40 Critical Windows Bugs used to hijack & infect PC's with malware

ComputerWorld About 40 different Windows applications contain a critical flaw that can be used by attackers to hijack PCs and infect them with malware, a security researcher said Wednesday through iTunes bug...

HD Moore, chief security officer at Rapid7 and creator of the open-source Metasploit penetration-testing toolkit. Moore did not reveal the names of the vulnerable applications or their makers, however. 

"The cat is out of the bag, this issue affects about 40 different apps, including the Windows shell,"

"Solving the flaw requires every affected vendor to produce a patch," he said. "

The bug in Apple in its iTunes... According to Apple, the bug does not affect Mac machines.

Moore confirmed that the flaw "applies to a wide range of Windows applications," and added that he stumbled across it while researching the Windows shortcut vulnerability, a critical bug that Microsoft acknowledged in July and patched on Aug. 2 using one of its rare "out of band" emergency updates.

Moore declined to name the applications that contain the bug or to go into great detail about the vulnerability. But he was willing to share some observations.

"The vector is slightly different between applications, but the end result is an attacker-supplied .dll being loaded after the user opens a 'safe' file type from a network share [either on the local network or the Internet]," Moore said in an e-mail reply to questions. "It is possible to force a user to open a file from the share, either through their Web browser or by abusing other applications, for example, Office documents with embedded content."

Some of what Moore described was reminiscent of the attacks using the Windows shortcut vulnerability. For instance, hackers were able to launch drive-by attacks exploiting the shortcut bug from malicious sites via WebDAV, and could embed their exploits into Office documents, which would presumably be delivered to victims as seemingly innocuous e-mail attachments.

His advice until the vulnerable applications are patched was also taken from Microsoft's shortcut bug playbook.

"Users can block outbound SMB [by blocking TCP ports] 139 and 445, and disable the WebDAV client [in Windows] to prevent these flaws from being exploited from outside of their local network," Moore recommended.

Both work-arounds were among those Microsoft told users they could apply if they were unable to apply the emergency update.

But although Microsoft was able to plug the shortcut hole with a patch for Windows, Moore was pessimistic that the company would be able to do the same with this vulnerability.

Please read full at ComputerWorld