Vulnerabilities

Researchers who will present at Black Hat have discovered a hole in the WPA2 Wi-Fi security protocol. The security hole was named as Hole 196 after the number of the relevant page in the IEEE 802.11 (2007) standard document. Read the full article. [The H Security]

PHP 5.3.3 contains approximately 100 bug fixes. Among the security-relevant bugs are buffer overflows in the native MySQL driver. Support for 5.2 ends. Read the full article. [The H Security]

This week brought us the rare double rainbow of a re-emergence of the disclosure discussion and major security news from Microsoft, all wrapped into one. It truly was a gift from Mother Nature. But Microsoft’s decision to change its disclosure stance–and refusal to pay bug bounties–wasn’t the only big news. The Stuxnet saga continued to widen and weirden, a major privacy leak cropped up in Safari and the roots of the mass SQL injection attacks were exposed. What does it all mean? Read on for the full week in review.

Dennis Fisher talks with independent security researcher Dino Dai Zovi about his upcoming Black Hat talk on return-oriented exploitation, the value of exploit mitigations such as DEP and ASLR, the new crop of vendor bug bounties and why we don’t have any good data on zero-day attacks.

Researchers have found two distinct new malware families that are exploiting the newly discovered Windows shell LNK vulnerability, leading to concerns that the development of a worm could be in the offing.

Dell said human error was to blame for mistakes which led it to ship a
number of replacement server motherboards to customers pre-loaded with
spyware. The company declined to say whether it was running anti-virus
software at its factory but said it had taken 16 steps to improve
processes. Read the full article. [The Register]

Microsoft has no plans to follow in the footsteps of Mozilla and Google and pay researchers cash rewards for the bugs that they find in Microsoft’s products.