http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02048471

http://secunia.com/advisories/39003/

Spamassassin Milter Plugin Remote Root Exploit
An exploit has been published to the mailing list “Full Disclosure” for a 0-day attack against the Spamassassin Milter Plugin. Spamassassin is a popular OpenSource spam filtering system. Successful exploitation results in remote root access to vulnerable systems. A preliminary patch for the flaw has been published to the project site. Mitigation recommendations include not running the milter (mail filter) plugin as root and not using the -x option. Users should implement the mitigations and patch vulnerable systems as soon as possible. Upgrades should be preformed as soon as official updates are made available.

http://isc.sans.org/diary.html?storyid=8434

http://www.securityfocus.com/bid/38578/info

http://seclists.org/fulldisclosure/2010/Mar/140

http://savannah.nongnu.org/bugs/index.php?29136

Proof of concept code exploiting a vulnerability (CVE-2010-0425) in the Apache HTTP server version 2.2.14, mod_isapi, was published to a well known Web site. Notes in the code state that the exploit may need to be run several times to achieve successful spawning of a shell however – a success rate of 70% is reported. Also mentioned in the code is that, if DEP is enabled (Windows platforms) for the Apache process, the result may be a denial of service condition. As CVE-2010-0425 is one of those noted as addressed in the above 2.2.15 release, we again suggest updating as soon as possible.
http://www.exploit-db.com/exploits/11650
http://securityreason.com/wlb_show/WLB-2010030028

Browser vulnerabilities
A proof of concept exploit has been posted for a vulnerability in the iPhone browser. The exploit sends a malformed CSS style tag which causes a denial of service. It’s possible that a remote attacker could execute arbitrary code if the victim is tricked into visiting a malicious website. The same vulnerability is reported to also affect Apple’s Safari browser and Google’s Chrome browser.
http://www.packetstormsecurity.nl/1002-exploits/iphone_crash.py.txt
http://www.packetstormsecurity.nl/1002-exploits/safarichrome-dos.txt

Olympic themed SEO
Last week we highlighted the use of Search Engine Optimization (SEO) techniques where an attacker modifies the optimized search results of search engines to direct users to malicious sites. Currently, many search results for Olympic-themed queries lead to malicious sites. Upcoming events like the St. Patrick’s Day holiday and Spring Break in March may be the next campaigns that are abused. We encourage our customers to be cautious when clicking on links from search results and to visit official Web sites when possible.
http://www.avertlabs.com/research/blog/index.php/2010/02/23/on-olympics-st-patricks-day-screensavers-and-wallpaper/
http://twitter.com/mikkohypponen/status/9628022758

When asked why she had such a long password, she said she was told that it had to be at least 8 characters long and include at least one capital…

Pay attention to what you post and upload. Social networking is public.

• Consider images, videos, and information you publish
• You shouldn’t publish your address, date of birth, etc.
• Use a nick-name that only your friends know.

Choose your friends with care.

• Do not accept friend requests from people you do not know
• Verify all your contacts

Protect your work and environment and avoid reputation risk

• When joining a social networking site use your personal e-mail address
• Be careful how you portray your company online
• Do not mix your business contacts with your friend contacts

Protect your mobile phone and the information saved on it from any physical intrusion

• Do not let anyone see your profile or personal information without consent
• Do not leave your phone unattended
• Do not save your passwords on your mobile phone
• Use the security features available on your mobile phone

Turn off Location Aware Services

• Twitter, Google Buzz, Foursquare and new Smart-phones will publish your location when you post an announcement. Letting the entire world know you aren’t home. See the website http://pleaserobme.com/
• Instead of using a GPS to mark your home location, have your GPS set home to a familiar landmark near your home, such as a corner store. If a thief breaks into your car, not only do they know you aren’t home, but they will have access to your garage door opener and turn by turn directions to your front door.

When Planning Vacation

• Do not post dates and times you will be away, rather write posts as a journal of events that have happened so it’s a surprise that you were gone for a period of time.

Please see the following flowchart for procedures on anti-phishing for email.