Core CTO: Highly Exploitable AIM Bug Could Lead to System Hijack
678926
In an interview this morning from Buenos Aires with BetaNews, Core Security Chief Technology Officer IvÃÂ¡n Arce described a scenario whereby a malicious user could be able to trigger AOL's Instant Messenger into launching Microsoft's Internet Explorer 7 Web browser, and then send it commands that enable that user to wrest full remote control of the AIM user's system.
763575
Ilia Alshanetsky posts today about the proposed "Month of PHP bugs" that Stefan Esser is proposing:   It would be interesting to see what issues he discovers, hopefully most of them have already been reported to the PHP Security Team, in which case the upcoming 5.2.1 release will provide a resolution path for affected users.   Hopefully, as Ilia states, the bugs will not turn out to be zero-day vulnerabilities and will instead be smaller issues. Either way, a bug-fix patch will probably soon follow.   Either way, I have to look at this as a free security audit of PHP by someone with a clue about security and ultimately, in the long run it will only make PHP better, even if March is going to be rather busy.
479970
Blog: Researcher finds a basic cookie handling error that could compromise Windows PCs.
756098
A recent string of high-profile ActiveX vulnerabilities caused the U.S. Computer Emergency Readiness Team (US-CERT) to advise users to disable the ubiquitous Microsoft browser plug-in technology altogether. The vectors for these recent exploits include a third-party image uploading tool used on both the Facebook and MySpace social networking sites, and flaws found in Yahoo's Music Jukebox, Real Networks' RealPlayer, and Apple's QuickTime.                                                    "We're seeing an increase in exploits aimed at these types of tools that are commonly used with a variety of technologies including social networking sites and multimedia players. As online crime becomes more prominent, malicious actors are taking advantage of these types of vulnerabilities to accomplish their objectives," said a spokesman at the U.S. Department of Homeland Security, which oversees the US-CERT.Security experts contend that there's no end in sight for attacks on the plug-in architecture.One reason is that there are plenty of security holes in ActiveX to be exploited. But another reason is not Microsoft's fault, they say: any technology used so widely will attract hacker attacks. "There's simply a lot of software out there using ActiveX that's either preloaded or embedded that users don't even realize is there, and that's why it was necessary to make the advisory," the US-CERT spokesman said.Although features added in Microsoft's newest Web browser, Internet Explorer 7, may help reduce the problem down the road and push attackers to move on to new targets, ActiveX will remain among the leading programs assaulted by opportunistic cyber-criminals, at least for the foreseeable future, several researchers say. After all, they say, Internet Explorer's status as the most used Web browser makes it an attractive target, just as the Windows operating system has been subject to constant attack for the past decade due to its huge market share. "When hackers spend time trying to find vulnerabilities to exploit, they want to make sure that they can affect the highest number of people," said Will Dormann, a vulnerability analyst at the Carnegie Mellon Software Engineering Institute CERT.A juicy target that's easier to exploit When you ask researchers which ActiveX exploits make them curl their toes in reaction, the answers don't tend to focus on specific sets of attacks but instead on the sheer volume and variety of the threats, and the vulnerabilities that allow for them.Some of the most prominent examples of ActiveX exploits include malware attacks aimed at Microsoft's Data Access Component (MDAC) software, which was pummeled for years by a broad range of attacks, and problems with the HTML Help ActiveX control module in Internet Explorer that opened it to numerous types of attacks, most notably the Phel Trojan virus.These well-known examples are just the tip of the iceberg for the vulnerabilities that ActiveX exposes users to. One reason is that as Microsoft fixes vulnerabilities in Windows, hackers are moving to easier targets, such as ActiveX, said Randy Abrams, director of technical education at ESET, a maker of anti-malware software. "Applications and plug-ins like ActiveX are the new low-hanging fruit so that's what's being attacked," he said.Abrams believes that ActiveX introduces unnecessary risk in many cases, because it is typically used for nonessential purposes. "The truth is that the ActiveX problem is also based on an irrational love of fashion; it's all about adding functionality to sites and applications to make them look cool, but in actuality it's completely unnecessary," he said. "If it wasn't for this need to make things look fashionable there would be much less risk." But Abrams doesn't expect developers to throttle back ActiveX use despite its security risks: "The cat is out of the bag, and sites now compete to look visually impressive and offer better functionality."Many developers of ActiveX-based applications do a poor job of ensuring security, notes Craig Schmugar, a threat researcher at McAfee's Avert Lab. And that threat grows as the number of ActiveX applications grows. "You can improve developer education, but hackers are likely to keep attacking the soft targets," he said.It's also become easier for hackers to find ActiveX's flaws, thanks to the broad availability of fuzzing tools. "The publicly available fuzz testing tools for ActiveX make it relatively simple to find new vulnerabilities and controls to go after, so people are able to research how exploitable certain applications may be before writing their attacks," said Carnegie Mellon's Dormann. "People are finding new holes all the time and posting them to public mailing lists," he added."One of the most telling things to look at with ActiveX is that security researchers delving into these problems don't get a lot of respect within the vulnerability research community itself," Schmugar noted. "That's mostly because with the sheer number of holes, and all the available fuzzing tools, people look at it like shooting fish in a barrel."IE7 improvements should help over time Microsoft is well aware that ActiveX is both a big target for hackers and one that they can successfully attack. So the company has re-architected its Internet Explorer Web browser in version 7 to limit the scope of well-known attacks methods. Researchers say that the work should eventually produce dividends.For example, the original implementation of ActiveX in IE6 and previous versions exposed binaries to any page visited by users. By contrast, IE7 provides far less access to sites and applications, preventing malware authors from activating code that would let them hack the browser.Microsoft has configured IE7's defaults so that only "safe" ActiveX controls (as determined by Microsoft) can be accessed, and it has enhanced separation of controls to prevent exploits from running roughshod across the entire Internet Explorer application as they often did in the past, researchers said. "IE7's protected mode definitely helps, even if the root cause in the form of ActiveX vulnerabilities is still present, and in the long run it will play a role in convincing attackers to move elsewhere, but with Vista and IE7 in relatively few hands this won't happen soon," said McAfee's Schmugar. Improvements made in the Windows Vista operating system should also help reduce the impact of traditional ActiveX attack techniques, he noted.However, most people use neither Vista nor IE7, so these improvements aren't widely deployed. The majority of users run IE6 on Windows XP, both of whose ActiveX components remain largely unchanged and thus at high risk.Dumping ActiveX is not the long-term solution Given that ActiveX is compatible only with Microsoft's Windows browsers, you might conclude the safest solution to the security threat is to use alternative technologies such as JavaScript.That strategy may work for a while, researchers said. But as alternative browser plug-in technologies gain adoption, they too will become more significant targets for attackers. Researchers cite the increasing attacks aimed at the Mozilla Firefox and Apple Safari browsers as they gained in popularity, as well as the likelihood of more Mac OS-based threats as that operating system continues to gain market share. And JavaScript is no stranger to attacks, either."The issue goes beyond ActiveX. Any plug-in architecture that has a lot of users will suffer from these same issues; anything where you have third party developers writing code that runs inside the browser," said Max Caceres, director of research and development at applications security firm Matasano Security. "As long as developers are building things without putting security at the top of their list of objectives, we'll have these problems, regardless of the plug-in architecture."
705228
Microsoft believes that any hacker looking to exploit this issue would have to rely on considerable help from users. The company said an attacker would need to first entice the user to visit a specific Web site and then entice them to drag ...
111115
Blog: The most serious vulnerabilities allow attackers to run code on compromised machines.
116542
(InfoWorld) - For the second week in a row, independent security researchers have fixed a hole in Microsoft Corp.'s software. On Friday, Determina Inc.Â published a free patch for a critical bug in an ActiveX control (called WebViewFolderIcon) that is used by Windows' graphical user interface. Security experts consider the flaw to be critical because it could be exploited by attackers to run unauthorized code on a victim's PC. To make this happen, the victim would have to visit a Web site with Internet Explorer (IE) and allow it to run a malicious ActiveX control. Security researcher HD MooreÂ published details of the bug on July 18, but he recently added attack code that exploited the flaw to his widely-used Metasploit hacking toolkit. Determina says that the availability of the Metasploit code has boosted the risk of attacks. There seems to be no shortage of Windows attacks this week. On Tuesday, MicrosoftÂ issued a rare emergency patch for a separate problem in Outlook and IE's Vector Markup Language (VML) rendering engine, after that flaw was widely exploited by attackers. And criminals have also launched extremely limited attacks that exploit an unpatched flaw in PowerPoint. The VML flaw had first been fixed four days ahead of Microsoft's patch by a group of security researchers calling themselves the Zeroday Emergency Response Team. This latest bug is not likely to be as widely exploited as the VML vulnerability, Moore said. "This bug is not as severe as the VML flaw, since it depends on ActiveX, and would not be exploitable by default through Outlook," he said in an e-mail. Nevertheless, Microsoft found the issue to be serious enough to meritÂ a security advisory, published Thursday. Microsoft plans to patch the WebViewFolderIcon flaw in its next scheduled set of security updates, due Oct. 10. So far, Microsoft doesn't know of "any attacks attempting to use the reported vulnerability or of customer impact at this time," the security advisory states. Microsoft does not recommend that users install third-party patches, because this software has not gone through the rigorous quality assurance testing process that Microsoft applies to its security updates. Determina's patch works on Windows 2000, XP and 2003 systems. Â
191229
A bug in Microsoft&#39;s Internet Security and Acceleration (ISA) Server 2000 and Proxy Server 2 can let hackers spoof Web content, such as a trusted site, with their own fake content, the Redmond
211581
The seriousness of an already critical flaw in the way a Microsoft component processes JPEG files got ratcheted up a notch this week as exploit code began circulating.
703212
Security researchers have found a nasty vulnerability in AOL's ICQ Pro 2003b software. AOL is recommendng that users update their software.
448507
An independent researcher finds an Internet Explorer vulnerability that could turn drag-and-drop into drag-and-infect.
281798
Before the sun set on Microsoft&#39;s Patch Tuesday this month, security firm Secunia discovered a vulnerability in Firefox that malicious hackers could exploit to compromise a user&#39;s system. Here&#39;s the catch: Exploiting the bug depends on interaction between Mozilla&#39;s browser and Microsoft&#39;s Internet Explorer.
161042
A programming error in Skype could let hackers use "Add Video" feature to run malicious code on the victim's system.
745683
How a simple bug betrays Microsoft's disdain for basic best practice principles
53629
Clicking the fraudulent update could install malicious code on your desktop.
676591
Ziff Davis - Holes in KOffice and RealPlayer allow attackers to take over a user's system.
31716
Security researchers find a "highly critical" security flaw in Oracle's JInitiator ActiveX control.