Video Screencast Help
Search Video Help Close Back
to help
Not able to make it to Vision this year? Get a sampling in the Best of Vision on Demand group.

Security Response

Showing posts tagged with Vulnerabilities & Exploits remove filter
Showing posts in English remove filter
Tibetan-Themed Malware Subverts a Legitimate Application
Symantec Security Response | 24 May 2012 | 0 comments

Analysis by: Hiroshi Shinotsuka

Recent malware campaigns that used Tibet-related issues as bait have been well documented and it should come as no surprise that we have seen another Tibetan-themed attack using a malicious Word document. The emails involved in the attack are in English and were sent to a clothing company in the United States.

While they appear to come from Tibet-related organizations, the email headers revealed that they were sent from a mail server in Russia.

Recently, we discovered a file that differs to other malware in that it uses a well-known graphics card manufacturer’s legitimately signed program as an attack vector.

After opening the attached...

Read more
Microsoft Patch Tuesday - May 2012
Candid Wueest | 08 May 2012 | 0 comments

Hello, welcome to this month’s blog on the Microsoft patch release. This is a larger month—the vendor is releasing 7 bulletins covering a total of 23 vulnerabilities.

Eight of this month's issues are rated ‘Critical’ and they affect Windows, .NET, Office and Silverlight. The remaining issues affect Office and Windows.

As always, customers are advised to follow these security best practices:

  • Install vendor patches as soon as they are available.
  • Run all software with the least privileges required while still maintaining functionality.
  • Avoid handling files from unknown or questionable sources.
  • Never visit sites of unknown or questionable integrity.
  • Block external access at the network perimeter to all key systems unless specific access is required.

Microsoft’s summary of the May releases can be found here:
...

Read more
Microsoft Patch Tuesday - April 2012
Robert Keith | 10 Apr 2012 | 0 comments

Hello, welcome to this month’s blog on the Microsoft patch release. This is an average month—the vendor is releasing six bulletins covering a total of 11 vulnerabilities.

Seven of this month's issues are rated ‘Critical’ and they affect Internet Explorer, .NET, and Windows. The remaining issues affect Internet Explorer, Windows, Forefront Unified Access Gateway, and Office.

As always, customers are advised to follow these security best practices:

  • Install vendor patches as soon as they are available.
  • Run all software with the least privileges required while still maintaining functionality.
  • Avoid handling files from unknown or questionable sources.
  • Never visit sites of unknown or questionable integrity.
  • Block external access at the network perimeter to all key systems unless specific access is required.

Microsoft’s summary of the April releases can be found here:
...

Read more
Working PoC for MS12-020 Spotted in the Wild
Symantec Security Response | 16 Mar 2012 | 0 comments

A warning against a critical vulnerability in the Remote Desktop Protocol (RDP) was posted by Microsoft on Tuesday, March 13. A patch to close this security hole was released on the same day as part of the regular MS Patch Tuesday release: Microsoft Remote Desktop Protocol CVE-2012-0002 Remote Code Execution Vulnerability (BID 52353).

As RDP listens on a TCP port, this vulnerability can be triggered remotely and could lead to code execution. Hackers are eager to develop an exploit. Security Response can confirm that a Proof of Concept (PoC) resulting in a denial-of-service condition for MS12-020 has been published. Symantec has released IPS signature 25610 (Attack: Microsoft RDP CVE-2012-0002 3) to block attempts to exploit the vulnerability.

...

Read more
Microsoft Patch Tuesday - March 2012
Robert Keith | 13 Mar 2012 | 0 comments

Hello, welcome to this month’s blog on the Microsoft patch release. This is a smaller month—the vendor is releasing six bulletins covering a total of seven vulnerabilities.

Only one of this month's issues is rated ‘Critical’ and it affects the Remote Desktop Protocol. The remaining issues affect the Windows kernel, DNS Server, Expression, Visual Studio, and Windows.

As always, customers are advised to follow these security best practices:

  • Install vendor patches as soon as they are available.
  • Run all software with the least privileges required while still maintaining functionality.
  • Avoid handling files from unknown or questionable sources.
  • Never visit sites of unknown or questionable integrity.
  • Block external access at the network perimeter to all key systems unless specific access is required.

Microsoft’s summary of the March releases can be found here:
...

Read more
Microsoft Patch Tuesday - February 2012
Robert Keith | 14 Feb 2012 | 0 comments

Hello, welcome to this month’s blog on the Microsoft patch release. This is a larger month—the vendor is releasing 9 bulletins covering a total of 21 vulnerabilities.

Six of this month's issues are rated ‘Critical’ and they affect Internet Explorer, .NET, Windows, and GDI. The remaining issues affect Internet Explorer, Windows, Visio, and SharePoint.

As always, customers are advised to follow these security best practices:

  • Install vendor patches as soon as they are available.
  • Run all software with the least privileges required while still maintaining functionality.
  • Avoid handling files from unknown or questionable sources.
  • Never visit sites of unknown or questionable integrity.
  • Block external access at the network perimeter to all key systems unless specific access is required.

Microsoft’s summary of the February releases can be found here:
...

Read more
MIDI exploit in the wild
Shunichi Imano | 27 Jan 2012 | 0 comments

Symantec Security Response is aware of in-the-wild malware exploiting the Microsoft Windows Media Player 'winmm.dll' MIDI File Parsing Remote Buffer Overflow Vulnerability (BID 51292). Microsoft has already issued a patch against this vulnerability in the monthly patch release this January. Applying the patch is strongly recommended.

There are several components involved in this live attack:

  • a.exe
  • baby.mid
  • i.js
  • mp.html

Symantec products detect mp.html and i.js as Trojan.Malscript. The vulnerable baby.mid file is detected as Trojan Horse and the end-result file, a.exe, is flagged as Downloader.Darkmegi....

Read more
Microsoft Patch Tuesday - January 2012
Robert Keith | 10 Jan 2012 | 0 comments

Hello, welcome to this month’s blog on the Microsoft patch release. This is a smaller month—the vendor is releasing seven bulletins covering a total of eight vulnerabilities.

Only one of this month's issues is rated 'Critical' and it affects Windows Media. The remaining issues affect Windows, the kernel, and Microsoft’s Anti-Cross Site Scripting library.

As always, customers are advised to follow these security best practices:

  • Install vendor patches as soon as they are available.
  • Run all software with the least privileges required while still maintaining functionality.
  • Avoid handling files from unknown or questionable sources.
  • Never visit sites of unknown or questionable integrity.
  • Block external access at the network perimeter to all key systems unless specific access is required.

Microsoft’s summary of the January releases can be found here:
...

Read more
Microsoft Patch Tuesday - December 2011
Robert Keith | 13 Dec 2011 | 0 comments

Hello, welcome to this month’s blog on the Microsoft patch release. This is an average month—the vendor is releasing 13 bulletins covering a total of 19 vulnerabilities.

Three of this month's issues are rated ‘Critical’ and they affect Media Player, Microsoft Time ActiveX control, and the public issue regarding TrueType fonts (currently being exploited by Duqu malware). The remaining issues affect Windows, the kernel, Internet Explorer, Active Directory, Word, Excel, PowerPoint, Active Directory, Publisher, and Office.

As always, customers are advised to follow these security best practices:

  • Install vendor patches as soon as they are available.
  • Run all software with the least privileges required while still maintaining functionality.
  • Avoid handling files from unknown or questionable sources.
  • Never visit sites of unknown or questionable integrity.
  • Block external access at the network perimeter...
Read more
Microsoft Patch Tuesday - November 2011
Robert Keith | 08 Nov 2011 | 0 comments

Hello, welcome to this month’s blog on the Microsoft patch release. This is a small month—the vendor is releasing four bulletins covering a total of four vulnerabilities.

Only one of this month's issues is rated ‘Critical’ and it affects the Windows TCP/IP stack. It potentially can be exploited to completely compromise an affected computer. The remaining issues affect Active Directory, Windows Mail, and Windows kernel-mode drivers.

As always, customers are advised to follow these security best practices:

  • Install vendor patches as soon as they are available.
  • Run all software with the least privileges required while still maintaining functionality.
  • Avoid handling files from unknown or questionable sources.
  • Never visit sites of unknown or questionable integrity.
  • Block external access at the network perimeter to all key systems unless specific access is required.

Microsoft’s...

Read more

Technical Support

Symantec.com

Store

Community Stats

Total Content Items
Members
269,997