SecurityFocus Microsoft Newsletter #261
----------------------------------------
Need to know what's happening on YOUR network? Symantec DeepSight Analyzer
is a free service that gives you the ability to track and manage attacks.
Analyzer automatically correlates attacks from various Firewall and network
based Intrusion Detection Systems, giving you a comprehensive view of your
computer or general network. Sign up today!
http://www.securityfocus.com/sponsor/Symantec_sf-news_041130
------------------------------------------------------------------
I. FRONT AND CENTER
1. Two-factor banking
2. ICANN on center stage
II. MICROSOFT VULNERABILITY SUMMARY
1. Multiple Vendor Antivirus Products Malformed Archives Scan Evasion
Vulnerability
2. PHPMyAdmin Local File Include Vulnerability
3. Kaspersky Anti-Virus Engine CHM File Parser Remote Buffer Overflow
Vulnerability
4. Microsoft Windows MSDTC Memory Corruption Vulnerability
5. Microsoft MSDTC COM+ Remote Code Execution Vulnerability
6. Microsoft MSDTC TIP Denial Of Service Vulnerability
7. Microsoft MSDTC TIP Distributed Denial Of Service Vulnerability
8. Microsoft Internet Explorer COM Object Instantiation Variant
Vulnerability
9. RARLAB WinRAR Multiple Remote Vulnerabilities
10. Microsoft DirectX DirectShow AVI Processing Buffer Overflow
Vulnerability
11. Microsoft Windows Explorer Web View Script Injection Vulnerability
12. Microsoft Windows Plug And Play UMPNPMGR.DLL wsprintfW Buffer
Overflow Vulnerability
13. Microsoft Windows Client Service For Netware Buffer Overflow
Vulnerability
14. Microsoft Collaboration Data Objects Remote Buffer Overflow
Vulnerability
15. Microsoft Windows Malicious Shortcut Handling Remote Code Execution
Vulnerability
16. Microsoft Windows Malicious Shortcut Handling Remote Code Execution
Variant Vulnerability
17. Novell NetMail NMAP Agent Remote Buffer Overflow Vulnerability
18. PHPWebSite Search Module SQL Injection Vulnerability
19. Kerio Personal Firewall and ServerFirewall Local Denial of Service
Vulnerability
20. AbiWord Stack-Based Buffer Overflow Vulnerabilities
21. Accelerated Mortgage Manager Password Field SQL Injection
Vulnerability
22. XMail Local Buffer Overflow Vulnerability
23. TYPSoft FTP Server RETR Denial Of Service Vulnerability
24. RARLAB WinRAR Command Line Processing Buffer Overflow Vulnerability
25. Opera Web Browser Multiple Malformed HTML Parsing Denial Of Service
Vulnerabilities
26. IBM DB2 Universal Database Multiple Vulnerabilities
27. Microsoft Windows Unspecified Remote Code Execution Vulnerability
28. Snort Back Orifice Preprocessor Remote Stack Buffer Overflow
Vulnerability
III. MICROSOFT FOCUS LIST SUMMARY
1. Auditing Options
2. SecurityFocus Microsoft Newsletter #260
IV. UNSUBSCRIBE INSTRUCTIONS
V. SPONSOR INFORMATION
I. FRONT AND CENTER
---------------------
1. Two-factor banking
By Kelly Martin
People who lived through the Second World War, like my grandparents, had a very
different view of money than those of us who grew up in the Information Age.
http://www.securityfocus.com/columnists/363
2. ICANN on center stage
By Scott Granneman
ICANN and the U.S. government reach center stage next month in Tunisia, as the
future of IP address assignments and U.S. control of the root DNS turns into a
hotbed of debate.
http://www.securityfocus.com/columnists/362
II. MICROSOFT VULNERABILITY SUMMARY
------------------------------------
1. Multiple Vendor Antivirus Products Malformed Archives Scan Evasion
Vulnerability
BugTraq ID: 15046
Remote: Yes
Date Published: 2005-10-08
Relevant URL: http://www.securityfocus.com/bid/15046
Summary:
Multiple antivirus products from various vendors are reported prone to a
vulnerability that may allow malformed archive files to bypass detection.
This issue arises when an affected application processes a specially altered
archive file that contains a fake, misleading MS-DOS executable MZ header.
This issue could result in malicious archives bypassing detection and allowing
the contents to be opened by a recipient.
It should be noted that specific information regarding affected packages and
versions is currently unavailable. The reporter of this issue used the EICAR
test message stored in multiple different malformed archives. It may be
possible that some of the reportedly affected packages may actually be immune
to this issue.
This BID will be updated as further information is disclosed.
2. PHPMyAdmin Local File Include Vulnerability
BugTraq ID: 15053
Remote: Yes
Date Published: 2005-10-10
Relevant URL: http://www.securityfocus.com/bid/15053
Summary:
phpMyAdmin is prone to a local file include vulnerability.
An attacker may leverage this issue to execute arbitrary server-side script
code that resides on an affected computer with the privileges of the Web server
process. This may potentially facilitate unauthorized access.
phpMyAdmin 2.6.4-pl1 is reported to be vulnerable. Other versions may be
affected as well.
3. Kaspersky Anti-Virus Engine CHM File Parser Remote Buffer Overflow
Vulnerability
BugTraq ID: 15054
Remote: Yes
Date Published: 2005-10-10
Relevant URL: http://www.securityfocus.com/bid/15054
Summary:
Kaspersky Anti-Virus Engine is prone to a remote buffer overflow vulnerability.
This issue presents itself when an attacker sends a maliciously crafted CHM
file to an affected computer and this file is processed by Kaspersky's CHM file
parser.
This vulnerability allows attackers to execute arbitrary machine code in the
context of the affected application. Attackers may gain privileged remote
access to computers running the affected application.
4. Microsoft Windows MSDTC Memory Corruption Vulnerability
BugTraq ID: 15056
Remote: Yes
Date Published: 2005-10-11
Relevant URL: http://www.securityfocus.com/bid/15056
Summary:
The Microsoft Windows MSDTC (Microsoft Distribution Transaction Coordinator)
service is prone to a memory corruption vulnerability. This issue could allow
for execution of arbitrary code in the context of the service. The
vulnerability may be remotely exploitable in some circumstances, but will also
permit local privilege escalation.
This issue is remotely exploitable on Windows 2000 platforms, since the Network
DTC is enabled by default on this platform. On Windows XP, this issue may be
remotely exploitable if a local user has started the service. On Windows
Server 2003, this vulnerability is limited to local privilege escalation unless
Network DTC has been explicitly enabled by an administrator. This issue is not
present on Windows XP SP2 and Windows Server 2003 SP1.
Update: Microsoft reports several systems have experienced one or more problems
after installing the critical update from Microsoft Security Bulletin MS05-051
for this issue. For a more detailed explanation of these problems please see
the attached microsoft knowledge base article 909444.
5. Microsoft MSDTC COM+ Remote Code Execution Vulnerability
BugTraq ID: 15057
Remote: Yes
Date Published: 2005-10-11
Relevant URL: http://www.securityfocus.com/bid/15057
Summary:
Microsoft Windows is prone to a vulnerability in the COM+ (Component Object
Model) functionality of the MSDTC (Microsoft Distribution Transaction
Coordinator) service. This issue may permit remote and local attackers to
execute arbitrary code in the context of the service.
This issue may be exploited by remote anonymous attackers on Windows 2000
platforms. On Windows XP versions up to and including SP1, the attacker must
authenticate as the Guest or another account prior to exploitation. On Windows
XP SP2 and all Windows Server 2003 operating systems, this issue is limited to
local privilege escalation.
Update: Microsoft reports several systems have experienced one or more problems
after installing the critical update from Microsoft Security Bulletin MS05-051
for this issue. For a more detailed explanation of these problems please see
the attached microsoft knowledge base article 909444.
6. Microsoft MSDTC TIP Denial Of Service Vulnerability
BugTraq ID: 15058
Remote: Yes
Date Published: 2005-10-11
Relevant URL: http://www.securityfocus.com/bid/15058
Summary:
The Microsoft Windows MSDTC (Microsoft Distribution Transaction Coordinator)
service is prone to a denial of service vulnerability.
The vulnerability exists in the TIP (Transaction Internet Protocol)
functionality that is provided by MSDTC. This vulnerability may be exploited
by a remote attacker to deny the availability of services that depend on MSDTC.
This issue only exists on operating systems that have support for the TIP
protocol enabled. This vulnerability is remotely exploitable on default
configurations on Windows 2000. TIP is not enabled by default on Windows XP
and Windows Server 2003 even if the MSDTC service is running.
Update: Microsoft reports several systems have experienced one or more problems
after installing the critical update from Microsoft Security Bulletin MS05-051
for this issue. For a more detailed explanation of these problems please see
the attached microsoft knowledge base article 909444.
7. Microsoft MSDTC TIP Distributed Denial Of Service Vulnerability
BugTraq ID: 15059
Remote: Yes
Date Published: 2005-10-11
Relevant URL: http://www.securityfocus.com/bid/15059
Summary:
The Microsoft MSDTC (Microsoft Distribution Transaction Coordinator) service is
prone to a vulnerability that may permit denial of service attacks against the
service or facilitate distributed denial of service attacks against other
computers.
The vulnerability exists in the TIP (Transaction Internet Protocol)
functionality that is provided by MSDTC.
This issue only exists on operating systems that have support for the TIP
protocol enabled. This vulnerability is remotely exploitable on default
configurations on Windows 2000. TIP is not enabled by default on Windows XP
and Windows Server 2003 even if the MSDTC service is running.
Update: Microsoft reports several systems have experienced one or more problems
after installing the critical update from Microsoft Security Bulletin MS05-051
for this issue. For a more detailed explanation of these problems please see
the attached microsoft knowledge base article 909444.
8. Microsoft Internet Explorer COM Object Instantiation Variant Vulnerability
BugTraq ID: 15061
Remote: Yes
Date Published: 2005-10-11
Relevant URL: http://www.securityfocus.com/bid/15061
Summary:
Microsoft Internet Explorer is prone to a buffer overflow vulnerability that is
related to instantiation of COM objects.
Successful exploitation could let remote attackers execute arbitrary code in
the context of the currently logged in user on the affected computer.
This is a variant of the vulnerability described in BID 14511 Microsoft
Internet Explorer COM Object Instantiation Buffer Overflow Vulnerability. The
difference between this issue and BID 14511 is that a different set of COM
objects are affected that were not addressed in the previous BID.
9. RARLAB WinRAR Multiple Remote Vulnerabilities
BugTraq ID: 15062
Remote: Yes
Date Published: 2005-10-11
Relevant URL: http://www.securityfocus.com/bid/15062
Summary:
WinRAR is prone to multiple remote vulnerabilities. These issues include a
format string and a buffer overflow vulnerability. Successful exploitation may
allow an attacker to execute arbitrary code on a vulnerable computer.
WinRAR 3.50 and prior versions are vulnerable to these issues.
10. Microsoft DirectX DirectShow AVI Processing Buffer Overflow Vulnerability
BugTraq ID: 15063
Remote: Yes
Date Published: 2005-10-11
Relevant URL: http://www.securityfocus.com/bid/15063
Summary:
A buffer overflow vulnerability exists in the Microsoft Windows DirectX
component. This issue is related to processing of .AVI (Audio Visual
Interleave) media files. The specific vulnerability exists in DirectShow and
could be exposed through applications that employ DirectShow to process .AVI
files.
Successful exploitation will permit execution of arbitrary code in the context
of the user who opens a malicious .AVI file.
This issue could be exploited through any means that will allow the attacker to
deliver a malicious .AVI file to a victim user. In Web-based attack scenarios,
exploitation could occur automatically if the malicious Web page can cause the
.AVI file to be loaded automatically by Windows Media Player. Other attack
vectors such as email or instant messaging may require the victim user to
manually open the malicious .AVI.
It is not known if third-party applications rely on DirectShow to process .AVI
files. If so, these applications could also present an attack vector.
11. Microsoft Windows Explorer Web View Script Injection Vulnerability
BugTraq ID: 15064
Remote: Yes
Date Published: 2005-10-11
Relevant URL: http://www.securityfocus.com/bid/15064
Summary:
Microsoft Windows Explorer Web View is affected by an arbitrary script
injection vulnerability.
An attacker can exploit this issue by crafting a malicious file and placing it
on a Web site or sending it to a user through email followed by enticing them
to preview it in Windows Explorer.
A successful attack can result in a remote compromise in the context of the
vulnerable user.
12. Microsoft Windows Plug And Play UMPNPMGR.DLL wsprintfW Buffer Overflow
Vulnerability
BugTraq ID: 15065
Remote: Yes
Date Published: 2005-10-11
Relevant URL: http://www.securityfocus.com/bid/15065
Summary:
Microsoft Windows Plug and Play is prone to a buffer overflow vulnerability.
This issue is due to a failure of the service to properly bounds check
user-supplied data prior to copying it to an insufficiently sized memory
buffer.
This issue takes place when the PnP service handles malformed messages
containing excessive data.
This vulnerability facilitates local privilege escalation and unauthorized
remote access depending on the underlying operating system. A successful attack
may result in arbitrary code execution resulting in an attacker gaining SYSTEM
privileges.
This issue is unrelated to the one documented in BID 14513, "Microsoft Windows
Plug and Play Buffer Overflow Vulnerability", but they both have similar attack
scenarios and affects.
13. Microsoft Windows Client Service For Netware Buffer Overflow Vulnerability
BugTraq ID: 15066
Remote: Yes
Date Published: 2005-10-11
Relevant URL: http://www.securityfocus.com/bid/15066
Summary:
Microsoft Client Service for Netware is prone to a buffer overflow
vulnerability that could permit the execution of arbitrary remote code.
A remote attacker can exploit this vulnerability to execute arbitrary code and
completely compromise the computer. This issue could also be exploited by
local attackers to gain elevated privileges.
It should be noted that the Client Service for Netware is not installed by
default on any affected operating system. Microsoft Windows XP Home is not
affected by this vulnerability at all.
14. Microsoft Collaboration Data Objects Remote Buffer Overflow Vulnerability
BugTraq ID: 15067
Remote: Yes
Date Published: 2005-10-11
Relevant URL: http://www.securityfocus.com/bid/15067
Summary:
Microsoft CDO is susceptible to a remote buffer overflow vulnerability. This
issue is due to a failure of the library to properly bounds check user-supplied
data prior to copying it to an insufficiently sized memory buffer.
This issue presents itself when an attacker sends a specifically crafted email
message to an email server utilizing the affected library.
This issue allows remote attackers to execute arbitrary machine code in the
context of the application utilizing the library.
15. Microsoft Windows Malicious Shortcut Handling Remote Code Execution
Vulnerability
BugTraq ID: 15069
Remote: Yes
Date Published: 2005-10-11
Relevant URL: http://www.securityfocus.com/bid/15069
Summary:
Microsoft Windows is prone to a remote code execution vulnerability when
handling a malicious shortcut (.lnk) file.
An attacker can exploit this issue by crafting a malicious file and placing it
on a Web site or sending it to a user through email followed by enticing them
to open it and view the file's properties.
This issue also poses a local threat as a local unprivileged attacker could
exploit this issue without user interaction to gain elevated privileges.
This vulnerability can facilitate arbitrary code execution with SYSTEM
privileges.
This BID is related to the issue described in BID 15070 (Microsoft Windows
Malicious Shortcut Handling Remote Code Execution Variant Vulnerability).
16. Microsoft Windows Malicious Shortcut Handling Remote Code Execution Variant
Vulnerability
BugTraq ID: 15070
Remote: Yes
Date Published: 2005-10-11
Relevant URL: http://www.securityfocus.com/bid/15070
Summary:
Microsoft Windows is prone to a remote code execution vulnerability when
handling a malicious shortcut (.lnk) file.
An attacker can exploit this issue by crafting a malicious file and placing it
on a Web site or sending it to a user through email followed by enticing them
to open it and view the file's properties.
This issue also poses a local threat as a local unprivileged attacker could
exploit this issue without user interaction to gain elevated privileges.
This vulnerability can facilitate arbitrary code execution with SYSTEM
privileges.
This BID is related to the issue described in BID 15069 (Microsoft Windows
Malicious Shortcut Handling Remote Code Execution Vulnerability).
17. Novell NetMail NMAP Agent Remote Buffer Overflow Vulnerability
BugTraq ID: 15080
Remote: Yes
Date Published: 2005-10-12
Relevant URL: http://www.securityfocus.com/bid/15080
Summary:
NetMail Network Messaging Application Protocol (NMAP) Agent is affected by a
remote buffer overflow vulnerability.
This vulnerability allows remote attackers to execute arbitrary machine code in
the context of the affected server process.
18. PHPWebSite Search Module SQL Injection Vulnerability
BugTraq ID: 15088
Remote: Yes
Date Published: 2005-10-12
Relevant URL: http://www.securityfocus.com/bid/15088
Summary:
phpWebSite is prone to an SQL injection vulnerability. This issue is due to a
failure in the application to properly sanitize user-supplied input before
using it in an SQL query.
Successful exploitation could result in a compromise of the application,
disclosure or modification of data, or may permit an attacker to exploit
vulnerabilities in the underlying database implementation.
The vendor has released the patch phpwebsite_security_patch_20051202.tgz
addressing this issue.
This vulnerability was originally believed to be related to to BID 14172
(PHPWebSite Index.PHP Multiple SQL Injection Vulnerabilities) but is a seperate
issue.
19. Kerio Personal Firewall and ServerFirewall Local Denial of Service
Vulnerability
BugTraq ID: 15094
Remote: No
Date Published: 2005-10-13
Relevant URL: http://www.securityfocus.com/bid/15094
Summary:
Kerio Personal Firewall and ServerFirewall are prone to a local denial of
service vulnerability.
Reports indicate that the FWDRV driver does not verify access to memory
associated with the Process Environment Block (PEB) of the application. An
attacker can trigger fatal exceptions and cause the firewall process to
terminate.
A denial of service condition in the firewall can expose computers to further
attacks.
20. AbiWord Stack-Based Buffer Overflow Vulnerabilities
BugTraq ID: 15096
Remote: Yes
Date Published: 2005-10-13
Relevant URL: http://www.securityfocus.com/bid/15096
Summary:
AbiWord is susceptible to multiple stack-based buffer overflow vulnerabilities;
fixes are available. These issues are due to a failure of the application to
properly bounds check user-supplied data prior to copying it to an
insufficiently sized memory buffer while importing RTF files.
These issues likely allow attackers to execute arbitrary machine code in the
context of the user running the affected application.
Though similar to the vulnerability described in BID 14971 (AbiWord RTF File
Processing Buffer Overflow Vulnerability), these vulnerabilities are a separate
issue.
21. Accelerated Mortgage Manager Password Field SQL Injection Vulnerability
BugTraq ID: 15097
Remote: Yes
Date Published: 2005-10-13
Relevant URL: http://www.securityfocus.com/bid/15097
Summary:
Accelerated Mortgage Manager is prone to an SQL injection vulnerability. This
is due to a lack of proper sanitization of user-supplied input before passing
it on to SQL queries.
Successful exploitation could result in a compromise of the application,
disclosure or modification of data, or may permit an attacker to exploit
vulnerabilities in the underlying database implementation.
22. XMail Local Buffer Overflow Vulnerability
BugTraq ID: 15103
Remote: No
Date Published: 2005-10-13
Relevant URL: http://www.securityfocus.com/bid/15103
Summary:
XMail is prone to a local buffer overflow vulnerability.
A successful attack can facilitate arbitrary code execution with elevated
privileges. An attacker can gain superuser or group mail privileges depending
on the underlying operating system and distribution.
XMail 1.21 is reported to be vulnerable. Other versions may be affected as
well.
23. TYPSoft FTP Server RETR Denial Of Service Vulnerability
BugTraq ID: 15104
Remote: Yes
Date Published: 2005-10-13
Relevant URL: http://www.securityfocus.com/bid/15104
Summary:
TYPSoft FTP Server is prone to a denial of service vulnerability. This issue is
due to a failure in the application to properly handle exceptional conditions.
A local authorized attacker could exploit this vulnerability to cause the
system to malfunction, resulting in a denial of service to legitimate users.
Versions 1.11 and earlier are known to be vulnerable.
24. RARLAB WinRAR Command Line Processing Buffer Overflow Vulnerability
BugTraq ID: 15123
Remote: Yes
Date Published: 2005-10-17
Relevant URL: http://www.securityfocus.com/bid/15123
Summary:
A remote, client-side buffer overflow vulnerability has been reported in the
command line processing of RARLAB WinRAR. This issue is due to a failure of the
application to properly validate the length of user-supplied strings prior to
copying them into static process buffers.
An attacker may exploit this issue to execute arbitrary code with the
privileges of the user that activated the vulnerable application. This may
facilitate unauthorized access or privilege escalation.
25. Opera Web Browser Multiple Malformed HTML Parsing Denial Of Service
Vulnerabilities
BugTraq ID: 15124
Remote: Yes
Date Published: 2005-10-17
Relevant URL: http://www.securityfocus.com/bid/15124
Summary:
The Opera Web browser is prone to multiple vulnerabilities that may result in a
browser crash. These issues are exposed when the browser attempts to parse
certain malformed HTML content. It is conjectured that this will only result in
a denial of service and is not further exploitable to execute arbitrary code,
though this has not been confirmed.
26. IBM DB2 Universal Database Multiple Vulnerabilities
BugTraq ID: 15126
Remote: Yes
Date Published: 2005-10-18
Relevant URL: http://www.securityfocus.com/bid/15126
Summary:
IBM DB2 Universal Database is prone to multiple vulnerabilities.
These issues may allow attackers to carry out denial of service attacks and
other unauthorized actions.
These issues affect DB2 versions prior to 8 FixPak 10 also known as version 8.2
FixPak 3.
27. Microsoft Windows Unspecified Remote Code Execution Vulnerability
BugTraq ID: 15130
Remote: Yes
Date Published: 2005-10-17
Relevant URL: http://www.securityfocus.com/bid/15130
Summary:
Microsoft Windows is prone to an unspecified remote code execution
vulnerability.
Reportedly, this vulnerability affects Windows Media Player and Internet
Explorer, allowing a remote attacker to execute arbitrary code and potentially
gain unauthorized access in the context of the user running an affected client.
Due to a lack of information, further details cannot be described at the
moment. This BID will be updated when more information becomes available.
28. Snort Back Orifice Preprocessor Remote Stack Buffer Overflow Vulnerability
BugTraq ID: 15131
Remote: Yes
Date Published: 2005-10-18
Relevant URL: http://www.securityfocus.com/bid/15131
Summary:
Snort is susceptible to a remote buffer overflow vulnerability. This issue is
due to a failure of the application to securely copy network-derived data into
sensitive process buffers. The specific issue exists in the Back Orifice
preprocessor.
An attacker may exploit this issue to execute arbitrary code with the
privileges of the user that activated the vulnerable application. This may
facilitate unauthorized access or privilege escalation.
Due to the nature of this issue, attackers may exploit it by sending a single
UDP packet with a potentially spoofed source address to an arbitrary
destination address and port. As long as the application can sniff the packet,
it may be exploited. These aspects of this issue may aid attackers in bypassing
firewalls in order to compromise a wider number of computers.
Reportedly, this issue is difficult to reliably exploit across differing
operating systems and compiler versions. Failed exploit attempts likely result
in crashing the application, thereby disabling detection of other attacks.
Snort versions 2.4.0 through 2.4.2 are affected by this issue. Other versions
may also be affected, but this has not been confirmed.
III. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. Auditing Options
http://www.securityfocus.com/archive/88/413156
2. SecurityFocus Microsoft Newsletter #260
http://www.securityfocus.com/archive/88/413116
IV. UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to
ms-secnews-unsubscribe@securityfocus.com from the subscribed address. The
contents of the subject or message body do not matter. You will receive a
confirmation request message to which you will have to answer. Alternatively
you can also visit http://www.securityfocus.com/newsletters and unsubscribe via
the website.
If your email address has changed email listadmin@securityfocus.com and ask to
be manually removed.
V. SPONSOR INFORMATION
------------------------
Need to know what's happening on YOUR network? Symantec DeepSight Analyzer
is a free service that gives you the ability to track and manage attacks.
Analyzer automatically correlates attacks from various Firewall and network
based Intrusion Detection Systems, giving you a comprehensive view of your
computer or general network. Sign up today!
http://www.securityfocus.com/sponsor/Symantec_sf-news_041130
---------------------------------------------------------------------------
---------------------------------------------------------------------------
