Ryan Naraine

Here’s a quick update on the Adobe Reader silent fix I wrote about earlier today. Adobe spokesperson John Cristofano sent me a statement confirming the severity of the vulnerability fixed with Adobe Reader 8.1.2 and promising that a detailed bulletin is on tap for release later. Here’s the full statement. “On Feb. 6, Adobe made […]

Two days ago, Apple released iPhoto 7.1.2 to patch a format string vulnerability that was found and reported by Ernst & Young researcher Nate McFeters. The language in the advisory from Apple sounds pretty scary: “A format string vulnerability exists in iPhoto. By enticing a user to subscribe to a maliciously crafted photocast, a remote […]

Apple has issued a patch for a high-profile vulnerability in its flagship QuickTime media player, acknowledging that the bug could lead to drive-by malware installations on Windows and Mac machines.With QuickTime 7.4.1, the company provides cover for a heap buffer overflow in QuickTime’s handling of HTTP responses when RTSP (Real Time Streaming Protocol) tunneling is […]

Adobe has released a software fix for what’s described simply as “security vulnerabilities” in its ubiquitous Adobe Reader program, but has not issued public documentation on the risk severity. The absence of a bulletin with details and severity ratings has raised eyebrows in the security research community.The patch, included in Adobe Reader 8.1.2, plugs at […]

For the first time since people started keeping track of this stuff, 2007 saw a noticeable decline in publicly reported security vulnerabilities. In fact, according to data from IBM ISS X-Force, there was a 5.4 percent decline in new vulnerability disclosures from the previous year, a drop that could represent an anomaly, a statistical correction […]

Blogging software provider WordPress has shipped an “urgent” security update to fix an XML-RPC implementation flaw that allows unauthorized third-party editing of blog posts. With WordPress 2.3.3, the open-source company patches a bug that could let attackers use specially crafted requests to edit posts of any other user on that blog. An attacker would need […]

As a follow up to two separate stories I wrote on vulnerable ActiveX controls affecting high-profile Web sites, here’s a quick primer on configuring Internet Explorer to handle ActiveX controls in a safe way. These recommendations come from the US-CERT (Computer Emergency Response Team) and have been modified slightly for IE 7, the most up-to-date […]

The US-CERT is urging Web surfers to immediately disable ActiveX controls from Internet Explorer to protect against a swath of publicly reported-and unpatched-software vulnerabilities.The US-CERT (Computer Emergency Response Team) recommendation follows the release of exploit code for multiple zero-day flaws in image uploaders used by Facebook and MySpace and bugs in the ActiveX control that […]

Security researchers have raised an alert for serious security problems with the MySpace and Facebook image upload feature. According to a warning from Symantec’s DeepSight threat analyst team, the issue centers around a buffer overflow in the ‘Action’ property of multiple ActiveX controls that’s used in the image upload process for the two popular social […]

The Google-backed StopBadware.org project has slapped a “badware” label on the widely deployed RealPlayer media player for problems associated with disclosure and uninstallation. For the most part, the non-profit group has reserved the badware label for sketchy spyware-related products but, in a new report, StopBadware.org singles out RealNetworks for failing to disclose that RealPlayer 10.5’s […]

More than a month ago, on Dec. 16, 2007, a Russian security research firm released an exploit for a zero-day vulnerability in RealNetworks’ RealPlayer software into a subscription-only exploit package. The vulnerability, which still exists in the most up-to-date version of the cross-platform media player, is still unpatched because RealNetworks has been unable to get […]

Microsoft has announced plans to add new anti-exploitation APIs into Windows Vista SP1, Windows XP SP3 and Windows Server 2008 as part of a larger plan to secure the Windows ecosystem. According to Michael Howard, a senior program manager in Microsoft’s security unit, the delivery of the new NX (/noexecute) APIs significantly lowers the barriers […]