Oracle patches SSL server bugs

Posted on by admini

The flaws exploit the ASN.1 (Abstract Syntax Notation 1) syntax notation used by the SSL (Secure Sockets Layer) and TLS (Transport Layer Security) protocols, which are widely used for exchanging data securely on the internet.

By submitting data that was purposefully constructed, a malicious client could, theoretically, gain control over certain servers running SSL or TLS software.

Oracle could have reduced the risk presented by these bugs had it removed certain features from the OpenSSL software libraries included with its servers, according to Thor Larholm, a senior security researcher with PivX Solutions, a network security consultancy.

More info: [url=http://www.computerweekly.com/articles/article.asp?liArticleID=127127&liFlavourID=1&sp=1]http://www.computerweekly.com/articles/article.asp?liArticleID=127127&liFlavourID=1&sp=1[/url]

Read more

Microsoft Clarifies Intentions to Retire JVM-Based Products

Posted on by admini

On Monday, Microsoft posted a new note to its Microsoft Developer Network (MSDN) community site, stating that the company is now planning to ax certain products from all Microsoft sales channels starting December 23.

MSDN Subscriber Downloads program manager Andy Boyd had posted a note on December 4 stating that Microsoft intended to remove Windows 98, SQL Server 7 and a number of versions of Office 2000 from MSDN downloads and all other Microsoft sales channels.

The December 8 note explains that Microsoft intends to ax the NT 4.0 Terminal Server and Option Pack releases only.

More info: [url=http://www.microsoft-watch.com/article2/0,4248,1407759,00.asp]http://www.microsoft-watch.com/article2/0,4248,1407759,00.asp[/url]

Read more

Congress OKs First National Anti-Spam Bill

Posted on by admini

Congress on Monday approved the first national effort to stem a flood of unwanted E-mail pitches offering prescription drugs, cheap loans, and other come-ons.

The House voted without dissent to approve slight changes Senate lawmakers made to the “can spam” legislation, which would outlaw the shadiest techniques used by the Internet’s most prolific E-mailers, who send tens of millions of messages each day. The last such major legislation was a 1998 law banning Web sites from collecting personal information from children under 13.

The anti-spam bill encourages the Federal Trade Commission to create a do-not-spam list of E-mail addresses and includes penalties for spammers of up to five years in prison in rare circumstances.

More info: [url=http://www.informationweek.com/story/showArticle.jhtml?articleID=16600425]http://www.informationweek.com/story/showArticle.jhtml?articleID=16600425[/url]

Read more

Cybersecurity groups work on white papers

Posted on by admini

The working groups have pledged to release white papers by 1 March, 2004, that outline their recommendations for securing businesses and consumers and creating more secure software.

Critics have snubbed the United States’ cybersecurity policy — the National Strategy to Secure Cyberspace — as largely voluntary and lacking regulatory prescriptions.

The four organisations that sponsored the Summit were the Business Software Alliance, the Information Technology Association of America, the TechNet lobbying group and the US Chamber of Commerce.

Security experts formed five groups to focus on specific problem areas: creating awareness in home computer users and small businesses; establishing a cybersecurity early warning system; making information security part of corporate governance; advocating technical best practices for security; and pushing security improvements into the software development process.

Despite the pressure to deliver, reigning in the groups to focus on concrete ideas that could be implemented quickly was a task, Oracle’s Davidson said.

More info: [url=http://news.zdnet.co.uk/business/0,39020645,39118329,00.htm]http://news.zdnet.co.uk/business/0,39020645,39118329,00.htm[/url]

Read more

How To Use Encryption On Database Contents

Posted on by admini

It may be time to protect your data where it lives–in your database.

But you can’t encrypt everything in your database. Indexed fields, for example, can’t be encrypted because your database-management software will sort the encrypted strings in hexadecimal values, which won’t match the real, unencrypted form. So your index, which is supposed to speed access to the data by preordering it, won’t work. Even if you could relate the encrypted index field to the original data, the collation order wouldn’t match.

Until databases support encryption natively, encrypted indices will be a problem. Remember that any indices generated from encrypted fields won’t be valid, either. And because these fields don’t relate to the actual data, it’ll be harder for the database administrator and developer to debug problems.

Database software, such as Sybase’s, lets you create encrypted databases.

Ingrian Networks’ DataSecure Platform, which lets you encrypt certain fields before you enter them in the database and automatically decrypts them on the way out, has been around for a couple of years.

Bottom line: When building your disk capacity for database encryption, anticipate that your data will triple or quadruple in size.

More info: [url=http://www.securitypipeline.com/story/showArticle.jhtml?articleID=16600160]http://www.securitypipeline.com/story/showArticle.jhtml?articleID=16600160[/url]

Read more

Security fears push users to open source

Posted on by admini

“Without a new killer app in Office, the upgrade cycle looks to be gradual until new XML-based technologies take hold of the broader market,” said the report. Professor Neil Barratt, technical director at security consultant Information Risk Management, said: “My reading of this is that it’s a shot across the bows.

“The main beef most CIOs have is patching; the perception is that the Microsoft patching system needs a lot more work.

More info: [url=http://www.vnunet.com/News/1151313]http://www.vnunet.com/News/1151313[/url]

Read more