SecurityFocus Microsoft Newsletter #342

SecurityFocus Microsoft Newsletter #342
----------------------------------------

This Issue is Sponsored by: VeriSign

Increase customer confidence at transaction time with the latest breakthr=
ough in online security - Extended Validation SSL from VeriSign.=20
Extended Validation triggers a green address bar in Microsoft IE7, which =
proves site identity. =20
Learn more at:

http://clk.atdmt.com/SFI/go/srv0890000048sfi/direct/01/


SECURITY BLOGS
SecurityFocus has selected a few syndicated sources that stand out as con=
veying topics of interest for our community. We are proud to offer conten=
t from Matasano at this time and will be adding more in the coming weeks.
http://www.securityfocus.com/blogs

------------------------------------------------------------------
I.   FRONT AND CENTER
       1. Time for a new certification
       2. 0wning Vista from the boot
II.  MICROSOFT VULNERABILITY SUMMARY
       1. BitsCast PubDate Element Remote Denial Of Service Vulnerability
       2. Media Player Classic .MPA Div-By-Zero Denial of Service Vulnera=
bility
       3. DeWizardX ActiveX Control Arbitrary File Overwrite Vulnerabilit=
y
       4. Caucho Resin Multiple Information Disclosure Vulnerabilities
       5. PrecisionID Barcode PrecisionID_DataMatrix.DLL ActiveX Control =
Denial of Service Vulnerability
       6. ID Automation Linear Barcode IDAutomationLinear6.DLL ActiveX Co=
ntrol Denial of Service Vulnerability
       7. CommuniGate Pro Web Mail HTML Injection Vulnerability
       8. yEnc32 Decoder Overly Long Filename Heap Buffer Overflow Vulner=
ability
       9. VooDoo CIrcle Server Multiple Remote Vulnerabilities
       10. NetWin WebMail Unspecified Vulnerability
       11. Microsoft Windows Terminal Services Remote Security Restrictio=
n Bypass Vulnerability
       12. IBM DB2 Universal Database JDBC Applet Server Unspecified Code=
 Execution Vulnerability
       13. Symantec PCAnywhere User Credential Local Information Disclosu=
re Vulnerability
       14. Microsoft Word RTF Parsing Remote Code Execution Vulnerability
       15. Microsoft Windows Media Server MDSAuth.DLL ActiveX Control Rem=
ote Code Execution Vulnerability
       16. Microsoft Office Malformed Drawing Object Remote Code Executio=
n Vulnerability
       17. Microsoft Exchange IMAP Command Processing Remote Denial of Se=
rvice Vulnerability
       18. Microsoft Exchange Base64 MIME Message Remote Code Execution V=
ulnerability
       19. Microsoft Exchange iCal Request Remote Denial of Service Vulne=
rability
       20. Microsoft Outlook Web Access Remote Script Injection Vulnerabi=
lity
       21. Microsoft Word Array Remote Code Execution Vulnerability
       22. Microsoft Capicom ActiveX Control Remote Code Execution Vulner=
ability
       23. Microsoft Excel Filter Records Remote Code Execution Vulnerabi=
lity
       24. Microsoft Excel Set Font Remote Code Execution Vulnerability
       25. Microsoft Internet Explorer HTML Objects Script Errors Remote =
Code Execution Vulnerability
       26. Microsoft Internet Explorer Object Handling Remote Code Execut=
ion Vulnerability
       27. Microsoft Internet Explorer HTML Objects Script Errors Variant=
 Remote Code Execution Vulnerability
       28. Microsoft Internet Explorer Property Method Remote Code Execut=
ion Vulnerability
       29. Microsoft Excel BIFF Record Remote Code Execution Vulnerabilit=
y
       30. Research In Motion Blackberry TeamOn Import Object ActiveX Con=
trol Buffer Overflow Vulnerability
III. MICROSOFT FOCUS LIST SUMMARY
       1. SecurityFocus Microsoft Newsletter #341
IV.  UNSUBSCRIBE INSTRUCTIONS
V.   SPONSOR INFORMATION

I.   FRONT AND CENTER
---------------------
1. Time for a new certification
By Don Parker
I wrote a column for Securityfocus some time ago that aired my concerns o=
ver GIAC dropping the practical portion of their certification process. T=
hat column resulted in a lot of feedback, with most agreeing about how GI=
AC bungled what was up till then, the best certification around.
http://www.securityfocus.com/columnists/443

2. 0wning Vista from the boot
By Federico Biancuzzi
Federico Biancuzzi interviews Nitin and Vipin Kumar, authors of VBootkit,=
 a rootkit that is able to load from Windows Vista boot-sectors. They dis=
cuss the "features" of their code, the support of the various versions of=
 Vista, the possibility to place it inside the BIOS (it needs around 1500=
 bytes), and the chance to use it to bypass Vista's product activation or=
 avoid DRM.
http://www.securityfocus.com/columnists/442


II.  MICROSOFT VULNERABILITY SUMMARY
------------------------------------
1. BitsCast PubDate Element Remote Denial Of Service Vulnerability
BugTraq ID: 23993
Remote: Yes
Date Published: 2007-05-15
Relevant URL: http://www.securityfocus.com/bid/23993
Summary:
BitsCast is prone to a remote denial-of-service vulnerability because it =
fails to adequately sanitize user-supplied input contained in RSS feeds.

An attacker can exploit this issue to crash the application, effectively =
denying service.

BitsCast 0.13.0 is vulnerable; other versions may also be affected.

2. Media Player Classic .MPA Div-By-Zero Denial of Service Vulnerability
BugTraq ID: 23991
Remote: Yes
Date Published: 2007-05-15
Relevant URL: http://www.securityfocus.com/bid/23991
Summary:
Media Player Classic is prone to a denial-of-service vulnerability when p=
rocessing a malformed MPA file.=20

A remote attacker can exploit this issue to crash the affected applicatio=
n, denying service to legitimate users.

This issue affects Media Player Classic 6.4.9.0; other versions may also =
be affected.

3. DeWizardX ActiveX Control Arbitrary File Overwrite Vulnerability
BugTraq ID: 23986
Remote: Yes
Date Published: 2007-05-15
Relevant URL: http://www.securityfocus.com/bid/23986
Summary:
The DeWizardX ActiveX control is prone to an arbitrary-file-overwrite vul=
nerability.=20

An attacker can exploit this issue to overwrite arbitrary files on the af=
fected computer. Successful attacks may aid in further attacks against th=
e computer. Failed attempts will likely cause denial-of-service
conditions.

4. Caucho Resin Multiple Information Disclosure Vulnerabilities
BugTraq ID: 23985
Remote: Yes
Date Published: 2007-05-15
Relevant URL: http://www.securityfocus.com/bid/23985
Summary:
Caucho Resin is prone to multiple information-disclosure vulnerabilities =
because it fails to adequately sanitize user-supplied data.

Attackers can exploit these issues to access potentially sensitive data t=
hat may aid in further attacks.

Resin 3.1.0 is vulnerable; other versions may also be affected.

NOTE: According to the application's 3.1.1 change log, these issues affec=
t the server only when installed on Microsoft Windows.

5. PrecisionID Barcode PrecisionID_DataMatrix.DLL ActiveX Control Denial =
of Service Vulnerability
BugTraq ID: 23957
Remote: Yes
Date Published: 2007-05-13
Relevant URL: http://www.securityfocus.com/bid/23957
Summary:
PrecisionID Barcode ActiveX control is prone to a denial-of-service vulne=
rability because it fails to perform adequate checks on user-supplied inp=
ut data.

Attackers can exploit this issue to crash the browsers of unsuspecting us=
ers, resulting in a denial of service. Remote code execution may also be =
possible, but has not been confirmed.

PrecisionID Barcode ActiveX control 1.3 is vulnerable; other versions may=
 also be affected.

6. ID Automation Linear Barcode IDAutomationLinear6.DLL ActiveX Control D=
enial of Service Vulnerability
BugTraq ID: 23954
Remote: Yes
Date Published: 2007-05-13
Relevant URL: http://www.securityfocus.com/bid/23954
Summary:
ID Automation Linear Barcode ActiveX Control is prone to a denial-of-serv=
ice vulnerability because it fails to perform adequate checks on user-sup=
plied input data.

Attackers can exploit this issue to crash the browsers of unsuspecting us=
ers, resulting in a denial of service. Remote code execution may also be =
possible, but has not been confirmed.

ID Automation Linear Barcode ActiveX Control version 1.6.0.5 is vulnerabl=
e; other versions may also be affected.

7. CommuniGate Pro Web Mail HTML Injection Vulnerability
BugTraq ID: 23950
Remote: Yes
Date Published: 2007-05-12
Relevant URL: http://www.securityfocus.com/bid/23950
Summary:
CommuniGate Pro is prone to an HTML-injection vulnerability because it fa=
ils to sufficiently sanitize user-supplied input.

Exploiting this issue may allow an attacker to execute HTML and script co=
de in the context of the affected site, to steal cookie-based authenticat=
ion credentials, or to control how the site is rendered to the user; othe=
r attacks are also possible.

CommuniGate Pro 5.1.8 and earlier versions are vulnerable to this issue.=20

Note that this issue is present only when using Microsoft Internet Explor=
er.

8. yEnc32 Decoder Overly Long Filename Heap Buffer Overflow Vulnerability
BugTraq ID: 23948
Remote: Yes
Date Published: 2007-05-12
Relevant URL: http://www.securityfocus.com/bid/23948
Summary:
yEnc32 Decoder is prone to a heap-based buffer-overflow issue because it =
fails to properly check boundaries on user-supplied data before  copying =
it into an insufficiently sized memory buffer.

Successfully exploiting this issue allows remote attackers to execute arb=
itrary code in the context of the user running the application. Failed ex=
ploit attempts likely result in denial-of-service conditions.

yEnc32 Decoder 1.0.7.207 is vulnerable.

9. VooDoo CIrcle Server Multiple Remote Vulnerabilities
BugTraq ID: 23929
Remote: Yes
Date Published: 2007-05-11
Relevant URL: http://www.securityfocus.com/bid/23929
Summary:
VooDoo cIRCle is prone to multiple remote vulnerabilities, including mult=
iple denial-of-service issues and a buffer-overflow issue.=20

An attacker can exploit these issues to execute arbitrary code within the=
 context of the affected application or cause the application to crash, d=
enying service to legitimate users.=20

These issues affect VooDoo cIRCle 1.1beta26 and prior versions.

10. NetWin WebMail Unspecified Vulnerability
BugTraq ID: 23908
Remote: Yes
Date Published: 2007-05-09
Relevant URL: http://www.securityfocus.com/bid/23908
Summary:
NetWin Webmail is prone to an unspecified vulnerability.

Few technical details are currently available. We will update this BID as=
 more information emerges.

Webmail versions prior to 3.1s-4 are vulnerable.  NetWin SurgeMail versio=
ns prior to 3.8i3 are also affected because they are bundled with vulnera=
ble Webmail packages.

11. Microsoft Windows Terminal Services Remote Security Restriction Bypas=
s Vulnerability
BugTraq ID: 23899
Remote: Yes
Date Published: 2007-05-09
Relevant URL: http://www.securityfocus.com/bid/23899
Summary:
Microsoft Windows Terminal Services is prone to a remote security-restric=
tion bypass vulnerability because the server software fails to properly e=
nforce encryption requirements.

Users can connect to affected servers; no encryption is required. Attacke=
rs can thus bypass security requirements configured by administrators and=
 perform man-in-the-middle attacks or eavesdrop on RDP sessions.

This issue affects Terminal Services installed on Windows 2003 Server; ot=
her versions may also be affected.

12. IBM DB2 Universal Database JDBC Applet Server Unspecified Code Execut=
ion Vulnerability
BugTraq ID: 23890
Remote: Yes
Date Published: 2007-05-08
Relevant URL: http://www.securityfocus.com/bid/23890
Summary:
IBM DB2 Universal Database is prone to an unspecified remote code-executi=
on vulnerability.

An attacker can exploit this issue to execute arbitrary code in the conte=
xt of the user running the application. Successful attacks can result in =
the compromise of the application or can cause denial-of-service conditio=
ns.

Few technical details are currently available. We will update this BID as=
 more information emerges.

13. Symantec PCAnywhere User Credential Local Information Disclosure Vuln=
erability
BugTraq ID: 23875
Remote: No
Date Published: 2007-05-09
Relevant URL: http://www.securityfocus.com/bid/23875
Summary:
Symantec pcAnywhere is prone to a local information-disclosure vulnerabil=
ity.=20

A local attacker may exploit this issue to gain access to sensitive infor=
mation that may lead to further attacks.

14. Microsoft Word RTF Parsing Remote Code Execution Vulnerability
BugTraq ID: 23836
Remote: Yes
Date Published: 2007-05-08
Relevant URL: http://www.securityfocus.com/bid/23836
Summary:
Microsoft Word is prone to a remote code-execution vulnerability.

An attacker could exploit this issue by enticing a victim to open a malic=
ious Word file. Successfully exploiting this issue would allow the attack=
er to execute arbitrary code in the context of the currently logged-in us=
er.

15. Microsoft Windows Media Server MDSAuth.DLL ActiveX Control Remote Cod=
e Execution Vulnerability
BugTraq ID: 23827
Remote: Yes
Date Published: 2007-05-08
Relevant URL: http://www.securityfocus.com/bid/23827
Summary:
The Microsoft Windows Media Server ActiveX control is prone to a remote c=
ode-execution vulnerability.

An attacker may exploit this issue by enticing victims into opening a mal=
iciously crafted HTML document.

Successful exploits will allow attackers to overwrite certain files to ex=
ecute arbitrary code. This will result in a complete compromise of affect=
ed computers. Failed exploit attempts will likely result in denial-of-ser=
vice conditions.

16. Microsoft Office Malformed Drawing Object Remote Code Execution Vulne=
rability
BugTraq ID: 23826
Remote: Yes
Date Published: 2007-05-08
Relevant URL: http://www.securityfocus.com/bid/23826
Summary:
Microsoft Office is prone to a remote code-execution vulnerability.=20

An attacker may exploit this issue by enticing a victim into opening a ma=
licious Office file.=20

Successful exploits will allow attackers to execute arbitrary code in the=
 context of the currently logged-in user. Failed exploit attempts will li=
kely result in denial-of-service conditions.

17. Microsoft Exchange IMAP Command Processing Remote Denial of Service V=
ulnerability
BugTraq ID: 23810
Remote: Yes
Date Published: 2007-05-08
Relevant URL: http://www.securityfocus.com/bid/23810
Summary:
Microsoft Exchange is prone to a remote denial-of-service vulnerability b=
ecause it fails to properly handle specially crafted IMAP commands.

Successfully exploiting this issue allows remote attackers to cause targe=
ted Exchange servers' mail service to stop responding, thus denying furth=
er email service for legitimate users. To recover from the denial-of-serv=
ice condition, administrators must restart the IIS Admin Service service.

18. Microsoft Exchange Base64 MIME Message Remote Code Execution Vulnerab=
ility
BugTraq ID: 23809
Remote: Yes
Date Published: 2007-05-08
Relevant URL: http://www.securityfocus.com/bid/23809
Summary:
Microsoft Exchange is prone to a remote code-execution vulnerability beca=
use the application fails to properly decode specially crafted email mess=
ages.

Successfully exploiting this issue allows remote attackers to execute arb=
itrary code in the context of the vulnerable application, which may lead =
to a complete compromise of affected computers.

19. Microsoft Exchange iCal Request Remote Denial of Service Vulnerabilit=
y
BugTraq ID: 23808
Remote: Yes
Date Published: 2007-05-08
Relevant URL: http://www.securityfocus.com/bid/23808
Summary:
Microsoft Exchange is prone to a remote denial-of-service vulnerability b=
ecause it fails to properly handle unexpected iCal message content.

Successfully exploiting this issue allows remote attackers to cause targe=
ted Exchange servers to stop responding to further requests for sending, =
receiving, or accessing email. As a result, denial-of-service conditions =
occur for legitimate users of affected servers. A denial-of-service condi=
tion will persist until an administrator restarts the Microsoft Exchange =
Information Store service.

20. Microsoft Outlook Web Access Remote Script Injection Vulnerability
BugTraq ID: 23806
Remote: Yes
Date Published: 2007-05-08
Relevant URL: http://www.securityfocus.com/bid/23806
Summary:
Microsoft Outlook Web Access is prone to a script-injection vulnerability=
 because the application fails to properly handle specially crafted email=
 attachments.

To exploit this issue, attackers must send specially crafted files throug=
h email messages to users of the affected application. When users open th=
e file, attacker-supplied script code will be executed in the context of =
the affected website.

Successful exploits allow attackers to access Outlook Web Access sessions=
 with the privileges of the targeted user. As a result, attackers may be =
able to obtain sensitive information and send, modify, or delete email; o=
ther attacks are also possible.

21. Microsoft Word Array Remote Code Execution Vulnerability
BugTraq ID: 23804
Remote: Yes
Date Published: 2007-05-08
Relevant URL: http://www.securityfocus.com/bid/23804
Summary:
Microsoft Word is prone to a remote code-execution vulnerability.

An attacker could exploit this issue by enticing a victim to open a malic=
ious Word file. Successfully exploiting this issue would allow the attack=
er to execute arbitrary code in the context of the currently logged-in us=
er.

22. Microsoft Capicom ActiveX Control Remote Code Execution Vulnerability
BugTraq ID: 23782
Remote: Yes
Date Published: 2007-05-08
Relevant URL: http://www.securityfocus.com/bid/23782
Summary:
The Microsoft CAPICOM ActiveX control is prone to a remote code-execution=
 vulnerability.=20

An attacker could exploit this issue to execute code in the context of th=
e user visiting a malicious web page.

23. Microsoft Excel Filter Records Remote Code Execution Vulnerability
BugTraq ID: 23780
Remote: Yes
Date Published: 2007-05-08
Relevant URL: http://www.securityfocus.com/bid/23780
Summary:
Microsoft Excel is prone to a remote code-execution vulnerability.

An attacker can exploit this issue to execute arbitrary code in the conte=
xt of a victim user running the application. A successful exploit will re=
sult in the compromise of the application and may aid in further attacks.

24. Microsoft Excel Set Font Remote Code Execution Vulnerability
BugTraq ID: 23779
Remote: Yes
Date Published: 2007-05-08
Relevant URL: http://www.securityfocus.com/bid/23779
Summary:
Microsoft Excel is prone to a remote code-execution vulnerability.

An attacker can exploit this issue to execute arbitrary code in the conte=
xt of a victim user running the application. A successful exploit will re=
sult in the compromise of the application and may aid in further attacks.

25. Microsoft Internet Explorer HTML Objects Script Errors Remote Code Ex=
ecution Vulnerability
BugTraq ID: 23772
Remote: Yes
Date Published: 2007-05-08
Relevant URL: http://www.securityfocus.com/bid/23772
Summary:
Microsoft Internet Explorer is prone to a remote code-execution vulnerabi=
lity.=20

This vulnerability is related to how the browser handles script errors in=
 certain situations. An attacker could exploit this issue to execute arbi=
trary code in the context of the user running the affected browser.

This issue affects Internet Explorer 7 running on Windows XP SP2, Windows=
 Server 2003 SP1 and SP2, and on Windows Vista.

26. Microsoft Internet Explorer Object Handling Remote Code Execution Vul=
nerability
BugTraq ID: 23771
Remote: Yes
Date Published: 2007-05-08
Relevant URL: http://www.securityfocus.com/bid/23771
Summary:
Microsoft Internet Explorer is prone to a remote code-execution vulnerabi=
lity.=20

This vulnerability is related to how the browser handles uninitialized or=
 deleted objects. An attacker could exploit this issue to execute arbitra=
ry code in the context of the user running the affected browser.

27. Microsoft Internet Explorer HTML Objects Script Errors Variant Remote=
 Code Execution Vulnerability
BugTraq ID: 23770
Remote: Yes
Date Published: 2007-05-08
Relevant URL: http://www.securityfocus.com/bid/23770
Summary:
Microsoft Internet Explorer is prone to a remote code-execution vulnerabi=
lity.=20

This vulnerability is related to how the browser handles script errors in=
 certain situations. An attacker could exploit this issue to execute arbi=
trary code in the context of the user running the affected browser.

This issue affects Internet Explorer 7 running on Windows XP SP2, Windows=
 Server 2003 SP1 and SP2, and on Windows Vista.

Microsoft states that this vulnerability is a variant of the issue discus=
sed in BID 23772 (Microsoft Internet Explorer HTML Objects Script Errors =
Remote Code Execution Vulnerability).

28. Microsoft Internet Explorer Property Method Remote Code Execution Vul=
nerability
BugTraq ID: 23769
Remote: Yes
Date Published: 2007-05-08
Relevant URL: http://www.securityfocus.com/bid/23769
Summary:
Microsoft Internet Explorer is prone to remote code-execution vulnerabili=
ty.=20

A remote attacker can exploit this issue to execute arbitrary code in the=
 context of the user running the vulnerable application.

29. Microsoft Excel BIFF Record Remote Code Execution Vulnerability
BugTraq ID: 23760
Remote: Yes
Date Published: 2007-05-08
Relevant URL: http://www.securityfocus.com/bid/23760
Summary:
Microsoft Excel is prone to a remote code-execution vulnerability.

An attacker can exploit this issue to execute arbitrary code in the conte=
xt of a victim user running the application. A successful exploit will re=
sult in the compromise of the application and may aid in further attacks.

30. Research In Motion Blackberry TeamOn Import Object ActiveX Control Bu=
ffer Overflow Vulnerability
BugTraq ID: 23331
Remote: Yes
Date Published: 2007-05-08
Relevant URL: http://www.securityfocus.com/bid/23331
Summary:
The Blackberry TeamOn Import Object ActiveX control is prone to a buffer-=
overflow vulnerability because the software fails to properly bounds-chec=
k user-supplied input before using it in an insufficiently sized buffer.

An attacker can exploit this issue to execute arbitrary machine-code on a=
 vulnerable computer in the context of the victim running the affected ap=
plication.

III. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. SecurityFocus Microsoft Newsletter #341
http://www.securityfocus.com/archive/88/468188

IV.  UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to ms-secnews-unsubscribe@securityf=
ocus.com from the subscribed address. The contents of the subject or mess=
age body do not matter. You will receive a confirmation request message t=
o which you will have to answer. Alternatively you can also visit http://=
www.securityfocus.com/newsletters and unsubscribe via the website.

If your email address has changed email [email protected] and a=
sk to be manually removed.

V.   SPONSOR INFORMATION
------------------------
This Issue is Sponsored by: VeriSign

Increase customer confidence at transaction time with the latest breakthr=
ough in online security - Extended Validation SSL from VeriSign.=20
Extended Validation triggers a green address bar in Microsoft IE7, which =
proves site identity. =20
Learn more at:

http://clk.atdmt.com/SFI/go/srv0890000048sfi/direct/01/