4 X Security Team

This one goes out to all the remaining dial-up users all over the world. Be warned! Some cyber criminals will single you just because of it and you don’t want to have to fix the damage they’ll do. Right now you have a bull's-eye on your balls, because they’ll hit you where it hurts most.




The latest attack aimed at old school dial-up
users and that topped last year’s charts is with a Trojan dialer. It will attempt to stealthily disconnect the infected PC from the ISP in use and then reconnect it to another and much more expensive phone number, said Web User. Now, do you understand why I said it will hurt?

Kaspersky Labs, the same company that made the statistics mentioned above, said that as long as there’ll be dial-up, its users will be targets. "Dial-up is still relied upon for internet access and cybercriminals are continuing to target those who are vulnerable to attack," David Emm said.

Take the United Kingdom, for example, where 11.6 percent of the total Internet users are subscribed to a dial-up service, and calculate the impact a massive attack of these Trojans would have in a single country. And then, consider the 9.6 million subscribers that AOL still has and think about the effect of somebody bringing the little bugger to one of the servers, from where it can send itself to all the users. I’m not ahead of my time, if it can disconnect and then reconnect somewhere else, a little code and it’ll email itself to anyone.

"Internet users, whether dial-up or broadband, should ensure they have an internet security regime including regular scheduled malware updates, heuristic analysis and real-time behaviour blocking, to ensure detection and protection against known and unknown threats," Kaspersky Labs’ Emm warned.

Oh, and let’s not forget what Trojans are really good at, namely opening your computer to other malware auto-installing itself. If your protection is not up-to-date, you’re one dial away from being a part of the Storm botnet without knowing it

[Source: softpedia]

Opera is one of the browsers which somehow managed to get closer to the two kings of the browsers, Internet Explorer and Firefox, attracting more audience every day. However, a growing popularity doesn't necessarily mean that a certain application is 100 percent secure because it has bugs too and they must be fixed quickly enough to avoid all potential exploits.

This is the case of the report you're about to see because
older versions of the browser are vulnerable to some highly critical vulnerabilities confirmed by its developers. This is not the first time when Opera is the subject of security notifications but what's important is that the company manages to fix them quite quickly without putting users' information at risk.

Security company Secunia wrote that a potential successful exploitation of the flaws might allow the attackers to execute arbitrary code and get the affected system even more vulnerable. Here's the description of the two vulnerabilities as published by Secunia:


1) An error when prompting the user to add a newsfeed can be exploited to cause an invalid memory access via a specially crafted newsfeed source.
2) An error exists in the processing of HTML CANVAS elements. This can be exploited to cause a memory corruption via specially crafted scaled pattern images.

The folks at Opera Software have already confirmed the flaws, which have been rated as moderately severe and highly severe, and released an updated version of the browser in order to correct the vulnerabilities. In case you're currently using Opera Browser and you'd want to patch it (you MUST want to patch it because leaving it vulnerable may threat the security of your computer), you have to download or update the browser to the latest release, namely the 9.27 edition.

Just as usual, you can download the latest version of the browser, as well as many other applications, straight from Softpedia, using this link.
 

[Source: softpedia]

VLC Media Player is quite a popular application nowadays, especially because it provides a remarkable functionality bundled with a freeware license. This
means that users are able to take advantage of its applaudable functions without paying for the software, as in the case of other programs on the market.

However, users of older versions of VLC Media Player are urged to update to the latest version of the application because a security flaw has been spotted in these releases. Calling it "VLC Media Player Browser Plugin Arbitrary File Overwrite Vulnerability," the folks of SecurityFocus explained that VLC Media Player 0.8.6, 0.8.6a, 0.8.6b and several edition of the program addressed to Debian Linux are all vulnerable.

The only version not vulnerable to this security flaw is VLC Media Player 0.8.6d which was especially rolled out by VideoLAN to correct the glitch.

"VLC media player is prone to a vulnerability that allows attackers to overwrite arbitrary files.
Successful exploits can compromise the computer or cause denial-of-service conditions. Versions prior to VLC media player 0.8.6d are vulnerable," SecurityFocus explained in the security advisory published on its main page.

At this time, there's no confirmation of a potential successful exploitation of the flaw, but consumers who are currently using older releases of VLC Media Player should update the application as soon as possible.

VLC Media Player supports a large series of formats, starting with 3GP, AVI, QuickTime, WAV and MP3 and ending with AAC, AC3, AMR, FLAC and WMA. Unfortunately, the application can't open or play the files based on RealMedia, Fraps and MIDI codecs.

For those of you who want to download the latest release of VLC Media Player, you can find it right here on Softpedia by clicking on the following link.

[Source: softpedia]

RealPlayer has always managed to remain in the spotlight, but not only with good things as the applications has been often the subject of security advisories published on the web. Today, it’s the time. It’s the time when RealPlayer is once again vulnerable to attacks and it seems like this time, it may be a serious one. Security company
Secunia published a notification entitled "RealPlayer Unspecified Buffer Overflow Vulnerability", stating that it can be easily used to compromise an affected computer.

Article: Unpatched RealPlayer = Your Worst Nightmare
Comments: RealPlayer in action

"The vulnerability is caused due to an unspecified error and can be exploited to cause a buffer overflow. No further information is available. Successful exploitation allows execution of arbitrary code", Secunia wrote in the advisory.

It seems like the only affected version is RealPlayer 11 build 6.0.14.748. US-CERT also published a security alert informing the users that they were "aware of a public report stating that working exploit code is available for RealPlayer."

Obviously, RealNetworks, the creators of the application, has been informed about the vulnerability and started an investigation on the report. The developers claim that a Russian security company discovered the exploit and published it on the web, which is pretty dangerous for all the RealPlayer users. "It seems they just wrote a script and decided to post it and say, 'Hey, we can do this'," Ryan Luckin, a RealNetworks spokesman, told SCMagazineUS.com.

In case you’re one of those affected users, you’re probably looking for a solution to avoid a potential exploitation and remain secure while using the program. Until an official fix released by the RealPlayer developers, you’re advised to avoid opening "untrusted media files or browse untrusted websites", as Secunia mentioned in the security notification.

If you’d like to download the latest version of RealPlayer, you can take it straight from Softpedia using this link.


[Source: softpedia]

uTorrent, one of the most popular BitTorrent download clients available on the web, must be updated as soon as possible as a new vulnerability has been discovered in
the application. SecurityFocus today reported that certain releases of both BitTorrent and uTorrent include a "peers windows remote denial of service vulnerability."

Article: uTorrent Must Be Updated ASAP!
Comments: uTorrent in action

According to the report, uTorrent 1.7.5, 1.6.1, 1.6 and BitTorrent 6.0 are all affected by the glitch, but previous versions might be also vulnerable. The only version which seems to be avoided by the vulnerability is uTorrent 1.7.6, so users of this release can employ their BitTorrent client as safe as anytime before.

"BitTorrent and uTorrent are prone to a remote denial-of-service vulnerability because the applications fail to perform adequate boundary checks on user-supplied data. Attackers can exploit this issue to crash the affected application, denying service to legitimate user," SecurityFocus explained in the advisory.

Both applications are extremely popular in a virtual world dominated by peer-to-peer and file sharing software solutions. To prove you that, here's some statistics provided by our Windows downloads section available right here on Softpedia: BitTorrent, a p2p file sharing client available for multiple platforms including Windows, Mac OS X and Linux, has recorded no less than 480,744 while uTorrent has attracted 449,044 hits. And keep in mind that uTorrent has only 254 KB!

In case you're one of the vulnerable users out there, you're probably looking for a solution to patch and correct the flaw. According to reports, uTorrent can be easily fixed by deploying the latest version of the application, especially designed by the vendor to repair the reported vulnerability.

If you want to download the latest uTorrent release, you can take it straight from Softpedia using the following link. Also, the newest version of BitTorrent can be found here.

[Source: softpedia]

The Internet really needs a watchdog because the amount of malware heading our way, and by that I mean the inexperienced public, there's no way we could fend all of the attacks on our own, with just some anti-virus, be it upgraded on a regular basis. McAfee and the other security software vendors are going that extra mile and are warning users of most, if not all, of the dangers that lurk in the Internet shadows.

Phishing is one of the shrewdest types of cyber crime there is. It tricks
the average Internet Joe into disclosing his personal information and then cleans him out. The latest such scheme surfaced in the United Kingdom, and it targets the victims of the HM Revenue and Customs data-loss scandal. The email promises a tax rebate of £215 for those willing to send personal information in a reply.

Of course, the cyber criminals aren't so upfront about it, claiming a refund for the HMRC scandal is well documented and very credible, and sending the bank details seems to be just natural in order to receive the money. If you have received such an email, McAfee security analyst Greg Day suggests that it be deleted right away. "This phishing attack has echoes of traditional get-rich-quick scams, preying on those keen to be compensated for the government losing their data. However, people must learn that there really is no such thing as free money," he says.

"Recent high-profile data loss incidents have left the public more vigilant about handing over information that has any link to HMRC, so this may not be the most thoroughly considered phishing attack," Day continued. Pretty ironic, isn't it? Ask for personal information from those hurt by giving it away in the first place. If the phishers aren't counting on one of those reverse psychology thingies shrinks tend to use, it won't really catch on. Nevertheless, the warning is out.

[Source: softpedia]

Windows is by far the most used operating system in the world, and as a direct result, it is targeted the most by cyberattacks, that take advantage of any flaw they
might find. Microsoft is regularly issuing updates that patch the security liabilities, but the software company cannot keep up with the rate at which the holes are being discovered.

The latest warning issued by the Redmond-based company regards Microsoft Word, and a flaw that was discovered as being used by malware producing individuals to install their software on a target victim’s computer. A MS security advisory says that users should "not open or save Word files that you receive from untrusted sources or that you receive unexpectedly from trusted sources." The risk presented by this hole in security, however, is not believed to be major, as "current attacks require customers to take multiple steps in order to be successful." Nevertheless, the possibility of additional and refined methods of attempting to send the malicious code via this flaw lying in the Jet Database Engine, was not excluded, and the team in charge with patching it is currently studying which other services might find themselves vulnerable.

Everybody running the 2000, 2002, 2003 and 2007 versions of Word are a potential target, unless the operating system used is Microsoft Server 2003 and Microsoft Vista, which have been shipped with a newer version of the Jet Database Engine. Any version of Msjet40.dll that is lower than 4.0.9505.0 will make an excellent target for Cybercriminals, and an emergency patch might be rolled out in order to plug it, ahead of the next security updates, expected on the 8th of April.

Should an attack be successful, the same user rights as the local user will be granted to the one conducting the process, but it will only impact heavily on those having administrator rights on the computer, while the accounts configured to have fewer user rights will be less affected.

[Source: softpedia]

Avast is quite a popular antivirus especially thanks to its freeware license which allows consumers to take advantage of its remarkable features without paying for them. And this happens in a market dominated by top security products such as Kaspersky Antivirus and
Norton Antivirus, which require users to buy a license in order to use them. But getting back to Avast, in case you're one of its users, you must update the application as soon as possible because older versions of the program contain a security flaw which may represent a real danger for computers.

Article: Avast Users Must Update Their Antivirus ASAP!
Comments: Avast Antivirus at work


Security company Secunia released an advisory confirming that a less critical vulnerability exists in Avast Antivirus, urging users to update to version 4.8.1169.

"Tobias Klein has reported a vulnerability in avast! Home/Professional, which can be exploited by malicious, local users to gain escalated privileges. An input validation error within the 0xb2d60030 IOCTL handler of the aavmker4.sys driver can be exploited e.g. to overwrite arbitrary kernel memory via a specially crafted IOCTL request," it is mentioned in the notification published by Secunia.

Although the vulnerability has been confirmed in version 4.7, it may also exist in other releases of the application, so updating to the latest edition is probably the best idea.

Avast Antivirus recorded a pretty remarkable number of downloads, no matter if we're talking about its official website or software download pages. On Softpedia.com for example, avast! 4 Professional Edition 4.7.1098 has 102,222 hits while avast! 4 Home Edition 4.8.1169 attracted 192,079 downloads. Two of its rivals, Kaspersky Anti-Virus Personal Pro 6.0.2.621 and BitDefender Antivirus Plus 10.2 Final, attracted no less than 223,044 and 221,553 hits.

In case you want to download the latest version of Avast Antivirus, you can take it straight from Softpedia using the following link.

[Source: softpedia]

Symantec is one of the most powerful security companies on the market, providing an impressive number of products installed on millions of computers around the world. But what happens if there's a vulnerability in one of its solutions? This means that a huge number of
users instantly become defenseless to attacks and Symantec's employees have to struggle to keep them on the safe side. This is exactly what happened a few days ago when two vulnerabilities were reported in an ActiveX control, multiple products being affected.

Article: Norton Antivirus and Norton 360 Vulnerable - Patch Inside!
Comments: Norton 360 at work

Among the damaged solutions, we can mention Norton 360 1.0, Norton Antivirus 2006-2008, Norton Internet Security 2006-2008 and Norton System Works 2006-2008, all of them for the Windows platform. Norton 360 2.0, Norton Antivirus for Macintosh, Norton Internet Security for Mac, Norton Personal Firewall for Mac and Norton Smartphone Security for Windows are all secure.

Symantec has already confirmed the vulnerabilities and provided details for both of them:

1. The first, reported by Peter Vreugdenhill, is a stack based buffer overflow which could allow a successful attacker to run code of their choice in the context of the user’s browser. The user must be enticed to visit a malicious website masquerading as a trusted Symantec site before an attack can be launched.

2. The second occurs due to a design error in the process used to look for and launch the AutoFix Tool. If successfully exploited, an attacker could load and execute code of their choice from a remote share. However, this can occur only if the target system (user’s system) is configured to allow access to remote shares via WebDav or SMB.

In order to patch your vulnerable security software provided by Symantec (please check that your product is among the vulnerable ones), click on this link and follow the instructions provided by the security company.

[Source: softpedia]

Security company Secunia has just published an advisory reporting a Subtitle Parsing Buffer Overflow vulnerability in DivX player, a quite popular
software solution on the web. According to Secunia's notification, the vulnerability has been confirmed to exist in DivX Player 6.7 (build 6.7.0.22), but previous releases may be affected as well. Although the developers of the program haven't yet released a patch or a fix to correct the issue, Secunia provided a solution which could be put into practice by all the users of the application: disable the automatic loading of subtitles and avoid opening suspicious or unknown subtitles coming from mistrusted sources.

Article: DivX Player Vulnerability Confirmed
Comments: Such a feature should exist in all software programs

"Securfrog has discovered a vulnerability in DivX Player, which can potentially be exploited by malicious people to compromise a user's system. The vulnerability is caused due to a boundary error in the processing of subtitles. This can be exploited to cause a stack-based buffer overflow via an overly long subtitle line contained in a malicious SRT file," Secunia wrote in the advisory published today. "Successful exploitation may allow execution of arbitrary code, but requires that the user is tricked into opening a specially crafted SRT file."

Secunia rated the flaw as highly critical, which underlines the level of the vulnerability and the need to patch it as soon as possible. However, due to the fact that developers haven't released a patch yet, you should really try to apply the solution mentioned above in order to be sure you remain on the safe side.

As you probably know, software vulnerabilities have always been one of the main problems for users who wanted to remain secure and, even if they kept the antivirus and the other security tools up-to-date, they still got their computer hacked or compromised. That's why it's pretty important to always install the latest software versions and apply the provided patches as soon as they're released.

[Source: softpedia]

Users of BitDefender Antivirus 2008 are asked to update their security application as soon as possible because a new security vulnerability was discovered,
according to several reports. Security company Secunia, which rated the flaw as not critical, said that while the vulnerability was confirmed in BitDefender Antivirus 2008 build 11.0.1, other versions of the antivirus may be affected as well. According to the same advisory, a successful exploit of the flaw would allow an attacker to cause a Denial of Service over BitDefender Antivirus.

Article: BitDefender Antivirus 2008 Needs Updates
Comments: The BitDefender Antivirus 2008 package

BitDefender Antivirus 2008 has acknowledged its vulnerability and provided more information on it. "This vulnerability consists in a denial of services that could be exploited locally. The file affected by this security issue included a function with insufficient parameter validation," a notification published on the BitDefender website reads.

The parent company has already fixed the flaw, so all the users of the security application are asked to apply the update function to get the latest patches that correct the issue. However, BitDefender 2008 clients usually receive the updates automatically but, in case the feature is disabled, manual update is required. Please note that only the Windows operating systems are affected by the flaw, namely Windows 2000, Windows Vista and Windows XP.

"The vulnerability has been solved and all BitDefender 2008 editions have been updated via automatic update. You can also manually update BitDefender by selecting Update now from the BitDefender Security Center (main window)," BitDefender explained.

If you wish to download the latest version of BitDefender Antivirus 2008, the one which already includes the newest security patches, you can take it straight from Softpedia using the following link. And don't forget to enable the auto-update features if you want to remain on the safe side and receive the latest updates as soon as they are rolled out.

[Source: softpedia]

Comodo Firewall Pro, a freeware firewall which attracted quite a large audience, needs to be updated as soon as possible in order to avoid a new vulnerability spotted
in older versions. Security company Secunia rated the flaw as not critical, but it stated that a successful exploit of the flaw could cause a Denial of Service. According to the same advisory, the vulnerability has been confirmed in version 2.4.18.184 but other releases may be affected as well.

Core Security reported that this is the same vulnerability spotted in some other security products, including here BitDefender Antivirus, Sophos Antivirus and Rising Antivirus. Consumers who are currently using the mentioned vulnerable version are advised to update to version 3.0 which is said to include the fix that corrects the reported vulnerability.

"Insufficient argument validation of hooked SSDT functions on multiple Antivirus and Firewalls (BitDefender Antivirus, Comodo Firewall, Sophos Antivirus and Rising Antivirus) have been found that could lead to a Denial of Service (DoS) and possibly to code execution attacks. An attacker, utilizing these flaws, could be able to locally reboot the whole system shutting down the firewall or anti-virus protection. However, in some cases it may be possible to extend the impact of these bugs, and they could lead to the execution of arbitrary code in the privileged kernel mode," Core Security wrote in the advisory published yesterday.

Comodo Firewall Pro is quite a popular security product, the main proof being the number of downloads it recorded on the web. On Softpedia for instance, Comodo Firewall Pro brought no less than 60,845 hits. However, some users applaud the performance provided by Comodo while others advice consumers looking for a firewall to try a different product.

"Comodo is the best and it's free! I used ZoneAlarm and my system crashed every few days, and some true vector problem, now my roomate and I use Comodo on our computers and have no problems. I would give Comodo rate 11 of 10," a user nicknamed Davor said in a comment posted on Softpedia.

"System became extremely slow and unstable, taskbar disappeared from desktop, other security programs vanished, startup and shutdown took forever. Uninstalled Comodo and re-installed ZA and some others - all problems went away," Xenomorph commented.

However, if you're one of the users who like it, you can download the latest version of Comodo, the one which is said to contain all the fixes, using this link.

[Source: softpedia]

It seems that Adobe Acrobat Reader and Professional users have been and probably still are vulnerable to dangerous attacks. The vulnerability has been discovered by one of the largest
security company, Symantec. According to Symantec's webpage, the security issue is part of the Neosploit exploit toolkit and has been created to take advantage of a February 2008 vulnerability in the above mentioned Adobe applications.

Article: Adobe Acrobat Reader and Professional Vulnerability Reported
Comments: Adobe Reader in action

Almost any browser you may use is vulnerable to this attack vector, which has been designed to work relatively silently. A user only needs to browse the Internet using whatever browser is available on a computer with Adobe's Acrobat previously installed. After these conditions are carried out, the user is lured to unprotected websites leaving his computer infected. The way this exploit works is largely familiar, as an increased number of websites bring pop-up windows that you end up clicking without choice.

What you need to do in order to ensure that you aren't affected by this exploit is to upgrade to the latest Adobe Acrobat and Reader. The 8.1.2 version is said to be secure and everything prior to this release will most likely render you vulnerable to attacks. Being the company that has discovered the vulnerability, Symantec has worked alongside Adobe's Security team in order to make this last patch safe. Any user of Symantec's IPS-enabled client will be protected, as the application will prevent this PDF attack and will recognize it as HTTP Malicious Toolkit Download Activity or Trojan.Pidief.C, depending on the used client.

Adobe's products usually have an upgrade session, but it is wiser to manually install the new patch as soon as possible. Doing so will make your computer safe from any potential attack, which will unlikely be noticeable. You can download the program, right here at Sofpedia using this link.

[Source: softpedia]

Security researchers at Core Security Technologies have issued a warning statement on Monday according to which they found a rare vulnerability in Wonderware subsidiary's InTouch SuiteLink application. Wonderware, a business unit of Invensys, is a software manufacturer that offers solutions to business users in areas such as Production and Performance Management, Geographical SCADA and Supervisory HMI (Human-Machine Interface).

Core Security found the vulnerability in Wonderware SuiteLink Service and it is said that the flaw allows the interference of an unauthenticated remote control that could shutdown the service. This means that a hacker could breach the SCADA (Supervisory Control And Data Acquisition) application by connecting to a SuiteLink service TCP port. The vulnerability hasn't been proven to allow remote code execution but according to Core Security, a potential scenario hasn't been excluded.

According to the Security company, systems running WonderWare SuiteLink prior to version 2.0 Patch 01 are susceptible to the reported bug. While testing a system running WonderWare InTouch 8, Sebastian Muniz from the Exploit Writers Team, has discovered the above mentioned vulnerability. According to the American National Institute of Standards and Technology (NIST), the bug has been reported as being a high-risk one. Wonderware has made available to its registered customers a technical document addressing this issue.

With consumer and business software applications this sort of breaches are somewhat common. Bugs involving SCADA applications aren't that frequent, but they can cause a lot of damage. There are a number of security companies that try to develop protective software applications for SCADA systems.

According to Wonderware's website "one third of the world's plants run Wonderware software solutions.". A hacking attack that could make use of the discovered vulnerability will most certainly cause some serious damage on a worldwide scale. Wonderware customers still running systems using SuiteLink 2.0 Patch 01 should contact the company website for more information.

[Source: softpedia]

Trillian is one of the most popular instant messaging clients namely thanks to the fact that it supports multiple instant messaging protocols, including Yahoo
Messenger, MSN Messenger, Jabber and many others. However, users of Trillian are advised to update the application as soon as possible to the latest version of the program due to several vulnerabilities found in previous releases, Secunia wrote in a notification published today. No less than three security glitches were discovered in Trillian, all of them allowing a potential attacker to compromise the affected system.

Article: Vulnerabilities Detected in Trillian, Update Required
Comments: Trillian in action

Here are the three security vulnerabilities explained by Secunia:

"A boundary error within the header parsing code for the MSN protocol can be exploited to cause a stack-based buffer overflow via a specially crafted X-MMS-IM-FORMAT header with an overly long attribute."

"An error within the XML parsing in talk.dll can be exploited to cause a memory corruption via certain malformed attributes within an 'IMG' tag."

"A boundary error when parsing messages (e.g. via the AIM network) with overly long attribute values within the FONT tag can be exploited to cause a stack-based buffer overflow."

All the three vulnerabilities allow the execution of arbitrary codes but only the last one requires the attacker to lure vulnerable users into opening a malicious picture that could permit him to compromise their computers.

As mentioned, the update to Trillian 3.1.10.0 is the only way to stay on the safe side and avoid a potential exploit of the security glitches reported today by Secunia. Moreover, note that both Trillian Basic and Trillian Pro are affected by the glitches. If you wish to download the latest versions of Trillian Basic and Pro, you can find both of them on our Windows download section, right here, on Softpedia.

[Source: softpedia]