Google Chrome 'SaveAs' Function 'Title' Tag Buffer Overflow

Google Chrome is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary-checks on user-supplied data.

An attacker can exploit this issue to execute arbitrary code in the context of the user running the application. Failed exploit attempts will likely result in a denial-of-service condition.

Google Chrome 0.2.149.27 is vulnerable.

SecurityFocus

Spammers abusing Google Picasa

Spammers are misusing Google's services to deceive spam filters and draw users to their advertising pages. MessageLabs says that in recent months it has noticed an increasing number of emails with links to Picasa web albums which use Flash films to redirect visitors to spammer pages. Users can store their own images – and apparently Flash applets as well – at Picasa, free of charge.

The Intelligence Report says that, with emails containing embedded links to Google, the usual spam filters have a hard time trying to discriminate between the legitimate and the malicious. These are after all legitimate URLs, so blocking emails containing Google URLs would probably do more harm than good.

ImageShack is also reported to be among the misused service providers. Although MessageLabs recorded less than two per cent of the total amount of spam in August as arriving by this route, it is nonetheless convinced that these distribution channels will become markedly more significant in coming months.

Like the ShadowServer Foundation, MessageLabs was able to spot an extension in the spread of botnets. The Srizbi and Cutwail botnets each grew by 20 to 25 per cent between July and August, taking the increase in spam worldwide in August close to 160 per cent compared to July. MessageLabs is also warning against "Antivirus XP 2008", a rogue program that poses as anti-spyware software and now represents a serious threat to companies. Once installed, it terrorizes its users with false warnings of infections, trying to persuade them to buy the full version of the program.

MessageLabs says that, in August, France suffered the most from junk advertising. The spam quota there rose 3.5 per cent to 82.8 per cent, putting the French on the top of the list of the world's most heavily spammed countries. The largest jump in the spam load – 13.9 percentage points – was recorded in Italy, where the total was 71.3 per cent.

heiseSecurity.

Microsoft to close four critical security holes

Next Tuesday, September 9, Redmond will release four updates to close critical security holes in Windows, Office, Windows Media Player and Windows Media Encoder.

According to the software vendor's announcement, all four holes can be used remotely to inject and execute code. While no detailed information has been released yet, users probably have to open a specially crafted file for the attack on Office to succeed. It is not clear whether the flaw in Windows Media requires a visit to a web site.

The holes in Windows, Windows Media Player and Windows Media Encoder all affect Windows 2000, XP (32/64), Vista (32/64), Windows Server 2003 and Windows Server 2008. In the latter, the flaw cannot, however, be found if the option for Server Core installation is set. As usual, an updated version of the Malicious Software Removal Tool will be included. Microsoft also plans to distribute updates for the Windows Mail Junk E-Mail Filter and other flaws not related to security.

heiseSecurity

ZoooS Aims for Online Versions of OpenOffice Apps
http://ostatic.com/172445-blog/zooos-aims-...openoffice-apps

Google Chrome at risk from 'carpet bomb' bug



Continued:

ComputerWorld

Mozilla Products Multiple Remote Vulnerabilities

The Mozilla Foundation has released six security advisories specifying vulnerabilities in Firefox, SeaMonkey, and Thunderbird.

These vulnerabilities allow attackers to:

- Execute arbitrary code
- Cause denial-of-service conditions
- Perform cross-site scripting attacks
- Obtain potentially sensitive information
- Spoof legitimate content

Other attacks may also be possible.

SecurityFocus

Botnets quadruple in size

In the past three months, the size of "botnets" – groups of virus-compromised "zombie" PCs – has increased by a factor of four, according to statistics published by the ShadowServer Foundation. The Foundation's members include a number of security specialists that monitor botnets, malware and phishing activity, but the experts aren't sure why the number of infected PCs has risen so quickly.

The Internet Storm Center (ISC) believes that widespread SQL injection attacks on web sites are behind it all. These attacks compromise the database server behind an otherwise-harmless web site, so that site visitors using unpatched browsers are served malware. Another explanation is that bot-herders may simply be able to keep control of a compromised PC for longer before users discover an anomaly or a virus scanner detects the infection.

Thorsten Holz, cofounder of Germany's Honeynet Project, believes that email attacks in the past few months have brought about these changes. During this time, malware has been circulating as forged UPS invoices, Angelina Jolie videos, reports about the US invading Iran and most recently as Olympic screensavers. Holz pointed out to heise Security that ShadowServer mainly monitors IRC botnets, which are not related to SQL injection attacks – a fact that further bolsters his interpretation.

Recently, security service providers FireEye and SecureWorks also reported some interesting findings about botnets. It turns out that the two botnets which vie for the title of King of the Hill, Srizbi and Rustock, have some things in common. Apparently, one client is using both networks to send spam email. It is also unusual that emails that distribute Srizbi bots are being sent from the Rustock network.

heiseSecurity

Spammers use free Web services to shield harmful links



Continued

ComputerWorld

Google amends Chrome license agreement after objections



Continued:

ComputerWorld

Google Chrome Arbitrary File Download Vulnerability

Google Chrome is prone to a security vulnerability because the application allows users to download arbitrary files without confirmation.

This issue may allow attackers to perform social-engineering or other attacks to trick users into downloading a malicious file.

SecurityFocus