SANS Unveils 2004&#39;s Top 20 Internet Vulnerabilities
454135
The security research group The SANS Institute on Friday released its annual Top 20 list of the most critical Internet-related vulnerabilities to give organizations a way to prioritize their defensive efforts.
572892
Four new unpatched vulnerabilities have been published for Internet Explorer and Firefox, with two coming for each browser.
44372
A flaw in the way the Firefox and Opera browsers handle an image file could allow an attacker to see what Web sites a person has visited.
320458
Web servers may be vulnerable to attack, security company warns.
716663
Networked multifunction devices share PC vulnerabilities to worms, hackers.
49531
Microsoftâs monthly security bulletin has uncovered a âcriticalâ buffer overrun vulnerability that exists in the processing of JPEG image formats.
606239
year in review Phishing scams and PC-compromising viruses were the dominant security threats in 2004.
683385
Many popular browsers are affected by a vulnerability that makes it easy to spoof the content of websites, security firm Secunia warns.
24345
IT security and research organization The SANS Institute is set to release its annual Top 20 list of Internet security vulnerabilities on Friday, with the intention of offering organizations at least a starting point for addressing critical issues.
376860
Security advisory service Secunia said that it has discovered a highly critical vulnerability in Microsoft Word 2000 and 2002 that can be exploited to cause a denial of service attack and compromise a user&#39;s system.
158022
In recent years, buffer overflows topped the list as the most popular vulnerability used by hackers to compromise websites. However, the latest report from Mitre Corp., a U.S.
331980
InfoWorld - A security researcher has found a serious vulnerability in an aging yet widely used software program used for the Internet&#39;s addressing system, prompting the software&#39;s maintainers to retire the affected version.
299
Updated: A &quot;cumulative security update&quot; plugs eight holes in the Internet Explorer browser, while other patches address &quot;critical&quot; vulnerabilities in the Windows shell, in SMTP and elsewhere.
214591
(InfoWorld) - The SANS Internet Storm Center on Friday raised its threat level to yellow after observing an increase in the number of Internet-based attempts to exploit a zero-day vulnerability discovered earlier in the week. Dozens of Web sites are exploiting the vector markup language and the number is growing, said Ed Skoudis, a SANS incident handler. The vulnerability, discovered Monday by Sunbelt Software, is also being exploited by an unknown volume of e-mail, he said. The VML exploit, which allows the remote execution of code, is worrisome to security experts because the only action required for infection is viewing a malicious Web site using Internet Explorer or viewing a specially formatted HTML e-mail with Outlook. So far, there are no reports of trusted Web sites trying to exploit the vulnerability. "We're anticipating that somebody is going to pop a trusted site and then we'll have a big problem," said Skoudis. "We went to yellow so people will do work-arounds." Microsoft said earlier this week it was aware of the problem and planned to issue a patch next month during its regularly scheduled update, "or sooner if necessary." Among the work-arounds is a patch being made available by the Zeroday Emergency Response Team (ZERT). The group also offers a Web page to test whether a machine has successfully been patched. Other temporary remedies include unregistering vgx.dll, the dll file that is targeted in attacks, or simply not using Internet Explorer and Outlook. Scott Deacon, a program manager with Microsoft's Security Response Center, said on the company's Web site that attacks remain limited. "Thereâs been some confusion about that, that somehow attacks are dramatic and widespread," Deacon wrote. "Weâre just not seeing that from our data, and our Microsoft Security Response Alliance partners arenât seeing that at all either." Microsoft cannot vouch for the quality of third-party fixes, and users should always install Microsoft updates as soon as they become available, Deacon added. But other groups also warned that the VML vulnerability was becoming a bigger target. Websense Security Labs said it has monitored attacks that include Trojan backdoors and code that is designed to steal information from end-user machines. Several Web sites are publishing example code, making it easier for others to pull off an attack, Websense said on its Web site.
472677
Zero-day flaw, which is could let attacker gain remote access to a system, affects Word 2000, 2002 and 2003 and Word Viewer 2003.
737101
Dubbed MyDoom.AH by security firms, this latest variant in the MyDoom family of worms is exploiting the recently publicised vulnerability in Microsoft Internet Explorer&#39;s (IE) IFRAME buffer overflow.
111115
Blog: The most serious vulnerabilities allow attackers to run code on compromised machines.