Monday, February 12, 2007

Anocá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365r Anti-Virus Problem

Here's more evidence if you need to make a case that blindly requiring anti-virus or ocá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365r agents on all systems is neicá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365r cost-free nor automatically justified, as I mentioned late last year. As reported by SANS @RISK (link will work shortly):

Trend Micro Antivirus, a popular antivirus solution, contains a buffer overflow vulnerability when parsing executables compressed with cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 UPX executable compression program. A specially-crafted executable could trigger this buffer overflow and execute arbitrary code with SYSTEM/root privileges, allowing complete control of cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 vulnerable system. Note that cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 malicious file can be sent to a vulnerable system via email (spam messages), web, FTP, Instant Messaging or Peer-to-Peer file sharing. UPX file format vulnerabilities have been widely-reported in cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 past, and UPX file fuzzers are commonly available.

Here's cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 Trend Micro advisory.

7 comments:

Anonymous said...

UPX file format vulnerabilities have been widely-reported in cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 past, and UPX file fuzzers are commonly available

It's almost as if cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 virus writers (or at least cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 designer of UPX) knew that cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 AV writers were going to screw up something like a UPX parser and baited cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365m into such a screw-up.

Chris Rohlf said...

I have blogged before on trusting analysis software. Not specifically AV but disassemblers/debuggers etc. They contain vulnerabilities as well and we are silly to think malware will not start targeting cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365m explicitly.

Anonymous said...

Good point, although I am reflexively queasy about having a system without A/V installed.

"Even" Windows Vista becomes instantly vulnerable if you install Windows Defender anti-spyware on it without cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 Feb. 14 update.

Microsoft Security Bulletin MS07-010, Affected Software:

Microsoft Windows Defender in Windows Vista
Windows Live OneCare
Microsoft Antigen for Exchange 9.x
Microsoft Antigen for SMTP Gateway 9.x
Microsoft Windows Defender
Microsoft Windows Defender x64 Edition
Microsoft Forefront Security for Exchange Server
Microsoft Forefront Security for SharePoint

Thanks Richard, for a most awesome website.

Anonymous said...

AV agents/scanners are crap. I currently use Blink for personal use when I have to. When I have to make an AV recommendation to an organization, it is usually BigFix.

I never use typical AV scanners and recommend you also do not. They are fine for incident response, when you have cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 computer in an electronically-shielded room with no network connections.

In fact, I have BartPE on a bootable USB key with cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 portable version of NOD32. I use it to do this sort of "offline" scanning.

Anonymous said...

About 7 or 8 months ago I was working for a networking company that used Trend Micro Client/Server Suite on 95% of it's customers. We also used RealVNC to remotely "fix" issues that arrived over a VPN. Trend sent out an update that classified RealVNC as a trojan, but not one instance,but many thousand per machine and every customer at cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 same time freaked out. Subsequently Trend had to send a patch a few hours later , and we spent a few days reassuring everyone that cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 issue was resolved and that cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365y weren't infected many thousand times over with cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 troj/generic 'virus'.

Carlos said...

cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365greenvoid.blogspot.com

Free Virus Protection said...

Some have we solve problem but some are it has a bad effect.