Report: Reused, Third Party Code Major Sources of Insecurity
A new report out from security testing firm Veracode suggests that reused and third party code is a big source of application insecurity.
Web Security
Researchers Develop Stealth Hypervisor Tool
Researchers at NC State University and IBM have
built a prototype security tool that operates in stealth mode to
determine the security of a hypervisor so as not to tip off attackers. Read the full article. [Dark Reading]
Apple Patches Mac OS X Info Stealing Hole
Apple has pushed out a Mac OS X security update to plug a security hole
that allows access to shared folders without a valid password. Read the full article. [ZDNet]
UPDATE: Engineers at social network Twitter.com plugged a vulnerability in the company’s main Web page after attacks that exploited the hole may have hit more than 500,000 users.
Microsoft is warning customers that it has seen ongoing attacks against the recently disclosed padding oracle vulnerability in ASP.NET and is encouraging them to implement a workaround that will help protect against the publicly disclosed exploit for the bug.
UPDATE– Within an hour of reports surfacing about a cross-site scripting bug on the Twitter home page, a worm exploiting the bug was released on the site. However, engineers at Twitter have repaired the bug and say that it no longer should be exploitable.
Canonical has released updated kernels for Ubuntu versions 10.04 LTS, 9.10, 9.04, 8.04 LTS and 6.06 LTS to close the recently discovered holes in the Linux kernel. The updates are also for the equivalent versions of Kubuntu, Edubuntu and Xubuntu and should be available through Ubuntu’s Software Update system. Read the full article. [The H Security]
Google has added a two-factor authentication mechanism to the login procedure for its Google Apps offerings, hoping that the addition will help cut down on the amount of fraudulent activity on these accounts.
By Costin RaiuWhen iPhone jailbreaking was declared legal earlier this year, Apple fans from all around the world rejoiced. Sites such as Jailbreakme.com, which allowed for the simple and straightforward jailbreaking of older iPhones, became very popular.
Microsoft has issued a security advisory for a recently disclosed vulnerability in the ASP.NET that could leave millions of Web pages vulnerable to attack.
