From SearchSecurity (Robert Westervelt)
Microsoft issued an advisory Monday, warning of a new vulnerability in Office Web Components being actively targeted by attackers. The Office Web Components allow users to view spreadsheets, charts and databases on the Web. Microsoft said the vulnerability is in the Spreadsheet ActiveX Control, which is used by Internet Explorer (IE) to display the data in the browser. It is remotely exploitable when a person browses with IE and visits a malicious website. If successfully exploited, an attacker could gain the same user rights as the local user and gain complete control of a system, Microsoft said. Read the full story [SearchSecurity].
Browsing Category: Vulnerabilities
From SearchSecurity (Robert Westervelt)
By Eric Rescorla
Andy Zmolek of Avaya reports on VoIP security research company VoIPshield’s new policy requiring vendors to pay for full details of bugs in their products. He quotes from a letter VoIPShield sent him:
“I wanted to inform you that VoIPshield is making significant changes to its Vulnerabilities Disclosure Policy to VoIP products vendors. Effective immediately, we will no longer make voluntary disclosures of vulnerabilities to Avaya or any other vendor. Instead, the results of the vulnerability research performed by VoIPshield Labs, including technical descriptions, exploit code and other elements necessary to recreate and test the vulnerabilities in your lab, is available to be licensed from VoIPshield for use by Avaya on an annual subscription basis.
From Websense Security Labs
The recently publicized Zero-Day Vulnerability in Microsoft DirectShow is in the wild and spreads through infection of thousands of legitimate Web sites. The proof-of-concept of the vulnerability is out and exploitation is very easy to achieve. In our labs we have been tracking the spread of this new zero day—the first compromised domains mainly originating in China. Read the full story [Websense].
Microsoft’s July Patch Tuesday release will include a fix for the DirectShow vulnerability that was revealed in May, and the software giant said it likely will also have a patch available for a related flaw in the MsVidCtl ActiveX control that became public earlier this week and has been under active attack. The company said it has been working on a patch for the second vulnerability all week and believes that the fix should be ready for release July 15.
From Zero Day (Ryan Naraine)
Apple has released Safari 4.0.2 to fix a pair of security flaws that could lead to cross-site scripting or remote code execution attacks. The vulnerabilities affect Safari for Windows (XP and Vista) and Mac OS X. Read the full story [ZDNet].
Dennis Fisher talks with security researcher Dino Dai Zovi about his upcoming Black Hat talk on Mac OS X rootkits, exploiting the Mac and the value of hacking contests and internal code reviews.
The ongoing exploitation of the vulnerability in an ActiveX control used by Internet Explorer has created a dangerous situation, as there is no patch yet for the MSVidCtl.dll vulnerability. However, there are several steps you can take to protect yourself against attacks.
From The H Security
Symbian, found in many mobile phones, especially those from Nokia, is one of the most widely used mobile operating systems and has now been in use for more than ten years. It continues to be viewed as a very secure operating system, with special security functions and a certification system which help to ensure that only signed code can run with high privileges. Anti-virus vendors occasionally report new malware capable of running on the Symbian platform, but so far none have managed to spread widely. Read the full story [The H Security].
From IDG News Service (Sumner Lemon)
Apple is working to fix an iPhone vulnerability that could allow an attacker to remotely install and run unsigned software code with root access to the phone.
The attack in question exploits a weakness in the way iPhones handle text messages received via SMS (Short Message Service), said security researcher Charlie Miller, during a presentation at the SyScan conference in Singapore on Thursday. He didn’t provide a detailed description of the SMS vulnerability, citing an agreement with Apple. Read the full story [Yahoo News].