exploit

Experts are growing increasingly concerned about a still-unpatched security flaw in Microsoft's popular web browser, Internet Explorer. According to recent reports, the vulnerability -- which first emerged in mid-September -- has been exploited on ... several occasions. Microsoft has called the vulnerability CVE-2013-3989. The firm first announced the flaw back on September 17 shortly after Microsoft became aware of its use in a number of attacks. In the days that followed Microsoft released a temporary "Fix It" tool that Internet Explorer users could manually download and install on their ... (view more)

Microsoft has fixed a major vulnerability exploited by the nasty Duqu Worm with its most recent Patch Tuesday series of security updates, which started rolling out yesterday. The total number of patches fix 17 vulnerabilities in Windows. (Source: ... eweek.com ) Unfortunately, the company still hasn't issued a fix for a serious browser flaw ominously known as BEAST (Browser Exploit Against SSL/TLS). The BEAST exploit was first discovered in September of this year and was responsible for cracking Paypal encrypted browser cookies. (Source: theregister.co.uk ) Of the 17 vulnerabilities noted, ... (view more)

Microsoft says it's unlikely that hackers will successfully exploit a recently discovered security bug in Windows. The company says that if the bug is abused, it would likely result in a denial of service attack instead. As noted on Wednesday, the ... problem involves system files related to Windows network file and printer sharing. Hackers are often particularly interested in exploiting such system files as they are a potential entry point between a networked computer and the outside world (via the Internet). Denial of Service Risk to Windows In this case, the Windows exploit appears to have two ... (view more)

Microsoft has confirmed that a zero-day vulnerability exists in Windows XP, Vista, as well as Server 2003 and Server 2008. The bug, which first emerged in mid-December 2010, has evolved since the exploit was posted publicly. The bug was first ... discussed on December 15 at a security conference in South Korea. Since no one had yet exploited the vulnerability, there was not significant cause for concern. That's changed now that researcher Joshua Drake has released an exploit module via open-source penetration testing project, Metasploit. Exploit Opens Door to Total System Takeover Metasploit has ... (view more)

A new Windows zero-day flaw has gone public. Known as the "Windows Shortcut flaw", the exploit affects all versions of Microsoft Windows. What's important to note is that merely opening or viewing an infected USB stick can infect a computer -- even ... on systems where Windows Autoplay is disabled. The flaw affects files which have the file extension .LNK, otherwise known as a "Windows Shortcut" file. Shortcut files are essentially copies of program icons and tell Windows where the original program is located. For example, normally one would have to click Start -> Programs ... (view more)

Microsoft has confirmed a serious security issue affecting Windows 7 Release Candidate (RC) -- the version that was made available to the public prior to the full release of Windows 7. The problem also currently affects Windows Vista and Server ... 2008, but not Windows XP or Server 2008 R2. The issue involves the Server Message Block (SMB) system which is a part of Windows itself and is used for sharing files over a network. A bug in the system means anyone could take advantage of the exploit and use SMB to gain remote access to (and take control of) a remote computer. Temporary Solution: Block ... (view more)

A zero-day or "0day" attack is a computer threat that tries to exploit computer application vulnerabilities for which no security fix is yet available. Zero-day exploits are used by attackers before the software vendor knows about the vulnerability. ... The term derives from the age of the exploit. When a vendor becomes aware of a security hole, there is a race to close it before attackers discover it or the vulnerability becomes public. A "zero day" attack occurs on or before the first or "zeroth" day of vendor awareness, meaning the vendor has not had any opportunity to disseminate a security ... (view more)