Mozilla quickly patches Firefox flaw

[dwightmckie]

Mozilla has reacted quickly to patch a zero-day vulnerability in its Firefox browser software.

The security flaw was used to run a drive-by-download attack so that Firefox fans visiting the website for the Nobel Peace prize were exposed to malware on Tuesday.

Code planted on the site redirected surfers to a hacker-controlled site that ran a JavaScript-based exploit, specific to Firefox, that attempted to plant a Trojan on vulnerable Windows PCs.

http://www.theregister.co.uk/2010/10...roday_patched/

[dwightmckie]

Adobe today confirmed that hackers are exploiting a critical unpatched bug in Flash Player, and promised to patch the vulnerability in two weeks.

The company issued a security advisory that also named Adobe Reader and Acrobat as vulnerable.

"There are reports that this vulnerability is being actively exploited in the wild against Adobe Reader and Acrobat," said Adobe in its warning. The company said it's seen no sign that hackers are also targeting Flash Player itself.

Those reports came from Mila Parkour, an independent security researcher who notified Adobe early today after spotting and then analyzing a malicious PDF file. According to Parkour, the rigged PDF document exploits the Flash bug in Reader, then drops a Trojan horse and other malware on the victimized machine.

Adobe said that all versions of Flash on Windows, Mac, Linux and Android harbored the bug, and that the "Authplay" component of Reader and Acrobat 9.x and earlier also contained the flaw. Authplay is the interpreter that renders Flash content embedded within PDF files
http://www.computerworld.com/s/artic...h_zero_day_bug

[khat17]

At least them finding them in a timely manner. I just feel sorry for the persons who the exploits may have affected. Hopefully it was discovered in a lab still.

[topanaris]

Yall see the trend here right? hackers arent targeting the operating systems that much anymore, just be careful of the apps that use.

[iKlsR]

saw this article on yahoo the other day where they gave a $3000 us check to some 12 yr old kid for finding a bug in the memory firefox uses to run...