Advisory #238 - QuickTime, Multiple News

Sûnnet Beskerming Alert List Advisory #238

You are receiving this message because you have subscribed to our  
Information Security Alert Mailing List, or have been selected for a  
specific one-off copy.  If you believe that you are receiving this  
message in error, please contact info@... to resolve the  
error.

Why not upgrade to get same day notification on security threats?  
Details and rates available online -
(http://www.beskerming.com/premium/generic_advisory.html).

Why not go the next step and get delivery tailored just for your  
company?
(http://www.beskerming.com/premium/focussed_advisory.html)


Contents
--------------------------------------------------------------------
1. SECURITY
--------------------------------------------------------------------
1.1 QuickTime
        - Remote Hacker Automatic Control
        - Time Since Discovery - 2 Days
=======================================
/*
        - Remote or Local - Can it be achieved through a network or does it  
require physical access?
        - Hacker - The bad guy
        - Manual or Automatic  - Does the vulnerability need to be manually  
performed, or can it be automated?
        - Control, Denial of Service or Data Theft - Will the hacker get  
control of your system / website, will they prevent you from using  
it, or will they steal data.
*/
--------------------------------------------------------------------
2.    NEWS
--------------------------------------------------------------------
2.1 Apple Busy in Otherwise Quiet Security Period
2.2 New Attention on Old Exploits
=====================================

1. SECURITY

1.1 QuickTime - Remote Hacker Automatic Control

        -- Products Affected --
        QuickTime 7.1.5 and prior.

        -- Technical Description --
        A heap overflow affecting QuickTime for Java can lead to arbitrary  
code execution, while a second issue addresses a memory leak from  
QuickTime for Java, which can allow a remote user to read arbitrary  
sections of the browser memory (potentially disclosing sensitive data  
in the browser).

        -- Description --
        Apple have released an updated version of the QuickTime media codec  
to address two serious issues with QuickTime for Java support. The  
vulnerabilities can lead to a remote attacker being able to take  
control of a vulnerable system in the worst case, and allow remote  
attackers to gain access to sensitive information in the second case.

        -- Recommended Action --
        Update to QuickTime 7.1.6 as soon as possible, either via the  
Product Updates link, or via the Software Update application (Apple  
Menu->Software Update)

        -- Source --
        (Paid subscription required to access)

        -- Updates Available --
        (Paid subscription required to access)

        -- External Tracking Data --
        (Paid subscription required to access)

        -- Threat Matrix --
                        U O
        Home User 9 9  (Critical)
        Corporate 9 9  (Critical)

=======================================
/*
Threat Matrix:
        U - User
        O - Operator
        Harmless - 0 ----- 10 - Highly Critical
*/
=======================================

2. NEWS

2.1 Apple Busy in Otherwise Quiet Security Period

Although there has been no reporting over the last few days, Sûnnet  
Beskerming staff have continued to track and monitor information  
security sources while the United States observed Memorial Day, and  
the UK observed the Spring Bank Holiday.

Following the return to work for these major markets, most news  
reporting covered material that has previously been covered by Sûnnet  
Beskerming analysis and coverage, including material that was several  
weeks or months old.

Even though there was a slow period over the last few days some  
companies still found the time to make significant security-related  
releases. Apple have released their fifth combined security update  
for the year, and have also released a separate update for QuickTime,  
today.

For some researchers, this release process by Apple can not come fast  
enough. In the words of one:

"...I use apple products enough that little by little I'm hoping I  
can help to nudge their priorities towards implimenting[sic] some  
defense in depth on their platform, cause[sic] right now, from a  
security standpoint they are way behind MS.."

This comment was made by Mike Lynn, previously better known for his  
disclosure of Cisco software related threats at DefCon. The increased  
focus from a noted security researcher on the Apple Macintosh  
platform should result in improved security results for Apple customers.


2.2 New Attention on Old Exploits

A relatively well-crafted targeted phishing scam (some might call it  
spear phishing) has attracted significant recent attention after  
senior executives at an Information Security company were recently  
targeted.

Despite the scam being known about for a number of months, the  
audacity of the attackers to target an Information Security company  
is a refreshing difference to most phishing efforts. Limiting attacks  
to senior management is also an interesting move.

The basics of the scam involve sending targeted emails (correct  
names, company positions and other position-related information) to  
specific individuals claiming to include a complaint registered at  
the Better Business Bureau against the firm.

Relying on the target to have a natural desire to address any  
complaints targeting their firm, the attackers are making use of  
basic social engineering techniques to get their victims to open the  
infected .rtf file which contains the downloader that launches the  
rest of the infection on the target's machine.

Unfortunately for targeted users, there are a lot of antivirus  
vendors that still can not detect the malware being distributed and  
installed by this particular phishing attempt. According to at least  
one firm, more than 1,400 victims have successfully been targeted by  
this attack.

With a Bancos variant being the most common installation target, this  
lack of coverage from the major antivirus vendors is placing many of  
the targeted victims at risk, especially if they have trusted their  
antivirus software to protect them against this issue.

=======================================

Sincerely,

Sûnnet Beskerming Team
info@...
Sûnnet Beskerming Pty. Ltd.
Adelaide, Australia
http://www.beskerming.com
Tel: +61 (0) 410 707 444

** Sûnnet Beskerming Pty. Ltd. **

Established in mid 2004, Sûnnet Beskerming Pty. Ltd. is the sister  
company to Jongsma & Jongsma Pty. Ltd., and was formed to develop and  
commercialise the research coming out of Jongsma & Jongsma Pty. Ltd..  
Sûnnet Beskerming Pty. Ltd. is an Information Security specialist  
and, in conjunction with the tools developed by Jongsma & Jongsma  
Pty. Ltd., provides total security solutions and services, from the  
perimeter to internal data stores, including web application security  
and security testing and analysis.
_______________________________________________
Alertmailinglist mailing list
Alertmailinglist@...
http://skiifwrald.com/mailman/listinfo/alertmailinglist_skiifwrald.com