Adobe, Apple Release Urgent Security Updates

It was Patch Tuesday for the second time this month — except this week it’s Adobe and Apple, not Microsoft, products that have urgent security updates.

Adobe yesterday released updates for its Acrobat and Reader applications and Flash Player browser plug-in to patch a dangerous vulnerability reported last week.

Bad guys had already been using the hole to attack PC users via Excel files infected with bad Flash objects.
The vulnerability affects all major PC operating systems (Windows, Mac and Linux), plus a minor one (Oracle’s Solaris) and Android OS smartphones, as well as all browsers.

Google’s Chrome got a jump on the Flash Player patch a few days earlier, thanks to a tight relationship with Adobe. Users running Chrome will still have to patch other browsers and the stand-alone Reader and Acrobat applications.

As has been the case for years, Internet Explorer requires a separate Flash Player plug-in from the other browsers.

Apple iOS devices will not need a patch; Steve Jobs’ ban on Flash for the iPhone and iPad seems to extend to Acrobat and Reader as well. (iOS reads PDF files natively.)

All patches are available from Adobe’s website here.

Slightly less urgent, but no less comprehensive, is Apple’s latest and possibly final major update to its Snow Leopard version of OS X.

This one bumps the version number up to 10.6.7 and patches 40 vulnerabilities in Apple and open-source apps and services, many related to the handling of image files.

Sophos’s Naked Security blog notes that the update also boosts Apple’s Safari browser to 5.0.4, which patches another 60 or so security holes.

Similar security upgrades are also available for OS X 10.5 Leopard, the last version of OS X to run on PowerPC-based Macs.

Apple’s OS X 10.7 Lion is scheduled to come out this summer.

Apple’s Software Update should automatically download the updates and prompt users to install them. If not, the updates can be found here.

[SecurityNewsDaily]

Mac OS X 10.6.7 fixes security vulnerabilities

 Apple today released Mac OS X 10.6.7 which increases the stability, compatibility, and security of your Mac.



AirPort
A divide by zero issue existed in the handling of Wi-Fi frames. When connected to Wi-Fi, an attacker on the same network may be able to cause a system reset. This issue does not affect systems prior to Mac OS X v10.6.

Apache
Apache is updated to version 2.2.17 to address several vulnerabilities, the most serious of which may lead to a denial of service.

AppleScript
A format string issue existed in AppleScript Studio's generic dialog commands ("display dialog" and "display alert"). Running an AppleScript Studio-based application that allows untrusted input to be passed to a dialog may lead to an unexpected application termination or arbitrary code execution.

ATS
A heap buffer overflow issue existed in the handling of OpenType, TrueType and Type 1 fonts. Viewing or downloading a document containing a maliciously crafted embedded font may lead to arbitrary code execution.

Multiple buffer overflow issues existed in the handling of SFNT tables. Viewing or downloading a document containing a maliciously crafted embedded font may lead to arbitrary code execution.

bzip2
An integer overflow issue existed in bzip2's handling of bzip2 compressed files. Using the command line bzip2 or bunzip2 tool to decompress a bzip2 file may result in an unexpected application termination or arbitrary code execution.

CarbonCore
When used with the kTemporaryFolderType flag, the FSFindFolder() API returns a directory that is world readable. This issue is addressed by returning a directory that is only readable by the user that the process is running as.

ClamAV
Multiple vulnerabilities exist in ClamAV, the most serious of which may lead to arbitrary code execution. This update addresses the issues by updating ClamAV to version 0.96.5. ClamAV is distributed only with Mac OS X Server systems.

CoreText
A memory corruption issue existed in CoreText's handling of font files. Viewing or downloading a document containing a maliciously crafted embedded font may lead to arbitrary code execution.

File Quarantine
The OSX.OpinionSpy definition has been added to the malware check within File Quarantine.

HFS
An integer overflow issue existed in the handling of the F_READBOOTSTRAP ioctl. A local user may be able to read arbitrary files from an HFS, HFS+, or HFS+J filesystem.

ImageIO
A heap buffer overflow issue existed in ImageIO's handling of JPEG and XBM images. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution.

A buffer overflow existed in libTIFF's handling of JPEG encoded TIFF images and CCITT Group 4 encoded TIFF images. Viewing a maliciously crafted TIFF image may result in an unexpected application termination or arbitrary code execution.

An integer overflow issue existed in ImageIO's handling of JPEG-encoded TIFF images. Viewing a maliciously crafted TIFF image may result in an unexpected application termination or arbitrary code execution. This issue does not affect systems prior to Mac OS X v10.6.

Image RAW
Multiple buffer overflow issues existed in Image RAW's handling of Canon RAW images. Viewing a maliciously crafted Canon RAW image may result in an unexpected application termination or arbitrary code execution.

Installer
A URL processing issue in Install Helper may lead to the installation of an agent that contacts an arbitrary server when the user logs in. The dialog resulting from a connection failure may lead the user to believe that the connection was attempted with Apple. This issue is addressed by removing Install Helper.

Kerberos
Multiple cryptographic issues existed in MIT Kerberos 5. Only CVE-2010-1323 affects Mac OS X v10.5.

Kernel
A privilege checking issue existed in the i386_set_ldt system call's handling of call gates. A local user may be able to execute arbitrary code with system privileges. This issue is addressed by disallowing creation of call gate entries via i386_set_ldt().

Libinfo
An integer truncation issue existed in Libinfo's handling of NFS RPC packets. A remote attacker may be able to cause NFS RPC services such as lockd, statd, mountd, and portmap to become unresponsive.

libxml
A memory corruption issue existed in libxml's XPath handling. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution.

A double free issue existed in libxml's handling of XPath expressions. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. This issue does not affect systems prior to Mac OS X v10.6.

Mailman
Multiple cross-site scripting issues existed in Mailman 2.1.13. These issues are addressed by updating Mailman to version 2.1.14.

PHP
PHP is updated to version 5.3.4 to address multiple vulnerabilities, the most serious of which may lead to arbitrary code execution.

PHP is updated to version 5.2.15 to address multiple vulnerabilities, the most serious of which may lead to arbitary code execution.

QuickLook
A memory corruption issue existed in QuickLook's handling of Excel files. Downloading a maliciously crafted Excel file may lead to an unexpected application termination or arbitrary code execution. This issue does not affect systems prior to Mac OS X v10.6.

A memory corruption issue existed in QuickLook's handling of Microsoft Office files. Downloading a maliciously crafted Microsoft Office file may lead to an unexpected application termination or arbitrary code execution.

QuickTime
Multiple memory corruption issues existed in QuickTime's handling of JPEG2000 images. Viewing a maliciously crafted JPEG2000 image with QuickTime may lead to an unexpected application termination or arbitrary code execution.

An integer overflow existed in QuickTime's handling of movie files. Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution. For Mac OS X v10.5 this issue was addressed in QuickTime 7.6.9.

A memory corruption issue existed in QuickTime's handling of FlashPix images. Viewing a maliciously crafted FlashPix image may lead to an unexpected application termination or arbitrary code execution. For Mac OS X v10.5 this issue was addressed in QuickTime 7.6.9.

A cross-origin issue existed in QuickTime plug-in's handling of cross-site redirects. Visiting a maliciously crafted website may lead to the disclosure of video data from another site. This issue is addressed by preventing QuickTime from following cross-site redirects.

A memory corruption issue existed in QuickTime's handling of panorama atoms in QTVR (QuickTime Virtual Reality) movie files. Viewing a maliciously crafted QTVR movie file may lead to an unexpected application termination or arbitrary code execution. For Mac OS X v10.5 this issue was addressed in QuickTime 7.6.9.

Ruby
An integer truncation issue existed in Ruby's BigDecimal class. Running a Ruby script that uses untrusted input to create a BigDecimal object may lead to an unexpected application termination or arbitrary code execution. This issue only affects 64-bit Ruby processes.

Samba
A stack buffer overflow existed in Samba's handling of Windows Security IDs. If SMB file sharing is enabled, a remote attacker may cause a denial of service or arbitrary code execution.

Subversion
Subversion servers that use the non-default "SVNPathAuthz short_circuit" mod_dav_svn configuration setting may allow unauthorized users to access portions of the repository. This issue is addressed by updating Subversion to version 1.6.13. This issue does not affect systems prior to Mac OS X v10.6.

Terminal
When ssh is used in Terminal's "New Remote Connection" dialog, SSH version 1 is selected as the default protocol version. This issue is addressed by changing the default protocol version to "Automatic". This issue does not affect systems prior to Mac OS X v10.6.

X11
Multiple vulnerabilities existed in FreeType, the most serious of which may lead to arbitrary code execution when processing a maliciously crafted font. These issues are addressed by updating FreeType to version 2.4.3. 

[Net-Security]

Apple issues mammoth security update for Safari browser

Apple has released Safari 5.0.4 - the latest version of Apple's browser software for Windows and Mac users - patching an eye-watering 62 security vulnerabilities in the process.

The vulnerabilities, described in an Apple knowledgebase article, were disclosed at the same time as a host of security holes in the iOS software used by the iPhone, iPad and iPod touch were also revealed by the company.

What this means is, just like their iPhone/iPod touch/iPad-owning cousins, people who run Safari on their Mac or Windows computers would be wise to check out the latest available security updates as soon as possible.

Apple doesn't like to assign severity levels to the security vulnerabilities found in its products, but the bugs in Safari look pretty critical to me. 57 of the 62 bugs can be exploited just by a user visiting a maliciously-crafted website.

If that's not a reason to install a security update to your Safari browser, I'm not sure what is.
You can download Safari 5.0.4 from Apple's website for Mac OS X 10.5 (Leopard), Mac OS X 10.6 (Snow Leopard), Windows XP, Windows Vista and Windows 7.

SophosLabs see tens of thousands of legitimately websites that have been infected by malware every single day, so it's really important to keep your browser up-to-date with the latest security patches.

[NakedSecurity]

Five Apple Security Myths — and the Disturbing Truths

"I just got a Mac,” think many first-time Apple customers. “I'll never have to worry about a virus again."
So it would seem to many longtime PC users, plagued by virus, e-mail and phishing attacks that require constant vigilance and the installation of often pricey security software. They rarely, if ever, hear their Mac-using friends complaining about the same problems.

But even though it’s true that Macintosh computers, iPhones, iPods and iPads (the latter three of which run Apple’s iOS mobile operating system) are subject to far fewer attacks than their Windows (or Android) counterparts, Apple products are definitely not immune to security flaws.

In fact, as Apple’s market shares increase, so do the chances of malware being written specifically for the company’s devices.

Virgin territory


Apple software is actually ripe for attack. At the 2010 “Pwn2Own” hacking contest, held every March at the CanSecWest security conference in Vancouver, Apple’s Mac OS X, the Safari Web browser and an iPhone 3GS were all exploited with surprising ease, falling quicker than their Windows-based competitors.

The overconfidence many Apple users feel about their gadgets may come from the company itself, said Alex Horan, director of product management at Boston-based Core Security.

“On its website, Apple states that: ‘Mac OS X doesn’t get PC viruses. And its built-in defenses help keep you safe from other malware without the hassle of constant alerts and sweeps,” Horan said.
But it’s a false comparison.

“Traditionally the only reason we haven’t seen a lot of news about viruses and worms targeting Mac systems is because we haven’t seen as many Mac systems in use,” Horan explained.

“The reality today remains that if I want to write some code that will attempt to control the maximum number of systems, then I need to have that code target the most common systems out there [Windows]. But as the number of Mac system grows, so will the attention of the attackers.”

Horan’s colleague at Core Security, Vice President of Security Awareness and Government Affairs Tom Kellermann, added a warning.

“Over the past few years, we’ve seen multiple exploits that have proven that this perception around Apple security is truly misguided,” Kellerman said. “Those people who believe that they are fundamentally more secure simply because they use Apple products will likely someday learn to regret it.”
Five hard lessons


With that in mind, here are five Apple security myths — and the brutal truth behind each:

Myth: I don't need antivirus and spam protection because I work on a Mac.

Truth: The Mac OS X operating system is targeted less frequently by malware only because it’s not as widespread as Windows. It’s no more secure than any other operating system, said Sorin Mustaca, data security expert at Germany-based Avira.

As for phishing attacks, said Mustaca, “the biggest problem in this case is not the computer itself, but rather it's the user.”

Myth: I can't be infected by any malicious software because I get my applications exclusively from the iTunes App Store.

Truth: “We've seen a couple of times already that the App Store is not such a secure fortress as one might have hoped,” said Mustaca. “It is extremely difficult to check every single application that is inserted there.”

Myth: Mac OS X is inherently more secure than Windows.

Truth: Apple’s brand-new products are being hacked almost immediately upon arrival. For example, “jailbreaking” your iPhone is as easy as browsing to a specific website.
“For a while, it was easier to write exploits for Mac OS X systems than it was for Windows, but now they're relatively equal,” said Core Security technical specialist Dan Crowley. “Bugs seem to be just as easy — if not easier — to find in Mac OS versus Windows.”

Myth: Apple's Safari browser is more secure than Microsoft's Internet Explorer.

Truth: Safari had more than twice the number of reported vulnerabilities in 2009 (94) than did Internet Explorer (41), according to Symantec's Global Internet Security Threat Report.

Myth: iPad users are not susceptible to the same sorts of attacks that Windows users experience.

Truth: According to Anup Ghosh, founder and chief scientist of Fairfax, Va.-based Invincea, Apple released the iOS 3.2.2 software update for the iPad specifically to fix a critical vulnerability in Adobe Reader that can be exploited by malicious PDF files.

So what can you do to make your Apple device more secure? First of all, never open an e-mail attachment you’re not expecting, even if it’s from someone you know.

Always check the URL — the long string of characters that begins with “http” — in your browser address window when surfing the Web, even on an iPhone or iPod Touch. Be very careful about using free Wi-Fi hotspots in coffeeshops, libraries or airports — it’s safer to just use your cellular carrier’s data service.

There isn’t any third-party security software for iOS devices as of yet, but a few Mac OS X applications are available, such as Sophos Anti-Virus for Mac Home Edition (free), BitDefender Antivirus 2011 for Mac (starting at $40 per year), Intego Virus Barrier X6 ($50 per year, two users) and various Norton products (starting at $50 per year).

[SecurityNewsDaily]

Microsoft announces 3 Security Bulletins

The Redmond company announced 3 security bulletins for the upcoming Patch Tuesday next week. These are meant to fix at least 4 security vulnerabilities. One flaw which affects Windows from XP to Windows 7 as well as Windows Server 2008 R2 is rated “critical” which means that attackers can smuggle in malware quite easily; a second bulletin deals with at least “important” vulnerabilities in the Windows operating systems. The third bulletin is about Microsoft Office – in Groove 2007 there is an “important” rated flaw to be  fixed.

Users and Administrators should prepare to install those updates as soon as possible upon release next Tuesday.

[ComputerSecurityArticles]

Seven Hints to Stay Safe Online

There have been a number of attacks recently against high-profile social networking accounts--French President Sarkozy, teen pop star Selena Gomez, and even social network wunderkind and Facebook founder Mark Zuckerberg have all fallen prey. Web surfing and social networking are here to stay, so the trick is figuring out how to protect your computer and your personal information while you're online.

Similar Articles:

A McAfee spokesperson e-mailed me a list of online security practices recommended by McAfee. Here is an overview of seven steps you can take to secure your online activities:

1. Update your browser. Newer browsers have better security controls and protection than older browsers. Make sure you are using the latest version of your Web browser of choice to take advantage of features like phishing filters that can protect you from attacks.

2. Do it in private. Public Wi-Fi hotspots like those at McDonald's or Starbucks are very convenient, but they are also--in a nutshell--insecure. There is typically no security or encryption enabled which means that anyone within range of your wireless connection can potentially intercept your data, including any account numbers or passwords you might type in.
In general, you should stick to reading the news and weather at public hotspots, and avoid ever typing any username, password, or other account data that should be kept private. If you absolutely must log in to Facebook, at least use the new security setting that uses HTTPS to set up a secure, encrypted connection with the social networking site.

3. Keep 'em guessing. Your username and password should be different for each site. Yes, that is more tedious and cumbersome for you to try and remember what your credentials are for each site, but it means that an attacker who compromises your Twitter account will only compromise your Twitter account, rather than having the master key that grants access to every site and service you use on the Web.

4. Double-check the domain. Before you start typing in sensitive information like your password or account number, take a peek at the address bar just to make sure that the site you are logging into is the legitimate site, hosted from the correct domain.
While you might think you are logging in to facebook.com, attackers will often create a realistic-looking malicious spoof site with a domain like facebook.hacker.com, or facebook_login.hacker.com. The bottom line is that the end is the only part that matters. If it says facebook.twitter.google.hacker.org, the real domain is simply "hacker.org" and the rest are simply subdomains created to distract and confuse you.

5. Suspicious messages are suspicious for a reason. Have you ever received an e-mail, or a private Facebook message from someone you know--but who almost never contacts you? Did it seem odd that after months or years or no communication, this person sent you a message out of the blue simply saying "Is this you in this video? LOL.", accompanied by a URL-shortened link to some unknown destination? Did it seem suspicious and make you think twice about clicking the link? It should have. If it seems suspicious--at all--assume that it is malicious and just delete it. If you are concerned that it might be important, then contact the alleged sender directly to make sure it is legitimate.

6. Clear history and log out. If you use a public PC, like at a library or a hotel lobby, to do any Web surfing, make sure you erase your tracks before you leave. You should use the anonymous or private browsing mode of the browser if there is one available. When you are done, you should go into the properties for the Web browser and erase the history and cache to remove traces of your Web-surfing activities.
You also need to make sure you manually log out of sites you log into. Just because you shut down the browser window doesn't necessarily mean you are logged out of the site. Whether intentional or pure accident, the next user of that same PC may find that your account is still actively logged in, granting complete access to a stranger.

7. Protect your PC. It wouldn't be a list of recommended security best practices without a reminder to properly protect the PC. You should have some sort of security suite, or collection of tools, providing personal firewall security and protection against viruses, spyware, phishing attacks, and other malware. As important as installing the protection is, it is more important to make sure the tools are frequently updated. Security software is typically only as secure as its last update. As new threats emerge, security software may be unable to detect or defend against them without the current update data.
There you have it. None of it is rocket science. In fact, most of it is simple, common sense. The dirty secret about PC and online security is that it is 90 percent common sense and healthy skepticism. The security software just helps guard against the other 10 percent.

[PCWorld]

Microsoft pushes anti-AutoRun update at XP, Vista users

Microsoft last week changed how it delivers an update that disables AutoRun, a Windows feature that big name worms, including Conficker and Stuxnet, have used to infect millions of PCs.

The company is now pushing the update to Windows XP and Vista users automatically.

When Microsoft first deployed the update Feb. 8, it said the patch would be offered as an optional download. To retrieve it, users had to manually checkmark the “KB971029″ update in the “Software, Optional” section of Windows Update in XP, or in Vista’s Windows Update panel under “Important.”

But last week Microsoft changed those rules and began feeding users the update through the Automatic Updates feature of Windows Update, which automatically downloads and installs hotfixes and other software upgrades. In Windows XP, for example, users now see the AutoRun fix under the “High-priority updates” label, and the patch is pre-checked so it downloads and installs without any user action.

The “High-priority updates” section of XP’s Windows Update is the same location where security-related patches appear.

Microsoft’s move to cripple AutoRun is a response to malware’s continued reliance on infection tactics that abuse AutoRun and AutoPlay, the technologies that automatically launch executable files on removable media, especially USB flash drives.

Both Conficker, a worm that spread widely in early 2009, and Stuxnet, the worm that analysts suspect was developed to sabotage Iran’s nuclear programs, used AutoRun and flash drives to infect Windows PCs.

Microsoft changed AutoRun’s behavior in Windows 7 to block automatic execution of files on a USB drive, and first backported the modifications to Windows XP and Vista in August 2009.

When the update is in place, flash drives inserted into a PC running XP or Vista no longer offer the option to run programs; the AutoRun extinction does not affect CDs or DVDs.

Microsoft confirmed the update reset, and said that it changed the delivery process to “minimize the user interaction required to install the updates on systems configured for automatic updating.” However, the company did not respond to questions about why it did not communicate the change to users as it had in early February when it said the patch was optional.

The unannounced automatic deployment of the AutoRun update may cause confusion if users expect files — in particular, setup executables that kick off software installation — to launch when they insert a flash drive in their Windows XP or Vista PCs.

Microsoft noted that the update breaks the functionality of some USB drives. “Users who install this update will no longer receive a setup message that prompts them to install programs that are delivered by USB flash drives. Users will have to manually install the software,” Microsoft warned in a security advisory.

To disable the update’s changes and revert to Windows XP’s and Vista’s earlier behavior, users can run the “Enable Autorun” tool found on Microsoft’s support site.

[ComputerWorld]

Report: malicious PDF files becoming the attack vector of choice

According to a newly released report by Symantec’s MessageLabs, malicious PDF files outpace the distribution of related malicious attachments used in targeted attacks, and currently represent the attack vector of choice for malicious attackers compared to media, help files, HTMLs and executables.
The report also notes a slight increase in the distribution of executable files, a rather surprising trend given the fact that spam and email filters will definitely pick them up.

PDFs now account for a larger proportion of document file types used as attack vectors. However, it should be noted that office-based file formats are still a popular and effective choice used in some targeted attacks. In 2009, approximately 52.6% of targeted attacks used PDF exploits, compared with 65.0% in 2010, an increase of 12.4%. Despite a recent downturn in the last three months, if this trend were to continue at the same rate it has for the last year, the chart in figure 2 shows that by mid-2011, 76% of targeted malware could be used for PDF-based attacks.

PDF-based malware campaigns are here to stay, though:
“PDF-based targeted attacks are here to stay, and are predicted to worsen as malware authors continue to innovate in the delivery, construction and obfuscation of the techniques necessary for this type of malware,” said MessageLabs Intelligence Senior Analyst, Paul Wood.

Are cybercriminals picky? Not necessarily as it’s entirely based on the campaign in question. In this case, they appear to be interested in bypassing spam and email filters by distributing a ubiquitous filetype that’s often allow to pass through them in the first place.

Email attachments combined with social engineering tactics, are among the many attack vectors, cybercriminals take advantage of. Next to email attachments, the use of web malware exploitation kits is growing, with the majority of publicly obtainable data indicating that they continue relying on outdated and already patched vulnerabilities for successful exploitation.

[ZDNet]

Apple Fixes Nearly 60 Bugs With iTunes 10.2 Release

Apple has released a new version of its ubiquitous iTunes software that includes fixes for nearly 60 vulnerabilities, including several bugs that could be used to run remote code on vulnerable machines.

Most of the vulnerabilities that Apple fixed with the release of iTunes 10.2 lie in the open source WebKit layout engine that underpins iTunes. Many of the vulnerabilities can be used by attackers to either crash iTunes or execute arbitrary code on the PC. Apple recommends that users download the new version immediately.

"Multiple memory corruption issues exist in WebKit. A man-in-the-middle attack while browsing the iTunes Store via iTunes may lead to an unexpected application termination or arbitrary code execution," Apple said in its advisory.

The non-WebKit bugs fixed in the new version of iTunes are equally as serious, with several of them capable of being used for remote code execution. Here are the details on the non-WebKit vulnerabilities:

• ImageIO
  Available for: Windows 7, Vista, XP SP2 or later
  Impact: Multiple vulnerabilities in libpng
  Description: libpng is updated to version 1.4.3 to address multiple vulnerabilities, the most serious of which may lead to arbitrary code execution. For Mac OS X v10.5 systems, this is addressed in Security Update 2010-007.

• ImageIO
  Available for: Windows 7, Vista, XP SP2 or later
  Impact: Viewing a maliciously crafted JPEG image may lead to an unexpected application termination or arbitrary code execution
  Description: A heap buffer overflow issue existed in ImageIO's handling of JPEG images. Viewing a maliciously crafted JPEG image may lead to an unexpected application termination or arbitrary code execution.

• ImageIO
  Available for: Windows 7, Vista, XP SP2 or later
  Impact: Viewing a maliciously crafted TIFF image may result in an unexpected application termination or arbitrary code execution
  Description: A buffer overflow existed in libTIFF's handling of JPEG encoded TIFF images. Viewing a maliciously crafted TIFF image may result in an unexpected application termination or arbitrary code execution.

• ImageIO
  Available for: Windows 7, Vista, XP SP2 or later
  Impact: Viewing a maliciously crafted TIFF image may result in an unexpected application termination or arbitrary code execution
  Description: A buffer overflow existed in libTIFF's handling of CCITT Group 4 encoded TIFF images. Viewing a maliciously crafted TIFF image may result in an unexpected application termination or arbitrary code execution.

• libxml
  Available for: Windows 7, Vista, XP SP2 or later
  Impact: Processing a maliciously crafted XML file may lead to an unexpected application termination or arbitrary code execution
  Description: A double free issue existed in libxml's handling of XPath expressions. Processing a maliciously crafted XML file may lead to an unexpected application termination or arbitrary code execution.

• libxml
  Available for: Windows 7, Vista, XP SP2 or later
  Impact: Processing a maliciously crafted XML file may lead to an unexpected application termination or arbitrary code execution
  Description: A memory corruption issue existed in libxml's XPath handling. Processing a maliciously crafted XML file may lead to an unexpected application termination or arbitrary code execution.

A large number of the vulnerabilities fixed in this release of iTunes were reported by members of Google's internal security research team, which has become quite active in researching outside applications recently.

[ThreatPost]

iTunes 10.2 addresses multiple security vulnerabilities

 Apple has released an update, version 10.2, to the popular iTunes  media player software, closing a number of security vulnerabilities in its product. According to Apple, iTunes 10.2 corrects five vulnerabilities in ImageIO, as well as two issues in the libxml library, many of which could possibly be used by an attacker to execute arbitrary code.

The update also fixes a total of 50 bugs in the WebKit browser engine which could also lead to arbitrary code execution via a man-in-the-middle attack while browsing the iTunes Store. In addition to closing the above security vulnerabilities, the iTunes update also improves Home Sharing and adds support for iPhone, iPad and iPod touch devices running iOS 4.3, which is expected to arrive on 11 March.

Version 10.2 of iTunes is available to download for Windows (32- and 64-bit) and Mac OS X 10.5 or later. All users are advised to upgrade as soon as possible.

[h-online]

Britons caught out by booby-trapped web ads

The website of the London Stock Exchange was one that displayed the booby-trapped ads

Tens of thousands of people could have been caught out by cyber criminals who put booby-trapped adverts on popular webpages.

The criminals racked up the victims by compromising the computers used by ad firm Unanimis to display adverts to popular websites.

The ads appeared on the websites of the London Stock Exchange, Autotrader, the Vue cinema chain and six other sites.

Unanimis said it moved quickly to pull the adverts once they were discovered.


Victim count
It said it was now investigating how the criminals managed to inject their booby-trapped ads into its feed.
David Nelson, operations and IT director at Unanimis, told the BBC that security alerts revealed the existence of the booby-trapped adverts at 1800 GMT on 27 February.

Clearing out the adverts took about three hours, said Mr Nelson.

A preliminary investigation revealed that "unauthorised access" to the ad servers allowed the criminals to inject their malicious code.

Mr Nelson said Unanimis was still investigating how the criminals got access as the firm has security systems in place that check adverts are safe before they are distributed.

"The [adverts] they chose to modify were not being widely distributed," said Mr Nelson. This, coupled with the attack taking place on a Sunday evening, limited how many people fell victim.

"We have to count ourselves lucky in some respects," he said.

The infection kicked off warnings from a fake security program

The bad ads exploited vulnerabilities in software used on Windows PCs to make it look like a machine had been hit by a virus.

Then it displayed a bogus diagnostic screen telling users that their PC was infected. It asked for payment to remove the "infection".

Mr Nelson said it was still trying to work out how many people had seen the booby-trapped ads.
He speculated that a "few percent" of Unanimis audience would have been hit. He declined to identify all the sites that had shown the adverts but said all those affected had been informed.

Patrik Runald, senior research manager at Websense, said its analysis suggested a lot of people had been caught out.

"We believe that quite a large number of sites were showing these adverts," he said, adding that the number of victims could be in the "tens of thousands".

The criminals behind the bad ads typically loaded their attack tools with code that exploited many different vulnerabilities in Windows programs.

Java and software from Adobe was becoming a favourite among hi-tech criminals, he said.

Mr Runald said cyber criminals liked to subvert advertising systems because it was a good way to get their malicious code put on popular sites with only a little effort on their part.

"Such malvertising is reasonably common," said Mr Runald. "It does not happen every day but it does happen every month or so."

[BBC]

The Computer Attacks You've Never Heard Of

CyberDefender Research Labs — We've all heard of worms, Trojan horses, phishing, and other common computer security attacks that aims to infect your system and steal your data. But what about bluebugging, smishing, and scareware? Brush up on your computer security terminology with these lesser-known attackers.


Malware is serious business. It can slow PCs down to a crawl. On the other hand, some of the terms security researchers have decided to name these sometimes annoying (and often damaging) pieces of code are downright charming.

Here are nine that stand out, followed by seven most people have heard of:

The Security Attacks Most People Have Never Heard Of

Smishing: Smishing or "SMS phishing" refers to a phishing attack that specifically targets mobile phones. The victim would receive an SMS with a hyperlink wherein a malware automatically finds its way in your phone or leads the user to a phishing site formatted for mobile screens. The term was brought on by David Rayhawk in a McAfee Avert Labs blog.

Botnet (Zombie PCs): A portmanteau of the words "Robot" and "Network," a Botnet is any number of internet computers that inconspicuous to their owners; forward e-mails (any of which include spam, malware, or viruses) to other computers on the internet. These infected computers are also known as "zombies". DoS attacks (Denial of Service) often rely on thousands of zombie PCs.

BlueBugging: A craze originally jumpstarted by a Malaysian IT Professional, bluebugging (not to be confused with bluesnarfing) allows a more skilled person to illegally access a cellular phone via Bluetooth wireless technology. This act often times goes unnoticed without any proper notification or alerting to the phone's user. A vulnerability such as this allows phone calls, SMS messages to be read and sent, phonebook contacts to be erased, phone conversations to be tapped, and other malicious activities. But much to the hacker's dismay [I think the hacker knows the limitations… perhaps the point is that widespread impact is minimized because of the range…], access is only attainable within a 10 meter range of the phone.

Pod Slurping: Coined by US security expert Abe Usher; Pod Slurping is when your iPod or any portable USB storage device begins to surreptitiously copy large amounts of files from your computer to its hard drive, it's engaged in something called "Pod Slurping". Pod slurping is becoming an increasing security risk to companies and government agencies. Typically, access is gained while the computer is unattended, and this process can occur in as little as 65 seconds.

Ransomware: A program that makes a computer near unusable then demands payment in order for the user to regain full access. It "kidnaps" the computer! Ransomware is also commonly referred to as a "cryptovirus" or "cryptotrojan." Examples of Ransomware include Gpcode.AK, Krotten, and Archiveus. Ransomware was originally a with a trojan called PC Cyborg, created by a Dr. Joseph Popp.

Scareware: Scareware is software that tricks people into downloading or purchasing it, under the guise of fixing their computer, when in reality the faux anti-virus program is the real problem. Scareware programs often run a fictitious or careless system scan, and then present the user with a list of malicious programs that must be corrected, always leaving itself off of the list. The scareware then informs that in order to fix these "problems" it will require the user to pay a fee for a "full" or "registered" version of the software. Examples of scareware include: System Security, Anti-Virus 2010, and Registry Cleaner XP.

Sidejacking: Sidejacking is a hacking technique used to gain access to your website specific accounts. Websites typically encrypt your password so it cannot be stolen, but then send you an unencrypted "session-id". The session-id is either some random data in the URL, or more often, random data in a HTTP cookie. A hacker who finds the session-id can then use it to gain access to the respective account. Thus enabling the hacker ability to read your email, look at what you've bought online, or control your social network account, and so on. Robert Graham, who pulled together a variety of known and new vulnerabilities and packaged them into an automated session snatcher, was responsible for this term.

Black Hat: "Black Hat" hackers are those people who specialize in unauthorized breaching of information systems, often times attacking those containing sensitive information. They may use computers to attack systems for profit, for fun, or for political motivations. Attacks often involve modification and/or destruction of data which is done without authorization. They also may distribute computer viruses, internet Worms and deliver spam through the use of botnets.

White Hat: A "White Hat" hacker describes an individual who identifies a security weakness in a computer system or network but, instead of maliciously taking advantage of it, exposes the weakness, and repairs the vulnerability protecting the network from unwarranted intrusions or attacks. The term is taken from old western films, where the white hat cowboy is portrayed as the hero, and the black hat as the villain.

The Attacks Everyone Sort of Understands

Worm: Originating in a Xerox Palo Alto Research Center 1979 by engineers, a "Computer Worm" was originally designed to make programs run more efficiently, then later corrupted to be a destructive computer virus that can alter or erase data on computers. Often times, they leave files irretrievably corrupted or slow the PC down to a crawl.

Trojan Horse: A long time and common infection found amongst even the newest of computers, this destructive program disguises itself as a harmless application. Although Trojans are incapable of self-replication, they are still just as destructive as a computer virus. In an act similar to its Greek origin, often times a Trojan horse opens up a backdoor to your computer enabling potential viral infections and allowing hackers to control the PC. Origins trace back to MIT hacker turned NSA spook, Dan Edwards.

Phishing: Originated by hackers who were stealing America On Line accounts by scamming passwords from unsuspecting users, "phishing" is the age-old crime of taking ownership of sensitive information from third parties (phishing scam victims). Information includes usernames, passwords, banking information, and credit card numbers. This is typically accomplished from sending someone an e-mail fraudulently claiming to be a legitimate company, or redirecting someone to a website that looks legitimate but isn't. More often than not, the direct result of being phished is your identity being stolen.

Script Kiddies: A term originated by Marcus Ranum to describe white hats who had no idea what they were doing, a script kiddy (sometimes plural as kiddies) is a derogative term, used by more skilled hackers of computer security systems, to describe young or less experienced hackers who still can be just as much a threat or annoyance. Utilizing cheap techniques, pre-written scripts and sometimes with assistance, the average script kiddy can exploit a weakness with computer networks. The difference is that these untrained hackers are often unaware of the potential consequences of their actions.

Keylogging: Originally designed by Perry Kivolowitz for a Usenet news group in 1983, Keylogging for the most part has become increasingly common, not to mention dangerous. It involves the recording of any keyboard input via internet connection. Not every instance of keylogging is necessarily illegal. It's sometimes done as a way to monitor teens and children.

Social Engineering: Brought into common knowledge by Kevin Mitnick (a hacker popular back in the day), Social Engineering involves obtaining or attempting to obtain private data by illegally persuading an individual to reveal otherwise secure information. The Information released by victims is often then used to attack a computer network. One common example would be when an employee at a large company is convinced to give out his employee identification, and then it is manipulated to gain further access to the said company's network, often sensitive information.

Crapware: Originally coined and reported by Marc Orchant on his ZDNet blog, Crapware is comprised of programs that use valuable resources on a computer's hard drive, such as memory or RAM, which are not necessary and are unused by the computer owner. Crapware can range from software loaded onto the system prior to sale to programs that are downloaded from the internet without the knowledge or consent of the user. One of the more common examples of Crapware is AOL being installed on PCs by the PC manufacturer.

[Gizmodo]

Flaw in Microsoft Malware Protection Engine puts users at risk

The latest update to the Microsoft Malware Protection Engine includes a patch for a vulnerability that could allow an elevation of privilege if the Engine performs a scan of the system after an attacker with valid logon credentials has created a specially crafted registry key.

Granted, the vulnerability cannot be exploited by an anonymous user, so the likelihood of it being exploited in the wild has been and is rather slim.

Unfortunately, the Engine is an integral part of various anti-malware products made by Microsoft - including its Security Essentials solution and its Malicious Software Removal Tool - so a speedy update of the malware definitions for the affected products is advised, since the update for the Engine is bundled up with them.

"Administrators of enterprise installations should follow their established internal processes to ensure that the definition and engine updates are approved in their update management software, and that clients consume the updates accordingly," warns Microsoft. According to the advisory, server side anti-malware products are not affected by the flaw.

[met-security.org]