93 Vulnerabilities Found in VMware
VMware has advised of a total of 93 vulnerabilities in several of its products, including ESX Server, Server, VirtualCenter and vCenter. Read the full article. [The H Security]
Web Security
Facebook XXX Worm Replaces Profiles
Security researchers have identified a new worm spreading across
Facebook, luring people out to adult Web sites and automatically
replicating itself across people’s profile pages. Read the full article. [internetnews.com]
Opera Fixes Vulnerability with Latest Upgrade
With version 10.10 (Opera Unite) of its browser, Opera has fixed a format string vulnerability which can potentially be exploited to compromise systems. Read the full article. [The H Security]
Researchers, analysts and experts weighed in on what they believe will be the security features of IE9 at the PDC Developer’s Conference. Read the full article. [eWEEK]
Engineering researchers at the University of Arkansas have developed a
unique and robust method to prevent cloning of passive radio frequency
identification tags.
Dennis Fisher and Ryan Naraine discuss the security bits of the Google Chromium OS, Microsoft finding a flaw in Google Chrome Frame, the Adobe Flash controversy and the ridiculous end to the France v. Ireland World Cup qualifier.
The latest version of Microsoft’s Internet Explorer browser contains
a bug that can enable serious security attacks against websites that
are otherwise safe. The flaw in IE 8 can be exploited to introduce XSS, or cross-site
scripting, errors on webpages that are otherwise safe. Read the full article. [The Register]
At the SecurityByte & OWASP AppSec Conference in India, Roberto Suggi Liverani and Nick Freeman offered insight into the substantial danger posed by Firefox extensions. Mozilla doesn’t have a security model for extensions and Firefox fully
trusts the code of the extensions. There are no security boundaries
between extensions and, to make things even worse, an extension can
silently modify another extension. Read the full article. [Help Net Security]
The latest release (PHP 5.3.1) features the addition of the “max_file_uploads” INI
directive, which can be used to limit the number of file uploads for
each request to 20 by default. By limiting the number of uploads
per-request, users can prevent possible denial of service (DoS)
attacks. Missing sanity checks around EXIF (exchangeable image file format) processing have also been added. Read the full article. [The H Security]
Three alleged members of the hacker gang Kryogeniks were hit with a
federal conspiracy charge for a 2008 stunt that replaced
Comcast’s homepage with a shout-out to other hackers. Prosecutors identified Christopher Allen Lewis, 19, and James Robert
Black Jr., 20, as the hackers “EBK” and “Defiant,” known for hijacking
Comcast’s domain name in May of last year — a prank that took down the
cable giant’s homepage and webmail service for more than five hours,
and allegedly cost the company over $128,000. Read the full article. [Wired] Read the Federal indictment.
