SafeGuard Your Business with Cisco ISA500 Series Security Appliances

Visit the Cisco Small Business blog to learn about tips for your products, industry-wide information, and how to get the best out of your technology from Cisco and industry experts.

Cisco Small Business Blog

View the original article here

Insurance Coverage for Data Security Breaches

Data security breaches are a real threat in today’s computer-dependent work environment. Security breaches via hacking, unauthorized internal access, and the inadvertent disclosure of personal information, are all circumstances that can create cost and legal exposure. Chances are, a company’s existing insurance policies may provide some coverage in the event of a data security breach, but there are additional coverages that may be worth exploring and evaluating.There are three basic types of insurance policies that may provide some coverage for data security breaches:First party coverage: Includes loss or damage to own property. Lost or damaged data may be covered, but there are a number of exclusions to consider.Third party coverage: Coverage provided to a company when it is sued. Commercial General Liability (CGL) insurance is an example of third-party coverage that virtually all businesses have. There are provisions in CGL policies that do provide coverage for data security breaches. Errors and Omissions (E&O) coverage: Possible coverage for data security breaches may be available in an E&O policy.One newer policy type to consider is network risk insurance. It blends first and third party coverages and can provide broader insurance than a typical policy would otherwise cover. For example, under a CGL policy, a company may have advertising injury coverage that could extend into data breaches. But in a network risk policy, a company could also secure first party coverage (e.g. theft or damage to data), business interruption coverage and perhaps cyberextortion, crisis management costs, public relations response and identity theft coverages. Policies can also include third party coverages such as professional services, content or media liability, network and security cost insurance. Coverage for basic privacy liabilities such as inadvertent or unintended disclosures of confidential information may also be available.Companies should have their existing insurance coverage reviewed to better understand what may or may not be covered. This is not a costly exercise, and would provide a sense as to whether your company has sufficient coverage.In the case of an actual data security breach, or other unintended disclosure of private information, it is critical to provide prompt notice of loss to the insurance company. Also, don’t assume that there is a lack of coverage without a professional evaluation of your policy. This is a largely new area of insurance law, and you should not assume that a company’s in-house risk management department or your insurance broker will know the answer of whether coverage exists. Chances are there is little or no case law analyzing coverage in this newly developing area. As such, it is important to have the coverage evaluated in the event of a data security breach.Pillsbury's insurance recovery practice is one of the first in the United States, dating back to the Great San Francisco Earthquake of 1906, when we helped California businesses work with their insurers in order to rebuild. From the enormous business interruption losses arising from the terrorist attacks in September 2001, to some of the largest environmental cleanup cases in the country, Pillsbury’s insurance recovery and advisory attorneys are at the forefront of efforts to secure insurance coverage for its clients.

View the original article here

About the security content of Apple TV 5.2.1

About the security content of Apple TV 5.2.1Learn more about the security content of Apple TV 5.2.1.

">ACUtil.setPOD('us~en'); var articleId = "HT5702"; var ACStaticText = { 'more': '…more', 'less': 'less' };KmLoader.akamaiUrl = 'http://km.support.apple.com';//function sendRead()var locale = 'en_US';Event.observe(window, 'load', function() {ACHistory.addKbView('HT5702', 'About the security content of Apple TV 5.2.1', 'en_US', 'unknown');ACUtil.getMultipleOffers('PP23', 'HOWTO_ARTICLES', 'en_US', 'false');ACUtil.reportView('HT5702', 'en_US');// Apple Instant Feed statistics code if(enableAppleInstant == "yes"){var store = new Persist.Store('FeedStats');if (store.get('resultActivity')=='true'){var time = new Date();// Fix for /*setReadTimer = setTimeout(function(){var feedStats = new ACFeedStatistics();feedStats.updateRead('HT5702', store.get('position'));store.remove('HT5702');store.remove('position');}, 3000);*///store.set('HT5702', time.getTime());store.set('timeStart', time.getTime());}} });Event.observe(window, 'beforeunload', function(){// Apple Instant Feed statistics code if(enableAppleInstant == "yes"){ var store = new Persist.Store('FeedStats'); if (store.get('resultActivity')=='true' && store.get('timeStart') !== null){ var time = new Date();//var timeDiff = time.getTime() - store.get('HT5702');var timeDiff = time.getTime() - store.get('timeStart');var timeSpent = Math.floor(timeDiff/1000);var feedStats = new ACFeedStatistics();// Fix for if (timeDiff About the security content of Apple TV 5.2.1 Summary

Learn more about the security content of Apple TV 5.2.1.

Products Affected

Product Security

Apple TV 5.2.1

Apple TV

Available for: Apple TV 2nd generation and later

Impact: A local user may be able to execute unsigned code

Description: A state management issue existed in the handling of Mach-O executable files with overlapping segments. This issue was addressed by refusing to load an executable with overlapping segments.

CVE-ID

CVE-2013-0977 : evad3rs

Apple TV

Available for: Apple TV 2nd generation and later

Impact: A local user may be able to determine the address of structures in the kernel

Description: An information disclosure issue existed in the ARM prefetch abort handler. This issue was addressed by panicking if the prefetch abort handler is not being called from an abort context.

CVE-ID

CVE-2013-0978 : evad3rs

Apple TV

Available for: Apple TV 2nd generation and later

Impact: A local user may be able to execute arbitrary code in the kernel

Description: The IOUSBDeviceFamily driver used pipe object pointers that came from userspace. This issue was addressed by performing additional validation of pipe object pointers.

CVE-ID

CVE-2013-0981 : evad3rs

$('articlecontent').select('img').each(function(element) { if(element.width > 640 ){ var imageDiv = document.createElement('div'); imageDiv.setStyle({ 'display':'block', 'width':'660px', 'overflow':'auto', 'border':'1px solid #dedede','margin-right': '15px'}); element.parentNode.replaceChild(imageDiv, element); imageDiv.appendChild(element); } }); $('articlecontent').select('table').each(function(element) { if(element.width > 660 || element.offsetWidth>660){ var tableDiv = document.createElement('div'); tableDiv.setAttribute("class","kbtablecontainer"); element.setAttribute("style","margin-bottom:0px !important"); element.parentNode.replaceChild(tableDiv, element); tableDiv.appendChild(element); } }); Rate this article:Not helpfulSomewhat helpfulHelpfulVery helpfulSolved my problemOne Moment PleaseThanks for rating this article Not helpful Somewhat helpful Helpful Very helpful Solved my problem Share this article View the original article here

About the security content of iTunes 10.6.3

About the security content of iTunes 10.6.3This document describes the security content of iTunes 10.6.3.

">ACUtil.setPOD('us~en'); var articleId = "HT5318"; var ACStaticText = { 'more': '…more', 'less': 'less' };KmLoader.akamaiUrl = 'http://km.support.apple.com';//function sendRead()var locale = 'en_US';Event.observe(window, 'load', function() {ACHistory.addKbView('HT5318', 'About the security content of iTunes 10.6.3', 'en_US', 'unknown');ACUtil.getMultipleOffers('133014,PP23', 'HOWTO_ARTICLES', 'en_US', 'false');ACUtil.reportView('HT5318', 'en_US');// Apple Instant Feed statistics code if(enableAppleInstant == "yes"){var store = new Persist.Store('FeedStats');if (store.get('resultActivity')=='true'){var time = new Date();// Fix for /*setReadTimer = setTimeout(function(){var feedStats = new ACFeedStatistics();feedStats.updateRead('HT5318', store.get('position'));store.remove('HT5318');store.remove('position');}, 3000);*///store.set('HT5318', time.getTime());store.set('timeStart', time.getTime());}} });Event.observe(window, 'beforeunload', function(){// Apple Instant Feed statistics code if(enableAppleInstant == "yes"){ var store = new Persist.Store('FeedStats'); if (store.get('resultActivity')=='true' && store.get('timeStart') !== null){ var time = new Date();//var timeDiff = time.getTime() - store.get('HT5318');var timeDiff = time.getTime() - store.get('timeStart');var timeSpent = Math.floor(timeDiff/1000);var feedStats = new ACFeedStatistics();// Fix for if (timeDiff About the security content of iTunes 10.6.3 Summary

This document describes the security content of iTunes 10.6.3.

Products Affected

Product Security, iTunes 10

For the protection of our customers, Apple does not disclose, discuss, or confirm security issues until a full investigation has occurred and any necessary patches or releases are available. To learn more about Apple Product Security, see the Apple Product Security website.

For information about the Apple Product Security PGP Key, see "How to use the Apple Product Security PGP Key."

Where possible, CVE IDs are used to reference the vulnerabilities for further information.

To learn about other Security Updates, see "Apple Security Updates".

iTunes 10.6.3

iTunes

Available for: Mac OS X v10.5.8 or later, Windows 7, Vista, XP SP2 or later

Impact: Importing a maliciously crafted .m3u playlist may lead to an unexpected application termination or arbitrary code execution

Description: A heap buffer overflow existed in the handling of .m3u playlists.

CVE-ID

CVE-2012-0677 : Gjoko Krstic of Zero Science Lab

WebKit

Available for: Windows 7, Vista, XP SP2 or later

Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution

Description: A memory corruption issue existed in WebKit.

CVE-ID

CVE-2012-0672 : Adam Barth and Abhishek Arya of the Google Chrome Security Team

$('articlecontent').select('img').each(function(element) { if(element.width > 640 ){ var imageDiv = document.createElement('div'); imageDiv.setStyle({ 'display':'block', 'width':'660px', 'overflow':'auto', 'border':'1px solid #dedede','margin-right': '15px'}); element.parentNode.replaceChild(imageDiv, element); imageDiv.appendChild(element); } }); $('articlecontent').select('table').each(function(element) { if(element.width > 660 || element.offsetWidth>660){ var tableDiv = document.createElement('div'); tableDiv.setAttribute("class","kbtablecontainer"); element.setAttribute("style","margin-bottom:0px !important"); element.parentNode.replaceChild(tableDiv, element); tableDiv.appendChild(element); } }); Important: Mention of third-party websites and products is for informational purposes only and constitutes neither an endorsement nor a recommendation. Apple assumes no responsibility with regard to the selection, performance or use of information or products found at third-party websites. Apple provides this only as a convenience to our users. Apple has not tested the information found on these sites and makes no representations regarding its accuracy or reliability. There are risks inherent in the use of any information or products found on the Internet, and Apple assumes no responsibility in this regard. Please understand that a third-party site is independent from Apple and that Apple has no control over the content on that website. Please contact the vendor for additional information. Rate this article:Not helpfulSomewhat helpfulHelpfulVery helpfulSolved my problemOne Moment PleaseThanks for rating this article Not helpful Somewhat helpful Helpful Very helpful Solved my problem View the original article here

About the security content of iTunes 10.7

WebKit

Available for: Windows 7, Vista, XP SP2 or later

Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution

Description: Multiple memory corruption issues existed in WebKit. These issues are addressed through improved memory handling.

CVE-ID

CVE-2011-3016 : miaubiz

CVE-2011-3021 : Arthur Gerkis

CVE-2011-3027 : miaubiz

CVE-2011-3032 : Arthur Gerkis

CVE-2011-3034 : Arthur Gerkis

CVE-2011-3035 : wushi of team509 working with iDefense VCP, Arthur Gerkis

CVE-2011-3036 : miaubiz

CVE-2011-3037 : miaubiz

CVE-2011-3038 : miaubiz

CVE-2011-3039 : miaubiz

CVE-2011-3040 : miaubiz

CVE-2011-3041 : miaubiz

CVE-2011-3042 : miaubiz

CVE-2011-3043 : miaubiz

CVE-2011-3044 : Arthur Gerkis

CVE-2011-3050 : miaubiz

CVE-2011-3053 : miaubiz

CVE-2011-3059 : Arthur Gerkis

CVE-2011-3060 : miaubiz

CVE-2011-3064 : Atte Kettunen of OUSPG

CVE-2011-3068 : miaubiz

CVE-2011-3069 : miaubiz

CVE-2011-3071 : pa_kt working with HP's Zero Day Initiative

CVE-2011-3073 : Arthur Gerkis

CVE-2011-3074 : Slawomir Blazek

CVE-2011-3075 : miaubiz

CVE-2011-3076 : miaubiz

CVE-2011-3078 : Martin Barbella of the Google Chrome Security Team

CVE-2011-3081 : miaubiz

CVE-2011-3086 : Arthur Gerkis

CVE-2011-3089 : Skylined of the Google Chrome Security Team, miaubiz

CVE-2011-3090 : Arthur Gerkis

CVE-2011-3105 : miaubiz

CVE-2011-3913 : Arthur Gerkis

CVE-2011-3924 : Arthur Gerkis

CVE-2011-3926 : Arthur Gerkis

CVE-2011-3958 : miaubiz

CVE-2011-3966 : Aki Helin of OUSPG

CVE-2011-3968 : Arthur Gerkis

CVE-2011-3969 : Arthur Gerkis

CVE-2011-3971 : Arthur Gerkis

CVE-2012-0682 : Apple Product Security

CVE-2012-0683 : Dave Mandelin of Mozilla

CVE-2012-1520 : Martin Barbella of the Google Chrome Security Team using AddressSanitizer, Jose A. Vazquez of spa-s3c.blogspot.com working with iDefense VCP

CVE-2012-1521 : Skylined of the Google Chrome Security Team, Jose A. Vazquez of spa-s3c.blogspot.com working with iDefense VCP

CVE-2012-2817 : miaubiz

CVE-2012-2818 : miaubiz

CVE-2012-2829 : miaubiz

CVE-2012-2831 : miaubiz

CVE-2012-2842 : miaubiz

CVE-2012-2843 : miaubiz

CVE-2012-3589 : Dave Mandelin of Mozilla

CVE-2012-3590 : Apple Product Security

CVE-2012-3591 : Apple Product Security

CVE-2012-3592 : Apple Product Security

CVE-2012-3593 : Apple Product Security

CVE-2012-3594 : miaubiz

CVE-2012-3595 : Martin Barbella of Google Chrome Security

CVE-2012-3596 : Skylined of the Google Chrome Security Team

CVE-2012-3597 : Abhishek Arya of Google Chrome Security Team using AddressSanitizer

CVE-2012-3598 : Apple Product Security

CVE-2012-3599 : Abhishek Arya of Google Chrome Security Team using AddressSanitizer

CVE-2012-3600 : David Levin of the Chromium development community

CVE-2012-3601 : Martin Barbella of the Google Chrome Security Team using AddressSanitizer

CVE-2012-3602 : miaubiz

CVE-2012-3603 : Apple Product Security

CVE-2012-3604 : Skylined of the Google Chrome Security Team

CVE-2012-3605 : Cris Neckar of the Google Chrome Security team

CVE-2012-3606 : Abhishek Arya of the Google Chrome Security Team using AddressSanitizer

CVE-2012-3607 : Abhishek Arya of the Google Chrome Security Team using AddressSanitizer

CVE-2012-3608 : Skylined of the Google Chrome Security Team

CVE-2012-3609 : Skylined of the Google Chrome Security Team

CVE-2012-3610 : Skylined of the Google Chrome Security Team

CVE-2012-3611 : Apple Product Security

CVE-2012-3612 : Skylined of the Google Chrome Security Team

CVE-2012-3613 : Abhishek Arya of the Google Chrome Security Team using AddressSanitizer

CVE-2012-3614 : Yong Li of Research In Motion, Inc.

CVE-2012-3615 : Stephen Chenney of the Chromium development community

CVE-2012-3616 : Abhishek Arya of the Google Chrome Security Team using AddressSanitizer

CVE-2012-3617 : Apple Product Security

CVE-2012-3618 : Abhishek Arya of Google Chrome Security Team using AddressSanitizer

CVE-2012-3620 : Abhishek Arya of Google Chrome Security Team

CVE-2012-3621 : Skylined of the Google Chrome Security Team

CVE-2012-3622 : Abhishek Arya of the Google Chrome Security Team using AddressSanitizer

CVE-2012-3623 : Skylined of the Google Chrome Security Team

CVE-2012-3624 : Skylined of the Google Chrome Security Team

CVE-2012-3625 : Skylined of Google Chrome Security Team

CVE-2012-3626 : Apple Product Security

CVE-2012-3627 : Skylined and Abhishek Arya of Google Chrome Security team

CVE-2012-3628 : Apple Product Security

CVE-2012-3629 : Abhishek Arya of Google Chrome Security Team using AddressSanitizer

CVE-2012-3630 : Abhishek Arya of Google Chrome Security Team using AddressSanitizer

CVE-2012-3631 : Abhishek Arya of Google Chrome Security Team using AddressSanitizer

CVE-2012-3632 : Abhishek Arya of the Google Chrome Security Team using AddressSanitizer

CVE-2012-3633 : Martin Barbella of Google Chrome Security Team using AddressSanitizer

CVE-2012-3634 : Martin Barbella of Google Chrome Security Team using AddressSanitizer

CVE-2012-3635 : Martin Barbella of Google Chrome Security Team using AddressSanitizer

CVE-2012-3636 : Martin Barbella of Google Chrome Security Team using AddressSanitizer

CVE-2012-3637 : Martin Barbella of Google Chrome Security Team using AddressSanitizer

CVE-2012-3638 : Martin Barbella of Google Chrome Security Team using AddressSanitizer

CVE-2012-3639 : Martin Barbella of Google Chrome Security Team using AddressSanitizer

CVE-2012-3640 : miaubiz

CVE-2012-3641 : Slawomir Blazek

CVE-2012-3642 : miaubiz

CVE-2012-3643 : Skylined of the Google Chrome Security Team

CVE-2012-3644 : miaubiz

CVE-2012-3645 : Martin Barbella of Google Chrome Security Team using AddressSanitizer

CVE-2012-3646 : Julien Chaffraix of the Chromium development community, Martin Barbella of Google Chrome Security Team using AddressSanitizer

CVE-2012-3647 : Skylined of the Google Chrome Security Team

CVE-2012-3648 : Abhishek Arya of the Google Chrome Security Team using AddressSanitizer

CVE-2012-3649 : Dominic Cooney of Google and Martin Barbella of the Google Chrome Security Team

CVE-2012-3651 : Abhishek Arya and Martin Barbella of the Google Chrome Security Team

CVE-2012-3652 : Martin Barbella of Google Chrome Security Team

CVE-2012-3653 : Martin Barbella of Google Chrome Security Team using AddressSanitizer

CVE-2012-3654 : Skylined of the Google Chrome Security Team

CVE-2012-3655 : Skylined of the Google Chrome Security Team

CVE-2012-3656 : Abhishek Arya of Google Chrome Security Team using AddressSanitizer

CVE-2012-3657 : Abhishek Arya of the Google Chrome Security Team using AddressSanitizer

CVE-2012-3658 : Apple

CVE-2012-3659 : Mario Gomes of netfuzzer.blogspot.com, Abhishek Arya of the Google Chrome Security Team using AddressSanitizer

CVE-2012-3660 : Abhishek Arya of the Google Chrome Security Team using AddressSanitizer

CVE-2012-3661 : Apple Product Security

CVE-2012-3663 : Skylined of Google Chrome Security Team

CVE-2012-3664 : Thomas Sepez of the Chromium development community

CVE-2012-3665 : Martin Barbella of Google Chrome Security Team using AddressSanitizer

CVE-2012-3666 : Apple

CVE-2012-3667 : Trevor Squires of propaneapp.com

CVE-2012-3668 : Apple Product Security

CVE-2012-3669 : Apple Product Security

CVE-2012-3670 : Abhishek Arya of Google Chrome Security Team using AddressSanitizer, Arthur Gerkis

CVE-2012-3671 : Skylined and Martin Barbella of the Google Chrome Security Team

CVE-2012-3672 : Abhishek Arya of the Google Chrome Security Team using AddressSanitizer

CVE-2012-3673 : Abhishek Arya of the Google Chrome Security Team using AddressSanitizer

CVE-2012-3674 : Skylined of Google Chrome Security Team

CVE-2012-3675 : Abhishek Arya of the Google Chrome Security Team using AddressSanitizer

CVE-2012-3676 : Julien Chaffraix of the Chromium development community

CVE-2012-3677 : Apple

CVE-2012-3678 : Apple Product Security

CVE-2012-3679 : Chris Leary of Mozilla

CVE-2012-3680 : Skylined of Google Chrome Security Team

CVE-2012-3681 : Apple

CVE-2012-3682 : Adam Barth of the Google Chrome Security Team

CVE-2012-3683 : wushi of team509 working with iDefense VCP

CVE-2012-3684 : kuzzcc

CVE-2012-3685 : Apple Product Security

CVE-2012-3686 : Robin Cao of Torch Mobile (Beijing)

CVE-2012-3687 : kuzzcc

CVE-2012-3688 : Abhishek Arya of the Google Chrome Security Team using AddressSanitizer

CVE-2012-3692 : Skylined of the Google Chrome Security Team, Apple Product Security

CVE-2012-3699 : Abhishek Arya of the Google Chrome Security Team using AddressSanitizer

CVE-2012-3700 : Apple Product Security

CVE-2012-3701 : Abhishek Arya of the Google Chrome Security Team using AddressSanitizer

CVE-2012-3702 : Abhishek Arya of the Google Chrome Security Team using AddressSanitizer

CVE-2012-3703 : Apple Product Security

CVE-2012-3704 : Skylined of the Google Chrome Security Team

CVE-2012-3705 : Abhishek Arya of the Google Chrome Security Team using AddressSanitizer

CVE-2012-3706 : Apple Product Security

CVE-2012-3707 : Abhishek Arya of the Google Chrome Security Team using AddressSanitizer

CVE-2012-3708 : Apple

CVE-2012-3709 : Apple Product Security

CVE-2012-3710 : James Robinson of Google

CVE-2012-3711 : Skylined of the Google Chrome Security Team

CVE-2012-3712 : Abhishek Arya of the Google Chrome Security Team using AddressSanitizer

View the original article here

About the security content of Apple TV 5.1.1

About the security content of Apple TV 5.1.1This document describes the security content of Apple TV 5.1.1.

For the protection of our customers, Apple does not disclose, discuss, or confirm security issues until a full investigation has occurred and any necessary patches or releases are available. To learn more about Apple Product Security, see the Apple Product Security website.

For information about the Apple Product Security PGP Key, see How to use the Apple Product Security PGP Key.

Where possible, CVE IDs are used to reference the vulnerabilities for further information.

To learn about other Security Updates, see Apple Security Updates.

">ACUtil.setPOD('us~en'); var articleId = "HT5598"; var ACStaticText = { 'more': '…more', 'less': 'less' };KmLoader.akamaiUrl = 'http://km.support.apple.com';//function sendRead()var locale = 'en_US';Event.observe(window, 'load', function() {ACHistory.addKbView('HT5598', 'About the security content of Apple TV 5.1.1', 'en_US', 'unknown');ACUtil.getMultipleOffers('133077,133607,PP23', 'HOWTO_ARTICLES', 'en_US', 'false');ACUtil.reportView('HT5598', 'en_US');// Apple Instant Feed statistics code if(enableAppleInstant == "yes"){var store = new Persist.Store('FeedStats');if (store.get('resultActivity')=='true'){var time = new Date();// Fix for /*setReadTimer = setTimeout(function(){var feedStats = new ACFeedStatistics();feedStats.updateRead('HT5598', store.get('position'));store.remove('HT5598');store.remove('position');}, 3000);*///store.set('HT5598', time.getTime());store.set('timeStart', time.getTime());}} });Event.observe(window, 'beforeunload', function(){// Apple Instant Feed statistics code if(enableAppleInstant == "yes"){ var store = new Persist.Store('FeedStats'); if (store.get('resultActivity')=='true' && store.get('timeStart') !== null){ var time = new Date();//var timeDiff = time.getTime() - store.get('HT5598');var timeDiff = time.getTime() - store.get('timeStart');var timeSpent = Math.floor(timeDiff/1000);var feedStats = new ACFeedStatistics();// Fix for if (timeDiff About the security content of Apple TV 5.1.1 Summary

This document describes the security content of Apple TV 5.1.1.

For the protection of our customers, Apple does not disclose, discuss, or confirm security issues until a full investigation has occurred and any necessary patches or releases are available. To learn more about Apple Product Security, see the Apple Product Security website.

For information about the Apple Product Security PGP Key, see How to use the Apple Product Security PGP Key.

Where possible, CVE IDs are used to reference the vulnerabilities for further information.

To learn about other Security Updates, see Apple Security Updates.

Products Affected

Apple TV (2nd generation), Apple TV (3rd generation), Product Security

Apple TV 5.1.1

Apple TV

Available for: Apple TV 2nd generation and later

Impact: Compromised applications may be able to determine addresses in the kernel

Description: An information disclosure issue existed in the handling of APIs related to kernel extensions. Responses containing a OSBundleMachOHeaders key may have included kernel addresses, which may aid in bypassing address space layout randomization protection. This issue was addressed by unsliding the addresses before returning them.

CVE-ID

CVE-2012-3749 : Mark Dowd of Azimuth Security, Eric Monti of Square, and additional anonymous researchers

Apple TV

Available for: Apple TV 2nd generation and later

Impact: An attacker with a privileged network position may cause an unexpected application termination or arbitrary code execution

Description: A time of check to time of use issue existed in the handling of JavaScript arrays. This issue was addressed through additional validation of JavaScript arrays.

CVE-ID

CVE-2012-3748 : Joost Pol and Daan Keuper of Certified Secure working with HP TippingPoint's Zero Day Initiative

$('articlecontent').select('img').each(function(element) { if(element.width > 640 ){ var imageDiv = document.createElement('div'); imageDiv.setStyle({ 'display':'block', 'width':'660px', 'overflow':'auto', 'border':'1px solid #dedede','margin-right': '15px'}); element.parentNode.replaceChild(imageDiv, element); imageDiv.appendChild(element); } }); $('articlecontent').select('table').each(function(element) { if(element.width > 660 || element.offsetWidth>660){ var tableDiv = document.createElement('div'); tableDiv.setAttribute("class","kbtablecontainer"); element.setAttribute("style","margin-bottom:0px !important"); element.parentNode.replaceChild(tableDiv, element); tableDiv.appendChild(element); } }); Important: Mention of third-party websites and products is for informational purposes only and constitutes neither an endorsement nor a recommendation. Apple assumes no responsibility with regard to the selection, performance or use of information or products found at third-party websites. Apple provides this only as a convenience to our users. Apple has not tested the information found on these sites and makes no representations regarding its accuracy or reliability. There are risks inherent in the use of any information or products found on the Internet, and Apple assumes no responsibility in this regard. Please understand that a third-party site is independent from Apple and that Apple has no control over the content on that website. Please contact the vendor for additional information. Rate this article:Not helpfulSomewhat helpfulHelpfulVery helpfulSolved my problemOne Moment PleaseThanks for rating this article Not helpful Somewhat helpful Helpful Very helpful Solved my problem Share this article Twitter Facebook Last Modified: Nov 29, 2012 Article: HT5598 Views: 126282 Rating: 3.0/5 Stars
(659 Responses) LanguagesDanskDeutschEnglishEspañolFrançaisItalianoNederlandsNorsk BokmålPolskiPortuguês (Brasil)PortuguêsSvenska KmLoader.isOmnitureSupported='true'; Event.observe(window, 'load', function() { new KmLoader('2', 0, 0, 'About the security content of Apple TV 5.1.1', 0, 0, 'en_US', 0, 0, 'support_site.related_articles.HT5598',undefined,undefined,'HT5598');}); Event.observe(window, 'load', function() { new KmLoader('1', 0, 0, 'About the security content of Apple TV 5.1.1', 0, 0, 'en_US', 0, 0, 'support_site.related_discussions.HT5598'); }); Related Discussions More discussions Related Articles Ask other users about this articlein Apple Support Communities Wait... See all questions on this articleSee all questions I have asked DeDupeFeaturedQA.Instance = new DeDupeFeaturedQA('question-form', 'interactiveQuestionSearchField', 'results-container', 'HT5598', 'en_US', 'https://discussions.apple.com/thread/','i

View the original article here

About the security content of Safari 6.0.4

About the security content of Safari 6.0.4This document describes the security content of Safari 6.0.4, which can be downloaded and installed via Software Update preferences, or from Apple Downloads.

">ACUtil.setPOD('us~en'); var articleId = "HT5701"; var ACStaticText = { 'more': '…more', 'less': 'less' };KmLoader.akamaiUrl = 'http://km.support.apple.com';//function sendRead()var locale = 'en_US';Event.observe(window, 'load', function() {ACHistory.addKbView('HT5701', 'About the security content of Safari 6.0.4', 'en_US', 'unknown');ACUtil.getMultipleOffers('PP23', 'HOWTO_ARTICLES', 'en_US', 'false');ACUtil.reportView('HT5701', 'en_US');// Apple Instant Feed statistics code if(enableAppleInstant == "yes"){var store = new Persist.Store('FeedStats');if (store.get('resultActivity')=='true'){var time = new Date();// Fix for /*setReadTimer = setTimeout(function(){var feedStats = new ACFeedStatistics();feedStats.updateRead('HT5701', store.get('position'));store.remove('HT5701');store.remove('position');}, 3000);*///store.set('HT5701', time.getTime());store.set('timeStart', time.getTime());}} });Event.observe(window, 'beforeunload', function(){// Apple Instant Feed statistics code if(enableAppleInstant == "yes"){ var store = new Persist.Store('FeedStats'); if (store.get('resultActivity')=='true' && store.get('timeStart') !== null){ var time = new Date();//var timeDiff = time.getTime() - store.get('HT5701');var timeDiff = time.getTime() - store.get('timeStart');var timeSpent = Math.floor(timeDiff/1000);var feedStats = new ACFeedStatistics();// Fix for if (timeDiff About the security content of Safari 6.0.4 Summary

This document describes the security content of Safari 6.0.4, which can be downloaded and installed via Software Update preferences, or from Apple Downloads.

Products Affected

Product Security

For the protection of our customers, Apple does not disclose, discuss, or confirm security issues until a full investigation has occurred and any necessary patches or releases are available. To learn more about Apple Product Security, see the Apple Product Security website.

For information about the Apple Product Security PGP Key, see "How to use the Apple Product Security PGP Key."

Where possible, CVE IDs are used to reference the vulnerabilities for further information.

To learn about other Security Updates, see "Apple Security Updates".
 

Safari 6.0.4

WebKit

Available for: OS X Lion v10.7.5, OS X Lion Server v10.7.5, OS X Mountain Lion v10.8.3

Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution

Description: An invalid cast issue existed in the handling of SVG files. This issue was addressed through improved type checking.

CVE-ID

CVE-2013-0912 : Nils and Jon from MWR Labs working with HP TippingPoint's Zero Day Initiative

$('articlecontent').select('img').each(function(element) { if(element.width > 640 ){ var imageDiv = document.createElement('div'); imageDiv.setStyle({ 'display':'block', 'width':'660px', 'overflow':'auto', 'border':'1px solid #dedede','margin-right': '15px'}); element.parentNode.replaceChild(imageDiv, element); imageDiv.appendChild(element); } }); $('articlecontent').select('table').each(function(element) { if(element.width > 660 || element.offsetWidth>660){ var tableDiv = document.createElement('div'); tableDiv.setAttribute("class","kbtablecontainer"); element.setAttribute("style","margin-bottom:0px !important"); element.parentNode.replaceChild(tableDiv, element); tableDiv.appendChild(element); } }); Important: Mention of third-party websites and products is for informational purposes only and constitutes neither an endorsement nor a recommendation. Apple assumes no responsibility with regard to the selection, performance or use of information or products found at third-party websites. Apple provides this only as a convenience to our users. Apple has not tested the information found on these sites and makes no representations regarding its accuracy or reliability. There are risks inherent in the use of any information or products found on the Internet, and Apple assumes no responsibility in this regard. Please understand that a third-party site is independent from Apple and that Apple has no control over the content on that website. Please contact the vendor for additional information. Rate this article:Not helpfulSomewhat helpfulHelpfulVery helpfulSolved my problemOne Moment PleaseThanks for rating this article Not helpful Somewhat helpful Helpful Very helpful Solved my problem Share this article Twitter Facebook Last Modified: Apr 16, 2013 Article: HT5701 Views: 27208 Rating: 3.0/5 Stars
(66 Responses) LanguagesCeštinaDanskDeutschEnglishEspañolSuomiFrançaisMagyarBahasa IndonesiaItaliano??????NederlandsNorsk BokmålPolskiPortuguês (Brasil)PortuguêsP??????Svenska???Türkçe???????? KmLoader.isOmnitureSupported='true'; Event.observe(window, 'load', function() { new KmLoader('2', 0, 0, 'About the security content of Safari 6.0.4', 0, 0, 'en_US', 0, 0, 'support_site.related_articles.HT5701',undefined,undefined,'HT5701');}); Event.observe(window, 'load', function() { new KmLoader('1', 0, 0, 'About the security content of Safari 6.0.4', 0, 0, 'en_US', 0, 0, 'support_site.related_discussions.HT5701'); }); Related Discussions More discussions Related Articles Ask other users about this articlein Apple Support Communities Wait... See all questions on this articleSee all questions I have asked

View the original article here

About the security content of iOS 6.1 Software Update

About the security content of iOS 6.1 Software UpdateThis document describes the security content of iOS 6.1.

For the protection of our customers, Apple does not disclose, discuss, or confirm security issues until a full investigation has occurred and any necessary patches or releases are available. To learn more about Apple Product Security, see the Apple Product Security website.

For information about the Apple Product Security PGP Key, see How to use the Apple Product Security PGP Key.

Where possible, CVE IDs are used to reference the vulnerabilities for further information.

To learn about other Security Updates, see Apple Security Updates.

">ACUtil.setPOD('us~en'); var articleId = "HT5642"; var ACStaticText = { 'more': '…more', 'less': 'less' };KmLoader.akamaiUrl = 'http://km.support.apple.com';//function sendRead()var locale = 'en_US';Event.observe(window, 'load', function() {ACHistory.addKbView('HT5642', 'About the security content of iOS 6.1 Software Update', 'en_US', 'unknown');ACUtil.getMultipleOffers('PL133,PL113,PF22,PP23', 'HOWTO_ARTICLES', 'en_US', 'false');ACUtil.reportView('HT5642', 'en_US');// Apple Instant Feed statistics code if(enableAppleInstant == "yes"){var store = new Persist.Store('FeedStats');if (store.get('resultActivity')=='true'){var time = new Date();// Fix for /*setReadTimer = setTimeout(function(){var feedStats = new ACFeedStatistics();feedStats.updateRead('HT5642', store.get('position'));store.remove('HT5642');store.remove('position');}, 3000);*///store.set('HT5642', time.getTime());store.set('timeStart', time.getTime());}} });Event.observe(window, 'beforeunload', function(){// Apple Instant Feed statistics code if(enableAppleInstant == "yes"){ var store = new Persist.Store('FeedStats'); if (store.get('resultActivity')=='true' && store.get('timeStart') !== null){ var time = new Date();//var timeDiff = time.getTime() - store.get('HT5642');var timeDiff = time.getTime() - store.get('timeStart');var timeSpent = Math.floor(timeDiff/1000);var feedStats = new ACFeedStatistics();// Fix for if (timeDiff About the security content of iOS 6.1 Software Update Summary This document describes the security content of iOS 6.1.

For the protection of our customers, Apple does not disclose, discuss, or confirm security issues until a full investigation has occurred and any necessary patches or releases are available. To learn more about Apple Product Security, see the Apple Product Security website.

For information about the Apple Product Security PGP Key, see How to use the Apple Product Security PGP Key.

Where possible, CVE IDs are used to reference the vulnerabilities for further information.

To learn about other Security Updates, see Apple Security Updates.

Products Affected

Product Security, iPad, iPhone, iPod touch

iOS 6.1

Identity Services

Available for: iPhone 3GS and later, iPod touch (4th generation) and later, iPad 2 and later

Impact: Authentication relying on certificate-based Apple ID authentication may be bypassed

Description: An error handling issue existed in Identity Services. If the user's AppleID certificate failed to validate, the user's AppleID was assumed to be the empty string. If multiple systems belonging to different users enter this state, applications relying on this identity determination may erroneously extend trust. This issue was addressed by ensuring that NULL is returned instead of an empty string.

CVE-ID

CVE-2013-0963

International Components for Unicode

Available for: iPhone 3GS and later, iPod touch (4th generation) and later, iPad 2 and later

Impact: Visiting a maliciously crafted website may lead to a cross-site scripting attack

Description: A canonicalization issue existed in the handling of the EUC-JP encoding, which could lead to a cross-site scripting attack on EUC-JP encoded websites. This issue was addressed by updating the EUC-JP mapping table.

CVE-ID

CVE-2011-3058 : Masato Kinugawa

Kernel

Available for: iPhone 3GS and later, iPod touch (4th generation) and later, iPad 2 and later

Impact: A user-mode process may be able to access the first page of kernel memory

Description: The iOS kernel has checks to validate that the user-mode pointer and length passed to the copyin and copyout functions would not result in a user-mode process being able to directly access kernel memory. The checks were not being used if the length was smaller than one page. This issue was addressed through additional validation of the arguments to copyin and copyout.

CVE-ID

CVE-2013-0964 : Mark Dowd of Azimuth Security

Security

Available for: iPhone 3GS and later, iPod touch (4th generation) and later, iPad 2 and later

Impact: An attacker with a privileged network position may intercept user credentials or other sensitive information

Description: Several intermediate CA certificates were mistakenly issued by TURKTRUST. This may allow a man-in-the-middle attacker to redirect connections and intercept user credentials or other sensitive information. This issue was addressed by not allowing the incorrect SSL certificates.

StoreKit

Available for: iPhone 3GS and later, iPod touch (4th generation) and later, iPad 2 and later

Impact: JavaScript may be enabled in Mobile Safari without user interaction

Description: If a user disabled JavaScript in Safari Preferences, visiting a site which displayed a Smart App Banner would re-enable JavaScript without warning the user. This issue was addressed by not enabling JavaScript when visiting a site with a Smart App Banner.

CVE-ID

CVE-2013-0974 : Andrew Plotkin of Zarfhome Software Consulting, Ben Madison of BitCloud, Marek Durcek

WebKit

Available for: iPhone 3GS and later, iPod touch (4th generation) and later, iPad 2 and later

Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution

Description: Multiple memory corruption issues existed in WebKit. These issues were addressed through improved memory handling.

CVE-ID

CVE-2012-2857 : Arthur Gerkis

CVE-2012-3606 : Abhishek Arya (Inferno) of the Google Chrome Security Team

CVE-2012-3607 : Abhishek Arya (Inferno) of the Google Chrome Security Team

CVE-2012-3621 : Skylined of the Google Chrome Security Team

CVE-2012-3632 : Abhishek Arya (Inferno) of the Google Chrome Security Team

CVE-2012-3687 : kuzzcc

CVE-2012-3701 : Abhishek Arya (Inferno) of the Google Chrome Security Team

CVE-2013-0948 : Abhishek Arya (Inferno) of the Google Chrome Security Team

CVE-2013-0949 : Abhishek Arya (Inferno) of the Google Chrome Security Team

CVE-2013-0950 : Abhishek Arya (Inferno) of the Google Chrome Security Team

CVE-2013-0951 : Apple

CVE-2013-0952 : Abhishek Arya (Inferno) of the Google Chrome Security Team

CVE-2013-0953 : Abhishek Arya (Inferno) of the Google Chrome Security Team

CVE-2013-0954 : Dominic Cooney of Google and Martin Barbella of the Google Chrome Security Team

CVE-2013-0955 : Apple

CVE-2013-0956 : Apple Product Security

CVE-2012-2824 : miaubiz

CVE-2013-0958 : Abhishek Arya (Inferno) of the Google Chrome Security Team

CVE-2013-0959 : Abhishek Arya (Inferno) of the Google Chrome Security Team

CVE-2013-0968 : Aaron Nelson

WebKit

Available for: iPhone 3GS and later, iPod touch (4th generation) and later, iPad 2 and later

Impact: Copying and pasting content on a malicious website may lead to a cross-site scripting attack

Description: A cross-site scripting issue existed in the handling of content pasted from a different origin. This issue was addressed through additional validation of pasted content.

CVE-ID

CVE-2013-0962 : Mario Heiderich of Cure53

WebKit

Available for: iPhone 3GS and later, iPod touch (4th generation) and later, iPad 2 and later

Impact: Visiting a maliciously crafted website may lead to a cross-site scripting attack

Description: A cross-site scripting issue existed in the handling of frame elements. This issue was addressed through improved origin tracking.

CVE-ID

CVE-2012-2889 : Sergey Glazunov

WiFi

Available for: iPhone 3GS, iPhone 4, iPod touch (4th generation), iPad 2

Impact: A remote attacker on the same WiFi network may be able to temporarily disable WiFi

Description: An out of bounds read issue exists in Broadcom's BCM4325 and BCM4329 firmware's handling of 802.11i information elements. This issue was addressed through additional validation of 802.11i information elements.

CVE-ID

CVE-2012-2619 : Andres Blanco and Matias Eissler of Core Security

 

$('articlecontent').select('img').each(function(element) { if(element.width > 640 ){ var imageDiv = document.createElement('div'); imageDiv.setStyle({ 'display':'block', 'width':'660px', 'overflow':'auto', 'border':'1px solid #dedede','margin-right': '15px'}); element.parentNode.replaceChild(imageDiv, element); imageDiv.appendChild(element); } }); $('articlecontent').select('table').each(function(element) { if(element.width > 660 || element.offsetWidth>660){ var tableDiv = document.createElement('div'); tableDiv.setAttribute("class","kbtablecontainer"); element.setAttribute("style","margin-bottom:0px !important"); element.parentNode.replaceChild(tableDiv, element); tableDiv.appendChild(element); } }); Important: Mention of third-party websites and products is for informational purposes only and constitutes neither an endorsement nor a recommendation. Apple assumes no responsibility with regard to the selection, performance or use of information or products found at third-party websites. Apple provides this only as a convenience to our users. Apple has not tested the information found on these sites and makes no representations regarding its accuracy or reliability. There are risks inherent in the use of any information or products found on the Internet, and Apple assumes no responsibility in this regard. Please understand that a third-party site is independent from Apple and that Apple has no control over the content on that website. Please contact the vendor for additional information. Rate this article:Not helpfulSomewhat helpfulHelpfulVery helpfulSolved my problemOne Moment PleaseThanks for rating this article Not helpful Somewhat helpful Helpful Very helpful Solved my problem Share this article View the original article here

Indian vendors answering BYOD security needs

Source: Internet Security Threat Report, Symantec

Several organizations these days allow, as well as encourage, employees to bring their own smartphones, tablets, and laptops to work. Some of these companies also give employees an allowance to buy their own devices and use them for work.

This bring-your-own-device (BYOD) trend, however, presents a challenge to traditional IT departments that prefer greater control over every device on the network.

Apart from personal devices, employees use online services for work intertwined with their personal ecosystem. Several people use social networks for work purposes like recruitment, marketing, and research, and many prefer using online storage and collaboration services to share work files or business communication instead of organization-managed applications.

Such consumer applications, services, and devices are invading office spaces and filling business needs. In some cases, this is done by geeky individuals without the support of the company. However, several businesses are embracing the idea of online services and personal devices to improve productivity and reduce IT costs.

Jay Vikram Bakshi, director of a Delhi-based digital marketing agency Digiqom, sees it as a positive trend. He asserted: "The whole idea is to benefit from the cost savings from fixed to pay-per-use, and additionally take advantage of open APIs (application programming interfaces) to adapt and modify traditional usage into scale, flexibility, and innovative usage."

There is, of course, the other side of this unmanaged adoption of cloud services and consumer devices in businesses--the security challenges brought about by the storage, management, and transfer of corporate data.

IT departments are struggling with tracking how and where corporate data is used. According to Symantec's Internet Security Threat Report, as users shift to mobile and cloud, so will attackers. It should come as no surprise that mobile platforms and cloud services will be likely targets for attacks and breaches in 2013. The rapid rise of Android malware in 2012 confirms this.

The threats are usually followed by vendor offerings. India telecoms player Bharti Airtel, for example, launched a new service--Dynamic Mobile Exchange Solution--which is touted to help organizations adopt BYOD without compromising data security. The service offers data "containerization" and secure browser for applications accessed with single sign-on across multiple device platforms, and empowers IT administrators to remotely manage security policies, device settings, certificates, applications, and operating systems.

At the announcement, Drew Kelton, president of Airtel Business at Bharti Airtel, said: "With changing business environment, youth driven trends like BYOD is gaining ground in India. According to industry estimates, approximately 70 percent of all smartphone-owning professionals are now using their personal devices to access corporate data, but almost 80 percent of today's BYOD activity remain inadequately managed because of various security concerns.

"This calls for businesses to implement innovative solutions that allow them to take control and benefit from BYOD phenomenon--without losing corporate data," Kelton added.

View the original article here

Life and death in Damascus's shrinking Square of Security

Pedestrians stop to read details of a death notice at a street in Damascus, April 3, 2013.

Credit: Reuters/Stringer

DAMASCUS | Wed Apr 17, 2013 10:25am EDT

DAMASCUS (Reuters) - In Damascus, even death offers no respite from the suffocating conflict encroaching on the Syrian capital.

The once secure central neighborhoods of the city are being sucked into the turmoil ravaging Syria as rebel fighters battle President Bashar al-Assad's forces on its periphery and step up rocket fire into central Damascus.

Relatives of people killed in and around the city cannot retrieve bodies before signing a mountain of paperwork absolving government forces of blame - just the first obstacle to be overcome before they can start a mourning process that is itself highly restricted.

Victims of violence cannot be described as "martyrs" in the death notices pasted on city walls and along narrow alleys unless they die fighting alongside President Bashar al-Assad's forces. Only vague phrases, such as "due to a tragic accident", are acceptable.

Bodies cannot be taken to mosques for funeral prayers in case they become a platform for anti-Assad protest.

And when mourners finally lay their loved one to rest, prayers are conducted in haste under the watchful eye of security forces who roam cemeteries to guard against the smallest display of anti-government sentiment.

The killing of a Damascus merchant, a distant relative of this reporter, at a checkpoint just a few weeks ago - a death described by his immediate family as random and unnecessary - highlighted both the new daily perils of Damascus life and the tribulations after death.

A trader in his 60s from the Old City in central Damascus, Aboudi was killed by a government sniper as his brother drove him and his son through a checkpoint on a morning errand to buy bread, his relatives told me. I have given only his family name to protect his identity.

The men passed through the area regularly and were known to the soldiers manning the checkpoint, who often waved them through. On this morning Aboudi's partially deaf brother saw a guard nod his assent, and drove through the checkpoint, unaware that another guard was shouting at him to stop.

A jittery conscript providing cover to the guards assumed the men were trying to flee and opened fire, killing Aboudi and wounding his brother and the young man in the back seat.

For the family, grief over their loss was compounded by the bureaucracy which followed.

"They had to sign papers that say it was terrorists who did it, and that the government had no role at all in his death," said Aboudi's daughter-in-law. "They didn't release the body until all forms were signed and sealed with thumb prints."

Describing her husband as "heart-broken" over his father's death, she said he and others in the neighborhood have vowed revenge on the soldier, who has not been seen since.

The dead man, popular in the Old City because of his reputation for giving money to the needy and poor, was buried in a muted ceremony without fanfare, under supervision of the security forces.

Family members said they were denied a full prayer service for him at a local mosque "for security reasons".

TWO STEPS FROM DEATH

Aboudi's killing was just one of many in a mounting death toll that is now part of everyday existence in the capital. Every Damascene today is just one or two degrees removed from the latest casualty.

On a daily basis we hear the sonic booms and air raids of fighter jets, the shelling from government-mounted missile batteries stationed in the hills overlooking north Damascus, and rocket and mortar fire from rebels on the outskirts.

Sometimes we count the shells; the other day we heard two dozen just seconds apart.

Another day, a Friday before midday prayers, I heard thuds and booms from the edge of the city as government MiG jets unleashed their bombs on the farming area of Sbeineh, where in happier days we went to get fresh air and pick apples.

The bombs also fell on Daraya, a working-class suburb that fell to the rebels months ago and has been reduced to a ghost town by relentless government shelling.

From my kitchen window, I saw black smoke rising from Daraya. Dense, acrid and slow-moving, it spread over the city, following a path taken by Daraya's families who have fled their district and dispersed around Damascus, doubled and tripled up in small flats with relatives.

One Daraya family of five has been squatting for months in the basement of my building, inside a cramped janitor's room.

FRUSTRATION

In these tense times, Damascenes complain of frustration and ennui. This is especially true on Fridays, the start of the Syrian weekend and the original day of protests in the early months of Syria's uprising, which has now spiraled into a civil war which the United Nations says has killed 70,000 people.

Determined to prevent protests, authorities increase security at checkpoints and deny entry to the city from the suburbs, questioning drivers within the city at length.

Nowadays hardly anyone goes out on a Friday, but I had promised to visit relatives so I ventured out, on foot to avoid questioning at checkpoints. The short walking tour brought home how the city has changed.

Damascus today feels smaller and emptier, shrunk to the dozen or so districts under government control known collectively as the 'Square of Security'. You can walk briskly from one end to the other in under two hours.

As it shrinks, Damascenes with a dark sense of humor have taken to calling it the Triangle of Security.

It includes the historic Old City, where the biblical Saint Paul walked on the Street Called Straight. All the city's major commercial districts are also in the Square-turned-Triangle, including the ancient bazaar and contemporary shopping malls.

It includes middle class districts, parliament, various ministries and intelligence branches. It is here that Assad and most government officials live.

Assad's forces are increasingly bringing artillery into the centre of this area, firing from the densely populated area towards the rebels outside.

"We hear it discharge and we hear it pierce the air," one of my friends told me.

"We hear its whistle as if it's flying past our window, and we hear it when it falls - the thud and the explosion," he said, adding that his whole family have been kept awake since the artillery was deployed in his neighborhood a few days ago.

"No matter how hard we try to get used to it, we get startled every time."

I once had many relatives and friends here. Most of them fled the country when the violence reached their doorstep and life became unbearable.

Such was the case of my cousin when I arrived to bid her farewell. Frazzled and unsure of the future, she and her husband had packed their belongings and were preparing for departure.

It was still light when I returned home. Back in my kitchen, as I prepared my dinner, I looked out the window and saw more smoke. The fighter jets were at their work.

(The journalist's name has been withheld for security reasons)

(Editing by Dominic Evans and Sonya Hepinstall)

View the original article here