AplusWebMaster
Topic Starter
FYI…
- http://preview.tinyurl.com/5omupm
April 7, 2008 (Computerworld) - " Hackers are using a new multiple-attack package composed of seven ActiveX exploits, many of them never seen in the wild before, said a security company on Friday… The attack framework probes Windows PCs for vulnerable ActiveX controls from software vendors Microsoft, Citrix Systems and Macrovision, as well as hardware makers D-Link Corp., Hewlett-Packard, Gateway and Sony… said Symantec researcher Patrick Jungles, who wrote an analysis of the multistrike package for customers of the company's DeepSight threat service. According to Jungles, visitors to compromised Web sites are redirected by a rogue IFRAME to a malicious site serving the package. The attack pack tests the victim's PC for each ActiveX control, detects whether a vulnerable version of a control is installed, and then launches an attack when it finds one… The seven exploited in the package outlined by Jungles are a mix of old and brand-new flaws… Four of the seven ActiveX flaws - those in the D-Link, Gateway, Sony, and Macrovision products - have not been patched, said Jungles… Jungles' report recommended that users apply patches, when they're available, and set the "kill bit" on those ActiveX controls which have not yet been updated by their makers."
- http://preview.tinyurl.com/5omupm
April 7, 2008 (Computerworld) - " Hackers are using a new multiple-attack package composed of seven ActiveX exploits, many of them never seen in the wild before, said a security company on Friday… The attack framework probes Windows PCs for vulnerable ActiveX controls from software vendors Microsoft, Citrix Systems and Macrovision, as well as hardware makers D-Link Corp., Hewlett-Packard, Gateway and Sony… said Symantec researcher Patrick Jungles, who wrote an analysis of the multistrike package for customers of the company's DeepSight threat service. According to Jungles, visitors to compromised Web sites are redirected by a rogue IFRAME to a malicious site serving the package. The attack pack tests the victim's PC for each ActiveX control, detects whether a vulnerable version of a control is installed, and then launches an attack when it finds one… The seven exploited in the package outlined by Jungles are a mix of old and brand-new flaws… Four of the seven ActiveX flaws - those in the D-Link, Gateway, Sony, and Macrovision products - have not been patched, said Jungles… Jungles' report recommended that users apply patches, when they're available, and set the "kill bit" on those ActiveX controls which have not yet been updated by their makers."