gHacks technology news » vulnerability http://www.ghacks.net A technology blog covering software, mobile phones, gadgets, security, the Internet and other relevant areas. Tue, 10 Nov 2009 01:33:24 +0000 http://wordpress.org/?v=2.8.5 en hourly 1 Adobe Fixes Critical Shockwave Vulnerability http://www.ghacks.net/2009/06/25/adobe-fixes-critical-shockwave-vulnerability/ http://www.ghacks.net/2009/06/25/adobe-fixes-critical-shockwave-vulnerability/#comments Thu, 25 Jun 2009 06:51:09 +0000 Martin http://www.ghacks.net/?p=13844 adobe shockwaveAdobe has issues a security patch for their Adobe Shockwave software program that fixes on vulnerability that has been rated critical. The vulnerability gives attackers, who can attack systems remotely, control over affected computer systems. The interesting aspect of the issued patch is that Adobe recommends to completely uninstall Adobe Shockwave 11.5.0.596 or earlier on their computer systems before installing the latest version of the software product in which the security vulnerability has been fixed.

To secure a computer system running Adobe Shockwave a user would therefor have to uninstall Adobe Shockwave, perform a system restart and install the latest version of Shockwave after the reboot.

The Security Bulletin that has been published at the Adobe website gives little information about the vulnerability other than it can be remotely exploited and that it only affects the Microsoft Windows operating system. Users are encouraged to download the latest version of Adobe Shockwave on the program’s website.

It should also be noted that this vulnerability targets only Adobe Shockwave and not Adobe Flash. Thanks goes to Dante for sending me the information per email.

Tags: , , , , , ,

Related posts

]]> http://www.ghacks.net/2009/06/25/adobe-fixes-critical-shockwave-vulnerability/feed/ 12 New Attack: Combine Files With Jar Scripts http://www.ghacks.net/2008/08/01/new-attack-combine-files-with-jar-scripts/ http://www.ghacks.net/2008/08/01/new-attack-combine-files-with-jar-scripts/#comments Fri, 01 Aug 2008 16:22:34 +0000 Martin http://www.ghacks.net/?p=5782 A new attack, dubbed Gifar by their creators named after the two file types that they mixed to create the attack (Gif and Jar), was mentioned in a Black Hat Sneak Preview article over at ZDnet. While not everything was revealed in that preview article it mentioned that the developers were able to combine two file types like the previously mentioned gif and jar files so that the first, container file type, would be shown normally in the browser but that the Java applet would be executed at the same time.

Many file and image hosts filter dangerous file types. If you tried to upload a Jar file to most of them you would get an error message stating that the file type was not supported. Many however fail to analyze the file itself and simply reject files based on their extension which opens the door for this attack.

That’s a pretty dangerous exploit. Imagine someone who uses this to upload a new avatar to popular websites like Facebook or Myspace (two examples, I have not checked if the two use advanced upload filters). He could do all sorts of things with the Java Applet once users open up his profile page.

The only valid defense against this type of attack is to disable Java on the computer for the moment. Sun is already working on a fix although the researchers say that it is not Sun’s fault that this vulnerability exists.

Tags: , , , , , , ,

Related posts

]]> http://www.ghacks.net/2008/08/01/new-attack-combine-files-with-jar-scripts/feed/ 4 Are you running the latest browser version? http://www.ghacks.net/2008/07/04/are-you-running-the-latest-browser-version/ http://www.ghacks.net/2008/07/04/are-you-running-the-latest-browser-version/#comments Fri, 04 Jul 2008 15:00:22 +0000 Martin http://www.ghacks.net/?p=5211 In a recently released research paper Stefan Frei, Thomas Dübendorfer, Gunter Ollmann and Martin May analyzed Google Search Engine logs between January 2007 and June 2008 to understand the web browser threat. The research paper brought up some interesting figures including worldwide browser usage, number of users with the latest version of the browser and the share of the most secure browser version.

According to their research Internet Explorer is leading the field with a market share of 78.3% followed by Firefox with 16.1%, Safari with 3.4% and Opera with 0.8%. This means in daily numbers 1108 million Internet Explorer, 227 million Firefox, 48 million Safari and 11 million Opera browsers.

If you analyze that data to find out how many of the users are using the latest version of the browser the picture changes drastically and provides another explanation why Internet Explorer is still the number one target for malicious software.

Only 52.5% of all Internet Explorer users are running the latest browser version compared to 92.2% of all Firefox users, 90.1% of the Opera users and 70.2% of the Safari users. The numbers are assuming that the latest version of the browser is the most secure one.

This leads to my initial question. Are you running the latest browser version of the browser that you are using ?

Tags: , , , , ,

Related posts

]]> http://www.ghacks.net/2008/07/04/are-you-running-the-latest-browser-version/feed/ 4 You better stop using Internet Explorer for now http://www.ghacks.net/2008/06/27/you-better-stop-using-internet-explorer-for-now/ http://www.ghacks.net/2008/06/27/you-better-stop-using-internet-explorer-for-now/#comments Fri, 27 Jun 2008 08:02:27 +0000 Martin http://www.ghacks.net/?p=5126 A security vulnerability came to light recently that affects Internet Explorer 6, Internet Explorer 7 and even Internet Explorer 8 that can be used to record keystrokes of a user even if he is switching domains. That means that a specifically prepared website can launch some Javascript that records everything the user does afterwards including text input which naturally means usernames and passwords as well.

Sounds scary ? There is no fix for this vulnerability yet other than to disable Javascript or allow it only on trusted domains. Some researchers claim that other browsers are affected as well but have failed to deliver proof for those claims yet. It would not hurt however to use the Firefox add-on No Script for instance.

The vulnerability can be tested on this page if you visit it with Internet Explorer. It opens a new window and records the user input on that domain. There is an explanation from the same researcher available.

Tags: , , , , ,

Related posts

]]> http://www.ghacks.net/2008/06/27/you-better-stop-using-internet-explorer-for-now/feed/ 18 VLC Player Vulnerability http://www.ghacks.net/2008/03/19/vlc-player-vulnerability/ http://www.ghacks.net/2008/03/19/vlc-player-vulnerability/#comments Tue, 18 Mar 2008 23:22:13 +0000 Martin http://www.ghacks.net/2008/03/19/vlc-player-vulnerability/ Torrentfreak are reporting that two vulnerabilities have been discovered in VLC Player which allow execution of arbitrary code. The second vulnerability has already been fixed in the newest version of VLC which is available for download on the developers homepage. The first vulnerability however can be exploited to cause stack-based buffer overflows when loading subtitles in VLC.

The solution given by the security company that discovered the vulnerability is to load only subtitles from trusted source or no subtitles at all until an official fix has been posted by the developers ov VLC.

Another option would be to switch to another player for the time being. SMPlayer, my favorite player, is another good choice which does not have this vulnerability.

Tags: , , , ,

Related posts

]]> http://www.ghacks.net/2008/03/19/vlc-player-vulnerability/feed/ 2 Real Player Internet Explorer vulnerability http://www.ghacks.net/2008/03/13/real-player-internet-explorer-vulnerability/ http://www.ghacks.net/2008/03/13/real-player-internet-explorer-vulnerability/#comments Thu, 13 Mar 2008 12:32:17 +0000 Martin http://www.ghacks.net/2008/03/13/real-player-internet-explorer-vulnerability/ Internet Explorer with an installed version of Real Player beware. A vulnerability has been discovered recently which could allow remote code execution. According to Zdnet users should either switch browsers for the time until an patch is released or disabling killbits for two Active X classes. They forgot to mention the third option which would be to uninstall Real Player (temporarily).

Affected are all Real Player versions running under Internet Explorer. Microsoft has an article up that explains Killbits and what they do. They basically prevent Active X controls from being loaded in Internet Explorer. I still would recommend to either switch to Firefox or Opera temporarily or uninstall Real Player for the time until a security patch has been created.

Researcher Elazar Broad has posted to the Full Disclosure mailing list a so-called heap overflow vulnerability that makes it possible for an attacker to modify heap blocks after they are freed and overwrite certain registers.

The killbits that should be disabled are the following:

  • 2F542A2E-EDC9-4BF7-8CB1-87C9919F7F93
  • CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA

This will definitely have the effect that some Real Player functions will stop working properly.

Tags: , , , ,

Related posts

]]> http://www.ghacks.net/2008/03/13/real-player-internet-explorer-vulnerability/feed/ 2 DOS Vulnerability in uTorrent and Bittorrent http://www.ghacks.net/2008/01/17/dos-vulnerability-in-utorrent-and-bittorrent/ http://www.ghacks.net/2008/01/17/dos-vulnerability-in-utorrent-and-bittorrent/#comments Thu, 17 Jan 2008 20:16:16 +0000 Martin http://www.ghacks.net/2008/01/17/dos-vulnerability-in-utorrent-and-bittorrent/ A vulnerability in uTorrent and Bittorrent, which is using uTorrent’s core, was discovered today that effects the BitTorrent 6.0 client,
uTorrent 1.7.x, uTorrent 1.6.x and uTorrent 1.8-alpha-7834. The Denial of Service vulnerability is made possible by the way the clients handle user data.

Basically said, uTorrent will crash if a user connects to it that sends a software version that is to long to be handled. This results in a crash of uTorrent. The attacker does not need to use Bittorrent at all to do that, a connection to the port that is being used by Bittorrent sending the to-long software version and a valid torrent hash is enough.

Code execution on the other hand is not possible. The uTorrent team reacted in less than one day and published a new version of their software 1.7.6 that handles the DOS vulnerability and three minor issues as well.

While it is not very likely that someone will actually exploit the vulnerability it is still advised to update immediately.

via Torrentfreak

Tags: , ,

Related posts

]]> http://www.ghacks.net/2008/01/17/dos-vulnerability-in-utorrent-and-bittorrent/feed/ 1 Send Windows to Nirvana with an animated cursor http://www.ghacks.net/2007/03/31/send-windows-to-nirvana-with-an-animated-cursor/ http://www.ghacks.net/2007/03/31/send-windows-to-nirvana-with-an-animated-cursor/#comments Sat, 31 Mar 2007 07:23:34 +0000 Martin http://www.ghacks.net/2007/03/31/send-windows-to-nirvana-with-an-animated-cursor/ One of the many disadvantages of every new Windows edition is the fact that the operating system becomes more and more bloated. Microsoft adds new features to Windows which could then be used to exploit the system. Instead of concentrating on fast efficient systems they produce heavy systems that look shiny but have problems under the surface. Recently a vulnerability in Windows Animated Cursor Handling was discovered. In order for this attack to be carried out, a user must either visit a Web site that contains a Web page that is used to exploit the vulnerability or view a specially crafted e-mail message or email attachment sent to them by an attacker.

You might be interested in which Windows editions are effected and which are not. It would also be nice to know if your browsers and e-mail clients are vulnerable and can be used to exploit the system. Vulnerable are Windows Vista, Windows XP SP2 and Windows 2000 SP4. Several other Microsoft operating systems are affected as well like Windows Server 2003 but I think the first three cover most Windows editions that my readers use. Exploitation happens completely silently.

Take a look at the demonstration video below. It shows how Windows Vista enters a endless Crash-Restart loop caused by a malicious ani file which was dropped on the desktop. Attacks will most likely occur over the Internet.

A security company has released a temporary fix for the solution until an official Microsoft patch gets released.

Tags: , , , , , , ,

Related posts

]]> http://www.ghacks.net/2007/03/31/send-windows-to-nirvana-with-an-animated-cursor/feed/ 1 SQL Injection Attacks by Example http://www.ghacks.net/2006/06/06/sql-injection-attacks-by-example/ http://www.ghacks.net/2006/06/06/sql-injection-attacks-by-example/#comments Tue, 06 Jun 2006 14:17:25 +0000 Martin http://www.ghacks.net/2006/06/06/sql-injection-attacks-by-example/ SQL injection is a security vulnerability that occurs in the database layer of an application. Its source is the incorrect escaping of dynamically-generated string literals embedded in SQL statements. It is in fact an instance of a more general class of vulnerabilities that can occur whenever one programming or scripting language is embedded inside another.

SQL Injection Attacks by Example gives you a detailed view how experts used the technique to break into a customers system.

“There have been other papers on SQL injection, including some that are much more detailed, but this one shows the rationale of discovery as much as the process of exploitation.”

Tags: , , ,

Related posts

]]> http://www.ghacks.net/2006/06/06/sql-injection-attacks-by-example/feed/ 0