Adobe Reader 9 and Acrobat 9 0Day Vulnerability

Adobe Reader 9 and Acrobat 9 found to be vulnerable to a 0day exploit where Adobe is planning to release the patches on 11th March 2009:

http://secunia.com/blog/44/

In the first place, the security specialist said that users can be protected by disabling the Javascript on Adobe, which can be found here:

http://www.4shared.com/file/90132463/a01aa640/Adobe_JS_Fix.html


Lately security specialist from Secunia reported that disabling the Javascript cannot eliminate all the risk, more information can be found here:

http://www.adobe.com/support/security/advisories/apsa09-01.html

Conclusion

The only mitigation is avoid opening PDF document from unknown source or cross the finger to wait the 11th March 2009 to reach :)

Now is F-Secure??

Another security company, F-Secure who has the same fate as Kaspersky, was hacked today. However the hacker claimed that there was no sensitive information leaked for this time.

More information:

http://hackersblog.org/2009/02/11/f-securecom-sql-injection-cross-site-scripting/
http://www.theregister.co.uk/2009/02/11/psystart_website/

Kaspersky Was Hacked??

On Feb 7 2009, Kaspersky was reported to be hacked by a Romanian hacker who is known as Unu. The hacker used a simple SQL injection technique to compromise the one of the famous antivirus companies, Kaspersky. Many security sepcialists as well as the security enthusiasts have commented on this incident.

The hacker claimed that they can access all the data hacked but Kaspersky denied that. They can only know the tables and fields in the database but not the data within it. I have attached the links which are considered to be most technical discussions in regards to the security breach.

Enjoy ;)

~~x9090

Kaspersky Incident Analysis:

http://www.viruslist.com/en/weblog?weblogid=208187633

Unu's Blog (with proof of vulnerability screenshots):

http://hackersblog.org/2009/02/07/usakasperskycom-hacked-full-database-acces-sql-injection/