GIFAR - File Exploit Affects GIF and JPEG Files

According to an article over at Arstechnica, researchers at NGSSoftware have developed a hybrid attack which is capable of hiding itself within an image or other file types. NGSSSoftware intend to present details on the exploit at the Black Hat security conference which takes place next week. This exploit could be used on web sites such as MySpace and Facebook with great ease. Embedding the offending exploit code in a graphic would make it idea for socially engineered distribution. The GIFAR exploit works because two different programs see the same file differently. The web server that actually holds the file sees it as a GIF file, and serves it accordingly, but when the "image" actually reaches the client, it's opened as a Java applet and run. The research team will leave some of the details of the attack out of their presentation, in order to prevent its immediate exploitation. Patches are already underway from some vendors, including Sun.

Intel Security Flaw Revealed

Kris Kaspersky claims that he's found a flaw in Intel's processors which would allow a hacker to compromise a computer using JavaScript or TCP/IP. The Flaw is present in the chipset meaning that it is irrelevent what operating system the computer is running. Kris indicates he'll unveil the flaw at the Hack In The Box conference in Malaysia this October.

Critical Flaw Found In Photoshop CS2 & CS3

An exploit code that could take advantage of a "highly critical" security flaw in Adobe Photoshop Creative Suite 3, as well as CS2, has been published. The security flaw is related to the way Adobe Photoshop handles the processing of bitmap files, such as .bmp, .dib and .rle. A malicious file of these types, could allow an attacker to exploit the flaw to launch a buffer overflow attack. The resulting buffer overflow could then allow the intruder to take over the affected user's system. For more info visit silicon.com.