Foxit on Friday released an update to fix the problem with PDF readers running executables without users’ permission. The problem, which was identified and publicized by Didier Stevens earlier this week, still exists in Adobe Reader.
A new version of Java is available that fixes at least 27 security vulnerabilities in the ubiquitous software. Read the full article. [KrebsonSecurity]
This video features a detailed demonstration of a technique for reproducing the Aurora Internet Explorer exploit using the Metasploit Framework.
Just call it Mac OS X patchapalooza. Over the last week, Apple has shipped security patches to cover 88 vulnerabilities in the Mac operating system, 16 holes in the QuickTime media player, 7 flaws in iTunes and a security bug in the AirPort Base Station.
Red Hat has released an OpenJDK 1.6.0 security update for Red Hat Enterprise Linux 5. The update comes after Oracle updated Java 6 with Update 19 and addresses many of the same vulnerabilities. Read the full article. [The H Security]
CanSecWest: Two security researchers at search engine giant Google have discovered
20 kernel bugs, about half remaining unpatched, affecting Windows,
Linux and the popular VMware virtualization software over the last
several years. Read the full article. [TechTarget]
According to a newly released report, 64% of all the reported Microsoft vulnerabilities for 2009 could have been mitigated by using the principle of the least privileged accounts. Read the full article. [ZDNet]
Security response teams at Adobe and FoxIt are investigating ways to mitigate a new PDF hack that allows the execution of an embedded executable without exploiting any security vulnerabilities.A demo of the PDF hack has been published to show how a hacker could employ social engineering techniques to launch code execution attacks if a user simply opens a rigged PDF file.
Computer users in China and Korea were the hardest hit by the latest wave of zero-day malware attacks targeting a flaw in the Internet Explorer browser, according to data released by the Microsoft Malware Protection Center (MMPC).
The latest rivalry appears to be budding between the author of the Zeus Trojan— a crime kit used by a large number of cyber thieves — and “SpyEye,” a
relatively new kit on the block that is taking every opportunity to
jeer at, undercut and otherwise siphon market share from the mighty
Zeus. Read the full article. [Krebson Security]
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
