Ryan Naraine

3Com Corp.s announcement that its Tipping Point division would start paying for the rights to security flaw information found by private researchers has reignited an old debate: Should underground hackers benefit from breaking into software systems? Tipping Points new ZDI (Zero Day Initiative), which will take center stage at the Black Hat Briefings in Las […]

Microsoft customers interested in disabling the automatic download of Windows Server 2003 Service Pack 1 have only a few days left to install the companys temporary blocking tool. Microsoft will start delivering the service patch through Automatic Updates starting July 26, 2005, but there is a “blocker tool kit” that lets companies stop that specific […]

Microsoft has acquired a minority stake in Finjan Software, an Internet security firm with which it has had a contentious relationship. Financial terms of the transaction and the size of Microsoft Corp.s equity stake were not released. The deal was part of a non-exclusive patent licensing agreement that lets Microsoft use select Finjan Software Inc. […]

Anti-virus vendor Trend Micro on Wednesday issued a warning for a new computer worm infecting users of America Online Inc.s Instant Messenger application. The worm, identified by Trend Micro Inc. as W32/Opanki, spreads by tricking users into clicking on a file named after Apples popular iTunes music service. “This worm arrives as the file ITUNES.EXE,” […]

A German database security outfit on Tuesday went public with information on six unpatched vulnerabilities—some rated critical—in Oracle Forms and Oracle Reports, two widely deployed enterprise-facing products. Red-Database-Security GmbH, a company that specializes in Oracle security audits, warned that the most serious flaw could allow a malicious hacker to use a Web browser to overwrite […]

A gaping security hole in a popular Firefox browser extension could allow malicious hackers to hijack files from a users hard drive, developers warned Tuesday. The vulnerability was flagged in Greasemonkey, the Firefox add-on that allows users to load custom scripts that modify Web sites on the fly. The flaw is so serious that developers […]

Microsoft plans to integrate rootkit detection technology from its Strider Ghostbuster research project into future versions of the Windows AntiSpyware application, Ziff Davis Internet News has learned. Strider Ghostbuster, a prototype tool developed by Microsoft Corp.s Cybersecurity and Systems Management Research Group, provides a straightforward way to detect Windows rootkits by comparing scan results between […]

POSSIBLE IE BROWSER BUG A private security researcher has discovered a possible remote code execution bug in the way Microsoft Corp.s Internet Explorer browser renders certain images. Researcher Michal Zalewski warned in a mailing list entry that during a 30-minute experiment, he found a bug in the browsers image decompression and parsing routines. “This experiment […]

The Microsoft Security Response Center late Saturday released a security advisory to offer pre-patch workarounds for a denial-of-service flaw in Windows XP Service Pack 2. The companys advisory follows the public disclosure of the vulnerability in Remote Desktop Services, a feature that allows XP users to remotely control computers from another office, from home or […]

Microsoft has acknowledged that it is working on a patch for a potentially serious security hole in fully patched versions of Windows XP Service Pack 2. The software makers confirmation follows public disclosure of the vulnerability by a private security researcher who goes by the moniker “badpack3t.” In an advisory posted at SecurityProtocols.com, the researcher […]

Patch Tuesday this month was an IT administrators worse nightmare. Microsoft Corp. patched three “critical” flaws. Oracle Corp. plugged 49 database server holes. The Mozilla Org. fixed a dozen fairly serious Firefox and Thunderbird bugs. Apple Computer Inc. applied security stripes to Tiger. Cisco Systems Inc. corrected denial-of-service flaws in CallManager. And the list goes […]

Microsoft Corp. on Tuesday released a fix for the underlying code execution vulnerability affecting users of its flagship Internet Explorer browser. As part of its monthly patching cycle, Microsoft shipped three security bulletins, all rated critical, including patches for a bug in the JView Profiler (Javaprxy.dll) that was being exploited via the IE browser. The […]