Upcoming Infocon Test and new Color
Testing finished. Please let us know if you saw any issues. Please note that the various infocon indicators can take about 15 minutes to update.
This Friday, we will change the infocon to test a new admin interface. The test will last from 10:00-11:00 EDT (14:00-15:00 UTC). We will cycle through all colors. The pager notifications will be disabled during the test.
In the future, we are planning more regular infocon tests. Probably once a month, but the schedule has yet to be determined. In order ot conduct the tests, we will use a new color "Blue". Blue is used only for tests. Pager alerts will not be disabled for these tests to allow you to test them as well.
For details about the infocon, see http://isc.sans.org/infocon.html .
------
Johannes B. Ullrich, Ph.D.
SANS Technology Institute
August 2008 Black Tuesday Overview
Overview of the August 2008 Microsoft patches and their status.
| # | Affected | Contra Indications | Known Exploits | Microsoft rating | ISC rating(*) | |
|---|---|---|---|---|---|---|
| clients | servers | |||||
| MS08-041 | Vulnerability in the ActiveX Control for the Snapshot Viewer for Microsoft Access Could Allow Remote Code Execution | |||||
| Access, Snapshot Viewer CVE-2008-2463 |
Known expoit code being actively exploited. |
Critical | Critical | Important | ||
| MS08-042 | Vulnerability in Microsoft Word Could Allow Remote Code Execution | |||||
| Word CVE-2008-2244 |
KB 955048 |
Important | Critical | Important | ||
| MS08-043 |
Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution |
|||||
|
Excel |
KB 954066 | No publicly known exploits | Critical | Critical | Important | |
| MS08-044 |
Vulnerabilities in Microsoft Office Filters Could Allow Remote Code Execution |
|||||
|
Office 2000, XP 2003, Works 8, Project |
KB 924090 |
No publicly known exploits | Critical | Critical | Important | |
| MS08-045 |
Cumulative Security Update for Internet Explorer |
|||||
|
Internet Explorer |
KB 953838 |
Publically disclosed vulnerability but no known exploits. | Critical | PATCH NOW! | PATCH NOW! | |
| MS08-046 |
Vulnerability in Microsoft Windows Image Color Management System Could Allow Remote Code Execution |
|||||
|
Windows 2000, XP, 2003 |
KB 952954 |
No publicly known exploits | Critical | Critical | Important | |
| MS08-047 |
Vulnerability in IPsec Policy Processing Could Allow Information Disclosure |
|||||
|
Vista, 2008 |
KB 95373 |
No publicly known exploits | Important | Important | Important | |
| MS08-048 |
Security Update for Outlook Express and Windows Mail |
|||||
|
Windows (OE, Mail) |
KB 951066 |
No publicly known exploits | Important | Important | Important | |
| MS08-049 |
Vulnerability in Event System Could Allow Remote Code Execution |
|||||
|
Windows |
KB 950974 |
No publicly known exploits | Important | Important | Important | |
| MS08-050 |
Vulnerability in Windows Messenger Could Allow Information Disclosure |
|||||
|
Windows Messenger |
KB 955702 |
Publically disclosed vulnerability but no known exploits. | Important | Important | Important | |
| MS08-051 |
Vulnerabilities in Microsoft PowerPoint Could Allow Remote Code Execution |
|||||
|
PowerPoint |
KB 949785 |
No publicly known exploits | Critical | Critical | Important | |
We appreciate updates
US based customers can call Microsoft for free patch related support on 1-866-PCSAFETY
(*): ISC rating
- We use 4 levels:
- PATCH NOW: Typically used where we see immediate danger of exploitation. Typical environments will want to deploy these patches ASAP. Workarounds are typically not accepted by users or are not possible. This rating is often used when typical deployments make it vulnerable and exploits are being used or easy to obtain or make.
- Critical: Anything that needs little to become "interesting" for the dark side. Best approach is to test and deploy ASAP. Workarounds can give more time to test.
- Important: Things where more testing and other measures can help.
- Less Urgent: Typically we expect the impact if left unpatched to be not that big a deal in the short term. Do not forget them however.
- The difference between the client and server rating is based on how you use the affected machine. We take into account the typical client and server deployment in the usage of the machine and the common measures people typically have in place already. Measures we presume are simple best practices for servers such as not using outlook, MSIE, word etc. to do traditional office or leisure work.
- The rating is not a risk analysis as such. It is a rating of importance of the vulnerability and the perceived or even predicted threat for affected systems. The rating does not account for the number of affected systems there are. It is for an affected system in a typical worst-case role.
- Only the organization itself is in a position to do a full risk analysis involving the presence (or lack of) affected systems, the actually implemented measures, the impact on their operation and the value of the assets involved.
- All patches released by a vendor are important enough to have a close look if you use the affected systems. There is little incentive for vendors to publicize patches that do not have some form of risk to them.
Defcon 16 reflections
As promised I thought I would send up a post about Defcon, since it's fresh on alot of our minds.
Despite what people think, this is still a good con. Still breakthrough talks happening, still "zero" days coming out. Thousands of Thousands of people there.
The Goons did a great job keeping everything flowing and organized. (Although, could have ordered more badges on day 1?) Even though the hotel posted guards around the ATMs, the Nevada Gaming Commission and some Cops were investigating a Horse Race Betting Machine (could have been totally legit, I didn't ask, I don't want to know. It was just funny and coincidental), and various other interesting tidbits.
There were alot of interesting talks, obviously I couldn't attend them all, but from the ones that I heard were very interesting (BTW -- I am going to link to the presentations that I can, Click through AT YOUR OWN RISK :
Kaminsky -- Although I heard that there was basically nothing new posted, (I wasn't there, I was on a plane), it was interesting to hear him present about the vuln.
BGP Hack -- I did hear that this WAS the most interesting talk. From what I heard/read, the guys that were presenting were able to successfully demonstrate how they changed the BGP routing at Defcon and sent everything through a box in New York, only to come back to Vegas. Apparently they did this live. Nice.
Snort plugin development -- Of personal interest to me, I sat in on this talk about Snort dynamic-preprocessor and rule development.
The Medical Identity Theft talk at DC16 had an unannounced software release... They wrote a tool to strip the headers off of LWAPP packets and output a regular pcap file showing the regular wireless client traffic.
Fyodor's Talk on Nmap -- Funny, excellent, interesting!
As always, the Capture the Flag contests were great and interesting. Spot the fed was funny (as always), as were several of the other contests:
Sit through 30 hours of vendor presentations without sleeping to split US10k.
Automate a pellet/paintball gun to shoot targets.
Guitar Hero 3 (Holy cow, the guys that play this on Expert are CRAZY fast!)
The Freakshow party (as most the parties I went to were) on Saturday was awesome. Props go to Sunshine and whomever was on her side for planning that one! Great conference everyone.
UPDATE: Added URL from The Medical Identify Theft talk, corrected post about the same -- Corrected Fyodor's URL.
-- Joel Esler http://www.joelesler.net
VMWare ESX 3.5u2 Errors
VMWare has an important announcement if you are using VMWare ESX 3.5u2: This particular version will "expire" today (August 12th). If you restart the server, or move a virtual machine, you will get an error and you will not be able to start up the machine or use VMotion.
In short: If you use this exact version of VMWare ESX: Don't touch it until you hear from VMware about a solution. As a work around, you can change the system time to a date before Aug. 12th and turn off NTP.
Links:
communities.vmware.com/thread/162377
www.vdi.co.nz/
(thanks to a number of readers who alerted us about this! And thanks to all the Australian VMware users who of course ran into this first)
------
Johannes B. Ullrich, Ph.D.
SANS Technology Institute
Gmail Outage?
Getting reports here at the Storm Center of an outage for Gmail. I can't replicate it, it works fine from me from two Internet access points. Is it still down on the interwebz for you guys?
Update: I have received a few emails indicating that it works, and I've received a couple indicating that its down. So perhaps it's regional? Or account based?
Update 2: Apparently Google had a whoopsie. Look at the top right of this page for further info. Issue closed. Thanks all!
-- Joel Esler http://www.joelesler.net
SBC Outage in Cleveland?
SBC Outage in Cleveland? Perhaps?
We've only had one report today of any problems, however, we don't know if SBC has changed their routes to avoid InternetHealth, or what the deal is, but it looks like something is up.
-- Joel Esler http://www.joelesler.net
Comments