Remote access a priority for latest Oracle patch update

The vulnerabilities that allow for remote unauthenticated access should be a priority for administrators applying the latest Oracle Critical Patch Update (CPU) say security experts.
This means businesses will need to focus on applying more than 40% of the 89 updates that cover most of Oracle’s product groups.

Java is on a different update cycle of every four months, but it will be migrated to the same schedule from October 2013. 

Oracle’s flagship product, the Oracle database, gets six updates this month, with four being remotely exploitable.
The XML parser vulnerability, which is remotely accessible but requires authentication, has the highest Common Vulnerability Scoring System (CVSS) score of the Critical Patch Update, scoring nine on a scale of 10, indicating high criticality.

“One mitigating factor is that Oracle databases are typically not exposed the internet,” said Wolfgang Kandek, chief technology officer at security firm Qualys.

Oracle’s MySQL database has 18 vulnerabilities addressed, including two that are remotely accessible and have a CVSS score of 6.8.

“MySQL is often found exposed to the internet, even though this is not considered best practice. If you use MySQL in your organisation, it makes sense to run a perimeter scan to collect information on all databases externally exposed,” said Kandek.

The Oracle Sun product line has 16 updates, with eight being remotely accessible. The highest CVSS score is 7.8.

“If you have Sun Solaris servers in your organisation, review these patches and start with the machines on your perimeter and DMZ,” said Kandek.

Oracle’s Fusion Middleware has a total of 21 vulnerabilities and includes many components that are typically found on the internet, such as the Oracle HTTP server.
Of the 21 vulnerabilities, 16 are accessible remotely, with a maximum CVSS score of 7.5. “Again, a perimeter scan is helpful, or even a quick query to Shodan, which shows more than 500,000 machines with Oracle’s HTTP out on the internet,” said Kandek.

The highest CVSS score is 7.5, which should not be ignored, said Ross Barrett, senior manager of security engineering at Rapid7.

Fusion contains the Outside-In product that is used in Microsoft Exchange for document viewing. Outside-In has, in the past year, caused two updates in Microsoft’s email product to address the vulnerabilities in MS12-058 and MS12-080.

According to Kandek, recent research by Will Domann shows that Outside-In has the potential for more vulnerabilities. He recommends turning off the WebReady feature, which means that users have to download the documents to the local disk for viewing.

Other product areas with security updates include Peoplesoft, E-Business, Virtualisation and Solaris, which has been hit with two remote denial of service (DoS) attacks, plus a couple of local elevation of privilege issues, said Barrett.

This free Computer Weekly special report on Oracle gives an independent view of the challenges facing Oracle, its financial performance, the services it offers, its place in the IT market and its future strategy.
“With such a diverse range of products in this quarter’s patch, it's hard to tackle these from top to bottom. I recommend patching any vulnerable Oracle Database Server instances as soon as possible, and don’t neglect the stability or integrity of the Solaris deployment,” he said.

Kandek said dealing with the large sizes of the Oracle CPUs would be easier if a good map of the currently installed software exists.

“In any case, we recommend addressing vulnerabilities on systems that are internet accessible first, such as Fusion Middleware, the Solaris operating system and MySQL,” he said.

According to Craig Young, a security researcher at Tripwire, Oracle has acknowledged and fixed 343 security issues so far this year.

“In case there was any doubt, this should be a big red flag to users that Oracle’s security practices are simply not working,” he said. “The constant drumbeat of critical Oracle patches is more than a little alarming, particularly because the vulnerabilities are frequently reported by third parties.”

This month’s CPU credits 18 different researchers coming from more than a dozen different companies, he added.

Critic’s Notebook: Latest Vision for Las Vegas: A Downtown Vibe

Isaac Brekken for The New York TimesTony Hsieh, the chief executive of Zappos, in Henderson, Nev. Mr. Hsieh is determined to revitalize downtown Las Vegas.

LAS VEGAS — Tony Hsieh didn’t look much like a modern-day Bugsy Siegel. Wearing backpack, T-shirt and jeans, standing outside a downtown bar, he patrolled his future empire along East Fremont Street here one sweltering morning.

A sortable calendar of noteworthy cultural events in the New York region, selected by Times critics.

But the flamboyant Siegel changed this city for good when he built the Flamingo Hotel, the first luxury casino on the Strip. Now Mr. Hsieh, a soft-spoken 39-year-old Internet billionaire who runs Zappos, the online clothing store, plans to do something as transformative. It’s a classic American dream: a Western-scale roll of the dice in a city that suddenly conjured up Belle Époque Paris and ancient Rome out of the desert. The idea this time is to build a version of the Mission district in San Francisco or the Williamsburg section of Brooklyn in downtown Vegas.

Mr. Hsieh (pronounced shay) is relocating Zappos headquarters from Henderson, Nev., about 16 miles away, and investing hundreds of millions of his own dollars to retrofit downtown with, well, a downtown, in line with the latest trends.

I came to check out the progress. There’s not much to see yet, but his $350 million Downtown Project — a mix of investments, acquisitions and loans — envisions blocks and blocks of community-based, pedestrian-friendly, small-business-oriented, high-density, high-tech urbanism in long-depressed and troubled neighborhoods. Zappos will take over the decrepit old City Hall. That gesture alone, salvaging a local landmark, has endeared Mr. Hsieh to many in Las Vegas.

We spoke briefly the other night in the Gold Spike, a former casino near City Hall whose gambling room he stripped and converted into a chic slots-free bar and chill space. He took me to the empty motel he bought next-door, where, he speculated, a modeling agency and photography studio could take over what used to be a few of the poolside guest rooms.

On nearby blocks, which he has also gobbled up, the Downtown Project would seed tech start-ups, boutiques, mom-and-pop restaurants and bars; the world’s largest Airstream trailer park; a playground and geodesic dome; a complex of recording studios; a charter school; a doggy day care; a bike share program, even a Tesla electric car share, along with theaters for TED Talk-like lecturers and music festivals.

There’s no designer-led master plan, no single billion-dollar construction project, no star architect. The concept is top-down but preaches piecemeal, bottom-up development and reuse. It exploits a picturesque supply of abandoned flop houses, vacant offices and collapsing warehouses, capitalizing on a growing desire among young Americans for urban life: an anti-Strip vision of America.

Out on the Strip, MGM opened CityCenter in 2009, a $7.8 billion luxury development and celebrity-architect petting zoo, which in a sense is the same concept, but pegged as a theme park for tourists. I got a peek the other day. It’s a smart and sleek attraction; business has been improving. CityCenter and the Downtown Project are both visions for evolving the same city.

But unlike MGM’s development, which opened in the midst of the housing collapse, Mr. Hsieh’s timing could hardly have been better. The local economy, devastated when the bubble burst, is limping back. The population (increasingly young Asians and Hispanics) keeps rising, and wealthy out-of-towners prop up the high end of the housing market. Most properties are still under water, and the city is down 100,000 construction jobs from pre-recession highs, but the picture isn’t as bleak, or straightforward, as four years ago.

At the same time, Las Vegas suffers the pitfalls of being a one-industry town. Baked into its economy are minimal taxes and a state government inclined to ship much of what Las Vegas contributes to the rest of Nevada, which, among other consequences, insures the school system is perennially poor. Casino moguls, needing a steady supply of parking attendants, hotel maids and blackjack dealers, not college-educated workers, were once fine with that. But times are changing. Now the lack of good public schools and downtown amenities — demanded by those mobile and educated young Americans other cities are competing to attract — has become a liability.


Follow me on Twitter @sajilpl

A Guide to the Latest Production Incentives

New York state has extended its production incentive program through 2019. California has its film tax credit for two years through 2017.

As states and foreign countries compete for film and television productions, they are constantly revisiting the incentives that they offer.

STORY: Locations Show: How Colorado Lured the Hallmark Channel

Here are some of the most recent changes, as compiled by the production services company Entertainment Partners:

NEW YORK

New York State Film/TV/Commercial Incentive Program has been extended and modified — Passed on Friday March 29, 2013

SB 2609 has been signed by Gov. Andrew Cuomo and will extend the Empire State Production Tax Incentive Program until 2019, as well as provide an additional $2.1 billion in funding. The yearly budget remains at $420 million with a rolling cap on qualified production expenditures.

In addition, $5 million has been allocated to a 40 percent credit on qualified labor for areas north and west of Albany for fiscal years 2015–19.

Also, any variety or talk show program produced outside of N.Y. for five years, with a studio audience of more than 200 as well as either a budget of more than $30 million or at least $10 million in capital expenditures, will immediately qualify for the NYS production incentive.

Lastly, the annual allotment for the N.Y. postproduction credit has been increased to $25 million from $7 million for fiscal years 2015-19.

While prospective applicants must still spend 75 percent of their project's total postproduction budget in New York in order to qualify for the post-only tax credit, the new budget stipulates a new and separate threshold of the lesser of $3 million or 20% of the total visual effects and animation spend in New York to qualify. The lower threshold makes it easier for films with larger visual effects and animation budgets to qualify for the program. Additionally, the post-only incentive now applies to post services on animated features and TV programs.

CALIFORNIA

Gov. Gerry Brown signed legislation (AB 2026 and SB 1197), which extends the film tax credit for two years through June 30, 2017, with funding of $100 million per year. The new law simplifies the information that taxpayers are required to include on their credit application with respect to members of a combined reporting group and partnerships or limited liability companies.

GEORGIA

The Georgia film incentive program remains stable.

NEW MEXICO

House Bill 641 will be effective after June 30, following the governor's signing of the bill April 4, 2013. The bill will allow for an additional 5 percent credit for qualifying projects, bumping the total available credit up to 30 percent if a project meets the criteria. The 5 percent credit may also be applied to wages and fringes paid to residents. All payments of wages, fringe benefits or fees to a resident for talent, management or labor, and payment to a nonresident performing artist, are all direct production expenditures given that they are subject to taxation in New Mexico.

STORY: Tax Lawyer: Hollywood Needs Federal Incentives Now (Guest Column)

NORTH CAROLINA

Gov. Bev Perdue signed a technical corrections bill (SB 847) that extends the film tax credit through Dec. 31, 2014

MASSACHUSETTS

The Massachusetts House of Representatives submitted a 2014 fiscal budget proposal that did not institute a cap on the film tax credit program. Gov. Deval Patrick’s budget proposal, submitted previously to the House, included capping the film tax credit program at $40 million.

PENNSYLVANIA

Governor Tom Corbett signed legislation that makes changes to the 25 percent film tax credit (HB 761), effective July 2, 2012, including an additional 5 percent credit for feature and television film or television series intended for a national audience meeting the minimum stage filming requirement in a qualified facility. The minimum stage filming requirements follow:

·       If PA production expenditures < $30 million (per project):

o   Build = 1 set at a "qualified production facility;"

o   Shoot = 10 days at a "qualified production facility;"

o   Spend = $1,500,000 in direct expenditures for use, rental or services of a "qualified production facility."

·       If PA production expenditures = $30 million (per project):

o   Build = 2 sets at a "qualified production facility;"

o   Shoot = 15 days at a "qualified production facility;"

o   Spend = $5 million in direct expenditures for use, rental or services of a "qualified production facility."

Annual funding is $60 million and allowance is made for "advance awards" from the next three successive years' funding (30 percent of the first successive year, 20 percent of the second successive year and 10 percent of the third successive year

OHIO

Gov. John Kasich signed legislation (HB 508) that doubles the 25-35 percent refundable film tax credit funding to $40 million for the fiscal biennium beginning on or after July 1, 2011. There is a $20 million cap for the first year of the biennium. The project cap remains at $5 million

ILLINOIS

Gov. Pat Quinn signed legislation (SB 1286) that expands the film production incentive to include "accredited animated productions" commencing on or after July 1, 2010, but credits may not be claimed for a taxable year ending prior to December 31, 2012

TEXAS

The Texas legislature allocated 95 million for The Texas Moving Image Industry Incentive Program

UNITED KINGDOM

The British government formally appointed the British Film Institute to be the certification body for the proposed tax credit system for animation, high-end TV and video games.

The U.K. Tax Credit for high-end television, animation, and video games went into effect April 1,

CANADA – Saskatchewan

Eliminated film incentive program

GERMANY

The State Minister for Culture and Media secured an additional €10 million annually for the German Federal Film Fund. The increase brings the DFFF annual budget to approximately $90 million (€70 million) to support productions that shoot locally. The funding increase follows the European Commission's approval to extend the DFFF through the end of 2015.

MAURITIUS

Mauritius launched a 30 percent film tax incentive.

CROATIA            

The funding for the new Incentive introduced in March 2012 is set at €5,900,000

UNITED ARAB EMIRATES - Abu Dhabi

The new 30 percent rebate came into effect September 2012. Guidelines, forms, FAQ and a glossary are provided on the Film Commission's website. While there is no local crew requirement, every project receiving the rebate will have an obligation to offer training and intern opportunities during local filming

MALAYSIA

The Malaysian government recently enacted a 30% cash rebate for foreign film and television productions that spend a minimum of MYR 5,000,000 (about $1.6 million), inclusive of postproduction, in the country. For local projects, the minimum is MYR 2,000,000. Additionally, the minimum spend for the post-production rebate is MYR 1,500,000 (about $480,000)

COLOMBIA

Colombia launched a new 40 percent location filming incentive. The program is available for features and television movies that spend $500,000 locally. In addition to the 40 percent rebate on production expenditure, producers can also claim a 20 percent rebate on accommodations, food, and transportation costs incurred locally. The Colombian government has earmarked about $14 million USD for 2013

LITHUANIA

Lithuania has introduced a 20 percent tax rebate for film production

Twitter: @sajilpl

Most Android threats would be blocked if phones ran latest Android version, report says

Over three quarters of Android threats are malicious apps that send SMS messages to premium rate numbers and could be mitigated by a protection feature present in Android 4.2, according to researchers from networking vendor Juniper Networks.

 

However, because manufacturers and carriers fail to update Android end user devices in a timely fashion, only 4 percent of devices currently run Android 4.2, even though this version was released more than six months ago.

 

From March 2012 to March 2013 the number of mobile threats grew by 614 percent to reach a total of 276,259 malicious samples, researchers from Juniper Networks’ Mobile Threat Center (MTC) said in a report released Wednesday. Of those malicious applications, 92 percent target the Android operating system, they said.

 

The surge of Android malware in the past two years is consistent with the findings of other security vendors that track mobile threats. This growth is primarily driven by Android’s “commanding share” of the global smartphone market, the Juniper researchers said.

 

The majority of Android malware, 77 percent, are apps that earn money for their creators by either requiring users to send SMS messages to premium rate numbers or by surreptitiously sending such messages on their own. These threats usually masquerade as legitimate applications or come bundled in pirated apps.

 

The Juniper researchers estimate that every successful attack using such an app can bring an immediate profit of $10 for the attacker on average.

 

Android 4.2 introduced a feature that detects attempts to send SMS messages to special rate numbers, also known as short codes, and prompts users for confirmation. Unfortunately, due to the Android market fragmentation, only 4 percent of Android devices are currently running Android 4.2.x.



This estimation is based on data collected from Google Playover a 14-day period ending on May 1, 2013, the Juniper researchers said. Based on the same data, the most common versions of Android found on devices are Android 2.3.3 to 2.3.7, also known as “Gingerbread,” with a 36.4 percent coverage and Android 4.0.3 and 4.0.4, also known as “Ice Cream Sandwich,” with 25.5 percent.

 

The lack of regular updates for Android devices contributes to the growth of Android malware, because the latest protections added by Google to the operating systems reach users too late or never, the researchers said.

 

The second most common type of Android threats are spyware applications that capture and transfer sensitive user data to attackers. These account for 19 percent of all malicious samples collected by Juniper’s MTC.

 

Some information-stealing Android Trojan apps discovered during the past year and distributed through drive-by downloads or phishing emails could also pose a threat to enterprise environments, the Juniper researchers said.



Data collected from enterprise mobile devices running Juniper’s Junos Pulse endpoint collaboration and security software showed at least one infection on 3.1 percent of such devices.

 

While that figure is not large enough to raise a significant alarm, it is proof that the threat of mobile malware to corporate devices is not only theoretical, the Juniper researchers said. “We expect the presence of mobile malware in the enterprise to grow exponentially in the coming years.”

 

 

Kyrgyzstan Latest Former Soviet Republic to Make Epic Historical Movie

MOSCOW – Kyrgyzstan is the latest former Soviet republic to put public money into producing a national historic epic.

Queen of the Mountains (Kurmandjan Datka in the local language, Kyrgyz) is the $1.5 million story of a noblewoman, Datka, revered to this day for her diplomacy in saving her nation from complete destruction and subjugation when Russian imperial forces conquered the Central Asian country in the 1870s.

Shot on digital Red Epic film and starring three top Kyrgyz actresses as the lead at different stages of her life -- as a young woman (Elina Abai Kyzy), middle-aged mother (Nazira Mambetova) and old woman (Jamal Seidakmatova). The film is backed by Kyrgyz president Almazbek Atambaev and minister of culture, Sultan Raev.

Writer-director Sadyk Sher-Niyaz, who is producing through Aitysh Film, Bishkek with national studio Kyrgyz Film, told The Hollywood Reporter that despite the film’s historical setting, it's subject -- that of a courageous woman who breaks away from Islamic mores and a patriarchal country to achieve great things -- is up-to-date.

"It's the story of a young woman who is forced into an arranged marriage but escapes, flees to the mountains and falls in love with the local chief, Alynbek, whom she marries. When he is killed by political rivals she becomes the 'queen of the mountains' and a key figure in the national struggle when the Russians invade."

Filled with spectacular locations, lavish costumes, bloody battle scenes and dramatic turns, the film is shooting on location this summer with a release slated for early next year.

Last year’s $10 million national epic from oil-rich neighbor Kazakhstan, Myn Bala, which included a top-notch international creative crew, was a box-office sensation in that more populous state.

Kyrgyzstan, which has a population of 5.5 million and GDP per capita of just $2,400 a year (compared with Kazakhstan's population of 17.7 million and per capita GDP of $13,900) is not a major producer of films. But the country’s rugged and beautiful scenery makes it a spectacular movie location and a new, relatively affluent generation of educated young people are increasingly using low-cost digital equipment to make films.

"We’re experiencing a film boom now, with around 100 low-budget movies shot every year – many of them about love, of course!" Sher-Niyaz said.