Attackers are exploiting a zero-day vulnerability in the latest versions of Adobe's Reader and Acrobat products to compromise computers. The company recommends disabling JavaScript as a temporary solution until a patch is shipped on October 13.The vulnerability, identified as CVE-2009-3459, can be used to remotely execute arbitrary code on a computer running the latest Windows flavor of Adobe Reader or Acrobat (9.1.3). In order to exploit it, attackers have to trick users into opening maliciously crafted PDF files.Adobe credits Chia-Ching Fang and the Taiwanese Information and Communication Security Technology Service Center with the d... [read more >>] eBay developer accounts may have been compromised by an unknown security flaw. On August 10, 2009, in an announcement from Kumar Kandaswamy, manager of the eBay Developer Program, the e-commerce giant revealed that a dangerous security flaw had been discovered in the Developer Program.According to Mr. Kandaswamy, no sensitive financial information was stolen and no attack was registered, this flaw being discovered internally after several tests and investigations. The eBay representative said that “This type of access DOES NOT allow the capture of financial or other sensitive information, such as credit card or bank account informatio... [read more >>] Researchers from Finnish security testing company Codenomicon warn that most open source XML parsing libraries suffer from vulnerabilities that can be exploited to generate denial of service conditions or execute hostile code. This research could have huge implications as there are a big number of applications that use these libraries to handle XML-formatted data.Codenomicon has offices in Oulu, Silicon Valley and Hong Kong, and its main activity is developing proprietary software security assessment tools. The company recently began testing open source XML libraries by using new XML-based fuzzing technology, as part of its Codenomicon Robu... [read more >>] Adobe has confirmed a critical vulnerability affecting the latest version of its Flash Player product, after reports of it being exploited in the wild surfaced. The zero-day flaw can be exploited by tricking users into viewing a maliciously crafted .swf file or opening PDF documents with malicious Flash streams embedded. Multiple security companies reported yesterday that a previously unknown Flash vulnerability was being actively exploited to infect computers with malware. These attacks are currently limited in number, but they are expected to increase as soon as more details about the flaw are made public. The bug affects even the lates... [read more >>] Several vulnerability research organizations have reported a remote stack buffer overflow vulnerability in the newly released Firefox 3.5.1 version. Mozilla dismisses claims that this bug can be exploited to compromise computers and says that its impact is only limited to a denial of service condition. Just a day before Mozilla released version 3.5.1 of its Firefox browser in order to address a highly critical flaw in the JavaScript Just-in-Time (JIT) compiler, security researchers reported a separate stack-based buffer overflow vulnerability. "By sending an overly long string of unicode data to the document.write method, a remote attacke... [read more >>] A zero-day proof-of-concept exploit for a critical vulnerability in the latest Mozilla Firefox version has been recently released. The flaw allows attackers to execute malicious code on users' computers by tricking them into visiting a maliciously crafted page. According to Mozilla's Security Team, the bug was discovered last week and is located in the Just-in-time (JIT) JavaScript compiler of the recently released Firefox 3.5. Danish vulnerability research company Secunia catalogs it as a memory corruption vulnerability and assigns it a "Highly Critical" severity rating. Proof-of-concept exploit code has been published two days... [read more >>] A hacker calling himself Arr1val has published proof-of-concept exploit codes for two 0-day vulnerabilities affecting Adobe Reader and Acrobat. The company has already confirmed one of them and strongly suggests disabling JavaScript in the products until a patch will be made available. The flaws are classified by SecurityFocus as "boundary condition errors." The first is located in the getAnnots() JavaScript function and the other in spell.customDictionaryOpen(). Both of them make it possible for an attacker to execute arbitrary code on systems with the affected products installed, by tricking users into opening a maliciously crafted PDF f... [read more >>] The development department at anti-virus vendor Trend Micro has been recently hard at work to plug a hole in the Internet Security 2008 and 2009 products after someone posted a PoC exploit for it. Trend Micro is one of the largest providers of anti-virus and security solutions in the world. Its flagship product is PC-cillin Internet Security, currently known as Trend Micro Internet Security (TIS). The company also develops HouseCall, one of the first free online anti-virus scanners. On 30 March 2009, someone going by the handle of "b1@ckeYe" posted a proof-of-concept exploit code for a privilege escalation vulnerability, affecting TIS 200... [read more >>] The release of proof-of-concept exploit code for an unresolved critical bug that allows for remote arbitrary code execution on the latest stable version of Mozilla Firefox has put developers on alert. A fix will be included in the 3.0.8 version of the browser, which is scheduled for release in a few days. The vulnerability is described on SecurityFocus as a "Boundary Condition Error" and allows an attacker to execute potentially malicious code by calling a malformed XML file from a Web page. Parsing a specially crafted "root" XML tag in an XSL file results in a memory-corruption error. These drive-by types of attacks have become the weapo... [read more >>] The yet-unpatched critical vulnerability affecting up-to-date versions of Adobe Reader and Acrobat has just become more dangerous. A security consultant has demonstrated how to exploit the bug without needing to actually open a malformed PDF file. It's been a little over two weeks since members of the cyber-crime fighting outfit "The Shadowserver Foundation" warned about a 0-day serious vulnerability in Adobe Reader and Acrobat, which was being exploited in the wild through maliciously-crafted PDF files. Adobe acknowledged the vulnerability in an advisory, but only scheduled a patch for March 11, a rather long period of time for a 0-... [read more >>] | 
RSS
