Here’s a collection of recent security vulnerabilities and alerts, which covers a backdoor in HP and Compaq laptops, the release of Nmap 4.50, the public release of Windows Vista SP1 release candidate, source packages of SquirrelMail being compromised, an SQL Injection vulnerability found in Typo3 CMS, the release of 11 packages in December’s Patch Tuesday, and vulnerabilities in earlier versions of DirectX and DirectShow.

  • Backdoor in HP and Compaq laptops

A critical flaw has been dsicovered in the HP Info Center software that comes preinstalled on many HP and Compaq laptops. An attacker can infect a vulnerable laptop with malware when its user visits a malicious website using either Internet Explorer 6 or 7.

The vulnerability resulted from the ActiveX control for this module being declared ‘Safe for Scripting’. As it result, it gives any website full scripting access and control to it via JavaScript. According to exploit portal Milw0rm, the problem affects the HP Info Center v1.0.1.1 in Windows 2000, XP, Server 2003 and Vista.

You can read more about the issue here, or simply apply the update here.

  • Nmap 4.50 released

zenmap.pngA major new release of Nmap has been released earlier this week. To get an idea how major this is – there are over 320 changes since version 4.00 shown in the changelog.

It comes with a spanking new scripting engine that allows you to write your own script for high-performance network discovery, a 2nd generation OS detection system with more than a thousand new fingerprints, and also 1,500 more version detection signatures, among other things.

It also features a new GUI as well as a result viewer called Zenmap. You can read the release notes here, or download Nmap 4.50 here.

  • Windows Vista SP1 Release Candidate released for public download

The candidate release of Widnows Vista SP1 has been released for public download. The primary purpose of this Service Pack is to correct known flaws, and indeed, it fixes a huge number of usability bugs.

There is a lot added in SP1, and you might want to check out this Technet article for an overview of SP1 for Windows Vista. More details can be gleaned from this other article.

It might be of interest to note that a number of features were added that should help to improve the reliability of Windows Update and allow patching without having to reboot. Termed “hotpatching,” it is a process in which Windows components are updated while still in use by a running process. You can read more about it from this Ars Technica article here.

  • SquirrelMail source packages compromised

The source packages for the SquirrelMail webmail system were modified after their official release on December 5. The package compromise happened on December 8 and was only discovered as a result of mismatching MD5 checksums.

The developers were able to trace the rogue modifications back to an apparently compromised maintainer account. The unauthorised modifications should have “little to no impact,” according to the developers analysis. A program error should be the worst possible consequence, though the developers also state they they cannot follow the modifications completely.

Only the packages of the current stable version 1.4.12 are affected. If you downloaded the affected packages between 8 and 13 of December, you can reinstall the original packages now available for download to be certain.

  • SQL injection vulnerability found in Typo3 CMS

The popular Typo3 content-management system has a vulnerability that can be exploited to order to gain authorized access to the database via an SQL Injection. This vulnerability arises from the system extension indexed_search which is a standard extension found in Typo3.

It is necessary to be a logged-on backend user to exploit this flaw though. However, if you use TYPO3 4.1.x, it is recommended y ou update to TYPO3 version 4.1.4 or later. Administrators running TYPO3 3.x or 4.0.x, are recommended to update to TYPO3 version 4.0.8 or later.

  • Microsoft releases 11 patches in December’s patch Tuesday

Microsoft released software updates in December’s patch Tuesday that plug at least 11 security holes in its Windows operating systems as well as other software. Three of these were designated as “critical” while another four were deemed “important.”

You can read more at Microsoft’s December patch summary here.

  • Vulnerabilities in Microsoft DirectX 7, 8 and DirectShow

There is a stack buffer overflow vulnerability in Microsof’s DirectShow that could allow an attacker to execute arbitrary code in the context of the local user.

It has to do with the DirectShow SAMI parser, which is implemented in the file quartz.dll. The SAMI parse does not properly check the length of the parameter. Hence parsing a specially crafted SAMI file can cause a stack-based buffer overflow.

iDefense has confirmed Microsoft DirectX 7.x and Microsoft DirectX 8.x are vulnerable. Microsoft DirectX 9.0c or newer is not vulnerable.