Safari attack code released...
FYI...
Safari 'carpet bomb' attack code released
- http://preview.tinyurl.com/65fe66
June 10, 2008 (Computerworld) - "A hacker has posted attack code that exploits critical flaws in the Safari and Internet Explorer Web browsers. The source code, along with a demo of the attack, was posted Sunday on a computer security blog. It can be used to run unauthorized software on a victim's machine, and could be used by criminals in Web-based computer attacks... the vulnerability has to do with the way Windows handles desktop executables and recommended that Windows users "restrict use of Safari as a Web browser until an appropriate update is available from Microsoft and/or Apple." The attack affects all versions of Windows XP and Vista, Microsoft said in its advisory*..."
- http://isc.sans.org/diary.html?storyid=4562
Last Updated: 2008-06-12 11:22:32 UTC
...Since the proof of concept is easily available, if you are using Safari on Windows please change the default download location as described in Microsoft's advisory available at
* http://www.microsoft.com/technet/sec...ry/953818.mspx
:fear:
Malicious doorways redirecting to malware
FYI...
- http://ddanchev.blogspot.com/2008/06...ecting-to.html
June 16, 2008 - "...bottom line - malicious doorways are slowly starting to emerge thanks to the convergence of traffic redirection and management tools with web malware exploitation kits, and just like we've been seeing the adaptation of spamming tools and approaches for phishing purposes, next we're going to see the development of infrastructure management kits, a feature that DIY phishing kits* are starting to take into consideration as well."
* http://ddanchev.blogspot.com/2008/05...ucing-new.html
Warning: We strongly suggest that readers NOT visit websites mentioned as being behind the attacks discussed. They should be considered dangerous and capable of infecting your system.
:fear:
IEv6 XSS vuln code released
FYI...
- http://www.us-cert.gov/current/index...plorer_6_cross
June 26, 2008 - "US-CERT is aware of publicly available proof-of-concept code for a new vulnerability in Microsoft Internet Explorer 6. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary script in the context of another domain. This could allow an attacker to take a variety of actions, including stealing cookies, hijacking a web session, or stealing authentication credentials. At this time, Internet Explorer 7 does not appear to be affected by this issue. US-CERT strongly encourages users to upgrade to Microsoft Internet Explorer 7 and follow the best security practices as outlined in the Securing Your Web Browser document to help mitigate the risk. Additional information about this vulnerability can be found in the Vulnerability Notes Database*..."
* http://www.kb.cert.org/vuls/id/923508
- http://secunia.com/advisories/30857/
===
(Another) IEv6 vuln... aka "Cross-Site Cooking"
- http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-3173
Last revised: 7/15/2008 - "...NOTE: this issue may exist because of an insufficient fix for CVE-2004-0866*..."
* http://nvd.nist.gov/nvd.cfm?cvename=CVE-2004-0866
:fear:
IE v6, v7, v8 vuln - unpatched
FYI...
- http://secunia.com/advisories/30851/
Last Update: 2008-06-30
Critical: Moderately critical
Impact: Security Bypass, Spoofing
Where: From remote
Solution Status: Unpatched...
Solution: Do not visit or follow links from untrusted websites...
- http://www.kb.cert.org/vuls/id/516627
Last Updated: 06/27/2008 - "...Limited testing has shown that IE 6, 7, and 8 beta 1 are vulnerable...
We are currently unaware of a practical solution to this problem. Please consider the following workarounds:
Disable Active Scripting
This vulnerability can be mitigated by disabling Active Scripting in the Internet Zone, as specified in the "Securing Your Web Browser" document*."
* http://www.us-cert.gov/reading_room/...ernet_Explorer
> http://www.us-cert.gov/current/#micr..._vulnerability
:fear:
40% of Web users surf with Unsafe Browsers
FYI...
40% of Web users surf with Unsafe Browsers
- http://preview.tinyurl.com/4nhr4n
July 1, 2008 (blog.washingtonpost.com/securityfix) - "A comprehensive new study of online surfing habits released today found that only 60 percent of the planet's Internet users surf the Web with the latest, most-secure versions of their preferred Web browsers. The study, conducted by researchers from Google, IBM and the Communication Systems Group in Switzerland, relied on data from server logs provided by Google for search requests between Jan. 2007 and June 2008. The researchers found that of the 1.4 billion Internet users worldwide at the end of March 2008, 576 million surfed with outdated versions of Web browsers..."
:fear::spider::sad: