Make Money

Kaspersky Lab, a leading developer of secure content management solutions, has discovered the first virus designed to infect iPod portable media players. The virus, which has been named Podloso, is a proof of concept program which does not pose a real threat.

The virus is a file which can be launched and run on an iPod. It should be stressed that in order for the virus to function, Linux has to be installed on the iPod. If the virus is installed on the iPod by the user, the virus then installs itself to the folder which contains program demo versions. Podloso cannot be launched automatically without user involvement.

Once launched, the virus scans the device’s hard disk and infects all executable .elf format files. Any attempt to launch these files will cause the virus to display a message on the screen which says "You are infected with Oslo the first iPodLinux Virus".

Podloso is a typical proof of concept virus, which is created in order to demonstrate that it is possible to infect a specific platform. It does not have a malicious payload and is unable to spread on its own: a user has to save the virus to the iPod for the device to become infected.

Vulnerabilities fixed:

• Kaspersky Antivirus ActiveX Unsage Methods Vulnerability
• Kaspersky Anti-Virus SysInfo ActiveX Control Information Disclosure Vulnerability
• Kaspersky AV Library Remote Heap Overflow
• klif.sys Heap Overflow Vulnerability
• KLIF Local Privilege Escalation Vulnerability

Kaspersky Antivirus ActiveX Unsafe Methods Vulnerability¹

This vulnerability allows remote attackers to download and remove any file on vulnerable versions of Kaspersky Anti-Virus. User interaction is required to exploit this vulnerability: the user must visit a webpage which takes advantage of this vulnerability. The specific flaw exists within the ActiveX controls in AxKLProd60.dll and AxKLSysInfo.dll

During installation of Maintenance Pack 2, the DLLs will be removed from the system.

Kaspersky Anti Virus SysInfo ActiveX Control Information Disclosure Vulnerability²

The remote exploitation of the information disclosure vulnerability in Kaspersky Anti-Virus 6.0 could allow malicious websites to steal files from end user machine running Kaspersky Anti-Virus.

The SysInfo ActiveX control includes a method called StartUploading which allows malicious web scripts to perform an anonymous FTP transfer of any file the scripts identify on the victim's machine. No dialogs, warnings or user action is required to perform the transfer.

During installation of Maintenance Pack 2, this DLL will be removed from system.

Kaspersky AV Library Remote Heap Overflow¹

This vulnerability affected systems which are running the Kaspersky Anti-Virus Engine. User interaction is not required to exploit this vulnerability.

klif.sys Heap Overflow Vulnerability²

KLIF Local Privilege Escalation Vulnerability

All these vulnerabilities have been fixed in the build 6.0.2. 614.

¹ Kaspersky would like to thank an anonymous researcher working with TippingPoint (www.tippingpoint.com) and the Zero Day Initiative (www.zerodayinitiative.com) for reporting this issue.

²Kaspersky would like to thank iDefence (http://labs.idefense.com) for reporting this issue.

Download Here

• Kaspersky Internet Security 6.0
• Kaspersky Anti-Virus 6.0