Threat Level: green Handler on Duty: Chris Mohan

SANS ISC InfoSec Handlers Diary Blog


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

March Black Tuesday Overview

Published: 2008-03-11
Last Updated: 2008-03-14 19:56:54 UTC
by Swa Frantzen (Version: 2)
0 comment(s)

Overview of the March 2008 Microsoft patches and their status.

# Affected Contra Indications Known Exploits Microsoft rating ISC rating(*)
clients servers
MS08-014 Multiple vulnerabilities allow code execution when opening a malicious file.
Replaces MS07-044, MS07-036 and MS08-013.

Excel

CVE-2008-0081
CVE-2008-0112
CVE-2008-0114
CVE-2008-0115
CVE-2008-0116
CVE-2008-0117

KB 949029

KB 950340

At least one vulnerability was abused in targeted attacks.

MSRC blog
Past diary
Critical PATCH NOW Important
MS08-015 Vulnerability in parsing of "mailto:" URIs allows Remote Code Execution.
Replaces MS07-003.
Outlook

CVE-2008-0110
KB 949031
No publicly known exploits Critical Critical Important
MS08-016 Multiple vulnerabilities allow for code execution upon opening a malicious document.
Replaces MS07-015, MS07-025 and MS08-013.
Office

CVE-2008-0113
CVE-2008-0118
KB 949030 No publicly known exploits Critical Critical Important
MS08-017 Multiple vulnerabilities allow Remote Code Execution. Affects clients through the web vector and for as of yet, unexplained reasons also certain versions of BizTalk, Commerce and ISA servers.
Office web components

CVE-2006-4695
CVE-2007-1201
KB 933103
No publicly known exploits Critical Critical Critical(**)

 

We will update issues on this page as they evolve.
We appreciate updates
US based customers can call Microsoft for free patch related support on 1-866-PCSAFETY
(*): ISC rating
  • We use 4 levels:
    • PATCH NOW: Typically used where we see immediate danger of exploitation. Typical environments will want to deploy these patches ASAP. Workarounds are typically not accepted by users or are not possible. This rating is often used when typical deployments make it vulnerable and exploits are being used or easy to obtain or make.
    • Critical: Anything that needs little to become "interesting" for the dark side. Best approach is to test and deploy ASAP. Workarounds can give more time to test.
    • Important: Things where more testing and other measures can help.
    • Less Urgent: Typically we expect the impact if left unpatched to be not that big a deal in the short term. Do not forget them however.
  • The difference between the client and server rating is based on how you use the affected machine. We take into account the typical client and server deployment in the usage of the machine and the common measures people typically have in place already. Measures we presume are simple best practices for servers such as not using outlook, MSIE, word etc. to do traditional office or leisure work.
  • The rating is not a risk analysis as such. It is a rating of importance of the vulnerability and the perceived or even predicted threat for affected systems. The rating does not account for the number of affected systems there are. It is for an affected system in a typical worst-case role.
  • Only the organization itself is in a position to do a full risk analysis involving the presence (or lack of) affected systems, the actually implemented measures, the impact on their operation and the value of the assets involved.
  • All patches released by a vendor are important enough to have a close look if you use the affected systems. There is little incentive for vendors to publicize patches that do not have some form of risk to them.

(**): Default classification due to lack of information at this point in time

--
Swa Frantzen -- Gorilla Security

Keywords:
0 comment(s)

MSIE 5 and 6 FTP vulnerability

Published: 2008-03-11
Last Updated: 2008-03-12 12:46:31 UTC
by Swa Frantzen (Version: 1)
3 comment(s)

The many out there still using older versions of MSIE (such as Internet Explorer 5 or 6), might well be interested in two new vulnerabilities discovered and made public today on full disclosure.

It looks somewhat like a Cross Site Request Forgery (CSRF) attack: A malicious URL you (somehow) hit. It can be unintentional on the user's part through e.g. an injected iframe on a forum.  The URL tells the client to contact another server and does some bad things there that the user never intended, but had the authorization to do. The twist in this case is that the second hit doing damage can also be a FTP request, not just a HTTP request.

Still normally you can only log in and download (GET) files using a URL, and if the FTP server is requiring authentication, the user or the URL should enter the login/password, tipping them off something strange is going on or the attacker already knowing the credential.

That's true, till you see the duo of bugs in IE:

  • Apparently IE5 and IE6 allow other commands too, such as deleting files by constructing a URL with %-encoded line-breaks.
  • Similarly IE 5 and IE6 allow the URL to be constructed in such a manner as to try to re-authenticate with cached credentials.

IE7 is claimed not to suffer from this, so if you need a bit more incentive to (be allowed to) upgrade, this might just be it.

--
Swa Frantzen -- Gorilla Security

Keywords:
3 comment(s)

Firewire in the limelight

Published: 2008-03-11
Last Updated: 2008-03-11 14:37:34 UTC
by Swa Frantzen (Version: 2)
0 comment(s)

Let's start with a warning: there's little news in here as it was made public by Adam Boileau at RUXCON 2006 (presentation), but went by relatively unnoticed by the big public at that time. Still in the aftermath of the "coldboot" paper the Firewire attack vector gained some more attention.

The short story: Just like (cold) DRAM doesn't behave like most of us thought, neither is Firewire that similar in features to USB. Firewire allows much more than USB. E.g. Firewire connected peripheral devices can read and write RAM on the host directly (using DMA, so the CPU doesn't come into play at all). So a Firewire device connected to e.g. a screen-locked machine could gain access to the machine or it's secrets like encryption keys.

The attack vector is physical access to a bus on a computer just like your PCI bus. Introduce a malicious device into a system and the entire system is untrustworthy. This however can also be used in forensic cases, and as such there is possibility for good use too.

How to defend against this attack vector becomes very complex as those which physical access could simply add a Firewire adapter to a PCCARD bus and wait for the OS to install the drivers and activate the card. Also noticing the attack isn't trivial as e.g. a (somewhat modified) iPod can be used to perform the attack.

Firewire is also known as IEEE-1394 or "iLink" (Sony).

UPDATE: Thorsten wrote in to reference the even earlier work by Max Dornseif, who published about this attack back in 2004 at PacSec and 2005 at CanSec.

--
Swa Frantzen -- Gorilla Security

Keywords:
0 comment(s)

Real player exploit made public

Published: 2008-03-11
Last Updated: 2008-03-11 12:23:41 UTC
by Swa Frantzen (Version: 1)
0 comment(s)

Real player is probably installed on many of your computers, and an exploit for an unpatched vulnerability was made public on the full-disclosure mailing list.

As a result, those using ActiveX capable browsers (read: MSIE) are vulnerable to attack, with no patch on the horizon yet.

Workarounds:

  • Set killbits for:
    rmoc3260.dll version 6.0.10.45
    {2F542A2E-EDC9-4BF7-8CB1-87C9919F7F93}
    {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA}

    But this will also remove the genuine functionality of the player.
  • Use a browser that doesn't support ActiveX (there's plenty of those).

--
Swa Frantzen -- Gorilla Security

Keywords:
0 comment(s)
Diary Archives