4 X Security Team

Hackers can create malicious podcasts to hijack usernames and passwords from Apple’s iTunes software.

According to a warning from Apple, a “design issue” in the iTunes podcast feature can be abused via rigged audio files to cause an authentication dialog to be presented to the user. From that dialog, a hacker can hijack iTunes credentials and upload it to the podcast server.

[ SEE: Apple plugs gaping iTunes hole, doesn't tell everyone ]

From Apple’s advisory:

• A design issue exists in the iTunes podcast feature. A subscription to a malicious podcast may cause an authentication dialog to be presented to the user. This dialog may entice the user to send iTunes credentials to the podcast server.

Apple has shipped a patch in iTunes 8.1 to clarify the origin of the authentication request in the dialog box.

The iTunes update also corrects a denial-of-service flaw that can be caused via maliciously crafted DAAP messages.

• An infinite loop exists in the handling of iTunes Digital Audio Access Protocol (DAAP) messages. Sending a message containing a maliciously crafted Content-Length parameter in the DAAP header may lead to a denial of service. This update addresses the issue by performing additional validation of DAAP messages.

The denial -of-service bug does not affect Mac OS X systems.

[Source: zdnet]

Microsoft today shipped three security bulletins with fixes for at least 8 documented vulnerabilities affecting millions of Windows OS users.

The most serious of this month’s patch batch is rated “critical” and could allow full remote execution attacks if a Windows user is simply lured into viewing a booby-trapped image file.

The skinny on the March 2009 bulletins:

• MS09-006: (CRITICAL) Provides cover for three newly discovered and privately reported vulnerabilities in Windows, which could allow remote code execution if a user viewed a specially crafted EMF or WMF image file from an affected system. These vulnerabilities affect all versions of Windows, including Vista and Windows Server 2008. Microsoft expects to see exploit code for these flaws but reckons the reliability will be “inconsistent.”
• MS09-007: (IMPORTANT): This bulletin includes a patch for a solitary vulnerability in Windows, which could allow spoofing if an attacker gains access to the certificate used by the end user for authentication. Again, Microsoft says “inconsistent exploit code” is likely. The bulletin is available for all versions of Windows — Windows 2000 through Windows Server 2008.
• MS09-008 (IMPORTANT): This update resolves two privately reported vulnerabilities and two publicly disclosed vulnerabilities in Windows , which could allow a remote attacker to redirect network traffic intended for systems on the Internet to the attacker’s own systems. Microsoft says the patches correct the way that Windows DNS servers cache and validate queries, and by modifying the way that Windows DNS servers and Windows WINS servers handle WPAD and ISATAP registration. For these issues, Microsoft warns that “consistent exploit code” is likely.

Windows users should treat the “critical” bulletin with the highest possible priority.

[Source: zdnet]

Apple has released a firmware update with fixes for three documented security vulnerabilities affecting its Time Capsule and AirPort Base Station products.

The vulnerabilities could lead to denial-of-service or information disclosure attacks via specially crafted packets. Details on the vulnerabilities:

• CVE-2008-2476 - The IPv6 Neighbor Discovery Protocol implementation does not validate the origin of Neighbor Discovery messages. By sending a maliciously crafted message, a remote user may cause a denial of service, observe private network traffic, or inject forged packets. This update addresses the issue by performing additional validation of Neighbor Discovery messages.
• CVE-2008-0473 - An out-of-bounds memory access issue exists in the handling of PPPoE discovery packets. By sending a maliciously crafted PPPoE discovery packet, a remote user may be able to cause an
  unexpected device shutdown. This update addresses the issue through improved bounds checking.
• CVE-2008-3530 - When IPv6 support is enabled, IPv6 nodes use ICMPv6 to report errors encountered while processing packets. An implementation issue in the handling of incoming ICMPv6 “Packet Too Big” messages
  may cause an unexpected device shutdown. This update addresses the issue through improved handling of ICMPv6 messages.

Apple says the update (firmware version 7.4.1) is installed into Time Capsule or AirPort Base Station with 802.11n* via AirPort Utility provided with the device.

[Source: zdnet]

A new report from Secunia is pouring more gas on the Internet Explorer vs. Mozilla Firefox security debate.

The security alerts aggregator collected and crunched the numbers on security flaws publicly reported — and fixed — by the two vendors and found that Mozilla easily won the time-to-patch race, despite having to respond to almost four times the number of vulnerabilities.

(Table shows window of exploitation for vulnerabilities publicly disclosed in IE and Firefox in 2008. The number of days unpatched are in red for those vulnerabilities that are still unpatched as of Dec. 1, 2008)

On average, according to the Secunia 2008 report (.pdf), Mozilla averaged 43 days to respond to 115 reported Firefox vulnerabilities while Microsoft took 110 days to release patches for 31 Internet Explorer holes.

* Image source: Channy Yun’s Flickr photostream (Creative Commons 2.0)

Charlie Miller, the security researcher who won last year’s Pwn2Own hacker contest, is predicting that Apple’s Safari browser will be the easiest target this year.

In a note posted on the popular Daily Dave mailing list, Miller describes Safari as “easy pickin’s” and forecasts that at least four zero-day Safari flaws will be used during the contest at CanSecWest later this month.

[ SEE: Pwn2Own hacker contest targets browsers, smart phones ]

This year’s contest will pit hackers against browsers and smart phones with Internet Explorer, Firefox, Safari, Opera and Chrome among the high-profile targets. It will also include attacks against fully patched BlackBerry, Android, iPhone, Symbian and Windows Mobile phones in their default configurations.

Here are Miller’s predictions:

• Safari: hacked by 4 different people. Easy pickin’s as usual.
• Android: hacked by 1 person. Not too tough but no one owns one.
• IE8, Firefox: Survive unscathed. The bugs to exploit equation is too hard for $5k.
• iPhone, Symbian: Survive due to non-executable heap.
• Blackberry, Windows Mobile, Chrome: I don’t know enough to say anything intelligent. That said, they’re probably hard/obscure and so survive.

Last year, Miller exploited a Safari flaw to hijack a fully patched MacBook Pro machine. He is also known for launching successful attacks against Apple’s iPhone and Google’s Android platform.

ALSO SEE: 10 questions for MacBook hacker Dino Dai Zovi

[Source: zdnet]

Opera Software has shipped a high-priority security patch for its flagship Web browser to plug at least three vulnerabilities that expose Windows users to code execution and cross-domain scripting attacks.

The Opera 9.64 upgrade also adds support for DEP (Data Execution Prevention) and ASLR (Address Space Layout Randomization), two anti-exploitation mechanisms that helps to limit the damage from malware attacks on the Windows platform.

Opera has only released details on one of the three security vulnerabilities, which was discovered and reported by Google’s Tavis Ormandy.

• Specially crafted JPEG images can cause Opera to corrupt memory and crash. Successful exploitation can lead to execution of arbitrary code.

Opera said the update also fixes an issue where plug-ins could be used to allow cross domain scripting and a third “moderately severe” issue that remains a mystery.

“Details will be disclosed at a later date,” the company said.

* Image source: andyket’s Flickr photostream (Creative Commons 2.0)

[Source: zdnet]

The open-source PHP Group has issued a patch for at least four security flaws in the widely-used general-purpose scripting language.

With PHP 5.2.9 (see changeLog), the PHP development team corrects a total of 50 bugs, including a publicly-known flaw that allows attackers to read the contents of arbitrary memory locations in certain situations.

Here’s the skinny on that issue, which is rated medium-severity:

• Array index error in the imageRotate function in PHP 5.2.8 and earlier allows context-dependent attackers to read the contents of arbitrary memory locations via a crafted value of the third argument (aka the bgd_color or clrBack argument) for an indexed image.

The other security fixes in PHP 5.2.9 are:

• Fixed a crash on extract in zip when files or directories entry names contain a relative path. (Pierre)
• Fixed explode() behavior with empty string to respect negative limit. (Shire)
• Fixed a segfault when malformed string is passed to json_decode(). (Scott)

ALSO SEE:

Flaw trifecta kicks off Month of PHP Bugs

Controversial ‘month of bugs’ getting security results

[Source: zdnet]

Microsoft today shipped four bulletins with patches for at least 8 documented security vulnerabilities affecting Windows users and warned that “consistent exploit code could be easily crafted” to launch attacks via the Internet Explorer browser.

The Patch Tuesday batch includes fixes for a pair of code execution holes in IE, two bugs in the Microsoft Exchange Server, a remote code execution issue in the Microsoft SQL Server, and three separate flaws haunting users of Microsoft Office Visio.

The Internet Explorer bulletin (MS09-002) should be treated with urgency because the flaws can be exploited to launch drive-by download attacks.

• This security update is rated Critical for Internet Explorer 7 running on supported editions of Windows XP and Windows Vista. For Internet Explorer 7 running on supported editions of Windows Server 2003 and Windows Server 2008, this security update is rated Moderate.

The Microsoft warning that consistent exploit code was likely suggests that it’s very easy for an attacker to host a specially crafted Web site and attack unpatched users who surfed to the rigged Web site.

• The attacker could also take advantage of compromised Web sites and Web sites that accept or host user-provided content or advertisements. These Web sites could contain specially crafted content that could exploit this vulnerability.

Enterprise administrators will also want to pay special attention to the Microsoft Exchange update (MS09-003) which covers two different vulnerabilities that expose users to code execution or denial-of-service attacks.

Microsoft explains:

• The first vulnerability could allow remote code execution if a specially crafted TNEF message is sent to a Microsoft Exchange Server. An attacker who successfully exploited this vulnerability could take complete control of the affected system with Exchange Server service account privileges. The second vulnerability could allow denial of service if a specially crafted MAPI command is sent to a Microsoft Exchange Server. An attacker who successfully exploited this vulnerability could cause the Microsoft Exchange System Attendant service and other services that use the EMSMDB32 provider to stop responding.

The company says it expects to see “inconsistent exploit code” published for this bulletin. However, nCircle director of security operations Andrew Storms says this is a very serious problem.

“This vulnerability means that any cybercriminal sending a well crafted email attachment to an enterprise could gain complete control over the server and gaining one of the keys to the kingdom,” Storms said.

“All kinds of highly confidential and proprietary information pass through an Exchange server every day. Gaining control over it and its content would be a gold mine to any cyber criminal,” he added.

[Source: zdnet]

A week after a newly launched crimeware tracking service went public, cybercriminals didn’t hesitate to prove its usefulness by launching a distributed denial of service attack (DDoS) against it. According to the Swiss security blog, the Zeus tracker came under attack from a previously known source that also attacked abuse.ch over an year ago taking advantage of a well known do-it-yourself DDoS malware.

Just like November 2008’s DDoS attack against the anti-fraud site Bobbear.co.uk — with evidence that the attack was commissioned provided by Zero Day back then — the single most evident proof of the usefulness of your cybercrime tracking service always comes in the form of a direct attack against its availability.

What is the Zeus Tracker anyway, and why is it so special at the first place?

The Zeus Tracker is a full-disclosure project keeping track of known Zeus hosting locations, one of the most ubiquitous crimeware applications cybercriminals take advantage of for years. Moreover, by maintaining a real-time blocklist that allows the community to easily take action against known Zeus domains/IPs it shouldn’t come as a surprise that the service is getting attacked - simply because it exposes active crimeware campaigns.

• Go through more recent DDoS attacks coverage - GoDaddy hit by a DDoS attack; AlertPay hit by a large scale DDoS attack; BBC hit by a DDoS attack; Anti fraud site hit by a DDoS attack; Norwegian BitTorrent tracker under DDoS attack; Georgia President’s web site under DDoS attack from Russian hackers

Once available as a proprietary crimeware tool costing several thousands dollars, today, pirated copies of Zeus are so prevalent, that most of the innovations attempting to to improve its usefulness and abilities to sniff E-banking transaction data come from third parties in a true open source crimeware fashion. In fact, the Zeus crimeware is so popular that cybercriminals themselves are looking for and successfully finding remotely exploitable vulnerabilities within the kit in an attempt to hijack someone else’s botnet.

Moreover, with or without the Zeus Tracker’s real-time data, the Zeus malware is prone to continue dominating the crimeware landscape due to its maturity into a cybercrime-as-a-service proposition. For instance, the increasing number of services offering managed Zeus botnets not only allow less sophisticated cybercriminals easy access to hundreds of thousands of banker malware infected hosts, but also, the relatively low prices the services charge due to the fact that they’re running pirated copies of Zeus ultimately results in the scalability of cybercrime in general.

Attempting to undermine this scalability would mean coming up with ways to shorten the average time a Zeus command and control domain/IP remains online, next to communicating the already known locations as a public service just like the Zeus Tracker does.

It’s Apple’s turn on the Patch Day treadmill and, for Mac OS X users, it’s quite ugly.

As I write, Apple has released four different bulletins to cover 48 documented vulnerabilities in the Mac OS X ecosystem, a solitary code execution flaw affecting Safari for Windows and four different security problems in Java for Mac OS X.

Security Update 2009-001 is quite a whopper, providing patches for holes in a wide range of components, including several open-source implementations like ClamAV and fetchmail.

[ How does Apple get away with this badware behavior? ]

This is a high-priority update for all Mac OS X users so don’t fool around when you see that Software Update alert. All the raw details can be found in this advisory.

If you’re a Windows user and Safari is installed on your machine, pay special attention to this alert, which warns of code execution exposure on Windows XP and Windows Vista.

• Multiple input validation issues exist in Safari’s handling of feed: URLs. The issues allow execution of arbitrary JavaScript in the local security zone. This update addresses the issues through improved handling of embedded JavaScript within feed: URLs.

[ Pwn2Own hacker contest targets browsers, smart phones ]

Apple also shipped a Java for Mac update with fixes for 4 more security problems:

• Multiple vulnerabilities exist in Java Web Start and the Java Plug-in, the most serious of which may allow untrusted Java Web Start applications and untrusted Java applets to obtain elevated privileges. Visiting a web page containing a maliciously crafted Java applet may lead to arbitrary code execution with the privileges of the current user.

It’s a seemingly light batch of patches this month, trailing an even lighter, single patch release in January. Two critical items were released — including patches for Internet Explorer 7 and Microsoft Exchange Server. Additionally, two “important” items were released — for Microsoft SQL Server and Visio.

MS09-002 is a typical IE patch, providing protection if a user is surfing to an evil website. What’s unusual this month is that the vulnerability is only present in Internet Explorer 7. This leads to the question “what did Microsoft put in IE7 that they didn’t put in earlier versions that leads to this exploit, and why didn’t their new security testing program catch this vulnerability?”

[ SEE: Microsoft: ‘Consistent exploit code likely’ for IE vulnerabilities ]

Microsoft says that it’s easy for hackers to create an evil webpage to exploit this issue.

MS09-003 is a Critical patch for Exchange Server (versions 2000, 2003, 2007) that could lead to code execution and/or Denial of Service. The attacker can send a malformed winmail.dat file to an Exchange Server in hopes of having that server execute code of their choosing. (winmail.dat files are configuration files that instruct the email client how to render and display Rich Text Formatted documents.) Alternatively, the attacker can send a series of packets to the Exchange Server in an attempt to take down the mail services - creating a denial of service attack. Microsoft says that inconsistent exploit code is likely to be released.

MS09-004 is probably the most interesting patch this month. This patch addresses the zero-day SQL Server flaw reported by Sec-Consult on December 9th, 2008. This flaw enables attackers to execute code of their choice on the affected SQL Server. The bar for exploitation is raised slightly in that the attacker must already have authenticated access to the SQL Server in order to pull of this exploit.

[ SEE: Microsoft confirms critical SQL Server vulnerability ]

However, unauthenticated attackers (since when you do authenticate your attacker anyway?) can still leverage this flaw if they can plant their code using SQL Server injection techniques via poorly coded websites. Proof of concept code has been published on the Internet but Microsoft says they have not seen proof of exploitation (maybe they aren’t looking hard enough?). I’d probably rate this patch as Critical - given the end result capable. I’m guessing Microsoft has downgraded this severity because of the “authentication” requirement. (although they give this a ‘1′ in the exploitability index - saying that consistent exploit code is likely).

MS09-005 is an Important patch for Visio. Open a malformed Visio document and the evil-doer can run code on your system in the context of your currently logged on account. Microsoft says this was privately reported and they’ve seen no reports of exploitation. They recommend not opening Visio documents from untrusted sources.

[ SEE: BlackBerry bitten by ActiveX control flaw ]

I recommend a two pronged approach to patching this month. Two patches are for Server issues (09-003 and 4 - Exchange and SQL) and two are for client side applications (09-002 and 5 - IE7 and Visio). Give the two server patches to the Server maintenance team and ask that they install these two as soon as possible - given what I believe is the severity of these issues. Give the two client side patches to the desktop team and have them install these patches in the next update cycle or as they see fit - but no need to burn the weekend candle for these.

* Eric Schultze is chief technology officer at Shavlik Technologies, a vulnerability management company.

[Source: zdnet]

Research in Motion (RIM) today raised an alarm for a serious security vulnerability in the BlackBerry Application Web Loader, warning that it exposes Windows users to code execution attacks.

• When a BlackBerry device user browses to a web site that is designed to install the BlackBerry Application Web Loader ActiveX control on BlackBerry devices over a USB connection, and clicks Yes to install and run the ActiveX control, the ActiveX control introduces the vulnerability to the computer.

An advisory from US-CERT explains that a malicious hacker could use booby-trapped HTML documents or Web pages to execute arbitrary code with the privileges of the user. The attacker could also cause Internet Explorer to crash.

To fix this issue, install the updated version of the BlackBerry Application Web Loader:

1. Visit http://na.blackberry.com/eng/developers/javaappdev/devtools.jsp
2. Click the link to download the BlackBerry Application Web Loader v1.1.
3. Complete the installation wizard.

A separate update rollup for Active killbits Microsoft provided cover for this BlackBerry issue and two other ActiveX control vulnerabilities.

[Source: zdnet]

Microsoft today shipped four bulletins with patches for at least 8 documented security vulnerabilities affecting Windows users and warned that “consistent exploit code could be easily crafted” to launch attacks via the Internet Explorer browser.

The Patch Tuesday batch includes fixes for a pair of code execution holes in IE, two bugs in the Microsoft Exchange Server, a remote code execution issue in the Microsoft SQL Server, and three separate flaws haunting users of Microsoft Office Visio.

The Internet Explorer bulletin (MS09-002) should be treated with urgency because the flaws can be exploited to launch drive-by download attacks.

• This security update is rated Critical for Internet Explorer 7 running on supported editions of Windows XP and Windows Vista. For Internet Explorer 7 running on supported editions of Windows Server 2003 and Windows Server 2008, this security update is rated Moderate.

The Microsoft warning that consistent exploit code was likely suggests that it’s very easy for an attacker to host a specially crafted Web site and attack unpatched users who surfed to the rigged Web site.

• The attacker could also take advantage of compromised Web sites and Web sites that accept or host user-provided content or advertisements. These Web sites could contain specially crafted content that could exploit this vulnerability.

Enterprise administrators will also want to pay special attention to the Microsoft Exchange update (MS09-003) which covers two different vulnerabilities that expose users to code execution or denial-of-service attacks.

Microsoft explains:

• The first vulnerability could allow remote code execution if a specially crafted TNEF message is sent to a Microsoft Exchange Server. An attacker who successfully exploited this vulnerability could take complete control of the affected system with Exchange Server service account privileges. The second vulnerability could allow denial of service if a specially crafted MAPI command is sent to a Microsoft Exchange Server. An attacker who successfully exploited this vulnerability could cause the Microsoft Exchange System Attendant service and other services that use the EMSMDB32 provider to stop responding.

The company says it expects to see “inconsistent exploit code” published for this bulletin. However, nCircle director of security operations Andrew Storms says this is a very serious problem.

“This vulnerability means that any cybercriminal sending a well crafted email attachment to an enterprise could gain complete control over the server and gaining one of the keys to the kingdom,” Storms said.

“All kinds of highly confidential and proprietary information pass through an Exchange server every day. Gaining control over it and its content would be a gold mine to any cyber criminal,” he added.

[Source: zdnet]

Routing and switching giant Cisco has released an alert to warn of multiple security flaws in some of its Wireless LAN controllers.

The company documented at least four vulnerabilities that could lead to denial-of-service or privilege escalation attacks. Affected product lines include Cisco Wireless LAN Controllers (WLCs), Cisco Catalyst 6500 Wireless Services Modules (WiSMs), and Cisco Catalyst 3750 Integrated Wireless LAN Controllers.

The skinny:

• CVE-2009-0058: Web authentication is a Layer 3 security feature that causes the
  controller to drop IP traffic (except DHCP and DNS related packets) from a
  particular client until that client has correctly supplied a valid username and
  password.
  
• CVE-2009-0059: An attacker may cause a device reload when sending a malformed post
  to the web authentication “login.html” page.
• CVE-2009-0061: Affected Cisco WLC, WiSM and Catalyst 3750 Wireless LAN Controller
  models are vulnerable to a DoS condition that is triggered by the receipt of
  certain IP packets. Upon receiving these IP packets, the affected device may
  become unresponsive and require a reboot to recover.
• CVE-2009-0062: A privilege escalation vulnerability exists only in WLC software
  version 4.2.173.0, and could allow a restricted user (i.e., Lobby Admin) to
  gain full administrative rights on the affected system.

One of these flaws carry a CVSS Base Score of 9.0, meaning it should be treated as a “high priority” update.

Mozilla’s flagship Firefox 3 browser has undergone another security makeover to fix at least 7 documented security vulnerabilities that expose users to malicious hacker attacks.

The Firefox 3.0.6 upgrade patches at least two critical Firefox flaws that may lead to arbitrary code execution attacks and another “high risk” bug that could be used to steal a victim’s data.

The raw details:

• MFSA 2009-06: Paul Nel reported that certain HTTP directives to not cache web pages, Cache-Control: no-store and Cache-Control: no-cache for HTTPS pages, were being ignored by Firefox 3. On a shared system, applications relying upon these HTTP directives could potentially expose private data. Another user on the system could use this vulnerability to view improperly cached pages containing private data by navigating the browser back.
• MFSA 2009-05: Developer and Mozilla community member Wladimir Palant reported that cookies marked HTTPOnly were readable by JavaScript via the XMLHttpRequest.getResponseHeader and APIs. This vulnerability bypasses the security mechanism provided by the HTTPOnly flag which intends to restrict JavaScript access to document.cookie. XMLHttpRequest.getAllResponseHeaders. The fix prevents the XMLHttpRequest feature from accessing the Set-Cookie and Set-Cookie2 headers of any response whether or not the HTTPOnly flag was set for those cookies.
• MFSA 2009-04: (Moderate severity) Mozilla security researcher Georgi Guninski reported that the fix for an earlier vulnerability reported by Liu Die Yu using local internet shortcut files to access other sites (MFSA 2008-47) could be bypassed by redirecting to a privileged about: URI such as about:plugins. If an attacker could get a victim to download two files, a malicious HTML file and a .desktop shortcut file, they could have the HTML document load a privileged chrome document via the shortcut and both documents would be treated as same origin. This vulnerability could potentially be used by an attacker to inject arbitrary code into the chrome document and execute with chrome privileges. Because this attack has relatively high complexity, the severity of this issue was determined to be moderate.
• MFSA 2009-03: (High severity) Mozilla security researcher moz_bug_r_a4 reported that a form input control’s type could be changed during the restoration of a closed tab. An attacker could set an input control’s text value to the path of a local file whose location was known to the attacker. If the tab was then closed and the victim persuaded to re-open it, upon restoring the tab the attacker could use this vulnerability to change the input type to file. Scripts in the page could then automatically submit the form and steal the contents of the user’s local file.
• MFSA 2009-02: (High severity) Mozilla security researcher moz_bug_r_a4 reported that a chrome XBL method can be used in conjuction with window.eval to execute arbitrary JavaScript within the context of another website, violating the same origin policy. Firefox 2 releases are not affected. Disable JavaScript until a version containing these fixes can be installed.
• MFSA 2009-01: (Rated Critical) Mozilla developers identified and fixed several stability bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these crashes showed evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code.

The patch is being released automatically via Firefox’s built-in update mechanism. This should be treated as a high-priority update for any user that has Firefox installed, whether you use the browser or not.

[Source: zdnet]

UPDATE: Google explains, blaming “human error.”

A major hiccup at Google this morning caused the entire Internet to be flagged as malware.

The problem appears to be centered around the Google Safe Browsing API — even that returned a “This site may harm your computer” warning (see screenshot below) — the security diagnostics service that powers Firefox’s malware blocking service.

There has been no official word from Google yet but the blogosphere and Twittersphere is abuzz with screenshots and complaints from unhappy Web surfers. (See Techmeme discussion).

For a short period during the hiccup, Firefox was blocking access to Web sites with the standard “This is an attack site!” warning.

With all the damaged reputations from this episode, how soon before we see a high-level warning about the dangers of the Google monoculture?

Apple today released QuickTime 7.6 to fix at least seven serious security flaws that expose Mac OS X and Windows users to remote code execution attacks.

The latest upgrade, available for Mac OS X v10.4.9 - v10.4.11, Mac OS X v10.5 or later, Windows Vista and Windows XP SP2 and SP3, covers vulnerabilities that could be exploited via malicious URLs or booby-trapped movie or audio files.

Here’s the skinny:

• CVE-2009-0001 — A heap buffer overflow exists in QuickTime’s handling of RTSP URLs. Accessing a maliciously crafted RTSP URL may lead to an unexpected application termination or arbitrary code execution.
• CVE-2009-0002 — A heap buffer overflow exists in QuickTime’s handling of THKD atoms in QTVR (QuickTime Virtual Reality) movie files. Viewing a maliciously crafted QTVR file may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking.
• CVE-2009-0003 — A heap buffer overflow may occur while processing an AVI movie file. Opening a maliciously crafted AVI movie file may lead to an unexpected application termination or arbitrary code execution.
• CVE-2009-0004 — A buffer overflow exists in the handling of MPEG-2 video files with MP3 audio content. Viewing a maliciously crafted
  movie file may lead to an unexpected application termination or arbitrary code execution.
• CVE-2009-0005 — A memory corruption exists in QuickTime’s handling of H.263 encoded movie files. Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution.
• CVE-2009-0006 — A signedness issue exists in QuickTime’s handling of Cinepak encoded movie files, which may result in a heap buffer
  overflow. Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution.
• CVE-2009-0007 — A heap buffer overflow exists in QuickTime’s handling of jpeg atoms in QuickTime movie files. Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution.

The patch is available via the software update utility on Mac OS X and the automatic-updating tool for Windows XP and Vista. Additionally, QuickTime 7.6 may be obtained from QuickTime Downloads site.

UPDATE: Apple issued a separate advisory for an input validation issue in the QuickTime MPEG-2 Playback Component for Windows:

• CVE-2009-0008 (available for Windows Vista, XP SP2 and SP3): Accessing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation of MPEG-2 files. This issue does not affect systems running Mac OS X.

Researchers at Intego have intercepted a Mac OS X malware threat circulating in pirated copies of Apple’s iWork 09 software.

The malicious file, dubbed OSX.Trojan.iServices.A, was found on BitTorrent trackers and other sites containing links to pirated software. The booby-trapped version of the iWord 09 productivity suite is complete and functional but the installer contains an additional package called iWorkServices.pkg, Intego said.

From the advisory:

When installing iWork 09, the iWorkServices package is installed. The installer for the Trojan horse is launched as soon as a user begins the installation of iWork, following the installer’s request of an administrator password (in older versions of Mac OS X, 10.5.1 or earlier, there will be no password request). This software is installed as a startup item (in /System/Library/StartupItems/iWorkServices, a location reserved normally for Apple startup items), where it has read-write-execute permissions for root. The malicious software connects to a remote server over the Internet; this means that a malicious user will be alerted that this Trojan horse is installed on different Macs, and will have the ability to connect to them and perform various actions remotely. The Trojan horse may also download additional components to an infected Mac.

[ Mac Attack: Porn video lures dropping DNS-changer Trojan ]

The company said at least 20,000 Mac users have already downloaded the rigged installer.

The risk of infection is serious, and users may face extremely serious consequences if their Macs are accessible to malicious users.

Although malware attacks on the Mac operating system have been limited, they do exist, especially on the DNS-changing front. Mac OS X users are urged to avoid downloading and installing software from untrusted sources or questionable Web sites.

[Source: zdnet]

Domain name registrar and web hosting provider GoDaddy.com, was hit by a DDoS attack on Wednesday affecting thousands of its shared hosting customers for several hours. GoDaddy’s Communications Manager Nick Fuller confirmed the attack originally speculated to be an “outage”, and responded to several questions about it.

Q: Was Wednesday’s GoDaddy.com “outage” an actual DDoS attack, and if so, how severe was it?

A: Wednesday, Go Daddy experienced a mutating type of DDOS attack.

Q: Could you provide us with more details on the DDoS attack itself, was it aimed at at disrupting GoDaddy’s entire infrastructure (email, DNS servers) or was it basically attacking GoDaddy.com’s webserver?

A: This attack was aimed at hosting servers.

Q: For how long was GoDaddy.com unreachable on Wednesday, and could you provide us with a rough estimate on the number of affected sites?

A: There was an intermittent service disruption to a small percentage of our hosting customers over a period of hours.

Q: This isn’t the first time that GoDaddy’s been hit with a DDoS attack. Do you attribute this pattern to GoDaddy’s popularity in the sense that unethical competition might be behind the attacks, or perhaps you have a different perspective on who and why attacked the company?

A: It’s our policy not to elaborate on any cyber attack. As you can appreciate, we don’t want to give attackers any information that could benefit them.

• Go through recent DDoS attack incidents - AlertPay hit by a large scale DDoS attack; BBC hit by a DDoS attack; Anti fraud site hit by a DDoS attack; Norwegian BitTorrent tracker under DDoS attack;

This isn’t the first time that GoDaddy is getting DDoS-ed. Similar attacks took place in 2005, and then again in 2007.

[Source: zdnet]

Ryan Naraine

Hackers can use booby-trapped PDF attachments sent to BlackBerry devices to launch malicious code execution attacks, according to warnings issued by Research in Motion (RIM).

The company shipped patches this week to address a pair of critical vulnerabilities affecting its enterprise product line.

The vulnerabilities are due to the improper processing of PDF files within the Distiller component of the BlackBerry Attachment Service, RIM said. Here are the raw details:

• KB17118: Multiple security vulnerabilities exist in the PDF distiller of some released versions of the BlackBerry Attachment Service. These vulnerabilities could enable a malicious individual to send an email message containing a specially crafted PDF file, which when opened for viewing on a BlackBerry smartphone, could cause memory corruption and possibly lead to arbitrary code execution on the computer that hosts the BlackBerry Attachment Service. These vulnerabilities each have a Common Vulnerability Scoring System (CVSS) score of 9.3.
• KB17119: Multiple security vulnerabilities exist in the PDF distiller of some released versions of the BlackBerry Attachment Service. These vulnerabilities could enable a malicious individual to send an email message containing a specially crafted PDF file, which when opened for viewing on a BlackBerry smartphone, could cause memory corruption and possibly lead to arbitrary code execution on the computer that hosts the BlackBerry Attachment Service. CVSS 9.3. RIM recommends that users upgrade to the latest version of the BlackBerry Unite! software.

RIM customers are strongly urged to apply the updates or implement the workarounds listed in the documents to help mitigate the risk.* Image source: edans’ Flickr photostream (Creative Commons 2.0)