ID: IRCNE2011071166
Date: 2011-07-02

According to eSecurity Planet, the WordPress 3.1.4 release follows the 3.1.3 update that came out at the end of May.
"This release fixes an issue that could allow a malicious editor-level user to gain further access to the site," WordPress developer Ryan Boren blogged.
Boren noted that WordPress 3.1.4 also incorporates several other security fixes and hardening measures. One such update is identified in changeset 18356, which provides new hardening and sanitizers for WordPress language files (WPLANG) and new admin email setup.
There are also new santization elements for the order of get_bookmarks,get_pages and get_terms. Code sanitization is intended to help ensure that bad input can't make it into the system that could potentially be leveraged by an attacker to exploit the system. The new WordPress 3.1.4 update comes as developers push forward on the next generation of the blogging platform. The third release candidate for WordPress 3.2 is now available, including the same security and hardening fixes that are in the 3.1.4 release. Additionally, WordPress 3.2 includes some additional JavaScript, and user interface fixes.
WordPress 3.2 is also set to provide performance gains for the server that will make the blogging platform run faster. In terms of user facing changes, the WordPress 3.2 release will have a focus on distraction-free writing. The new distraction-free visual editor user interface for composing blog posts is intended to help bloggers focus more on their content.
Another big shift with WordPress 3.2 comes in the form of the minimum requirements. The Microsoft IE6 browser will no longer be supported and the server requirements have also changed and no longer support PHP 4.
"As a reminder, we've bumped our minimum requirements for version 3.2 to PHP 5.2.4 and MySQL 5.0," Boren said.

ID: IRCNE2011071164
Date: 2011-07-02

According to “eSecurity Planet”, SANS was out last week with its annual CWE/SANS Top 25 Most Dangerous Software Errors Report for 2011. According to a number of security industry professionals it's a list that isn't necessarily highlighting new trends, but rather than old problem continue to persist.
At the top of the list for 2011 is SQL Injection, which should come as no surprise to anyone that has followed the recent spate of breaches.
"SQL injection was the vulnerability behind the Sony, Infraguard, and other recent attacks. Yet no matter if it's No. 1 or No. 4 or No. 10, it always has been one of the primary causes of significant data breaches in the past, and it will continue to be for many years to come.", said managing partner at security research firm Stach & Liu.
In 2010, SQL Injection came in at No. 2 on the SANS list behind Cross Site Scripting.
"Given the types of hacks that made the news in the last 12 months it’s not surprising that SQL Injection is high on the list," said Mike Shema, engineering lead for the Qualys Web application scanning service. "What is surprising is that the countermeasures to SQL injection are well-known, effective, and available in all of the major programming languages used in web apps for at least half a decade." Shema added that the prevalence of malware has shown that software errors in Web browsers seem to be more interesting targets (in terms of sheer numbers) than bugs in websites.
Looking beyond SQL Injection, the SANS report ranked 'OS Command Injection' as No. 2. Coming in third is the classic Buffer Overflow while Cross-Site Scripting (XSS) came in fourth. In the fifth spot, is Missing Authentication for Critical Function.

ID: IRCNE2011071163
Date: 2011-07-02

According to “TechWorld”, researchers from security firm Kaspersky Lab have discovered that millions of PCs around the world appear to have been quietly infected by the dangerous TDSS ‘super-malware’ rootkit as part of a campaign to build a giant new botnet.
Malware and botnets come and go, but TDSS is different. First detected more than three years ago, TDSS (also known as ‘TDL’ and sometimes by its infamous rootkit component, Alureon), it has grown into a multi-faceted malware nexus spinning out ever more complex and dangerous elements as it evolves.
In recent weeks, Kaspersky Lab researchers were able to penetrate three SQL-based command and control servers used to control the activities of the malware’s latest version, TDL-4, where they discovered the IP addresses of 4.5 million IP PCs infected by the malware in 2011 alone. Almost 1.5 million of these were in the US. If active, this number of compromised computers could make it one of the largest botnets in the world.
The TDL-4 malware has also added technical and economic capabilities to its features list, including some that are out of the ordinary for botnets, the researchers said.
Making use of the malware’s bootkit design – it infects the master boot record of a PC to allow it to load before other programs – it attempts to clean rival malware from an infected PC, searching for an nixing up to 20 different malware types, including Gbot, Zeus and Optima. This stops other programs interfering with its activities as well as hurting their commercial activities.
Perhaps most intriguing of all are the economic innovations shown by the TDSS creators which help them sell it in a botnet-as-a-service form.
“We don’t doubt that the development of TDSS will continue,” said Kaspersky researcher, Sergey Golovanov, who performed the latest analysis of TDSS. “Active reworkings of TDL-4 code, rootkits for 64-bit systems, the use of P2P technologies, proprietary anti-virus and much more make the TDSS malicious program one of the most technologically developed and most difficult to analyse.”
The bigger question is why TDSS/TDL-4 has invested so much effort in complexity when other malware performs adequately without it. Perhaps its most infamous innovation was the 64-bit version of Alureon that Microsoft claimed in May to have removed from hundreds of thousands of systems despite the fact this version of the OS is supposed to be harder to attack.
The answer is that TDSS’s creators are pioneering in their outlook. Windows might have fewer 64-bit users and the OS might be more of a challenge, but tackling it offers larger rewards because they stay ahead not only of rivals but of the software defences.

ID: IRCNE2011071162
Date: 2011-07-02

According to "thetechherald", Google Inc. has this week released a platform update that addresses no less than seven possible vulnerabilities. Arriving as the second security patch Google has released for its web browser in June, the 12.0.742.112 update delivers solutions for six flaws rated as ‘high’ where associated risk factor is concerned.
Of the more severe issues dealt with, one involves the V8 JavaScript engine, while two others cover memory corruption problems with CSS and re-entrancy faults with HTML parsers. The remaining three address “use-after-free” SVG font handling exploits that could enable attackers to inject malicious code.
Interestingly, five of the flaws fixed by 12.0.742.112 were uncovered and reported to Google by security researcher ‘miaubiz’.
Not just consisting of solutions to internal problems, Google’s latest security offering also comes with an updated version of Adobe’s Flash player.
On June 8 of this month, Google released a Chrome patch that stamped out no less than 15 vulnerabilities and added a selection of new features.

شماره: IRCNE2011061161

يك مطالعه سيمانتك نشان مي دهد كه اندرويد گوگل، بسياري از نقاط ضعف امنيتي را كه باعث بروز مشكل در ويندوزها مي شد، برطرف كرده است.
يك مركز تحقيقاتي درباره امنيت دستگاه هاي تلفن همراه، معماري امنيت اندرويد را با رقيب اصلي آن، iOS اپل مقايسه مي كند و مي گويد در حال حاضر امنيت اندرويد در مقام دوم قرار دارد.
آزادي عمل نسبي اندرويد، تكه تكه كردن نسخه هاي مختلف، بررسي ضعف برنامه هاي كاربردي و استفاده نادرست از رمزنگاري مواردي است كه نسبت به مدل iOS اپل مقايسه شده است. ولي نويسندگان سيمانتك هنوز نگران كل روش هاي امنيتي هستند كه ممكن است در طول زمان مشكلات عمده اي را به وجود آورند.
مشكل اندرويد و مشكل تمامي سيستم عامل هاي تلفن همراه، قدرت زيادي كه در اختيار برنامه هاي كاربردي قرار مي دهد و نيز راه تعامل كاربران با آن ها است، كه در نتيجه زمينه را براي حملات مهندسي اجتماعي آماده مي كند.
اولين دوره از حملات برنامه هاي اندرويد نشان مي دهد كه برنامه هاي كاربردي مي توانند به آساني از برنامه هاي معتبر، سرقت هويت كنند تا بتوانند از برنامه هاي ثبت نام ديجيتالي گوگل عبور كنند.
در نيمه اول سال 2011، اندرويد توسط حملات كوچكي از بدافزارها صدمه ديد كه باعث شد گوگل براي برطرف كردن مشكلات برنامه هاي كاربردي تلاش كند. در ماه آوريل نرم افزار غول پيكر CA يك آنتي ويروس جعلي كه هدف آن كاربران اندرويد بود را پيدا كرد.

شماره: IRCNE2011061160
تاريخ: 8/4/90

بر اساس اخطار اپل، اين آسيب پذيريها مي توانند به يك اپلت غير قابل اطمينان جاوا اجازه دهد تا كدهاي دلخواهي را در خارج از sandbox جاوا اجرا نمايد.
خطرات: بازديد از يك صفحه وب، حاوي يك اپلت غير قابل اطمينان و خرابكارانه ممكن است منجر به اجراي يك كد دلخواه با دسترسي كاربر فعلي بر روي سيستم شود.
به روز رساني ها براي Mac OS X v10.6.6 و Mac OS X v 10.5.8 در دسترس قرار دارد.
برخي از حفره هاي امنيتي Mac OS X مي توانند منجر به اجراي از راه دور كد از طريق فونت ها يا فايل هاي پي دي اف شوند. اجزاي مبتلا به اين آسيب پذيري مهم عبارتند از : ATS، ColorSync، CoreFundation، CoreGraphics، ImageIO.
اپل همچنين درباره نقص هاي امنيتي در MobileMe، MySQL، OpenSSL، QuickLook و QUICKtime هشدار داده است.

ID: IRCNE2011061161
Date: 2011-06-29

According to 'teckworld', Google’s Android has solved many of the security weaknesses that beset Windows but at the expense of handing a dangerous level of decision-making to users, a Symantec study has argued.
A Window into Mobile Device Security compares Android’s security architecture to that of its major rival, Apple’s iOS, and finds the latter to be superior, at least for now.
Android’s relative openness, fragmentation of different versions, weaker app vetting, and immature use of encryption all mark it down compared to iOS, but Symantec’s authors still worry that its whole security model might start to cause it major problems over time.
The problem for Android - and to some extent all mobile operating systems - is the power it hands to applications and the way users interact with them, which leaves it wide open to social engineering attacks.
The first generation of Android app attacks have also shown that apps can easily impersonate legitimate programs in order to bypass Google’s digital appsigning.
In the first half of 2011, Android has been hit by several small waves of malware which have left Google scrambling to remove problem apps from its Msrketplace. In April, software giant CA even found a fake antivirus app targeting Android users.

ID: IRCNE2011061160
Date: 2011-06-29

zdnet - According to warnings from Apple, the vulnerabilities could allow an untrusted Java applet to execute arbitrary code outside the Java sandbox.
The risks:Visiting a web page containing a maliciously crafted untrusted Java applet may lead to arbitrary code execution with the privileges of the current user.
The updates are available for Mac OS X v10.6.6 and Mac OS X v10.5.8.
The Java for Mac patches follows the weekend release of a major Mac OS X security update to cover major security holes.
Some of the Mac OS X security holes could lead to remote code execution via rigged fonts or PDF files. The components affected by critical vulnerabilities include ATS, ColorSync, CoreFoundation, CoreGraphics, ImageIO.
Apple also warned about security flaws in MobileMe, MySQL, OpenSSL, QuickLook and QuickTime.

شماره: IRCNE2011061159
تاريخ: 7/4/90

مايكروسافت به كاربران ويندوز گفت كه اگر به rootkit جديدي كه در سكتور بوت ماشين پنهان مي شود، آلوده شده اند بايد سيستم عامل را دوباره نصب نمايند.
يك نوع جديدي از تروجان كه مايكروسافت آن را "Popureb" خوانده است، عميقا در سيستم فرو مي رود و تنها راه ريشه كن كردن آن بازگشت به پيكره بندي پيش فرض است. هفته پيش چان فنگ، يك مهندس امنيت در مايكروسافت در سايت گروه اعلام كرد "ما پيشنهاد مي كنيم كه اگر يك سيستم با تروجان Win32/Popureb.E آلوده شد، ابتدا MBR را ترميم كرده و سپس از سي دي بازيابي براي بازگرداندن سيستم خود به حالت قبل از آلودگي استفاده كنيد."
به گفته فنگ، Popureb عمليات نوشتن با هدف MBR (عملياتي كه براي پاك كردن MBR و يا سكتورهاي ديگر هارد ديسك شامل كد حمله است) را تشخيص مي دهد و سپس آن ها را با عمليات خواندن تعويض مي كند.
در اين زمان اگرچه عمليات با موفقيت انجام مي شود اما داده هاي جديد واقعا بر روي ديسك نوشته نمي شوند، به عبارت ديگر پروسه پاك كردن شكست مي خورد.
فنگ همچنين لينك هايي را به دستوراتي براي ترميم MBR براي ويندوز XP، Vista و ويندوز 7 ارائه داده است.
Rootkit ها معمولا توسط مهاجمان براي پنهان كردن تروجان هايي مانند تروجان هاي سرقت رمزهاي عبور بانكي، استفاده مي شوند و پديده جديدي در ويندوز نيستند. به عنوان مثال در اوايل سال 2010، مايكروسافت با Rootkit اي به نام "Alureon" مبارزه كرد كه سيستم هاي ويندوز XP را آلوده كرده بود. در آن زمان نيز مايكروسافت پيشنهادهايي مشابه آنچه هم اكنون فنگ براي Popureb ارائه كرده است را پيشنهاد داد.

شماره: IRCNE2011061158

موزيلا در حال برنامه ريزي است تا پشتيباني از فايرفاكس نسخه 3.6 را بازنشسته كند اما اين مرورگر را كه تنها 18 ماه از عرضه آن مي گذرد، تا اوايل ماه اوت كنار نمي گذارد.
كنار گذاشتن فايرفاكس نسخه 3.6 به تبعيت از بازنشستگي فايرفاكس نسخه 4 و نسخه 3.5 در اوايل سال جاري است.
فايرفاكس نسخه 3.5 كه موزيلا اواسط سال 2009 آن را عرضه كرد، آخرين به روز رساني امنيتي خود را در ماه آوريل دريافت كرده است. از آن زمان كاربران تشويق شدند كه فاير فاكس خود را به نسخه هاي 3.6 يا 4 به روز رساني كنند. بعد از آن تقريبا دوازده ميليون كاربر فايرفاكس نسخه 3.5 مشاهده كردند كه فايرفاكس آن ها به طور خودكار به نسخه 3.6 به روز رساني مي شود. اين حركتي بود كه ماه گذشته شركت موزيلا در مورد آن به بحث پرداخت.
هفته گذشته موزيلا، فايرفاكس نسخه 4 را كه تنها سه ماه از عرضه آن مي گذشت، بازنشسته كرد تا فايرفاكس نسخه 5 را عرضه كند.
اين كار مورد انتقاد بسياري از مديران شركت هاي فناوري اطلاعات قرار گرفت. آن ها استدلال مي كردند كه بازنشتگي سريع نسخه هاي فايرفاكس همراه با انتشار سريع نسخه هاي جديد كه هر شش هفته يك بار عرضه مي شد، آن ها را در يك موقعيت امكان ناپذير قرار مي دهد كه هر زمان مشغول امتحان كردن يك نسخه بودند، نسخه بعدي عرضه مي شد.
موزيلا تصميم گرفته است كه حداقل يك به روزرساني ديگر براي نسخه اي كه در ژانويه سال 2010 عرضه شده بود، منتشر كند. اين به روز رساني تحت عنوان نسخه 3.6.19 در كنار فايرفاكس نسخه 6 در تاريخ 16 آگوست عرضه خواهد شد.
شركت موزيلا بخش هاي ديگر برنامه ي بازنشستگي فايرفاكس نسخه 3.6 را آشكار نكرد.بازنشستگي از فايرفاكس نسخه 3.5 تنها بخش كوچكي از كاربران فايرفاكس را تحت تاثير قرار مي دهد. معلوم نيست كه چه تعدادي از كاربران در اواسط ماه آگوست با بازنشستگي فايرفاكس نسخه 3.6 صدمه مي بينند.

مطالب مرتبط:
توقف پشتيباني امنيتي موزيلا براي فايرفاكس 4