Threat Level: green Handler on Duty: Rob VandenBrink

SANS ISC InfoSec Handlers Diary Blog


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

Security updates available for Flash Player, RoboHelp, Audition, and Flash Media Server

Published: 2011-05-12
Last Updated: 2011-05-12 23:51:20 UTC
by Chris Mohan (Version: 1)
5 comment(s)

The Adobe security team have released security updates available for Flash Player, RoboHelp, Audition, and Flash Media Server

Three are marked critical:

    APSB11-09 – Security update available for RoboHelp (Important Severity)
    APSB11-10 – Security update available for Audition (Critical Severity)
    APSB11-11 – Security update available for Flash Media Sever (FMS) (Critical Severity)
    APSB11-12 – Security update available for Flash Player (Critical Severity)

Please read the Adobe security blog fore more details:
http://blogs.adobe.com/psirt/2011/05/security-updates-available-for-flash-player-robohelp-audition-and-flash-media-server.html 

Thanks to Diary reader Toby for bring this to our attention

 

Chris Mohan --- Internet Storm Center Handler on Duty

Keywords: adobe
5 comment(s)

ActiveX Flaw Affecting SCADA systems

Published: 2011-05-12
Last Updated: 2011-05-12 13:03:43 UTC
by Johannes Ullrich (Version: 1)
0 comment(s)

Grey, maybe black and rack mounted, with a digital LED (orange?) display showing a number that may change once in a while. That's how most people probably envision SCADA systems, the automated controls that make civilization possible. After all, that's what it looked like in Dr. Evil's lair and this is about as close as most of us will ever come to these systems. Who knew that what we really have is PCs, running Windows, and systems programed to take advantage of ActiveX and browser controlls. While you are running the latest version of "Power Plant Sim" in one browser window on Facebook, your other window is controlling the real thing.

US-CERT (actually the part of it called the "ICS-CERT", or the "Industrial Control System Cyber Emergency Response Team"") alerted its constituency that a commonly used set of ActiveX controls is vulnerable to a good old stack overflow. Stack overflows are not all that hard to exploit typically, and it doesn't come as a big surprise that according to ICS-CERT, an exploit is publicly available.

If you are running a power plant, a refinery or any other system using ICONICS' GENESIS32 and BizViz software, stop playing on Facebook for a while and please patch your plant.

http://www.us-cert.gov/control_systems/pdf/ICSA-11-131-01.pdf

 

------
Johannes B. Ullrich, Ph.D.
SANS Technology Institute
Twitter

Keywords: activex scada
0 comment(s)

Reports of another javascript-based spam scam doing the rounds in Facebook

Published: 2011-05-12
Last Updated: 2011-05-12 08:38:17 UTC
by Chris Mohan (Version: 1)
2 comment(s)

We have received reports of another JavaScript-based spam scam doing the rounds in Facebook.

This one involves a friend's profile posting a link to your wall.

Should you click on the link in the friend's post , the JavaScript code send spam to your Friends list and so the snowball spam effect grows.

TrendMirco's malware blog had a good write up of the attack method here:

http://blog.trendmicro.com/dubious-javascript-code-found-in-facebook-application/

Sounds like introducing friends and family to NoScript Firefox extension [1] would be one way to avoid a large number of phone calls of "Help!" over the next few days.

Thanks to reader Roseman and others for writing in with details.

 [1] http://noscript.net/

 

Chris Mohan --- Internet Storm Center Handler on Duty

Keywords: Facebook
2 comment(s)
Diary Archives