Fighting malware and spam

Outpost firewall security breached

Exploit defeats self-protection systems.

Security researchers at Matousec, known to VB readers from their firewall leak tests, have released details of an exploit taking advantage of a weakness in Agnitum's Outpost firewall product.

The attack exploits a weakness in the self-protection system used by Outpost to prevent tampering with its own files. Full details of the exploit are available online for malicious use, and no patch has yet been made available, as the vendor was informed of the problem at the same time as the public disclosure.

It is believed the flaw affects various versions between 3.0.5 and 4.0.1, and can only be exploited from the local system. The release from Matousec is here, with an alert from heise security here.

A response from Agnitum to the discovery and announcement of the exploit was posted on the company's blog on 23 January. The company states that it hopes to have a fix available before the end of January, but also questions the motives of the research group, Matousec, that initially identified the exploit.

Agnitum's statement can be read here.

17 January 2007

Tags:    del.icio.us   digg this

Poll

Virus Bulletin

• Same malware, different code
• Can you spare a seg?
• Kernel mechanics of Rustock
• Early warning approaches to combat typosquatting
• The challenges of collecting and monitoring URLs that point to malware
• Norman Network Protection Appliance
• Anti-spam comparative review July 2009