Yahoo IM affected by ActiveX vulnerabilities
83975
Three different ActiveX vulnerabilities affect Yahoo Instant Messenger version 3.5,  and Yahoo Messenger versions 4.0, 5.0, and 5.5
439551
A wave of bugs in the plug-in technology used by Microsoft's Internet Explorer (IE) browser has some security experts, including those at US-CERT, recommending that users disable all ActiveX controls.The U. S. Computer Emergency Readiness Team (US-CERT), part of the federal government's Department of Homeland Security, put it bluntly in advisories posted in the last two days: encourages users to disable ActiveX controls as described in the Securing Your Web Browser document," the organization recommended.US-CERT's advice was prompted by multiple vulnerabilities in high-profile ActiveX components used by members of the popular Facebook and MySpace social networks, as well as users of Yahoo's music services.Three new vulnerabilities in the photo uploader software used by both Facebook and MySpace were disclosed Monday by researcher Elezar Broad, who on Monday also posted sample attack code for a pair of critical bugs in Yahoo's Music Jukebox.Last week, Broad had pinned the Facebook and MySpace ActiveX controls with two other flaws. All five of the Facebook/MySpace vulnerabilities originated with an ActiveX control developed by Aurigma.As the number of vulnerabilities mounted, security professionals began ringing the alarm. On Monday, for instance, Symantec analysts urged users to "use caution when browsing the Web" and told IT administrators to disable the relevant ActiveX controls by setting several "kill bits" in the Windows registry.US-CERT, however, offered up more aggressive advice as it recommended users move IE's security level to the "High" setting, which completely disables all ActiveX controls.Setting IE's security level to 'High' disables all ActiveX controls. To get here, select Internet Options from the Tools menu, then click on the Security tab. Click Internet at the top for the zone, then move the slider up to the maximum."That's the easiest way to protect yourself," agreed Oliver Friedrichs, director of Symantec's security response group. "But it can also have an adverse impact on your browsing experience." A compromise, said Friedrichs, would be to disable "only those plug-ins that pose a current and imminent threat," such as the flawed ActiveX controls used by Facebook, MySpace and Yahoo.Disabling individual ActiveX controls, however, requires editing the Windows registry, a task too scary for most consumers to contemplate.Not so in business. "That approach is hard to argue against in the enterprise," said Friedrichs, who noted that there are tools available that let corporate IT administrators push registry changes -- including new keys that disable specific ActiveX controls -- to all users.The SANS Institute's Internet Storm Center (ISC) acknowledged that setting kill bits is beyond the ken of most users; one of its researchers came up with a graphical interface-based tool that sets and clears the kill bits of six ActiveX controls that have been tagged with bugs in the past week. The free tool can be downloaded from the ISC's Web site.The SANS Institute's free 'kill bit' tool provides checkbox-simple settings to disable half a dozen ActiveX controls. It's much easier than monkeying with the Windows registry."This is an easy way to disable the ActiveX control [for people] who don't know how to modify the keys directly," said Friedrichs.As if to emphasize the seriousness of the ActiveX problem, Friedrich's team warned customers Monday that attack code targeting one of the two Yahoo Music Jukebox bugs was on the loose. "Just one day after the proof of concept was released, in-the-wild exploitation was identified in our crawler honeypots," Patrick Jungles, a Symantec analyst, said in an alert to customers of the company's DeepSight threat network.Browser plug-in problems are anything but rare, said Friedrichs. "In the first half of 2007, Symantec counted 237 plug-in vulnerabilities. That's compared to 108 in all of 2006." The vast majority of those bugs -- 89 percent in fact -- were in ActiveX controls, making IE by far the most popular target for plug-in exploits.Last week, Facebook and MySpace said that they had come up with fixes for the vulnerabilities Broad had initially spotted, saying through a spokeswoman that they were "working to individually alert users of any additional steps that need to be taken to ensure user security." The two companies did not immediately respond to queries Tuesday about the newest bugs, however.As of mid-day Tuesday, Yahoo had not yet replied to questions posed the day before concerning the Yahoo Music Jukebox flaws.
143342
A vulnerability in Internet Explorer spells potential trouble for Skype users who add or play video in their chats.
603807
(InfoWorld) - A critical bug in the Internet Explorer (IE) browser also affects users of the Outlook 2003 e-mail client, making it much more serious than previously thought. The vulnerability can be triggered when IE or Outlook 2003 processes Web-based graphics code written in the Vector Markup Language (VML). It wasÂ first reported Monday by researchers at Sunbelt Software Inc. Attackers have not yet begun exploiting the e-mail attack, but aÂ handful of Web sitesÂ now serve the code, and hackers have publicly posted software that exploits the vulnerability. Initially, researchers thought that only Internet Explorer was vulnerable to attacks that exploited this flaw, but Sunbelt has now concluded that Outlook 2003 users are also at risk. That's because researchers have discovered a way to execute malicious code without using scripting code, which would normally be blocked by Outlook. By embedding a machine-language "shellcode" program in the VML tags, researchers have been able run unauthorized software on systems running the latest version of Outlook 2003. This has raised concerns because it means that some victims could have their PCs compromised with little or no user action. To attack Internet Explorer, criminals would first need to trick users into visiting a malicious Web site. But with an Outlook attack, it becomes much easier to target a victim. "All you have to do is send an HTML e-mail and the user is hosed," said Eric Sites, Sunbelt's vice president of research and development. Researchers at VeriSign Inc's iDefense unit have also confirmed that some configurations of Outlook will launch the code with no user action, said Ken Dunham, the director of the iDefense Rapid Response Team. Users who have Outlook's Reading Pane enabled to read messages in HTML are particularly vulnerable to this attack, Dunham said. Outlook Express users do not appear to be at risk, said Sites. Microsoft is advising users who want to protect themselves to set Outlook to read e-mail messages in plain text format. Instructions describing how to do this can beÂ found here. Microsoft's advisory on the VML issue can beÂ found here. Sunbelt has posted aÂ workaround for the vulnerability. According to one researcher, Outlook 2003 should not be rendering VML code automatically, but the product appears to be vulnerable due to a second bug in Microsoft's software. "Some versions of Outlook will render VML despite the fact that they shouldn't," said Russ Cooper, a senior information security analyst with Cybertrust Inc. "We should be raking Microsoft over the coals for this." Sites agreed that "there seems to be a bug in the latest version of Outlook." Microsoft executives were not immediately available to comment for this story. Microsoft plans to patch the VML problem as part of its next set of security patches, due Oct. 10, but Sites believes that hackers may force the software vendor to rush out an early fix. "I think it will get bad enough that they will have to," he said. Â
345464
php|architect has a new note about a few PHP vulnerabilities:
468166
Vuln researcher questions company's disclosure practices Yahoo! bug crushers have plugged a serious hole in Yahoo! Messenger that made it possible for bad guys to remotely take control of a user's machine. The update became available less than 24 hours after an anonymous hacker posted proof-of-concept code that demonstrated how the vulnerability could be exploited.â¦
598026
InfoWorld - Just one day after hackers showed how to exploit a number of flaws in the ActiveX software used by Internet Explorer, Symantec has spotted online criminals using one of the attacks.
349775
A new class at Vulnerability High Flaws in ActiveX controls are being increasingly used to run security exploits.â¦
756098
A recent string of high-profile ActiveX vulnerabilities caused the U.S. Computer Emergency Readiness Team (US-CERT) to advise users to disable the ubiquitous Microsoft browser plug-in technology altogether. The vectors for these recent exploits include a third-party image uploading tool used on both the Facebook and MySpace social networking sites, and flaws found in Yahoo's Music Jukebox, Real Networks' RealPlayer, and Apple's QuickTime.                                                    "We're seeing an increase in exploits aimed at these types of tools that are commonly used with a variety of technologies including social networking sites and multimedia players. As online crime becomes more prominent, malicious actors are taking advantage of these types of vulnerabilities to accomplish their objectives," said a spokesman at the U.S. Department of Homeland Security, which oversees the US-CERT.Security experts contend that there's no end in sight for attacks on the plug-in architecture.One reason is that there are plenty of security holes in ActiveX to be exploited. But another reason is not Microsoft's fault, they say: any technology used so widely will attract hacker attacks. "There's simply a lot of software out there using ActiveX that's either preloaded or embedded that users don't even realize is there, and that's why it was necessary to make the advisory," the US-CERT spokesman said.Although features added in Microsoft's newest Web browser, Internet Explorer 7, may help reduce the problem down the road and push attackers to move on to new targets, ActiveX will remain among the leading programs assaulted by opportunistic cyber-criminals, at least for the foreseeable future, several researchers say. After all, they say, Internet Explorer's status as the most used Web browser makes it an attractive target, just as the Windows operating system has been subject to constant attack for the past decade due to its huge market share. "When hackers spend time trying to find vulnerabilities to exploit, they want to make sure that they can affect the highest number of people," said Will Dormann, a vulnerability analyst at the Carnegie Mellon Software Engineering Institute CERT.A juicy target that's easier to exploit When you ask researchers which ActiveX exploits make them curl their toes in reaction, the answers don't tend to focus on specific sets of attacks but instead on the sheer volume and variety of the threats, and the vulnerabilities that allow for them.Some of the most prominent examples of ActiveX exploits include malware attacks aimed at Microsoft's Data Access Component (MDAC) software, which was pummeled for years by a broad range of attacks, and problems with the HTML Help ActiveX control module in Internet Explorer that opened it to numerous types of attacks, most notably the Phel Trojan virus.These well-known examples are just the tip of the iceberg for the vulnerabilities that ActiveX exposes users to. One reason is that as Microsoft fixes vulnerabilities in Windows, hackers are moving to easier targets, such as ActiveX, said Randy Abrams, director of technical education at ESET, a maker of anti-malware software. "Applications and plug-ins like ActiveX are the new low-hanging fruit so that's what's being attacked," he said.Abrams believes that ActiveX introduces unnecessary risk in many cases, because it is typically used for nonessential purposes. "The truth is that the ActiveX problem is also based on an irrational love of fashion; it's all about adding functionality to sites and applications to make them look cool, but in actuality it's completely unnecessary," he said. "If it wasn't for this need to make things look fashionable there would be much less risk." But Abrams doesn't expect developers to throttle back ActiveX use despite its security risks: "The cat is out of the bag, and sites now compete to look visually impressive and offer better functionality."Many developers of ActiveX-based applications do a poor job of ensuring security, notes Craig Schmugar, a threat researcher at McAfee's Avert Lab. And that threat grows as the number of ActiveX applications grows. "You can improve developer education, but hackers are likely to keep attacking the soft targets," he said.It's also become easier for hackers to find ActiveX's flaws, thanks to the broad availability of fuzzing tools. "The publicly available fuzz testing tools for ActiveX make it relatively simple to find new vulnerabilities and controls to go after, so people are able to research how exploitable certain applications may be before writing their attacks," said Carnegie Mellon's Dormann. "People are finding new holes all the time and posting them to public mailing lists," he added."One of the most telling things to look at with ActiveX is that security researchers delving into these problems don't get a lot of respect within the vulnerability research community itself," Schmugar noted. "That's mostly because with the sheer number of holes, and all the available fuzzing tools, people look at it like shooting fish in a barrel."IE7 improvements should help over time Microsoft is well aware that ActiveX is both a big target for hackers and one that they can successfully attack. So the company has re-architected its Internet Explorer Web browser in version 7 to limit the scope of well-known attacks methods. Researchers say that the work should eventually produce dividends.For example, the original implementation of ActiveX in IE6 and previous versions exposed binaries to any page visited by users. By contrast, IE7 provides far less access to sites and applications, preventing malware authors from activating code that would let them hack the browser.Microsoft has configured IE7's defaults so that only "safe" ActiveX controls (as determined by Microsoft) can be accessed, and it has enhanced separation of controls to prevent exploits from running roughshod across the entire Internet Explorer application as they often did in the past, researchers said. "IE7's protected mode definitely helps, even if the root cause in the form of ActiveX vulnerabilities is still present, and in the long run it will play a role in convincing attackers to move elsewhere, but with Vista and IE7 in relatively few hands this won't happen soon," said McAfee's Schmugar. Improvements made in the Windows Vista operating system should also help reduce the impact of traditional ActiveX attack techniques, he noted.However, most people use neither Vista nor IE7, so these improvements aren't widely deployed. The majority of users run IE6 on Windows XP, both of whose ActiveX components remain largely unchanged and thus at high risk.Dumping ActiveX is not the long-term solution Given that ActiveX is compatible only with Microsoft's Windows browsers, you might conclude the safest solution to the security threat is to use alternative technologies such as JavaScript.That strategy may work for a while, researchers said. But as alternative browser plug-in technologies gain adoption, they too will become more significant targets for attackers. Researchers cite the increasing attacks aimed at the Mozilla Firefox and Apple Safari browsers as they gained in popularity, as well as the likelihood of more Mac OS-based threats as that operating system continues to gain market share. And JavaScript is no stranger to attacks, either."The issue goes beyond ActiveX. Any plug-in architecture that has a lot of users will suffer from these same issues; anything where you have third party developers writing code that runs inside the browser," said Max Caceres, director of research and development at applications security firm Matasano Security. "As long as developers are building things without putting security at the top of their list of objectives, we'll have these problems, regardless of the plug-in architecture."
663936
bulk messages clogging instant-messaging accounts. AOL and its Anti-Spam Alliance partners -- EarthLink, Microsoft, and Yahoo
653917
A new variant of the Mydoom worm that exploits an unpatched flaw in Microsoft&#39;s Internet Explorer browser is in the wild and posing particular risk to home and small business users, security experts warn.
341717
Upgrade averts code catastrophe Yahoo! users are urged to upgrade their instant messaging software following the discovery of a brace of security vulnerabilities - the second set of serious security flaws involving Yahoo! Messenger in as many weeks.â¦
165927
Critical Opera and Firefox bugs menace IE-refuseniks There's bad news for users of alternative browsers this Friday, with both Opera and Firefox subject to security vulnerabilities.â¦
370540
A wave of bugs in the plug-in technology used by Microsoft's browser has some security experts recommending that users disable all ActiveX controls.
462043
Nasty ActiveExploit Security flaws in an ActiveX control used in MySpace upload images onto the social networking sites leave users open to attack. Facebook users may also be at risk.â¦
23096
Attackers are exploiting an ActiveX bug in Yahoo's Jukebox music player, Symantec says.
16648
Opt-out button in spam used to run exploit