5/4/2008

Akamai Download Manager Arbitrary Program Execution Vulnerability

Filed under: — Aviran Mordo

Akamai Download Manager is an integral component of Akamai’s global distribution service. It is used to deliver big files quickly and reliably to users around world. It has been used by vendors such as Symantec and Microsoft to provide downloads to the public.

Akamai provides both an ActiveX and a Java based Download Manager. If a user uses the ActiveX control once, it will remain installed on the users computer until manually removed. For more information, please visit following web sites.

http://www.akamai.com/html/technology/products/http_downloads.html

http://www.akamai.com/html/solutions/electronic_software_delivery.html

Remote exploitation of a design error in Akamai Technologies, Inc’s Download Manager allows attackers to execute arbitrary code in the context of the current user.

The ActiveX control version has the following identifiers:

Class: DownloadManager Control
CLSID: 2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B
CLSID: FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1
ProgId: MANAGER.DLMCtrl.1.
File: C:WindowsDownloaded Program FilesDownloadManagerV2.ocx

The Java version has the following identifiers:

Class: com.akamai.dm.ui.applet.DMApplet.class
JAR: dlm-java-2.2.2.0.jar

This problem specifically exists due to two undocumented object parameters. By using these parameters, it is possible to cause Download Manager to automatically download and execute arbitrary binaries from attacker controlled locations.

Microsoft withdraws proposal to acquire Yahoo

Filed under: — Aviran Mordo

Microsoft on Saturday yanked its proposal to acquire Yahoo, saying the struggling Internet pioneer refused to budge on price despite the software giant upping its offer to nearly 50 billion dollars.

Talks aimed at resolving corporate dueling that began with Microsoft’s offer on February 1 to buy Yahoo for 31 dollars per share ended with the two firms unable to close a multi-billion-dollar gap in price expectations.

“Despite our best efforts, including raising our bid by roughly five billion dollars, Yahoo has not moved toward accepting our offer,” Microsoft chief executive Steve Ballmer said in a letter posted on his company’s website.

“We continue to believe that our proposed acquisition made sense for Microsoft, Yahoo and the market as a whole.”

“After careful consideration, we believe the economics demanded by Yahoo do not make sense for us, and it is in the best interests of Microsoft stockholders, employees and other stakeholders to withdraw our proposal,” said Ballmer.

Powered by WordPress