New Banking Trojan Horses Gain Polish

Criminals today can hijack active online banking sessions, and new Trojan horses can fake the account balance to prevent victims from seeing that they're being defrauded.

Traditionally, such malware stole usernames and passwords for specific banks; but the criminal had to access the compromised account manually to withdraw funds. To stop those attacks, financial services developed authentication methods such as device ID, geolocation, and challenging questions.

Unfortunately, criminals facing those obstacles have gotten smarter, too. One Trojan horse, URLzone, is so advanced that security vendor Finjan sees it as a next-generation program.
Greater Sophistication

Banking attacks today are much stealthier and occur in real time. Unlike keyloggers, which merely re­­cord your keystrokes, URLzone lets crooks log in, supply the required authentication, and hijack the session by spoofing the bank pages. The assaults are known as man-in-the-middle attacks because the victim and the attacker access the account at the same time, and a victim may not even notice anything out of the ordinary with their account.

http://www.pcworld.com/article/182889/banking_trojan_horses.html?tk=rss_news

Microsoft Internet Explorer CSS Handling Code Execution Vulnerability (0day)

Title : Microsoft Internet Explorer CSS Handling Code Execution Vulnerability (0day)
VUPEN ID : VUPEN/ADV-2009-3301
CVE ID : GENERIC-MAP-NOMATCH
CWE ID : VUPEN VNS Only
CVSS V2 : VUPEN VNS Only
Rated as : Critical
Remotely Exploitable : Yes
Locally Exploitable : Yes
Release Date : 2009-11-21




A vulnerability has been identified in Microsoft Internet Explorer, which could be exploited by attackers to compromise a vulnerable system. This issue is caused by a dangling pointer in the Microsoft HTML Viewer (mshtml.dll) when retrieving certain CSS/STYLE objects via the "getElementsByTagName()" method, which could allow attackers to crash an affected browser or execute arbitrary code by tricking a user into visiting a malicious web page.

VUPEN has confirmed the vulnerability on fully patched Windows XP SP3 systems with Internet Explorer 7 and 6.

Affected Products

Microsoft Internet Explorer 7
Microsoft Internet Explorer 6

Solution

Disable Active Scripting in the Internet and Local intranet security zones.

VUPEN Security is not aware of any vendor-supplied patch.

References

http://www.vupen.com/english/advisories/2009/3301

Windows SMB Subject to Denial-of-Service Attack Windows 7

Microsoft is continuing to investigate holes in its Server Message Block (SMB) file-sharing protocol used in Windows.

Late Friday, Microsoft put out a yet another Security Advisory, saying it was looking into "new public reports of a denial-of-service vulnerability" in SMB.

The reported exploits touch SMBv1 and SMBv2 on Windows 7 and Windows Server 2008 R2 operating systems, according to the software giant.

Vista, Windows Server 2008, XP, Windows Server 2003 and Windows 2000 are not affected.

"Microsoft is aware of public, detailed exploit code that would cause a system to stop functioning or become unreliable," said Dave Forstrom, a spokesman for Microsoft Trustworthy Computing. "If exploited, this DoS vulnerability would not allow an attacker to take control of, or install malware on, the customer's system but could cause the affected system to stop responding until manually restarted."

Last Friday's advisory is the second such advisory since Redmond released one in September. This also marks the second time in as many months that news about vulnerabilities in the SMB program has emerged.

Forstrom said the default firewall settings on Windows 7 will help block attempts to exploit this latest DoS issue.

He added that while Microsoft is not currently aware of active attacks, customers should "review and implement the workarounds outlined in the advisory until a comprehensive security update is released."

http://mcpmag.com/articles/2009/11/16/windows-smb-subject-to-denial-of-service-attack.aspx

New Vulnerabilities Microsoft / Adobe

* Microsoft .NET Framework Remote Code Execution Exploit (MS09-061)

This remote code execution exploit takes advantage of a vulnerability
in Microsoft .NET Framework when processing certain code e.g. in
a XAML browser application (XBAP).

CVE ID: CVE-2009-0091


* Adobe Reader U3D Clod Declaration Code Execution Exploit (APSB09-15)

This code execution exploit takes advantage of an array indexing
vulnerability in Adobe Reader when processing U3D Clod Declarations
within a PDF file.

CVE ID: CVE-2009-2994


* Microsoft Internet Explorer Remote Memory Corruption PoC (MS09-052)

This code demonstrates a memory corruption vulnerability in Microsoft
Internet Explorer when processing certain HTML elements.


CVE ID: CVE-2009-2531

Mozilla Firefox Code Execution and Information Disclosure Vulnerabilities

Multiple vulnerabilities have been identified in Mozilla Firefox,
which could be exploited by attackers to manipulate or disclose
certain data, bypass security restrictions or compromise a vulnerable
system.

The first issue is caused by an error within the form history, which
could allow malicious web sites to trick a vulnerable browser into
auto-filling form fields with history entries and then reading the
entries.

The second vulnerability is caused due to a predictable file naming
scheme being used to download a file which already exists in the
downloads folder, which could allow an attacker with access to a
vulnerable system to place a malicious file in the world-writable
directory used to save temporary downloaded files and cause the
browser to open it.

The third issue is caused by a memory corruption error within the
processing of recursive web-worker calls, which could be exploited to
crash an affected browser or execute arbitrary code.

The fourth vulnerability is caused by a memory corruption error within
the parsing of regular expressions used in Proxy Auto-configuration
(PAC) files, which could allow attackers to crash an affected browser
or execute arbitrary code on a system where PAC has been configured
with specific regular expresssions.

The fifth issue is caused by a heap overflow error in the GIF image
parser, which could be exploited to crash an affected browser or
execute arbitrary code.

The sixth vulnerability is caused due to the XPCOM utility
"XPCVariant::VariantDataToJS" unwrapping doubly-wrapped objects before
returning them to chrome callers, which could result in chrome
privileged code calling methods on an object which had previously been
created or modified by web content, leading to the execution of
malicious JavaScript code with chrome privileges.

The seventh issue is caused by a heap overflow error in the string to
floating point number conversion routines, which could be exploited to
crash an affected browser or execute arbitrary code.

The eighth vulnerability is caused due to a same-origin policy bypass
via the "document.getSelection" function, which could be exploited to
conduct cross-domain scripting attacks.

The ninth vulnerability is caused by an error when downloading a file
with a name containing a right-to-left override character (RTL), which
could be exploited to obfuscate the name and extension of a malicious
file to be downloaded and opened.

The tenth issue is caused by memory corruption errors in the
JavaScript and browser engines when parsing malformed data, which
could be exploited by attackers to crash a vulnerable browser or
execute arbitrary code.

Other memory corruption errors related to liboggz, libvorbis, and
liboggplay have also been reported, which could be exploited by
attackers to compromise a vunerable system.

Affected Products

Mozilla Firefox versions prior to 3.5.4
Mozilla Firefox versions prior to 3.0.15

DHS Web sites vulnerable to hackers, IG says

The Homeland Security Department’s most popular Web sites appear to be vulnerable to hackers and could put department data at risk of loss or unauthorized use, according to a new report from DHS Inspector General Richard Skinner.

“These vulnerabilities could put DHS data at risk,” Skinner wrote in the report issued Oct. 8. “In addition, DHS can make improvements in managing its system inventory and providing technical oversight and guidance in order to evaluate the security threats to its public-facing Web sites.”

Read More...

Snow Leopard bug deletes all user data

Computerworld - Snow Leopard users have reported that they've lost all their personal data when they've logged into a "Guest" account after upgrading from Leopard, according to messages on Apple's support forum.

The bug, users said in a well-read thread on Apple's support forum, resets all settings on the Mac, resets all applications' settings and erases the contents of critical folders containing documents, photos and music.

The MacFixIt site first reported the problem more than a month ago.

Read more...