* Microsoft .NET Framework Remote Code Execution Exploit (MS09-061)
This remote code execution exploit takes advantage of a vulnerability
in Microsoft .NET Framework when processing certain code e.g. in
a XAML browser application (XBAP).
CVE ID: CVE-2009-0091
* Adobe Reader U3D Clod Declaration Code Execution Exploit (APSB09-15)
This code execution exploit takes advantage of an array indexing
vulnerability in Adobe Reader when processing U3D Clod Declarations
within a PDF file.
CVE ID: CVE-2009-2994
* Microsoft Internet Explorer Remote Memory Corruption PoC (MS09-052)
This code demonstrates a memory corruption vulnerability in Microsoft
Internet Explorer when processing certain HTML elements.
CVE ID: CVE-2009-2531
Showing posts with label Security Vulnerabilities. Show all posts
Showing posts with label Security Vulnerabilities. Show all posts
Friday, October 30, 2009
Monday, October 19, 2009
DHS Web sites vulnerable to hackers, IG says
The Homeland Security Department’s most popular Web sites appear to be vulnerable to hackers and could put department data at risk of loss or unauthorized use, according to a new report from DHS Inspector General Richard Skinner.
“These vulnerabilities could put DHS data at risk,” Skinner wrote in the report issued Oct. 8. “In addition, DHS can make improvements in managing its system inventory and providing technical oversight and guidance in order to evaluate the security threats to its public-facing Web sites.”
Read More...
“These vulnerabilities could put DHS data at risk,” Skinner wrote in the report issued Oct. 8. “In addition, DHS can make improvements in managing its system inventory and providing technical oversight and guidance in order to evaluate the security threats to its public-facing Web sites.”
Read More...
Monday, July 13, 2009
Vulnerability in Microsoft Video ActiveX Control Could Allow Remote Code Execution
Microsoft is investigating a privately reported vulnerability in Microsoft Video ActiveX Control. An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. When using Internet Explorer, code execution is remote and may not require any user intervention.
We are aware of attacks attempting to exploit the vulnerability.
Our investigation has shown that there are no by-design uses for this ActiveX Control in Internet Explorer which includes all of the Class Identifiers within the msvidctl.dll that hosts this ActiveX Control. For Windows XP and Windows Server 2003 customers, Microsoft is recommending removing support for this ActiveX Control within Internet Explorer using all the Class Identifiers listed in the Workaround section. Though unaffected by this vulnerability, Microsoft is recommending that Windows Vista and Windows Server 2008 customers remove support for this ActiveX Control within Internet Explorer using the same Class Identifiers as a defense-in-depth measure.
Read more...
We are aware of attacks attempting to exploit the vulnerability.
Our investigation has shown that there are no by-design uses for this ActiveX Control in Internet Explorer which includes all of the Class Identifiers within the msvidctl.dll that hosts this ActiveX Control. For Windows XP and Windows Server 2003 customers, Microsoft is recommending removing support for this ActiveX Control within Internet Explorer using all the Class Identifiers listed in the Workaround section. Though unaffected by this vulnerability, Microsoft is recommending that Windows Vista and Windows Server 2008 customers remove support for this ActiveX Control within Internet Explorer using the same Class Identifiers as a defense-in-depth measure.
Read more...
Monday, July 6, 2009
Microsoft warns of hole in Video ActiveX control
"Microsoft on Monday warned of a vulnerability in its Video ActiveX Control that could allow an attacker to take control of a PC if the user visits a malicious Web site.
There have been limited attacks exploiting the hole, which affects Windows XP and Windows Server 2003, Microsoft said on its Security Response Center blog.
This is the second DirectShow security hole Microsoft has announced in the past few months. The company has yet to provide a security update for a vulnerability announced in May that involves the way DirectX handles QuickTime files."
There have been limited attacks exploiting the hole, which affects Windows XP and Windows Server 2003, Microsoft said on its Security Response Center blog.
This is the second DirectShow security hole Microsoft has announced in the past few months. The company has yet to provide a security update for a vulnerability announced in May that involves the way DirectX handles QuickTime files."
Saturday, May 30, 2009
Critical Windows vulnerability under attack, Microsoft warns
Posted in Anti-Virus, 28th May 2009 22:37 GMT
Microsoft has warned of a critical security bug in older versions of its Windows operating system that is already being exploited in the wild to remotely execute malware on vulnerable machines.
The vulnerability in a Windows component known as DirectX is being targeted using booby-trapped QuickTime files, which when parsed can allow attackers to gain complete control of a computer. Because many browsers are designed to automatically play video, people can be compromised simply by visiting a site serving malicious files. Vista, Windows Server 2008 and the beta version of Windows 7 are not affected, and neither is Apple's QuickTime player, Microsoft said.
Read more...
Microsoft has warned of a critical security bug in older versions of its Windows operating system that is already being exploited in the wild to remotely execute malware on vulnerable machines.
The vulnerability in a Windows component known as DirectX is being targeted using booby-trapped QuickTime files, which when parsed can allow attackers to gain complete control of a computer. Because many browsers are designed to automatically play video, people can be compromised simply by visiting a site serving malicious files. Vista, Windows Server 2008 and the beta version of Windows 7 are not affected, and neither is Apple's QuickTime player, Microsoft said.
Read more...
Thursday, March 26, 2009
Firefox critical vulnerability patched in 3.0.8, due next week
A new vulnerability has just been found in Firefox. The vulnerability, discovered by security researcher Guido Landi, was published on several security sites on Wednesday the 25th. The flaw could be used by an attacker to remotely execute code on a users machine using remote memory corruption after a user views a specially crafted malicious XML file. Read more...
Tuesday, March 10, 2009
Recent exploits evade Adobe's countermeasures; patch not ready
March 6, 2009 (Computerworld) An unpatched bug in popular PDF viewing and editing applications is much more dangerous than first thought, according to security researchers who have created exploits that sidestep Adobe's defensive recommendations.
Last week, a researcher who works at the Danish vulnerability tracker Secunia said he had come up with an exploit that didn't rely on JavaScript. Read more..
Last week, a researcher who works at the Danish vulnerability tracker Secunia said he had come up with an exploit that didn't rely on JavaScript. Read more..
Thursday, February 12, 2009
New Vulnerability Found in Blackberry's
Feb 11, 2009 | 05:29 PM
By Tim WilsonDarkReading
Just a few weeks after President Obama won his fight to keep his BlackBerry, the handheld's security is causing concern again.
BlackBerry maker Research In Motion this week is warning users about a newly discovered vulnerability that could potentially enable an attacker to gain remote control of the device or crash its browser.Read More...
Work around and Fixes
http://www.blackberry.com/btsc/search.do?cmd=displayKC&docType=kc&externalId=KB16248
Wednesday, January 14, 2009
RealVNC 4.1.2 'vncviewer.exe' RFB Protocol Remote Code Execution Vulnerability
RealVNC Viewer is prone to a remote code-execution vulnerability because it fails to adequately handle certain encoding types.
An attacker can exploit this issue to execute arbitrary code in the context of the vulnerable process. Failed exploit attempts are likely to result in denial-of-service conditions.
This issue may be related to the vulnerability discussed in BID 30499 (RealVNC 4.1.2 'vncviewer.exe' Remote Denial of Service Vulnerability).
RealVNC 4.1.2 is vulnerable; earlier versions may also be affected.
Read more...
An attacker can exploit this issue to execute arbitrary code in the context of the vulnerable process. Failed exploit attempts are likely to result in denial-of-service conditions.
This issue may be related to the vulnerability discussed in BID 30499 (RealVNC 4.1.2 'vncviewer.exe' Remote Denial of Service Vulnerability).
RealVNC 4.1.2 is vulnerable; earlier versions may also be affected.
Read more...
Tuesday, January 13, 2009
Serious security vulnerability in Safari web browser reported
An open source software engineer with a history of uncovering flaws in Mac OS X, claims to have uncovered a security vulnerability in Apple’s web browser Safari, affecting both Windows and Apple Mac users. Read more...
Tuesday, December 16, 2008
Serious security flaw found in IE
"Users of Microsoft's Internet Explorer are being urged by experts to switch to a rival until a serious security flaw has been fixed." Read more...
Subscribe to:
Posts (Atom)
