This week’s security issues are dominated by Oracle and Adobe Acrobat/Reader flaws – Oracle’s issues look to be in remote access and listener areas while Reader/Acrobat are to do with image decoding buffer overflows ( 14! ). Perhaps Adobe should do some code checking once in a while considering the high rate of vulnerabilities they have with their pdf products.
Oracle’s issues remain problematic due to the long lead time between them being found and fixed via serice packs. It’s important when running Oracle apps with remote users especially, to make sure you are using alternative security measures such as intrusion protection and sql cleaning appliances/tools ( eg. http://www.fortinet.com/products/fortidb/ ).
Other issues of note this week include HP Procurve Threat Management Services ( good one that ), Firefox/Thunderbird/Seamonkey memory corruption, Novell eDirectory, ISC DHCP client ( fixed already in Slackware this morning ) and MS Windows DirectX and font engine.
Lastly, and on the subject of botnets, the recent 176000 PC controlled botnet that has launched attacks on US and S Korea websites, is a baby compared to a recent botnet found by security researcher Finjan – a 1.9mill PC monster. No name has been given yet to this advert for Microsoft insecurity as the botnet is using multiple and evolving malware and spyware tools as an infection vector.