Different Way To Tamper Windows Kernel

"Security researchers have discovered one of the most subtle and sophisticated examples of Windows rootkit software known to date," writes The Register.

Worm.Win32.AutoRun.nox, as F-Secure calls it, extends the standard virus writer trick of using software vulnerabilities to infect systems, by including functionality that allows the worm to exploit Windows security bugs to hook into parts of the Windows system that operate below the radar of anti-virus packages.

"Most malware with rootkit functionality will tamper with the Windows kernel and attempt to execute code in kernel mode. Typically, a special driver is used to do this, " writes F-Secure. "AutoRun.nox is different — it uses "GDI Local Elevation of Privilege Vulnerability (CVE-2006-5758)" to do the job. For malware, its rather unique to see such a technique being used." Microsoft patched the vulnerability in April 2007 update (MS07-017).

More detailed description of AutoRun.GM can be read from F-Secure Blog.

Firefox 3.0.3 released

Firefox 3.0.3 contains the following change:

* Fixed a problem where users were unable to retrieve saved passwords or save new passwords (bug 454708)

Thunderbird 2.0.0.17 Released

Mozilla has released updated version of Thunderbird email client. New version contains patches for two critical and five moderate vulnerabilities.

Critical:
MFSA 2008-46 Heap overflow when canceling newsgroup message
MFSA 2008-37 UTF-8 URL stack buffer overflow

Moderate:
MFSA 2008-44 resource: traversal vulnerabilities
MFSA 2008-43 BOM characters stripped from JavaScript before execution
MFSA 2008-42 Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17)
MFSA 2008-41 Privilege escalation via XPCnativeWrapper pollution
MFSA 2008-38 nsXMLDocument::OnChannelRedirect() same-origin violation


Thunderbird 2.0.0.17 Release Notes

Mozilla Releases Updates

Mozilla has released a new version of Firefox web browser. Version 3.0.2 fixes bunch of issues including following five vulnerabilities:
-MFSA 2008-44 resource: traversal vulnerabilities
-MFSA 2008-43 BOM characters stripped from JavaScript before execution
-MFSA 2008-42 Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17)
-MFSA 2008-41 Privilege escalation via XPCnativeWrapper pollution
-MFSA 2008-40 Forced mouse drag

Of these -42 and -41 are categorized as critical, -44 and -43 are moderate and -40 low.

Version 2.0.0.17 fixes above mentioned and couple of other security issues for Firefox 2 series users.

Mozilla released also updated version of SeaMonkey (1.1.12). Part of listed five security issues affects Thunderbird too. 2.0.0.17 version should fix these but it's not yet available for downloading at the moment of writing this.


More information on the updates:
Firefox 3.0.2 Release Notes
Firefox 2.0.0.17 Release Notes
SeaMonkey 1.1.12 Release Notes

McAfee Makes A $465 Million Offer Of Secure Computing

Security company McAfee announced on Monday (22-09-08) that it has placed a deal to acquire security company Secure Computing. Deal is worth around US$465 million.

With Secure Computing, McAfee expects to be able to deliver the complete content and data lifecycle management at the network, spanning detection, filtering, encryption, blocking, archiving, reporting and compliance. Also, McAfee hopes to expand its security as a service offering and to sell more products and services to Secure Computing's 22,000 customers worldwide.

The deal is expected to close toward the end of the fourth quarter, McAfee said.

McAfee's press release

VMware Fixes Vulnerabilities

VMware has fixed critical security vulnerabilities in two of its virtualization products, ESXi and ESX 3.5. The patches fix two buffer overflow bugs that reside in a component known as openwsman. It provides web services management functionality and is enabled by default. The vulnerabilities could be exploited by people without login credentials to the system. However, to exploit the vulnerabilities the attacker has to have access to the service console network. Security best practices provided by VMware recommend that the service console be isolated from the VM network.

More information can be read from the correspondent VMware security advisory.

Hackers Attempt To Spread Malware On BusinessWeek Website

Hackers have broken into BusinessWeek's online site and set up an attack scenario in which visitors to a section of the site could have their own computers compromised and their data stolen, tells Graham Cluley from security company Sophos in his Blog.

The hackers used an increasingly common form of attack called SQL injection, in which a small malicious script is inserted into a database that feeds information to the BusinessWeek website. Injected code was pointing to a website behind a Russian domain, which could download malware onto the computers of BusinessWeek.com readers.

At the moment the Russian website is offline. Cluley points out that it’s status could potentially change at any time though.

The amount of SQL injections has increased a lot this year. "As we reported in our recent Security Threat Report, over 16,000 new infected webpages are discovered every single day. That’s one every five seconds - three times faster than the rate we saw during 2007", says Cluley.


Video containing more information on the matter can be seen on Graham Cluley's Blog.