Comodo lets consumers 'hunt' buffer overflow bugs
107521
BO test bit whiffy Security firm Comodo, best known for its digital certificate business, has released a free diagnostic tool designed to identify buffer overflows in desktop security products. Our try-out, however, suggests that Comodo's BO Tester is principally designed to help poach users than provide a detailed breakdown of bugs.â¦
103702
Blog: Many of the patches address flaws within QuickTime for Java.
620094
roundup Free-roaming source code breeds new Netsky pest. Also: From IE to Opera, browsers are a likely prey.
18022
(InfoWorld) - Fortify SoftwareÂ and the FindBugs project have launched a free service that will scan open-source Java software for bugs in the code. The Java Open Review project (JOR) lets open-source projects run audits of their source code using Fortify's source code analysis software and the University of Maryland's FindBugs tool. With developers focusing on more secure software development practices, the Java community needs more advanced bug-finding tools like JOR, said Barmak Meftah, vice president of product and services, with Fortify. "Everybody understands that the cheapest and easiest point to find and fix security bugs is at the time of implementation," he said. Open-source developers will now get the benefit of Fortify's Source Code Analysis software, which is already used by commercial vendors such as Oracle and Adobe Systems. But the free JOR analysis is not as detailed as one done by Fortify's commercial product. Fortify Source Code Analysis can find more than 120 categories of software security problems, Meftah said. The JOR analysis will detail about 40 categories, covering "the most egregious types of security vulnerabilities and the types that developers tend to understand most readily," he said. The details of the free source code analysis will be made available only to project contributors so that JOR cannot be used as a hacking tool, Meftah added. JOR has been working with a handful of open-source projects over the past six weeks and has discovered hundreds of bugs in applications like Tomcat, Zimbra and Java Pet Store. On Monday, the service will be opened up to any Java open-source projects that want to use it, Meftah said. Sun Microsystems already uses FindBugs for its GlassFish open-source application server software, said Geoff Halliwell, a manager of application server quality engineering with Sun. Though Sun has no immediate plans to audit its application server code with JOR, Halliwell said he would "certainly look at it." "In my business, we're always looking to improve," he said.ADVERTISEMENTNEW IT SERVICES FROM IBM: EASIER TO BUY AND IMPLEMENTDiscover a simpler, more cost-effective way to get the solutions your company needs to grow more flexible and efficient.
90155
Based off of a previous article from Mike Willbanks, Stuart Herbert has posted some of his own thoughts on tuning and tweaking your applications for the best performance you can get out of them.   There's some good advice in there, and I thought it'd be a good idea to quickly add a bit more detail about the separate approaches that Mike raises.   He goes over the APC caching, memcache, the "gzip trick", the "Not Modified" header and optimized SQL statements.   He also mentions one thing that Mike didn't mention - a split between static files (no PHP needed) and their dynamic cousins. Having a more pure Apache (no PHP installed) can help give a minute jump in speed that, depending on the size of the site, could really add up from a user's perspective.
496780
Lorenzo Alberton has posted some updates about the PEAR packages that he maintains to his blog today including MDB_QueryTool, Mail_Queue2, MDB2, and Translation2.   Even if lately I've been coding way more in C/C++ than in PHP, I still keep an eye on PEAR developement: I reckon in the last month I've closed a bug a day, on average. And after my last call for help about my PEAR packages, I'm also pleased to announce that someone did indeed offer a hand. I'm happy to welcome not one, but two new developers!   Each of the items has links to their PEAR homepage and a few quick words on where the package stands (including developers involved or wanting to get involved). He also reminds developers out there that they can help out too if they want to jump in and get into PEAR.
739909
(InfoWorld) - Hackers are hitting paydirt in their search for browser bugs. According to Symantec's twice-yearly Internet Security Threat Report, hackers found 47 bugs in Mozilla's open-source browsers and 38 bugs in Internet Explorer (IE) during the first six months of this year. That'sÂ up significantlyÂ from the 17 Mozilla and 25 IE bugs found in the previous six months. Even Apple's Safari browser saw its bugs double, jumping from six in the last half of 2005 to 12 in the first half of 2006. Opera was the only browser tracked by Symantec that saw the number of vulnerabilities decline, but not by much. Opera bugs dropped from nine to seven during the period. And while Internet Explorer remained theÂ most popular choice of attackers, no one is invulnerable. According to the report, 31 percent of attacks during the period targeted more than one browser, and 20 percent took aim at Mozilla's Firefox. "There is no safe browser," said Vincent Weafer, senior director with Symantec Security Response. "If you've got a browser, make sure you're configuring it correctly," he added. "That's a far better strategy than running some browser just because you haven't heard of it." Part of the rise is due to the growing market for vulnerabilities, Weafer said. Legitimate companies such as 3Com's Tipping Point and Verisign' s iDefense pay for this information, and there is also a growing black market for exploits. "People are encouraged and getting money for finding vulnerabilities, so now you have more people looking," said Weafer. Browser bugs are also relatively easy to find and exploit, said Marc Maiffret, chief technology officer with eEye Digital Security. "Everyone has realized that targeting the applications on the desktop is a better way to break into businesses and consumers and steal things than server flaws," he said via instant message. Businesses and consumers may both be targets, but home users are the victims in about 86 percent of all attacks, according to Symantec. And the U.S. is the biggest source of online attacks, thanks to its large number of compromised machines with broadband connections, Weafer said. About 37 percent of all online attacks originate in the U.S., he said. While there may have been more bugs in Mozilla than in IE, Symantec gave the open-source project high marks for its bug-fixing. On average, it patched bugs within one day of their public disclosure -- the fastest turn-around of all measured browsers. Opera came in second, averaging two days. Safari was next, with a five-day window, followed by Microsoft, which averaged nine days per patch. Microsoft may lag as a browser patcher, but when it comes to operating systems, the company leads the pack, according to Symantec. The slowest? Sun Microsystems.
112205
Software update patches bug in wireless drivers that left systems vulnerable.
2750
On DevShed today, there's the second part in a two part series (another excerpt from the "Zend PHP Certification" from Zend) talking about getting the most out of your application and platform through some simple debugging/optimizing tools.   They start off with a look at debuggers - what they're for and a brief mention (high level) of how to use them. Next up is some simple suggestions for optimizing the performance of your application:  Hardware issues Web server issues Avoid overkill Zip it up Database optimizations  They also include a simple recommendation that all developers, looking for performance boosts or not should follow - "keep your code simple".
740071
A closer look at some behind-the-scenes tweaks for speeding up page loads, reducing memory drain and making the interface behave the way you want it to.
275619
Travis Swicegood is teasing us with some output from a script in his latest blog post:   So my free time of late (what there is of it) has been spent on a project that's getting really close to v0.1 release. In other words, its first functional release. If you've ever run a test using the PEAR installer or know what a .phpt file looks like, you might be able to guess what I've been up.   Keep an eye on his blog for more information on his "secret project".
86929
In a new post to his Oracle blog today, Christopher Jones talks about a bug that's been found in the OCI8 extension involving statement caching and a fix he's presenting.   As part of some testing we were doing, we found that PHP's OCI8 extension had a bug in the way it used Oracle's statement caching. The fix is already in CVS and will be generally available in PHP 5.2.4. After a short period for you to send me comments, Antony Dovgal will also build a new PECL snapshot of OCI8.   He explains the issue, a problem attributed to the switching of a "hard pause" and "soft pause" when the script caching connects to the Oracle database server. This caching feature is enabled by adding an "oci8.statement_cache_size" value in your php.ini file (and has a default size of 20).    If you've been having issues with this request caching and want to get the fix right away, grab it from the CVS. Otherwise, keep an eye out for PHP 5.2.4 coming soon to correct the issue.
444532
Ten security flaws found in Firefox browser, Thunderbird e-mail client.
552298
PC Magazine - Opinion: CPUs, like software, have always had bugs. The security implications of this are a relatively new problem, and open-source users may be at a disadvantage.
767079
After struggling with it for a good while, Maggie Nelson finally figured out the answer to her problems with Oracle, PDO and CLOBs - they're just not supported.   LOB support was added to PDO_OCI in PHP 5.1. This is really cool, however, it appears that the LOB support really means BLOB support. After much investigation and self-doubt (e.g. "what if we're using streams incorrectly?"), we found out that PDO_OCI does not currently support CLOBs (BLOBs only!).   The bug's already been documented and remains open, but Maggie encourages all of the Oracle developers out there with the fact that Chris Jones (of Oracle) knows about the issue and plans to correct it in the next release of the extension.
158022
In recent years, buffer overflows topped the list as the most popular vulnerability used by hackers to compromise websites. However, the latest report from Mitre Corp., a U.S.
568430
Developer launches a Month of PHP Bugs project with 11 bugs in five days.