Time Warner Router Flaw Exposes Customers
There’s a rudimentary vulnerability in a cable modem/wireless router installed in tens of thousands of homes by Time Warner that could enable an attacker to get full access to the router quite easily.
Vulnerabilities
Windows 7 Security Story May Appeal to Enterprises
Microsoft Windows 7 is on its way tomorrow, and it is bringing with it a set of security features Microsoft hopes will appeal to enterprises.The Windows 7 security story has three main chapters that have received a fair amount of attention – DirectAccess, BitLocker To Go and AppLocker. With these, capabilities like Branchcache and enhancements to features like user account control (UAC), officials at Microsoft feel they are pushing out their most secure operating system yet. Read the full story [eWEEK/Brian Prince]
WordPress Zaps Security Bugs in ‘Hardening Release’
The WordPress blog software has been upgraded to version 2.8.5 to backport a number of security hardening changes to make WordPress-powered blogs more secure.Here’s a glimpse of some of the security fixes being pushed out:
Virtualization software specialist VMware has shipped a massive batch of critical security updates to cover 48 security holes in a wide range of
its server and workstation products.
The growing use of social networking sites is leaving PC inadvertently open to identity thieves warned Hugh Thompson, chief security strategist at People Security.
Speaking at the RSA Europe Conference, Thompson said that people were unaware just how many clues they left for fraudsters. He said such carelessness was fuelling the rise of cybercrime. He told the conference about the way he managed to access one of his wife’s friend’s bank account in a couple of hours using publicly available data – a process that he had previously documented in a Scientific American article. He warned that most people’s private accounts could be accessed in this way. Read the full article [Techworld/Maxswell Cooter]
Oracle has released its Critical Patch Update for October 2009 to address 38 vulnerabilities across several database and server products. The update contains the following security fixes:
The U.S. Government Accountability Office (GAO) has painted a bleak picture of the NASA’s IT security posture.
An audit of the space agency’s computer systems found weaknesses in
several critical areas, especially in the way NASA implemented access
controls like user accounts, passwords and the encryption of sensitive
data. Here’s the gist of the audit findings:
Adobe isn’t the only software vendor struggling to cope with security vulnerabilities in PDF reader applications. According to reports, there are numerous PDF applications — including Foxit Reader and Xpdf — that allow attackers to infect systems with malware.
Mozilla temporarily added the dangerous Microsoft .NET Framework Assistant add-on to its blacklist over the weekend, a move that effectively disabled the dangerous extension and plug-in for all Firefox users. However, after some clarifications from Redmond, the add-on was unblocked.
Microsoft is blaming human error for the the critical SMB v2 vulnerability that exposed Windows users to remote code execution attacks and argues that it’s near impossible to catch these types of bugs with existing code review tools and techniques.
