Ryan Naraine

Microsoft Corp.’s plans to hawk a subscription-based product bundling anti-virus, anti-spyware and firewall tools might be the security industry’s worse-kept secret, but that has not stopped the guessing games leading up to next week’s RSA Conference 2005. Officials at the Redmond, Wash., company remain tight-lipped on specifics, refusing to confirm or deny widespread speculation that […]

Network security specialist Symantec Corp. has confirmed a high-risk vulnerability in multiple anti-virus and anti-spam products and warned that a successful exploit could lead to code execution attacks. The vulnerability, which was reported by Internet Security Systems Inc.’s X-Force unit, is described as a boundary error in the DEC2EXE parsing engine used in versions of […]

Microsoft on Tuesday released 12 advisories to cover 17 security flaws in a range of products, including high-priority patches for Internet Explorer, Windows Media Player, Windows Messenger and MSN Messenger. The February batch of patches includes eight “critical” fixes, and Microsoft officials say IT administrators should prioritize and deploy patches for four potentially dangerous code-execution […]

Anti-virus vendors have raised the threat level on a double-barreled MSN Messenger worm that lures users with the promise of sexy image files. The worm, identified as W32/Bropia, arrives as a download link within MSN instant messaging sessions, but instead of sexy photographs, infected users get an image of a cooked chicken on a platter […]

Qualcomm has pushed out an update for its Eudora e-mail client to fix multiple security flaws that put users at risk of computer hijacking. The San Diego-based Qualcomm Inc., which offers a free version of the client alongside premium versions, said the new Eudora 6.2.1 corrects several vulnerabilities reported by research firm NGSS (Next Generation […]

Microsoft’s February Patch Day will be a busy one for IT administrators. The software giant on Thursday announced plans to release 13 security advisories on Feb. 8, including “critical” fixes for Microsoft Office, Windows Media Player and MSN Messenger. Also expected is a cumulative patch to plug known vulnerabilities in the widely deployed Internet Explorer […]

Microsoft Corp. on Monday confirmed it was investigating a claim by a Russian security researcher that two key security technologies built into Windows XP Service Pack 2 could be easily defeated. The weaknesses were highlighted in a research paper published by Alexander Anisimov of Positive Technologies and centers around XP SP2’s heap protection and DEP […]

Last week’s sophisticated bot attack against Windows installations of the MySQL database engine has fizzled after DNS (Domain Name System) service authorities shut off access to IRC servers controlling the worm. The bot, which launched brute-force attacks on weak MySQL passwords, was infecting vulnerable systems at the rate of 100 per minute. At its peak, […]

Malicious hackers have launched a zero-day bot attack against default Windows installations of the MySQL database engine, infecting vulnerable systems at the rate of 100 per minute, security experts warned on Thursday. The bot takes advantage of the publicly released “MySQL UDF Dynamic Library Exploit” to break into the open-source MySQL package. Once a database […]

The nonprofit Internet Systems Consortium has rolled out fixes for a pair of denial-of-service flaws in its BIND (Berkeley Internet Name Domain) implementation of the Domain Name System protocols. The vulnerabilities were reported in BIND versions 8.4.4, 8.4.5 and 9.3.0 and carry a “moderately critical” rating from independent research firm Secunia. BIND is by far […]

Switching and routing firm Cisco Systems Inc. has issued a fix for a denial-of-service vulnerability affecting versions of its flagship IOS (Internetwork Operating System) software. A security advisory from the San Jose, Calif.-based company said the flaw affects all Cisco devices that are configured for Cisco ITS (IOS Telephony Service), Cisco CME (CallManager Express) or […]

A pair of vulnerabilities in the Sun Java Plug-In technology could put users at risk of system bypass attacks, Sun Microsystems Inc. confirmed Thursday. The Santa Clara, Calif.-based company said the more serious of the two vulnerabilities could allow an untrusted applet to elevate privileges through JavaScript calling into Java code. For example, an untrusted […]