Ubisoft patches dangerous plugin flaw

Powered by SC Magazine
 

Add-on allows attackers to execute applications on user machines.

Ubisoft has scrambled to fix a vulnerability discovered in its web browser plugin that allowed web sites to execute applications on user machines.

The flaw was reported on the Full Disclosure mailing list by Google security researcher Travis

Ormandy who stumbled across the flaw while installing the Ubisoft game title Assassin's Creed Revelations.

The vulnerable browser plugin was installed on customer machines as part of a game package and was used to take command line arguments while games were in under development.

But the function allowed the application to run any executable.

Ormanday created a brief proof of concept code that allowed a website to launch the Windows calculator via the vulnerable plugin.

Hours after the Monday post, Ubisoft issued a patch to close the vulnerability, blaming the gaffe on a "coding error".

Ubisoft denied claims by users it had installed rootkits on user machines to preserve its contentious digital rights management.

Copyright © SC Magazine, Australia


Ubisoft patches dangerous plugin flaw
 
 
 
Top Stories
The True Cost of BYOD - 2014 survey
Twelve months on from our first study, is BYOD a better proposition?
 
Photos: Unboxing the Magnus supercomputer
Pawsey's biggest beast slots into place.
 
ANZ looks to life beyond the transaction
If digital disruptors think an online payments startup could rock the big four, they’ve missed the point of why people use banks, says Patrick Maes.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
What is delaying adoption of public cloud in your organisation?







   |   View results
Lock-in concerns
  29%
 
Application integration concerns
  3%
 
Security and compliance concerns
  28%
 
Unreliable network infrastructure
  9%
 
Data sovereignty concerns
  21%
 
Lack of stakeholder support
  3%
 
Protecting on-premise IT jobs
  4%
 
Difficulty transitioning CapEx budget into OpEx
  3%
TOTAL VOTES: 1071

Vote