Exploit for 'extremely critical' Yahoo Jukebox vuln goes wild
ActiveX strikes again
Customer Success Testimonial: Recovery is Everything
Just one day after nasty security flaws were disclosed in Yahoo's Music Jukebox, miscreants have begun to actively exploit them.
The buggy Yahoo media player is one of at least three pieces of web software reported in the last week to be smitten by ActiveX flaws that leaves users wide open to attack. Elazar Broad, the researcher who disclosed the vulnerability on Sunday, also recently revealed critical flaws in the programs used to upload photos onto MySpace and Facebook. Sites that use the Anon Proxy Server are at risk of being remotely controlled by attackers exploiting a third recently disclosed ActiveX vulnerability.
According to Symantec's DeepSight Threat Management System, exploit code targeting the Yahoo media player installs a backdoor on vulnerable machines. Yahoo currently has no patch for the multiple vulnerabilities.
Two ActiveX controls in the player are susceptible to buffer overflow attacks because they fail to scrutinize code for malicious input. Broad posted proof-of-concept code on the Milw0rm site, and within about 24 hours exploits targeting one of the two vulnerabilities were found by Symantec honeypots. Symantec researchers say it's likely exploits the other flaw will also make it into the wild soon.
Vulnerability tracking service Secunia rates the vulnerabilities "extremely critical," its highest classification.
Yahoo Music Jukebox is the default software for playing music sold by Yahoo. The insecurity comes as Yahoo has announced plans to abandon an unlimited service and transfer users to RealNetworks' Rhapsody service.
It's been a busy week for Broad. Last Thursday, he disclosed a buffer overflow vulnerability in Aurigma's Image Uploader Control Library that put MySpace users at risk. He was back on Sunday to update additional ActiveX uploader tools distributed by Aurigma that were also vulnerable.
Of course, the easiest way to insulate yourself from one of these bugs is to simply uninstall the software. There are plenty of other ways to upload pics or listen to digital tunes, so that isn't really asking for much, now is it?
Those who are really stubborn, and have a sufficient technical foundation, can set the kill bit for the vulnerable CLSIDs. The SANS Internet Storm Center provides instructions here. ®
COMMENTS
Good heavens! Surprise, surprise!
Active X implicated in a security panic??? Well, knock me down with a whore's draws!
"Yahoo has announced plans to abandon an unlimited service and transfer users to RealNetworks' Rhapsody service."
And THAT is meant to be a good thing? See:
http://www.theregister.co.uk/2008/01/31/realplayer_branded_badware/
virtual machine
MS could fix a lot of the problems by making IE run in a virtual machine of some sort. hack away, a site should never see anything the site didn't put there or a user entered directly.
why exactly does a random website need the ability to run code that can potentially see the whole machine?
if you have a need to do that provide a program to download, and use which provides the data collection etc.
don't panic
It would take social engineering to trick a user into exposing themself to the exploit. Only users who install plugins that send them to external web pages are vulnerable, and even then they have to be tricked into going to a web page with the exploit. This is very unlikely, since almost no users of this software ever install any plugins.
About "I also look sternly at people like Yahoo! that release such shoddy products", that's ridiculously harsh. All internet software has vulnerabilities. We have had very few exploits in this software, and we are racing to ship a patch.
The underlying issue is once again the insecure design of ActiveX. Windows needs a capabilities model.
IT infrastructure monitoring strategies
What you need to know about cloud backup
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Customer Success Testimonial: Recovery is Everything
