Mailing Lists & Feeds
Current Activity Calendar
| February 16, 2006 - Current ActivityThis is an archived copy of current activity, if you would like to see the most recent version, please click here.Public Exploit Code for Buffer Overflow Vulnerability in Microsoft Windows Media Player added February 16, 2006 US-CERT is aware of publicly available exploit code for a buffer overflow vulnerability in Windows Media Player. The vulnerability exists because Windows Media Player fails to properly validate bitmap image files. Exploitation may occur if a user takes any of the following actions:
Successful exploitation may allow a remote, unauthenticated attacker to execute arbitrary code with the privileges of the user. More information can be found in the following US-CERT Vulnerability Note:
US-CERT urges users and administrators to implement the following recommendations:
Exploit for QueryInterface Vulnerability in Mozilla added February 7, 2006 | updated February 8, 2006 US-CERT is aware of publicly available exploit code for a memory corruption vulnerability in the Mozilla Firefox web browser and Thunderbird mail client. If JavaScript is enabled in these applications, then the system is vulnerable to exploitation. A vulnerable system may be successfully exploited if a user is convinced to visit a specially crafted web page or open a specially crafted email. A remote, unauthenticated attacker may be able to execute arbitrary code on a compromised system. If the user has elevated privileges, then the attacker will be able to exploit them. More information can be found in the following US-CERT Vulnerability Note:
US-CERT urges users and administrators to implement the following recommendations:
XML Injection and Code Execution Vulnerabilities in Mozilla Suite added February 3, 2006 | updated February 6, 2006 US-CERT is aware of several vulnerabilities in Mozilla. Successful exploitation may allow a remote, unauthenticated attacker to execute arbitrary JavaScript commands with elevated privileges or cause a denial of service condition on a vulnerable system. More information can be found in the following US-CERT Vulnerability Note:
US-CERT urges users and administrators to implement the following recommendations:
Active Exploit for Buffer Overflow Vulnerability in Winamp added January 31, 2006 | updated February 6, 2006 US-CERT is aware of active exploitation of a buffer overflow vulnerability in Winamp. The buffer overflow is triggered when Winamp processes a specially crafted playlist (.PLS or .M3U) file that has a long "file" parameter. By convincing a user to open a playlist file, a remote, unauthenticated attacker can execute arbitrary code on a vulnerable system. Winamp can open a playlist without any user interaction as the result of viewing a specially crafted web site. More information can be found in the following US-CERT Vulnerability Note:
US-CERT urges users and administrators to implement the following recommendations:
Nyxem Mass-mailing Worm added January 24, 2006 | updated January 25, 2006 US-CERT is aware of a new mass-mailing worm known as Nyxem (CME-24). This worm relies on social engineering to propagate. Specifically, the user must click on a link or open an attached file. The Nyxem worm targets Windows systems that hide file extensions for known file types (this is the default setting for Windows XP and possibly other versions). The worm's icon makes it appear to be a WinZip file. As a result, the user may unknowingly start the worm. Once a Windows system is infected, the malicious code may:
In addition, on February 3, 2006, the worm will corrupt files and make them unusable by overwriting them with a small text message. The files with the following extensions are targeted on this date: DOC, XLS, MDB, MDE, PPT, PPS, ZIP, RAR, PDF, PSD, and DM. US-CERT strongly encourages users and system administrators to implement the following workarounds:
Additionally, US-CERT strongly encourages users not to follow unknown links, even if sent by a known and trusted source. Users may also wish to visit the US-CERT Computer Virus Resources for general virus protection information. Exploit for Vulnerability in VERITAS NetBackup Volume Manager Daemon added January 16, 2006 US-CERT is aware of a public exploit for a vulnerability in VERITAS NetBackup Volume Manager Daemon (vmd). The VERITAS NetBackup vmd listens on network port 13701/tcp. An attacker could send a specially crafted packet to the Volume Manager on a vulnerable system to cause a buffer overflow or a denial-of-service condition. Successful exploitation may allow may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system with root or SYSTEM privileges. More information about this vulnerability can be found in the following US-CERT Vulnerability Note:
US-CERT strongly encourages users and administrators to review the following mitigation to address this vulnerability as soon as possible:
Malicious Website Exploiting Sun Java Plug-in Vulnerability added January 12, 2006 | updated January 13, 2006 US-CERT is aware of an active malicious website that exploits a vulnerability in the Sun Java Runtime Enviroment (JRE). The initial report led US-CERT to believe the website was exploiting VU#974188. After further analysis, it was determined that the actual vulnerability being exploited was VU#760344. This vulnerability allows a Java Applet to bypass java security settings. Once these checks are bypassed, a remote attacker may be able to exploit this vulnerability to execute arbitrary code on the host machine. More information about these vulnerabilities can be found in the following US-CERT Vulnerability Notes:
US-CERT strongly encourages users and administrators to review the following mitigation to address this vulnerability as soon as possible:
Exploit for Vulnerability in Microsoft Windows Metafile Handling added December 28, 2005 | updated January 5, 2006 US-CERT is aware of active exploitation of a vulnerability in how Microsoft Windows handles Windows Metafiles (".wmf"). Several variations of the WMF exploit file have been released that attempt to avoid detection by anti-virus software and intrusion detection and intrusion prevention systems. A Windows system may be compromised through several methods including:
Once the vulnerability is exploited, a remote attacker may be able to perform any of the following malicious activities:
More information about this vulnerability can be found in the following:
Microsoft has released an update to address this vulnerability in Microsoft Security Bulletin MS06-001. US-CERT strongly encourages users and administrators to apply the appropriate updates as soon as possible. |
|||||||||||||||||||||||||||||||||||||||||||||||||||
Information For
Sign Up
Reporting
