The exploit that is being used in the attacks against the latest zero-day vulnerability in Adobe Flash is a modified version of a harmless SWF file that is only one byte different from the original file. Researchers have seen the exploit being used in active attacks against the vulnerability in Flash, which Adobe is set to patch tomorrow.
Google has paid out its highest sum yet, $2,000, for the discovery of a
high-risk vulnerability found in its Chrome browser. The recipient is developer
Sergey Glazunov, who found a DOM method-related means of circumventing
the same origin policy. Read the full article. [The H Security]
Scareware has become such an indomitable economic force that the take
down of perhaps the largest, most vertically-integrated scareware
purveyor, Innovative Marketing, has had a negligible deterrent effect. Read the full article. [The Last Watchdog]
The Microsoft Patch Tuesday train rolled into town today, dropping off a massive 10 security bulletins with fixes for at least 34 documented vulnerabilities. Three of the bulletins are rated “critical” because of the risk of remote code execution attacks. Affected products include the Windows operating system, Microsoft Office, the Internet Explorer browser and Internet Information Services (IIS).
The number of malware and spyware programs found
on smartphones like the Android, BlackBerry and Windows Mobile devices has more than doubled in the past six months, and some
types of malware are more prevalent on certain smartphone platforms than
others. Read the full article. [Dark Reading]
According to a survey of 242 IT
professionals, 1 in 10 admitted that either they or a colleague have cheated
to get an IT audit passed. However, it isn’t all bad news; compared to a
similar survey conducted in 2009 the number of people admitting to
cheating has halved in number. Read the full article. [Help Net Security]
Researchers have released software that exposes private information and
executes arbitrary code on sensitive websites by exploiting weaknesses
in the widely used web development technology JavaServer Faces. Read the full article. [The Register]
Apple has shipped new versions of its Safari browser with patches for at least 48 security vulnerabilities.The Safari 4.1 and 5.0 updates, considered “highly critical,” is available for both Windows and Mac OS X. Exploitation of some of these vulnerabilities could lead to drive-by download (remote code execution) attacks.
Adobe said on Monday that it will have a patch available for the newly discovered critical vulnerability in Flash ready by June 10 for most platforms. The patches for Adobe Reader and Acrobat, which also are affected by the flaw, won’t be released until June 29.
Adobe issued an alert late Friday night to warn about zero-day attacks against an unpatched vulnerability in its Reader and Flash Player software products.The vulnerability, described as critical, affects Adobe Flash Player 10.0.45.2 and earlier versions for Windows, Macintosh, Linux and Solaris operating systems.
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
