Spyware, viruses, & security forum: NEWS - October 17, 2012

Oracle will not patch a critical sandbox escape vulnerability in Java SE versions 5, 6 and 7 until its February Critical Patch Update, according to the researcher who discovered the flaw. Adam Gowdiak of Polish security firm Security Explorations told Threatpost via email that Oracle said it was deep into testing of another Java patch for the October CPU released yesterday and that it was too late to include the sandbox fix.

Gowdiak said he plans to present technical details on the flaw Nov. 14 at the Devoxx Java Community Conference in Belguim. His team did share a technical description of the issue and source and binary codes of proof-of-concept exploit code.

The vulnerability and exploit were announced in late September. Gowdiak's exploit successfully beat a fully patched Windows 7 computer running Firefox 15.0.1, Chrome 21, Internet Explorer 9, Opera 12 and Safari 5.1.7. The exploit relies on a user landing on a site hosting the exploit; an attacker would use a malicious Java applet or banner ad to drop the malware and ultimately have full remote control of a compromised machine.

Oracle did not respond to a request for comments.

Continued : https://threatpost.com/en_us/blogs/oracle-leaves-fix-java-se-zero-day-until-february-patch-update-101712

TrendLabs Malware Blog:

Without verifying its legitimacy, users who may be anticipating a WebEx conference are at risk of downloading variants of a notorious info stealing malware.

Last week, we received two spoofed emails that redirect users to a fake Adobe Flash Player update. These messages use different approaches to lure users into downloading the malicious file update_flash_player.exe (detected as TSPY_FAREIT.SMC).

The first email is disguised as a WebEx email containing an HTM attachment. Once users execute this attachment, they are lead to a malicious site hosting TSPY_FAREIT.SMC. Employees may be trick into opening this as it appears to be an alert coming from a business tool they often use. The second sample, on the other hand, is a spoofed PayPal email that features transaction details. Curious users who click these details are then directed to the webpage hosting the rogue Flash update file.

[Screenshot: Spoofed WebEx Email] - [Screenshot: Spoofed PayPal Email]

The said site in question is a spoofed Adobe Flash Player update. To the undiscerning eye, this site may pass off as the real Adobe Flash Player website as it is an exact copy of the legitimate Adobe site. But looking closer into the site's address, reveals that it is everything but authentic.

Continued : http://blog.trendmicro.com/trendlabs-security-intelligence/spoofed-webex-paypal-emails-lead-to-rogue-flash-update/

Security firm ReVuln has analysed the browser protocol that Steam servers use to execute commands via users' browsers. During the analysis, the company's researchers discovered security issues that could potentially allow attackers to infect PCs with malicious code such as spyware.

Among other things, Valve's Steam platform is used to distribute games and also functions as a central hub of the company's digital rights management concept. During installation, it registers the steam:// URL protocol which is capable of connecting to game servers and launching games, for example via: steam://run/id/language/url_encoded_parameters

In the simplest case, an attacker can use this to interfere with the parameters that are submitted to the program. For example, the Source engine's command line allows users to select a specific log file and add items to it. The ReVuln researchers say that they successfully used this attack vector to infect a system via a batch file that they had created in the autostart folder. Popular games such as Half-Life 2 and Team Fortress 2 use the Source engine and are distributed through Valve's Steam platform. In the even more popular Unreal engine, the researchers also found a way to inject and execute arbitrary code. Potential attackers would, of course, first have to establish which games are installed on the target computer.

Continued : http://www.h-online.com/security/news/item/Report-Steam-poses-security-risk-1731562.html

Also: Steam vulnerability can lead to remote insertion of malicious code