The developers of the uTorrent file-sharing application have released an
updated version that fixes a problem that could allow an attacker to
load malicious code onto a user’s computer. Read the full article. [IDG News Service]
In the wake of all of the stories about the Windows DLL hijacking bug, it appears that certain Linux distributions may be vulnerable to a similar problem related to the way that Linux handles a specific variable in some cases. The bug apparently was introduced via a Debian patch last year.
A senior official at the Department of Defense is talking publicly about a 2008 security breach that he claims compromised classified intelligence networks used by the U.S. military.
By Oliver LaveryIt’s been
interesting watching DLL hijacking grow from interesting phenomena to a full-on snowball of hype and FUD over
the last few days. As of this writing Google turns up 152 news articles on the
subject. The vast majority
of coverage is calling this a “new class of attack” and pointing out how “over
30 zero-day vulnerabilities have been found so far!”. The only way to
paraphrase many of the headlines is: “Panic!”
With Web based software vulnerabilities on the rise, Google displaces HP on the list of vendors with the most reported software holes in the first half of 2010.software vulnerabilities.
The list of applications known to be vulnerable to the Windows DLL-hijacking bug is growing by the hour, with some sites listing more than 30 vulnerable applications right now. A large portion of the known vulnerable apps belong to Microsoft, including PowerPoint 2010 and Microsoft Live Email.
By Stefan TanaseThe growing popularity of location-based services in the social networking world is a serious security and privacy risk that must be taken seriously.
Adobe has shipped a Shockwave Player update to fix 20 security holes, some serious enough to lead to system takeover attacks.
The vulnerabilities, rated “critical,” affect Shockwave Player 11.5.7.609 and earlier versions for Windows and Macintosh.
Apple released a patch Tuesday that fixes more than a dozen bugs, including a critical remote code-execution flaw in Apple Type Services. The patch release also includes a fix for a flaw in CFNetwork that enabled an attacker to intercept user credentials and other sensitive data silently on a network.
Researchers have found a very simple method for evading the Android licensing scheme that Google uses to ensure that paid applications in its Android Market are correctly licensed.
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
