Lisa Vaas

Oracles up for being a whipping-boy at Black Hat 2007 Washington, Feb. 28-March 1, with two briefings dedicated to Oracle security and/or insecurity. Cesar Cerrudo, founder of information security service firm Argeniss, is expected to release at least one zero-day vulnerability and exploit code for an Oracle product during his presentation, called “Practical 10-Minute Security […]

The most critical flaw in Firefox hasn’t been addressed in the update released today. Mozilla’s out with Firefox updates and is urging that customers upgrade immediately to fix critical security holes and stability issues. Issued today were Firefox 1.5.0.10, Firefox 2.0.0.2, and Thunderbird 1.5.0.10, available for Windows, Mac and Linux at getfirefox.com and getthunderbird.com. Mike […]

And so it begins anew: Microsoft’s security problems. In what looks to be the first remotely exploitable bug in an Office 2007 application, Microsoft is now working with eEye Digital Security to dissect a high-severity flaw in Publisher 2007 that could let an attacker hijack a PC. “This would be the first publicly reported vulnerability […]

Security analysts have been predicting that kernel rootkits, which cloak their activity by replacing a portion of a programs software kernel with modified code, are expected to continue to grow in frequency in 2007. While rootkit-fighting technologies such as the PatchGuard kernel protection system built into 64-bit versions of Microsofts new Windows Vista operating system […]

Polish hacker Michal Zalewski has found yet another flaw in Mozilla’s Firefox browser, this one having to do with memory corruption and possible system takeover. While he was at it, he also found an IE flaw that sets up malicious pages that won’t let visitors leave. And that taunt the trapped user while they’re at […]

Why is it the only one there? It sure isn’t because of its track record of popping up in US-CERT for vulnerability warnings, at least as of today! My former colleague and security blogger hero, Ryan Naraine, pointed out today that Microsoft’s just-released list of Vista-compatible apps lacks the anti-virus heavyweights: CA, Symantec, eTrust, McAfee. […]

Cisco yesterday posted two security advisories: one on certain Cisco Unified IP Conference Station and IP Phone devices that contain vulnerabilities that may allow unauthorized users to gain administrative access to vulnerable devices, and another about multiple vulnerabilities, including privilege escalations and information disclosure, in the 802.1X authentication standard. The IP phone and Conference Station […]

Websense Security Labs researchers have caught a somewhat rare insight into an interface used by an attacker to control infected systems in a bot network. Websense discovered the new malicious Web sites yesterday, using the company’s ThreatSeeker technology. The sites are designed to install Trojan horse bots that seek out banking credentials for more than […]

Whats in store for Black Hat Feb. 28-March 1? Weve got digital forensics—will Jim Christy, forensics expert to the DOD, challenge attendees to break the encryption of the hardware encryption chip used by Vista? Maybe—stay tuned, because he tells me theres definitely going to be some kind of challenge! Then weve got new and better […]

The open-source Snort intrusion detection and prevention system and Sourcefire Intrusion Sensor IDS/IPS are vulnerable to a stack-based buffer overflow, which can result in remote code execution, IBM’s Internet Security Systems division has advised. IBM ISS posted the flaw on Feb. 19 (link to IBM ISS’ advisory requires registration). Sourcefire has updates on hand to […]

Microsoft has another IE vulnerability on its hands. But is it a flaw, or is it a feature? IE’s been having a miserable time of late, starring in scads of headlines about security flaws. Most recently came last week’s monthly security bulletin, a package of fixes for 20 individual problems in Microsoft products. Included in […]

Websense Security Labs is reporting a Trojan packed into an e-mail that claims that Australia’s Prime Minister has suffered a heart attack. Websense says the Trojan monitors all of a user’s activity online, keeping track of Web sites visited and keylogging “everything you do,” according to Websense’s e-mail alert of Feb. 19. The Trojan includes […]