• Здраво и добредојдовте на форумот на IT.mk.

    Доколку сеуште не сте дел од најголемата заедница на ИТ професионалци и ентузијасти во Македонија, можете бесплатно да се - процесот нема да ви одземе повеќе од 2-3 минути, а за полесна регистрација овозможивме и регистрирање со Facebook и Steam.

Attackers target unpatched QuickTime flaw

Статус
Затворена за нови мислења.
  • Ја почнал/а темата
  • #1

AMD_fan

Gaining Experience
10 ноември 2007
3,646
139
Attackers are trying to exploit an unpatched vulnerability in Apple's QuickTime software that could let them run code on a victim's computer, Symantec warned in a DeepSight Threat Management System alert issued Sunday.
Click here to find out more!

First observed on Saturday, the attacks appear to be aimed at Windows users, but Mac OS users could also be at risk since the QuickTime vulnerability in question affects both operating systems, the alert said. That vulnerability, called the Apple QuickTime RTSP Response Header Stack-Based Buffer Overflow Vulnerability, was first disclosed on Nov. 23 and remains unpatched by Apple.

Researchers have shown that the QuickTime vulnerability affects a range of operating systems, including Windows XP, Windows Vista, MacOS X 10.4, and the recently released MacOS X 10.5, also called Leopard. The vulnerability can be exploited through Internet Explorer, Firefox, Opera, and Safari.

There are two types of attacks underway, Symantec said. In the first, victims' computers are being redirected from an adult Web site, Ourvoyeur.net, to another Web site that infects the computer with an application called loader.exe, which can be saved to the computer as metasploit.exe, asasa.exe, or syst.exe. Once installed on a computer this application downloads another binary file, which Symantec identified as Hacktool.Rootkit, a set of tools that can be used to break into a system.

Symantec said it was possible attackers had managed to compromise Ourvoyeur.net as part of the attack.

The second attack also involves redirection, and Symantec is currently investigating the attack to determine what if any malicious code is involved.

To protect systems from attack, Symantec recommended blocking access to affected sites. "Filter outgoing access to 85.255.117.212, 85.255.117.213, 216.255.183.59, 69.50.190.135, 58.65.238.116, and 208.113.154.34. Additionally 2005-search.com, 1800-search.com, search-biz.org, and ourvoyeur.net should be filtered," it said, adding IT managers can also block outgoing TCP access to port 554.

Alternatively, IT managers could take more drastic steps.

"As a last measure, QuickTime should be uninstalled until patches are available," the alert said.

Source:http://security.itworld.com/4345/071203quicktimeflaw/page_1.html
 
Статус
Затворена за нови мислења.

Нови мислења

Последни Теми

Статистика

Теми
43,496
Мислења
821,772
Членови
28,040
Најнов член
Mrale
На врв Дно