Just two weeks after the release of exploit code
for a critical (remotely exploitable) security hole in its Internet
Explorer browser, Microsoft says a fix will be included in this month’s
batch of Patch Tuesday updates.
Adobe’s
security response team is scrambling to deal with the release of
exploit code for what appears to be a critical zero-day flaw in the
Adobe Illustrator CS4 software product.
The vulnerability is caused due to an error in the parsing of
Encapsulated Postscript Files (.eps) and can be exploited to corrupt
memory when a user opens a specially crafted .eps file. Successful
exploitation allows execution of arbitrary code.
Although the combined number of reported data breaches in the
government and the military has dropped in 2009 compared to last year,
many more records were compromised in those breaches, according to
recent figures compiled by the Identity Theft Resource Center. Read the full article. [Government Technology]
The three universities involved in the security consortium put together this week by Northrop Grumman will have wide latitude to pursue research projects as they see fit and will be under no obligation to work only on technology that fits Northrop’s future plans. The researchers, in fact, will be able to work on the kind of long-range projects that often go unfunded because they don’t show short-term commercial promise.
The
Internet Systems Consortium (ISC) has shipped a patch to cover a
“severe” cache poisoning vulnerability for BIND 9 users who have DNSSEC
validation turned on. The vulnerability exists in the way BIND 9 handles recursive client queries
that may cause additional records to be added to its cache.
Novell has released a security update for its eDirectory server to remedy a heap overflow vulnerability. Attackers can remotely exploit the flaw to
crash or penetrate a server. The vendor says that the vulnerability can
be exploited with a specially crafted NDS Service Request. Read the full article. [The H Security] Read the original advisory.
The craze in online games among Chinese netizens is fuelling an increasingly lucrative real-world market for computer hackers, security firms have said. A report by state broadcaster CCTV said Trojan-horse attacks, which allow hackers remote access to a targeted computer system, make up a market expected to be worth 10 billion yuan (S$2 billion) this year. Read the full story [asiaonline.com]
A Cyber Forensics panel at the U.S Spy Museum discussed data breaches and the effects one bad hacking event can have; The panel discussion included the CEO of Heartland Payment Systems, whose company was the victim of a very large, very publicized data breach in 2008. Read the full article. [Dark Reading]
Malware attacks and infections are up 50 percent from 2008 and losses are down, according to a Computer Security Institute report, but the industry organization says very few companies are willing to disclose dollar amounts. Read the full article. [Security Focus]
A consortium of cybersecurity researchers from MIT, Purdue and Carnegie Mellon was announced in Washington D.C. with the stated goal is to collaborate on cybersecurity research including 10 projects, one which is the development of an Internet-scale model on which to perform
constrained experiments not possible on the live Internet. Read the full article. [TechTarget]
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
