Symantec fixes flaw in Brightmail AntiSpam
Symantec has updated its Brightmail AntiSpam product to fix a vulnerability attackers could exploit to bypass security restrictions. In an advisory, the Cupertino, Calif.-based antivirus giant said attackers could use a static database administration password in Brightmail AntiSpam to access the database.
"With the release of Symantec Brightmail AntiSpam version 6.0, some configuration information is now also stored in the database," the advisory said. "The 6.0 release added security by restricting access to the admin account to local host. However, Symantec engineers have found the restriction to local host failed when upgrading from a prior version… It was only effective if a clean install of [the product] was done. Prior versions… that were upgraded to 6.0 without doing a clean install remained remotely accessible."
Symantec has released version 6.0.2 to address the issue.
No IE 7.0 for Windows 2000
The extra security muscle in the upcoming release of Internet Explorer 7.0 will be of no use to Windows 2000 users. Chris Wilson, Microsoft's IE program manager, has posted a message on the Internet Explorer Weblog saying the beefed up browser will only run on Windows XP SP2.
"It should be no surprise that we do not plan on releasing IE 7 for Windows 2000," he said. "One reason is where we are in the Windows 2000 lifecycle. Another is that some of the security work in IE 7 relies on operating system functionality in XP SP2 that is non-trivial to port back to Windows 2000."
Wilson's comments were part of a larger message about future support for the antiquated but still-used Windows 2000. He said the operating system will move from what the software giant calls "mainstream" support to the less functional "extended" support after June 30.
Report: Global security revenue up 5%
Here's more evidence that growing cyberthreats have security vendors rolling in revenue: San Jose, Calif.-based Infonetrics Research said in a new report that global network security appliance and software revenue rose 5% between the last quarter of 2004 and the first quarter of 2005. And the firm predicts revenue will grow another 27% to $1.3 billion in the first quarter of 2006. Infonetrics predicted annual revenue will grow to $6.5 billion by 2008. The firm said its network security appliance and software revenue forecast for the first quarter of 2005 was within 1% of actual revenue. The firm also said that:
- Cisco is the worldwide revenue leader in the overall network security appliance and software market, a position it has more or less maintained since 2002;
- Check Point is second in worldwide revenue share and Juniper is close behind in third;
- Enterasys, ISS, McAfee, Nokia, Nortel, SonicWALL, and Symantec are strong second-tier players, with significant revenue market share across a number of categories; and
- VPN/firewall appliances and software accounted for 78% of first-quarter revenue, with IDS/IPS second at 14% and gateway antivirus third at 8%.
Apple fixes QuickTime flaw
Apple has released an update to QuickTime 7 that plugs a security hole, Macworld reported Wednesday. The QuickTime 7.0.1 update fixes a vulnerability in which a QuickTime movie containing a maliciously crafted Quartz Composer object could leak data to an arbitrary Web location. "Quartz Composer objects can be wrapped in a QuickTime track and delivered as a QuickTime movie," Apple said in an advisory. "With QuickTime 7.0, a Quartz Composer object can gather local data and send it using an encoded URL to an arbitrary Web location. The QuickTime 7.0.1 update modifies the QuickTime Quartz Composer Plug-in to prevent access to remote Web locations."
New probe of laptop theft holding Justice Dept. employee data
A travel agency catering to government employees says no Social Security numbers or home addresses were stored in a stolen laptop holding travel account data on up to 80,000 Department of Justice employees. The Washington Post reports the password-protected computer was stolen from Omega World Travel of Fairfax, Va., in early May and held names and account numbers from travel credit cards. Company officials would not disclose how the laptop was stolen but did tell the newspaper it had improved its physical security and done a computer security audit. It also configured its computing systems to reject the pilfered laptop in the event the thieves broke the password and tried to illegally access the network.
Flaw in Nortel VPN routers
Attackers could exploit a flaw in Nortel VPN routers to cause a denial of service, Danish security firm Secunia said in an advisory. "The vulnerability is caused due to an error in the handling of IKE packets and can be exploited via a specially crafted IKE packet containing a malformed ISAKMP header," the firm said. "Successful exploitation causes the VPN router to crash or reboot." Secunia said the vulnerability has been reported in the 600, 1010, 1050, 1100, 1600, 1700, 1740, 2600, 2700, 4500, 4600, and 5000 models. The firm recommended users upgrade to version 5.05.200 or install patched versions of 4.76, 4.85, 4.90, or 5.00 when available.