F-Secure and Authentium patch holes, while Samba flaws worry Apple users.
Users of
Mac OS X
, used to a cosy sense of security, have been warned of possible penetration vectors thanks to a slew of flaws unveiled in the
Samba
networking system used to connect
Mac
s to
Windows
systems.
An alert issued by
Symantec
‘s
DeepSight
threat team warned
Mac
users that even if their systems report being fully patched, fixes for the latest batch of vulnerabilities in
Samba
, reported in early May, are unlikely to be in place, as
Apple
has apparently not released updates to the system since 2005. While a default installation of
Mac OS X
includes
Samba
version 3.0.10, version 3.0.25 is needed to be safe from the latest flaws.
Details of the
Samba
buffer-overflow issues are
here
, and patches can be downloaded
here
.
F-Secure
meanwhile joins a growing roster of AV firms rocked by security flaws in their products in recent months, with four separate vulnerabilities in their products reported in the last few days. The most serious is a buffer overflow while scanning LHA archives, which can result in remote system access – a summary from
F-Secure
is
here
, and details from
Secunia
are
here
.
Less severe are a denial of service attack involving archives and packed files which can cause errors during scanning, another thanks to a problem with its
Policy Manager
, and a privilege escalation issue thanks to a flaw in on-access scanning. Information on each flaw is provided by
Secunia
here
,
here
and
here
, and more information is on the
F-Secure
lab blog,
here
.
Authentium
‘s troubles are down to some flawed ActiveX controls used by its product, which can apparently be exploited to gain remote system access and allow drive-by downloads from malicious or infected websites. Another summary from
Secunia
is
here
.
All users of both
F-Secure
and
Authentium
products should be automatically protected by the latest updates, but users are advised to ensure they are running the most up-to-date versions of their security software, with all relevant patches applied.
Posted on 01 June 2007 by
Virus Bulletin
Leave a Reply