A critical new threat has emerged in Internet Explorer 6,
and no patch is yet available. At the other end of the spectrum, several Linux
vendors have released patches for some critical Linux vulnerabilities.
Details
Secunia has released a security advisory detailing a new vulnerability in Microsoft’s
Internet Explorer 6 browser (CVE-2006-1992). The company has designated it a highly
critical threat.
Michael Zalewski published the original
advisory on April 23. The security vendor has conducted its own tests and
found that even fully patched versions of IE 6 may be subject to this object
tag memory corruption vulnerability.
Successful exploitation could allow the execution of
arbitrary code. However, no reports of exploits have appeared in the wild.
No patch is yet available for this flaw. Until Microsoft
releases a fix, the only workaround is to avoid visiting untrusted Web sites.
Meanwhile, the French
Security Incident Response Team (FrSIRT) has no major Windows
vulnerabilities listed, but it does cite several critical patches for Linux
versions. Each of these patches eliminates a number of CVE-listed
vulnerabilities.
- Gentoo
has released an update to address a Mozilla remote
code execution vulnerability. - Debian
patched this
threat as well as a Firefox code execution
threat last week. - Fedora did the
same. - Fedora and Gentoo both
patched an Ethereal remote code execution threat last week as well. - SGI released
a critical patch
last week.
Also watch for…
- The National
Infrastructure Security Co-ordination Centre (NISCC), a British security
organization, has reported new flaws
in the DNS protocol. - Cisco Systems
has patched
its Wireless LAN Solution Engine and other products. - Shades
of War Games: According to The
Palm Beach Post newspaper,
instead of garnering a glowing high school transcript, 18-year-old Jeff
Yorston has landed a felony fraud arrest for altering student records—perhaps
he’s watched the Matthew Broderick movie once too often.
Miss a column?
Check out the IT Locksmith Archive,
and catch up on the most recent editions of John McCormick’s column.
Want to stay on top of
the latest security updates? Automatically
sign up for our free IT Locksmith newsletter, delivered each Tuesday!
John McCormick is a
security consultant and well-known author in the field of IT, with more than
17,000 published articles. He has written the IT Locksmith column for
TechRepublic for more than four years.
Daily Tech Insider Newsletter
Stay up to date on the latest in technology with Daily Tech Insider. We bring you news on industry-leading companies, products, and people, as well as highlighted articles, downloads, and top resources. You’ll receive primers on hot tech topics that will help you stay ahead of the game.
Delivered Weekdays
