Web-based Java attack vectors in Internet Explorer, while still leaving the desktop Java functionality intact.
A sizable number of web servers running vulnerable Plesk software including a number of Apache servers make up a new IRC botnet.
CERT warns of an unpatched vulnerability in HP’s Insight Diagnostics server management software that could lead to remote code execution attacks.
There is a cross-site scripting vulnerability in the Apple Store Web site that is exposing visitors to potential attack. The vulnerability was discovered by a German security researcher who says he informed Apple about the problem in mid-May, but the vulnerability still exists.
Google has one of the older bug bounty programs in existence, and the company often makes changes to its rules in an effort to stay current with the security landscape. The latest change is another increase in the rewards that the company will pay to researchers who report certain bugs, including cross-site scripting in sensitive Web properties, to $7,500.
Microsoft announced today in an advanced patch Tuesday notification that it will ship just five bulletins in the June edition of patch Tuesday.
DNS servers running BIND 9 should upgrade the latest version of the software after an Internet Systems Consortium advisory warned a remotely exploitable vulnerability had been publicly disclosed.
Security experts are lukewarm on Oracle’s security plans for the Java browser plug-in, largely because they don’t address code innate to the platform’s security sandbox which has been bypassed in a number of attacks.
