Last Updated: 2006-03-24 20:29:25 UTC
by Deborah Hale (Version: 2)
From the Microsoft advisory:
"Microsoft has confirmed new public reports of a vulnerability in Microsoft Internet Explorer. Based on our investigation, this vulnerability could allow an attacker to execute arbitrary code on the user's system in the security context of the logged-on user. We have seen examples of proof of concept code but we are not aware of attacks that try to use the reported vulnerabilities or of customer impact at this time."
Microsoft Suggested Workarounds:
* Configure Internet Explorer to prompt before running Active Scripting or disable Active Scripting in the Internet and Local intranet security zones.
* Set Internet and Local intranet security zone settings to "high" to prompt before Active Scripting in these zones.
Microsoft says that they are still investigating and will provide more information as it becomes available. So stay tuned for further updates.
Last Updated: 2006-03-24 19:22:24 UTC
by Adrien de Beaupre (Version: 2)
Update 2: 2006-03-24 19:21 UTC - Sun has updated the advisory and will be providing patches for Solaris 8 as well. Thank you, Sun. --JAC
Sendmail has released an advisory related to a vulnerability in all versions of sendmail 8 previous to 8.13.6 of this popular MTA. The advisory includes the commercial versions of products using sendmail.
and it has CVE entry CVE-2006-0058
Impact: the attacker could run arbitrary commands.
Mitigation: upgrade to 8.13.6, apply the patch, or setting the RunAsUser option in the configuration file.
This one looks bad.
Update: as more information becomes available this is starting to look worse.
Patch or upgrade NOW!
Last Updated: 2006-03-23 13:14:13 UTC
by John Bambenek (Version: 1)
A reader wrote in reporting a worm spreading through the latest Mambo/Joomla exploits and establishing an IRC connection. When I looked it appeared the botnet was already down but it is trivial to modify the shellbot code and regenerate the botnet. Joomla 1.0.8 was released Feb 26th and had 37 (wow) security fixes, so if you aren't running 1.0.8, you have been warned. It doesn't appear that any new vulnerabilities have been discovered since the release.
bambenek -at- gmail -dot- com
Please choose a specific diary above to comment