Over 1M sites affected by WordPress Plugin flaw

WP-Super-Cache plug-in for WordPress responsible for generating static html files from dynamic WordPress blog. Recently security researchers from Sucuri identified cross-site scripting (XSS) vulnerability that allows an intruder to take complete control of the website. Over 1 million websites are using this plugin that means it's a huge risk for everyone. Fortunately, WP-Super-Cache developers addresses this security flaw with a release of new version 1.4.4. Sysadmins should update the vulnerable plugin on earliest basis otherwise attackers can take the advantage via malformed query and add malicious scripts to the cached files published by the component. Sucuri gives CVSS score 8.0 to this issue that means it can be done with ease. There is a high possibility that attacker could add new admin account and install backdoors on the vulnerable website. <more>

New Firefox 37 rectifies security flaws

Latest version of open-source web browser Mozilla Firefox 37 is available for download and eliminates several critical security flaws present in prior versions. Not only security fixes this time but also Firefox gets a new feature 'OneCRL' which is responsible for improved revocation of invalid certificates used for validating and securing the connection to an authorized host. According to company's classification - a CRITICAL flaw is the one that allows arbitrary code execution without human intervention. Critical fixes cover under CVE-2015-0803, CVE-2015-0804 and CVE-2015-0813 - all are related to use-after-free issues allowing users to execute arbitrary code or crash vulnerable application. Two memory corruption errors are also reported by Abhishek Arya of Google Chrome Security Team and covered under CVE-2015-0805 and CVE-2015-0806 related to 2D graphics rendering. Besides security updates, OneCRL gives the developer an opportunity to update the list of revoked certificates without pushing a new Firefox update. <more>

LESS Admin rights result LESS Microsoft flaws

UK security firm Avecto states that if you want to mitigate critical vulnerabilities in Microsoft applications. All you need is just to remove admin rights from users. Exploitation requires admin privileges for almost 97% of Windows flaws; 99.5% of Internet Explorer and 95% of Office applications. Avecto did in-depth analysis of Microsoft security updates and found 92% of vulnerabilities in 2013 which can be mitigated by revoking admin rights - Similarly in 2014, it surges to 97%. According to Avecto's European VP, Paul Kenyon, companies can get rid of security woes by just breaking down the admin rights so that most of the users are unable to do installation. <more>