SecurityFocus Microsoft Newsletter #343

SecurityFocus Microsoft Newsletter #343
----------------------------------------

This Issue is Sponsored by: SPI Dynamics

ALERT: "How A Hacker Launches A Cross-Site Scripting Attack"- White Paper=
=20
Cross-site scripting vulnerabilities in web apps allow hackers to comprom=
ise confidential information, steal cookies and create requests that can =
be mistaken for those of a valid user!! Download this *FREE* white paper =
from SPI Dynamics for a complete guide to protection!
=20
https://download.spidynamics.com/1/ad/xss.asp?Campaign_ID=3D70160000000Cq=
BQ


SECURITY BLOGS
SecurityFocus has selected a few syndicated sources that stand out as con=
veying topics of interest for our community. We are proud to offer conten=
t from Matasano at this time and will be adding more in the coming weeks.
http://www.securityfocus.com/blogs

------------------------------------------------------------------
I.   FRONT AND CENTER
       1. Your Space, My Space, Everybody's Space
II.  MICROSOFT VULNERABILITY SUMMARY
       1. Microsoft VDT Database Designer VDT70.DLL ActiveX Control Denia=
l Of Service Vulnerability
       2. Microsoft Office 2000 UA OUACTRL.OCX ActiveX Control Buffer Ove=
rflow Vulnerability
       3. EScan Agent Service MWAGENT.EXE Remote Buffer Overflow Vulnerab=
ility
       4. Microsoft Internet Information Server Hit Highlighting Authenti=
cation Bypass Vulnerability
       5. Dart ZipLite Compression DartZipLite.DLL ActiveX Control Buffer=
 Overflow Vulnerability
       6. NOD32 Multiple Buffer Overflow Vulnerabilities
       7. GD Graphics Library PNG File Processing Denial of Service Vulne=
rability
       8. Opera Web Browser Torrent File Handling Buffer Overflow Vulnera=
bility
       9. Rational Software Hidden Administrator Unspecified Authenticati=
on Bypass Vulnerability
       10. Magic ISO Maker Cue File Stack Buffer Overflow Vulnerability
       11. PrecisionID Barcode PrecisionID_Barcode.DLL ActiveX Control Ar=
bitrary File Overwrite Vulnerability
       12. PrecisionID Barcode PrecisionID_Barcode.DLL ActiveX Control Bu=
ffer Overflow Vulnerability
       13. NewzCrawler Enclosure Element Remote Denial of Service Vulnera=
bility
       14. BitsCast PubDate Element Remote Denial Of Service Vulnerabilit=
y
       15. Media Player Classic .MPA Div-By-Zero Denial of Service Vulner=
ability
       16. DeWizardX ActiveX Control Arbitrary File Overwrite Vulnerabili=
ty
       17. Caucho Resin Multiple Information Disclosure Vulnerabilities
       18. PrecisionID Barcode PrecisionID_DataMatrix.DLL ActiveX Control=
 Denial of Service Vulnerability
       19. ID Automation Linear Barcode IDAutomationLinear6.DLL ActiveX C=
ontrol Denial of Service Vulnerability
III. MICROSOFT FOCUS LIST SUMMARY
       1. Compromising the Windows Service or Driver failure event sink
IV.  UNSUBSCRIBE INSTRUCTIONS
V.   SPONSOR INFORMATION

I.   FRONT AND CENTER
---------------------
1. Your Space, My Space, Everybody's Space
By Mark Rasch
Privacy is about protecting data when somebody wants it for some purpose.=
 It is easy to protect data that nobody wants.
http://www.securityfocus.com/columnists/444


II.  MICROSOFT VULNERABILITY SUMMARY
------------------------------------
1. Microsoft VDT Database Designer VDT70.DLL ActiveX Control Denial Of Se=
rvice Vulnerability
BugTraq ID: 24127
Remote: Yes
Date Published: 2007-05-23
Relevant URL: http://www.securityfocus.com/bid/24127
Summary:
Microsoft Visual Database Tools Database Designer ActiveX Control is pron=
e to a denial-of-service vulnerability because the application fails to h=
andle overly-long user-supplied strings.

Attackers can exploit this issue to crash Internet Explorer or other appl=
ications that use the vulnerable ActiveX control, resulting in denial-of-=
service conditions.

NOTE: Due to the nature of this vulnerability, attackers may be able to l=
everage the issue to execute remote code, however, this has not been conf=
irmed.

2. Microsoft Office 2000 UA OUACTRL.OCX ActiveX Control Buffer Overflow V=
ulnerability
BugTraq ID: 24118
Remote: Yes
Date Published: 2007-05-23
Relevant URL: http://www.securityfocus.com/bid/24118
Summary:
Microsoft Office 2000 UA ActiveX Control is prone to a buffer-overflow vu=
lnerability because the application fails to bounds-check user-supplied d=
ata before copying it into an insufficiently sized buffer.=20

Successfully exploiting this issue allows remote attackers to execute arb=
itrary code in the context of the application using the ActiveX control (=
typically Internet Explorer). Failed exploit attempts likely result in de=
nial-of-service conditions.

3. EScan Agent Service MWAGENT.EXE Remote Buffer Overflow Vulnerability
BugTraq ID: 24112
Remote: Yes
Date Published: 2007-05-23
Relevant URL: http://www.securityfocus.com/bid/24112
Summary:
eScan is prone to a buffer-overflow vulnerability because it fails to suf=
ficiently bounds-check user-supplied input.=20

An attacker can exploit this issue to execute arbitrary code with SYSTEM-=
level privileges. A successful remote exploit of this issue would result =
in the complete compromise of affected computers.=20

This issue affects eScan 9.0.715.1; other versions may also be affected.

4. Microsoft Internet Information Server Hit Highlighting Authentication =
Bypass Vulnerability
BugTraq ID: 24105
Remote: Yes
Date Published: 2007-05-22
Relevant URL: http://www.securityfocus.com/bid/24105
Summary:
Microsoft IIS is prone to an authentication-bypass vulnerability due to i=
ts implementation of 'Hit-highlighting' functionality.

Attackers can exploit this issue to access private files hosted on an IIS=
 website. Successful exploits may allow attackers to gain access to poten=
tially sensitive information. Other attacks are possible.

NOTE: Presumably, accessing a Trusted Zone may allow attackers to execute=
 commands; this has not been confirmed.

5. Dart ZipLite Compression DartZipLite.DLL ActiveX Control Buffer Overfl=
ow Vulnerability
BugTraq ID: 24099
Remote: Yes
Date Published: 2007-05-22
Relevant URL: http://www.securityfocus.com/bid/24099
Summary:
The Dart ZipLite Compression ActiveX control is prone to a buffer-overflo=
w vulnerability because the application fails to bounds-check user-suppli=
ed data before copying it into an insufficiently sized buffer.=20

Successfully exploiting this issue allows remote attackers to execute arb=
itrary code in the context of the application using the ActiveX control (=
typically Internet Explorer). Failed exploit attempts likely result in de=
nial-of-service conditions.

Dart ZipLite Compression ActiveX control 1.8.5.3 is vulnerable to this is=
sue; other versions may also be affected.

6. NOD32 Multiple Buffer Overflow Vulnerabilities
BugTraq ID: 24098
Remote: No
Date Published: 2007-05-22
Relevant URL: http://www.securityfocus.com/bid/24098
Summary:
NOD32  is prone to multiple stack-based buffer-overflow vulnerabilities b=
ecause the application fails to bounds-check user-supplied data before co=
pying it into an insufficiently sized buffer.=20

An attacker can exploit these issues to execute arbitrary code with SYSTE=
M-level privileges. Successful exploits will result in the complete compr=
omise of affected computers. Failed exploit attempts will cause denial-of=
-service conditions.=20

These issue affects NOD32  2.7 prior to update 2.70.37.0

7. GD Graphics Library PNG File Processing Denial of Service Vulnerabilit=
y
BugTraq ID: 24089
Remote: Yes
Date Published: 2007-05-22
Relevant URL: http://www.securityfocus.com/bid/24089
Summary:
The GD graphics library is prone to a denial-of-service vulnerability.

An attacker can exploit this issue to cause denial-of-service conditions =
in applications implementing the affected library.
=20
GD graphics library 2.0.34 is reported vulnerable; other versions may be =
affected as well.

8. Opera Web Browser Torrent File Handling Buffer Overflow Vulnerability
BugTraq ID: 24080
Remote: Yes
Date Published: 2007-05-21
Relevant URL: http://www.securityfocus.com/bid/24080
Summary:
The Opera Web Browser is prone to a buffer-overflow vulnerability because=
 it fails to sufficiently bounds-check user-supplied input.

Exploiting this issues may allow an attacker to execute arbitrary code wi=
th the privileges of the user running the affected application.

Versions of Opera prior to 9.21 are vulnerable.

NOTE: This issue is reported to affect only Opera running on Microsoft Wi=
ndows.

9. Rational Software Hidden Administrator Unspecified Authentication Bypa=
ss Vulnerability
BugTraq ID: 24049
Remote: Yes
Date Published: 2007-05-18
Relevant URL: http://www.securityfocus.com/bid/24049
Summary:
Hidden Administrator is prone to an unspecified authentication-bypass vul=
nerability.

Attackers can exploit this issue to execute arbitrary code on affected co=
mputers with the privileges of the application.

Hidden Administrator 1.7 is vulnerable; other versions may also be affect=
ed.

10. Magic ISO Maker Cue File Stack Buffer Overflow Vulnerability
BugTraq ID: 24029
Remote: Yes
Date Published: 2007-05-17
Relevant URL: http://www.securityfocus.com/bid/24029
Summary:
Magic ISO Maker is prone to a remote stack-based buffer-overflow vulnerab=
ility because it fails to adequately bounds-check user-supplied data befo=
re copying it to an insufficiently sized memory buffer.=20

Successful exploits may allow attackers to execute arbitrary code with th=
e privileges of the affected library. Failed exploit attempts will likely=
 result in denial-of-service conditions.

Magic ISO Maker 5.4(build239) is vulnerable; other versions may also be a=
ffected.

11. PrecisionID Barcode PrecisionID_Barcode.DLL ActiveX Control Arbitrary=
 File Overwrite Vulnerability
BugTraq ID: 24014
Remote: Yes
Date Published: 2007-05-16
Relevant URL: http://www.securityfocus.com/bid/24014
Summary:
PrecisionID Barcode ActiveX control is prone to a vulnerability that lets=
 an attacker overwrite arbitrary files on the affected computer.=20

PrecisionID Barcode ActiveX control 1.9 is vulnerable; other versions may=
 also be affected.

12. PrecisionID Barcode PrecisionID_Barcode.DLL ActiveX Control Buffer Ov=
erflow Vulnerability
BugTraq ID: 24010
Remote: Yes
Date Published: 2007-05-16
Relevant URL: http://www.securityfocus.com/bid/24010
Summary:
PrecisionID Barcode ActiveX control is prone to a buffer-overflow vulnera=
bility because the application fails to bounds-check user-supplied data b=
efore copying it into an insufficiently sized buffer.=20

Successfully exploiting this issue allows remote attackers to execute arb=
itrary code in the context of the application using the ActiveX control (=
typically Internet Explorer). Failed exploit attempts likely result in de=
nial-of-service conditions.

PrecisionID Barcode ActiveX control 1.9 is vulnerable; other versions may=
 also be affected.

13. NewzCrawler Enclosure Element Remote Denial of Service Vulnerability
BugTraq ID: 23994
Remote: Yes
Date Published: 2007-05-15
Relevant URL: http://www.securityfocus.com/bid/23994
Summary:
NewzCrawler is prone to a denial-of-service vulnerability when processing=
 an RSS feed with an invalid string.=20

A remote attacker can exploit this issue to crash the affected applicatio=
n, denying service to legitimate users.

This issue affects NewzCrawler 1.8; other versions may also be affected.

14. BitsCast PubDate Element Remote Denial Of Service Vulnerability
BugTraq ID: 23993
Remote: Yes
Date Published: 2007-05-15
Relevant URL: http://www.securityfocus.com/bid/23993
Summary:
BitsCast is prone to a remote denial-of-service vulnerability because it =
fails to adequately sanitize user-supplied input contained in RSS feeds.

An attacker can exploit this issue to crash the application, effectively =
denying service.

BitsCast 0.13.0 is vulnerable; other versions may also be affected.

15. Media Player Classic .MPA Div-By-Zero Denial of Service Vulnerability
BugTraq ID: 23991
Remote: Yes
Date Published: 2007-05-15
Relevant URL: http://www.securityfocus.com/bid/23991
Summary:
Media Player Classic is prone to a denial-of-service vulnerability when p=
rocessing a malformed MPA file.=20

A remote attacker can exploit this issue to crash the affected applicatio=
n, denying service to legitimate users.

This issue affects Media Player Classic 6.4.9.0; other versions may also =
be affected.

16. DeWizardX ActiveX Control Arbitrary File Overwrite Vulnerability
BugTraq ID: 23986
Remote: Yes
Date Published: 2007-05-15
Relevant URL: http://www.securityfocus.com/bid/23986
Summary:
The DeWizardX ActiveX control is prone to an arbitrary-file-overwrite vul=
nerability.=20

An attacker can exploit this issue to overwrite arbitrary files on the af=
fected computer. Successful attacks may aid in further attacks against th=
e computer. Failed attempts will likely cause denial-of-service
conditions.

17. Caucho Resin Multiple Information Disclosure Vulnerabilities
BugTraq ID: 23985
Remote: Yes
Date Published: 2007-05-15
Relevant URL: http://www.securityfocus.com/bid/23985
Summary:
Caucho Resin is prone to multiple information-disclosure vulnerabilities =
because it fails to adequately sanitize user-supplied data.

Attackers can exploit these issues to access potentially sensitive data t=
hat may aid in further attacks.

Resin 3.1.0 is vulnerable; other versions may also be affected.

NOTE: According to the application's 3.1.1 change log, these issues affec=
t the server only when installed on Microsoft Windows.

18. PrecisionID Barcode PrecisionID_DataMatrix.DLL ActiveX Control Denial=
 of Service Vulnerability
BugTraq ID: 23957
Remote: Yes
Date Published: 2007-05-13
Relevant URL: http://www.securityfocus.com/bid/23957
Summary:
PrecisionID Barcode ActiveX control is prone to a denial-of-service vulne=
rability because it fails to perform adequate checks on user-supplied inp=
ut data.

Attackers can exploit this issue to crash the browsers of unsuspecting us=
ers, resulting in a denial of service. Remote code execution may also be =
possible, but has not been confirmed.

PrecisionID Barcode ActiveX control 1.3 is vulnerable; other versions may=
 also be affected.

19. ID Automation Linear Barcode IDAutomationLinear6.DLL ActiveX Control =
Denial of Service Vulnerability
BugTraq ID: 23954
Remote: Yes
Date Published: 2007-05-13
Relevant URL: http://www.securityfocus.com/bid/23954
Summary:
ID Automation Linear Barcode ActiveX Control is prone to a denial-of-serv=
ice vulnerability because it fails to perform adequate checks on user-sup=
plied input data.

Attackers can exploit this issue to crash the browsers of unsuspecting us=
ers, resulting in a denial of service. Remote code execution may also be =
possible, but has not been confirmed.

ID Automation Linear Barcode ActiveX Control version 1.6.0.5 is vulnerabl=
e; other versions may also be affected.

III. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. Compromising the Windows Service or Driver failure event sink
http://www.securityfocus.com/archive/88/469330

IV.  UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to ms-secnews-unsubscribe@securityf=
ocus.com from the subscribed address. The contents of the subject or mess=
age body do not matter. You will receive a confirmation request message t=
o which you will have to answer. Alternatively you can also visit http://=
www.securityfocus.com/newsletters and unsubscribe via the website.

If your email address has changed email [email protected] and a=
sk to be manually removed.

V.   SPONSOR INFORMATION
------------------------
This Issue is Sponsored by: SPI Dynamics

ALERT: "How A Hacker Launches A Cross-Site Scripting Attack"- White Paper=
=20
Cross-site scripting vulnerabilities in web apps allow hackers to comprom=
ise confidential information, steal cookies and create requests that can =
be mistaken for those of a valid user!! Download this *FREE* white paper =
from SPI Dynamics for a complete guide to protection!
=20
https://download.spidynamics.com/1/ad/xss.asp?Campaign_ID=3D70160000000Cq=
BQ