Why are criminals still exploiting an 18-month old patched vulnerability?
283610
Nearly two years after Microsoft issued a patch, enough systems remain vulnerable that criminals still including this exploit (and others) in their bag of tricks.
16648
Opt-out button in spam used to run exploit
435582
Blog: Updates address some critical vulnerabilities in the popular browser.
587711
Hackers could bypass security warnings and download malicious content.
302247
Mozilla issued 10 patches on Friday for its Firefox browser, including three for critical vulnerabilities. The latest version of Firefox is now 2.0.0.12.One of the critical vulnerabilities, MFSA 2008-06, is a problem in the way the browser handles images on certain Web pages.It&#39;s possible to exploit the flaw to steal a person&#39;s Web browsing history, forward that information and then crash the browser. It may also be possible to run arbitrary code on a machine, Mozilla said.A second critical vulnerability can enable a privilege escalation attack or remote code execution.The last critical problem involves a memory corruption flaw that &quot;we presume that with enough effort at least some of these could be exploited to run arbitrary code,&quot; Mozilla said.Also notable is a fix for a problem with Mozilla&#39;s &quot;chrome&quot; protocol, which is the term Mozilla uses for its user interface. The problem involves some of Firefox&#39;s add-ons, or applications that users can download which extend browser functionality.The vulnerability would let an attacker determine what applications are installed on a person&#39;s PC, which could give clues to how the machine could be compromised, Mozilla said. However, a victim would have to be lured to a special malicious Web page designed to take advantage of the flaw.&#160;
35029
Unpatched vulnerabilities may leave computers open to remote attacks.
357185
Just one day after&#160;Microsoft issued a massive set of security patches for its software, hackers have begun posting code showing how to exploit one of the flaws.The proof-of-concept code, posted Wednesday to the Milw0rm Web site, exploits a bug in the Microsoft Works file converter software that is part of Office 2003 and can be used to run unauthorized software on a victim&#39;s computer.The flaw also affects Works 8 and Works Suite 2005. To fall prey to the attack, a victim would first have to open a malicious Works attachment.Hackers have uncovered many of these file-format bugs in recent years, and they are generally not used in widespread attacks. In fact, security vendor Symantec predicts that we&#39;ll see fewer of these attacks in the months ahead as online criminals increasingly rely on browser bugs to do their dirty work.&quot;The bad guys, they&#39;re looking for different ways to trick people,&quot; said Wayne Periman, director of development with Symantec Security Response. &quot;The popular method of choice is to exploit plugins in browsers right now.&quot;Still, Periman expects criminals to try out this latest attack code. &quot;It&#39;s so simple,&quot; he said. &quot;All you have to do is get someone to open the document.&quot;As of Wednesday, Symantec had not seen any signs of attackers taking advantage of any of the flaws that Microsoft fixed this week.The software vendor released 11 sets of patches this week, fixing 17 flaws in its products, but this is the first exploit code to pop up following Tuesday&#39;s updates. A second program exploiting one of these vulnerabilities -- this one in an ActiveX control used by the Visual FoxPro database -- was posted to Milw0rm in September, months before Microsoft patched the issue.
763575
Ilia Alshanetsky posts today about the proposed "Month of PHP bugs" that Stefan Esser is proposing:   It would be interesting to see what issues he discovers, hopefully most of them have already been reported to the PHP Security Team, in which case the upcoming 5.2.1 release will provide a resolution path for affected users.   Hopefully, as Ilia states, the bugs will not turn out to be zero-day vulnerabilities and will instead be smaller issues. Either way, a bug-fix patch will probably soon follow.   Either way, I have to look at this as a free security audit of PHP by someone with a clue about security and ultimately, in the long run it will only make PHP better, even if March is going to be rather busy.
345464
php|architect has a new note about a few PHP vulnerabilities:
609514
Last weekend's disclosure of an alleged security vulnerability in Microsoft Word 2000, exploited by a new version of an old worm, is raising questions over what constitutes the severity of an exploit. Is it the degree to which we know about it, or the number of systems out there it could possibly hurt?
220487
An exploit attacking the most recent Windows bug is circulating on Usenet, security experts said Tuesday, that crashes machines, yet another indicator that attackers will chase the vulnerability until they&#39;ve launched mass mailing-style worm-based attacks
73868
The experts speak Interview Zero-day exploits were once the realm of just underground and elite hackers, but their increased prevalence is bringing a positive new trend: unofficial patches from members of the community, offered for protection before official vendor patches appear.â¦
520541
Exploit code targets a flaw that generated a government warning last week.
63078
Security researchers have discovered another vulnerability in Windows XP Service Pack 2, but it doesn&#39;t appear to be an immediate threat.
699435
A researcher has posted proof-of-concept code for a zero-day flaw within Mac OS X dealing with its handling of disk image (.dmg) files. The issue causes a memory corruption vulnerability that could allow attackers to execute arbitrary code.
608293
There is no need for serious alarm, but the exploit does appear to have been crafted before Apple Computer patched the flaw last week.
607068
As per suggestions contained in the FAQ: Herein lies a report of two identified and as-of-yet uncorrected security flaws in Scoop. &nbsp;Enough detail will be provided to assist admins in investigating and correcting the flaws, but it is the author's hope that the details of the flaws will be sufficiently obscured to prevent abuse by the undesirables. Executive summary: Through the exploitation of various unchecked privileged operations, attackers may be able to perform admin-level actions leading to data loss. &nbsp;Additionally, well-intentioned security measures combined with XSS vulnerabilities can be exercised to simulate admin-level action, resulting in data loss.