Adobe product exploits on your local computer can compromise your servers

Brad Mitchell · 05-30-2009

I have just sent this to all of our customers and wanted to bring the exploit to the whole community's attention as this is something that can affect everyone at all hosts. Best wishes to all and enjoy your weekend.

Dear Clients,

We have caught something early and fortunately, for 99% of you, this will likely mean that you have not been a victim yet. To give this scenario perspective, in the last week we have identified approximately 3 clients where in the final analysis it was determined this exploit of client side software has been the culprit.

If you are not running the most recently patched versions of Adobe Acrobat and Adobe Flash Player you are at risk for compromising your web sites. A recently discovered vulnerability in this software which runs locally on your computer can lead to malware stealing your FTP credentials with the potential for much more. This poses a significant security risk to your server and web sites, leading to attackers using client FTP credentials to deface web sites and insert malicious code which can exploit things further. Below is a description of the risk from the United States Computer Emergency Readiness Team.

Here are two quick links to update your versions:
http://get.adobe.com/flashplayer/
http://get.adobe.com/reader/

Lastly, please be sure that you are up to date with good antivirus software on your local computer. If you discover by surfing any of your web sites that they have been affected, please enter a support ticket and our team can help to mitigate any damage done and issue new FTP/other credentials. It is crucial that your local software and virus protection be up to date and this unexpected exploit of everyday software is a lesson to everybody about just how fragile things truly can be.

---------------------------------------------------------------------
Information as published on: http://www.us-cert.gov/current/

Gumblar Malware Exploit Circulating
added May 18, 2009 at 12:47 pm

US-CERT is aware of public reports of a malware exploit circulating. This is a drive-by-download exploit with multiple stages and is being referred to as Gumblar. The first stage of this exploit attempts to compromise legitimate websites by injecting malicious code into them. Reports indicate that these website infections occur primarily through stolen FTP credentials but may also be compromised through poor configuration settings, vulnerable web applications, etc. The second stage of this exploit occurs when users visit a website compromised by Gumblar. Users who visit these compromised websites and have not applied updates for known PDF and Flash Player vulnerabilities may become infected with malware. This malware may be used by attackers to monitor network traffic and obtain sensitive information, including FTP and login credentials, that can be used to conduct further exploits. Additionally, this malware may also redirect Google search results for the infected user.

US-CERT encourages users and administrators to apply software updates in a timely manner and use up-to-date antivirus software to help mitigate the risks.

US-CERT will provide additional information as it becomes available.
---------------------------------------------------------------------

Sincerely,

Brad Mitchell, CEO
MojoHost
888-345-MOJO Toll Free
248-233-2045 International
ICQ #56950199

Toby · 05-30-2009

I have one sponsor with this exploit on their sites. I notified them and included info about Gumblar. They replied, thanked me for the info, said they were working on it with their host. That was almost two weeks ago and the exploit persists on their site. Too bad they're not hosted with Mojo.

softball · 06-01-2009

I got that from Brad and I have to say its this kind of service that greatly increases my comfort level working with Mojohost.

Brad Mitchell · 06-02-2009

Quote:

Originally Posted by Toby

I have one sponsor with this exploit on their sites. I notified them and included info about Gumblar. They replied, thanked me for the info, said they were working on it with their host. That was almost two weeks ago and the exploit persists on their site. Too bad they're not hosted with Mojo.

I'll be the first to say that hosts are made up of people and thus, as a result, none are perfect. This particular exploit is a good reminder to us and everybody just how fragile security can be. It's my initiative here to be much more pro-active and quicker to market with this kind of data in the future and we are working internally to assure that this happens.

Quote:

Originally Posted by rhetorical

I got that from Brad and I have to say its this kind of service that greatly increases my comfort level working with Mojohost.

Thanks, Marett! So pleased to have you as one of our longest term clients. Please don't hesitate to reach out for any level of assistance.

Brad

TheEnforcer · 06-02-2009

Thanks for the info Brad.

05-30-2009	#1
Brad Mitchell Members Join Date: Feb 2003 Location: Michigan Posts: 198	Adobe product exploits on your local computer can compromise your servers I have just sent this to all of our customers and wanted to bring the exploit to the whole community's attention as this is something that can affect everyone at all hosts. Best wishes to all and enjoy your weekend. Dear Clients, We have caught something early and fortunately, for 99% of you, this will likely mean that you have not been a victim yet. To give this scenario perspective, in the last week we have identified approximately 3 clients where in the final analysis it was determined this exploit of client side software has been the culprit. If you are not running the most recently patched versions of Adobe Acrobat and Adobe Flash Player you are at risk for compromising your web sites. A recently discovered vulnerability in this software which runs locally on your computer can lead to malware stealing your FTP credentials with the potential for much more. This poses a significant security risk to your server and web sites, leading to attackers using client FTP credentials to deface web sites and insert malicious code which can exploit things further. Below is a description of the risk from the United States Computer Emergency Readiness Team. Here are two quick links to update your versions: http://get.adobe.com/flashplayer/ http://get.adobe.com/reader/ Lastly, please be sure that you are up to date with good antivirus software on your local computer. If you discover by surfing any of your web sites that they have been affected, please enter a support ticket and our team can help to mitigate any damage done and issue new FTP/other credentials. It is crucial that your local software and virus protection be up to date and this unexpected exploit of everyday software is a lesson to everybody about just how fragile things truly can be. --------------------------------------------------------------------- Information as published on: http://www.us-cert.gov/current/ Gumblar Malware Exploit Circulating added May 18, 2009 at 12:47 pm US-CERT is aware of public reports of a malware exploit circulating. This is a drive-by-download exploit with multiple stages and is being referred to as Gumblar. The first stage of this exploit attempts to compromise legitimate websites by injecting malicious code into them. Reports indicate that these website infections occur primarily through stolen FTP credentials but may also be compromised through poor configuration settings, vulnerable web applications, etc. The second stage of this exploit occurs when users visit a website compromised by Gumblar. Users who visit these compromised websites and have not applied updates for known PDF and Flash Player vulnerabilities may become infected with malware. This malware may be used by attackers to monitor network traffic and obtain sensitive information, including FTP and login credentials, that can be used to conduct further exploits. Additionally, this malware may also redirect Google search results for the infected user. US-CERT encourages users and administrators to apply software updates in a timely manner and use up-to-date antivirus software to help mitigate the risks. US-CERT will provide additional information as it becomes available. --------------------------------------------------------------------- Sincerely, Brad Mitchell, CEO MojoHost 888-345-MOJO Toll Free 248-233-2045 International ICQ #56950199 __________________ Owner, MojoHost Toll Free 888-345-MOJO \| ICQ #56950199

05-30-2009	#2
Toby Fat Fucking Nobody Respin bullshit press Your Comments Are Welcomed Join Date: Jul 2005 Location: Houston Posts: 2,624	Re: Adobe product exploits on your local computer can compromise your servers I have one sponsor with this exploit on their sites. I notified them and included info about Gumblar. They replied, thanked me for the info, said they were working on it with their host. That was almost two weeks ago and the exploit persists on their site. Too bad they're not hosted with Mojo. __________________ My TGP's: Bevy Of Babes \| Bevy Of Boobs \| Babes In Boots \| Well Heeled Women \| Dressing For Sex \| Latex Vixens \| Stocking Vixens

06-01-2009	#3
softball Members Want to see your own Advertising Here! Join Date: Jul 2005 Posts: 6,165	Re: Adobe product exploits on your local computer can compromise your servers I got that from Brad and I have to say its this kind of service that greatly increases my comfort level working with Mojohost.

06-02-2009	#5
TheEnforcer Scored VIP to Anton's Piss Tank Want to see your own Advertising Here! Join Date: Oct 2002 Posts: 8,781	Re: Adobe product exploits on your local computer can compromise your servers Thanks for the info Brad.