Security updates available for Flash Player, RoboHelp, Audition, and Flash Media Server
The Adobe security team have released security updates available for Flash Player, RoboHelp, Audition, and Flash Media Server
Three are marked critical:
APSB11-09 – Security update available for RoboHelp (Important Severity)
APSB11-10 – Security update available for Audition (Critical Severity)
APSB11-11 – Security update available for Flash Media Sever (FMS) (Critical Severity)
APSB11-12 – Security update available for Flash Player (Critical Severity)
Please read the Adobe security blog fore more details:
http://blogs.adobe.com/psirt/2011/05/security-updates-available-for-flash-player-robohelp-audition-and-flash-media-server.html
Thanks to Diary reader Toby for bring this to our attention
Chris Mohan --- Internet Storm Center Handler on Duty
ActiveX Flaw Affecting SCADA systems
Grey, maybe black and rack mounted, with a digital LED (orange?) display showing a number that may change once in a while. That's how most people probably envision SCADA systems, the automated controls that make civilization possible. After all, that's what it looked like in Dr. Evil's lair and this is about as close as most of us will ever come to these systems. Who knew that what we really have is PCs, running Windows, and systems programed to take advantage of ActiveX and browser controlls. While you are running the latest version of "Power Plant Sim" in one browser window on Facebook, your other window is controlling the real thing.
US-CERT (actually the part of it called the "ICS-CERT", or the "Industrial Control System Cyber Emergency Response Team"") alerted its constituency that a commonly used set of ActiveX controls is vulnerable to a good old stack overflow. Stack overflows are not all that hard to exploit typically, and it doesn't come as a big surprise that according to ICS-CERT, an exploit is publicly available.
If you are running a power plant, a refinery or any other system using ICONICS' GENESIS32 and BizViz software, stop playing on Facebook for a while and please patch your plant.
http://www.us-cert.gov/control_systems/pdf/ICSA-11-131-01.pdf
------
Johannes B. Ullrich, Ph.D.
SANS Technology Institute
Twitter
Reports of another javascript-based spam scam doing the rounds in Facebook
We have received reports of another JavaScript-based spam scam doing the rounds in Facebook.
This one involves a friend's profile posting a link to your wall.
Should you click on the link in the friend's post , the JavaScript code send spam to your Friends list and so the snowball spam effect grows.
TrendMirco's malware blog had a good write up of the attack method here:
http://blog.trendmicro.com/dubious-javascript-code-found-in-facebook-application/
Sounds like introducing friends and family to NoScript Firefox extension [1] would be one way to avoid a large number of phone calls of "Help!" over the next few days.
Thanks to reader Roseman and others for writing in with details.
[1] http://noscript.net/
Chris Mohan --- Internet Storm Center Handler on Duty
Comments
Anonymous
Dec 3rd 2022
9 months ago
Anonymous
Dec 3rd 2022
9 months ago
<a hreaf="https://technolytical.com/">the social network</a> is described as follows because they respect your privacy and keep your data secure. The social networks are not interested in collecting data about you. They don't care about what you're doing, or what you like. They don't want to know who you talk to, or where you go.
<a hreaf="https://technolytical.com/">the social network</a> is not interested in collecting data about you. They don't care about what you're doing, or what you like. They don't want to know who you talk to, or where you go. The social networks only collect the minimum amount of information required for the service that they provide. Your personal information is kept private, and is never shared with other companies without your permission
Anonymous
Dec 26th 2022
9 months ago
Anonymous
Dec 26th 2022
9 months ago
<a hreaf="https://defineprogramming.com/the-public-bathroom-near-me-find-nearest-public-toilet/"> nearest public toilet to me</a>
<a hreaf="https://defineprogramming.com/the-public-bathroom-near-me-find-nearest-public-toilet/"> public bathroom near me</a>
Anonymous
Dec 26th 2022
9 months ago
<a hreaf="https://defineprogramming.com/the-public-bathroom-near-me-find-nearest-public-toilet/"> nearest public toilet to me</a>
<a hreaf="https://defineprogramming.com/the-public-bathroom-near-me-find-nearest-public-toilet/"> public bathroom near me</a>
Anonymous
Dec 26th 2022
9 months ago
Anonymous
Dec 26th 2022
9 months ago
https://defineprogramming.com/
Dec 26th 2022
9 months ago
distribute malware. Even if the URL listed on the ad shows a legitimate website, subsequent ad traffic can easily lead to a fake page. Different types of malware are distributed in this manner. I've seen IcedID (Bokbot), Gozi/ISFB, and various information stealers distributed through fake software websites that were provided through Google ad traffic. I submitted malicious files from this example to VirusTotal and found a low rate of detection, with some files not showing as malware at all. Additionally, domains associated with this infection frequently change. That might make it hard to detect.
https://clickercounter.org/
https://defineprogramming.com/
Dec 26th 2022
9 months ago
rthrth
Jan 2nd 2023
8 months ago