Many campaigns are known to use mail attachments containing double zipped files. A remote attacker could send e-mails including such files and convince users to manually trigger their execution. This would allow the malicious code to run and infect the target system.
Category Archives: Checkpoint
Checkpoint
Adobe Acrobat and Reader Use After Free (APSB17-01: CVE-2017-2956; CVE-2017-2957)
A remote code execution vulnerability has been reported in Adobe Acrobat and Reader. The vulnerability is due to a use-after-free error in Adobe Reader and Acrobat while handling a specially crafted PDF file. A remote attacker can exploit this vulnerability by enticing a target user to open a specially crafted PDF file.
PowerDNS Authoritative Server Dot Character Denial of Service (CVE-2016-5427)
A denial-of-service vulnerability exists in PowerDNS Authoritative Server. The vulnerability is due to an error in processing queries with the dot character inside. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted DNS packet to the target application that could lead to excessive resources being consumed, resulting in a denial of service condition.
Adobe Acrobat and Reader Use After Free (APSB17-01: CVE-2017-2951)
A use after free vulnerability exists in Adobe Acrobat and Reader. The vulnerability is due to an error in the way Adobe Acrobat and Reader handles objects in memory. A remote attacker can exploit this vulnerability by enticing the user to open a specially crafted PDF file.
ImageMagick SyncExifProfile Out Of Bounds Array Indexing (CVE-2016-7799)
A out-of-bounds array indexing vulnerability exists in ImageMagick. The vulnerability is due to improper handling of certain objects in memory. Successful exploitation could result in arbitrary code execution.
Adobe Acrobat and Reader Memory Corruption (APSB17-01: CVE-2017-2939)
A memory corruption vulnerability has been reported in Adobe Reader and Acrobat. The vulnerability is due to an error in Adobe Reader and Acrobat while parsing a file with malformed cross-reference table. A remote attacker may exploit this vulnerability by enticing a target user to open a specially crafted file.
Web Servers Malicious Upload Directory Traversal
A directory traversal vulnerability exists in web servers. The vulnerability allows unauthorized users to upload malicious files to the server. A remote attacker can exploit this vulnerability by uploading an arbitrary, executable file and executing it under the context of SYSTEM.
Adobe Acrobat and Reader Buffer Overflow (APSB17-01: CVE-2017-2948)
A buffer overflow vulnerability exists in Adobe Reader and Acrobat. The vulnerability is due to an error while parsing a corrupted PDF file containing an XSL stylesheet. A remote attacker may exploit this vulnerability by enticing a target user to open a specially crafted PDF file.
Adobe Flash Player Heap Overflow (APSB17-02: CVE-2017-2934)
A Heap Overflow vulnerability exists in Adobe Flash Player. The vulnerability is due to an error in Adobe Flash Player while parsing a specially crafted file. A remote attacker can exploit this issue by enticing a victim to open a specially crafted file.
Adobe Flash Player Heap Overflow (APSB17-02: CVE-2017-2933)
A heap overflow vulnerability exists in Adobe Flash Player. The vulnerability is due to an error in Adobe Flash Player while parsing a specially crafted ATF file. A remote attacker can exploit this issue by enticing a victim to open a specially crafted ATF file.