CyberInsecure.com

Archive for the ‘Adobe’ Category

A researcher has unearthed a bug in software used to install Adobe’s ubiquitous Reader and Flash applications that can be exploited to remotely install malicious files on end user PCs.

The Adobe Download Manager is an ActiveX script that is invoked when people install or update Reader or Flash using Internet Explorer. Researcher Aviv Raff has figured out how to exploit it to install any file he wishes simply by tricking a user into clicking on a link on the Adobe.com domain.

The attack combines a vulnerability on Adobe’s website with a defect in the download manager. The result: he was able to install and execute his own instance of the Windows calculator on a Register test machine. Aviv demonstrated the exploit on the condition further technical details be withheld.

“Instead of admitting that this design flaw is indeed a problem which can be abused by malicious attackers, Adobe decided to downplay this issue,” Raff wrote. He was referring to unpublished comments an Adobe spokeswoman made to Zero Day blogger Ryan Naraine.

In part, the comments said the download manager “is designed to remove itself from the computer after use at the next restart,” “can only be used to download the latest version of software hosted on Adobe.com,” and “presents a very large user dialog box when downloading software.”

But because the download manager remains on a machine until it is rebooted, attackers have ample opportunity to exploit the bug. Assuming the typical machine is restarted once every 24 to 72 hours, attacks have a reasonable chance of success as long as they are launched within the first one to three days of a recent update. (We’re guessing a fair percentage of people would be unfazed by the dialog box).

And once that happens, attackers have the ability to remotely install malicious code on an untold millions of PCs.

In response to Raff’s post, Adobe spokeswoman Wiebke Lips wrote: “Adobe is aware of the recently posted report of a remote code execution vulnerability in the Adobe Download Manager. We are working with the researcher, Aviv Raff, and the third party vendor of this component to investigate and resolve the issue as quickly as possible.”

The myriad bugs that over the past few years have routinely imperiled the entire internet have made Adobe the Toyota of the software industry. Company security personnel seem intent of correcting the problems, but the only way for that to happen is to launch a comprehensive initiative that makes a top-to-bottom review of the company’s entire code base.

Credit: The Register

A rare emergency update from Microsoft to patch a critical vulnerability in Internet Explorer will be released on Thursday. Critical patches for Adobe Systems software keep coming. This time, they fix serious security bugs in the company’s Shockwave Player. Apple has also released a major security update designed to fix security bugs, some of which present a critical security risk on unpatched systems.

Microsoft update will mark only the 10th 12th time Microsoft has issued a security update outside of its normal schedule since 2003, when it began issuing patches on the second Tuesday of each month. It will come a week after the world learned an attack exploiting the potent IE flaw was used to pierce the defenses of Google and at least some of the other 33 large companies that suffered similar assaults.

Microsoft researchers said that they continue to see only limited attacks that exploit the bug and that, so far, they have only succeed against IE 6. But, as reported Tuesday, researchers elsewhere said they have figured out how to bypass security measures offered in later versions of the widely used browser, making it theoretically possible to compromise a much broader base of PCs.

Microsoft said the emergency patch will be issued as close to 10 am Seattle time as possible and will contain fixes for several other vulnerabilities as well. The company recommends users install it as soon as possible. The patch will require users to restart their machines.

For the first time, Microsoft said the vulnerability could also be exploited to attack users of its email and office productivity software. Thursday’s patch will close holes in those programs as well. Users of Microsoft Access, Word, Excel, or PowerPoint can workaround the issue by disabling ActiveX Controls.

Adobe is strongly urging users to upgrade. Unlike the vast majority of patches, the Shockwave fix requires users manually uninstall the out-of-date version, reboot their systems, and then install the latest version. For an application with more than 450 million installations, that’s downright primitive.

More importantly, making it inconvenient for users to upgrade is a guarantee that a sizable portion of them will remain vulnerable. Adobe has recently unveiled an automatic updater for its Reader application. It’s about time the software maker made seamless updating for Flash and Shockwave standard too. The critical patch, assuming it’s installed, will update Shockwave to version 11.5.6.606.

Patches released by Apple on Tuesday address a malware injection risk in the CoreAudio media player, Flash Player plug-in bugs and a similarly critical vulnerability involving Image Raw. The update also tackles a recently discovered OpenSSL renegotiation exploit. Security fixes for CUPS and Image IO make up the remainder of the patch batch.

Most of these updates are connected with third party software. For example, seven of the twelve CVEs are connected with the update for Adobe’s flash player plug-in. The remainder of the bugs are the usual file format parsing problems that we’ve seen a lot of in the past.

Apple advisory can be found at http://support.apple.com/kb/HT4004.

Credit: The Register

Microsoft published an advisory today about a critical security vulnerability in all versions of Internet Explorer (apart from version 5). While all versions of Internet Explorer are affected, the risk for everyone running Internet Explorer 8 is lower since it has DEP (Data Execution Prevention) enabled by default.

According to McAfee, hackers who breached the defenses of Google, Adobe Systems and at least 32 other companies used this vulnerability to carry out at least some of the attacks.

The previously unknown flaw in the IE browser was probably just one of the vectors used in the attacks, McAfee CTO George Kurtz wrote in a blog post. Using a sophisticated spear-phishing campaign, the perpetrators included malicious links exploiting the bug in emails and instant messages sent to employees from at least three of the targeted companies.

Contrary to previous speculation, there was no evidence vulnerabilities in Adobe’s Reader or Acrobat applications were used in any of the attacks, Kurtz said. In its own statement, adobe concurred, saying researchers “have not been able to obtain any evidence to indicate that Adobe Reader or other Adobe technologies were used as the attack vector in this incident.”

Kurtz said his findings were based on malware samples taken from “three to five” of the targeted companies and he stressed that other zero days or exploits could have been used against other victims.

“In our investigation we discovered that one of the malware samples involved in this broad attack exploits a new, not publicly known vulnerability in Microsoft Internet Explorer,” Kurtz wrote. “Our investigation has shown that Internet explorer is vulnerable on all of Microsoft’s most recent operating system releases, including Windows 7.”

Shortly after the report, Microsoft confirmed the new IE vulnerability was “one of the vectors used in targeted and sophisticated attacks against Google and possibly other corporate networks.” A company statement said the attacks were carried out against version 6 of the widely used browser and suggested users protect themselves by enabling security features that have been added to successor versions.

McAfee’s report is the latest to shed light on one of the most significant cyberattacks in years. Google first disclosed the “highly sophisticated and targeted attack” on Tuesday, saying it originated in China and targeted its intellectual property. It added that 20 other companies suffered similar assaults, a number that independent researchers soon raised to 34. So far, only Google and Adobe have been identified as victims.

Yahoo, Symantec, Northrop Grumman and Dow Chemical have also been penetrated according to The Washington Post, citing unnamed “congressional and industry sources.”

The malware that McAfee researchers analyzed was sent to a highly select group of employees of a handful of companies that Kurtz declined to identify.

“This wasn’t something that got blasted to 300,000 people in a corporation,” Kurtz said in an interview with The Register. “It was really targeted at senior technology leaders that had access to core pieces of intellectual property, source code, et cetera.”

Kurtz has dubbed the attack “Aurora,” a reference to the filepath on the attacker’s machine that showed up in some of the malware code McAfee researchers analyzed. They believe that is the name the attackers gave to the operation. There was nothing in the binaries that indicated either way whether the code writers spoke Cantonese or Mandarin or were located in China.

The IE vulnerability stems from an invalid pointer reference that when exploited allows an attacker to execute malicious shell code on underlying machines. The malware caused exploited machines to download further malicious scripts that installed a backdoor. The machines then connected to command and control channels that were hosted on servers that resided in the US and Taiwan.

A security feature known as data execution prevention, which prevents data loaded into memory from being executed, will block the particular exploits McAfee has observed. But Kurtz warned the vulnerability exists in all versions of IE except for IE 5.01, service pack 4, and that it would be possible for attackers to work around the protection.

In an advisory, Microsoft recommended people use DEP, which by default is enabled in IE 8 but must be turned on in prior versions. The statement also advised users on Vista and later versions of Windows to run IE in protected mode. The advisory didn’t say when an update would be released that patches the vulnerability.

Credit: The Register, SANS ISC

A security researcher has identified more than 8 million Adobe Flash files that make the websites hosting them vulnerable to attacks that target visitors with malicious code.

The Flash files are contained on a wide variety of sites operated by online casinos, news organizations, banks, and professional sports teams. They make the pages where they reside susceptible to XSS, or cross-site scripting, attacks that have the potential to inject malicious code and content into a visitor’s browser and in some cases steal credentials used to authenticate user accounts.

The researcher, who goes by the moniker MustLive, said the Flash files contain poorly written ActionScript used to count the number of times a banner has been clicked and typically contain the clickTAG or url parameters. Google searches identified a total more than 8.3 million of them on sites hosted by the New York Giants football team, Praguepost.com and ParadaisPoker.com. Because Google results are often abbreviated, the actual number is probably higher.

MustLive said websites that host the buggy content aren’t automatically vulnerable to XSS exploits. Indeed, even though the pages on the official Citibank website included such content, XSS attacks that tried to exploit them failed.

But the researcher provided a wealth of examples of websites that were made vulnerable by the Adobe files, which provide graphics that move and are often referred to as SWFs, because of the three-letter suffix their file names carry.

It’s by no means the first time someone has identified a sprawling body of SWF files that threaten the security of the sites hosting them. Two years ago, researchers documented serious vulnerabilities in Adobe-based content that exposed more than 10,000 sites to attack.

The threat was particularly difficult to eradicate because webmasters had to patch their content-generation software and then render the animation scripts all over again. Months after the problem was identified, many websites still hadn’t bothered to take action.

Last year, MustLive reported 215,000 vulnerable Flash files, a number he later raised to the millions. That content was also made vulnerable by buggy ActionScript.

It should be said that the vulnerabilities exposed in the latest discovery are the result of bugs introduced by sloppy rendering, rather than vulnerable Adobe software. Adobe provides security guidance for designing banners with tracking capabilities.

Credit: The Register

Adobe is investigating reports of unpatched flaws in its Reader and Acrobat software packages. Zero-day bugs in Adobe Reader and Acrobat have reportedly been exploited by hackers to attack vulnerable systems, in a series of limited (presumably) targeted attacks since 11 December. Adobe Reader and Acrobat 9.2 or below are potentially vulnerable to attacks. Successful exploitation creates a means for hackers to inject hostile code onto vulnerable systems, security notification firm Secunia warns.

Adobe has posted a holding statement on its security blog, saying that it is investigating the flaw. It’s unclear when a patch might become available.

Shadowserver suggests disabling JavaScript as a workaround, pending the availability of a patch from Adobe.

The latest security problem for Adobe follows the release of a patch for Flash and AIR addressing a previously unpatched vulnerability, released last week. Adobe is planning to publish a patch for a zero-day flaw in Illustrator on 8 January.

The popularity of Adobe software has made it a favoured target for hacking attacks over recent months. Booby-trapped PDF files have become as commonplace as browser exploits in hacking attacks. Part of the problem for this may be that applying Adobe updates is fiddlier and more time consuming than applying Microsoft fixes or patching browser exploits. Vulnerable ActiveX components can easily get left behind during updates, for example.

Credit: The Register

P.S. Whoever still uses Adobe Reader and Acrobat deserves to be hacked. With the amount of alternatives, there is no reason why Adobe products for PDF should not be uninstalled in the next 2 minutes.

Fears over a reportedly unpatched flaw in Adobe Illustrator have been heightened by the release of exploit code. A zero-day flaw in the vector graphics editor means that users tricked into opening maliciously manipulated Encapsulated Postscript Files (.eps) files are liable to find themselves hacked.

Successful exploitation of the unpatched flaw triggers a memory corruption bug that clears the path towards the execution of malware on vulnerable systems.

Security notification firm Secunia reports that both Illustrator CS3 13.0.0 and CS4 14.0.0 are affected, adding that a published exploit works on fully patched Windows XP machines. Other versions of Illustrator may also be vulnerable.

Adobe acknowledged a potential problem in at least Illustrator CS4, which it said it was investigating.

Adobe is aware of a report of a potential vulnerability in Adobe Illustrator CS4 (CVE-2009-4195). We are currently investigating this issue and will have an update once we have more information. It appears that this issue would require a local user to take the action of opening a malicious .eps file in Illustrator.

The software firm’s delayed quarterly patch update is due next Tuesday, a date that coincides with Microsoft’s Patch Tuesday release. Adobe’s security response team will have their work cut out to develop and test a patch in time.

Tuesday’s releases from Adobe are due to include an update addressing a critical flaw in its Flash player software. The critical update for Adobe Flash Player 10.0.32.18 and earlier versions is due to be accompanied by a security fix for Adobe AIR 1.5.2, also addressing a critical vulnerability.

The ubiquity of Adobe software has made it a favourite target for hacking attacks over the last year or so. Booby-trapped PDF exploits have become a particular favourite in targeted attacks.

Flash exploits have also become a weapon of choice as miscreants have extended their sights beyond attacks against Internet Explorer and booby-trapped Microsoft Office document files. In response, Adobe has adopted a regular patch schedule.

Credit: The Register

Attackers once again are targeting an unpatched vulnerability in Adobe Reader that allows them to take complete control of a user’s computer, the software maker warned.

Adobe said it planned to patch the critical security bug in Reader and Acrobat 9.1.3 for Windows, Mac and Unix on Tuesday, the date of the company’s previously scheduled patch release for the PDF reader. According to Security Focus here, attackers can exploit the vulnerability by tricking a user into opening a booby-trapped PDF file.

“Successful exploits may allow the attacker to execute arbitrary code in the context of a user running the affected application,” the security site warned. “Failed attempts will likely result in denial-of-service conditions.”

The bug is presently being exploited in “limited targeted attacks,” Security Focus added, without elaborating. Adobe said only that the attacks target Reader and Adobe running on Windows operating systems.

Those using Windows Vista with a feature known as data execution prevention enabled are safe from the exploit. Users on other platforms can insulate themselves from the current attack by disabling javascript from running inside the application, but Adobe warned it’s possible to design an exploit that works around that measure.

The company said it’s working with anti-virus providers so their software can detect the PDF files that target the bug.

This is at least the third time this year that criminals have targeted an unpatched vulnerability in Adobe Reader or Flash, which arguably are installed on a larger base of machines than any Microsoft software. The company has taken flak not just for releasing buggy programs, but for taking too long to fix security flaws once they’re discovered. The company in May promised to reinvigorate its security program for Reader.

To disable javascript from running inside the application, choose Preferences from Reader’s Edit menu, highlight javascript and then uncheck the box that says “Enable Acrobat JavaScript.” Another good idea would be completely uninstalling the Reader and using a much safer, less bloated alternative like Foxit Reader.

Credit: The Register

Adobe Systems has released updates that patch vulnerabilities in two widely used web development applications, several of which let attackers steal sensitive data or take complete control of users’ machines.

In all, the patches fix seven flaws in versions 8.0.1 and earlier of ColdFusion and JRun 4.0. The most serious of them are XSS, or cross-site scripting, bugs that allow attackers to execute malicious code on an underlying system by supplying a target with a booby-trapped web link.

Adobe engineers also fixed a separate management console flaw. It allowed unauthenticated users to traverse restricted directories, a vulnerability that could lead to information disclosure. Proof-of-concept code released Tuesday showed the flaw could be exploited using a URL that looks something like this:

http://[server]/server/[profile]/logging/logviewer.jsp?logfile=../../../../../../../boot.ini

The fixes come as Adobe, whose software is perhaps more ubiquitous than Microsoft’s, struggles to patch a variety of security vulnerabilities that have been exploited to install malware on the machines running the programs. Three weeks ago, its security team pushed out a fix for a bug in its Flash Player that criminals were using to hijack user machines. Attackers last month were also able to compromise a large number of websites by targeting an open-source text editor bundled with ColdFusion.

In May, Adobe announced it was reinvigorating security measures used to design its Reader application used to view PDF documents. The initiative was a great start, but by no means adequate because it left Flash and other widely used Adobe titles out of the tent.

Adobe says it is currently unaware of any exploits targeting the latest ColdFusion and JRun bugs. The company’s security bulletin is available here.

Credit: The Register

Adobe is investigating a critical vulnerability in its Flash format that is currently being exploited by hackers using malicious PDF documents, according to the company’s security team and outside researchers.

Adobe said little in a short entry to its security blog late Tuesday. “Adobe is aware of reports of a potential vulnerability in Adobe Reader and Acrobat 9.1.2 and Adobe Flash Player 9 and 10,” said Brad Arkin, the company’s director for product security and privacy. “We are currently investigating this potential issue.”

Reader and Acrobat 9.1.2 are the most current versions of those applications.

An Adobe spokesman early Wednesday confirmed that the vulnerability was an issue within Flash content that is inserted into a PDF (Portable Document Format) file. Users can drop Flash movies into PDF files, for instance.

VeriSign’s iDefense said it spotted an in-the-wild attack exploiting the Flash zero-day, according to a target=”new” message posted to Twitter yesterday. “iDefense recently investigated a targeted attack using [a] embedded zero-day Flash exploit inside a PDF file,” the security intelligence company said.

Adobe has had its share of security problems this year, particularly with Reader, the popular PDF viewer. In mid-March, for example, it plugged several holes in Reader, including one that had been exploited by hackers since early January. Then in both May and June it followed that with further fixes to quash another Reader zero-day and patch another 13 bugs in the viewer.

Security was also at issue this week when Danish bug tracker Secunia noticed that Adobe continues to provide an outdated edition of Reader for download. Yesterday, Adobe reacted to Secunia’s report by saying it was reevaluating how its software updater operated.

iDefense did not immediately respond to a request for more information on its findings, while Adobe’s spokesman said details of the Flash-PDF vulnerability would be posted on the company’s security blog when they are available.

Credit: ComputerWorld.com

Microsoft has released a solitary bulletin that covers 14 vulnerabilities in PowerPoint, including a zero-day bug that has been the target of hacker exploitation over recent weeks, as part of its May Patch Tuesday update.

All versions of PowerPoint will need patching with the cumulative update, which earns Redmond’s highest security rating of “critical”. The patches released today include versions of Powerpoint that weren’t flagged as vulnerable to the zero-day as Microsoft also included fixes for 13 additional vulnerabilities that were privately reported.

Some of these vulnerabilities impact the newer versions of Powerpoint that were not vulnerable to the 0-day. Included in today’s release are patches for the Powerpoint viewer as well as the full version of Powerpoint. The patch brings relief from zero-day flaws in Microsoft Office software for the first time in nearly two months.

Microsoft’s bulletin can be found at http://www.microsoft.com/technet/security/Bulletin/MS09-017.mspx.

Separately Adobe released an update that defends Adobe Reader against another zero-day vulnerability. The flaw in Adobe Reader 9.1 and Acrobat has been the target of hacking attacks since last month and was, if anything, more dangerous than the 0-day PowerPoint flaw.

More details on the fix from Adobe can be found at http://www.adobe.com/support/security/bulletins/apsb09-06.html.

Popular applications and files like Adobe PDF files or Word, Excel or PowerPoint files have been great vehicles for targeted attacks because those attachments are so socially acceptable and are simply expected attachments within corporate email.

Apart from fixes from Microsoft, Adobe and Apple other vendors including Google, F-Secure,, HP, Symantec and Mozilla have collectively released a slew of patches for popular software applications over recent days.

Credit: The Register