On Tuesday, exploits for the Yahoo apps were reported circulating. There is currently no patch from the individual vendors, so the only workaround is to disable the several specific, vulnerable ActiveX controls. (ActiveX controls were developed by Microsoft for use with Internet Explorer and other browsers.)
The SANS tool, available here, eliminates the risks associated with editing the Windows system registry file. A command line version is available here.
The kill-bit tool first checks your system to see if any of the vulnerable CLSIDs exist. If so, the tool saves a copy of any values currently set, then updates the display to show that the CLSID--the unique sequence assigned to each ActiveX component that specifies which control you are using--exists. It also shows whether the kill-bit flag is set. To set the kill-bit, just check the box beside any of the affected ActiveX controls then click on the "Set" button. Unchecking any of the boxes will either reset the "Compatibility Flags" to their saved value or remove the CLSID entirely (if you didn't have the control installed in the first place).
SANS suggests setting the kill-bits for all of the affected ActiveX controls, and, even if you don't currently have one or more of these CLSIDs installed on your machine, go ahead set the kill-bit for controls that might be added to your system in the future.
Updated at 3:37 p.m. PST with statement from MySpace and Facebook.
Within the last week, researcher Elazar Broad has disclosed two ActiveX vulnerabilities in the tools that MySpace.com and Facebook users use to upload images to their sites. On Sunday, Broad disclosed a buffer overflow vulnerability within the Facebook image upload control. Last week, Broad disclosed a similar buffer overflow flaw within MySpaceAurigma's ImageUploader ActiveX; the MySpace vulnerability also affects Facebook users.
Facebook and MySpace use controls repackaged from Aurigma Imaging Technology. Vulnerable to the recent attack scenario are FaceBook PhotoUploader 4.5.57.0, Aurigma ImageUploader4 4.6.17.0, Aurigma ImageUploader4 4.5.70.0, Aurigma ImageUploader4 4.5.126.0, and Aurigma ImageUploader5 5.0.10.0.
The MySpace attack outlined last week could allow specially crafted Web pages to crash Windows systems. The Facebook attack announced Sunday could allow for denial-of-service attacks or for malicious code to run on compromised PCs. An exploit exists for the MySpace attack. An exploit for the Facebook attack is expected to be posted on the Internet shortly.
Recent versions of Facebook PhotoUploader 4.5.57.1 are not vulnerable. Also, for the MySpace vulnerability, Aurigma Imaging Technology recommends upgrading to the latest 4.x and 5.x releases.
Additional workarounds include disabling all ActiveX within Internet Explorer. Microsoft provides detailed instructions here. You can also disable just the image uploader within either Facebook or MySpace.
On Monday afternoon, MySpace and Facebook issued a joint statement: "MySpace and Facebook are firmly committed to keeping all users as safe and secure as possible. Recently, the companies were alerted to a vulnerability in Aurigma Imaging Technology's software that could potentially put certain users with Windows-based systems at risk. Immediately after identifying a solution, Facebook, MySpace, and Aurigma collaborated to resolve the issue and are working to individually alert users of any additional steps that need to be taken to ensure user security."
On Thursday, security vendor Fortinet warned Facebook users that a popular new widget also installed Zango, software that has been labeled by some antivirus vendors as spyware. The Facebook widget, Secret Crush, promises to reveal who has a secret crush on them, and requires the user to add it to their site. Upon doing so, Fortinet says the Zango software also piggybacks in the installation without notification.
Previously, MySpace users were tricked into downloading video from a site called YooTube, which also attempted to install the Zango Cash program.
Zango, also known as 180Solutions and Hotbar, has had a checkered history. In 2006, Zango settled with the Federal Trade Commission, agreeing to pay $3 million dollars for illegally installing its software on user's PCs without proper notification. Recently, Zango lost its lawsuit against antivirus vendor Kaspersky. At issue was Kaspersky's claim that Zango was a threat to users.
Fortinet estimates that about 3 percent of the Facebook sites currently have the Secret Crush widget installed. For its part, Zango told WiredNews it disputes the advisory, citing that it has not detected any noticeable increase in the use of its software in recent weeks.
- prev
- 1
- next
