Storm Making A Comeback As A Modified Version

The bot code used in the infamous, massive Storm botnet that was taken down nearly two years ago is being used to build another spamming botnet.

Related links:
https://www.honeynet.org/node/539
http://www.darkreading.com/insiderthreat/security/client/showArticle.jhtml?articleID=224700110
http://krebsonsecurity.com/2010/04/infamous-storm-worm-stages-a-comeback/

Malware Targeting iPad Users

Security company BitDefender warns about malware that is targeting iPad owners. E-mail invitation promises to keep iPad software updated “for best performance, newer features and security”. Purpose is to lure user to click included web link that is said to contain new version of iTunes software needed to update iPad. Instead of being iTunes update the file is actually malware that BitDefender detects as Backdoor.Bifrose.AADY.

Read the story here.

Patched Version Of VLC Player Available

VideoLAN project has released a new version of their VLC media player. Version 1.0.6 fixes several vulnerabilities in different media format handling. By exploiting the vulnerabilities an attacker may be able to execute arbitrary code in target system.

Affected are VLC Player versions 0.5.0 - 1.0.5. Owners of those versions should update to the 1.0.6 version. Version 1.1.0 (currently in pre-release stage) is not affected by these vulnerabilities.

Symantec Internet Security Threat Report

Symantec has published "Global Internet Security Threat Report Trends for 2009" report. The report provides an overview and analysis of Internet threat activity worldwide, a review of known vulnerabilities, and highlights of malicious code. Other covered things are trends in phishing and spam. The report assess also observed activities on underground economy servers.

The report can be viewed here.

Update For Java Available

New Java version fixes vulnerability in Java Web Start control. The vulnerability is currently actively exploited and so it's important Java users update their versions to the latest version available.

The latest update can be downloaded here.

More information about contents of the update can be read from Release Notes of Java SE 6 Update 20.

Updates For Adobe PDF Software

There has been detected critical vulnerabilities in Adobe Reader and Acrobat PDF products. These vulnerabilities could cause the application to crash and could potentially allow an attacker to take control of the affected system.

Affected versions:
Adobe Reader 9.3.1 and earlier versions
Adobe Acrobat 9.3.1 and earlier versions

Users of vulnerable versions are instructed to update their versions either by using automatic update functionality or by downloading fresh version manually. The default installation configuration runs automatic updates on a regular schedule and can be manually activated by choosing Help > Check for Updates.

Those who want to upgrade manually, can download the latest versions of the links below:
Adobe Reader
Acrobat Standard and Pro
Acrobat Pro Extended
Acrobat 3D


More information about fixed vulnerabilities can be read from Adobe's security bulletin.

Updates To Oracle Products Released

Oracle has released updates for their products that fix 47 security issues in total. The updates are a part of Oracle's quarterly released critical patch update (CPU).

Detailed list of vulnerabilities with patching instructions can be read from Oracle CPU Advisory.

Next Oracle CPU is planned to be released in July 2010.