Evil PDF Exploiting Windows-IE Flaw in the Wild

eWeek 23/10/2007
Website: http://www.eweek.com

A malicious PDF is exploiting a URL-handling flaw in Windows XP and Windows Server 2003 running IE7.

A PDF Trojan horse is spreading malware by exploiting a URL-handling vulnerability in Windows XP and Windows Server 2003 running Internet Explorer 7, Symantec warned customers of its DeepSight Alert Services on Oct. 23.

On Oct. 10, Microsoft released Security Advisory 943521 about this vulnerability and public reports of remote code execution. At the time, it said a patch was in the works.

The vulnerability is caused by insufficient validation of URLs. Attackers can leverage the flaw to execute arbitrary commands via maliciously crated URLs.

Symantec noted in its advisory that the issue was originally disclosed in July but initially received scant attention. In light of new research, public exploits and Microsoft's advisory, Symantec considers the problem to be more severe.

"With the ease of exploitation, the availability of public proof-of-concept code, and further attention that this vulnerability is receiving, we will likely begin to see more exploitation of this issue in the wild," the company, based in Cupertino, Calif., said in its advisory.

Symantec is calling the malware Trojan.Pidief.A. The rigged PDF file is using the "mailto: option" vulnerability to install a Trojan that in turn is downloading a file that the security firm is detecting as "Downloader." That document is delivered as a piece of spam with a file name such as "BILL.pdf" or "INVOICE.pdf."

Upon execution, the malicious code attempt to disable the Windows Firewall with a "netsh firewall set opmode mode=disable" command, and then downloads a remote file via FTP from 81.95.146.130. Symantec says the remote file is "ldr.exe" and is a Downloader Trojan. As of the afternoon of Oct. 23 when Symantec posted its advisory, the host 81.95.146.130 was alive and still serving "ldr.exe" over FTP.

"This server is known for hosting malicious software," Symantec warned.

The DeepSight Threat Analyst Team is advising users to block delivery of PDF files in e-mail. The team is also advising organizations to tell employees not to read or execute PDF files from unknown or untrusted sources.

In addition, Symantec is advising users and companies to block access to the network and IP address involved in this attack, as given above, and to apply the patches outlined in Adobe Advisory APSB07-18 as soon as possible. Adobe released fixes on Oct. 22.

In lieu of providing a timetable for the delivery of a patch, Mark Miller, director of Security Response Communications for Microsoft, headquartered in Redmond, Wash., issued a statement explaining that creating security updates is complicated.

"Once the MSRC knows the extent and the severity of the vulnerability, it works to develop an update for every supported version affected. Once the update is built, it must be tested with the different operating systems and applications it affects, then localized for many markets and languages across the globe. In some instances, multiple vendors are affected by the same or similar issues, which require a coordinated release," Miller said.

Virus Definition Updates 24/10/2007

AVG Anti-Virus Free Edition 7.5
Download AVG AVI:269.15.8.1
Download AVG AVI:269.15.8.2
Download AVG AVI:269.15.8.3
Download AVG IAVI:1089
Version: -
Date: 23/10/2007

AntiVir PersonalEdition Classic
Download AntiVir IVDF
Version: 7.00.00.126
Date: 24/10/2007

Avast! 4 Home Edition
Download Avast VPS
Version: 000783-1
Date: 22/10/2007

Symantec
Download Norton VDU
Version: 91023p
Date: 23/10/2007
Supports the following versions of Symantec antivirus software:
Norton AntiVirus 2003 Professional Edition
Norton AntiVirus 2003 for Windows 98/Me/2000/XP Home/XP Pro
Norton AntiVirus 2004 Professional Edition
Norton AntiVirus 2004 for Windows 98/Me/2000/XP Home/XP Pro
Norton AntiVirus 2005 for Windows 98/Me/2000/XP Home/XP Pro
Norton AntiVirus 2006 for Windows 2000/XP Home/XP Pro
Norton AntiVirus 2007 for Windows XP Home/XP Pro/Vista
Norton AntiVirus for Microsoft Exchange (Intel)
Norton SystemWorks (all versions)
Norton Utilities for Windows 95/98 (all versions)
Symantec AntiVirus 3.0 for CacheFlow Security Gateway
Symantec AntiVirus 3.0 for Inktomi Traffic Edge
Symantec AntiVirus 3.0 for NetApp Filer/NetCache
Symantec AntiVirus 8.0 Corporate Edition Client
Symantec AntiVirus 8.1 Corporate Edition Client
Symantec AntiVirus 9.0 Corporate Edition Client
Symantec AntiVirus 10.0 Corporate Edition Client
Symantec AntiVirus 10.1 Corporate Edition Client
Symantec AntiVirus 10.2 Corporate Edition Client
Symantec Mail Security for Domino v 4.0
Symantec Mail Security for Domino v 5.0

Spammers turn to MP3s to deliver pitches

Associated Press 22/10/2007
Website: http://www.ap.org

SAN JOSE, Calif. - Spam is now being served in audio form.

The latest in unwanted electronic communication is an MP3 file that began landing in inboxes around the world last week. It features a spooky, synthesized Darth-Vader-sounding female voice touting the stock of Exit Only Inc., traded on the lower-standard Pink Sheets.

"Hello, this is an investor alert!" the halting, at times unintelligible voice says. Her pitch invokes the growth prospects of Exit Only, a Web site operator that runs Text4Cars.com, which links auto buyers and sellers via text messages.

Computer security researchers say the audio blasts — MP3 files with misleading names attached to spam e-mails — reflect spammers' need to slip their messages through increasingly sophisticated e-mail filters.

The MP3s masquerade as cell phone ringtones or carry names like "bartsimpson.mp3" and "justintimberlake.mp3," said Keith Crosley, director of market development for Proofpoint Inc., which sells e-mail security software and hardware.

Spammer have had to change tactics as the filters have gotten smarter at blocking traditional text-based spam, spam sent as image attachments — such as GIFs or JPEGs — and even the latest rage, spam hidden inside attachments created with Adobe Systems Inc.'s ubiquitous Portable Document Format, or PDF.

Santa Monica, Calif.-based Exit Only said the e-mails are being sent by someone trying to pump up the company's stock before dumping it.

"It's very disheartening," said Exit Only Chief Executive David Dion. "I have enough to do on a daily basis trying to run Text4Cars. I really don't need this."

The company hired investigators to trace the origin of the e-mails, which appear to be coming from "ghost servers" in Russia, Dion said.

"Someone is trying to manipulate my stock for some kind of gain," he said. "What I can say is they have been very unsuccessful so far."

Just $2,500 worth of stock was traded in the two days after the messages appeared, and the stock price remained even, he said.

This new form of spam can be difficult to detect because each one is slightly different from the last, Crosley said.

"This new form of spam shows a new level of sophistication for spammers and the power of the botnets," Crosley said, referring to networks of hijacked computers that are linked together without their owners' knowledge and turned into spam-sending machines.

Avira warns against spam emails with MP3 files

AVIRA
Website: http://www.avira.com

Tettnang, 19 October 2007 – Computer users are confronted with a new spam method: they become the unwilling recipients of emails with attached audio files. Whoever opens them - they can be played with any Windows Media Player - hears advertising messages in English. The mails do not contain a subject or a text. The MP3 files have many different names that appear to refer, for example, to a well-known pop star or important information. The problem with this spam method is that users do not yet know about it and therefore react without suspicion. Spam filters are generally ineffective, but above all the size of the mass MP3 mails places a heavy strain on mailboxes, especially those of businesses. So called “stock spam” has already spread in other file formats, for instance, in the form of image files (PDF).

AVG Anti-Virus Free is the Most Popular Program on CNET Download.com

AVG Anti-Virus and Internet Security 19/10/2007
Website: http://www.grisoft.com

AVG Anti-Virus Free and Anti-Virus Pro ranked as number one and number three antivirus programs on download.com

Orlando, F.L. - October 17, 2007 – GRISOFT, the developer of AVG Internet security software, today announced that AVG Anti-Virus Free is the number one downloaded program on all of CNET Download.com. Additionally, AVG Anti-Virus Free is the first most popular and Anti-Virus Pro is the third most popular antivirus based on Editor’s Choice. CNET Download.com is a well-referenced site and is part of CNET Networks, an internationally established online publication and host to technology news and reviews.

AVG security products, for the home and office, are popular among CNET.com reviewers and users alike. AVG Anti-Virus Free holds an editor rating of five out of five, in addition to a user rating of four stars out of five. CNET.com reports that the latest version of AVG Anti-Virus Free, for private, non-commercial use, has earned more than 38 million total downloads, and over 922,600 downloads just last week. AVG Anti-Virus Pro software, GRISOFT’s commercial edition anti-virus, has been downloaded over two million times overall and earned a five of five star editor rating and a user rating of four stars out of five.

“The combination of a 5-star rating from CNET editors and being the most popular download on CNET Download.com emphasizes the value of providing comprehensive security that is not only low on system resources, but most importantly, user-friendly,” explains Rick Carlson, GRISOFT’s managing director of the Americas. “AVG is always designed with the user in mind and we are pleased to see that CNET visitors worldwide appreciate our ongoing efforts to make our software efficient, unobtrusive and easy-to-use.”

Both AVG Anti-Virus Free and Anti-Virus Pro have been engineered to use minimal resources, while still providing strong protection against viruses, worms, Trojans and potentially unwanted programs that infect computers. AVG Pro, a commercial product for home or small business use, provides users more benefits including free 24/7 technical support, multiple operating system compatibility and high-speed downloads, while AVG Free, for personal, single computer use, does not.

In addition to CNET Download.com, GRISOFT offers products through its website and in national leading retailer chains. All commercial versions of AVG products including AVG Anti-Virus Pro, include free updates and 24/7 technical support throughout the two- or one-year license duration. Commercial offerings include AVG Anti-Virus, Anti-Spyware, Anti-Malware and Internet Security.

About GRISOFT

GRISOFT is a leading developer of antivirus, firewall protection and Internet security solutions for consumers and SMEs. It is one of the fastest growing companies in the industry with more than 50 million protected computers around the world.

Established in 1991, GRISOFT employs some of the world’s leading experts in Internet security, specifically in the areas of virus analysis and detection, software development, and security research. GRISOFT’s award-winning products are distributed globally through its 12,000 resellers and the Internet as well as via AVG Anti-Virus Software Developer’s Kit (SDK) to interested partners.

Virus Definition Updates 20/10/2007

AVG Anti-Virus Free Edition 7.5
Download AVG AVI:269.15.3.1
Download AVG AVI:269.15.3.2
Download AVG AVI:269.15.3.3
Download AVG IAVI:1081
Version: -
Date: 19/10/2007

AntiVir PersonalEdition Classic
Download AntiVir IVDF
Version: 7.00.00.111
Date: 19/10/2007

Avast! 4 Home Edition
Download Avast VPS
Version: 000782-3
Date: 19/10/2007

Symantec
Download Norton VDU
Version: 91019i
Date: 19/10/2007
Supports the following versions of Symantec antivirus software:
Norton AntiVirus 2003 Professional Edition
Norton AntiVirus 2003 for Windows 98/Me/2000/XP Home/XP Pro
Norton AntiVirus 2004 Professional Edition
Norton AntiVirus 2004 for Windows 98/Me/2000/XP Home/XP Pro
Norton AntiVirus 2005 for Windows 98/Me/2000/XP Home/XP Pro
Norton AntiVirus 2006 for Windows 2000/XP Home/XP Pro
Norton AntiVirus 2007 for Windows XP Home/XP Pro/Vista
Norton AntiVirus for Microsoft Exchange (Intel)
Norton SystemWorks (all versions)
Norton Utilities for Windows 95/98 (all versions)
Symantec AntiVirus 3.0 for CacheFlow Security Gateway
Symantec AntiVirus 3.0 for Inktomi Traffic Edge
Symantec AntiVirus 3.0 for NetApp Filer/NetCache
Symantec AntiVirus 8.0 Corporate Edition Client
Symantec AntiVirus 8.1 Corporate Edition Client
Symantec AntiVirus 9.0 Corporate Edition Client
Symantec AntiVirus 10.0 Corporate Edition Client
Symantec AntiVirus 10.1 Corporate Edition Client
Symantec AntiVirus 10.2 Corporate Edition Client
Symantec Mail Security for Domino v 4.0
Symantec Mail Security for Domino v 5.0