Vulnerabilities

Microsoft plans to release six security bulletins next Tuesday
November 10 to fix at least 15 serious vulnerabilities that could
expose Windows users to malicious hacker attacks.
According to Microsoft’s advance notice
for this month’s Patch Tuesday, the updates will address gaping holes
in the Windows operating system and the Microsoft Office productivity
suite.  Read the notice from Redmond [microsoft.com]

Facebook and MySpace have fixed errors that could have allowed data to be given out from its subdomains. A Dutch developer, Yvo Schaap, discovered the flaw and wrote on his blog: “A “more invasive and hidden exploit could harvest all the user’s
personal photos, data and messages to a central server without any
trace, and there is no reason why this wouldn’t be happening already
with both Facebook and MySpace data.” Read the full article. [Computerworld]

Guest editorial by Costin RaiuIn every system designed by man, there is always a balance between features, usability and security. While designing pretty, easy to use and secure systems is possible, quite often this is not what the users get, or, worse, this is not what the users want.

A flaw in the SSL protocol that could affect company networks, hosting environments and key machines has security researchers scrambling. The flaw, which requires a hack in to a network to launch, has devastating consequences and implications on database and mail servers. Discovered in August by PhoneFactor, the researchers have been working with ICASI to make an industry-wide fix, which is called “Project Mogul.” Researchers Chris Paget and HD Moore are helping to expose the flaw. Read the full article. [Computerworld]

There is a NULL pointer dereference flaw in the Linux kernel that can be exploited by attackers to gain root access to a vulnerable machine.

Sun Microsystems and Research In Motion have issued critical bug fixes for security issues with their products.  Both updates include fixes for critical security bugs that could be abused by attackers to run unauthorized software on a victim’s computer, although none of the flaws appear to have been publicly known before Tuesday. Read the full story [IDG News Service/Robert McMillan]

Microsoft has reissued a patch for a critical Internet Explorer update, MS09-54 from last month. The new patch targets four critical vulnerabilities, including the scrambling of Web page elements and spawned script errors. The problems affect most versions of IE (IE 5.01, IE 6, IE 7, IE 8, on all Windows operating systems, including Windows 7). Read the full article. [Computerworld]