Internet Security Systems Inc yesterday issued a patch for what it called a critical vulnerability in a software component common to most of its products, the second such warning in the same module in a month.

The flaw is in the Protocol Analysis Module found in most of its RealSecure, Proventia and BlackICE intrusion detection and prevention products, the firm said. Specifically, it is a series of unchecked buffers in how PAM handles ICQ instant messaging traffic.

According to ISS competitor eEye Digital Security Inc, which found the hole, an exploit was tested to gain full remote system control over a BlackICE box running in its highest security mode. Last month, ISS patched a similar flaw in PAM’s SMB routines.

In other news, Lucent Technologies Inc has agreed to accept a $25m penalty from the SEC following an investigation into revenue-recognition irregularities dating back to 1999. Under a deal announced in February 2003, Lucent had to slice $700m off its sales as a result of inaccurate bookings, and agreed not to make any future violations of deferral securities laws.

Murray Hill, New Jersey-based Lucent said the penalty was not based on any additional violations of law, but on what the SEC considered to be Lucent’s lack of cooperation during the investigation and certain actions taken by the company following its agreement with the SEC. Lucent said it was disappointed by the decision, but decided to put the matter behind it and not admit or deny any liability.

And finally, Californian business intelligence (BI) software maker Actuate Corp has signed a regional alliance with Indian IT services firm Satyam Computer Services Ltd (SCSL) to help build its presence in Asia Pacific.

Hyderabad-based Satyam says its has over 20 consultants trained and certified on Actuate’s enterprise reporting and information delivery products. It plans to increase that number this year.

Both companies will develop a BI center of excellence at SCSL’s global solutions center located in Cyberjaya, Malaysia.

This article is based on material originally published by ComputerWire