NIST IT Security: COMLAN_100 / COMLAN_99 / Acrobat Reader Browser Plug-in has a huge XSS vulnerability.

NIST Site Search

Product Research

Advertise on this site

Headlines

US-CERT Current Activity

»	Malicious Email Campaign Circulating
»	Microsoft Releases Advance Notification for September Security Bulletin
»	Cisco Releases Updates for Wireless LAN Controller
»	Mozilla Releases Firefox 3.6.9
»	Apple Releases Safari 5.0.2 and 4.1.2
»	Apple Releases iTunes 10
»	Google Releases Chrome 6.0.472.53
»	Insecure Loading of Dynamic Link Libraries in Windows Applications
»	VMware Releases Updates for ESX Service Console Packages
»	Cisco Releases Security Advisory for IOS XR Software Border Gateway Protocol

Date published: not known
Details

DOE-CIRC Updates

»	T-434: Security update available for Shockwave Player Security update available for Shockwave Player
»	T-433: Security Advisory for Adobe Reader and Acrobat Security Advisory for Adobe Reader and Acrobat
»	T-432: Google Chrome Multiple Flaws Let Remote Users Execute Arbitrary Code Google Chrome Multiple Flaws Let Remote Users Execute Arbitrary Code
»	T-431: Linux Kernel Null Pointer Dereference in irda_bind() May Let Local Users Gain Elevated Privileges Linux Kernel Null Pointer Dereference in irda_bind() May Let Local Users Gain Elevated Privileges
»	T-430: Apple QuickTime Flaw in QTPlugin.ocx ActiveX Control Lets Remote Users Execute Arbitrary Code Apple QuickTime Flaw in QTPlugin.ocx ActiveX Control Lets Remote Users Execute Arbitrary Code
»	T-429: WaspTime MS-SQL Database instance with blank password for sa account WaspTime MS-SQL Database instance with blank password for sa account
»	T-428: Vulnerability in Help and Support Center Vulnerability in Help and Support Center
»	T-427: VMWare WebAccess Vulnerability VMWare WebAccess Vulnerability
»	T-426: Microsoft Windows Shortcut 'LNK/PIF' Files Automatic File Execution Vulnerability Microsoft Windows Shortcut 'LNK/PIF' Files Automatic File Execution Vulnerability
»	T-425: Desktop Java running in web browsers Desktop Java running in web browsers
»	T-424: Windows TCP/IP Stack IcmpSendEcho2Ex() Bug Lets Local Users Deny Service Windows TCP/IP Stack IcmpSendEcho2Ex() Bug Lets Local Users Deny Service
»	T-423: Microsoft Security Advisory (2269637) - Insecure Library Loading Could Allow Remote Code Execution Microsoft Security Advisory (2269637) - Insecure Library Loading Could Allow Remote Code Execution
»	T-422: Adobe Flash Player and AIR (CVE-2010-2216) Unspecified Memory Corruption Vulnerability Adobe Flash Player and AIR (CVE-2010-2216) Unspecified Memory Corruption Vulnerability
»	T-421: Multiple CACTI Security Vulnerabilities Multiple CACTI Security Vulnerabilities
»	T-420: Microsoft Windows TCP/IP IPv6 Extension Header Remote Denial of Service Vulnerability Microsoft Windows TCP/IP IPv6 Extension Header Remote Denial of Service Vulnerability

Date published: not known
Details

Virus Bulletin news

»	September issue of VB published The September issue of Virus Bulletin is now available for subscribers to download.
»	ARF published as IETF standard Abuse report format helps auto-handling of email complaints
»	Microsoft releases new fix for DLL vulnerability Earlier workaround believed to be too complex for most users.
»	Malicious tweets link to fake TweetDeck update Twitter resets passwords for accounts that appear to have been hacked.
»	94% of Internet users befriend unknown 'good-looking woman' Sensitiva data shared after two-hour chat.
»	Investment boost for Quick Heal Indian security firm gets hefty cash injection.
»	41% of spam sent via Rustock botnet Botnet spam back after short summer break.
»	Avast gets $100m investment boost Growth equity firm invests in Czech firm
»	Computer chip giant buys AV giant Intel becomes new owner of McAfee for the princely sum of $7.8bn

Date published: not known
Details

DarkReading - All Stories

»	SHould SMBs Invest In Cyber Risk Insurance? Experts say the right cyber risk insurance policy could save even small enterprises from catastrophi ...
»	NSS Labs To Open Marketplace For Buying And Selling Exploits No zero-days on 'Exploit Hub'
»	Fraud At Sprint Offers Lessons For Enterprises, Experts Say Insider attacks leading to Sprint phone fraud might have been prevented with a few simple practices, ...
»	Forensics Out Of Reach For Most Small To Midsize Organizations Software-as-a-service, managed forensics services needed
»	String Of Deals Shows Demand for Cloud-Based Authentication Acquisitions highlight how authentication-as-a-service is now part of identity and access management ...
»	Tech Insight: Retooling Vulnerability Scanning, Penetration Testing For IPv6 Traditional host discovery via network scanning won't work with IPv6, but alternative methods are av ...
»	Five Ways To Stop Mass SQL Injection Attacks The best practices for mitigating this popular form of attack often are not being deployed
»	IPv6 Transition Poses New Security Threats Next-generation IP protocol comes with more security as well as some potential flaws of its own ...
»	Networked Scanners Offer A Window Into The Enterprise, Researcher Says Emerging Web-based features make it possible to capture document contents remotely from networked sc ...

Date published: not known
Details

Acrobat Reader Browser Plug-in has a huge XSS vulnerability.

Let's get straight to the point, this vulnerability should not be taken lightly. People I know, and in some cases fear, are worried about this. If you have the Adobe Acrobat Reader browser plug-in installed nearly any website that contains a PDF file can now be exploited for Cross-site Scripting (XSS). (UPDATES below)

[ Read the rest of the article... ]

Posted by NIST.org on Wednesday 03 January 2007 - 20:31:17 | Read/Post Comment: 0 |