This Week In Security: The Full Disclosure Rabbit Hole Re-Opens

Had you gone to sleep in 2004 and woken up three days ago, you’d be forgiven for thinking you’d only slept a few hours instead of a few years. This week saw the inglorious return of not just the full disclosure debate, but also of the heated rhetoric that usually accompanies it. Had you awoken to...

Googler Drops Windows Zero-Day, Microsoft Unhappy

Google security researcher Tavis Ormandy has set the cat among the “responsible disclosure” pigeons with the release of technical details of a zero-day vulnerability affecting the Microsoft Windows Help and Support Center without giving Microsoft adequate time to prepare a patch. The vulnerabilit...

Anatomy of the New Adobe Flash Exploit

The exploit that is being used in the attacks against the latest zero-day vulnerability in Adobe Flash is a modified version of a harmless SWF file that is only one byte different from the original file. Researchers have seen the exploit being used in active attacks against the vulnerability in...

NYTimes Report: Attackers Hit Google's Password System

The New York Times is reporting that Google’s password system was compromised during a targeted attack last December. The system, called Gaia or Single Sign-On, controls access by millions of users worldwide to almost all of the company’s Web services, including e-mail and business applications...

Monetary Value of Vulnerabilities Still High

The Pwn2Own contest is probably the best theoretical situation to show the damage that can be caused by skilled, dedicated attackers. However, throughout the contest, many researchers say the cash and hardware prizes were not enough to get them to give up “high-value” browser vulnerabilities. The...

Microsoft Confirms IE Zero-Day Used in Google Attack

Hackers linked to China used a zero-day vulnerability in Microsoft’s Internet Explorer browser to compromise corporate systems at more than 30 U.S. companies, including Google, Adobe and Juniper Networks. According to Microsoft, the vulnerability is still unpatched and can lead to remote code...

The Microsoft MsVidCtl Video Control Flaw Explained

From Websense Security Labs The recently publicized Zero-Day Vulnerability in Microsoft DirectShow is in the wild and spreads through infection of thousands of legitimate Web sites. The proof-of-concept of the vulnerability is out and exploitation is very easy to achieve. In our labs we have been...

Adobe PDF zero-day update: Turn off JavaScript

Adobe’s security response team is scrambling to investigate new public reports of a new zero-day vulnerability affecting uses of its widely deployed PDF Reader software. In a brief note posted to its PSIRT blog, Adobe confirmed it was investigating a code execution flaw, which affects Adobe Reade...

More information on ZERT patch for ANI 0day

Hi, more information about the patch released April 1st can be found here: http://zert.isotf.org/ Including: 1. Technical information. 2. Why this patch was released when eeye already released a third party patch. The newly discovered zero-day vulnerability in the parsing of animated cursors is...

[Full-disclosure] EEYE: Temporary workaround for IE createTextRange vulnerability

eEye Digital Security has created a temporary work around for the current Internet Explorer zero day vulnerability within the IE createTextRange functionality. This workaround has been created because currently there is no solution from Microsoft other than the workaround to disable Active...