AOH :: HP Unsorted I :: B06-2147.HTM

Insecure auto-update and file execution (2006)



Insecure Auto-Update and File execution (2)
Insecure Auto-Update and File execution (2)




Dear List,

As my advisory has been a bit unclear in certain regards, I would like
to clarify a few questions I have received briefly :

- The Auto update problem with Zango Adware remains, there was no fix.
- The Adware component is distributed by over 10.000 affilates
  everyday and I expect it to be installed on millions of workstations (IMO).
- If you compromise (or alter) a DNS server this gives immediate access to
  internal client machines.

  The impact as citing Kevin F. is : "Dns server pwnage and then mass client ownage"
  
  

-- 
http://secdev.zoller.lu 
Thierry Zoller
Fingerprint : 5D84 BFDC CD36 A951 2C45  2E57 28B3 75DD 0AC6 F1C7


The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.