Office 2007 Ultimate 'Bricking' bug threatens most

Computerworld - The hacker who posted an exploit last week that threatened a big swath of Hewlett-Packard Co.'s laptop computer lineup followed up yesterday with new assault code that will "brick" practically each HP laptop computer.
In a very submit for the milw0rm.com Site Wednesday, a Polish security researcher who utilized the alias "porkythepig" spelled out a pair of vulnerabilities in an ActiveX control utilized by HP's Computer software Update, the patch management program bundled with just about each HP- and Compaq-branded laptop computer.
In accordance to porkythepig's submit, the Software Update bugs let an attacker corrupt Windows' kernel files, creating the laptop computer unbootable, or with a minor a lot more effort, let hacks that might end result within a Computer hijack or malware infection. In possibly scenario, a drive-by assault could be carried out by feeding customers an e-mail message using a website link to a malicious Web page.
"Every HP notebook machine made up of the HP Software program Updates software is vulnerable," claimed porkythepig. "It is possible the susceptible machine design record disclosed by the vendor being a confirmation for the prior situation regarding HP laptops, [the] HP Data Middle situation, will be related in this case."
Previous week,Are acer laptops any good - IT Professionals' Lounge, porkythepig disclosed many flaws in other computer software included with HP's portables. If the organization patched the vulnerabilities a day later,Office 2007 Ultimate, it outlined 83 affected laptops.
The situation in which an attacker overwrites the kernel and hence "bricks" the HP or Compaq notebook, was out of the regular, since most hacks aim to snatch management in the machine or infect it with identity-stealing malware. However the crippling assault, said porkythepig, is in fact the simpler with the two. "This attack vector isn't going to require any additional victim social engineering, because the system files are constantly placed within the predictable places," he said.
A drive-by attack that hopes to execute rogue code,Office Ultimate Key, nonetheless, calls for far more perform. To effectively exploit the ActiveX bug in Software program Update and compromise the pc, the hacker has to know the site of particular files.
The researcher said he had tested the exploit code on Windows 2000, XP,Office Home And Student 2010 Sale, Server 2003 and Vista, and the vulnerabilities pose a threat to any user with either Internet Explorer 6 (IE6) or IE7 within the Computer. Nor will HP be capable of utilize the down-and-dirty correct it deployed final week, explained porkythepig. Right after he uncovered several bugs in HP's Information Center per week ago, HP issued an update that basically disabled the vulnerable computer software.
"Simple disabling in the susceptible manage through the vendor's patch, like inside the other HP application vulnerability situation, HP Info, [could still] result within the machine['s] software update system [being] compromised, and would leave the user susceptible to long term safety issues," porkythepig said within the milw0rm.com write-up.

HP didn't reply to e-mailed requests for confirmation and comment.


Related News and Discussion:
Update: Most HP,Genuine Windows 7, Compaq notebooks ship with code bugs
Evan Koblentz,Office Professional 2010, Technological innovation Rewind: HP-35/35th Anniversary Edition expected shortly
Robert L. Mitchell, Fact Check out: Ink wars: HP's glass fifty percent empty defense
Robert L. Mitchell, Actuality Verify: Kodak vs HP ink wars: Select your paper wisely
HP unveils its 1st Linux laptop
Ken Mingis, Mingis on Macs: Mac consumers 'unbearably smug' about security?
C.J. Kelly's blog: Hacking Stupidity 101: In no way hack from home
The eight most dangerous client technologies
Read a lot more about Safety in Computerworld's Protection Subject Middle.