TippingPoint Threat Intelligence and Zero-Day Coverage – Week of March 12, 2018

This week marked the 11th annual Pwn2Own contest held during the CanSecWest conference in Vancouver and while the contest had fewer entries compared to previous years, it was still an exciting event filled with a little drama. Over the course of two days, the Zero Day Initiative awarded $267,000...

dlplibs/cdrfuzzer: Use-of-uninitialized-value in libcdr::CDRContentCollector::_generateBitmapFromPattern

Detailed report: https://oss-fuzz.com/testcase?key=5929090067464192 Project: dlplibs Fuzzer: libFuzzerdlplibscdrfuzzer Fuzz target binary: cdrfuzzer Job Type: libfuzzermsandlplibs Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

A View of Upcoming Threat Coverage from Pwn2Own 2018

This blog will be updated throughout the competition so keep tracking for the latest updates on upcoming threat coverage! St. Patrick’s Day is coming up later this week, but the contestants at Pwn2Own 2018 will need more than luck on their side. They will need to dive into their expert hacking...

Flash, Windows Users: It’s Time to Patch

Adobe and Microsoft each pushed critical security updates to their products today. Adobe's got a new version of Flash Player available, and Microsoft released 14 updates covering more than 75 vulnerabilities, two of which were publicly disclosed prior to today's patch release. The Microsoft updat...

imagemagick/encoder_pdb_fuzzer: Use-of-uninitialized-value in PushColormapIndex

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=5687802160218112 Project: imagemagick Fuzzer: libFuzzerimagemagickencoderpdbfuzzer Fuzz target binary: encoderpdbfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type:...

A week in security (March 05 – March 11)

Last week on Malwarebytes Labs, we paid homage to several women in tech, including some of our very own, on International Women's Day and shared their stories. We also looked into an adware posing as an Android app that claims to live stream the 2018 Winter Olympics, exposed scammers that go by t...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of March 5, 2018

Today marks the first day of South by Southwest SXSW here in Austin and if you happen to be in town for the event, Trend Micro will be there! Starting tomorrow, Trend Micro will be exhibiting at the SXSW Job Market in booth 523. The SXSW Job Market is being held on March 10-11, 2018 at the Palmer...

imagemagick/encoder_psd_fuzzer: Use-of-uninitialized-value in ClampPixel

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=5650303102746624 Project: imagemagick Fuzzer: libFuzzerimagemagickencoderpsdfuzzer Fuzz target binary: encoderpsdfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type:...

International Women’s Day: Women in tech share their stories

From the metoo movement to Oprah's Time's Up speech to the women's marches on cities throughout the world—it's been a banner year for women's rights. And on this International Women's Day, we wanted to do more than pay lip service to the changes in feminist dialogue. After all, tech is an industr...

Leaked NSA Dump Also Contains Tools Agency Used to Track Other Hackers

A years ago when the mysterious hacking group 'The Shadow Brokers' dumped a massive trove of sensitive data stolen from the US intelligence agency NSA, everyone started looking for secret hacking tools and zero-day exploits. A group of Hungarian security researchers from CrySyS Lab and Ukatemi ha...

Eaton ELCSoft

CVSS v3 6.3 ATTENTION: Exploitable remotely/low skill level to exploit. Vendor: Eaton Equipment: ELCSoft Vulnerability: Improper Input Validation AFFECTED PRODUCTS ELCSoft is programming software for all Eaton ELC programmable logic controllers. The ELC programmable logic controllers are not...

gdal/envi_fuzzer: Heap-buffer-overflow in ENVIDataset::ReadHeader

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=5710112736935936 Project: gdal Fuzzer: libFuzzergdalenvifuzzer Fuzz target binary: envifuzzer Job Type: libfuzzerasangdal Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

gdal/avce00_fuzzer: Heap-use-after-free in OGRAVCLayer::AppendTableDefinition

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=5310171959001088 Project: gdal Fuzzer: aflgdalavce00fuzzer Fuzz target binary: avce00fuzzer Job Type: aflasangdal Platform Id: linux Crash Type: Heap-use-after-free READ 2 Crash Address: 0x611000000faa...

imagemagick/encoder_mvg_fuzzer: Crash in TracePoint

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=5950563343663104 Project: imagemagick Fuzzer: libFuzzerimagemagickencodermvgfuzzer Fuzz target binary: encodermvgfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type:...

skia/api_draw_functions: Use-of-uninitialized-value in sk_store_bgra

Project: https://skia.googlesource.com/skia.git Detailed report: https://oss-fuzz.com/testcase?key=5230900821360640 Project: skia Fuzzer: libFuzzerskiaapidrawfunctions Fuzz target binary: apidrawfunctions Job Type: libfuzzermsanskia Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of February 26, 2018

Pwn2Own 2018 is coming up in a couple of weeks and I am excited to see what interesting vulnerabilities will pop up at the contest. I attempted to explain the contest to my mom, and in the simplest terms, I told her that Pwn2Own is a contest where contestants are rewarded for breaking something...

FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines

Office 365 Advanced Threat Protection Office 365 ATP blocked many notable zero-day exploits in 2017. In our analysis, one activity group stood out: NEODYMIUM. This threat actor is remarkable for two reasons: Its access to sophisticated zero-day exploits for Microsoft and Adobe software Its use of...

graphicsmagick/coder_XCF_fuzzer: Use-of-uninitialized-value in AlphaCompositePixel

Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed report: https://oss-fuzz.com/testcase?key=5069895264894976 Project: graphicsmagick Fuzzer: libFuzzergraphicsmagickcoderXCFfuzzer Fuzz target binary: coderXCFfuzzer Job Type: libfuzzermsangraphicsmagick Platform Id: linux Crash Type:...

Delta Electronics Delta Industrial Automation DOPSoft

CVSS v3 6.3 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Delta Electronics Equipment: Delta Industrial Automation DOPSoft Vulnerability: Stack-based Buffer Overflow AFFECTED PRODUCTS The following version of Delta Industrial Automation DOPSoft, a human machine interface HMI...

graphicsmagick/coder_TOPOL_fuzzer: Use-of-uninitialized-value in InsertRow

Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed report: https://oss-fuzz.com/testcase?key=4613781415002112 Project: graphicsmagick Fuzzer: libFuzzergraphicsmagickcoderTOPOLfuzzer Fuzz target binary: coderTOPOLfuzzer Job Type: libfuzzermsangraphicsmagick Platform Id: linux Crash Type...