Subscribe to this site with RSS

LinuxWorld.com > Security >

Another nasty Internet Explorer bug

Patches from HP, Ubuntu, Fedora, others Beware e-mail worm spreading via message with the title "My Best Photo" EBay helps shut down Russian Web site selling stolen eBay account info, and other interesting reading

Virus and Bug Patch Alert Newsletter By Jason Meserve, Network World, 03/27/06

Today's bug patches and security alerts:

Story tools

Sponsored by:

E-Mail article
Print article
Contact author
AIM article	del.icio.us
Reddit	Digg
Stumble	Slashdot It!

Microsoft warns of nasty IE bug

Microsoft is warning users of its Internet Explorer browser to use caution on the Web, after the disclosure of an unpatched bug that could allow attackers to seize control of a PC running the browser software.

Lennart Wistrand blog entry

ISS advisory

**********

iDefense warns of privilege escalation in ISS tools

According to an iDefense advisory, ISS security tools such as BlackICE and RealSecure Desktop are vulnerable to privilege escalation.

**********

iDefense warns of flaws in RealPlayer and Helix Player

iDefense says a heap overflow in RealNetworks' RealPlayer and Helix Player could be exploited by an attacker to run malicious code on the affected machine. RealNetworks has released updates to fix this problem.

**********

HP patches swagentd for HP-UX

According to an alert from HP, "A potential security vulnerability has been identified in HP-UX running swagentd. The vulnerability could be exploited remotely by an unauthenticated user to cause swagentd to abort resulting in a Denial of Service."

**********

Fedora releases sendmail update

A race condition in sendmail could be exploited by an attacker to run malicious code on an affected machine. Fedora has a patch for its operating system variants.

**********

Ubuntu patches libcairo flaw

A flaw in the way the cairo library renders glyphs could be exploited by an attacker to crash the program. This flaw also impacts the Evolution mail client.

**********

New updates from Debian

koffice (multiple flaws)

Linux kernel 2.4.27 (multiple flaws)

Linux kernel 2.6.8 (multiple flaws)

Evolution (format string flaw, code execution)

Sendmail (race condition, code execution)

firebird2 (buffer overflow)

**********

New patches from Gentoo

NetHack (privilege escalation, code execution)

PHP (multiple flaws)

Sendmail (race condition, code execution)

**********

New fixes from Mandriva

Sendmail (race condition, code execution)

Linux kernel 2.6 (multiple flaws)

freeradius (denial of service)

**********

Today's roundup of virus alerts:

Hackers use Trojan to target bank customers

Hackers have been quietly infecting hundreds of thousands of computers worldwide with a particularly sophisticated Trojan horse program designed to steal bank account information and other sensitive data from compromised systems, according to security researchers. Computerworld, 03/22/06.

W32/Rontokbr-A -- An e-mail worm that spreads through a message with the title "My Best Photo" and an attachment called "Photo.zip". It drops a number of files on the infected host, including "msvbvm60.dll" in the Windows System Folder. It can be used to harvest e-mail addresses. (Sophos)

Troj/Clagger-M -- A Trojan that spreads through an e-mail message that looks like it is from amazon.co.uk. It drops "uhoy112.exe" in the Windows System directory. (Sophos)

W32/Sdbot-BBA -- A new Sdbot variant that exploits known Windows flaws as it spreads through network shares. It drops "winhost32.exe" in the Windows folder and allows backdoor access through IRC. (Sophos)

Troj/Haxdoor-BH -- This Trojan can communicate with remote servers via HTTP. It is installed as "ke7dnl.sys" in the Windows System folder and registers itself as "AVXSearch service". (Sophos)

Troj/Orse-R (also known as Troj/DwnLdr-AKR) -- Another Trojan that uses HTTP to communicate with remote servers. This nuisance is installed as "taskdir.exe", "taskdir.dll" and "zlbw.dll" in the Windows System folder. (Sophos)

W32/Cellery-B -- A virus that spreads through network shares, dropping "format32.exe" in the Windows System folder. What's interesting, it plays a midi file (minuet.mid) and opens a Tetris-like game on the infected host. (Sophos)

Banker.CJA -- Another banking Trojan that target specific Internet banking sites, collecting username and password information. This Trojan is dropped on a host by another malicious worm: Nabload.CC. (Panda Software)

Troj/Loosky-BY -- This Trojan drops "batserv2.exe" in the Windows directory and "sysc.exe" in the Windows System folder. No word on any permanent damage caused by Looksy-BY. (Sophos)