SecurityFocus Microsoft Newsletter #224

Peter Laborge <[email protected]> 18 Jan 2005 23:08:17 -0000

Newsgroups	gmane.comp.security.news.microsoft
Message-ID	<[email protected]>

SecurityFocus Microsoft Newsletter #224
----------------------------------------

Need to know what's happening on YOUR network? Symantec DeepSight Analyzer
is a free service that gives you the ability to track and manage attacks.
Analyzer automatically correlates attacks from various Firewall and network
based Intrusion Detection Systems, giving you a comprehensive view of your
computer or general network. Sign up today!

http://www.securityfocus.com/sponsor/Symantec_sf-news_041130

------------------------------------------------------------------------
I. FRONT AND CENTER
1. A New Tool In The Spam War
2. The Perils of Deep Packet Inspection
II. MICROSOFT VULNERABILITY SUMMARY
1. JohnyTech Encrypted Messenger Plug-In Remote Denial Of Servi...
2. RhinoSoft Serv-U FTP Server Resource Exhaustion Denial Of Se...
3. Microsoft Office Encrypted Documents RC4 Initialization Vect...
4. Microsoft Windows Indexing Service Buffer Overflow Vulnerabi...
5. Microsoft Windows User32.DLL ANI File Header Handling Stack-...
6. Apple ITunes Playlist Buffer Overflow Vulnerability
7. Nullsoft Winamp Multiple Unspecified Vulnerabilities
8. IlohaMail Insecure Default Installation Information Disclosu...
9. Vim TCLTags and VimSpell.sh Scripts Insecure Temporary File ...
10. Brat Designs Breed Remote Denial of Service Vulnerability
11. Microsoft Internet Explorer Dynamic IFRAME File Download Sec...
12. MPM Guestbook Header Input Validation Vulnerability
13. Multiple Vendor Anti-Virus Gateway Failure To Decode Base64 ...
III. MICROSOFT FOCUS LIST SUMMARY
1. local admin vs group policy and apps... (Thread)
2. IIS6 on W2k3 DCs (Thread)
3. PGP and Outlook (Thread)
4. Automatic Updates and Users/Power Users (Thread)
5. Anti-spyware Beta from Microsoft available (Thread)
6. NTFS Security (Thread)
7. XP SP2 Blind install (Thread)
8. SecurityFocus Microsoft Newsletter #223 (Thread)
9. suggestions for proxy server to run on w2003 box.. (Thread)
IV. NEW PRODUCTS FOR MICROSOFT PLATFORMS
1. CoreGuard Core Security System
2. KeyCaptor Keylogger
3. SpyBuster
4. FreezeX
5. NeoExec for Active Directory
6. Secrets Protector v2.03
V. NEW TOOLS FOR MICROSOFT PLATFORMS
1. Network Equipment Performance Monitor 2.2
2. Etherchange v1.0
3. IPFront 1.0
4. Azure Web Log 1.5
5. Interface Traffic Indicator 1.2.3
6. Colasoft Capsa 4.05
VI. UNSUBSCRIBE INSTRUCTIONS
VII. SPONSOR INFORMATION

I. FRONT AND CENTER
-------------------
1. A New Tool In The Spam War

Arbitration is part of the next wave of security measures, and can be
effective against spammers who illegally harvest email addresses from a
honeypot on your website.

http://www.securityfocus.com/columnists/291

2. The Perils of Deep Packet Inspection
By Dr. Thomas Porter

This paper looks at the evolution of firewall technology towards Deep
Packet Inspection, and then discusses some of the security issues with this
evolving technology.

http://www.securityfocus.com/infocus/1817

II. MICROSOFT VULNERABILITY SUMMARY
-----------------------------------
1. JohnyTech Encrypted Messenger Plug-In Remote Denial Of Servi...
BugTraq ID: 12211
Remote: Yes
Date Published: Jan 10 2005
Relevant URL: http://www.securityfocus.com/bid/12211
Summary:
JohnyTech Encrypted Messenger Plug-in is reported prone to a remote denial of service vulnerability. The vulnerability presents itself when certain strings are processed by the vulnerable library.

A remote attacker may exploit this condition to deny service to legitimate users.

2. RhinoSoft Serv-U FTP Server Resource Exhaustion Denial Of Se...
BugTraq ID: 12213
Remote: Yes
Date Published: Jan 10 2005
Relevant URL: http://www.securityfocus.com/bid/12213
Summary:
Serv-U FTP Server is reported prone to a remote denial of service vulnerability. This issue may allow remote attackers to crash an affected server.

It is reported that the vulnerable service does not properly handle multiple connection attempts. Successful exploitation can deny service to legitimate users.

Serv-U FTP 2.5 is reported prone to this vulnerability.

3. Microsoft Office Encrypted Documents RC4 Initialization Vect...
BugTraq ID: 12223
Remote: Yes
Date Published: Jan 11 2005
Relevant URL: http://www.securityfocus.com/bid/12223
Summary:
Microsoft Office Word and Excel applications are reported prone to a security vulnerability. It is reported that the functionality that provides for password protecting confidential documents is flawed; specifically the RC4 stream cipher that is employed to obfuscate protected documents is implemented incorrectly.

An attacker that can retrieve an original encrypted document and subsequent encrypted modifications of said document may employ cryptanalysis techniques to potentially reveal portions of the target document.

Information gathered by exploiting this vulnerability may be used to aid in further attacks launched against a target victim.

4. Microsoft Windows Indexing Service Buffer Overflow Vulnerabi...
BugTraq ID: 12228
Remote: Yes
Date Published: Jan 11 2005
Relevant URL: http://www.securityfocus.com/bid/12228
Summary:
Microsoft Indexing Service is reported prone to a buffer overflow vulnerability. This issue results from insufficient boundary checks performed by the application when copying user-supplied data in to sensitive process buffers. A remote or local attacker may execute arbitrary code on a vulnerable computer, which could ultimately allow the attacker to gain unauthorized access to the computer or gain elevated privileges.

This issue can be exploited by sending a malformed query to the Indexing Service. It is reported that issue may be locally and remotely exploited, if Indexing Service is enabled on a vulnerable computer.

5. Microsoft Windows User32.DLL ANI File Header Handling Stack-...
BugTraq ID: 12233
Remote: Yes
Date Published: Jan 11 2005
Relevant URL: http://www.securityfocus.com/bid/12233
Summary:
A stack-based buffer overflow vulnerability is reported to affect the ANI (animated cursor files) handler on Microsoft Windows operating systems.

The vulnerability exists in the ANI file header handling routines contained in the 'user32.dll' library.

Ultimately the issue may be leveraged to force the execution of attacker-supplied instructions. It has been reported that this vulnerability affects any application that employs the vulnerable Internet Explorer component, for example:
Microsoft Internet Explorer, Word, Excel, PowerPoint, Outlook, Outlook Express and the Windows Shell.
Other applications are also affected.

6. Apple ITunes Playlist Buffer Overflow Vulnerability
BugTraq ID: 12238
Remote: Yes
Date Published: Jan 11 2005
Relevant URL: http://www.securityfocus.com/bid/12238
Summary:
Apple iTunes is prone to a buffer overflow vulnerability. This issue is exposed when the application parses 'm3u' and 'pls' playlist files. As these files may originate from an external source, this issue is considered remotely exploitable.

If the vulnerability is successfully exploited, it will result in execution of arbitrary code in the context of the user running the application.

7. Nullsoft Winamp Multiple Unspecified Vulnerabilities
BugTraq ID: 12245
Remote: Yes
Date Published: Jan 12 2005
Relevant URL: http://www.securityfocus.com/bid/12245
Summary:
Winamp is a freely available media player from Nullsoft. It is available for the Microsoft Windows platform.

Multiple unspecified vulnerabilities affect Nullsoft's Winamp. The underlying causes of most of these issues are unknown, however one of the issues is due to a buffer overflow.

Further information surrounding these issues is not available. This BID will be updated immediately upon the release of more details.

It is likely that a remote attacker may leverage these issues by distributing malicious files and enticing unsuspecting users to process them. This may facilitate privilege escalation and unauthorized access.

8. IlohaMail Insecure Default Installation Information Disclosu...
BugTraq ID: 12252
Remote: Yes
Date Published: Jan 13 2005
Relevant URL: http://www.securityfocus.com/bid/12252
Summary:
An insecure default installation information disclosure issue affects IlohaMail. This issue is due to a failure of the application to install sensitive files securely.

An attacker may leverage this issue to gain access to sensitive information, potentially including user names and passwords. Sensitive information disclosed in this way may lead to a compromise of email accounts and other attacks.

9. Vim TCLTags and VimSpell.sh Scripts Insecure Temporary File ...
BugTraq ID: 12253
Remote: No
Date Published: Jan 13 2005
Relevant URL: http://www.securityfocus.com/bid/12253
Summary:
Multiple Vim scripts are reported prone to an insecure temporary file creation vulnerability. It is reported that the Vim 'tcltags' and 'vimspell.sh' scripts create temporary files in an insecure manner.

An attacker that has local interactive access to a system may exploit this issue to corrupt arbitrary files with the privileges of the user that is invoking the vulnerable application.

10. Brat Designs Breed Remote Denial of Service Vulnerability
BugTraq ID: 12262
Remote: Yes
Date Published: Jan 13 2005
Relevant URL: http://www.securityfocus.com/bid/12262
Summary:
Breed is reported prone to a remote denial of service vulnerability.

It is reported that a game server may be crashed by sending an empty UDP packet.

All versions up to and including Breed patch 1 are reported prone to this issue.

11. Microsoft Internet Explorer Dynamic IFRAME File Download Sec...
BugTraq ID: 12264
Remote: Yes
Date Published: Jan 13 2005
Relevant URL: http://www.securityfocus.com/bid/12264
Summary:
Microsoft Internet Explorer is reported prone to a file download security warning bypass weakness. This issue may be exploited to download a malicious file to the client system.

It is reported that this security warning can be bypassed by creating a document containing a specially crafted HTML BODY tag and a dynamic IFRAME.

By enticing a user to visit a site, the attacker can potentially plant malicious files on vulnerable systems in order to execute malicious code. It should be noted that although no security warning appears, the standard download confirmation widnow still appears and requires the user to confirm the download prior to any files being placed on the unsuspecting user's computer.

This vulnerability may be combined with other issues in the browser or the affected computer to aid in various attacks.

It should also be noted that Symantec has been unable to replicate this issue. Furthermore Microsoft has stated that this is not a vulnerability. This BID will be updated when further information becomes available.

Internet Explorer 6.0 running on Microsoft Windows XP SP2 is reported to be affected by this vulnerability. It is conjectured that other versions of Internet Explorer are vulnerable as well. This BID will be updated when more information about affected packages is available.

12. MPM Guestbook Header Input Validation Vulnerability
BugTraq ID: 12266
Remote: Yes
Date Published: Jan 14 2005
Relevant URL: http://www.securityfocus.com/bid/12266
Summary:
MPM Guestbook is reported prone to an input validation vulnerability that may lead to remote command execution or arbitrary file content disclosure. The issue is due to a lack of sufficient sanitization performed on user-supplied 'header' URI parameter data.

An attacker may leverage this issue to execute arbitrary PHP code in the context of the web server process or disclose the contents of web server readable files.

It should be noted that although this vulnerability is reported to affect MPM Guestbook version 1.05, other versions might also be affected.

13. Multiple Vendor Anti-Virus Gateway Failure To Decode Base64 ...
BugTraq ID: 12269
Remote: Yes
Date Published: Jan 14 2005
Relevant URL: http://www.securityfocus.com/bid/12269
Summary:
Multiple vendor anti-virus gateway products are reported prone to a security weakness that could lead to a false sense of security. It is reported that the affected anti-virus gateways do not decode base64-encoded images that are contained in 'data' URIs.

A malicious image that is obfuscated in this manner will bypass the affected anti-virus scanner; the image will be rendered in the browser of a target user when the malicious page is viewed. It is reported that because Microsoft Internet Explorer does not support the 'data' URI, Internet Explorer cannot be used as an attack vector to exploit this weakness.

This weakness may lead to a false sense of security where a network administrator believes that the affected product will detect malicious images designed to trigger a target vulnerability. In reality, the images may be obfuscated by an attacker and may not be detected.

III. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. local admin vs group policy and apps... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/387497

2. IIS6 on W2k3 DCs (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/387495

3. PGP and Outlook (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/387494

4. Automatic Updates and Users/Power Users (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/387224

5. Anti-spyware Beta from Microsoft available (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/387014

6. NTFS Security (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/387013

7. XP SP2 Blind install (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/386949

8. SecurityFocus Microsoft Newsletter #223 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/386891

9. suggestions for proxy server to run on w2003 box.. (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/386882

IV. NEW PRODUCTS FOR MICROSOFT PLATFORMS
----------------------------------------
1. CoreGuard Core Security System
By: Vormetric
Platforms: AIX, Linux, Solaris, Windows 2000, Windows XP
Relevant URL: http://www.vormetric.com/products/#overview
Summary:

CoreGuard System profile

The CoreGuard System is the industry's first solution that enforces
acceptable use policy for sensitive digital information assets and
protects personal data privacy across an enterprise IT environment.
CoreGuard's innovative architecture and completeness of technology
provide a comprehensive, extensible solution that tightly integrates all
the elements required to protect information across a widespread,
heterogeneous enterprise network, while enforcing separation of duties
between security and IT administration. At the same time, CoreGuard is
transparent to users, applications and storage infrastructures for ease
of deployment and system management.

CoreGuard enables customers to:
* Protect customer personal data privacy and digital information assets
* Protect data at rest from unauthorized viewing by external attackers
and unauthorized insiders
* Enforce segregation of duties between IT administrators and security
administration
* Ensure host & application integrity * Block malicious code, including
zero-day exploits

2. KeyCaptor Keylogger
By: Keylogger Software
Platforms: MacOS, Windows 2000, Windows 95/98, Windows NT, Windows XP
Relevant URL: http://www.keylogger-software.com/keylogger/keylogger.htm
Summary:

KeyCaptor is your solution for recording ALL keystrokes of ALL users on your computer! Now you have the power to record emails, websites, documents, chats, instant messages, usernames, passwords, and MUCH MORE!

With our advanced stealth technology, KeyCaptor will not show in your processes list and cannot be stopped from running unless you say so!

3. SpyBuster
By: Remove Spyware
Platforms: Windows 2000, Windows 95/98, Windows NT, Windows XP
Relevant URL: http://www.remove-spyware.com/spybuster.htm
Summary:

Our award winning spyware / adware scanner and removal software, SpyBuster will scan your computer for over 4,000 known spyware and adware applications. SpyBuster protects your computer from data stealing programs that can expose your personal information.

SpyBuster scanning technology allows for a quick and easy sweep, so you can resume your work in minutes.

4. FreezeX
By: Faronics Technologies USA Inc
Platforms: Windows 2000, Windows 95/98, Windows XP
Relevant URL: http://www.faronics.com/html/Freezex.asp
Summary:

FreezeX prevents all unauthorized programs, including viruses, keyloggers and spy ware from executing. Powerful and secure, FreezeX ensures that any new executable, program, or application that is downloaded, introduced via removable media or the network will never install

5. NeoExec for Active Directory
By: NeoValens
Platforms: Windows 2000, Windows XP
Relevant URL: http://www.neovalens.com
Summary:

NeoExec® is an operating system extension for Windows 2000/XP that allows the setting of privileges at the application level rather than at the user level.

NeoExec® is the ideal solution for applications that require elevated privileges to run as the privileges are granted to the application, not the user.

NeoExec® is the only solution on the market capable of modifying at runtime the processes' security context -- without requiring a second account as with RunAs and RunAs-derived products.

6. Secrets Protector v2.03
By: E-CRONIS
Platforms: Windows 2000, Windows XP
Relevant URL: http://www.e-cronis.com/download/sp.exe
Summary:

It's the end of your worries about top-secret data of your company, your confidential files or the pictures from the last party. All these will be hidden beyond the reach of ANY intruder and you will be the only one able to handle them. And what you want to delete will be DELETED. It is the ultimate security tool to protect your sensitive information on PC, meeting the three most important security issues: Integrity, Confidentiality and Availability. This product gives you the features of a "folder locker" and a "secure eraser".

Your secret information is available only trough this software and there is no other mean to access it. The information is protected at file system level and it cannot be accidentally deleted or overwritten neither in Safe mode nor in other operating system. This program doesn't make your operating system unstable as other related product do and protects your information from being seen, altered or deleted by an unauthorized user with or without his wish. The program allows you to permanently erase your sensitive data using secure wiping methods leaving no trace of your information. Depending on the selected wiping method your data is unrecoverable using software or even hardware recovery techniques.

V. NEW TOOLS FOR MICROSOFT PLATFORMS
------------------------------------
1. Network Equipment Performance Monitor 2.2
By: Nova Software, Inc.
Relevant URL: http://www.nepm.net/
Platforms: AIX, FreeBSD, HP-UX, Linux, Solaris, True64 UNIX, UNIX, Windows 2000, Windows NT, Windows XP
Summary:

NEPM is a very general, highly configurable, two part software system that monitors any type of logged data from IP networked equipment and reports it via E-mail and web pages. Current conditions and history from systems based on Windows NT/2000 and UNIX can be tracked and reported. Most major server, switch and router systems can be monitored, without running agents on the target systems.

2. Etherchange v1.0
By: Arne Vidstrom
Relevant URL: http://www.ntsecurity.nu/toolbox/etherchange/
Platforms: Windows 2000, Windows XP
Summary:

EtherChange can change the Ethernet address of the network adapters in Windows 2000 / XP.

3. IPFront 1.0
By: Hernán M. Racciatti
Relevant URL: http://www.hernanracciatti.com.ar/ipfront/
Platforms: Windows 2000
Summary:

IPFront is a small tool named which enables users to generate IPSec rules easily. It really speeds-up the process of hardening Windows 2000/2003 in Bastion Host Environment.

Additionally, it allows to set-up IPSec exceptions, and enables a couple of TCP/IP Stack protections against DoSes.

So, IPFront is nothing more than a small Frontend/GUI that writes small scripts that one can later execute from within IPFront, or externally, as simple script files, in other servers,

4. Azure Web Log 1.5
By: Azure Desktop
Relevant URL: http://www.azuredesktop.com/download/awlog.zip
Platforms: Windows 2000, Windows 95/98, Windows NT, Windows XP
Summary:

Log analyzer tells you all you want about your web site: What are the most popular pages and files on your site? How many visitors are there and where are they from? What browsers and OS they use? What is your sites traffic? Special features:Statistics for a year. Separate statistics for every page or file - daily hits for two last months, monthly hits for a year, referring site for particular page or file. Multiple site statistics support.

5. Interface Traffic Indicator 1.2.3
By: Carsten Schmidt
Relevant URL: http://software.ccschmidt.de/#inftraffic
Platforms: Windows 2000, Windows NT, Windows XP
Summary:

Interface Traffic Indicator, a graph utility to measure incoming and outgoing traffic on an interface in bits/sec, bytes/sec or utilization. Works on all SNMP-capable devices (computers, NICs, switches, routers, etc.) with adjustable poll intervall down to three seconds. You can use this programm in a professional network environment to monitor selected network interfaces (even backplane ports if the device provides the information) or you can monitor your home network or

6. Colasoft Capsa 4.05
By: Roy Luo
Relevant URL: http://www.colasoft.com/
Platforms: Windows 2000, Windows 95/98, Windows XP
Summary:

Capsa is a powerful but easy to use network monitor and analyzer designed for packet decoding and network diagnosis. With the abilities of real time monitoring and data analyzing, you can capture and decode network traffic transmitted over local host and local network. Capsa has Packet Analysis Module and three advanced analysis modules: Email Analysis Module, Web Analysis Module and Transaction Analysis Module.

VI. UNSUBSCRIBE INSTRUCTIONS
----------------------------
To unsubscribe send an e-mail message to [email protected] from the subscribed address. The contents of the subject or message body do not matter. You will receive a confirmation request message to which you will have to answer. Alternatively you can also visit http://www.securityfocus.com/newsletters and unsubscribe via the website.

If your email address has changed email [email protected] and ask to be manually removed.

VII. SPONSOR INFORMATION
-----------------------

http://www.securityfocus.com/sponsor/Symantec_sf-news_041130

------------------------------------------------------------------------