Threat Outbreak Alert RuleID22130: Email Messages Distributing Malicious Software on April 7, 2016

Medium Alert ID: 44549 First Published: 2016 April 7 20:10 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID22130 may contain the following files: Name | Siz...

Threat Outbreak Alert RuleID22043: Email Messages Distributing Malicious Software on April 1, 2016

Medium Alert ID: 44457 First Published: 2016 April 4 13:51 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID22043 may contain the following files: Name | Siz...

Threat Outbreak Alert RuleID22041: Email Messages Distributing Malicious Software on April 1, 2016

Medium Alert ID: 44420 First Published: 2016 April 1 16:21 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID22041 may contain the following files: Name | Siz...

Threat Outbreak Alert RuleID20754: Email Messages Distributing Malicious Software on January 27, 2016

Medium Alert ID: 43240 First Published: 2016 January 27 19:50 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID20754 may contain the following files: Name |...

Intuit Suspends Turbo Tax, Investigating Fraudulent Returns

UPDATE: This story has been updated with commentary from Intuit. Intuit last Thursday suspended its Turbo Tax e-filing service after a dramatic increase in suspicious filings and criminal attempts to leverage stolen identities in order to claim tax refunds. Intuit has since restored Turbo Tax and...

MIRcon 2014 – Day 1 Highlights

The first day of MIRcon 2014 is officially done and was packed with thought-provoking keynotes, presentations and a one-of-a-kind reception. While there's too much to fit into this blog post, I wanted to provide you with some of the highlights: FireEye's COO, Kevin Mandia kicked-off MIRcon and wa...

INTUIT ONLINE Cloud Service Detection

Binary data 8463.prm...

Fake Payroll Confirmation Email Leads to Black Hole Exploit Kit

Criminal hackers launched an attack campaign earlier this week in which they sent a slew of emails purporting to come from the financial software developer Intuit. The emails contained links that led to sites hosting the Blackhole exploit kit in an apparent attempt to infect the machines of...

CVE-2010-5198

Multiple untrusted search path vulnerabilities in Intuit QuickBooks 2010 allow local users to gain privileges via a Trojan horse 1 dbicudtx11.dll, 2 mfc90enu.dll, or 3 mfc90loc.dll file in the current working directory, as demonstrated by a directory that contains a .des, .qbo, or .qpg file. NOTE...

Design/Logic Flaw

Multiple untrusted search path vulnerabilities in Intuit QuickBooks 2010 allow local users to gain privileges via a Trojan horse 1 dbicudtx11.dll, 2 mfc90enu.dll, or 3 mfc90loc.dll file in the current working directory, as demonstrated by a directory that contains a .des, .qbo, or .qpg file. NOTE...

CVE-2010-5198

Multiple untrusted search path vulnerabilities in Intuit QuickBooks 2010 allow local users to gain privileges via a Trojan horse 1 dbicudtx11.dll, 2 mfc90enu.dll, or 3 mfc90loc.dll file in the current working directory, as demonstrated by a directory that contains a .des, .qbo, or .qpg file. NOTE...

CVE-2010-5198

CVE-2010-5198 affects Intuit QuickBooks 2010. The issue is described as multiple untrusted search path vulnerabilities that allow local privilege escalation when a malicious DLL is placed in the current working directory. Specifically, the vulnerable components are (1) dbicudtx11.dll, (2) mfc90en...

CVE-2010-5198: Undefined Security Weakness

Multiple untrusted search path vulnerabilities in Intuit QuickBooks 2010 allow local users to gain privileges via a Trojan horse 1 dbicudtx11.dll, 2 mfc90enu.dll, or 3 mfc90loc.dll file in the current working directory, as demonstrated by a directory that contains a .des, .qbo, or .qpg file. NOTE...

PT-2012-1410

Name of the Vulnerable Software and Affected Versions Intuit QuickBooks version 2010 Description The issue allows local users to gain privileges via a Trojan horse dbicudtx11.dll, mfc90enu.dll, or mfc90loc.dll file in the current working directory. This can be demonstrated by a directory that...

CVE-2012-2418

Heap-based buffer overflow in the intu-help-qb aka Intuit Help System Async Pluggable Protocol handlers in HelpAsyncPluggableProtocol.dll in Intuit QuickBooks 2009 through 2012, when Internet Explorer is used, allows remote attackers to cause a denial of service memory corruption or possibly...

CVE-2012-2419

Memory leak in the intu-help-qb aka Intuit Help System Async Pluggable Protocol handlers in HelpAsyncPluggableProtocol.dll in Intuit QuickBooks 2009 through 2012, when Internet Explorer is used, allows remote attackers to cause a denial of service memory consumption via a URI with multiple...

CVE-2012-2420

The intu-help-qb aka Intuit Help System Async Pluggable Protocol handlers in HelpAsyncPluggableProtocol.dll in Intuit QuickBooks 2009 through 2012, when Internet Explorer is used, might allow remote attackers to obtain sensitive information via a URI with a % percent character as its 1 last or 2...

CVE-2012-2421

Absolute path traversal vulnerability in the intu-help-qb aka Intuit Help System Async Pluggable Protocol handlers in HelpAsyncPluggableProtocol.dll in Intuit QuickBooks 2009 through 2012, when Internet Explorer is used, might allow remote attackers to read arbitrary files in ZIP archives via a...

CVE-2012-2423

The intu-help-qb aka Intuit Help System Async Pluggable Protocol handlers in HelpAsyncPluggableProtocol.dll in Intuit QuickBooks 2009 through 2012, when Internet Explorer is used, provide different responses to remote requests depending on whether a ZIP pathname is valid, which allows remote...

CVE-2012-2424

The intu-help-qb aka Intuit Help System Async Pluggable Protocol handlers in HelpAsyncPluggableProtocol.dll in Intuit QuickBooks 2009 through 2012, when Internet Explorer is used, allow remote attackers to cause a denial of service NULL pointer dereference and application crash via a URI that lac...