Adobe Issues Patch for PDF-related Vulnerability
103752
It ended up not being Adobe's problem to begin with anyway: a vulnerability that enabled JavaScript code within a specifically crafted URL to run unchecked, and launch any executable code. When Petko D. Petkov of GNUCitizen.org discovered the problem, it appeared to have been directly triggered by Adobe Acrobat or Adobe Reader.
715397
(InfoWorld) - Microsoft Corp. has released its monthly set of security patches, fixing a critical flaw in Office. Attackers could exploit the bug by tricking Office users into opening a maliciously encoded .pub document, which would then allow attackers to run unauthorized software on a victim's PC. These .pub documents are created by Microsoft's Publisher software, an Office component used for designing print and online business publications. The flaw isÂ described here. Microsoft rates the bug as critical for Publisher 2000, but this warning has been downgraded to "important" for the Publisher 2002 and Publisher 2003 products. Some security experts expected Microsoft toÂ fix a similar bug in Word, which has been used by online attackers over the past few weeks, but that problem remains unfixed. Microsoft acknowledged the Word problem last week and probably did not have time to run a fix through its quality assurance tests, said Jonathan Bitle, a manager of technical accounts with Qualys Inc. "It's really late in their engineering cycle, so it's understandable that they wouldn't manage to get something out," he said. Both the Word and Publisher bugs rely on the same type of attack to work: an attacker e-mails a malicious document and somehow tricks the victim into clicking on the attachment. Security experts have been seeing more of these Office flaws exploited of late. "This is one of the trends that we have observed," said Amol Sarwate, director of the Qualys vulnerability research lab. "The growing number of client-side vulnerabilities where you have a malformed Publisher file or Word file or Excel file." Tuesday's patches also include less-critical fixes for two Windows components: the PGM (Pragmatic General Multicast) protocol used by Microsoft's Reliable Multicast Program software to transfer data, and the Windows Indexing service, which is used by the operating system's search engine. Microsoft's security bulletins offer more information. September may seem likeÂ a bit of a reprieve for harried system administrators who were given 19 updates to test and deploy over the past two months. Microsoft was forced toÂ reissue one of its August patches after it caused Internet Explorer to crash when working with a Web-based enterprise applications such as PeopleSoft and Siebel. But before Microsoft patchers get too relaxed, they should brace for the possibility of another patch later this month, Qualys said. Because attackers are actively exploiting the Word problem, Sarwate believes that Microsoft may issue an "out-of-cycle" patch for the problem, ahead of its next scheduled security updates, which are due Oct. 10. Â
560514
Adobe this week updated its Acrobat and Reader software to fix vulnerabilities spotted by Reston, Vir.-based security intelligence firm iDefense.
516374
Adobe today patched its Reader and Acrobat programs to fix a flaw involving malicious PDF files.
67079
Microsoft Corp has released a patch for its latest âcriticalâ rated security flaw affecting its Windows, Office and developer tools software programmes.
75537
No patch in sight Researchers from Google have documented serious vulnerabilities in Adobe Flash content which leave tens of thousands websites susceptible to attacks that steal the personal details of visitors.â¦
644473
Adobe Systems Inc. has released fixes for three critical vulnerabilities in Flash Player that could let hackers infect Windows, Mac OS X and Linux systems.
152057
More dodgy upgrade madness A faulty signature update from GRISoft published this week meant that its popular AVG anti-virus package falsely warned versions of Adobe Reader were infected with a Trojan.â¦
407556
Open secret widely exploited Security researchers have confirmed that a recent "covert" update to Adobe Reader has been exploited to distribute Trojans for at least a fortnight prior to its publication last Thursday (7 February).â¦
320729
Adobe fails to respond about a bug un-installing Flash, does not communicate will and tracks users of their CS3 software.
112014
PC Magazine - A malicious PDF is exploiting a URL-handling flaw in Windows XP and Windows Server 2003 running IE7.
300950
Update addresses potential denial-of-service vulnerabilities as well as a flaw in QuickTime.
321788
Microsoft on Tuesday issued a patch for an earlier discovered flaw in Visual Studio 2005, while yet another cumulative patch for Internet Explorer was released, as well as one for a vulnerability within the Windows Media Format.
643225
A team of analysts has successfully exploited a heap corruption vulnerability on a fully-patched Mac, and users running the Samba file- and printer-sharing application are advised to update the application manually.
560799
The patch fixes a flaw in the e-mail server software that could be used to get access to in-boxes and information.
625830
(InfoWorld) - MicrosoftÂ released its February set of security updates Tuesday, including critical fixes for bugs in Office and the scanning engine used by the company's security products. The security software flaw is of particular concern because it could, in theory, be very easily exploited by an attacker to run unauthorized software on a victim's PC. The bug has to do with the way that Microsoft's Malware Protection Engine, used by Windows Live One Care and Windows Defender, processes PDF files. Windows Defender is available for free and ships with Microsoft's Vista operating system. "An attacker could exploit the vulnerability by constructing a specially crafted PDF that could potentially allow remote code execution when the target computer system receives, and the Microsoft Malware Protection Engine scans, the PDF file," Microsoft said in its bulletin on the patch. This engine is also used by Microsoft's Antigen and Windows Forefront Security products, meaning that Exchange servers running these products could also be compromised. Although there is not yet any known attack that exploits this flaw, it could become a serious problem for Windows users running Microsoft's security products, according to Amol Sarwate, vulnerability lab manager at Qualys. "These attacks are very difficult to avoid," he said. "These products run automatically in the background." Symantec rated this scanning engine flaw the most critical of the vulnerabilities patched on Tuesday. In total, six of Microsoft's 12 updates are rated as "critical," while the other six have the less-serious rating of "important." Among the patches is a widely anticipated update for Microsoft WordÂ that fixes six bugs in Microsoft's word processing software. Hackers had been exploiting a number of these bugs in very targeted attacks over the past few months. Other critical patches fix bugs in the ActiveX HTML Help control and Microsoft Data Access Components, both used by Windows, as well as flaws in Office and Internet Explorer.
584817
Will a trifecta try at fixing Internet Explorer patch be the charm?