The Hacker News

 

 

The Hacker News

The Hacker News has been internationally recognized as a leading news source dedicated to promoting awareness for security experts and hackers // via fulltextrssfeed.com

Microsoft Patch Tuesday - 8 Security Updates, 4 critical vulnerabilities, including Internet Explorer zero-day
10/7/2013 1:59:00 PM

October is turning out to be a busy month for patches. This month also marks the 10-year anniversary of the Patch Tuesday program, which Microsoft started in October of 2003.

Scheduled for tomorrow, Microsoft has announced that they will release eight security updates including four critical, addressing vulnerabilities in Microsoft Windows, Internet Explorer (IE), Microsoft Office and its other products.

Bulletin 1 is almost certainly to a zero-day vulnerability CVE-2013-3893 that has been actively exploited by hackers in targeted attacks. Though Microsoft issued a temporary "Fix it" in September for the vulnerability,

Bulletins 2, 3 and 4 address vulnerabilities in a wide range of Microsoft products, including Windows XP, 7 and 8, and Windows Server 2003, 2008 and 2012.

Bulletins 5, 6 and 7 address vulnerabilities that could allow for remote code execution. Bulletin 8 addresses an information disclosure vulnerability in SIlverlight and is the least urgent of the eight patches.

Microsoft's pre-release notice provides more details of the affected software packages.

Adobe will also be releasing updates on Tuesday for Reader XI and Acrobat XI for Windows. Both are rated 2, which means it's a critical vulnerability, but not known to be in use.

Author

Wang Wei has been a security consultant for the government, financial securities, banks. Working as Researcher with The Hacker News. He is also a renowned speaker on the subject of 'Exploit Writing'. He is Malware analyst, Freelancer Penetration Tester, Cloud Computing, Mobile application & Software Developer. Follow him @ Twitter | Google | Email

Popular Stories

 

iPhone Fingerprint scanner hack allows attacker to hijack Apple ID using Flight Mode
10/6/2013 4:26:00 PM

A German security firm SRL claims a vulnerability in Touch ID Fingerprint Scanner and iCloud allows a hacker to access a locked device and potentially gain control over an owner's Apple ID.

SRL points out that Airplane mode can be enabled on a stolen phone from the lockscreen, which turns off wireless connectivity and so defeats the remote wipe facility.

This can be accessed without requiring a passcode, could be a major vulnerability when it comes to physically stolen devices.

In a video demonstration, they point out that while Apple lets users locate and remotely wipe a device using the Find My iPhone app.

Since Find My iPhone can only perform a wipe if a device is connected to the Internet, but because airplane mode will disable Internet Connectivity, that may give a thief enough time to get fingerprints off of the device and eventually log in. An attacker can create a fake fingerprint on a laminated sheet and later attached to one of their fingers, as already explained by another researcher.

SRLabs suggests several things Apple could do to mitigate the problem. These include making Airplane Mode inaccessible from the lockscreen by default, and warning people not to keep a password reset email account active on a mobile device.

Author

Wang Wei has been a security consultant for the government, financial securities, banks. Working as Researcher with The Hacker News. He is also a renowned speaker on the subject of 'Exploit Writing'. He is Malware analyst, Freelancer Penetration Tester, Cloud Computing, Mobile application & Software Developer. Follow him @ Twitter | Google | Email

Popular Stories

 

You are receiving this email because you subscribed to this feed at feedmyinbox.com

If you no longer wish to receive these emails, you can unsubscribe from this feed, or manage all your subscriptions