Spyware, viruses, & security forum: NEWS - April 18, 2012

Oracle has released 88 security patches as part of its scheduled April Critical Patch Update (CPU), ten more than on its last patch day in January. One of the patches affects a series of vulnerabilities in the Java JRockit VM with a CVSS Base Score of 10.0 - this is the highest possible level of vulnerability in the Common Vulnerability Scoring System. Oracle also closed holes with a CVSS score of 9.0 in Grid Engine and the Windows version of the database component Spatial (in non-Windows versions the vulnerability score of this flaw is 6.5). All other vulnerabilities have scores of 7.5 or lower.

Of the 88 released updates, 6 patch holes directly in Oracle's Database Server and 6 others might affect it indirectly via Enterprise Manager Grid Control. Of the Grid Control vulnerabilities, 4 can be exploited remotely without authentication. The Oracle Fusion middleware software received 11 advisories, some of which affect Java and therefore also JRockit. Additionally, 17 patches have been released for Oracle FLEXCUBE, 11 affect PeopleSoft Enterprise and 6 relate to MySQL. Oracle has released several patches for Solaris as well.

Details about the patched vulnerabilities are still sparse as the company is trying to prevent attackers from reverse engineering the fixes before its customers have had a chance to deploy them. In an earlier out-of-band update to MySQL, this strategy failed when Oracle accidentally released a proof of concept for exploiting a vulnerability along with a security patch.

Continued : http://www.h-online.com/security/news/item/Oracle-patch-day-addresses-88-vulnerabilities-1541933.html

Also:
Oracle fixes 88 security vulnerabilities
Oracle Fixes 88 Bugs with April 2012 Critical Patch Update

See : Vulnerabilities / Fixes - April 18, 2012

The government's controversial plans to allow intelligence agencies to monitor the internet use and digital communications of every person in the UK suffered a fresh blow on Tuesday when the inventor of the world wide web warned that the measures were dangerous and should be dropped.

Sir Tim Berners-Lee, who serves as an adviser to the government on how to make public data more accessible, says the extension of the state's surveillance powers would be a "destruction of human rights" and would make a huge amount of highly intimate information vulnerable to theft or release by corrupt officials. In an interview with the Guardian, Berners-Lee said: "The amount of control you have over somebody if you can monitor internet activity is amazing.

"You get to know every detail, you get to know, in a way, more intimate details about their life than any person that they talk to because often people will confide in the internet as they find their way through medical websites ... or as an adolescent finds their way through a website about homosexuality, wondering what they are and whether they should talk to people about it."

Continued : http://www.guardian.co.uk/technology/2012/apr/17/tim-berners-lee-monitoring-internet

Related :
Google's Sergey Brin: state filtering of dissent threatens web freedom
Internet freedom under threat, says Google co-founder

.. the Mac malware remains on 140k machines

According to computer security firm Symantec, the recently discovered Flashback malware, which was estimated to be on approximately 600,000 Mac computers around the world, still hasn't been removed from some 140,000 of them. Time to perform a software update, perhaps?

Even though Apple recently released a removal tool together with a patch to prevent future infection, the Flashback malware is reported to still be on a large number of Mac computers.

Computer security firm Symantec said in a blog post on Tuesday that some 140,000 Mac machines remain infected, a significant drop from the 600,000 reported earlier this month but more than expected considering the publicity given to the malware, as well as the release of removal tools and patches from Apple, Symantec and other security firms.

"We had originally believed that we would have seen a greater decline in infections at this point in time, but this has proven not to be the case," Symantec's post said. The number of infected Macs is declining daily, but the rate of removal is slowing, as the table below shows. [Screensht]

Continued : http://www.digitaltrends.com/computing/flashback-lingers-despite-apples-fix-the-malware-remains-on-140k-machines/