[ news_security_news ]
Keeping An 'eEye' On Zero-Day Exploits
David Utter
Staff Writer
2006-12-05
 Security News RSS Feed
Marc Maiffret's eEye security firm recently launched the Zero-Day Tracker, a website where the company will post and archive information on vulnerabilities hit by zero-day exploits.
When a patch emerges from a prominent software company like Microsoft or Oracle, the details of a new vulnerability can spur malicious people to try and exploit those issues before customers apply the patches.
"The increasing proliferation of zero-day vulnerabilities means the previous window of opportunity IT had to secure networks between the release of a software patch and an attack has been slammed shut," said Maiffret, eEye's founder and CTO.
Citing consumer demand, eEye launched the Zero-Day Tracker to meet the need for more information about the exploits that can plague a system administrator on any size network.
Maiffret indicated a point of difference between the Zero-Day Tracker and other vulnerability & exploits tracking services:
The eEye Research Team investigates vulnerabilities independently of other reports, separating "denial of service" vulnerabilities from those that are truly exploitable through exhaustive, expert research. An example of this can be found here.
Originally reported as a "denial of service" flaw, eEye demonstrates that the vulnerability is actually exploitable. By tracking the vulnerability in detail, eEye enables security professionals to implement mitigation strategies immediately.
Currently the site has seven active unpatched vulnerabilities listed, plus 17 more that have been patched and archived.
The most recent exploit listed affects Adobe Reader and Adobe Acrobat Standard and Professional versions.
An ActiveX issue with those products could permit remote execution of arbitrary code on a targeted Windows system.
Any malicious website could host the ActiveX payload and corrupt a machine, which would be a huge problem if the user has Administrator rights when the code hits.
---
Tag: Zero-Day
Add to  Del.icio.us |  Digg |  Reddit |  Furl
Get all the SecurityProNews updates: 
About the Author:
David Utter is a business and technology writer for SecurityProNews and WebProNews.
More news_security_news Articles
Security News RSS Feed
|
|
RSS
Archive
Contact Us
Advertise
