McAfee Apologizes for Bugs in Falcon Roll Out
452780
McAfee says it's sorry for glitches in new security software.
11292
Secunia has found that the number of security bugs in the open source Red Hat Linux operating system and Firefox browsers far outstripped comparable products from Microsoft last year.In a report released this week, Secunia also criticized CA for the quality of the code in its anti-virus products, saying that "inherent" code problems are exposing CA products to ongoing security vulnerabilities.On the other hand, "zero-day" security bugs in Firefox were patched more quickly than in Microsoft Internet Explorer, according to the Secunia 2007 Report, released this week.In a review of the number of vulnerabilities found in enterprise anti-virus vendors' products, Secunia found that CA was by far the leader, with 187 vulnerabilities, followed by Symantec with 73. Trend Micro (34), ClamAV (15), McAfee (13) and F-Secure (6) ranked lower on the list.The high figures for Symantec and CA are partly due to their wide range of products, some of which cover areas other than anti-virus, Secunia said.However, the majority of the CA bugs were due to "inherent code problems with some CA products", Secunia said in the report.Of particular concern is CA's range of ARCServe Backup products for laptops and desktops, which Secunia submitted to its Binary Analysis process after several bugs were reported and fixed. The bugs involved errors in processing particular arguments and requests.The analysis found that about 60 reported bugs were still present in the supposedly patched versions.What's more, the analysis found that the vulnerabilities were partly due to "the nature of the product code itself", Secunia said."Unless an overhaul of the code is undertaken, then the product remains susceptible to similar types of vulnerabilities," Secunia said.However CA said in a statement that it has rigorous quality-control measures in place for its software and continues to improve those measures.A number of the vulnerabilities found in Symantec products were due to their use of vulnerable software from third-party developers, Secunia said.One of these is the Autonomy Keyview SDK (software development kit), used in Symantec Mail to view Lotus 1-2-3 files. The component was reported to have a "highly critical" flaw on 12 December, but hasn't yet been patched, leaving some Symantec products vulnerable.Symantec said in a statement that it has published instructions for mitigating the problem and has issued product updates for some affected vendors. IBM, whose Lotus Notes was also affected by the Autonomy bug, has issued its own patch.Operating systems and browsersOut of the operating systems monitored by Secunia -- Windows (98 and onwards), Mac OS X, HP-UX 10.x and 11.x, Solaris 8, 9, and 10 and Red Hat (excluding Fedora) -- Red Hat was found to have by far the most vulnerabilities, at 633, with 99 percent found in third-party components. (Linux distributions are generally composed mostly of third-party software, which is integrated by the distributor.)Red Hat has taken issue with the figures, claiming the accurate number should be 404 vulnerabilities for last year.Solaris came next, with 252 bugs, 80 percent of which were in third-party components. Mac OS X came after that with 235, 62 percent of which were third-party.Windows had only 123 bugs reported, but 96 percent of those were found in the operating system itself. HP-UX had 75 bugs reported, 81 percent of which were in third-party code.Last week, a US Department of Homeland Security (DHS) bug-fixing scheme uncovered an average of one security glitch per 1,000 lines of code in 180 widely used open source software projects.The large number of Red Hat flaws is partly due to the large number and wide variety of components it includes."Red Hat contains two different browsers and graphic interfaces, a number of PDF readers and image editors, and so on," the report said. "Red Hat, HP-UX, and Solaris can easily be used as servers, and as such include and support a large number of third party components, while the same cannot be said of all versions of Windows and Mac OS X."Any consideration of relative OS security should look at factors not covered by the report, such as average patching time for vulnerabilities, Secunia said.In the browser field, Firefox led the way with 64 bugs, compared to 43 for Internet Explorer, and 14 each for Opera and Safari.However, in an examination of zero-day flaws - reported by third parties before a patch was available - Secunia found that Firefox tended to get more patches, sooner, compared to IE.Out of eight zero-day bugs reported for Firefox in 2007, five have been patched, three of those in just over a week. Out of 10 zero-day IE bugs, only three were patched and the shortest patch time was 85 days.ActiveX was hit by the largest number of browser add-on bugs in 2007, with 339 (compared to 45 last year), Secunia said.The figure was propped up by the Month of ActiveX Controls Bugs in May 2007, and by Secunia's discovery of a vulnerable ActiveX component that was used in 40 different products.QuickTime followed with 35 bugs and Java with 21 bugs.
409923
Swiss cheese IM client menaced by umpteenth zero day bug Trouble came in pairs for instant messenger users this week with the disclosure of unpatched flaws in chat software from both AOL and Yahoo!â¦
520541
Exploit code targets a flaw that generated a government warning last week.
424439
10.3.7 fixes bugs, fills security holes
517744
A vulnerability that McAfee Avert Labs first warned about last week is now being exploited in the wild, according to VeriSign&#39;s iDefense. At issue are embedded objects in Rich Text Format (RTF) files.
268428
McAfee Executive Vice President Bill Kerrigan acknowledged that there had been glitches in the roll out.
713098
The bug fixes kept coming Monday, as Apple shipped critical security updates for its Mac OS X operating system.The latest security updates fix 11&#160;bugs in the Mac operating system, including eight bugs in the recently released Mac OS X 10.5, known as &quot;Leopard.&quot; Apple released the security fixes in conjunction with an 10.5.2 update to Leopard, which includes dozens of other updates.Some of the security flaws are extremely serious, and could be exploited by hackers to run unauthorized software on a victim&#39;s computer, although Apple did not report any incidents of this occurring.The patches include fixes for Safari, Mail, Launch Services, the Mac OS Directory Services, Open Directory and Parental Controls. There are also patches for several Unix components that ship with Apple&#39;s software, including a recently patched flaw in the Samba file-and-print software.&quot;The Samba bug was expected, since all the open-source distributions released fixes a while ago,&quot; said Andrew Storms, nCircle&#39;s director of security operations, via instant message.It&#39;s been a busy time for software developers working on some widely used software products.Apple&#39;s patches come a day before&#160;Microsoft is set to issue a massive set of updates&#160;itself. Last week, the software vendor said it expected to release 12 security updates for a variety of products including critical updates for Windows, Internet Explorer and Office.Last week other&#160;critical patches were also released for Adobe Reader&#160;and Apple&#39;s QuickTime media player.&#160;
239684
Flaw filler Wall Street darling VMware released patches that address multiple vulnerabilities in its products this week.â¦
522714
(InfoWorld) - oMicrosoft released six sets of security patches Tuesday that address critical flaws in its products, including a bug in Active Directory software. The software vendor also fixed critical vulnerabilities in Excel and the .Net Framework as well as less-critical bugs in Microsoft Office Publisher, Internet Information Services (IIS), andÂ the Vista firewall. The six updates addressed a total of 11 bugs. The MS07-039 Active Directory update, which is for Windows 2000 Server and Windows Server 2003 systems, should be at the top of enterprise IT administrators' lists, said Eric Schultze, chief security architect with Shavlik Technologies. "That one scares me because those are the crown jewels there. And it looks like you're caught with your pants down at the moment." The flaw deals with the way Active Directory processes LDAP client requests. Attackers could create a malicious LDAP request that would then allow them to "take complete control of an affected system," Microsoft warned in its advisory on the flaw. Active Directory enables LDAP by default, but there are factors that mitigate a possible attack. The flaw can be exploited by an anonymous user attacking a Windows 2000 Server, but with Windows Server 2003 a hacker would need to have user credentials for the attack to work. Also, Windows Active Directory servers are typically protected by the firewall, so the attacker would most likely have to be inside the corporate network, Schultze said. The Excel and .Net Framework updates each fix three vulnerabilities in these products and are both rated critical by Microsoft because they could be exploited by attackers to install unauthorized software on a victim's computer. Two of the less-critical patches are also noteworthy. The MS07-041 patch fixes a flaw that could allow an attacker to take over a Windows XP-based Web server by sending specially crafted URLÂ requests. Microsoft rated this flaw as "important" rather than "critical," however, because it only affects XP systems, and IIS is not installed by default on XP. Microsoft also patched a flaw in the Windows Vista firewall. The bug, which is in Vista's Teredo IPv6 tunneling protocol, would allow an attacker to find out if a Vista computer is on the network. Normally the Vista firewall should simply block unsolicited traffic trying to communicate over the Teredo interface. The bug could not be exploited to take over a Vista machine and is considered low risk, Schultze said. "If Teredo is turned on, something within it would give a response back, even though the firewall is turned on," he said. Microsoft has released 41 updates so far in 2007. That's a little ahead of the 39 updates it had released by this time last year.
97191
A Chinese security group has released sample code to exploit two new unpatched flaws in Microsoft Windows. The advisory comes in the week before Christmas, a time when many companies and home users are least prepared to deal with the problems.
727620
A security researcher has found a security bug that could be attacked in Internet Explorer. Mozilla Corp. said it plans to patch the problem in its next Firefox software update.
753365
(InfoWorld) - A security researcher has found a security bug that could be attacked in Internet Explorer. Mozilla said it plans to patch the problem in its next Firefox software update. No, that's not a typo, just the strange fall-out from an unusual bug that had security researchers debating the question this week, "Who's to blame? Microsoft or Mozilla?" Security researcher Thor LarholmÂ kicked off the controversy on Tuesday, claiming that he had discovered a flaw that would let an attacker run commands on a victim's PC. In his blog posting, Larholm said the bug was similar to a flaw he'd discovered last month in Apple's Safari 3.0 beta software, and he called it an an "input validation flaw in Internet Explorer." The problem is with a URL protocol handler component of Internet Explorer, he said. This software allows Internet Explorer users to launch applications such as Excel or Firefox by clicking on specially written links on Web pages. When Internet Explorer clicks on a link that launches the Firefox browser, however, the software does not properly check its syntax, and that, Larholm said, lets an attacker create a malicious link, that could be used in an attack. Security vendor Secunia ApS rates the flaw as "highly critical." So while the flaw affects Internet Explorer users, it appears to be a risk only to those who already have Firefox installed. And to make matters more complicated, if a Firefox user were to click on one of the specially written links, he would not be affected. Still, Microsoft Security Program Manager Mark Griesi said that the bug was not his company's problem. "We don't feel that there's an issue in IE and therefore there's nothing to be fixed," he said Tuesday. With Microsoft saying it won't fix the vulnerability, Mozilla said it would change the way its Firefox URL protocol handler worked in its next Firefox update. That will fix Larholm's bug, but Mozilla security strategist Window Snyder wouldn't say whether or not she considered the vulnerability to be an IE or Firefox problem. She did, however, point out that without Microsoft making changes to IE, other Windows programs may be at risk. Noted browser bug-hunter Aviv Raff wrote in his blog that he thought both Microsoft and Mozilla were to blame. But another security expert said that the responsibility to fix the problem lies with the open-source browser developers. "This is an oversight in how Mozilla decided to construct their protocol registration, and how they do input validation between this handler and their application," said Eric Schultze, chief security architect with Shavlik Technologies, via e-mail. "I think Mozilla needs to write and release a patch for this issue and Microsoft can take the week off."
581203
More anti-virus false alarm madness A dodgy anti-virus update from McAfee on Wednesday wrongly identified legitimate JavaScript files as a virus in the second such screw-up by a major security vendor in less than a week.â¦
544632
How a seemingly simply Microsoft bug betrayed its author's disdain for a wide range of secure coding principles.
116542
(InfoWorld) - For the second week in a row, independent security researchers have fixed a hole in Microsoft Corp.'s software. On Friday, Determina Inc.Â published a free patch for a critical bug in an ActiveX control (called WebViewFolderIcon) that is used by Windows' graphical user interface. Security experts consider the flaw to be critical because it could be exploited by attackers to run unauthorized code on a victim's PC. To make this happen, the victim would have to visit a Web site with Internet Explorer (IE) and allow it to run a malicious ActiveX control. Security researcher HD MooreÂ published details of the bug on July 18, but he recently added attack code that exploited the flaw to his widely-used Metasploit hacking toolkit. Determina says that the availability of the Metasploit code has boosted the risk of attacks. There seems to be no shortage of Windows attacks this week. On Tuesday, MicrosoftÂ issued a rare emergency patch for a separate problem in Outlook and IE's Vector Markup Language (VML) rendering engine, after that flaw was widely exploited by attackers. And criminals have also launched extremely limited attacks that exploit an unpatched flaw in PowerPoint. The VML flaw had first been fixed four days ahead of Microsoft's patch by a group of security researchers calling themselves the Zeroday Emergency Response Team. This latest bug is not likely to be as widely exploited as the VML vulnerability, Moore said. "This bug is not as severe as the VML flaw, since it depends on ActiveX, and would not be exploitable by default through Outlook," he said in an e-mail. Nevertheless, Microsoft found the issue to be serious enough to meritÂ a security advisory, published Thursday. Microsoft plans to patch the WebViewFolderIcon flaw in its next scheduled set of security updates, due Oct. 10. So far, Microsoft doesn't know of "any attacks attempting to use the reported vulnerability or of customer impact at this time," the security advisory states. Microsoft does not recommend that users install third-party patches, because this software has not gone through the rigorous quality assurance testing process that Microsoft applies to its security updates. Determina's patch works on Windows 2000, XP and 2003 systems. Â
573204
Unsanity on Sunday apologized for problems some of their customers experienced when their application-enhancement framework software critically conflicted with Apple's new Leopard OS, but the firm still claims only PowerPC-based Macs running two-year-old APE could have blue-screened.