SYS-2064 — THE NEWS

[PRIVACY] [CYBER CRIMES] [E-WAR & E-SPIONAGE] [CRYPTOGRAPHY & AUTHENTICTION] [CORPORATE NEWS] [E-MAIL] [OFFICE SOFTWARE] [UNIX] [DYNAMIC FEATURES] [HARDWARE] [HANDHELDS]

2002/4/29

10:12 +0100

MP3 files can cause code execution under Winamp

[Viruses & Worms] Andreas Sandblad informs, that it is possible to modify an existing MP3 file in such a way that it can carry a virus. The virus is activated when the MP3 file is played in Winamp and can then infect other MP3 files found on hard drives or network shares. In order to protect yourself you need to upgrade to Winamp 2.80 or disable the minibrowser. // SecuriTeam :: [dre].

Comments (0)

2002/4/19

14:23 +0100

SQL Extended Procedure Functions contain unchecked buffers

[ASP, JSP, SQL, CGI, PHP...] (Microsoft) SQL Server 7.0 and 2000 provide extended stored procedures, which are external routines written in a programming language such as C. These procedures appear to users as normal stored procedures and are executed in the same way. SQL Server 7.0 and 2000 include a number of extended stored procedures that are used for various helper functions.

Several of the Microsoft-provided extended stored procedures have been found to contain a common flaw. Namely, they fail to perform input validation correctly, and are susceptible to buffer overruns as a result. Exploiting the flaw could enable an attacker to either cause the SQL Server service to fail, or to cause code to run in the security context in which the SQL Server is running. SQL Server can be configured to run in various security contexts, and by default runs as a domain user. The precise privileges the attacker could gain would depend on the specific security context that the service runs in.

An attacker could exploit this vulnerability in one of two ways. First, the attacker could attempt to load and execute a database query that calls one of the affected functions. Second, if a web site or other database front-end were configured to access and process arbitrary queries, it could be possible for the attacker to provide inputs that would cause the query to call one of the functions in question with the appropriate malformed parameters.

The patch for this issue is available in the SQL 7.0 Cumulative Security patch at: [http://support.microsoft.com/support/misc/kblookup.asp?id=Q318268], and in the SQL Server 2000 Cumulative Security patch at: [http://support.microsoft.com/support/misc/kblookup.asp?id=Q316333]. :: [dre].

Comments (0)

2002/4/18

10:17 +0100

Microsoft IE/Office for Mac OS Buffer Overflow Vulnerability

[Apple / Macintosh] (Matt Conover and w00w00 / VulnWatch / SecuriTeam) There is a vulnerability in multiple Microsoft products on Mac OS (classic and carbon). The problem lies in the handling of a lengthy subdirectory in the file://
directive, such as file:///AAAAAA[...] or file://A/A/A/A/[...]. The number of subdirectories is trivial as long as there is at least one.

Vulnerable systems are those with running Microsoft Internet Explorer 5.1, Microsoft Outlook Express 5.0.2, Microsoft Entourage 2001 and -X, Microsoft PowerPoint 98, 2001, and X, Microsoft Excel 2001 and X, Microsoft Word 2001.

For Internet Explorer, a patch is available from: [http://www.apple.com/macosx/upgrade/softwareupdates.html].
For the other products, the patches can be downloaded from: [http://www.microsoft.com/mac/download]. :: [dre].

Comments (0)

2002/4/17

22:29 +0100

IE "Back" button dangerous

[Online / Browser / Email] (Andreas Sandblad / BugTraq / SecuriTeam) The Microsoft Internet Explorer allows URLs to contain JavaScript in their history text. Code injected in the URL will operate in the same zone/domain as the last URL viewed. The JavaScript URL can be set to trigger when a user presses the back button.

The normal behavior when a page fails to load is to press the backbutton. The error page shown by IE is operating in the local computer zone (res://C:\WINNT\System32\shdoclc.dll/dnserror.htm# on Win2000). Thus, attacker can execute code and read local files. :: [dre].

Comments (0)

17:55 +0100

Worm.Klez.h

[Viruses & Worms] Kaspersky Labs and TrendMicro announce the exposure of a new modified version of the "Klez" Internet-worm — Klez.h, already resulting in numerous computer infections in many countries including Japan, China, Austria and the Czech Republic.

To gain entry to a computer the worm exploits a vulnerability in the Microsoft Internet Explorer security system (the IFRAME vulnerability). Due to this, Klez is able to imperceptibly infect computers immediately after
the infected message is read. This special feature practically discounts the human factor and many times over raises the effectiveness of Klez.h to infect and to spread.

To protect against Klez.h Kaspersky Labs recommends that you immediately update your Anti-Virus protection. To remove the threat of infection from the Klez.h worm and any other modification of this worm, you should install the required patch for IE. It can be found on the Microsoft site at the following address: http://www.microsoft.com/windows/ie/download/critical/Q290108/default.asp :: [dre].

Comments (0)

2002/2/27

19:03 +0100

Another buffer overflow in MS-IE

[Online / Browser / Email] CERT Advisory CA-2002-04 reports that Microsoft Internet Explorer contains a buffer overflow vulnerability in its handling of embedded objects in HTML documents. This vulnerability could allow an attacker to execute arbitrary code on the victim's system when the victim visits a web page or views an HTML email message.

Internet Explorer supports the directive, which can be used to include arbitrary objects in HTML documents. Common types of embedded objects include multimedia files, Java applets, and ActiveX controls. The SRC attribute specifies the source path and filename of an object. For example, a MIDI sound might be embedded in a web page with the following HTML code: IE uses attributes of the directive and MIME information from the web server to determine how to handle an embedded object. In most cases, a separate application or plugin is used.

A group of Russian researchers, SECURITY.NNOV, has reported that Internet Explorer does not properly handle the SRC attribute of the directive. An HTML document, such as a web page or HTML email message, that contains a crafted SRC attribute can trigger a buffer overflow, executing code with the privileges of the user viewing the document. Microsoft Internet Explorer, Outlook, and Outlook Express are vulnerable. Other applications that use the Internet Explorer HTML rendering engine, such as Windows compiled HTML help (.chm) files and third-party email clients, may also be vulnerable.

The CERT/CC is tracking this vulnerability as VU#932283, which corresponds directly to the "buffer overrun" vulnerability described in Microsoft Security Bulletin MS02-005. This vulnerability has been assigned the CVE identifier CAN-2002-0022.

Microsoft has released a cumulative patch for Internet Explorer that corrects this vulnerability and several others. For more information about the patch and the vulnerabilities, please see Microsoft Security Bulletin MS02-005. // c.f. SecuriTeam, SecuritySpace :: [dre].

Comments (0)

2002/2/21

11:37 +0100

W32/Yarner

[Viruses & Worms] W32/Yarner alias W32/Yaw, W32/Yarner-A, W32/Yarner-B, Worm/Yarner, Win32.Yarner.A@mm, W32/YAWsetup, WORM_YARNER.B is an internet worm which uses its own SMTP routines to send email messages. The worm attempts to send itself to email addresses found on infected machines and in the Microsoft Windows address book. The email mimics the appearance of a well-known German anti-trojan newsletter and has the following characteristics: Subject Trojaner-Info Newsletter [Date]. Attachment: yawsetup.exe.

The body reads:

Hallo !

Willkomen zur neuesten Newsletter-Ausgabe der Webseite Trojaner-Info.de.

Hier die Themen im Ueberblick:

1. YAW 2.0 - Unser Dialerwarner in neuer Version

Viele haben ihn und viele moegen ihn - unseren Dialerwarner YAW. YAW ist nun in einer brandneuen und stark erweiterten Version verfuegbar. Alle unsere Newsletterleser bekommen ihn kostenlos zusammen mit diesem Newsletter. Also einfach die angehaengte Datei starten und YAW 2.0 installieren. Bei Fragen steht Ihnen der Programmierer des bislang einzigartigen Programmes Andreas Haak unter [email protected] zur Verfügung. Viel Spaß mit YAW!
(...)

W32/Yarner renames notepad.exe in the Windows directory to notedpad.exe and copies itself to notepad.exe. It creates a randomly named file with an .EXE extension in the Windows directory and changes a registry key so that the worm file runs on Windows startup. After a period of running on the system, the worm executes its destructive payload and attempts to delete all files from the hard drive. :: [dre].

Comments (0)

2002/2/13

19:27 +0100

Major privacy hole in Windows/MSN Messenger

[Online / Browser / Email] A nifty feature in Microsoft's MSN and Windows Messenger which apparently was intended to identify IE users (without their knowledge or consent) on Microsoft Web sites can easily be abused by any Webmaster with a bit of Javascript or VBscript, Richard A. Burton has discovered. The feature allows anyone to obtain a surfer's Messenger username and those of his contacts, according to The Register.

Worse, if a username is not available, the e-mail address of the surfer and those of his contacts are displayed instead. Only Microsoft.com, Hotmail.com and Hotmail.msn.com should be able to access the e-mail address of the surfer and his contacts—which of course is bad enough. However, a piece of software could easily make a registry entry during installation which would allow an associated Web site to obtain full details from Messenger.

Using a certain registry key, a semi-malicious program could easily enable Web access by adding domain suffixes. According to Burton, the suffix can be as little as .org or .com, which would enable any Web site with that suffix to access your details. By default, there are no suffixes listed in the registry, Burton says, but the Microsoft domains are hard-coded into Messenger, presumably to enhance the company's renowned devotion to customer service, or to accommodate the advertising industry in some backchannel manner.

Presently the only known, sure fix for IE users is to disable Messenger before visiting the Microsoft sites mentioned above. It would also be a good idea to check for entries under the above registry key, especially after installing software, Burton says. On the plus side, The Register had anecdotal reports from readers indicating that users of other browsrs like Opera, Mozilla and Netscape aren't affected. They also heard that Trillian users are safe as well, even if they use IE. Finally, it appears that users of IE and Messenger can avoid revealing themselves by setting their browsers to prevent scripting ActiveX controls. All of this is preliminary, however. // c.f. SecuritySpace :: [dre].

Comments (0)