US-CERT warns of flaw in latest RealPlayer
245392
InfoWorld - US-CERT is warning computer users of a possible problem with the latest version of RealPlayer after a Russian security company claimed to have found a way to exploit a critical flaw in the multimedia software.
633181
Gareth Heyes has a new post today talking about one of the vulnerable values in the $_SERVER superglobal - PHP_SELF.   I thought it might be a good idea to gather a few test cases demonstrating the problem. Why PHP allows these URL's is beyond me and it wouldn't take much work to filter out these malicious URL's in the PHP code.   He provides four test cases to show how simple it is to abuse - one using a HTTP header, another pushing XSS through, the third mentions search pages and the fourth a direct code injection.   You can download the code here.
103702
Blog: Many of the patches address flaws within QuickTime for Java.
676591
Ziff Davis - Holes in KOffice and RealPlayer allow attackers to take over a user's system.
569781
RealNetworks announced a new version of its RealPlayer media player software. Its makers claim RealPlayer 11 will be the first media player to offer one-click video downloads of embedded web-based content. The online player will also support rival formats Flash and QuickTime.
469846
An exploit for PHP's COM objects on the 5.x series has been reported by shinnai - an issue that allows for a bypass of safe_mode and disable_function settings.   The exploit has been published as a PHP file for easy testing on your Windows/PHP installation (it was tested on WinXP Pro SP2 on both the CLI and Apache). No additional modules are needed for this exploit - only the COM functions and a Windows system.   The issue comes from an overflow in the str_repeat function allowing for the execution of whatever applications the developer wants on the remote Windows machine (including the ability to create and remove files and directories). There is no path for this issue currently (should be corrected in the next minor PHP release).
212311
A US security company is warning that it has found ten &#39;serious&#39; vulnerabilities in Windows XP systems with SP2 installed.
182443
Software security companies and US-Cert, the US government&#39;s computer monitoring body, have issued warnings about security vulnerabilities in Oracle software.
756098
A recent string of high-profile ActiveX vulnerabilities caused the U.S. Computer Emergency Readiness Team (US-CERT) to advise users to disable the ubiquitous Microsoft browser plug-in technology altogether. The vectors for these recent exploits include a third-party image uploading tool used on both the Facebook and MySpace social networking sites, and flaws found in Yahoo's Music Jukebox, Real Networks' RealPlayer, and Apple's QuickTime.                                                    "We're seeing an increase in exploits aimed at these types of tools that are commonly used with a variety of technologies including social networking sites and multimedia players. As online crime becomes more prominent, malicious actors are taking advantage of these types of vulnerabilities to accomplish their objectives," said a spokesman at the U.S. Department of Homeland Security, which oversees the US-CERT.Security experts contend that there's no end in sight for attacks on the plug-in architecture.One reason is that there are plenty of security holes in ActiveX to be exploited. But another reason is not Microsoft's fault, they say: any technology used so widely will attract hacker attacks. "There's simply a lot of software out there using ActiveX that's either preloaded or embedded that users don't even realize is there, and that's why it was necessary to make the advisory," the US-CERT spokesman said.Although features added in Microsoft's newest Web browser, Internet Explorer 7, may help reduce the problem down the road and push attackers to move on to new targets, ActiveX will remain among the leading programs assaulted by opportunistic cyber-criminals, at least for the foreseeable future, several researchers say. After all, they say, Internet Explorer's status as the most used Web browser makes it an attractive target, just as the Windows operating system has been subject to constant attack for the past decade due to its huge market share. "When hackers spend time trying to find vulnerabilities to exploit, they want to make sure that they can affect the highest number of people," said Will Dormann, a vulnerability analyst at the Carnegie Mellon Software Engineering Institute CERT.A juicy target that's easier to exploit When you ask researchers which ActiveX exploits make them curl their toes in reaction, the answers don't tend to focus on specific sets of attacks but instead on the sheer volume and variety of the threats, and the vulnerabilities that allow for them.Some of the most prominent examples of ActiveX exploits include malware attacks aimed at Microsoft's Data Access Component (MDAC) software, which was pummeled for years by a broad range of attacks, and problems with the HTML Help ActiveX control module in Internet Explorer that opened it to numerous types of attacks, most notably the Phel Trojan virus.These well-known examples are just the tip of the iceberg for the vulnerabilities that ActiveX exposes users to. One reason is that as Microsoft fixes vulnerabilities in Windows, hackers are moving to easier targets, such as ActiveX, said Randy Abrams, director of technical education at ESET, a maker of anti-malware software. "Applications and plug-ins like ActiveX are the new low-hanging fruit so that's what's being attacked," he said.Abrams believes that ActiveX introduces unnecessary risk in many cases, because it is typically used for nonessential purposes. "The truth is that the ActiveX problem is also based on an irrational love of fashion; it's all about adding functionality to sites and applications to make them look cool, but in actuality it's completely unnecessary," he said. "If it wasn't for this need to make things look fashionable there would be much less risk." But Abrams doesn't expect developers to throttle back ActiveX use despite its security risks: "The cat is out of the bag, and sites now compete to look visually impressive and offer better functionality."Many developers of ActiveX-based applications do a poor job of ensuring security, notes Craig Schmugar, a threat researcher at McAfee's Avert Lab. And that threat grows as the number of ActiveX applications grows. "You can improve developer education, but hackers are likely to keep attacking the soft targets," he said.It's also become easier for hackers to find ActiveX's flaws, thanks to the broad availability of fuzzing tools. "The publicly available fuzz testing tools for ActiveX make it relatively simple to find new vulnerabilities and controls to go after, so people are able to research how exploitable certain applications may be before writing their attacks," said Carnegie Mellon's Dormann. "People are finding new holes all the time and posting them to public mailing lists," he added."One of the most telling things to look at with ActiveX is that security researchers delving into these problems don't get a lot of respect within the vulnerability research community itself," Schmugar noted. "That's mostly because with the sheer number of holes, and all the available fuzzing tools, people look at it like shooting fish in a barrel."IE7 improvements should help over time Microsoft is well aware that ActiveX is both a big target for hackers and one that they can successfully attack. So the company has re-architected its Internet Explorer Web browser in version 7 to limit the scope of well-known attacks methods. Researchers say that the work should eventually produce dividends.For example, the original implementation of ActiveX in IE6 and previous versions exposed binaries to any page visited by users. By contrast, IE7 provides far less access to sites and applications, preventing malware authors from activating code that would let them hack the browser.Microsoft has configured IE7's defaults so that only "safe" ActiveX controls (as determined by Microsoft) can be accessed, and it has enhanced separation of controls to prevent exploits from running roughshod across the entire Internet Explorer application as they often did in the past, researchers said. "IE7's protected mode definitely helps, even if the root cause in the form of ActiveX vulnerabilities is still present, and in the long run it will play a role in convincing attackers to move elsewhere, but with Vista and IE7 in relatively few hands this won't happen soon," said McAfee's Schmugar. Improvements made in the Windows Vista operating system should also help reduce the impact of traditional ActiveX attack techniques, he noted.However, most people use neither Vista nor IE7, so these improvements aren't widely deployed. The majority of users run IE6 on Windows XP, both of whose ActiveX components remain largely unchanged and thus at high risk.Dumping ActiveX is not the long-term solution Given that ActiveX is compatible only with Microsoft's Windows browsers, you might conclude the safest solution to the security threat is to use alternative technologies such as JavaScript.That strategy may work for a while, researchers said. But as alternative browser plug-in technologies gain adoption, they too will become more significant targets for attackers. Researchers cite the increasing attacks aimed at the Mozilla Firefox and Apple Safari browsers as they gained in popularity, as well as the likelihood of more Mac OS-based threats as that operating system continues to gain market share. And JavaScript is no stranger to attacks, either."The issue goes beyond ActiveX. Any plug-in architecture that has a lot of users will suffer from these same issues; anything where you have third party developers writing code that runs inside the browser," said Max Caceres, director of research and development at applications security firm Matasano Security. "As long as developers are building things without putting security at the top of their list of objectives, we'll have these problems, regardless of the plug-in architecture."
618473
Tycho:  Gamespot is saying there's a reproducible crash in the new Tiger Woods for the 360, and that the Gamernet functionality doesn't work there either.  PS3 version sounds clean.    Next year, can you guys make sure you put your crash bugs into the demo, too?  It would really help the consumer make an educated decision.    It's so weird; we had problems with the last one, but it never occurred to us that the next one could be worse.  That is to say, I expect inertia.  I don't expect it to break before I even get the Goddamned thing home.      (CW)TB
42081
Blog: Popular add-ons could have their update process hijacked by man-in-the-middle attacks.
82794
Blog: Real Networks announced today that the new version of their RealPlayer will allow users to download and organize embedded internet video content right from their browser.
242975
Tycho:  Sony hasn't been entirely clear regarding what their 1.92 update for the Playstation 3 actually does, suggesting that it "focuses on some PS3 compatibility and playability issues for select titles," but our own experience with the update has been conclusive.  In the Internet's dark places, aggrieved Lair fans are suggesting that this update improves the game's motion controls, and that each media outlet must rescind their previous scores.  I'm fairly certain this is magical thinking - neither Sony or Factor 5 will say with any specificity, and now that both our PS3s are updated it would be impossible to test.  Typically we don't take the traditional holidays off, nor do we take off non-traditional holidays, such at the Feast of St. Motherfucker - a holy day that I've only just now invented.  Gabe's father was around, though, and golf seemed like a good time investment.  Reading greens and choosing clubs for other people is about as far as I get, so for me the social aspects of the game are paramount.  Standing under the awning at the driving range, it's hard not to see where EA's Tiger series could improve.      This year's lobby system is much improved over last year's, but I'm not sure why the lobby itself couldn't be a driving range.  This is how virtually any actual round of golf starts, with every person hitting the bucket they bought and lamenting their performance.  A few of their minigames would work just fine in this context - don't create a custom game to play them, build all of the basic play into a casual, central experience.  From here, modes, courses, and wagers are established.  When new people pull in, carts can be heard.  Links for the 360 wasn't as complete as Tiger, but it had four player modes first - and it had a means to play Speed Golf that Tiger should loot from its fallen enemy.  Essentially, you play the round as normal.  Everyone else plays the round as normal simultaneously, and shots are keyed to a certain color so that the arc of each person's shot is visible to all other players.  They need to steal this - throw the name of each player on there, use the face, whatever.  This needs to be how it works.  You can play an entire course in a quarter of the time.  The RPG metaphor really worked the first few times I bought the product, but it's really lost its currency with me.  There's a point - and it may be with the '08 version of the product - where the number of courses are such that I don't actually want to pay sixty dollars again just to lose all of my character progression every year.  Gabriel's suggestion is to approach it more like a fighting game, which is to say like Mario Golf - with discrete golfer archetypes that have a suite of skills.  I'm wondering if Guild Wars doesn't have the answer - full priced expansions every year, with a perpetually tracked online experience where your prior purchase actually increases the value of the next.  Let all play - online and off - be a part of the core experience, let all play hone your ability.  Don't wall off online play into some purgatory as it is now, untracked, outside of the normal scheme of advancement.    With these thoughts in my head, excited by the sun-dappled future we had envisioned. we sat down to play a round online the next night.  After determining that one of us couldn't play at all or it would crash the game for everyone - a weird kind of crash where you can't play, but you're able to talk to one another about the crash - we were able to play eight holes, at which point it crashed before a victor could be determined.  They've only just made online Photo Game Face available for Tiger, for the first time since launch, but they had to deactivate online features for two other titles to do it.  So, no.  I don't have high hopes.
143929
Microsoft Windows users need to watch out for several flaws in non-Microsoft media players.
745068
InfoWorld - A recent string of high-profile ActiveX vulnerabilities caused the U.S. Computer Emergency Readiness Team (US-CERT) to advise users to disable the ubiquitous Microsoft browser plug-in technology altogether. The vectors for these recent exploits include a third-party image uploading tool used on both the Facebook and MySpace social networking sites, and flaws found in Yahoo's Music Jukebox, Real Networks' RealPlayer, and Apple's QuickTime.
27813
One day after Symantec Corp. researchers discovered software that attacked a critical unpatched vulnerability in RealNetworks Inc.'s media player, Real says that a fix for the issue is imminent.
98682
One day after Symantec&#160;researchers discovered software that attacked a critical&#160;unpatched vulnerability in RealNetworks&#39; media player, Real says that a fix for the issue is imminent.&quot;Real has created a patch for RealPlayer 10.5 and RealPlayer 11 that addresses the vulnerability identified by Symantec,&quot; wrote RealNetworks General Manager of Product Development Russ Ryan, in a Friday blog posting. &quot;Real will make this patch available to users via this blog and our security update page later today.&quot;Users of RealOne Player, RealOne Player v2, and RealPlayer 10 should upgrade to the 10.5 version of the product or the RealPlayer 11 beta code and should install the patch, Ryan said.The attack exploits a flaw in an ActiveX browser helper object, software that RealPlayer employs to help users who are experiencing technical difficulties, so the PC must be using the Internet Explorer browser to be affected by this particular attack, Symantec said.The attack only works on Windows systems, RealNetworks said. Linux, Mac and RealPlayer 8 users are not affected.Attackers were using a complicated network of advertising Web sites to launch the attack from a Web site that has been spotted hosting malicious code several times over the past two years, Symantec said.&quot;The exploit itself is embedded in advertisements that were being served by 247realmedia.com,&quot; Symantec said in a note on its DeepSight threat management system. &quot;The redirection to the exploit page... was accomplished through an iFrame embedded in each advertisement.&quot;Iframe is an HTML command that allows developers to insert a second Web page into the page being viewed. It is often used by malware creators because these iFrame pages can be as small as 1 pixel, making them invisible to the naked eye.Users who do not have the patch can turn off ActiveScripting within IE as a workaround to the problem. Very technical users can also set kill bit on the Class identifier (CLSID) FDC7A535-4070-4B92-A0EA-D9994BCC0DC5 to disable the ActiveX control, Symantec said.&#160;