Behind the Scenes of the Botnet Epidemic

2009 saw many, many new botnet outbreaks and advancements in their criminal management. Throughout the year Damballa tracked thousands of distinct criminal operated botnets and identified millions of newly compromised enterprise systems each day. This week I’m going to share some of our findings...

Zeus Botnet Steals $150K from Michigan Company

An insurance firm in Michigan lost nearly $150,000 this month as a result of a single computer virus infection. Read the full article. KrebsonSecurity...

New Criminal Toolkit Touts Zeus Killing

Purveyors of a new botnet toolkit are touting a feature aimed at aspiring cybercriminals: the opportunity to commandeer computers already compromised by an established crimeware package known as Zeus. Read the full article. The Register...

Zeus Trojan Attacking NSA, .gov Sites

Criminals are spamming the Zeus banking Trojan in a convincing e-mail that spoofs the National Security Agency. Initial reports indicate that a large number of government systems may have been compromised by the attack. Read the full article. KrebsonSecurity...

Zeus Trojan Found in Fake AIM Update

A new iteration of Zeus, a notorious password-stealing trojan, is victimizing users of AOL Instant Messenger AIM, according to researchers. Read the full article. Secure Computing...

Update Protection against Zeus Web Server SSL2_Client_Hello Buffer Overflow

Zeus Web Server is a web server for Unix and Unix-like platforms. A buffer overflow was detected in Zeus Web Server SSL2 implementation SSL2CLIENTHELLO...

Code injection

Zeus Web Server before 4.3r5 does not use random transaction IDs for DNS requests, which makes it easier for remote attackers to spoof DNS responses...

Cross site scripting

Cross-site scripting XSS vulnerability in Zeus Web Server before 4.3r5, when SSL is enabled for the admin server, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2002-1785...

CVE-2010-0363

Cross-site scripting XSS vulnerability in Zeus Web Server before 4.3r5, when SSL is enabled for the admin server, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2002-1785...

CVE-2010-0362

Zeus Web Server before 4.3r5 does not use random transaction IDs for DNS requests, which makes it easier for remote attackers to spoof DNS responses...

Buffer overflow

Buffer overflow in the SSLv2 support in Zeus Web Server before 4.3r5 allows remote attackers to cause a denial of service daemon crash or possibly execute arbitrary code via a long string in an invalid Client Hello message...

CVE-2010-0359

Buffer overflow in the SSLv2 support in Zeus Web Server before 4.3r5 allows remote attackers to cause a denial of service daemon crash or possibly execute arbitrary code via a long string in an invalid Client Hello message...

CVE-2010-0363

Cross-site scripting XSS vulnerability in Zeus Web Server before 4.3r5, when SSL is enabled for the admin server, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2002-1785...

CVE-2010-0363

CVE-2010-0363 is an XSS vulnerability in Zeus Web Server prior to 4.3r5, specifically involving the Zeus Administration Server when SSL is enabled for the admin interface. Connected records confirm affected product/version ranges (e.g., Zeus Web Server 4.0–4.1r2) and that remote attackers can inj...

CVE-2010-0362

Affected product/versions: Zeus Web Server before 4.3r5. Root cause: failure to use random DNS transaction IDs for DNS requests, which can enable remote attackers to spoof DNS responses. Impact (as stated): DNS spoofing potential. Exploitation details: not provided in the connected documents. Rem...

CVE-2010-0359

Buffer overflow in the SSLv2 support in Zeus Web Server before 4.3r5 allows remote attackers to cause a denial of service daemon crash or possibly execute arbitrary code via a long string in an invalid Client Hello message...

CVE-2010-0359

CVE-2010-0359 affects Zeus Web Server before 4.3r5. The SSLv2 support, specifically SSL2_CLIENT_HELLO handling, can overflow a buffer due to insufficient boundary checks on user-supplied data, enabling a remote attacker to cause a daemon crash or possibly execute arbitrary code. Impact: full comp...

CVE-2010-0362

Zeus Web Server before 4.3r5 does not use random transaction IDs for DNS requests, which makes it easier for remote attackers to spoof DNS responses...

Zeus Web Server 'SSL2_CLIENT_HELLO' Remote Buffer Overflow Vulnerability

Zeus Web Server is prone to a buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective...

Zeus Web Server 'SSL2_CLIENT_HELLO' Remote Buffer Overflow Vulnerability

Zeus Web Server is prone to a buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user- supplied data. Attackers can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a...