Infected add-ons found on Mozilla download site


Mozilla has discovered two 'experimental' add-ons for its Firefox browser which contain dangerous malware. According to Mozilla, version 4.0 of Sothink Web Video Downloader is infected with password sniffer Win32.LdPinch.gen and Master Filer is infected with the backdoor trojan Win32.Bifrose. Where malware has infected a Windows system following installation of an infected browser add-on, uninstalling the add-on alone will not remove the infection.

In its advisory on the problem, Mozilla lists several anti-virus programs which are able to recognise the malware and have been able to do so for some time. But this is where it gets embarrassing for Mozilla – the infected add-ons have been available from the official download site for several months and, according to Mozilla, have together been downloaded around 4,600 times. The infected add-ons were only discovered and removed, on 25th January and 2nd February, following use of additional anti-virus scanning software by Mozilla.

Mozilla should really have been alert to the danger since malware had been found in a Vietnamese language pack back in 2008. In that case the malware merely displayed advertising, but it could, according to Mozilla developers, also have been used for more nefarious activities. That script, designated HTML.Xorer also appears to have slipped past Mozilla's anti-virus scanner. As a result, Mozilla developers announced that the add-on directory would in future be checked for malware on a daily basis.

The current case illustrates the point that it is still advisable to check add-ons for viruses before installing them, using, for example, an online service such as VirusTotal.

http://www.h-online.com/security/news/item...ite-924307.html

Microsoft to fix 26 vulnerabilities on patch day


This Tuesday, the 9th of February, Microsoft plans to fix 26 security vulnerabilities in Office and in all supported Windows versions. There are 13 updates and bulletins describing the threats posed, five of which the company classes as critical. Microsoft's Security Response Team is already recommending administrators and users to treat bulletins 1 ,2, 3 and 6 as maximum priority and to test and install them as soon as they are made available.

The bugs fixed include the now 17 year old vulnerability in the Virtual DOS Machine, which, using various tricks, allows 16-bit programs to manipulate the kernel stack belonging to any process. This can be exploited by users with restricted privileges to execute code with system privileges.

There will not be a patch for the newly discovered vulnerability in Internet Explorer. Microsoft does not appear to be prioritising this problem, since it primarily affects pre-Vista Windows versions. From Vista onwards, Internet Explorer (7 and 8) runs in protected mode, which prevents exploitation of the vulnerability. A fix-it tool is available for earlier versions.

The denial-of-service (DoS) vulnerability in the Windows 7 and Windows Server 2008 R2 SMB clients, discovered in mid November, will also remain unpatched. This bug can only be exploited using manipulated SMB servers sending crafted packets to clients – a scenario which apparently occurs so infrequently that Microsoft has yet to see a single instance. The vulnerability when parsing file names with semicolon extensions in Internet Information Server 6.0 (IIS) will likewise remain unpatched.

Microsoft is also reminding users that support for various Windows versions expires this year. There will be no further updates for Windows 2000 after 13th July 2010 and Windows XP Service Pack 2 will also cease to be supported after this date. SP2 users are advised to update to SP3. Windows Vista RTM will be supported until 13th April 2010 only, Vista SP1 until 12th July 2011.

http://www.h-online.com/security/news/item...day-923011.html

Microsoft Security Bulletin Advance Notification for February 2010
Microsoft Security Bulletin Advance Notification issued: February 4, 2010
Microsoft Security Bulletins to be issued: February 9, 2010

5 Critical
7 Important
1 Moderate

http://www.microsoft.com/technet/security/...n/ms10-feb.mspx

Fake Firefox site bundles undead adware



http://www.theregister.co.uk/2010/02/03/fa...refox_download/

Microsoft confirms new vulnerability in Internet Explorer


Microsoft has confirmed the existence of a security vulnerability revealed at the Black Hat DC security conference on Tuesday and itself issued a warning. The vulnerability allows a crafted website to access and read the content of arbitrary files on a PC. Although an attacker needs to know the specific path and file name, for a standard Windows installation these are usually known default paths.

All versions of Internet Explorer from 5.01 to 8 on all supported Windows platforms are reportedly affected. Windows XP Home users, however, appear to be unaffected by the problem, as XP Home does not include a hidden C$ administrative share for websites to access. For Internet Explorer 7 and 8 running under Windows 7, Vista or Server 2003/2008, the vulnerability cannot be exploited as long as protected mode is activated in the browser (as it is by default).

Microsoft has said that it is looking into how it can solve the problem. However, solving it is not going to be straightforward, as Jorge Luis Alvarez Medina of Core Security Technologies, who discovered the vulnerability, has repeatedly stressed. The crux of the problem is that security zone settings in Internet Explorer do not always bite if a path is entered in the browser in UNC (Uniform Naming Convention) format (e.g. file://127.0.0.1/C$/.../index.dat). This means that under specific conditions JavaScript from the Internet Zone can access (and render) local files, despite the zone model being intended to prevent this.

Core Security reported two similar cross-domain vulnerabilities to Microsoft in 2008 and 2009, for which Microsoft released updates. However, until now, Microsoft has always merely patched things up, without addressing the actual core problem. As a result Medina has been able to discover a new means of reading local files. To overcome the hurdles set up by Microsoft, he takes advantage of a bug in the way the MIME type of local files is determined and a weakness when processing OBJECT tags.

As an interim solution, Microsoft has released a downloadable fix-it tool which disables the Internet Explorer file protocol. This could, however, cause problems for some other applications.

http://www.h-online.com/security/news/item...rer-922111.html

The H ´Online Security reports on 3 February about hackers which hacked emission trade scheme, causing a huge financial damage

The H Online report 1. February 2010 about lot of open holes in VMware products