Apple released a security update which includes 12 vulnerabilities in
Mac OS X. These vulnerabilities range from DoS, to arbitrary code
All OS X users are recommended to apply this patch as soon as possible.
In order to support BIOS service routines in legacy 16bit applications,
the Windows NT Kernel supports the concept of BIOS calls in the
Virtual-8086 mode monitor code."
"Upon successful exploitation, the kernel stack is switched to an attacker
specified address." This would allow arbitrary code execution with
"Potential security vulnerabilities have been identified with HP Power
Manager. The vulnerabilities could be exploited remotely to execute
References: CVE-2009-3999, CVE-2009-4000
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
HP Power Manager earlier than v4.2.10"
It is recommended that users of this software update immediately to
This paper is an interesting read from S Mobile Systems on Blackberry malicious applications. Blackberry admins and users should be aware of potentially dangerous third party applications. A good read.
"January 6, 2010
This is the flaw that was key in the 'Operation Aurora' attack on Google
last week. There are several workarounds that could be employed to help
mitigate the attack.
Running with Internet zone set to High, running with Data Execution
Prevention (DEP) or not running Internet Explorer at all will help to
avoid this issue.
There isn't a lot of technical data on this one, but it seems that some network equipment on AT&T's wireless network gave a session cookie to another user. Thereby circumventing authentication and just giving Facebook access to a random person.
"The diversity, volume, and innovation of the research was impressive. Competition was as fierce as ever and the judges had their work cut out. Rich Mogull, Dinis Cruz, Chris Hoff, HD Moore, Billy Rios, Dan Kaminsky, Romain Gaucher, Steven Christey, Jeff Forristal, and Michal Zalewski were tasked with ranking the field based upon novelty, impact, and overall pervasiveness."
"Microsoft is aware of reports of vulnerabilities in Adobe Flash Player
6 provided in Windows XP. We are not aware of attacks that try to use
the reported vulnerabilities or of customer impact at this time but
recommend that users install the latest version of Flash Player provided
"MIT Kerberos is prone to multiple integer-underflow vulnerabilities
because it fails to properly handle malformed encrypted data.
Attackers can exploit these issues to execute arbitrary code with
SYSTEM-level privileges. Failed attacks will result in denial-of-service
Versions prior to Kerberos 5 1.6.4 and 1.7.1 are vulnerable."