eBay Has Cross Site Forgery Flaw
eBay is working on a fix for a cross-site request forgery problem that could allow an attacker to change a user’s password and get access to that user’s account. Read the full article. [eWEEK]
Vulnerabilities
MS10-015 Restart Issues Are the Result of Rootkit Infection
Microsoft on Thursday confirmed that the blue screen of death issues that affected a slew of users after the latest batch of Patch Tuesday updates is the result of an existing infection by the Alureon rootkit.
ID Theft Criminal Sentenced to 309 Years in Prison
Robert Thompson, also known as John Lawson, age 43, of Zachary, La., was sentenced to a term of 309 years in prison. Thompson, the leader of a massive identity theft and bribery scheme, was sentenced based on charges of conspiracy, wire fraud, mail fraud, bank fraud, computer fraud, access device fraud, aggravated identity theft, money laundering, and obstruction of justice. This is the longest sentence of any white collar offender in the history of the Middle District of Louisiana. Read the full FBI statement. [FBI.gov]
Cisco has released updates to close numerous security holes in several of its products. The ASA 5500 Adaptive Security Appliances are most affected. They alone contain six vulnerabilities that can be exploited to remotely cripple or reboot a device via specially crafted TCP, SIP, SCCP or IKE packets. Read the full article. [The H Security]
More than 74,000 PCs at nearly 2,500 organizations around the globe
were compromised over the past year and a half in a botnet infestation
designed to steal login credentials to bank sites, social networks, and
e-mail systems, researchers have discovered. Read the full article. [cnet]
The Mozilla developers have announced the release of version 3.5.8 and 3.0.18 of their open source Firefox web browser. In addition to the usual bug fixes and stability improvements, the updates address a total of five vulnerabilities, three of them rated critical. Read the full article. [The H Security]
OpenOffice.org has shipped a new version of the desktop productivity suite to patch six vulnerabilities that could expose users to malicious hacker attacks.The flaws fixed in OpenOffice.org 3.2 could be exploited via GIF, XPM files and Microsoft Word document processing, according to an advisory released by the open-source group.
During the simulated cyber attack that took place yesterday in Washington and was recorded by the CNN,
one thing became clear: the US are still not ready to deflect or
mitigate such an attack to an extent that would not affect considerably
the everyday life of its citizens. Read the full article. [Help Net Security]
Google has fixed a Web flaw that gave hackers a way to take control of Google Buzz accounts. Read the full article. [Computerworld]
The 2010 CWE/SANS Top 25 Most Dangerous Programming Errors is a list
of widespread and critical programming errors that can lead
to serious software vulnerabilities. Read the full article. [Common Weakness Enumeration/Mitre]
