Category: exploit

Microsoft: Emergency IE Patch Coming

0
Posted by Tech Paranoia on January 19, 2010 – 9:02 am
Filed under Patches, exploit
Tagged as , , , , ,

Microsoft has started dropping broad hints that an emergency patch for Internet Explorer will be released very soon to counter targeted attacks and the publication of exploit code for a “browse and you’re owned” vulnerability in its flagship Web browser.

The out-of-band update will be released once the company is satisfied that it has been properly tested against all affected versions of Windows. This could happen as early as this weekend.

The decision to ship the IE patch outside of Microsoft’s scheduled Patch Tuesday releases follows the release of exploit code into the Metasploit attack tool.

The Metasploit code only works against Internet Explorer 6 but there are claims in the security research community that the vulnerability has been successfully exploited on IE7 (Windows Vista) as well as IE6 and on Windows XP.

The vulnerability was discovered during zero-day attacks against several big-name U.S. companies, including Google, Adobe and Juniper Networks. During those attacks, data-stealing malware exploited the flaw against systems running IE6 on Windows XP.

Microsoft says the ongoing attacks remain “targeted to a very limited number of corporations” and are only effective against Internet Explorer 6. However, with the exploit code now in Metasploit, malware purveyors could begin tinkering with exploits geared to newer versions of the browser.

Now, Microsoft is imploring its customers to upgrade immediately to IE 8. A special guidance page has been published to offer information on how to mitigate this vulnerability and avoid attacks.

Microsoft’s Security Research & Defense team has created and released a one-click “Fix It” tool to allow users to enable DEP (Data Execution Prevention) on older versions of the browser. DEP, a crucial anti-exploit mitigation, is enabled by default on IE8 only.

Source: ThreatPost

Hack of Adobe Conducted Via Zero-Day IE Flaw

0
Posted by Tech Paranoia on January 14, 2010 – 2:22 pm
Filed under Hacks, Zero Day, exploit
Tagged as , , , , ,

The recent hack attack on Adobe occurred through exploitation of a zero-day vulnerability that affects all versions of Internet Explorer, according to a security researcher with a leading anti-virus firm.

Microsoft learned about the vulnerability only Wednesday evening and is planning to release an announcement about the vulnerability later today, said the researcher, who asked not to be identified because he’s not authorized to speak with the press.

The vulnerability, for which there is currently no patch, is a memory corruption flaw that causes the browser to internally misfire in a way that allows the hacker to inject malware on the user’s computer.

“It’s pretty targeted so the reality is that it’s only currently being used against these targeted companies,” the researcher said. He couldn’t say how many of the other 33 companies hit in the hack attack were breached in this way.

Zero day vulnerabilities are security flaws in software for which there is currently no patch. Researchers discovered a memory corruption flaw in IE in December, which Microsoft patched on Dec. 9. The researcher, however, said the one that affected Adobe is believed to be a new and different one.

Google announced on Tuesday that it had been the target of a “highly sophisticated” and coordinated hack attack against its corporate network, and that the hackers had stolen intellectual property and sought access to the Gmail accounts of human rights activists.

Minutes later, Adobe acknowledged in a blog post that it discovered Jan. 2 that it had been the target of a “sophisticated, coordinated attack against corporate network systems managed by Adobe and other companies.”

Neither Google nor Adobe provided details about how the hacks occurred.

Full article at: Threat Level

Microsoft warning to XP users: Update Flash Player Now

2
Posted by Tech Paranoia on January 13, 2010 – 10:00 am
Filed under Software, exploit
Tagged as , , ,

Microsoft has shipped a security advisory with an urgent message for Windows XP users: Update your Flash Player immediately.

The Adobe Flash Player 6 that ships by default in Windows XP is vulnerable to multiple code execution vulnerabilities that could lead to PC takeover attacks, according to the advisory.

Here’s the warning:

Microsoft is aware of reports of vulnerabilities in Adobe Flash Player 6 provided in Windows XP. We are not aware of attacks that try to use the reported vulnerabilities or of customer impact at this time but recommend that users install the latest version of Flash Player provided by Adobe.

The Adobe Flash Player 6 was provided with Windows XP and contains multiple vulnerabilities that could allow remote code execution if a user views a specially crafted Web page. Adobe has addressed these vulnerabilities in newer versions of Adobe Flash Player. Microsoft recommends that users of Windows XP with Adobe Flash Player 6 installed update to the most current version of Flash Player available from Adobe.

This issue affects Windows XP Service Pack 2 and Windows XP Service Pack 3. The warning is also applicable to users running Windows XP Professional x64 Edition Service Pack 2.

Adobe discontinued support for Adobe Flash Player 6 in 2006. The latest version of Adobe Flash Player is 10.0.42.34.

Adobe Flash Player is among the most commonly exploited desktop applications so it’s important for all Windows XP users to heed this warning from Microsoft.

Source: ThreatPost

Mac OS X vulnerability left unpatched for months

1
Posted by Tech Paranoia on January 12, 2010 – 3:00 pm
Filed under exploit
Tagged as ,

New information about a security hole in Mac OS X ,which has been known for about seven months, could finally force Apple to fix the problem. The hole is a new instance of the flawed implementation of the dtoa (double to ascii) C function for converting floating point numbers into strings. During conversion, a flaw in the array index can allow some memory areas to be overwritten. Since the flaw originated in a C library file it found its way into a number of operating systems and applications.

By adding certain formatting characters to print functions, attackers can exploit the vulnerability to provoke a heap overflow, inject arbitrary code in a system, and execute it there. Publicly known since last June, the hole was rated (extremely) critical and has been fixed by several browser vendors, such as Opera, Google and the Mozilla Foundation. OpenBSD, FreeBSD and NetBSD also contained the hole, but have now been updated to close it.

According to Maksymilian Arciemowicz, who discovered the vulnerability, the dtoa flaw does exist in Mac OS X 10.5.x and 10.6.x, but it can’t be exploited via normal print functions such as printf. However, the strtod (string to double) libc function also uses the vulnerable dtoa code and can, in turn, be exploited via printf. Arciemowicz has released a short demo program which provokes the flaw – although it only causes the application to crash. However, according to Arciemowicz, it is not difficult to manipulate the ESI and EDI registers in such a way that injected code can be executed. Users apparently only need to visit a specially crafted web page to fall victim to the attack.

Why Apple hasn’t closed the known hole in dtoa is an open question. Arciemowicz speculates that the previous absence of a proof-of-concept exploit led Apple to believe the hole can’t be exploited. He said that other affected vendors usually respond promptly after being informed about vulnerabilities.

A similar misinterpretation of a hole in Java already caused considerable trouble for Apple last year. It was probably only an exploit published by security specialist Landon Fuller that eventually made Apple release an updated version of Java to close the hole.

Source: H Online

Frustrated bug hunters to expose a flaw a day for a month

0
Posted by Tech Paranoia on January 12, 2010 – 2:00 pm
Filed under Software, exploit
Tagged as , ,

A Russian security firm has pledged to release details of previously undisclosed flaws in enterprise applications it has discovered every day for the remainder of January.

Intevydis intends to publish advisories on zero-day vulnerabilities in products such as Zeus Web Server, MySQL, Lotus Domino and Informix and Novell eDirectory between 11 January and 1 February, security blogger Brian Krebs reports.

As an opener, Intevydis published a crash bug in Sun Directory Server 7.0, along with exploit code. The final line-up of zero-days is still being finalised, but the MySQL buffer overflows and IBM DB2 root vulnerability flaws on the provisional menu sound much tastier than Intevydis’s somewhat bland opener. Advisories are due to be published on the Intevydis blog here.

Intevydis said it launched its campaign after becoming more and more disillusioned with foot-dragging by vendors when confronted by security flaws in their products. “After working with the vendors long enough, we’ve come to conclusion that, to put it simply, it is a waste of time,” Evgeny Legerov, a founder of Intevydis told Krebs. “Now, we do not contact with vendors and do not support so-called ‘responsible disclosure’ policy.”

Only one software vendor, Zeus, reportedly worked with Intevydis in developing a patch to be released at the same time as an upcoming advisory from the Russian security firm. Intevydis’s stance is likely to reboot the long running debate about the responsible disclosure of security vulnerabilities.

Full article at: The Register

Adobe Reader vuln hit with unusually advanced attack

0
Posted by Tech Paranoia on January 5, 2010 – 12:00 pm
Filed under exploit
Tagged as , ,

With more than a week until Adobe is scheduled to patch a critical vulnerability in its Reader and Acrobat applications, online thugs are targeting it with an unusually sophisticated attack.

The PDF file uses what’s known as egg-hunting shellcode to compress the first phase of the malicious payload into 38 bytes, a tiny size that’s designed to thwart anti-virus detection. As a result, just four of the 41 major AV programs detect the attack more than six days after the exploit surfaced, according to this analysis from Virus Total.

The shellcode then loads an obfuscated binary file contained in the PDF file that installs PoisonIvy, a backdoor client used to maintain control over infected PCs.

“Not only was this a very interesting example of a malicious PDF document carrying a sophisticated ‘war head,’ but it also showed the length attackers are willing to go to in order to make their malware as hard to detect as possible, not only for the AV vendors, but also for victims,” wrote Bojan Zdrnja, a Sans handler who analyzed the exploit.

The PDF was distributed through email that was specifically targeted at an unnamed organization, Zdrnja, who is a senior information security consultant with Infigo, said in an interview with The Register. Based on the metadata found in the PDF, it originated in China and was produced on December 29.

Just to make the attack even harder for end users to detect, the obfuscated binary runs a third executable program that does nothing more than open a benign file called baby.pdf on the infected machine. Zdrnja believes this is done to deflect attention and prevent users from figuring out their PC has just been compromised.

Source: The Register

MS now dismisses IIS zero-day bug reports

0
Posted by Tech Paranoia on December 30, 2009 – 10:00 am
Filed under exploit
Tagged as , ,

Microsoft has dismissed reports that there’s an unpatched critical flaw in the latest version of its webserver software.

The software giant accepts there is an “inconsistency” in how IIS 6 handles semicolons in URLs . But it denies that this lends itself to hacking attacks, contrary to claims by security researchers shortly before Xmas. Redmond said fears that the bug allows hackers to circumvent content filtering software in order to upload and execute code on an IIS server are misplaced.

This scenario would only work if IIS web servers were set up to allow both “write” and “execute” privileges from the same directory, something that would make a system vulnerable in the first place and isn’t established even in default configurations, Microsoft states. The software giant has promised to make changes to purge the inconsistent behaviour from IIS 6.

Microsoft’s nothing-to-worry-about-please-move-along advisory, which helpfully provides links to best practice web server security guidelines, can be found here.

Source: The Register