Adobe Fixes Four Critical Flaws in Flash
Adobe on Tuesday fixed four critical vulnerabilities in its Flash software, all of which could be used by attackers to execute code on vulnerable machines.
Vulnerabilities
Critical IE, Windows Kernel Flaws Patched
For the second month in a row, Microsoft has released a cumulative update for Internet Explorer, patching a number of critical remote code execution vulnerabilities in the browser, including one previously disclosed. It also patched a serious kernel mode driver vulnerability that could enable attackers to gain root access to a machine using a malicious USB drive, a la Stuxnet.
Metasploit Module Released for Patched Honeywell ICS Vulnerability
Metasploit today released an exploit module for a serious vulnerability in Honeywell industrial control system software used to manage everything from HVAC and building access systems, to energy and facilities management processes.
Homeland Security’s Computer Emergency Response Team is warning today that some printers manufactured by Hewlett-Packard, including 10 of its LaserJet Professional printers, have a security vulnerability that could allow an attacker to remotely access data.
VIEW SLIDESHOW Scenes from CanSecWest 2013The CanSecWest security conference in Vancouver last week included technical presentations on bypassing ASLR and DEP and the intricacies of Android research, as well as a fascinating talk on the red team exercises Facebook’s security team runs. We put together some scenes from the show and Vancouver itself.
The resumption this week of distributed denial of service attacks against major U.S. banks brought not only more cost and disruption to financial institutions trying keep online services available, but it also raised new questions about the funding and true motives behind the attacks.
VANCOUVER–Within less than 24 hours of the vulnerabilities being used and disclosed to them, both Mozilla and Google have issued patches for flaws employed by participants in this week’s Pwn2Own contest at CanSecWest here.
Dennis Fisher talks with Adrian Stone, the head of security response at BlackBerry, about the new security model in BlackBerry 10, the partition between private and work data and the challenges of dealing with app developers who might not know a whole lot about security or privacy.
VANCOUVER–Finding and exploiting new vulnerabilities in the major browsers has become a difficult exercise for security researchers, thanks to the exploit mitigations, sandboxes and other protections that Microsoft, Google and Mozilla have added in the last few years. The same has become true of Adobe Flash, but difficult is not the same as impossible, as the contestants at the Pwn2Own contest here have shown.
VANCOUVER–The Pwn2Own contest has evolved in many ways over the years, from new rules to new targets to larger prizes, but perhaps the one thing that has changed the most is that the researchers who show up here every year hoping to go home with a bag full of money are having to spend more and more time finding and exploiting vulnerabilities in the browsers and plug-ins in play. The research team at VUPEN, which successfully compromised Internet Explorer 10 on Windows 8 spent several months finding the flaws they used and writing the expoits.
