Wednesday, July 15, 2009

Nine new patches from Microsoft but leaves one hole open

Microsoft has delivered six security updates to patch nine vulnerabilities. Although the patches fix two bugs now being used by hackers but leave one still open to exploit.

Of the six bulletins, three patched some part of Windows, while the remainder plugged holes in Publisher, Internet Security and Acceleration Server (ISA), and Microsoft's virtualisation software. Six of the nine bugs were ranked critical, Microsoft's highest ranking in its four-step score, while three were tagged as "important," the next-lowest label.

"We got what we expected," said Andrew Storms, director of security operations at nCircle Network Security. "We got the 'kill bit' we were looking for in the ActiveX control, and the DirectShow fix," he said, referring to two recent vulnerabilities that attackers have been exploiting for weeks.

In May, Microsoft acknowledged ongoing attacks exploiting a bug in DirectShow, one of the components in Windows' DirectX graphics platform. Last week, it owned up to a bug in a video streaming ActiveX control used by Internet Explorer (IE), which it had known about - but not fixed - for the past 18 months. Last Thursday, Microsoft had gone into unusual detail to describe the upcoming patches, and promised that both the DirectShow and ActiveX bugs would be patched.

Microsoft also delivered patches today for two critical vulnerabilities in a Windows' font engine, and one important bug each in Publisher 2007, ISA 2006, and the client and server editions of its virtualization software.


"MS09-029 and MS09-030 are bucking the trend," said Storms, talking about two of the six bulletins released today. "Typically, Microsoft's newer software is more secure, but that's not the case here."

The fix for the Embedded OpenType (EOT) Engine in MS09-029 is rated critical in all versions of Windows, including Vista and Server 2008, which if not immune from many attacks, are often less threatened by exploits because of additional security measures baked into those operating systems. And the Publisher patch in MS09-030 fixes a file format flaw in the newest 2007 edition.

"The fact that we got them both in the same month is probably just a coincidence," said Storms, "but it doesn't surprise me that researchers are looking at the newer software, because it's the newer software that's being deployed."

Missing from today's batch was a patch or automated "kill bit" solution for another ActiveX control vulnerability that Microsoft disclosed only yesterday. web attacks exploiting that bug are rapidly increasing, but Microsoft said that it wouldn't be able to wrap up a fix in time for today.

How Does Ubuntu 9.04 Measure Up to Mac OS X?

Bypassing Windows altogether, Mark Shuttleworth has stated that OS X is the operating system to beat. With Ubuntu’s 9.04 now in wide distribution, we look at how it stacks up with the competition.

Thursday, April 16, 2009

Oracle Updates for Multiple Vulnerabilities

Systems Affected

* Oracle Database 11g, version 11.1.0.6, 11.1.0.7
* Oracle Database 10g Release 2, versions 10.2.0.3, 10.2.0.4
* Oracle Database 10g, version 10.1.0.5
* Oracle Database 9i Release 2, versions 9.2.0.8, 9.2.0.8DV
* Oracle Application Server 10g Release 2 (10.1.2), version 10.1.2.3.0
* Oracle Outside In SDK HTML Export 8.2.2, 8.3.0
* Oracle XML Publisher 5.6.2, 10.1.3.2, 10.1.3.2.1
* Oracle BI Publisher 10.1.3.3.0 10.1.3.3.1, 10.1.3.3.2, 10.1.3.3.3, 10.1.3.4
* Oracle E-Business Suite Release 12, version 12.0.6
* Oracle E-Business Suite Release 11i, version 11.5.10.2
* PeopleSoft Enterprise PeopleTools versions: 8.49
* PeopleSoft Enterprise HRMS versions: 8.9 and 9.0
* Oracle WebLogic Server 10.3
* Oracle WebLogic Server 9.0 GA, 9.1 GA, 9.2 through 9.2 MP3
* Oracle WebLogic Server 8.1 through 8.1 SP6
* Oracle WebLogic Server 7.0 through 7.0 SP7
* Oracle WebLogic Portal 8.1 through 8.1 SP6
* Oracle Data Service Integrator 10.3.0 and Oracle AquaLogic Data Services Platform (formerly BEA ALDSP) 3.2, 3.0.1, 3.0
* Oracle JRockit (formerly BEA JRockit) R27.6.2 and earlier (JDK/JRE 6, 5, 1.4.2)

Overview

Oracle products and components are affected by multiple vulnerabilities. The impacts of these vulnerabilities include remote execution of arbitrary code, information disclosure, and denial of service.

Description

The Oracle Critical Patch Update Advisory - April 2009 addresses 43 vulnerabilities in various Oracle products and components. The document provides information about affected components, access and authorization required for successful exploitation, and the impact from the vulnerabilities on data confidentiality, integrity, and availability.

Oracle has associated CVE identifiers with the vulnerabilities addressed in this Critical Patch Update. If significant additional details about vulnerabilities and remediation techniques become available, we will update the Vulnerability Notes Database.

Impact

The impact of these vulnerabilities varies depending on the product, component, and configuration of the system. Potential consequences include the execution of arbitrary code or commands, information disclosure, and denial of service. Vulnerable components may be available to unauthenticated, remote attackers. An attacker who compromises an Oracle database may be able to access sensitive information.

Solution

Apply the appropriate patches or upgrade as specified in the Oracle Critical Patch Update Advisory - April 2009. Note that this document only lists newly corrected issues. Updates to patches for previously known issues are not listed.

Friday, April 10, 2009

Slow connections to Mysql Server on Windows

PROBLEM

You may experience connection delays when you try to connect remotely to a mysql server installed on Windows 2000 or above. When you try to connect from the computer MySQL is hosted on, it connects to the server very quickly (through the mysql dos client), but when you try to remotely connect , it would take quite a while to connect.

REASON

When a new client connects to MYSQL, mysql spawns a new thread to handle the request. This thread first checks whether the host name is in the host name cache. If not, the thread attempts to resolve the host name:
  • The thread takes the IP address and resolves it to a host name (using gethostbyaddr()). It then takes that host name and resolves it back to the IP address (using gethostbyname()) and compares to ensure it is the original IP address.

  • If the operating system supports the thread-safe gethostbyaddr_r() and gethostbyname_r() calls, the thread uses them to perform host name resolution.

  • If the operating system does not support the thread-safe calls, the thread locks a mutex and calls gethostbyaddr() and gethostbyname() instead. In this case, no other thread can resolve host names that are not in the host name cache until the first thread unlocks the mutex.

SOLUTION

You can disable DNS host name lookups by adding the "skip-name-resolve" to my.ini


Wednesday, April 8, 2009

A new free antivirus for Unix/Linux platform - BitDefender Antivirus Scanner for Unices

Today I’d like to introduce to you all a brand new antivirus for Unix/Linux platform from a famous company, BitDefender. A couple of days ago, BitDefender introduced a new antivirus for Unix/Linux OS called BitDefender Antivirus Scanner for Unices (you can take a look, and get more information from BitDefender website).

Just because you use Linux, it doesn’t mean your computer doesn’t have viruses or worms. They are just lying dormant, embedded in the EXE files on the NTFS partitions, or hiding beside those DLLs on the dual-boot computers, waiting for you to send them to your Windows-using friends.

Unless you sadistically enjoy seeing your non-Linux peers suffer, you should act responsibly and get yourself an anti-virus scanner that runs on Linux. One such is the latest BitDefender Antivirus Scanner For Unices. If you agree to use it on your home computers only, you can have it for free - that’s free as in freeware, not Richard Stallman free.

Virus is a catch-all phrase, and BitDefender’s designed to catch them all - from executable viruses, script viruses, macro viruses, to backdoors, trojans, spyware, adware, diallers, and more. BitDefender looks inside files created by over 70 packers, compressors, and installers, from the most common ones such as Zip, 7-Zip, and .tar.gz to more exotic ones such as UPX, ASPack, PECrypt, etc. We found that it even picked up an infected file inside an archive split into multiple volumes. To avoid being caught out by Zip bombs, BitDefender has an adjustable compression depth.

Product Description

BitDefender Antivirus Scanner for Unices is a versatile on-demand scanner built for Linux and FreeBSD systems. It provides antivirus and antispyware scanning for both UNIX-based and Windows-based partitions.

BitDefender Antivirus Scanner for Unices is highly customizable and capable of script and extension-based integration with various applications such as file managers and mail clients.

Licensing

BitDefender Antivirus Scanner for Unices may be used free of charge at home or on your personal computer. In case you want to use BitDefender Antivirus for Unices for business purposes, a registration key must be purchased through the BitDefender Online Store or from BitDefender certified partners

Features and Benefits

  • On-demand antivirus and antispyware protection
  • Script and extension-based integration with various applications and services:
    • Mail clients (e.g. Pine, Evolution) and Mail Server services
    • Scheduling services (e.g. Cron) ensuring scan and update automation
  • Classic command line scanner complete with a graphical user interface for better integration with desktop environments
  • Automatic addition of the scanner’s GUI to the system menu
  • Three popular file manager plugins (the GPL-ed sources) included in the GUI package: Konqueror (KDE), Nautilus (GNOME) and Thunar (Xfce)
  • Action setting based on scan result type

System Requirements

Operating System: Linux, FreeBSD
Linux Kernel: 2.4.x or 2.6.x (recommended)
FreeBSD: 5.4 (or newer with compat5x)
glibc: version 2.3.1 or newer, and libstdc++5 from gcc 3.2.2 or newer
Processor: x86 compatible 300 MHz; i686 500MHz; amd64(x86_64)
Minimum Memory: 64MB (128MB recommended)
Minimum Free Disk Space: 100MB

Supported Distributions:

  • RedHat Enterprise Linux 3 or newer
  • SuSE Linux Enterprise Server 9 or newer
  • Fedora Core 1 or newer
  • Debian GNU/Linux 3.1 or newer
  • Slackware 9.x or newer
  • Mandrake/Mandriva 9.1 or newer
  • FreeBSD 5.4 or newer

Tuesday, March 31, 2009

Bought A New MacBook White

Hi Friends,

I just bought a new macbook white, it has amazing looks and performance. You can have a look at detailed features at http://www.apple.com/macbook/white/features.html

Conficker Worm Targets Microsoft Windows Systems - Update I

Home users can apply a simple test for the presence of a Conficker/Downadup infection on their home computers. The presence of a Conficker/Downadup infection may be detected if a user is unable to surf to their security solution website or if they are unable to connect to the websites, by downloading detection/removal tools available free from those sites:

http://www.symantec.com/norton/theme.jsp?themeid=conficker_worm&inid=us_ghp_link_conficker_worm
http://www.microsoft.com/protect/computer/viruses/worms/conficker.mspx
http://www.mcafee.com

If a user is unable to reach any of these websites, it may indicate a Conficker/Downadup infection. The most recent variant of Conficker/Downadup interferes with queries for these sites, preventing a user from visiting them. If a Conficker/Downadup infection is suspected, the system or computer should be removed from the network or unplugged from the Internet - in the case for home users.


Solution

Instructions, support and more information on how to manually remove a Conficker/Downadup infection from a system have been published by major security vendors. Please see below for a few of those sites. Each of these vendors offers free tools that can verify the presence of a Conficker/Downadup infection and remove the worm:

Symantec:
http://www.symantec.com/business/security_response/writeup.jsp?docid=2009-011316-0247-99

Microsoft:
http://support.microsoft.com/kb/962007

http://www.microsoft.com/protect/computer/viruses/worms/conficker.mspx