Microsoft has been caught out

Microsoft has been caught out with another security flaw, this time in the Universal Plug & Play software that ships with Windows XP and ME (and if you are running Internet Connection Sharing, it affects Windows 98/98SE, too). The bug, which depends on overflowing a bit of buffer memory, was found by Marc Maiffret, the chief hacking officer at eEye, who told the San Jose Mercury News: "What we found was by no means trivial. The people who wrote the code were doing everything almost perfectly.'' The story, here, also covers a bug found in Oracle's top of the line database software, which was found by David Litchfield of Next Generation Security Software in Surrey. It is a pity this one has not had more publicity. Oracle's bumptious chief executive Larry Ellison, while slagging off IBM and Microsoft at Comdex in November, claimed that Oracle 9i was "unbreakable". Wrong again, Larry.