Vulnerabilities

There will be no April 1st Conficker outbreak

By Joe Stewart, SecureWorks

If you’ve been reading any news at all on the Internet in the past week, you’ve probably heard that Conficker Armageddon is approaching, and it’s scheduled for April 1st, only a few days from now.
The truth is, there will be no April 1st outbreak, despite what some of the press stories have said so far. The only thing that will happen with Conficker on April 1st is that already-infected systems will begin to use a new algorithm to locate potential update servers. There, that’s not so scary, is it? So why all the fuss over the 1st?
Read the full essay [secureworks.com]

Still no fix for TCP DoS weakness

Software vendors and security officials in several countries have been working for nearly six months on a fix for a serious flaw in a number of TCP implementations that caused a lot of controversy and speculation last fall. The problem could allow attackers to consume all of the resources on a given remote server, essentially making it unusable.

Now, it appears that the release of a patch for the weakness may not come for several more months.

Multiple vulnerabilities found, fixed in OpenSSL

The OpenSSL Project has released new versions of its popular implementation of the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols to fix multiple security vulnerabilities.
According to an advisory [openssl.org], the update fixes three security flaws that carry “moderate severity” ratings.  The raw details:

IE8 security stops memory bypass attacks

by Dennis Fisher

When Mark Dowd and Alex Sotirov demonstrated a technique for bypassing Vista’s memory protections at Black Hat last year, the security community was stunned. Microsoft officials said at the time they were working on ways to defeat the pair’s attack and now that protection has arrived, in the form of Internet Explorer 8.

iPhone security comes to the fore

by Dennis Fisher

By Paul F. Roberts, The 451 Group
The security of smartphones such as the iPhone, Windows Mobile devices and the T-Mobile G1 has come under a lot of scrutiny lately. Each device has its own unique security model, and in the case of the iPhone, Apple has kept its platform closed to third-party security vendors. But that’s not stopping some of them from making an end run around Apple and creating their own security applications for the hugley popular device.

Cisco plugs IOS security holes

by Ryan Naraine

By Chuck Miller, SC Magazine
Security updates for Cisco’s Internetwork Operating System (IOS) were released Wednesday [scmagazine.com] to shield against a number of vulnerabilities.
The security issues [cisco.com] are varied and relate to TCP, UDP, mobile and VPN vulnerabilities. In describing one bug, an advisory warned about a problem that could block traffic to a router or even cause it to crash.

Adobe lifts curtains on secret PDF patches

by Ryan Naraine

By Gregg Keizer, ComputerWorld
Adobe Systems Inc. revealed today that it patched five critical vulnerabilities behind the scenes [computerworld.com] when it updated its Reader and Acrobat applications earlier this month to fix a bug already under attack.
According to a security bulletin issued today [adobe.com], the updates to Reader 9.1 and Acrobat 9.1 that Adobe delivered on March 10 included patches for not just one bug — as Adobe indicated at the time — but for five other vulnerabilities as well.

Beware these telecommuting security mistakes

by Ryan Naraine

By Joan Goodchild, CSO

Whether it is employees who travel frequently for their job or staff that work out of a home office full or part-time, their mobility poses serious security risks to your organization. Here are the common mistakes employees often make [csoonline.com] while telecommuting some advice on how to put a damper on them.

Cybersecurity for your growing business
Cybersecurity for your growing business

Topics

Show all

Authors

Threatpost

InfoSec Insider

Infosec Insider Post

Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.

Sponsored

Sponsored Content

Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.