Typo in Code Caused Latest ActiveX Vulnerability

It's the case of the missing ampersand... article from CNet here

Bind 9 Vulnerability

New vuln discovered in Bind 9. Summary is a crafted dynamic update for a zone the server is master over can make bind go bye-bye, Won't work against slaves.. Details here. If you are running Bind 9, especially externally facing, check into patching ASAP...

Interesting New Service from TippingPoint

TippingPoint is now offering an Emergency Response Service for businesses without IDS/IPS. If I read their data sheets correctly, a network manager would call TippingPoint once they ascertained they were under attack or experienced a breach (a little late to the dance if the breach has already occurred, but no matter) and the Emergency Response Team would deploy a fully set up system consisting of an IPS sensor and a management station (within 24-72 hours). It would remain in place for two to a maximum of four weeks, after which time they would "work with the organization to determine long term security requirements and appropriate solutions". This is done on a complimentary basis... I don't see anything about obligation to purchase products or services after the deployment has ended, but I have to believe there would be one. It wouldn't be cheap at all to rush a well-paid team of security engineers and product to a site within three days and have the system up and running (not to mention the possible liability if the IPS blocks legitimate traffic and SLA's are missed). Interesting...
Info about the service found here

Adobe Screw Up Could Leave You Vulnerable (or 0wn3d)

Adobe has been delivering an out-of-date version of Reader on it's Web site, leaving users at risk to several vulnerabilities the company has already patched. Secunia discovered at least 14(!) vulns that were patched by the company in the last two months. The version is 9.1, released back in March. There was no response to a Computerworld request for comment.
It's bad enough when software vendors release buggy code that leaves your system at risk. It's even worse when they cover the fact up and sit on their hands until pressured to fix their product. But to fix the bugs, then not QA the process of updating the software on their download site is almost unbelievable, had it not just happened. I'm thinking this will be good news to vendors who offer non-Adobe alternatives Acrobat, as it should be. Irresponsible corporate behavior should lead to loss of revenue..
LINK

Patch Firefox Now

Mozilla has released Firefox 3.5.1 to address the JIT compiler bug. If you disabled JIT, re-enable it after upgrading...

Nmap 5.0 Released

Fyodor has released version of of the ubiquitous nmap scanner... small writeup about it here from the folks at the Internet Storm Center... Or just go straight to www.insecure.org and grab your copy...

Paypal Update

Paypal contacted Johnny Long and is taking care of his issues. Wonder if had anything to do with all the tweeting, blogging and friends of a friend inside Paypal making it public? However, it happened, it's good news. A good man doing a good thing to help others...
Link

Handlers Pages

Some of the Storm Center handlers have their own handlers pages separate from the diaries... you can find more detailed information on topics there than is covered in the (necessarily) brief diary entries. The link is here.