Vulnerabilities / Threats
3/25/2014
10:04 AM
Connect Directly
RSS
E-Mail

Outlook Users Face Zero-Day Attack

Simply previewing maliciously crafted RTF documents in Outlook triggers exploit of bug present in Windows and Mac versions of Word, Microsoft warns.

(Image: Elliot Brown)
(Image: Elliot Brown)

Comment  | 
Print  | 
Comments
Newest First  |  Oldest First  |  Threaded View
J_Brandt
50%
50%
J_Brandt,
User Rank: Apprentice
3/31/2014 | 11:46:07 PM
Re: All eggs in one basket
Microsoft is only the target because of its market share.  If you're going to write an exploit, you want it to have the greatest effect possible.  Also the larger the install base the more the curve of skills and patching.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Apprentice
3/26/2014 | 8:49:06 PM
Re: All eggs in one basket
TBH, I don't think it's much of a "Microsoft monoculture" anymore.  Apple has made SIGNIFICANT headway in the enterprise, as have other competitors.  More malware is targeted to Apple than ever before (partly because of those awful Java vulnerabilities), and Android is seeing more enterprise adoption -- and hack/malware targeting -- as well.

Anyway, I'm personally a Lotus fan.
moarsauce123
50%
50%
moarsauce123,
User Rank: Apprentice
3/26/2014 | 7:10:53 PM
All eggs in one basket
That is what one gets from clinging to the Microsoft monoculture in the enterprise. If not everyone would run Exchange/Outlook/MS Office there would be less of a reason to target Microsoft products.
Indian-Art
50%
50%
Indian-Art,
User Rank: Apprentice
3/26/2014 | 1:27:26 PM
Thunderbird is safe
Time to take the free, safe, secure & feature-packed LibreOffice for a spin. Its truly multi-platform & takes just a few minutes to install.

Try it you have so much to gain: www.libreoffice.org/download

I think Thunderbird is safe as well.
codyhalter281
0%
100%
codyhalter281,
User Rank: Apprentice
3/25/2014 | 2:01:20 PM
Let See
just as Rebecca said I can't believe that you able to get paid $8327 in four weeks on the computer . site here>
>>>>>> w­w­­w­.­b­a­y­9­1­.­C­ℴ­M
David F. Carr
100%
0%
David F. Carr,
User Rank: Apprentice
3/25/2014 | 12:59:29 PM
Email spam/AV protection for Outlook bug?
Are email filtering programs such as Postini and Barracuda scanning for this yet?
Joe Stanganelli
100%
0%
Joe Stanganelli,
User Rank: Apprentice
3/25/2014 | 11:20:05 AM
Email insecurity
Ugh.  Between this stuff and the NSA debacle, this makes me want to go back to smoke signals for communication.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0993
Published: 2014-09-15
Buffer overflow in the Vcl.Graphics.TPicture.Bitmap implementation in the Visual Component Library (VCL) in Embarcadero Delphi XE6 20.0.15596.9843 and C++ Builder XE6 20.0.15596.9843 allows remote attackers to execute arbitrary code via a crafted BMP file.

CVE-2014-2375
Published: 2014-09-15
Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to read or write to arbitrary files, and obtain sensitive information or cause a denial of service (disk consumption), via the CSV export feature.

CVE-2014-2376
Published: 2014-09-15
SQL injection vulnerability in Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

CVE-2014-2377
Published: 2014-09-15
Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to discover full pathnames via an application tag.

CVE-2014-3077
Published: 2014-09-15
IBM SONAS and System Storage Storwize V7000 Unified (aka V7000U) 1.3.x and 1.4.x before 1.4.3.4 store the chkauth password in the audit log, which allows local users to obtain sensitive information by reading this log file.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
CISO Insider: An Interview with James Christiansen, Vice President, Information Risk Management, Office of the CISO, Accuvant