SecurityFocus Microsoft Newsletter #225

Peter Laborge <[email protected]> 25 Jan 2005 23:34:41 -0000

Newsgroups	gmane.comp.security.news.microsoft
Message-ID	<[email protected]>

SecurityFocus Microsoft Newsletter #225
----------------------------------------

Need to know what's happening on YOUR network? Symantec DeepSight Analyzer
is a free service that gives you the ability to track and manage attacks.
Analyzer automatically correlates attacks from various Firewall and network
based Intrusion Detection Systems, giving you a comprehensive view of your
computer or general network. Sign up today!

http://www.securityfocus.com/sponsor/Symantec_sf-news_041130

------------------------------------------------------------------------
I. FRONT AND CENTER
1. Unintended Consequences
2. Blind Buffer Overflows In ISAPI Extensions
II. MICROSOFT VULNERABILITY SUMMARY
1. SparkleBlog Multiple Input Validation Vulnerabilities
2. MySQL Database MySQLAccess Local Insecure Temporary File Cre...
3. INCA nProtect Gameguard Unprivileged Arbitrary Read/Write Ac...
4. Research In Motion Blackberry Enterprise Server Mobile Data ...
5. Netegrity SiteMinder HTML Page Injection Vulnerability
6. Gallery Multiple Unspecified Input Validation Vulnerabilitie...
7. ImageMagick Photoshop Document Parsing Remote Client-Side Bu...
8. Kazaa Sig2Dat Protocol Multiple Remote Vulnerabilities
9. Microsoft Internet Explorer Remote Information Disclosure Vu...
10. VBulletin Init.PHP Unspecified Remote Vulnerability
11. CMSimple Multiple Remote Input Validation Vulnerabilities
12. RealNetworks RealOne Player And RealPlayer ShowPreferences A...
13. RealNetworks RealOne Player And RealPlayer Multiple Potentia...
14. DivX Player Skin File Directory Traversal Vulnerability
III. MICROSOFT FOCUS LIST SUMMARY
1. AW: IIS6 on W2k3 DCs (Thread)
2. Dhcp security (Thread)
3. IIS6 on W2k3 DCs (Thread)
4. [Maybe Spam] Dhcp security (Thread)
5. PGP and Outlook (Thread)
6. SecurityFocus Microsoft Newsletter #224 (Thread)
7. local admin vs group policy and apps... (Thread)
IV. NEW PRODUCTS FOR MICROSOFT PLATFORMS
1. CoreGuard Core Security System
2. KeyCaptor Keylogger
3. SpyBuster
4. FreezeX
5. NeoExec for Active Directory
6. Secrets Protector v2.03
V. NEW TOOLS FOR MICROSOFT PLATFORMS
1. Network Equipment Performance Monitor 2.2
2. Etherchange v1.0
3. IPFront 1.0
4. Azure Web Log 1.5
5. Interface Traffic Indicator 1.2.3
6. Colasoft Capsa 4.05
VI. UNSUBSCRIBE INSTRUCTIONS
VII. SPONSOR INFORMATION

I. FRONT AND CENTER
-------------------
1. Unintended Consequences
By Scott Granneman

The law of unintended consequences shows us how many innocent innovations
like email, anti-virus and DRM can become something far worse than the
inventors had ever imagined.

http://www.securityfocus.com/columnists/293

2. Blind Buffer Overflows In ISAPI Extensions
By Isaac Dawson

This paper will outline the risks ISAPI Extensions pose and how they can be
exploited by third parties without any binary exposure or knowledge using
blind stack overflows. This method can enable remote code execution in
proprietary and third party applications.

http://www.securityfocus.com/infocus/1819

II. MICROSOFT VULNERABILITY SUMMARY
-----------------------------------
1. SparkleBlog Multiple Input Validation Vulnerabilities
BugTraq ID: 12272
Remote: Yes
Date Published: Jan 15 2005
Relevant URL: http://www.securityfocus.com/bid/12272
Summary:
Multiple input validation vulnerabilities reportedly affect SparkleBlog. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it to carry out critical actions.

The first issue is a cross-site scripting issue and the second issue is an SQL injection issue.

An attacker may leverage these issues to carry out cross-site scripting and SQL injection attacks against the affected application. This may result in the theft of authentication credentials, destruction or disclosure of sensitive data, and potentially other attacks.

2. MySQL Database MySQLAccess Local Insecure Temporary File Cre...
BugTraq ID: 12277
Remote: No
Date Published: Jan 17 2005
Relevant URL: http://www.securityfocus.com/bid/12277
Summary:
A local insecure temporary file creation vulnerability affects the MySQL Database. This issue is due to a failure of a script bundled with the application to securely create temporary files in globally accessible locations.

An attacker may leverage this issue to corrupt arbitrary files with the privileges of the user that activates the vulnerable script.

3. INCA nProtect Gameguard Unprivileged Arbitrary Read/Write Ac...
BugTraq ID: 12280
Remote: No
Date Published: Jan 17 2005
Relevant URL: http://www.securityfocus.com/bid/12280
Summary:
It is reported that the INCA nProtect Gameguard kernel driver provides functionality that may impact the security model of a Windows NT/2000/XP computer. Reports indicate the affected kernel driver provides functionality to modify the I/O permission mask of the process that invokes the affected driver to allow for unrestricted I/O operations in unprivileged user-mode.

An unprivileged attacker that has obtainined local interactive access to a computer that is running the vulnerable kernel mode driver may exploit this to make arbitrary read and write operations to a specified device.

4. Research In Motion Blackberry Enterprise Server Mobile Data ...
BugTraq ID: 12282
Remote: Yes
Date Published: Jan 17 2005
Relevant URL: http://www.securityfocus.com/bid/12282
Summary:
Blackberry Enterprise Server is reportedly affected by a remote denial of service vulnerability. This issue is due to an error while processing WML (Wireless Markup Language) pages in the 'Mobile Data Service'. Exploitation of this issue would cause a 100% processor utilization, thus resulting in a denial of service.

5. Netegrity SiteMinder HTML Page Injection Vulnerability
BugTraq ID: 12284
Remote: Yes
Date Published: Jan 17 2005
Relevant URL: http://www.securityfocus.com/bid/12284
Summary:
Netegrity SiteMinder is reported prone to a vulnerability that may allow an attacker to inject arbitrary HTML pages that may be rendered in a user's browser through a URI link. This issue originates in the 'smpwservicescgi.exe' script and can facilitate arbitrary script execution and other attacks such as phishing.

An attacker can manipulate URI parameters to redirect a user to a potentially malicious Web page after authentication to the server.

All versions of SiteMinder are considered vulnerable at the moment.

6. Gallery Multiple Unspecified Input Validation Vulnerabilitie...
BugTraq ID: 12286
Remote: Yes
Date Published: Jan 17 2005
Relevant URL: http://www.securityfocus.com/bid/12286
Summary:
Gallery is reported prone to multiple unspecified remote input validation vulnerabilities. It is reported that multiple instances of insufficient sanitization performed on Gallery variables were fixed; reports indicate that these issues may be exploited to disclose Gallery passwords contained in the Gallery database.

7. ImageMagick Photoshop Document Parsing Remote Client-Side Bu...
BugTraq ID: 12287
Remote: Yes
Date Published: Jan 17 2005
Relevant URL: http://www.securityfocus.com/bid/12287
Summary:
A client-side buffer overflow vulnerability affects the Photoshop document (PSD) parsing functionality of ImageMagick. This issue is due to a failure of the application to properly validate the length of user-supplied strings prior to copying them into static process buffers.

An attacker may exploit this issue remotely by sending a malicious file through email or some other means to an unsuspecting user and enticing them to process it with the affected application.

An attacker may exploit this issue to execute arbitrary code with the privileges of the user that activated the vulnerable application. This may facilitate unauthorized access or privilege escalation.

8. Kazaa Sig2Dat Protocol Multiple Remote Vulnerabilities
BugTraq ID: 12291
Remote: Yes
Date Published: Jan 17 2005
Relevant URL: http://www.securityfocus.com/bid/12291
Summary:
Multiple remote vulnerabilities reportedly affect KaZaA's Sig2Dat protocol functionality. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it in critical actions.

An attacker may leverage these issues to cause the affected application to crash, denying service to legitimate users, and to create files in arbitrary directories that are readable to the affected application.

9. Microsoft Internet Explorer Remote Information Disclosure Vu...
BugTraq ID: 12294
Remote: Yes
Date Published: Jan 18 2005
Relevant URL: http://www.securityfocus.com/bid/12294
Summary:
A remote information disclosure vulnerability affects Microsoft Internet Explorer. This issue is due to a failure of the application to properly secure scripts that reside on a local computer.

An attacker may leverage this issue to identify any scripts that may reside on an unsuspecting user's computer. Information disclosed in this way may lead to further attacks against affected computers.

Any script access that occurs will take place in the context of the unsuspecting user that views the malicious page.

10. VBulletin Init.PHP Unspecified Remote Vulnerability
BugTraq ID: 12299
Remote: Yes
Date Published: Jan 18 2005
Relevant URL: http://www.securityfocus.com/bid/12299
Summary:
VBulletin is reported prone to an unspecified vulnerability that presents itself in the 'includes/init.php' script.

It is reported that this vulnerability may be exploited to compromise an affected VBulletin installation; this compromise may include information disclosure.

This BID will be updated, as further information regarding this vulnerability is made available.

11. CMSimple Multiple Remote Input Validation Vulnerabilities
BugTraq ID: 12303
Remote: Yes
Date Published: Jan 19 2005
Relevant URL: http://www.securityfocus.com/bid/12303
Summary:
Multiple input validation vulnerabilities affect CMSimple. These issues are due to a failure of the application to properly sanitize user-supplied input prior to including it in dynamically generated Web content.

The first issue is an HTML injection vulnerability in the guestbook functionality of the application. The second issue is a cross-site script vulnerability in the search functionality of the application.

An attacker may leverage these issues to have arbitrary script code executed in the context of the vulnerable Web site. This will facilitate theft of cookie based authentication credentials as well as other attacks.

12. RealNetworks RealOne Player And RealPlayer ShowPreferences A...
BugTraq ID: 12311
Remote: Yes
Date Published: Jan 19 2005
Relevant URL: http://www.securityfocus.com/bid/12311
Summary:
RealOne Player and RealPlayer are affected by a buffer overflow vulnerability. This issue may be exploited by a remote attacker to execute arbitrary code in the context of the software.

The application fails to perfrom proper boundary checks before copying the arguments of the 'ShowPreferences' action to a static buffer through a 'sprintf()' function call.

An attacker can design a malicious Web site or skin file and trigger an overflow condition in the application. This issue may be leveraged to execute arbitrary code in the context of the user running the application.

It is likely that this issue is identical the vulnerability described in BID 11307 (RealNetworks RealOne Player And RealPlayer Unspecified Web Page Code Execution Vulnerability). This cannot be confirmed at the moment, however, one of the BIDs will be retired, if it turns out that the BIDs represent the same issue.

13. RealNetworks RealOne Player And RealPlayer Multiple Potentia...
BugTraq ID: 12315
Remote: Yes
Date Published: Jan 20 2005
Relevant URL: http://www.securityfocus.com/bid/12315
Summary:
RealNetworks RealOne Player And RealPlayer are reported prone to multiple potential vulnerabilities. These issues may allow an attacker to potentially execute arbitrary code or disclose the presence of files on a vulnerable computer.

The following specific issues were identified:

The first issue presents itself when the application processes Real Metadata Package files containing malformed tags. The researchers responsible for discovering this issue have reported that this issue may not be exploitable and represents a potential threat.

The second issue may allow attacker to determine the existence of files on a vulnerable computer. The validity of this issue is not confirmed at the moment is also considered a potential threat.

It is likely that this issues were originally released as unspecified vulnerabilities. This cannot be confirmed at the moment, however, one of the BIDs will be retired, if it turns out that the BIDs represent the same issues.

14. DivX Player Skin File Directory Traversal Vulnerability
BugTraq ID: 12332
Remote: Yes
Date Published: Jan 21 2005
Relevant URL: http://www.securityfocus.com/bid/12332
Summary:
DivX Player is reported prone to a directory traversal vulnerability. The issue presents itself when DPS '.dps', archive files are processed.

Ultimately an attacker may exploit this issue to save a script or executable file in an arbitrary location. This may lead to the execution of malicious code when the affected system is restarted. Alternatively, the attacker may overwrite a target file with the privileges of a user that is installing a malicious skin file.

III. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. AW: IIS6 on W2k3 DCs (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/387976

2. Dhcp security (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/387974

3. IIS6 on W2k3 DCs (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/387973

4. [Maybe Spam] Dhcp security (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/387964

5. PGP and Outlook (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/387687

6. SecurityFocus Microsoft Newsletter #224 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/387682

7. local admin vs group policy and apps... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/387556

IV. NEW PRODUCTS FOR MICROSOFT PLATFORMS
----------------------------------------
1. CoreGuard Core Security System
By: Vormetric
Platforms: AIX, Linux, Solaris, Windows 2000, Windows XP
Relevant URL: http://www.vormetric.com/products/#overview
Summary:

CoreGuard System profile

The CoreGuard System is the industry's first solution that enforces
acceptable use policy for sensitive digital information assets and
protects personal data privacy across an enterprise IT environment.
CoreGuard's innovative architecture and completeness of technology
provide a comprehensive, extensible solution that tightly integrates all
the elements required to protect information across a widespread,
heterogeneous enterprise network, while enforcing separation of duties
between security and IT administration. At the same time, CoreGuard is
transparent to users, applications and storage infrastructures for ease
of deployment and system management.

CoreGuard enables customers to:
* Protect customer personal data privacy and digital information assets
* Protect data at rest from unauthorized viewing by external attackers
and unauthorized insiders
* Enforce segregation of duties between IT administrators and security
administration
* Ensure host & application integrity * Block malicious code, including
zero-day exploits

2. KeyCaptor Keylogger
By: Keylogger Software
Platforms: MacOS, Windows 2000, Windows 95/98, Windows NT, Windows XP
Relevant URL: http://www.keylogger-software.com/keylogger/keylogger.htm
Summary:

KeyCaptor is your solution for recording ALL keystrokes of ALL users on your computer! Now you have the power to record emails, websites, documents, chats, instant messages, usernames, passwords, and MUCH MORE!

With our advanced stealth technology, KeyCaptor will not show in your processes list and cannot be stopped from running unless you say so!

3. SpyBuster
By: Remove Spyware
Platforms: Windows 2000, Windows 95/98, Windows NT, Windows XP
Relevant URL: http://www.remove-spyware.com/spybuster.htm
Summary:

Our award winning spyware / adware scanner and removal software, SpyBuster will scan your computer for over 4,000 known spyware and adware applications. SpyBuster protects your computer from data stealing programs that can expose your personal information.

SpyBuster scanning technology allows for a quick and easy sweep, so you can resume your work in minutes.

4. FreezeX
By: Faronics Technologies USA Inc
Platforms: Windows 2000, Windows 95/98, Windows XP
Relevant URL: http://www.faronics.com/html/Freezex.asp
Summary:

FreezeX prevents all unauthorized programs, including viruses, keyloggers and spy ware from executing. Powerful and secure, FreezeX ensures that any new executable, program, or application that is downloaded, introduced via removable media or the network will never install

5. NeoExec for Active Directory
By: NeoValens
Platforms: Windows 2000, Windows XP
Relevant URL: http://www.neovalens.com
Summary:

NeoExec® is an operating system extension for Windows 2000/XP that allows the setting of privileges at the application level rather than at the user level.

NeoExec® is the ideal solution for applications that require elevated privileges to run as the privileges are granted to the application, not the user.

NeoExec® is the only solution on the market capable of modifying at runtime the processes' security context -- without requiring a second account as with RunAs and RunAs-derived products.

6. Secrets Protector v2.03
By: E-CRONIS
Platforms: Windows 2000, Windows XP
Relevant URL: http://www.e-cronis.com/download/sp.exe
Summary:

It's the end of your worries about top-secret data of your company, your confidential files or the pictures from the last party. All these will be hidden beyond the reach of ANY intruder and you will be the only one able to handle them. And what you want to delete will be DELETED. It is the ultimate security tool to protect your sensitive information on PC, meeting the three most important security issues: Integrity, Confidentiality and Availability. This product gives you the features of a "folder locker" and a "secure eraser".

Your secret information is available only trough this software and there is no other mean to access it. The information is protected at file system level and it cannot be accidentally deleted or overwritten neither in Safe mode nor in other operating system. This program doesn't make your operating system unstable as other related product do and protects your information from being seen, altered or deleted by an unauthorized user with or without his wish. The program allows you to permanently erase your sensitive data using secure wiping methods leaving no trace of your information. Depending on the selected wiping method your data is unrecoverable using software or even hardware recovery techniques.

V. NEW TOOLS FOR MICROSOFT PLATFORMS
------------------------------------
1. Network Equipment Performance Monitor 2.2
By: Nova Software, Inc.
Relevant URL: http://www.nepm.net/
Platforms: AIX, FreeBSD, HP-UX, Linux, Solaris, True64 UNIX, UNIX, Windows 2000, Windows NT, Windows XP
Summary:

NEPM is a very general, highly configurable, two part software system that monitors any type of logged data from IP networked equipment and reports it via E-mail and web pages. Current conditions and history from systems based on Windows NT/2000 and UNIX can be tracked and reported. Most major server, switch and router systems can be monitored, without running agents on the target systems.

2. Etherchange v1.0
By: Arne Vidstrom
Relevant URL: http://www.ntsecurity.nu/toolbox/etherchange/
Platforms: Windows 2000, Windows XP
Summary:

EtherChange can change the Ethernet address of the network adapters in Windows 2000 / XP.

3. IPFront 1.0
By: Hernán M. Racciatti
Relevant URL: http://www.hernanracciatti.com.ar/ipfront/
Platforms: Windows 2000
Summary:

IPFront is a small tool named which enables users to generate IPSec rules easily. It really speeds-up the process of hardening Windows 2000/2003 in Bastion Host Environment.

Additionally, it allows to set-up IPSec exceptions, and enables a couple of TCP/IP Stack protections against DoSes.

So, IPFront is nothing more than a small Frontend/GUI that writes small scripts that one can later execute from within IPFront, or externally, as simple script files, in other servers,

4. Azure Web Log 1.5
By: Azure Desktop
Relevant URL: http://www.azuredesktop.com/download/awlog.zip
Platforms: Windows 2000, Windows 95/98, Windows NT, Windows XP
Summary:

Log analyzer tells you all you want about your web site: What are the most popular pages and files on your site? How many visitors are there and where are they from? What browsers and OS they use? What is your sites traffic? Special features:Statistics for a year. Separate statistics for every page or file - daily hits for two last months, monthly hits for a year, referring site for particular page or file. Multiple site statistics support.

5. Interface Traffic Indicator 1.2.3
By: Carsten Schmidt
Relevant URL: http://software.ccschmidt.de/#inftraffic
Platforms: Windows 2000, Windows NT, Windows XP
Summary:

Interface Traffic Indicator, a graph utility to measure incoming and outgoing traffic on an interface in bits/sec, bytes/sec or utilization. Works on all SNMP-capable devices (computers, NICs, switches, routers, etc.) with adjustable poll intervall down to three seconds. You can use this programm in a professional network environment to monitor selected network interfaces (even backplane ports if the device provides the information) or you can monitor your home network or

6. Colasoft Capsa 4.05
By: Roy Luo
Relevant URL: http://www.colasoft.com/
Platforms: Windows 2000, Windows 95/98, Windows XP
Summary:

Capsa is a powerful but easy to use network monitor and analyzer designed for packet decoding and network diagnosis. With the abilities of real time monitoring and data analyzing, you can capture and decode network traffic transmitted over local host and local network. Capsa has Packet Analysis Module and three advanced analysis modules: Email Analysis Module, Web Analysis Module and Transaction Analysis Module.

VI. UNSUBSCRIBE INSTRUCTIONS
----------------------------
To unsubscribe send an e-mail message to [email protected] from the subscribed address. The contents of the subject or message body do not matter. You will receive a confirmation request message to which you will have to answer. Alternatively you can also visit http://www.securityfocus.com/newsletters and unsubscribe via the website.

If your email address has changed email [email protected] and ask to be manually removed.

VII. SPONSOR INFORMATION
-----------------------

http://www.securityfocus.com/sponsor/Symantec_sf-news_041130

------------------------------------------------------------------------