Threat Level: green Handler on Duty: Chris Mohan

SANS ISC InfoSec Handlers Diary Blog


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

August 2010 Microsoft Black Tuesday Summary

Published: 2010-08-10
Last Updated: 2010-08-16 15:15:31 UTC
by Jim Clausing (Version: 5)
17 comment(s)

 Overview of the Aug 2010 Microsoft Patches and their status.

Update:  Microsoft also released an advisory for an unpatched privilege escalation vulnerability

Update 2: Exploit code apparently exists for MS10-048, but it is not being seen in the wild at present.

# Affected Contra Indications Known Exploits Microsoft rating ISC rating(*)
clients servers
MS10-047 Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (Replaces MS10-021 )
Windows Kernel
CVE-2010-1888
CVE-2010-1889
CVE-2010-1890
KB 981852 no known exploits. Severity:Important
Exploitability: 1,2,?
Important Important
MS10-048 Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (Replaces MS10-032 )
Windows Kernel
CVE-2010-1887
CVE-2010-1894
CVE-2010-1895
CVE-2010-1896
CVE-2010-1897
KB 2160329 PoC code apparently exists Severity:Important
Exploitability: ?,1,1,1,1
Important Impoortant
MS10-049 Vulnerabilities in SChannel could allow Remote Code Execution
IIS and SChannel
CVE-2009-3555
CVE-2010-2566
KB 980436 no known exploits. Severity:Critical
Exploitability: 3,2
Important Critical
MS10-050 Vulnerability in Windows Movie Maker Could Allow Remote Code Execution (Replaces MS10-016 )
Windows Movie Maker
CVE-2010-2564
KB 981997 no known exploits. Severity:Important
Exploitability: 1
Critical Important
MS10-051 Vulnerability in Microsoft XML Core Services Could Allow Remote Code Execution (Replaces MS08-069 )
Microsoft XML core services
CVE-2010-2561
KB 2079403 no known exploits. Severity:Critical
Exploitability: 2
Critical Critical
MS10-052 Vulnerability in Microsoft MPEG Layer-3 Codecs Could Allow Remote Code Execution
Microsoft MPEG Layer-3 Codecs
CVE-2010-1882
KB 2115168 no known exploits. Severity:Critical
Exploitability: 1
Critical Important
MS10-053 Cumulative Security Update for Internet Explorer (Replaces MS10-035 )
Internet Explorer
CVE-2010-1258
CVE-2010-2556
CVE-2010-2557
CVE-2010-2558
CVE-2010-2559
CVE-2010-2560
KB 2183461 no known exploits. Severity:Critical
Exploitability: 3,2,1,2,2,1
Critical Important
MS10-054 Vulnerabilities in SMB Server Could Allow Remote Code Execution
SMB server
CVE-2010-2550
CVE-2010-2551
CVE-2010-2552
KB 982214 no known exploits. Severity:Critical
Exploitability: 2,3,3
Critical Critical
MS10-055 Vulnerability in Cinepak Codec Could Allow Remote Code Execution
Cinepak codec
CVE-2010-2553
KB 982665 no known exploits. Severity:Critical
Exploitability: 1
Critical Important
MS10-056 Vulnerabilities in Microsoft Office Word Could Allow Remote Code Execution (Replaces MS09-068 M009-027 MS10-036 )
Word
CVE-2010-1900
CVE-2010-1901
CVE-2010-1902
CVE-2010-1903
KB 2269638 no known exploits. Severity:Critical
Exploitability: 1,1,2,2
Critical Important
MS10-057 Vulnerability in Microsoft Office Excel Could Allow Remote Code Execution (Replaces MS10-036 MS10-038 )
Excel
CVE-2010-2562
KB 2269707 no known exploits. Severity:Important
Exploitability: 1
Critical Important
MS10-058 Vulnerabilities in TCP/IP Could Allow Elevation of Privilege
Windows Networking (TCP/IP)
CVE-2010-1892
CVE-2010-1893
KB 978886 no known exploits. Severity:Important
Exploitability: 3,1
Important Important
MS10-059 Vulnerabilities in the Tracing Feature for Services Could Allow Elevation of Privilege
Tracing Facility for Services
CVE-2010-2554
CVE-2010-2555
KB 982799 no known exploits. Severity:Important
Exploitability: ?,1
Important Important
MS10-060 Vulnerabilities in the Microsoft .NET Common Language Runtime and in Microsoft Silverlight Could Allow Remote Code Execution (Replaces MS09-061 )
.NET and Silverlight
CVE-2010-0019
CVE-2010-1898
KB 2265906 no known exploits. Severity:Critical
Exploitability: 1,1
Critical Critical

 

We will update issues on this page for about a week or so as they evolve.
We appreciate updates
US based customers can call Microsoft for free patch related support on 1-866-PCSAFETY
(*): ISC rating
  • We use 4 levels:
    • PATCH NOW: Typically used where we see immediate danger of exploitation. Typical environments will want to deploy these patches ASAP. Workarounds are typically not accepted by users or are not possible. This rating is often used when typical deployments make it vulnerable and exploits are being used or easy to obtain or make.
    • Critical: Anything that needs little to become "interesting" for the dark side. Best approach is to test and deploy ASAP. Workarounds can give more time to test.
    • Important: Things where more testing and other measures can help.
    • Less Urgent: Typically we expect the impact if left unpatched to be not that big a deal in the short term. Do not forget them however.
  • The difference between the client and server rating is based on how you use the affected machine. We take into account the typical client and server deployment in the usage of the machine and the common measures people typically have in place already. Measures we presume are simple best practices for servers such as not using outlook, MSIE, word etc. to do traditional office or leisure work.
  • The rating is not a risk analysis as such. It is a rating of importance of the vulnerability and the perceived or even predicted threat for affected systems. The rating does not account for the number of affected systems there are. It is for an affected system in a typical worst-case role.
  • Only the organization itself is in a position to do a full risk analysis involving the presence (or lack of) affected systems, the actually implemented measures, the impact on their operation and the value of the assets involved.
  • All patches released by a vendor are important enough to have a close look if you use the affected systems. There is little incentive for vendors to publicize patches that do not have some form of risk to them

 

---------------
Jim Clausing, jclausing --at-- isc [dot] sans (dot) org
FOR408 coming to central OH in Sep, see http://www.sans.org/mentor/details.php?nid=22353

17 comment(s)

SSH - new brute force tool?

Published: 2010-08-12
Last Updated: 2010-08-13 16:51:28 UTC
by Daniel Wesemann (Version: 5)
6 comment(s)

We have received some reports about a new SSH brute force script, possibly named dd_ssh, that gets dropped onto web servers, most likely via an older phpmyadmin vulnerability.  If you have sample log entries from a successful attack or can share a copy of dd_ssh, please let us know.  The current DShield figures do show a recent uptick in the number of sources that participate in SSH scanning.

Update 1735UTC: We have received several samples of dd_ssh, with MD5 24dac6bab595cd9c3718ea16a3804009.  If your MD5 differs, please still send us a copy.  It also looks like the vulnerability exploited is indeed in phpmyadmin, but seems to be the rather old CVE-2009-1151. Again, if your information differs, please let us know.  Thanks to all the ISC readers who responded so far!

Update 2005UTC: Several readers have identified 91-193-157-206 as the most likely original source of the scanning for phpmyadmin's setup.php. If successful, two files named "vmsplice.txt" and "dd.txt" were downloaded from that same IP. How exactly dd_ssh was installed is not yet clear, but most readers found it in /tmp after a POST request to phpmyadmin/scripts/setup.php. A running dd_ssh was seen to talk to a bunch of IPs over port 54509 and 54510, this is most likely the C&C connection.

Update 2020UTC: We got it reasonably established that the vulnerability exploited to drop the SSH scanner was indeed CVE-2009-1151. C'mon, folks, if you insist to have your phpmyadmin reachable from the Internet (why would you?? Access control isn't hard!) then please at least upgrade to the most current version, which at this time is 2.11.10 or 3.3.5.

Update Aug12 0920UTC:  In some cases, a dd_ssh was accompanied by a file named vm.c, which seems to cointain the "vmsplice" local root exploit (CVE2008-0600).  We also have a couple of cases where setup.php was replaced by a new file named setup1.php, which contains a very basic remote command shell. 

6 comment(s)
New Apple security updates for iPad/Pod/Phone. See http://support.apple.com/kb/ht1222

Protect your privates!

Published: 2010-08-10
Last Updated: 2010-08-11 00:42:23 UTC
by Daniel Wesemann (Version: 1)
5 comment(s)

In view of all the brute force attacks still being attempted against Secure Shell (SSH), we have long since been extolling the virtues of forgoing passwords and moving to RSA/DSA keys instead.

While key based login indeed nicely addresses the problem of password guessing attacks, it looks like many a Unix admin has been less than diligent in the implementation. In pretty much every Unix security audit recently, we've come across unprotected or badly protected SSH private keys (id_dsa, id_rsa). Some reside plain flat out in the open, in /tmp and such. Others are found in world-readable tar "backup" archives of user and administrator home directories. Some are even built into home-grown Linux RPM and Solaris PKG packages, ready to be plucked off an install server.

It probably goes without saying, but let's repeat it nonetheless:

  • Whoever can access a TAR/ZIP/GZ archive, can read all its contents. Be super careful when you create a "temporary" archive copy of everything residing in a home directory. This copy is bound to include the ".ssh" directory, and the private keys therein
  • Whoever can access a RPM or PKG package, can read all its contents. Yes it is "convenient" to have the SSH keys that are part of your home-grown admin script suite already within the install package. But then don't be surprised if others make use of this convenience, too.

In a Unix penetration test within a company or academic institution network, we often first go looking for files and directories that can be read without authentication. Most large organizations have an "install server" from where they stage their new Unix systems, and often we find these install servers to openly share the package filesystem over NFS for"everyone". Other good choices are home directories, all too often also exported via NFS to "everyone". Once read access is established, we can go hunting:

$find /mnt/some_exported_fs \( -name "id_dsa" -o -name "id_rsa" \) -exec ls -ald \{\} \;
$find /mnt/some_exported_fs -type d -name ".ssh" -exec ls -al \{\} \;
$find /mnt/some_exported_fs -type f -name "*.tar" -print -exec tar tvf \{\} \; | egrep "(^/|id_dsa|id_rsa|.ssh)"

...etc. Adapt as needed for your environment.

To better protect your privates, please consider to

  1. add a passphrase for all private keys that are used interactively. "ssh-keygen -p" can be used to add a passphrase to an existing private key
  2. use a forced command for all private keys that are used in system automation, to limit the abuse potential. Use "command=/bin/foo/bar" in an authorized_keys file to limit what the corresponding private key can do


Keys without passphrase look differently from those that have one. If you want to make sure that your users also protect their privates, you can (as root) search for keys without passphrase with the following command

#find / \( -name "id_dsa" -o -name "id_rsa" \) -exec egrep -L "Proc-Type" \{\} \; 2>/dev/null

Newer DSA/RSA Keys contain the string "Proc-Type" as part of the key file when a password is set on the key. The above command lists all those key files where this isn't the case ("egrep -L")

If you got additional tips on how to protect SSH private keys on Unix, or how to best locate misplaced / unprotected private keys, please let us know.

 

Keywords: ssh
5 comment(s)

Adobe critical security updates

Published: 2010-08-10
Last Updated: 2010-08-10 23:40:25 UTC
by Jason Lam (Version: 2)
6 comment(s)

This is a busy day for the folks doing patching out there. Aside from the MS patches released today, Adobe also released a bunch of security updates.

Here are the links to the each of the security updates,

Flash Media Server - Rating : Critical (rated by Adobe)

Adobe AIR and Flash - Rating : Critical (rated by Adobe)

ColdFusion - Rating : Important (rated by Adobe)

With the current exploitation trend, the Flash vulnerability should be a high priority for patching. Happy patching.

 

--------------------
Jason Lam

6 comment(s)
Diary Archives