Time's up: Google releases attack code for serious Adobe Reader bug

Windows users who haven't updated to the latest version of Acrobat and Adobe Reader probably should do so right now, after a Google security researcher revealed details of a vulnerability affecting the pair, and how to exploit it.

As Adobe noted in its September security update for Acrobat and Reader on Windows, version 11.0.8 of the two programmes was vulnerable to a sandbox bypass that could allow an attacker to run native code with escalated privileges on Windows. US-CERT gave it a severity rating of 10.

The bug was discovered by James Forshaw, a security researcher in Google's Project Zero initiative. Forshaw has now released further details of the flaw, making it more important for Windows users to update to version 11.0.9 of Acrobat and Reader, since attackers can use the information to devise an attack for the vulnerability. Details released this week include a proof of concept exploit, source code, and pre-compiled binaries.

Project Zero is part of Google's effort to clean up widely-used third-party software with the aim of reducing the number of people potentially harmed by zero-day attacks. The program is separate to its own bug bounty program for researchers who report flaws in Google software.

Flaws discovered by the Project Zero team are housed in an external database and are kept under wraps until the vendor of the affected product issues a patch for it, or 90 days after it was reported to the vendor. In this case, Adobe has released a fix and the 90 days were up on November 26.

According to Forshaw, the sandbox escape in version 11.0.8 was possible due to a "race condition in the handling of the MoveFileEx call hook". 

"While the function resolves the location of the source and destination and ensures they are within the policy, there is a timing race once the function calls into the MoveFileEx function in the broker. This race can be won by the sandboxed process by using an OPLOCK to wait for the point where the MoveFileEx function opens the original file for the move. This allows code in the sandbox to write an arbitrary file to the file system," Forshaw wrote.

He noted that technically version 11.0.9 doesn't fix the race condition, however the update did make it "difficult if not impossible to exploit" due to additional defences Adobe made available in the update.

According to Forshaw, the update made it "no longer possible to use the broker file system hooks to create directory junctions".

View the original article here

Kabul police chief quits after South African family die in Taliban attack

By Kay Johnson and Jessica Donati
KABUL Sun Nov 30, 2014 10:43am EST

1 of 2. Smoke and fire rise from a foreign aid workers' guest house after a Taliban attack in Kabul November 29, 2014.
Credit: Reuters/Omar Sobhani
KABUL (Reuters) - The Kabul police chief resigned on Sunday after Taliban gunmen killed three members of a South African family in the capital, while officials said Afghan forces had ousted insurgents trying to seize former U.S. and British base Camp Bastion in the south.
Taliban fighters breached the perimeter of Camp Bastion in the southern Afghan province of Helmand three days ago, just one month after the base was handed over to the Afghan army.
The latest Taliban attacks have dented confidence in the country's security force and added to concern the police and army will struggle to hold strategic territory after most foreign troops pull out at the end of 2014.
The guest house attacked by the Taliban in Kabul on Saturday, the third attack on a foreign guest house in 10 days, was home to staff of the U.S.-based charity Partnership in Academics and Development (PAD).
PAD said on its website that three people were killed by insurgents who used guns and explosives. They were identified as members of the same South African family - a father and his two teenage children - by a colleague of the mother, who was not in the compound at the time.
The family had lived in Afghanistan for nearly 12 years, with the father running the charity and the mother working as a doctor at a Kabul clinic, the colleague said.
The Taliban said on Saturday they had attacked the foreign guesthouse because they believed it to be a Christian center. This was the second time this year the Taliban targeted a group that it said had links to Christianity.
The 17-year-old son had been applying to universities in the United States, while his sister was 14, according to their mother's colleague, who asked not to be identified for security reasons.
Kabul's police spokesman declined to comment on the reason for the chief's resignation.
"We can only confirm... he will not continue his job as police chief anymore," Hashmat Stanekzai said.
PAD, which supports education in Afghanistan, could not be reached immediately for comment.
Violence across Afghanistan has surged this year as the Taliban and their allies have stepped up their activities ahead of the scheduled withdrawal of most international troops by the end of next month.
Over the past 10 days, three compounds used by foreign organizations have been hit by armed attackers. In separate attacks in Kabul, two American soldiers, two British embassy workers and dozens of Afghan civilians have died.
In Helmand province, Afghan soldiers ousted a group of Taliban from Camp Bastion after a third day of fighting. At least five soldiers were killed in the battle that started late on Thursday.
By Sunday, troops were clearing the part of the sprawling base that had been seized by a few dozen insurgents, according to the governor's spokesman, Omar Zwak.
Violence in another part of Helmand added to the weekend toll, Zwak said, with 12 soldiers dying in Sangin district after their smaller outpost was attacked.
(This story has been refiled to fix layout of third paragraph, no change to text)
(Additional reporting by Mirwais Harooni; Editing by Richard Borsuk and Raissa Kasolowsky)

View the original article here

Three dead in attack and Islamist protests in Egypt

CAIRO Fri Nov 28, 2014 7:00pm EST

1 of 13. Army soldiers take their positions with their armoured personnel vehicle during clashes with supporters of Muslim Brotherhood and ousted Egyptian President Mohamed Mursi in the Cairo suburb of Matariya November 28, 2014.
Credit: Reuters/Mohamed Abd El Ghany
CAIRO (Reuters) - Three people including an army general were killed and at least 28 wounded on Friday in militant attacks, some claimed by a group loyal to Islamic State, and clashes at Islamist protests around Egypt, security sources and health officials said.
Police were out in force at the demonstrations, organized by a hardline Salafi group calling for removal of the government of President Abdel Fattah al-Sisi, the ex-army chief who led the overthrow of elected Islamist president Mohamed Mursi in July 2013.
In Matariya, focal point for protests in Cairo, a civilian died before the gathering was dispersed, security sources said.
Hours before, an army brigadier general was killed and two soldiers wounded when gunmen in an unmarked car fired on a parking lot in nearby Gesr al-Suez, they said. One soldier later died.
The demonstrations were small. Reuters witnesses saw just 100 or 200 people in Matariya.
The Interior Ministry said it thwarted 10 planned bombings and arrested 224 people nationwide on Friday.
One officer was shot in Alexandria and a bomb injured four police in the Nile Delta town of Sharqiya. In Al-Arish, in largely lawless northern Sinai province, a bomb wounded six policemen, security sources said.
Violence also erupted in Beni Soueif, a southern town, and Kafr Sheikh in the Delta, they said.
Ansar Bayt al-Maqdis, Egypt's most active militant group, appeared to take responsibility for some attacks via what claims to be its official Twitter account.
Ansar has pledged loyalty to Islamic State, the ultra-hardline Sunni militants that captured territory in Iraq and Syria, and claimed responsibility for shooting the general, the Sinai bomb and another attack in Qalyubiyah province.
Reuters could not confirm the group's claims.
Since Mursi's ouster, Egypt has cracked down on his Muslim Brotherhood supporters, arresting thousands and sentencing hundreds to death in trials that drew international criticism.
Hundreds of Brotherhood supporters were killed in August 2013 when security forces cleared two protest camps in one of the bloodiest days in Egypt's modern history.
That crackdown and laws banning unsanctioned protests have dampened enthusiasm for the kind of mass rallies that helped remove President Hosni Mubarak in 2011 and Mursi last year.
Authorities have tried to curb radical preaching, replacing thousands of imams and controlling Friday sermons.
The Salafi Front designated Friday's protests the "Uprising of Islamist Youth", alienating secular critics of Sisi and limiting turnout.
(Reporting by Shadi Bushra, Mostafa Hashem and Lin Noueihed; Editing by Andrew Roche and Gunna Dickson)

View the original article here

Friday's mosque attack killed 100, wounded 135 in Nigeria's Kano: state governor

KANO, Nigeria Sat Nov 29, 2014 6:27pm EST

Security and emergency agency staff investigate the Kano Central Mosque bombing scene in Kano November 29, 2014.
Credit: Reuters/Stringer
KANO, Nigeria (Reuters) - A total of 100 people were killed in Friday's coordinated attack on the central mosque of north Nigeria's biggest city of Kano and 135 people were wounded, the governor of Kano state said on Saturday.
Rabiu Musa Kwankaso was speaking to reporters after visiting one of the hospitals treating the victims. Officials had said on Friday that 81 people had been killed in the attack.
Gunmen set off three bombs and opened fire on worshippers at the main mosque in Kano in an attack that bore the hallmarks of Islamist Boko Haram militants, although the attack has not yet been claimed.
Boko Haram, a Sunni jihadist movement fighting to revive a medieval Islamic caliphate in northern Nigeria, regards the traditional Islamic religious authorities in Nigeria with disdain.
The targeted mosque is next to the palace of the emir of Kano, who is the second highest Islamic authority in Africa's most populous country and a vocal critic of Boko Haram.
In a bloody campaign of nearly six years the group has also targeted churches, schools, police stations, military bases and government buildings.
After Friday's attack President Goodluck Jonathan said the perpetrators would be tracked down.
(Reporting by Nnekule Ikemfuna; Writing by Julia Payne; Editing by Raissa Kasolowsky)

View the original article here

Friday's mosque attack killed 100, wounded 135 in Nigeria's Kano: state governor

AppId is over the quota
KANO, Nigeria Sat Nov 29, 2014 6:27pm EST

Security and emergency agency staff investigate the Kano Central Mosque bombing scene in Kano November 29, 2014.
Credit: Reuters/Stringer
KANO, Nigeria (Reuters) - A total of 100 people were killed in Friday's coordinated attack on the central mosque of north Nigeria's biggest city of Kano and 135 people were wounded, the governor of Kano state said on Saturday.
Rabiu Musa Kwankaso was speaking to reporters after visiting one of the hospitals treating the victims. Officials had said on Friday that 81 people had been killed in the attack.
Gunmen set off three bombs and opened fire on worshippers at the main mosque in Kano in an attack that bore the hallmarks of Islamist Boko Haram militants, although the attack has not yet been claimed.
Boko Haram, a Sunni jihadist movement fighting to revive a medieval Islamic caliphate in northern Nigeria, regards the traditional Islamic religious authorities in Nigeria with disdain.
The targeted mosque is next to the palace of the emir of Kano, who is the second highest Islamic authority in Africa's most populous country and a vocal critic of Boko Haram.
In a bloody campaign of nearly six years the group has also targeted churches, schools, police stations, military bases and government buildings.
After Friday's attack President Goodluck Jonathan said the perpetrators would be tracked down.
(Reporting by Nnekule Ikemfuna; Writing by Julia Payne; Editing by Raissa Kasolowsky)

View the original article here