The latest Flash update patches two security vulnerabilities - the first (CVE-2012-0772), resolves a memory corruption vulnerability related to URL security domain checking that could lead to code execution on Windows 7 or Vista. The second (CVE-2012-0773) fixes a memory corruption vulnerability in the NetStream class that could lead to code execution.
TLDR; vulnerable Flash player, exploits patched.
However, this time around, Adobe have introduced an automatic updating mechanism for Flash Player.
In Microsoft's Security Bulletin Summary for February 2012 a number of updates have been released including four "critical" and five "important" severity updates.
Lavasoft has just received a VB100 award from Virus Bulletin ranked among the top applications in the detection chart: http://www.virusbtn.com/vb100/latest_comparative/index. We’re pretty happy!
In a comparative test published in Virus Bulletin’s latest issue, Ad-Aware achieved one of the top results for malware detection. Virus Bulletin independently tests anti-virus products and those products which pass the tests are awarded the VB100. The test review covers a range of criteria, including detection rates, design and usability, and performance.
It's common to hear security vendors advise people to "keep their computer up to date with the latest patches" but what does that actually mean and why is it important?
Malware can infiltrate PCs via a number of attack surfaces, one of which being bugs in Windows and the programs on your PC.
Microsoft have published a Security Bulletin Summary for November 2011. A number of updates have been released including one "critical" and two "important" severity updates.
The patches address remote code execution, elevation of privilege and denial of service vulnerabilities. Importantly, an update has been released to patch the critical vulnerability in the TCP/IP stack (MS11-083). Microsoft report that "the vulnerability could allow remote code execution if an attacker sends a continuous flow of specially crafted UDP packets to a closed port on a target system."
An apparently modified version of the well-publicised Stuxnet worm has been discovered on a number of corporate computer systems in Europe. Analysis suggests that the malware, named Duqu (pronounced dyü-kyü), appears to be based on the Stuxnet source code, giving rise to the possibility that Duqu may have been developed either by the Stuxnet authors or by developers who have had access to the source code.
As the malware landscape evolves, it's helpful to understand how malware gets onto your machine. Knowing the bad guys' strategies gives you the edge while on-line and puts you in a stronger position to defend your data and PC against compromising threats.
We all know that we should install anti-malware software, keep it up to date and run regular scans, apply Windows and application security patches when they become available, use a firewall... well, I won't bore you - you know what to do. But what kind of attacks can we expect and where are they coming from?
Developing malware from scratch is a highly complex task that requires considerable skill and effort. In recent years, crimeware toolkits have taken the heavy lifting out of creating malware. Toolkits, such as MPack, Neospoit and Zeus, can be found for sale on underground hacking forums, lowering the skills barrier for would-be criminals. For a fee and with little effort, hackers can generate their own malware that can be used for stealing credit card details, passwords and other sensitive information.
Microsoft have published a Security Bulletin Summary for October 2011. Eight updates have been released including two "critical" and six "important" severity updates.
The patches address remote code execution, elevation of privilege and denial of service vulnerabilities within Windows, Internet Explorer, Microsoft .NET Framework, Microsoft Silverlight, Microsoft Forefront United Access Gateway and Microsoft Host Integration Server.
Lavasoft attended the 21st Virus Bulletin conference in Barcelona from 5-7 October.
Virus Bulletin is a leading security industry publication who's annual conference presents the latest research, defensive procedures and the chance to discuss future developments and countermeasures. It also provides an opportunity for experts in the anti-malware arena to share their research interests, discuss technologies, as well as meet with - and learn from - those who put their technologies into practice in the real world.
- 1 of 4
- ››



