Apple TV gets a security update


	August 07, 2008 New version of Spytech SpyAgent added! more New build of All In One Keylogger 3.1 added! more


	August 29, 2008 ICO urges firms to step up privacy controls more Watch Out! Firing IT Workers Can Cost You more New security rules on tap for credit-card handlers more Royal College of Physicians improves database security more FBI warns of hit man scam more Bank of New York loses 12.5 million customer details more Microsoft introduces black screens for pirates more Four Quick Tips for Choosing an IM Security Product more Intel releases Bios update more Microsoft warns of IE8 lock-in with XP SP3 more Apple confirms iPhone security bug, promises patch more Best Western forced to play defense on data breach disclosure more

E-mail:

E-mail:

DISCLAIMER: Logging other people's keystrokes or breaking into other people's computer without their permission can be considered illegal by the courts of many countries. The monitoring software reviewed here is ONLY for authorized system administrators and/or owners of computers. We assume no liability and are not responsible for any misuse or damage caused by the keylogging software. The end user of this software is obliged to obey all applicable local, state, federal and other laws in his country of residence.

July 11, 2008

Apple TV gets a security update

Apple released a security update on Thursday for its Apple TV. Version 2.1 includes six patches that address buffer overflow and arbitrary code execution vulnerabilities.

Apple TV 2.1 can be automatically downloaded when the update is detected by the Apple TV device. The patches may take up to one week to be detected, depending on the day a device checks. A manual update can be accomplished by using the TV interface and selecting Settings > Update Software. This update will not appear in your computer's Software Update application or in the Apple Downloads site.

Here's an overview of the six patches, which affect only users of Apple TV:

* The update addresses a buffer overflow vulnerability described in CVE-2008-1015. According to Apple, "an issue in the handling of data reference atoms may result in a buffer overflow. Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution". Apple credits Chris Ries of Carnegie Mellon University Computing Services for reporting this issue.

* The update addresses a buffer overflow vulnerability described in CVE-2008-1017. Apple says "an issue in the parsing of 'crgn' atoms may result in a heap buffer overflow. Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution". Apple credits Sanbin Li, working with TippingPoint's Zero Day Initiative, for reporting this issue.

* The update addresses a buffer overflow vulnerability described in CVE-2008-1018. Apple says "viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution". This update addresses the issue through improved handling of format strings.

* The update addresses an arbitrary code execution vulnerability described in CVE-2008-2314. Apple says "a URL-handling issue exists in the handling of 'file:' URLs. This may allow arbitrary applications and files to be launched when a user plays maliciously crafted QuickTime content. This update addresses the issue by no longer launching local applications and files". Apple credits Vinoo Thomas and Rahul Mohandas of McAfee Avert Labs, and Petko D. (aka pdp) Petkov of GNUCitizen working with TippingPoint's Zero Day Initiative, for reporting this issue.

* The update addresses a buffer overflow vulnerability described in CVE-2008-0234. Apple says "a heap buffer overflow exists in the handling of HTTP responses when RTSP tunneling is enabled. Playing maliciously crafted QuickTime content may lead to an unexpected application termination or arbitrary code execution".

* The update addresses a buffer overflow vulnerability described in CVE-2008-0036. Apple says "a buffer overflow may occur while processing a compressed PICT image. Opening a maliciously crafted compressed PICT file may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by terminating decoding when the result would extend beyond the end of the destination buffer". Apple credits Chris Ries of Carnegie Mellon University Computing Services for reporting this issue.

Source: ZDNet Asia

	All news for August 29, 2008:
	15:12	ICO urges firms to step up privacy controls
	15:09	Watch Out! Firing IT Workers Can Cost You
	15:08	New security rules on tap for credit-card handlers
	15:05	Royal College of Physicians improves database security
	15:04	FBI warns of hit man scam
	15:04	Bank of New York loses 12.5 million customer details
	14:59	Microsoft introduces black screens for pirates
	14:57	Four Quick Tips for Choosing an IM Security Product
	14:54	Intel releases Bios update
	14:50	Microsoft warns of IE8 lock-in with XP SP3
	14:47	Apple confirms iPhone security bug, promises patch
	14:46	Best Western forced to play defense on data breach disclosure
	All news for August 28, 2008:
	14:03	IT administrators admit they’d steal data
	14:02	Stolen SSH keys used for attacks
	14:01	UK to lead e-crime prosecutor network
	13:59	Nortel Uses USB Drive to Secure Remote Work
	13:56	Symantec wants another chance
	13:56	PC Tools to be poor man's Norton
	13:54	Nasa hacker loses final legal challenge
	13:53	Full disclosure: The only protocol for net security
	13:52	Researchers exploit web protocol to hijack traffic
	13:51	Linux cryptography attacks seen in the wild
	13:50	McAfee: Criminals hijacking virtual worlds
	13:48	Microsoft Office Live Small Biz suffers outage, possibly lost e-mail
	13:34	Judge lets privacy advocate keep Social Security numbers on Web site
	13:19	Microsoft reveals IE8 Beta 2
	13:01	Malware infects space station laptops

All news for August, 2008
All news for 2008 year
All news for 2007 year
All news for 2006 year
All news for 2005 year
All news for 2004 year

DONATION: Keylogger.org is an independent research project supported by a team of enthusiasts. If you find this project useful or would like to help foster its continued development please consider making a donation using PayPal`s online secure payment service.

A PayPal account is not required. All major credit cards are accepted (MasterCard/Eurocard, Visa/Delta/Electron, American Express, Switch/Maestro, Solo). Simply click the button below.

Any amount would be useful and appreciated!

Thanks in advance for your support!

	\| home \| testing and reviews \| testing policy \| press_releases \| developers \| \| articles \| contest \| chat \| forum \| sponsorship & services \| contacts \| links \|
	Copyright © 2003-2008, Keylogger.Org Team. All Rights Reserved. Use of any information from this website is permitted only with hypertext link to www.keylogger.org.