Updates

A compilation of the latest information about viruses and worms, security issues and patches to rectify the same.

Vulnerability detected in Xerox Web servers

Multiple vulnerabilities have been reported in Xerox WorkCentre and WorkCentre Pro, which can be exploited to bypass certain security restrictions, conduct cross-site scripting attacks, or cause a DoS (Denial of Service).

These include some unspecified errors in the Xerox MicroServer web server which can be exploited to bypass the user authentication.

Additionally, some unspecified errors within the handling of HTTP requests in the Xerox MicroServer web server can be exploited to cause a DoS or access certain files.

Certain unspecified input passed to the Xerox MicroServer web server is not properly sanitised before being returned to users. This can be exploited to execute arbitrary HTML and script code in a user’s browser session in the context of a vulnerable site.

It affects WorkCentre M35/M45/M55 series, WorkCentre Pro 35/45/ 55/65/75/90/165/175 and the WorkCentre Pro 35/45/55 (colour versions). WorkCentre M165 and M175 are also affected.

Patches are available at www.xerox.com/downloads/usa/en/c/cert_P23_HTTP_Patch_AllWCP.zip

Multiple vulnerabilities detected in MySQL

Some vulnerabilities have been reported in MySQL which can be exploited to cause a DoS (Denial of Service), or can potentially execute arbitrary code.

This can be exploited to crash any application that uses the zlib library, or potentially to execute arbitrary code with privileges of the vulnerable application.

The vulnerability has been reported in version 1.2.2. Prior versions may also be affected. Patches are available from the vendor.

W32/Banworm-C reported by Sophos

Sophos has reported a worm that spreads through a network and affects Windows. The side effects include dropping of malware and reduced system security. The worm installs itself in the registry and exploits system or software vulnerabilities.

W32/Banworm-C spreads to other network computers by exploiting common buffer overflow vulnerabilities.

CA reports Win32 Jginko.A virus

CA has reported Win32.Jginko.A, a password stealing Trojan. When executed, Win32.Jginko.A copies itself to C:\system.exe and sets the registry value so that this file can be executed at the start of Windows. The Trojan monitors sites visited by the user (when browsing with Internet Explorer). If any of the sites or URLs (related to Japanese Internet banking) is visited, the Trojan logs all login information (such as account numbers and passwords) entered by the user.

Malware reported by Trend Micro

Trend Micro has reported Worm_Mytob.IV, a malware. Like other Worm_Mytob variants, this memory-resident worm propagates by sending a copy of itself as an attachment to an e-mail message, which it sends to target recipients using its own Simple Mail Transfer Protocol engine.

It gathers target e-mail addresses from the Windows Address Book and Temporary Internet files folder, as well as from files. Further, this worm has backdoor capabilities and attacks Windows NT, 2000 and XP.