Independent

ComputerWorldIndependent

More June security patch bugs: You can patch an IE flaw, CVE-2017-8529, or print inside iFrames—but not both

Credit to Author: Woody Leonhard| Date: Wed, 19 Jul 2017 12:00:00 -0700

Strap on your hip waders. This particular “scare” article should have you thinking yet again about the advisability of installing Windows updates as soon as they’re available. As you’ll see, Microsoft itself has flip-flopped on the resolution and those who subscribe to Windows Update have been taken along for the ride.

Buggy June patches to Windows, Internet Explorer and Edge left customers in the horns of a dilemma:

  • You can plug a security hole known as CVE-2017-8529, in which IE or Edge reveal the presence of a specific file on your computer when you simply surf to a compromised web site, OR
  • You can print content on web pages that are inside an HTML construct known as an iFrame, using IE 9, 10 or 11.

Microsoft’s up against a hard bug that makes this an either-or proposition: Until Microsoft figures out how to fix both problems at the same time, either you patch the security hole, or you can print inside iFrames with IE, but not both.

To read this article in full or to leave a comment, please click here

Read More
ComputerWorldIndependent

More June security patch bugs: You can patch an IE flaw, CVE-2017-8529, or print inside iFrames — but not both

Credit to Author: Woody Leonhard| Date: Wed, 19 Jul 2017 12:00:00 -0700

Strap on your hip waders. This particular “scare” article should have you thinking yet again about the advisability of installing Windows updates as soon as they’re available. As you’ll see, Microsoft itself has flip-flopped on the resolution and those who subscribe to Windows Update have been taken along for the ride.

Buggy June patches to Windows, Internet Explorer and Edge left customers in the horns of a dilemma:

  • You can plug a security hole known as CVE-2017-8529, in which IE or Edge reveal the presence of a specific file on your computer when you simply surf to a compromised web site, OR
  • You can print content on web pages that are inside an HTML construct known as an iFrame, using IE 9, 10 or 11.

Microsoft’s up against a hard bug that makes this an either-or proposition: Until Microsoft figures out how to fix both problems at the same time, either you patch the security hole, or you can print inside iFrames with IE, but not both.

To read this article in full or to leave a comment, please click here

Read More
IndependentKrebs

Trump Hotels Hit By 3rd Card Breach in 2 Years

Credit to Author: BrianKrebs| Date: Wed, 19 Jul 2017 15:43:36 +0000

Maybe some of you missed this amid all the breach news recently (I know I did), but Trump International Hotels Management LLC last week announced its third credit-card data breach in the past two years. I thought it might be useful to see these events plotted on a timeline, because it suggests that virtually anyone who used a credit card at a Trump property in the past two years likely has had their card data stolen and put on sale in the cybercrime underground as a result.

Read More
IndependentKrebs

Experts in Lather Over ‘gSOAP’ Security Flaw

Credit to Author: BrianKrebs| Date: Tue, 18 Jul 2017 14:30:11 +0000

Axis Communications — a maker of high-end security cameras whose devices can be found in many high-security areas — recently patched a dangerous coding flaw in virtually all of its products that an attacker could use to remotely seize control over or crash the devices. The problem wasn’t specific to Axis, which seems to have reacted far more quickly than competitors to quash the bug. Rather, the vulnerability resides in open-source, third-party computer code that has been used in countless products and technologies (including a great many security cameras), meaning it may be some time before most vulnerable vendors ship out a fix — and even longer before users install it.

Read More
ComputerWorldIndependent

Microsoft yanks bad Outlook patches of patches KB 3191849, 3213654, 401042

Credit to Author: Woody Leonhard| Date: Sat, 15 Jul 2017 13:16:00 -0700

Read More
IndependentSecuriteam

SSD Advisory – Geneko Routers Unauthenticated Path Traversal

Credit to Author: SSD / Maor Schwartz| Date: Sun, 16 Jul 2017 07:24:56 +0000

Vulnerability Summary The following advisory describes a Unauthenticated Path Traversal vulnerability found in Geneko GWR routers series. Geneko GWG is compact and cost effective communications solution that provides cellular capabilities for fixed and mobile applications such as data acquisition, smart metering, remote monitoring and management. GWG supports a variety of radio bands options on 2G, … Continue reading SSD Advisory – Geneko Routers Unauthenticated Path Traversal

Read More
ComputerWorldIndependent

Verifying and testing that Firefox is restricted to TLS 1.2

Credit to Author: Michael Horowitz| Date: Sun, 16 Jul 2017 12:56:00 -0700

TLS is the protocol invoked under the covers when viewing secure websites (those loaded with HTTPS rather than HTTP). There are multiple versions of the TLS protocol, and the most recent version, 1.2, is the most secure. Last time, I discussed tweaking Firefox so that it only supports TLS version 1.2 and not the older versions (1.0 and 1.1) of the protocol.

But that begs the question: what happens when a security-reinforced copy of Firefox encounters a website that does not support TLS 1.2? The answer is shown below.

To read this article in full or to leave a comment, please click here

Read More
IndependentKrebs

Porn Spam Botnet Has Evil Twitter Twin

Credit to Author: BrianKrebs| Date: Sun, 16 Jul 2017 12:11:35 +0000

Last month KrebsOnSecurity published research into a large distributed network of apparently compromised systems being used to relay huge blasts of junk email promoting “online dating” programs — affiliate-driven schemes traditionally overrun with automated accounts posing as women. New research suggests that another bot-promoting botnet of more than 80,000 automated female Twitter accounts has been pimping the same dating scheme and ginning up millions of clicks from Twitter users in the process.

Read More