Internet Security Systems Inc yesterday issued a patch for a vulnerability in a core software component that is used in most of its security products, including most current versions of RealSecure, Proventia and BlackICE.
The vulnerability, found by eEye Digital Security Inc a week ago, is in how ISS’s software handles scanning of the Server Message Block protocol, ISS said. The flaw is in the Protocol Analysis Module common to many ISS products.
The company said the vulnerability could be remotely exploited to execute arbitrary code, but that it would be necessary for the attacker to establish a legitimate SMB session first, which may mitigate the risk. ISS said users should patch anyway.
In other news, Bearing Point Inc, the consulting and IT services operation of Deloitte Touche Tohmatsu, reported its preliminary results for the fourth quarter ended December 31, 2003.
It anticipated a net loss of approximately $117m however, down from a profit of $14.5m in the same period in 2002. Revenue fell by 2% year on year and is expected to come in at $792m for the quarter.
These results are not yet fully comparable to previous years given that the company is in a 6-month transition period as it changes its fiscal year-end from June 30 to December 31. Analysts will have to wait until April 16 to view a full report of the results.
And finally, Endforce Inc yesterday said it will deliver its first endpoint security management software, based on technology developed when it was a managed VPN provider called SmartPipes, at the end of April.
Content from our partners
Dan Harris, director of marketing at the company, said the first version of the software will allow administrators to enforce security policies such as patch levels, antivirus definitions and firewall rules via agent software and a central policy server.
Version 2.0, currently scheduled for release in July, will extend beyond those three types of applications, allowing administrators to write rules for any endpoint application that has an entry in the Windows registry.
This article is based on material originally published by ComputerWire
