Here’s a collection of recent security vulnerabilities and alerts, which covers two security updates released by Novell, updates for avast! antivirus, Skype and Camino 1.5.4 for the Mac OS X, a DoS vulnerability in the Cisco 7940 SIP phone, vulnerability issues with Windows Media Player, a latest legal threat made against security site Secunia, and how researchers were able to circumvent anonymization by Netflix.

  • Novell releases two security updates

Novell has released two security updates, the first of which closes a hole in Novell NetMail which can be exploited to compromise a system running version 3.5.2 of the software. The second update fixes three vulnerabilities in Novell BorderManager 3.8. The most serious of these vulnerabilities involes a flaw in Novell Client Trust.

You can check out additional information about the NetMail 3.5.2, or BorderManager 3.8 vulnerabilities.

  • Security update for avast! antivirus released

An update for the avast! antivirus have been released which fixes two security-related bugs. Both avast! 4 Home and Professional editions has vulnerabilities in the Tar and RAR unpacker. It is possible for an attacker to exploit them to gain access to a system. Avast! users should already have been updated via its automatic update.

Other antivirus products which uses the avast! engine might not have been updated yet, though it remains unclear if they implement their own unpacker.

You can read more on this in this security advisory from Nevis Labs on this: Avast! antivirus TAR processing remote heap corruption.

  • Critical hole in Skype remedied

It appears that Skype has once again closed critical holes furtively without informing users at all. According to Zero Day Initiative, a specific flaw exists within the ‘skype4com’ URL handler created by Skype during installation. Processing short string values through this handler might result in an exploitable memory corruption which can result in arbitrary code execution in the context of the current user.

Users who still have an older version of Skype should install the latest version as soon as possible.

  • DoS vulnerability in Cisco 7940 SIP phone

The authors of the Nokia report have also discovered a DoS vulnerability in the SIP implementation of the Cisco 7940 IP phone. The impact is that knowledge of the userid and IP address of the target, it is possible for a remote user to crash the phone. Alternatively, a DoS can be performed by sending a certain sequence of packets at regular intervals.

The vulnerability has been confirmed for firmware POS3-08-7-00. No update have been made available from Cisco yet. A perl proof of concept is available here.

  • Security holes in Camino 1.5.4 Web browser for Mac OS X closed

Version 1.5.4 of the Camino Web browser for the Mac OS X have been released. It closes security holes which resulted in the release of Firefox 2.0.0.10 and followed by Firefox 2.0.0.11. Improved ad blocking has been thrown in as well as its looks adapted to match Apple’s Mac OS X 10.5 operating system.

YOu can check out the release notes here.

  • Issues with Windows Media Player

According to multiple sources, there are unpatched remote vulnerabilities in Windows Media Player 6.4 and Windows Media Player Classic 6.4. The vulnerability can be triggered by enticing an unsuspecting user to open a malicious MP4 file. A successful exploit will allows remote attackers to execute arbitrary code in the context of the local user running the application.

Media Player 6.4 is the default on Windows NT and 95 systems. However, it is also included with later versions of the Windows operating system as “mplayer2.exe,” where its used by some apps to access its Directshow functionality.

  • Secunia faces legal threat over flaw advisory

Autonomy, the maker of the KeyView SDK – which adds document-printing and viewing functionality to applications, has demanded taht security site Secunia remove details of flaws in its SDK from its public database. Secunia published the advisory late last month on November 29 after identifying that several previous vulnerabilities occurred in the SDK and not in third-party products.

Secunia has asserted that what they are doing is completely legal, and pledged to continue to do vulnerability research in Autonomy products and any other products of interest. You can read the Secunia blog entry here.

  • Researchers reverses Netflix anonymization

In a demonstration of the privacy dangers of databases that collects consumer habits, two researchers hailing from the University of Texas at Austin have shown how a handful of moving ratings can reveal the identity of a person.  They claimedto haveidentified two people out of a nearly half million anonymized users.

According to Professor Vitaly Shmatikov, “Releasing the data and just removing the names does nothing for privacy.  If you known their name and a few records, then you can identify that person in the other (private) database.”

You can read more about the paper  published by the researchers.