Hancitor (AKA Chanitor) observed using multiple attack approaches

Many threat actors use multiple attack vectors to ensure success. The individuals using Hancitor malware also known by the name Chanitor are no exception and have taken three approaches to deliver the malware in order to ultimately steal data from their victims. These techniques include uncommon...

File Roller 'src/file-utils.c' Directory Traversal Vulnerability

File Roller is for the Gnome desktop environment provides a graphical interface to operate the compressed, archived files, similar to the KDE desktop environment, Ark. A target traversal vulnerability exists in File Roller 3.5.4-3.20.2. If the target user opens a malicious document, it can cause...

Adobe Acrobat Reader XFA FormCalc replace Integer Overflow (CVE-2016-1043)

An integer overflow vulnerability exists in Adobe Acrobat Reader. The vulnerability is due to improper validation of the parameters for a certain function. A remote attacker could exploit this vulnerability by enticing a user to open a maliciously crafted document. Successful exploitation of the...

Adobe Acrobat/Reader Javascript API Execution Bypass Vulnerability (CNVD-2015-06715)

Adobe Reader/Acrobat is a popular application for working with PDF files. An unspecified security bypass vulnerability exists in Adobe Reader/Acrobat. The vulnerability allows an attacker to construct a malicious PDF file and trick the user into parsing it, which could bypass Javascript API...

Adobe Acrobat/Reader Javascript API Execution Bypass Vulnerability (CNVD-2015-06719)

Adobe Reader/Acrobat is a popular application for working with PDF files. An unspecified security bypass vulnerability exists in Adobe Reader/Acrobat. The vulnerability allows an attacker to construct a malicious PDF file and trick the user into parsing it, which could bypass Javascript API...

Adobe Acrobat/Reader Memory Misreference Vulnerability (CNVD-2015-06684)

Adobe Reader/Acrobat is a popular application for working with PDF files. An unspecified memory misreference vulnerability exists in Adobe Reader/Acrobat. This allows an attacker to construct a malicious PDF file and trick the user into parsing it, which could crash the application or execute...

Adobe Acrobat/Reader Bypass Information Disclosure Vulnerability (CNVD-2015-06733)

Adobe Reader/Acrobat is a popular application for working with PDF files. An information disclosure bypass vulnerability exists in Adobe Reader/Acrobat. Allowing an attacker to construct a malicious PDF file and trick the user into parsing it, sensitive information can be obtained...

Adobe Acrobat/Reader Bypass Information Disclosure Vulnerability (CNVD-2015-06736)

Adobe Reader/Acrobat is a popular application for working with PDF files. Adobe Reader/Acrobat suffers from a bypass information disclosure vulnerability that allows an attacker to construct a malicious PDF file and trick the user into parsing it, which could lead to sensitive information...

Adobe Acrobat/Reader Javascript API Execution Bypass Vulnerability (CNVD-2015-06697)

Adobe Reader/Acrobat is a popular application for working with PDF files. An execution bypass vulnerability exists in Adobe Reader/Acrobat. Allows an attacker to construct a malicious PDF file and trick the user into parsing it, which can bypass Javascript API execution restrictions...

Adobe Acrobat/Reader Javascript API Execution Bypass Vulnerability (CNVD-2015-06690)

Adobe Reader/Acrobat is a popular application for working with PDF files. An execution bypass vulnerability exists in Adobe Reader/Acrobat. Allows an attacker to construct a malicious PDF file and trick the user into parsing it, which can bypass Javascript API execution restrictions...

Apple iOS ICC Profile Handling Memory Corruption Vulnerability

Apple iOS is the latest operating system that runs on Apple's iPhone and iPod touch devices. A memory corruption vulnerability exists in Apple iOS's handling of ICC files, which allows attackers to construct malicious PDF files and trick users into parsing them, which can execute arbitrary code...

Malicious Microsoft Office Documents: Generate-Macro

This script will generate malicious Microsoft Excel Documents that contain VBA macros. This script will prompt you for an IP address and port you will receive your shell at this address and port and the name of the malicious document. From there, the script will then prompt you to choose from a...

Updated qt3 packages fix security vulnerabilities

Updated qt3 packages fix security vulnerabilities: QXmlSimpleReader in Qt versions prior to 5.2 supports expansion of internal entities in XML documents without placing restrictions to ensure the document does not cause excessive memory usage. If an application using this API processes untrusted...

Threat Outbreak Alert: Fake Bank Document Delivery Email Messages on February 20, 2014

Medium Alert ID: 32940 First Published: 2014 February 20 17:03 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a bank document for the recipient. The text in the email message attempts to convince the recipient to open t...

qt4-xml -- XML Entity Expansion Denial of Service

Richard J. Moore reports: QXmlSimpleReader in Qt versions prior to 5.2 supports expansion of internal entities in XML documents without placing restrictions to ensure the document does not cause excessive memory usage. If an application using this API processes untrusted data then the application...

ABB Test Signal Viewer CWGraph3D ActiveX Arbitrary File Creation (CVE-2013-5022)

An arbitrary file writing vulnerability exists in ABB Test Signal Viewer. The vulnerability is due to a directory traversal error in the exposed insecure method ExportStyle by the included CWGraph3D cw3dgrph.ocx ActiveX control. An attacker could exploit this vulnerability by enticing the target...

Business Partners Give Hackers Easy Access to Secure Firms

As frequently targeted, high-value companies continue fortifying their defenses, FireEye researchers claim that attackers are increasingly setting their sights on the affiliated but not-as-well-protected third-party organizations that do business with them. By aiming phishing email campaigns at...

Phishing for Fanboys with Phony iPhone 5 Images

There is no such thing as a trivial detail when it comes to the impending release of an Apple product and scammers are well aware of this. A recent attack is exploiting the public’s fascination with all things Apple and the ubiquitous interest in anything iPhone 5-related with an email phishing...

MS12-005 Microsoft Office ClickOnce Unsafe Object Package Handling Vulnerability

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' require 'rex/zip' class Metasploit3...

Print of one malicious document can expose your whole LAN

Print of one malicious document can expose your whole LAN This year at Chaos Communications Congress 28C3 Ang Cui presents Print Me If You Dare, in which he explained how he reverse-engineered the firmware-update process for HPs hundreds of millions of printers and In Andrei Costin's presentation...