Ryan Naraine

Apple Patches Critical Safari Vulnerabilities

Apple today shipped Safari 4.0.4 to fix a total of seven security flaws that expose Windows and Mac users to a wide range of malicious hacker attacks.The high-priority update patches vulnerabilities that allow remote code execution (drive-by downloads) if a user simply surfs to a maliciously rigged Web site.  Some of the issues affect Microsoft’s new Windows 7 operating system.

Online Ad Site Hacked, Rigged to Serve Exploits

A
high-profile online advertising Web site has been hacked and rigged to
serve multiple exploits to Microsoft Windows users surfing the net with
unpatched third party desktop software.
According to a warning issued by Websense Security Labs, the malicious code was found on media-servers.net,
which is described as a high-profile advertiser on the Internet realm. 
The site has been firing an assortment of exploits for several months,
including exploits for vulnerabilities in Microsoft DirectShow and
Adobe PDF Reader.  Read the full advisory [websense.com]


Adobe has shipped a patch to cover a security vulnerability affecting its Photoshop Elements software product.
The flaw, rated moderate, affects Adobe Photoshop Elements versions
8.0 and 7.0. It could be exploited by a hacker with valid login
credentials and/or physical access to execute arbitrary commands with
elevated privileges. Read the advisory [adobe.com]

As
part of its scheduled batch of patches for November, Microsoft today
issued six security bulletins with fixes for a total of 15
vulnerabilities affecting its Windows and Office product lines.

Three of the six bulletins are rated “critical,” meaning they can be
used to launch remote code execution or worm attacks without any user
action.  One of the Windows vulnerabilities could expose users to
drive-by malware attacks via the browser, Microsoft warned.

Apple has dropped another mega-patch to cover a total of 58 documented vulnerabilities affecting the Mac OS X ecosystem. The majority of the flaws could allow a remote attacker to gain complete control of an unpatched system, meaning that this update carries an “extremely critical rating.”

Arbor Networks researcher Jose Nazario has spotted a malicious Google AppEngine application being used to control a botnet of infected computers. The Google App Engine is feeding URLs to the zombies (hijacked machines) for them to download, Nazario explained.  Read the full blog post [arbornetworks.com]

A team of Catalan researchers has developed a protocol to distort the
user profile generated by Internet search engines, in such a way that
they cannot save the searches undertaken by Internet users and thus
preserve their privacy.  Read the full story [Science Daily]

Research in Motion (RIM) has shipped a patch to cover a gaping hole in its BlackBerry Desktop Manager software.The vulnerability, which exists in a  Lotus Notes Intellisync DLL that the BlackBerry Desktop Manager uses, allows a malicious user to perform an attack that leverages social engineering to achieve remote code execution on the computer running the BlackBerry Desktop Manager.