Solaris zero-day vulnerability goes wild
507966
Worm turns Sun Microsystems has urged users to update and secure their Solaris 10 installations after a recently discovered zero-day vulnerability was found in the wild.â¦
165416
The release of Solaris 10 11/06 is intended to make Solaris the most secure operating system in existence, Sun officials said.
9540
The Hardened-PHP Project has released a new vulnerability for the PHProjekt groupware software.    While searching for applications that are vulnerable to a new class of vulnerabilities inside PHP applications we took a quick look into the current PHProjekt source code and discovered that a (remote) include vulnerability had been (re)introduced.   By overwriting a variable with user input it is possible to inject and execute arbitrary PHP code. Overwriting this variable is possible regardless of the register_globals setting.    They give a few more details further down the posting and note that users should download and install the latest version (at the time of this post, 5.1.2).
97619
(InfoWorld) - Attackers have targeted the zero-day VML vulnerability on an unknown number of Windows-based machines, using a layered approach that first involved exploiting a hole in cpanel, an application that's popular with Web hosting services. AccordingÂ to posts on the support forum of HostGator, criminals accessed the company's servers using the cpanel hole, which was also a zero-day vulnerability. Once in, they planted code on many of the Web sites of HostGator's customers. End users who used Internet Explorer to visit those sites and had not followed work-around procedures were then infected with a virus, which attacks vector markup language in Windows. "The person or group that did this is very intelligent, and obviously knows how to plan a big attack," a HostGator official wrote in the forum. "Since this exploit could have worked on anyone running cpanel it had nothing to do with how secure we were. We suspect it was done by someone in china as we have a small piece of information supporting this." HostGator says the vulnerability in cpanel has been patched. The attack demonstrates the growing sophistication of computer attacks. According to HostGator, the cpanel vulnerability was discovered about a month ago, leading officials to speculate that the attackers waited for a zero-day to emerge before exploiting it.ADVERTISEMENTMAKE SOA REAL WITH IBM WEBSPHERE PODCASTStreamline processes and maximize efficiency within a proven service oriented architecture. Take back control of your business processes with IBM WebSphere.
576139
eTrust Antivirus mistook a critical security process for malware.
763575
Ilia Alshanetsky posts today about the proposed "Month of PHP bugs" that Stefan Esser is proposing:   It would be interesting to see what issues he discovers, hopefully most of them have already been reported to the PHP Security Team, in which case the upcoming 5.2.1 release will provide a resolution path for affected users.   Hopefully, as Ilia states, the bugs will not turn out to be zero-day vulnerabilities and will instead be smaller issues. Either way, a bug-fix patch will probably soon follow.   Either way, I have to look at this as a free security audit of PHP by someone with a clue about security and ultimately, in the long run it will only make PHP better, even if March is going to be rather busy.
428155
Multicasting migraine Security researchers have identified multiple unpatched vulnerabilities in a widely-used content distribution package.â¦
760426
It took less than 24 hours for attackers to crank out code targeting a Windows 2000 vulnerability.
449710
A security expert has found programming errors in Oracle 11g that left security vulnerabilities.
581853
Proof of concept exploit sparks full disclosure row Security watchers warn that an unpatched vulnerability in RealPlayer poses a severe risk.â¦
467651
A computer worm is using a recently disclosed flaw in Sun Microsystems' operating system to propagate.
620122
Sivar writes &quot;Ace&#39;s Hardware and news.com.com.com report Solaris that 10 has been released. Improvements include a performance-enhanced TCP-IP stack to shed the &quot;Slowaris&quot; moniker and their much-vaunted ZFS (Z File System).
591861
A vulnerability in a Java plug-in from Sun Microsystems used by most web browsers poses a risk for users of IE and alternative browsers alike.
569314
Incoming Security researchers irked at Oracle's tardiness at releasing patches for security bugs plan to name a different vulnerability in Oracle's enterprise software every day for a week in December.â¦
345464
php|architect has a new note about a few PHP vulnerabilities:
455087
COMMENTARY -- Judging by his latest blog entry, Sun COO and president Jonathan Schwartz has something new to keep him up at night -- the growing perception that Solaris x86 is anti-Linux -- anti-GNU/Linux, to be specific.
52789
The flaw exploited by the most recent versions of the worm such as Santy.C or Santy.E is more general than the original, and can occur anywhere a site designer has left the door open for the inclusion of arbitrary files into PHP scripts, reports IDG News