Adobe has shipped a patch to cover a security vulnerability affecting its Photoshop Elements software product.
The flaw, rated moderate, affects Adobe Photoshop Elements versions
8.0 and 7.0. It could be exploited by a hacker with valid login
credentials and/or physical access to execute arbitrary commands with
elevated privileges. Read the advisory [adobe.com]
Guest editorial by Jason MillerMicrosoft
has released six new security bulletins in November’s Patch Tuesday.
Administrators are getting a bit of a break after last month’s mammoth security
bulletin release.
As
part of its scheduled batch of patches for November, Microsoft today
issued six security bulletins with fixes for a total of 15
vulnerabilities affecting its Windows and Office product lines.
Three of the six bulletins are rated “critical,” meaning they can be
used to launch remote code execution or worm attacks without any user
action. One of the Windows vulnerabilities could expose users to
drive-by malware attacks via the browser, Microsoft warned.
The new version of the GNU GRUB boot loader, 1.97.1,
closes a security hole in the previous version, 1.97, which allowed
passwords be easily circumvented. The password protection is available
in GRUB to prevent unauthorized modification of the boot parameters. Read the full article. [The H Security]
Security researcher and former penetration tester Dino Dai Zovi delivers a lecture at the Polytechnic Institute of New York University on exploiting Windows.
Apple has dropped another mega-patch to cover a total of 58 documented vulnerabilities affecting the Mac OS X ecosystem. The majority of the flaws could allow a remote attacker to gain complete control of an unpatched system, meaning that this update carries an “extremely critical rating.”
The security industry lacks a uniform way to title botnets, and the
result is sometimes a long list of names for the same botnet that are
used by different antivirus vendors and that can be confusing to
customers. As it stands now, the infamous Conficker is also known as Downup, Downadup and Kido. The Srizbi botnet is also called Cbeplay and Exchanger. Kracken is also the botnet Bobax.
Firefox accounted for 44 percent of all browser vulnerabilities
reported in the first half of 2009. In contrast, Apple’s Safari had 35
percent of all reported browser vulnerability, Microsoft’s Internet
Explorer was third at 15 percent and Opera had just six percent share. The 2009 figures stand in contrast to Cenzic’s Q3/Q4 2008 report, where IE accounted for 43 percent of all reported Web browser vulnerabilities and Firefox followed closely at 39 percent. Read the full article. [internetnews.com]
Mozilla has pushed out a new
version of its browser to fix a crash bug inadvertently introduced in its latest Firefox update. Firefox 3.5.5, which Mozilla posted
for download late Thursday, fixes a small number of what the company
called “stability issues” in the release notes that accompanied the
update.
In the year since the shutdown of notorious Web hosting firm McColo, spammers are growing strong. Part of this is the result of improvements by botnet operators. Like anyone who is successful what they do, the people controlling the most powerful botnets in cyber-space learn from their mistakes. Security researchers discussed how.
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
