F-Secure hit with anti-virus vulnerabilities
688836
(InfoWorld) - F-Secure has patched several vulnerabilities in its security products, the most critical of which could be used to run unauthorized software on a victim's computer. The most critical of these bugs affects F-Secure's anti-virus products. A flaw in the way the software unpacks files that have been compressed using the LHA archiving format could allow an attacker to crash the system, or even run unauthorized software on the computer, F-Secure said in an advisory, published Wednesday. This flaw is related to a similar flaw in the Gzip decompression utility that was discovered last September, F-Secure said. Security vendor Secunia ApS rates the bug as highly critical. The flaw affects F-Secure's Anti-Virus, Internet Gatekeeper, and Internet Security product suites. A second less-critical vulnerability in some of the company's anti-virus software was also patched Wednesday. This flaw could be used by an attacker with access to the local system to get into unauthorized parts of the system in what is called a privilege escalation attack. Users of some versions of F-Secure Anti-Virus and Internet Security have been automatically delivered the software patches for these flaws, F-Secure said. A list of which products require hotfixes can be found within F-Secure's security bulletins. Also on Wednesday, F-Secure fixed a flaw in its Policy Manager Server that could be used by attackers to launch aÂ DoS attack against the security management software. Secunia rates this bug as "less critical."
633181
Gareth Heyes has a new post today talking about one of the vulnerable values in the $_SERVER superglobal - PHP_SELF.   I thought it might be a good idea to gather a few test cases demonstrating the problem. Why PHP allows these URL's is beyond me and it wouldn't take much work to filter out these malicious URL's in the PHP code.   He provides four test cases to show how simple it is to abuse - one using a HTTP header, another pushing XSS through, the third mentions search pages and the fourth a direct code injection.   You can download the code here.
488709
F-Secure ha annunciato che la sua tecnologia per la protezione dei dispositivi wireless F-Secure Mobile Anti-Virus sarÃ  disponibile con il nuovissimo smartphone multimediale Nokia 7710, presentato ieri alla Nokia Mobility Conference di Monaco e al
716663
Networked multifunction devices share PC vulnerabilities to worms, hackers.
729820
Scammers and hackers are targeting the human factor in system setups. Part of a series on hot security topics.
5949
Handling of images could allow an attacker to take over your PC.
624271
New variant offers holiday greetings before infecting your PC with a virus.
475145
The purpose of this paper is to explain how attackers behave when they attempt to identify and defeat honeypots, and is useful information for security professionals who need to deploy honeypots in a more stealthy manner. Part 2 looks at Sebek-based honeypots, snort_inline, Fake AP, and Bait and Switch honeypots.
428155
Multicasting migraine Security researchers have identified multiple unpatched vulnerabilities in a widely-used content distribution package.â¦
610973
This article discusses the use of Libwhisker, a PERL module which allows for the creation of custom HTTP packets and can be used for penetration  testing various web applications.
630854
Mozilla is working to fix a browser flaw that could give attackers unauthorized access to data on a victim's machine.
295779
Blog: Low ransom request and a self-termination date on the code suggest this is a test attack.
497821
Alternative browser features protection against online scams.
190172
Blog: Phishing and drive-by downloads are possible if you stumble across an infected profile.
589863
The purpose of this paper is to explain how attackers behave when they attempt to identify and defeat honeypots, and is useful for security professionals to deploy honeypots in a more stealthy manner.
740908
Danish security research firm Secunia has reported a vulnerability that occurs in most browsers that can be exploited by hackers looking to spoof the content of Web sites.
676591
Ziff Davis - Holes in KOffice and RealPlayer allow attackers to take over a user's system.