Adobe has released a new version of their Flash Player. Version 10.1.53.64 fixes many critical vulnerabilities in Flash Player version 10.0.45.2 and earlier. Users of Adobe AIR 1.5.3.9130 and earlier versions are also affected and they are recommended to update to Adobe AIR version 2.0.2.12610.
More information about vulnerabilities and instructions for updating can be read from the correspondent security bulletin.
Saturday, June 12, 2010
Thursday, June 10, 2010
Fixed Version of Google Chrome Available
Google has released a new version of their Chrome web browser. The new version contains fixes to 11 vulnerabilities of which nine are categorized as high and two as medium. One of the high critical vulnerabilities, [43304] High Linux sandbox escape, affects only Linux versions. Details about the vulnerabilities hasn't been made public yet.
More information can be read from Google Chrome Releases blog.
More information can be read from Google Chrome Releases blog.
Tuesday, June 8, 2010
Microsoft Security Updates For June 2010
Microsoft has released security updates for June 2010. This month update consists of ten updates. Three are categorized as critical and seven as important:
Critical:
MS10-033: Vulnerabilities in Media Decompression Could Allow Remote Code Execution (979902)
MS10-034: Cumulative Security Update of ActiveX Kill Bits (980195)
MS10-035: Cumulative Security Update for Internet Explorer (982381)
Important:
MS10-032: Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (979559)
MS10-036: Vulnerability in COM Validation in Microsoft Office Could Allow Remote Code Execution (983235)
MS10-037: Vulnerability in the OpenType Compact Font Format (CFF) Driver Could Allow Elevation of Privilege (980218)
MS10-038: Vulnerabilities in Microsoft Office Excel Could Allow Remote Code Execution (2027452)
MS10-039: Vulnerabilities in Microsoft SharePoint Could Allow Elevation of Privilege (2028554)
MS10-040: Vulnerability in Internet Information Services Could Allow Remote Code Execution (982666)
MS10-041: Vulnerability in Microsoft .NET Framework Could Allow Tampering (981343)
A new version of Windows Malicious Software Removal Tool (MSRT) was released too.
More information can be read from the bulletin summary.
For consumer the easist way to get the update is to use Microsoft Update service.
Critical:
MS10-033: Vulnerabilities in Media Decompression Could Allow Remote Code Execution (979902)
MS10-034: Cumulative Security Update of ActiveX Kill Bits (980195)
MS10-035: Cumulative Security Update for Internet Explorer (982381)
Important:
MS10-032: Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (979559)
MS10-036: Vulnerability in COM Validation in Microsoft Office Could Allow Remote Code Execution (983235)
MS10-037: Vulnerability in the OpenType Compact Font Format (CFF) Driver Could Allow Elevation of Privilege (980218)
MS10-038: Vulnerabilities in Microsoft Office Excel Could Allow Remote Code Execution (2027452)
MS10-039: Vulnerabilities in Microsoft SharePoint Could Allow Elevation of Privilege (2028554)
MS10-040: Vulnerability in Internet Information Services Could Allow Remote Code Execution (982666)
MS10-041: Vulnerability in Microsoft .NET Framework Could Allow Tampering (981343)
A new version of Windows Malicious Software Removal Tool (MSRT) was released too.
More information can be read from the bulletin summary.
For consumer the easist way to get the update is to use Microsoft Update service.
Apple Fixes Safari Vulnerabilities
Apple has released new versions of their Safari web browsers. The new versions contain fixes to 48 different vulnerabilities. Some of these may allow an attacker to execute arbitrary code in affected system.
Affected are Safari versions earlier than 5.0 or 4.1. Users of vulnerable Safari versions can get the latest version here.
More information of security content of 5.0 and 4.1 versions can be read here.
Affected are Safari versions earlier than 5.0 or 4.1. Users of vulnerable Safari versions can get the latest version here.
More information of security content of 5.0 and 4.1 versions can be read here.
Sunday, June 6, 2010
OpenOffice 3.2.1 Available
OpenOffice.org has released a new version of OpenOffice. The fresh version contains fixes for two vulnerabilities:
-CVE-2009-3555: OpenOffice.org 2 and 3 may be affected by the TLS/SSL Renegotiation Issue in 3rd Party Libraries
-CVE-2010-0395: Security vulnerability in OpenOffice.org related to python scripting
More information about OpenOffice security fixes can be found here and about other changes can be read from Release Notes. OpenOffice 3.2.1 can be downloaded here.
-CVE-2009-3555: OpenOffice.org 2 and 3 may be affected by the TLS/SSL Renegotiation Issue in 3rd Party Libraries
-CVE-2010-0395: Security vulnerability in OpenOffice.org related to python scripting
More information about OpenOffice security fixes can be found here and about other changes can be read from Release Notes. OpenOffice 3.2.1 can be downloaded here.
Saturday, June 5, 2010
Vulnerability In Adobe Acrobat, Reader And Flash Player
There has been found a critical vulnerability in Adobe Acrobat, Reader and Flash Player. By exploiting the vulnerability an attacker may be able cause a system crash or execute arbitrary code in target system.
The vulnerability is related to a way the authplay.dll library (used for handling SWF content) of the affected software handles SWF content. The vulnerability can be exploited by luring affected software user to access specially crafted web site or to open crafted PDF file. Adobe says that the vulnerability is currently exploited in the wild.
Affected software are:
- Adobe Flash Player 10.0.45.2, 9.0.262 and earlier 10.0.x & 9.0.x series versions
- Adobe Reader and Acrobat 9.3.2 and earlier 9.x series versions
At the moment, there is no patch against the vulnerability available but Flash Player users can mitigate the problem by installing The Flash Player 10.1 Release Candidate available at http://labs.adobe.com/technologies/flashplayer10/.
In Adobe Reader and Acrobat cases deleting, renaming, or removing access to the authplay.dll file that ships with Adobe Reader and Acrobat 9.x mitigates the threat for those products, but users will experience a non-exploitable crash or error message when opening a PDF file that contains SWF content. The authplay.dll that ships with Adobe Reader and Acrobat 9.x for Windows is typically located at C:\Program Files\Adobe\Reader 9.0\Reader\authplay.dll for Adobe Reader or C:\Program Files\Adobe\Acrobat 9.0\Acrobat\authplay.dll for Acrobat.
The vulnerability is related to a way the authplay.dll library (used for handling SWF content) of the affected software handles SWF content. The vulnerability can be exploited by luring affected software user to access specially crafted web site or to open crafted PDF file. Adobe says that the vulnerability is currently exploited in the wild.
Affected software are:
- Adobe Flash Player 10.0.45.2, 9.0.262 and earlier 10.0.x & 9.0.x series versions
- Adobe Reader and Acrobat 9.3.2 and earlier 9.x series versions
At the moment, there is no patch against the vulnerability available but Flash Player users can mitigate the problem by installing The Flash Player 10.1 Release Candidate available at http://labs.adobe.com/technologies/flashplayer10/.
In Adobe Reader and Acrobat cases deleting, renaming, or removing access to the authplay.dll file that ships with Adobe Reader and Acrobat 9.x mitigates the threat for those products, but users will experience a non-exploitable crash or error message when opening a PDF file that contains SWF content. The authplay.dll that ships with Adobe Reader and Acrobat 9.x for Windows is typically located at C:\Program Files\Adobe\Reader 9.0\Reader\authplay.dll for Adobe Reader or C:\Program Files\Adobe\Acrobat 9.0\Acrobat\authplay.dll for Acrobat.
Wednesday, June 2, 2010
“Tequila Botnet” Targets Mexican Users
Senior Threat Researcher Ranieri Romera writes in Trend Micro blog about botnet that is targeting Mexican users, particularly PayPal's local site and Bancomer that is the biggest bank in Mexico. Client program of Tequila botnet can arrive to user's computer via different ways.
First, it takes advantage of the news about missing four-year-old girl, Paulette Gebara Farah. Users who are following the said news may fall prey to this attack by visiting the page http://www.knijo.{BLOCKED}0.net/fotografias-al-desnudo-de-la-mama-de-paulette.htm which contains an article about Paulette and claims to show nude photos of her mother. When user arrives at the page one is shown fake dialog trying to make user install "Adobe Flash Player". If user clicks "run" one is led to the download of the file video-de-la-mama-de-paulette.exe that is actually client of a bot detected as TSPY_MEXBANK.A by Trend Micro. Among spreading via malicious webpages the Tequila botnet may spread itself via USB devices and via MSN Messenger as well. It sends messages that either contain the file itself (as an attachment of sorts) or links that go to copies of the malware.
The whole blog post with more detailed description of Tequila botnet can be read here.
First, it takes advantage of the news about missing four-year-old girl, Paulette Gebara Farah. Users who are following the said news may fall prey to this attack by visiting the page http://www.knijo.{BLOCKED}0.net/fotografias-al-desnudo-de-la-mama-de-paulette.htm which contains an article about Paulette and claims to show nude photos of her mother. When user arrives at the page one is shown fake dialog trying to make user install "Adobe Flash Player". If user clicks "run" one is led to the download of the file video-de-la-mama-de-paulette.exe that is actually client of a bot detected as TSPY_MEXBANK.A by Trend Micro. Among spreading via malicious webpages the Tequila botnet may spread itself via USB devices and via MSN Messenger as well. It sends messages that either contain the file itself (as an attachment of sorts) or links that go to copies of the malware.
The whole blog post with more detailed description of Tequila botnet can be read here.
Subscribe to:
Posts (Atom)
