SecurityFocus Microsoft Newsletter #327

[email protected] 31 Jan 2007 00:50:56 -0000

Newsgroups	gmane.comp.security.news.microsoft
Message-ID	<[email protected]>

SecurityFocus Microsoft Newsletter #327
----------------------------------------

This Issue is Sponsored by: Black Hat

Black Hat Europe, March 27-30 in Amsterdam, is Europe's premier technical event for ICT security experts.
Featuring 10 hands-on training courses and 30 Briefings presentations with lots of new content-the best of Black Hat focused on Europe's infosec challenges. Network with 400 delegates from 25 nations, and see solutions from major sponsors.

http://www.blackhat.com

------------------------------------------------------------------
I. FRONT AND CENTER
1. The New Vista Waiting Game
2. Testing Fault Injection in Local Applications
II. MICROSOFT VULNERABILITY SUMMARY
1. Bloodshed Dev-C++ CPP Source File Buffer Overflow Vulnerability
2. GD Graphics Library JIS-Encoded Font Buffer Overflow Vulnerability
3. Microsoft Internet Explorer Multiple ActiveX Controls Denial of Service Vulnerabilities
4. Ipswitch WS_FTP 2007 SCP Handling Format String Vulnerability
5. Yahoo! Messenger Notification Message HTML Injection Vulnerability
6. CHM Lib Multiple Unspecified Buffer Overflow Vulnerabilities
7. Microsoft Word 2000 Unspecified Code Execution Vulnerability
8. Computer Associates BrightStor ARCServe BackUp Multiple Remote Buffer Overflow Vulnerabilities
9. Mini Web Server Unspecified Multiple Buffer Overflow Vulnerabilities
10. Microsoft Visual C++ Resource File Buffer Overflow Vulnerability
11. FishCart Olst Parameter SQL Injection Vulnerability
12. KarjaSoft Sami HTTP Server Request Remote Denial of Service Vulnerability
13. SMF Index.PHP HTML Injection Vulnerability
III. MICROSOFT FOCUS LIST SUMMARY
1. SecurityFocus Microsoft Newsletter #326
2. Blocking weblinks in MSN/Live Messenger from central point
3. Performance impact and filesystem audit
4. Automatic spam mover
5. IE security zone assignment on 2003 terminal server
6. IPSec and GRE (47)
IV. UNSUBSCRIBE INSTRUCTIONS
V. SPONSOR INFORMATION

I. FRONT AND CENTER
---------------------
1. The New Vista Waiting Game
By Kelly Martin
Vista is a step forward in security, but many businesses will be stuck with Windows XP for years to come. The cost of upgrading, the value of existing assets, and enterprise application compatibility issues trump the security advantages of Vista today in the classic enterprise waiting game.
http://www.securityfocus.com/columnists/431

2. Testing Fault Injection in Local Applications
By Chris Wysopal
This article is a book excerpt that looks at the approach and techniques used to test the security of local applications. It describes local resources and interprocess communication, how to enumerate the local resources an application depends on, and then discusses methods of testing several of those types of resources. It also describes how to test ActiveX objects, command-line programs, and applications' use of local files and shared memory.
http://www.securityfocus.com/infocus/1886

II. MICROSOFT VULNERABILITY SUMMARY
------------------------------------
1. Bloodshed Dev-C++ CPP Source File Buffer Overflow Vulnerability
BugTraq ID: 22315
Remote: Yes
Date Published: 2007-01-30
Relevant URL: http://www.securityfocus.com/bid/22315
Summary:
Bloodshed Dev-C++ is prone to a remote buffer-overflow vulnerability because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized memory buffer.

An attacker can exploit this issue to crash the affected application, denying service to legitimate users, and may be able to execute arbitrary machine code, but this has not been confirmed.

Bloodshed Dev-C++ version 4.9.9.2 is affected by this issue; other versions may also be vulnerable.

2. GD Graphics Library JIS-Encoded Font Buffer Overflow Vulnerability
BugTraq ID: 22289
Remote: Yes
Date Published: 2007-01-29
Relevant URL: http://www.securityfocus.com/bid/22289
Summary:
The GD graphics library is prone to a buffer-overflow vulnerability.

An attacker can exploit this issue to cause denial-of-service conditions in applications implementing the affected library. Arbitrary code execution may also be possible; this has not been confirmed.

3. Microsoft Internet Explorer Multiple ActiveX Controls Denial of Service Vulnerabilities
BugTraq ID: 22288
Remote: Yes
Date Published: 2007-01-29
Relevant URL: http://www.securityfocus.com/bid/22288
Summary:
Microsoft Internet Explorer is prone to multiple denial-of-service vulnerabilities because the application fails to handle exceptional conditions.

These issues are triggered when an attacker entices a victim user to visit a malicious website.

Remote attackers may exploit these issues to crash Internet Explorer, effectively denying service to legitimate users.

4. Ipswitch WS_FTP 2007 SCP Handling Format String Vulnerability
BugTraq ID: 22275
Remote: Yes
Date Published: 2007-01-27
Relevant URL: http://www.securityfocus.com/bid/22275
Summary:
WS_FTP is prone to a format-string vulnerability because the application fails to properly sanitize user-supplied input before passing it as the format specifier to a formatted-printing function.

A successful attack may allow the attacker to crash the application or possibly to execute arbitrary code. This may facilitate unauthorized access or privilege escalation in the context of the user running the application.

5. Yahoo! Messenger Notification Message HTML Injection Vulnerability
BugTraq ID: 22269
Remote: Yes
Date Published: 2007-01-26
Relevant URL: http://www.securityfocus.com/bid/22269
Summary:
Yahoo! Messenger is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the context of a victim's Internet Explorer temporary folder. This may help the attacker steal information and launch other attacks.

Versions prior to 2.1.0.29 are vulnerable to this issue.

6. CHM Lib Multiple Unspecified Buffer Overflow Vulnerabilities
BugTraq ID: 22258
Remote: Yes
Date Published: 2007-01-26
Relevant URL: http://www.securityfocus.com/bid/22258
Summary:
CHM Lib is prone to multiple buffer-overflow vulnerabilities because it fails to properly bounds-check user-supplied input prior to copying it to insufficiently sized memory buffers.

Successfully exploiting these issues may allow remote attackers to execute arbitrary machine code in the context of users running applications that uses the affected library.

Versions prior to 0.39 are vulnerable to these issues.

7. Microsoft Word 2000 Unspecified Code Execution Vulnerability
BugTraq ID: 22225
Remote: Yes
Date Published: 2007-01-25
Relevant URL: http://www.securityfocus.com/bid/22225
Summary:
Microsoft Word 2000 is prone to an unspecified remote code-execution vulnerability.

Microsoft Word 2000 is confirmed vulnerable to an unspecified remote code-execution issue. Exploit attempts against Word 2003/XP will consume all CPU resources and will cause a denial of service for legitimate users.

Note that this issue is distinct from issues described in BID 21589 (Microsoft Word Code Execution Vulnerability), BID 21451 (Microsoft Word Unspecified Remote Code Execution Vulnerability), and BID 21518 (Microsoft Word Unspecified Code Execution Vulnerability).

8. Computer Associates BrightStor ARCServe BackUp Multiple Remote Buffer Overflow Vulnerabilities
BugTraq ID: 22199
Remote: Yes
Date Published: 2007-01-23
Relevant URL: http://www.securityfocus.com/bid/22199
Summary:
Computer Associates BrightStor ARCServe BackUp is prone to multiple unspecified buffer-overflow vulnerabilities.

The vendor has reported that these vulnerabilities allow remote attackers to execute arbitrary code with SYSTEM privileges facilitating a full compromise. Unsuccessful attacks may cause denial-of-service conditions as well.

These issues affect BrightStor ARCserve Backup for laptops and desktops running Microsoft Windows.

9. Mini Web Server Unspecified Multiple Buffer Overflow Vulnerabilities
BugTraq ID: 22182
Remote: Yes
Date Published: 2007-01-23
Relevant URL: http://www.securityfocus.com/bid/22182
Summary:
Mini Web Server is prone to multiple buffer-overflow vulnerabilities.

A successful exploit may lead to remote arbitrary code execution with the privileges of the server application, facilitating a remote compromise of affected computers.

Mini Web Server 0.04 and prior versions are vulnerable to these issues.

10. Microsoft Visual C++ Resource File Buffer Overflow Vulnerability
BugTraq ID: 22170
Remote: Yes
Date Published: 2007-01-22
Relevant URL: http://www.securityfocus.com/bid/22170
Summary:
Microsoft Visual C++ is prone to a stack-based buffer-overflow vulnerability because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial of service.

11. FishCart Olst Parameter SQL Injection Vulnerability
BugTraq ID: 22166
Remote: Yes
Date Published: 2007-01-22
Relevant URL: http://www.securityfocus.com/bid/22166
Summary:
FishCart is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

12. KarjaSoft Sami HTTP Server Request Remote Denial of Service Vulnerability
BugTraq ID: 22159
Remote: Yes
Date Published: 2007-01-22
Relevant URL: http://www.securityfocus.com/bid/22159
Summary:
Sami HTTP Server is prone to a remote denial-of-service vulnerability.

Exploiting this issue allows remote attackers to crash the server application, denying further service to legitimate users.

13. SMF Index.PHP HTML Injection Vulnerability
BugTraq ID: 22143
Remote: Yes
Date Published: 2007-01-20
Relevant URL: http://www.securityfocus.com/bid/22143
Summary:
SMF is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would execute in the context of the affected website, potentially allowing an attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.

NOTE: To trigger this vulnerability, the attacker must log in with a valid account.

III. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. SecurityFocus Microsoft Newsletter #326
http://www.securityfocus.com/archive/88/458189

2. Blocking weblinks in MSN/Live Messenger from central point
http://www.securityfocus.com/archive/88/458164

3. Performance impact and filesystem audit
http://www.securityfocus.com/archive/88/458163

4. Automatic spam mover
http://www.securityfocus.com/archive/88/458108

5. IE security zone assignment on 2003 terminal server
http://www.securityfocus.com/archive/88/457897

6. IPSec and GRE (47)
http://www.securityfocus.com/archive/88/457813

IV. UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to [email protected] from the subscribed address. The contents of the subject or message body do not matter. You will receive a confirmation request message to which you will have to answer. Alternatively you can also visit http://www.securityfocus.com/newsletters and unsubscribe via the website.

If your email address has changed email [email protected] and ask to be manually removed.

V. SPONSOR INFORMATION
------------------------
This Issue is Sponsored by: Black Hat

http://www.blackhat.com