NIST IT Security: COMLAN_100 / COMLAN_99 / Possible Cross-Platform 0Day in Apple's Quicktime Music Player

NIST Site Search

Product Research

Advertise on this site

Headlines

US-CERT Current Activity

»	Mozilla Releases Firefox 3.6.9
»	Apple Releases Safari 5.0.2 and 4.1.2
»	Apple Releases iTunes 10
»	Google Releases Chrome 6.0.472.53
»	Insecure Loading of Dynamic Link Libraries in Windows Applications
»	VMware Releases Updates for ESX Service Console Packages
»	Cisco Releases Security Advisory for IOS XR Software Border Gateway Protocol
»	RealNetworks Releases Update to Address Vulnerabilities in RealPlayer
»	Cisco Releases Advisories for Unified Communications Manager and Unified Presence
»	APWG Fax Back Phishing Education Program

Date published: not known
Details

DOE-CIRC Updates

»	T-433: Security Advisory for Adobe Reader and Acrobat Security Advisory for Adobe Reader and Acrobat
»	T-432: Google Chrome Multiple Flaws Let Remote Users Execute Arbitrary Code Google Chrome Multiple Flaws Let Remote Users Execute Arbitrary Code
»	T-431: Linux Kernel Null Pointer Dereference in irda_bind() May Let Local Users Gain Elevated Privileges Linux Kernel Null Pointer Dereference in irda_bind() May Let Local Users Gain Elevated Privileges
»	T-430: Apple QuickTime Flaw in QTPlugin.ocx ActiveX Control Lets Remote Users Execute Arbitrary Code Apple QuickTime Flaw in QTPlugin.ocx ActiveX Control Lets Remote Users Execute Arbitrary Code
»	T-429: WaspTime MS-SQL Database instance with blank password for sa account WaspTime MS-SQL Database instance with blank password for sa account
»	T-428: Vulnerability in Help and Support Center Vulnerability in Help and Support Center
»	T-427: VMWare WebAccess Vulnerability VMWare WebAccess Vulnerability
»	T-426: Microsoft Windows Shortcut 'LNK/PIF' Files Automatic File Execution Vulnerability Microsoft Windows Shortcut 'LNK/PIF' Files Automatic File Execution Vulnerability
»	T-425: Desktop Java running in web browsers Desktop Java running in web browsers
»	T-424: Windows TCP/IP Stack IcmpSendEcho2Ex() Bug Lets Local Users Deny Service Windows TCP/IP Stack IcmpSendEcho2Ex() Bug Lets Local Users Deny Service
»	T-423: Microsoft Security Advisory (2269637) - Insecure Library Loading Could Allow Remote Code Execution Microsoft Security Advisory (2269637) - Insecure Library Loading Could Allow Remote Code Execution
»	T-422: Adobe Flash Player and AIR (CVE-2010-2216) Unspecified Memory Corruption Vulnerability Adobe Flash Player and AIR (CVE-2010-2216) Unspecified Memory Corruption Vulnerability
»	T-421: Multiple CACTI Security Vulnerabilities Multiple CACTI Security Vulnerabilities
»	T-420: Microsoft Windows TCP/IP IPv6 Extension Header Remote Denial of Service Vulnerability Microsoft Windows TCP/IP IPv6 Extension Header Remote Denial of Service Vulnerability
»	T-419: PHP 'ibase_gen_id()' Function off-by-one Buffer Overflow Vulnerability PHP 'ibase_gen_id()' Function off-by-one Buffer Overflow Vulnerability

Date published: not known
Details

Virus Bulletin news

»	September issue of VB published The September issue of Virus Bulletin is now available for subscribers to download.
»	ARF published as IETF standard Abuse report format helps auto-handling of email complaints
»	Microsoft releases new fix for DLL vulnerability Earlier workaround believed to be too complex for most users.
»	Malicious tweets link to fake TweetDeck update Twitter resets passwords for accounts that appear to have been hacked.
»	94% of Internet users befriend unknown 'good-looking woman' Sensitiva data shared after two-hour chat.
»	Investment boost for Quick Heal Indian security firm gets hefty cash injection.
»	41% of spam sent via Rustock botnet Botnet spam back after short summer break.
»	Avast gets $100m investment boost Growth equity firm invests in Czech firm
»	Computer chip giant buys AV giant Intel becomes new owner of McAfee for the princely sum of $7.8bn

Date published: not known
Details

DarkReading - All Stories

»	String Of Deals Shows Demand for Cloud-Based Authentication Acquisitions highlight how authentication-as-a-service is now part of identity and access management ...
»	Tech Insight: Retooling Vulnerability Scanning, Penetration Testing For IPv6 Traditional host discovery via network scanning won't work with IPv6, but alternative methods are av ...
»	Five Ways To Stop Mass SQL Injection Attacks The best practices for mitigating this popular form of attack often are not being deployed
»	IPv6 Transition Poses New Security Threats Next-generation IP protocol comes with more security as well as some potential flaws of its own ...
»	Networked Scanners Offer A Window Into The Enterprise, Researcher Says Emerging Web-based features make it possible to capture document contents remotely from networked sc ...
»	U.S. Businesses Could Lose Up To $1 Billion In Online Banking Fraud This Year Small- to midsized businesses taking the biggest hit, experts say, but consumer banking customers co ...
»	Product Watch: Verizon, VMware Team Up With Hybrid Cloud Service New Verizon service offers private public-cloud option
»	Could USB Flash Drives Be Your Enterprise's Weakest Link? The Pentagon last week conceded that a USB flash drive carried an attack program inside a classified ...
»	Delaware Contractor Mistakenly Posts Personal Data Of 22,000 Employees State of Delaware contractor Aon mistakenly posts personal data of 22,000 retirees without randomiza ...

Date published: not known
Details

Possible Cross-Platform 0Day in Apple's Quicktime Music Player

Apple's Quicktime music player in combination with Safari has been identified as the attack vector that won last week's $10,000 prize at the CanSecWest security conference in Vancouver. But it turns out that the vulnerability not only extends to other OSX browsers but also possibly to Windows and PPC Macs as well. Updated: Possible Exploit Released. Fix released on May 1st. See below.

[ Read the rest of the article... ]

Posted by NIST.org on Wednesday 25 April 2007 - 16:11:18 | Read/Post Comment: 0 |