Updates

A compilation of the latest information about viruses and worms, security issues and patches to rectify the same

Yahoo! Messenger vulnerability

Secunia Research has discovered a vulnerability in Yahoo! Messenger that can be exploited by local users to gain escalated privileges. Long filenames are displayed incorrectly in the application’s file transfer dialogue. This exploit can be used to trick users into unwittingly running malware executables. It can only happen if the ‘Hide extension for known file types’ option is enabled in Windows; this is the default setting. This vulnerability has been confirmed in version 6.0.0.1750 of Yahoo! Messenger. It has been updated in version 6.0.0.1921 that can be download from messenger.yahoo.com

New worm discovered

Trend Micro has warned of a new virus, WORM_AHKER.E, that attempts to propagate via e-mail, peer-to-peer file sharing networks and Internet Relay Chat (IRC). The virus prevents users from accessing security and anti-virus vendor websites by modifying registry entries. At the same time, the virus also tries to launch a denial of service attack on www.windowsupdate.microsoft.com. Most anti-virus firms have released patches to stop this virus.

Apple patches Java for OS X

Apple has released a patch for a vulnerability in Java for Mac OS X, which can be exploited by hackers to compromise a user’s system. The patch can be downloaded from

www.apple.com/support/downloads/securityupdate2005002macosx1034orlater.html

SUSE patches Squid

SUSE has issued an update for the popular Squid proxy server that fixes a vulnerability that can be exploited to launch a denial of service attack.

Patches can be downloaded from:

For SUSE Linux Professional 9.2

ftp.suse.com/pub/suse/i386...6/squid-2.5.STABLE6-6.8.i586.rpm

a207ddd1b3700d2a345570b40ffdcb16

For SUSE Linux Professional 9.1

ftp.suse.com/pub/suse/i386...squid-2.5.STABLE5-42.30.i586.rpm

8b3f3300e055260ea5a59c8a95f71d42

KDE vulnerability

Vulnerabilities in KDE, a popular desktop environment for Linux, may permit local users to gain escalated privileges. These vulnerabilities can be exploited to cause stack based buffer overflows. Users can download patches for KDE 3.3.2 from

ftp.kde.org

Trojan horse

Symantec has warned of a trojan horse called Trojan.Dremn that attempts to log keystrokes and steal information. The trojan passes itself off as a Microsoft Word document with a password protected macro. Most security vendors have released patches to stop this trojan.

MyDoom variant uses search engines

The latest variant of MyDoom searches an infected computer’s hard disk for e-mail addresses. After pulling out domain names from these e-mail addresses, it searches the Internet for e-mail addresses from the same domains. The worm directs its search requests to Google followed by Lycos, Yahoo and Altavista.