Png Files Vulnerable To Buffer Overflow

The code to handle PNG files is a serious vulnerability. The problem that has been identified in libpng, the PNG library is used in a lot of software.

The leak was reported Friday by Glenn Randers-Pehrson. Thanks png files with manipulated image headers hackers are able to create a buffer overflow and allow applications to crash. An attacker could also execute malicious code when a successful attack.

A complicating factor is that many programs use the libpng library to display png files or save. They include the most web browsers, Android, image viewers, media players and virtually all Office programs.

Updates

It is expected that in the very short term already widespread abuse will be made ​​of the leak. The libpng version 1.6.19, 5.1.24, 1.4.17, 1.2.54 and 1.0.64 which were released last week, are no longer vulnerable. These versions can be downloaded via libpng.sourceforge.net.

Vulnerabiltiy: Google Reveals Adobe Reader Leak for Mac OS X

Google has unveiled a vulnerability in Adobe Reader in the Windows version of the PDF reader would be patched, but the Mac version is still present. The vulnerability was reported to Adobe in October last year.In December there was an update for the Windows version appeared, but Adobe had to Google that it had failed to deliver a solution for the Mac version.

This week, however, went the deadline had asked Google. "Project Zero Team" of the search giant is looking specifically for vulnerabilities in commonly used software. Once a leak is found will the supplier 90 days to come up with an update, other details are the vulnerability automatically made ​​public. Adobe was warned by Google that it would reveal the details.

Via the leak, it is possible to let the application crash, which is possible up to a "heap-based buffer overflow" can cause.Noteworthy is the way that Adobe to Google said to have patched the flaw in the Windows version. The leak in question, known as CVE-2014-9160, however, does not appear in the list of Adobe Reader update.

Google Reveals Unpatched Vulnerabilities In Mac OS X

After several have leaks in Windows unveiled at a time that no security updates, Google has the same now done with Mac OS X. In total there are three vulnerabilities, allowing an attacker commands as a "system daemon" execute through ' kernel code execution 'root privileges can get or through a Bluetooth device memory corruption can cause.

One of the vulnerabilities has been tested on Mac OS X 10.9.5, while another only at Yosemite is confirmed. Leaks are detected by the "Project Zero Team" of Google, which is looking specifically for vulnerabilities in commonly used software.Once a leak is found will the supplier 90 days to come up with an update, otherwise the details of the vulnerability are automatically made ​​public. Much to the dissatisfaction of Microsoft, which Google called to work better together. Apple has not yet responded to the leak revealed.

Google discovered critical vulnerability in UnZip

A researcher of the Google Security Team has a critical vulnerability in UnZip discovered, an open source tool to tackle them from files. Due to an error in the cyclic redundancy check (CRC), it is possible to cause a buffer overflow that may allow an attacker to run arbitrary code on the computer. CRC is correct a check for detecting errors.

To carry out the attack, an attacker the victim or a specially prepared zip file via the command unzip -t leave open. Google adheres next to the search for vulnerabilities in their own software too busy checking open source software. The leak was reported on December 3 by researcher Michele Spagnuolo.

On the same day, there appeared the UnZip administrator update, followed by a second update later that day. A week later warned were all affected suppliers using UnZip, after yesterday's advisory appeared online. The leak is present in UnZip 6.0 ​​and older. The last update of the program dates from April 2009.

Critical vulnerabilities Found in Network Time Protocol (NTP)

Researchers at Google have critical vulnerabilities in the Network Time Protocol (NTP) allowing attackers discovered on systems that use NTP can execute code. NTP is a protocol that allows systems to synchronize the time for different services and applications.

It is used among other things on a large scale industrial systems. Neel Mehta and Stephen Roettger of the Google Security Team discovered several vulnerabilities in the protocol. In the worst case, an attacker by sending a single packet to cause a buffer overflow, and it is now possible to carry out on the attacked system code with the rights of the NAP-process. This vulnerability is present in all versions of NTP NTP-4.2.8.

Before warn the the Industrial Control Systems Cyber ​​Emergency Response Team (ICS-CERT) of the US Government, the US Computer Emergency Readiness Team ( US-CERT ) and the CERT Coordination Center ( CERT-CC ) at Carnegie Mellon University. Administrators also are advised to upgrade to NTP 4.2.8. Furthermore, this version fixes vulnerabilities in the random number generator allow an attacker to retrieve certain information. Exploits that make the leak abuse have been found on the Internet, according to the ICS-CERT