A security flaw affecting Microsoft’s Windows operating system that was exploited by the Stuxnet worm was publicly disclosed more than a year before the worm appeared, according to a researcher at Symantec Corp.
ESPN’s Fantasy Football site is riddled with flaws that allow players to rig games, a security researcher says. Read the full article. [The Register]
An error in the free (de)compression library libbzip2 can be exploited using specially prepared files to provoke an integer overflow. Read the full article. [The H Security]
Cisco has released its twice-yearly set of security updates for its switches and routers. There are six advisories in all, each one covering a different component of the Cisco Internetwork Operating System (IOS), which powers the routers. Read the full article. [IDG News Service]
Findings from Veracode’s report “State of Software Security Report: Volume 2.” show that overall quality of
applications remains poor, with 57 percent failing to meet acceptable
levels of security. New results demonstrate that cloud/web-based
applications are the most commonly scrutinized, and with good reason: 80
percent of web applications would not pass a PCI audit. Read the full article. [Help Net Security]
A new report out from security testing firm Veracode suggests that reused and third party code is a big source of application insecurity.
Researchers at NC State University and IBM have
built a prototype security tool that operates in stealth mode to
determine the security of a hypervisor so as not to tip off attackers. Read the full article. [Dark Reading]
Apple has pushed out a Mac OS X security update to plug a security hole
that allows access to shared folders without a valid password. Read the full article. [ZDNet]
UPDATE: Engineers at social network Twitter.com plugged a vulnerability in the company’s main Web page after attacks that exploited the hole may have hit more than 500,000 users.
Microsoft is warning customers that it has seen ongoing attacks against the recently disclosed padding oracle vulnerability in ASP.NET and is encouraging them to implement a workaround that will help protect against the publicly disclosed exploit for the bug.
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
