Blog Elements

Half Sized Blog Element (Single Author Style)

Half Sized Blog Element (Multi Author Style)

Adobe confirms PDF zero-day, plans rush patch

2010-08-06/0 Comments/in Vulnerability/by admin

Adobe today said it would issue an emergency patch the week of Aug. 16 to fix a critical flaw in its Reader and Acrobat software.

The bug was disclosed by researcher Charlie Miller at last month’s Black Hat security conference when he demonstrated how the open-source BitBlaze toolkit could be used to boost bug-hunting productivity tenfold.

Arlington, VA hosts SANS training program for the CISSP(R) Certification Exam, October 4 – 9

2010-08-06/0 Comments/in Conference, Training/by SecurityOrb_Staff

SANS is pleased to announce Community SANS Arlington, VA where
we will teach Management 414: SANS Training Program for the
CISSP(R) Certification Exam, October 4 – 9. The course will be
taught by SANS Certified Instructor Ted Demopolous. For complete
course description, event details, and to register, please visit
(https://www.sans.org/arlington-2010-cs).

Adobe confirms PDF zero-day, plans rush patch

2010-08-06/0 Comments/in Vulnerability/by admin

Adobe today said it would issue an emergency patch the week of Aug. 16 to fix a critical flaw in its Reader and Acrobat software.

Arlington, VA hosts SANS training program for the CISSP(R) Certification Exam, October 4 – 9

2010-08-06/0 Comments/in Conference, Training/by SecurityOrb_Staff

Full Sized Blog Element (Big Preview Pic)

Adobe confirms PDF zero-day, plans rush patch

2010-08-06/0 Comments/in Vulnerability/by admin

By Gregg Keizer | Computerworld | InfoWorld

Adobe today said it would issue an emergency patch the week of Aug. 16 to fix a critical flaw in its Reader and Acrobat software.

Miller, an analyst with Baltimore-based Independent Security Evaluators, is well-known for finding vulnerabilities in Adobe’s popular Reader PDF viewer. Last March, Miller showed how a simple fuzzing tool could root out scores of potential bugs in Reader, Microsoft Office, Apple’s Preview, and other software.

According to a paper Miller published after the Black Hat conference ( download PDF ), and others, the bug is in Reader’s and Acrobat’s font parsing.

“This can be exploited to corrupt memory via a PDF file containing a specially-crafted TrueType font,” stated Danish vulnerability tracker Secunia in an advisory published Wednesday. “Successful exploitation may allow execution of arbitrary code.”

Today, Adobe announced it would release a rush, or “out-of-band” security update during the week of Aug. 16-20. Adobe issues its quarterly security updates for Reader and Acrobat on Tuesdays, and has shipped emergency fixes on that same day of the week. If the company continues the practice, it would most likely deliver the out-of-band patch on Aug. 17.

Adobe hinted that the out-of-band update will include fixes for vulnerabilities other than the one Miller uncovered. The company also said it would still ship its next regularly-scheduled quarterly update on Oct. 12.

Although the Adobe vulnerability shares traits with the one currently being used to “jailbreak” Apple’s iOS mobile operating system — both involve font parsing errors — they’re not linked, Miller said.

“Its just a coincidence that they are both bugs in the way programs parse fonts in PDFs,” Miller said in an e-mail reply to questions.

The vulnerability exploited by the JailbreakMe software is in Apple ‘s PDF viewer, dubbed Preview, not in Adobe’s Reader, a fact that Adobe tried to make clear yesterday. “Not all PDF-related vulnerabilities are automatically Adobe vulnerabilities,” argued Brad Arkin, Adobe’s head of security and privacy, pointing out that the formerly proprietary PDF was issued as an open standard in 2008.

To read the rest of this article, you can find it at the here.

Arlington, VA hosts SANS training program for the CISSP(R) Certification Exam, October 4 – 9

2010-08-06/0 Comments/in Conference, Training/by SecurityOrb_Staff

If you need to take this course sooner than the first week of
October, there are a few seats still available in Charleston,
SC for the same course starting on Monday, August 23,
(https://www.sans.org/charleston-2010-cs).

SANS Instructor Ted Demopolous just completed teaching this sold out
course to a group of students in Dulles, and so we are scheduling
another class as so many of you are working to make sure you are
compliant with the DoD 8570.1 directive on security certifications
by the end of this year. Why take this course from SANS as opposed
to another training provider?

Over the past four years, 98% of the people who have taken this SANS
course and then took the CISSP(R) certification exam have passed
the exam. Don’t you want those odds on your side when you sit for
the CISSP(R) exam this year?

Save $400 on tuition fees when you register by September 1.

TRAINING EVENT DETAILS:

When: October 4 – 9, 2010

Course: Management 414: SANS Training Program for the CISSP(R)
Certification Exam
Instructor: Ted Demopolous
(https://www.sans.org/arlington-2010-cs)

Where: Residence Inn Marriott
Arlington Pentagon City
550 Army Navy Drive
Arlington, Virginia 22202
Phone: 703-413-6630

Tuition: $3,095 through September 1, 2010
(https://www.sans.org/arlington-2010-cs/tuition.php)

Group Discounts: contact community@sans.org

THE COMMUNITY SANS ADVANTAGE (http://www.sans.org/info/41114)

The Community SANS format offers the most popular SANS courses in
your local community at a reduced tuition fee.

Small class sizes make it easier for you to get the access you need
to your veteran Community SANS instructor, Ted Demopolous. The small
class size also makes it much easier for you to network with your
professional peers throughout the six course days.

SANS promises that you will be able to use what you learn in the
classroom as soon as you return to the office.

Does this sound like the kind of training that would help you to be
more effective in your job combating Cyber Crime and Cyber Terrorism?
Won’t your management want to know you are working to get the
skills needed to provide a secure networked environment for your
organization? Then register today to join us in Dulles by visiting
(http://www.sans.org/info/58518).

Please contact me if you have any questions, and thanks for your
continued participation in the SANS community.

See you in Arlington!

Warm regards,

Scott Weil – Director
SANS Training Without Travel

********************************************************************

SANS is pleased to announce an easy way to view all upcoming training
events happening right in your community. To view our current schedule
please visit us at (http://www.sans.org/info/33203)

To change your subscription, address, or other information, visit
http://portal.sans.org. If you wish to have your name removed from our
mailing list, visit the site above, click on “update your account” and
check the box “Do not send any email.”

SANS Institute, 8120 Woodmont Ave., Suite 205, Bethesda, MD 20814-2743

********************************************************************