SecurityFocus Microsoft Newsletter #371

SecurityFocus Microsoft Newsletter #371
----------------------------------------

This issue is Sponsored by: Watchfire

The Twelve Most Common Application-level Hack Attacks
Hackers continue to add billions to the cost of doing business online des=
pite security executives' efforts to prevent malicious attacks. This whit=
epaper identifies the most common methods of attacks that we have seen, a=
nd outlines a guideline for developing secure web applications. Download =
today!=20

https://www.watchfire.com/securearea/whitepapers.aspx?id=3D70170000000940=
0


SECURITY BLOGS
SecurityFocus has selected a few syndicated sources that stand out as con=
veying topics of interest for our community. We are proud to offer conten=
t from Matasano at this time and will be adding more in the coming weeks.
http://www.securityfocus.com/blogs

------------------------------------------------------------------
I.   FRONT AND CENTER
       1.The Man in the Machine
       2.Aye, Robot, or Can Computers Contract?
II.  MICROSOFT VULNERABILITY SUMMARY
       1. avast! Home/Professional TAR File Handling Unspecified Vulnerab=
ility
       2. Microsoft Optical Desktop Wireless Keyboard Weak Encryption Inf=
ormation Disclosure Vulnerability
       3. Microsoft Web Proxy Auto-Discovery Proxy Spoofing Vulnerability
       4. Apple QuickTime Unspecified Remote Vulnerability
       5. Microsoft Windows Media Player AIFF Parsing Divide-By-Zero Deni=
al of Service Vulnerability
       6. Tencent QQ LaunchP2PShare Multiple Stack Buffer Overflow Vulner=
abilities
       7. VanDyke VShell Unspecified Denial Of Service Vulnerability
       8. Samhain Labs Samhain Insecure Random Number Generator Informati=
on Disclosure Weakness
       9. Skype Technologies Skype Voicemail URI Handler Remote Denial of=
 Service Vulnerability
III. MICROSOFT FOCUS LIST SUMMARY
       1. SecurityFocus Microsoft Newsletter #370
IV.  UNSUBSCRIBE INSTRUCTIONS
V.   SPONSOR INFORMATION

I.   FRONT AND CENTER
---------------------
1.The Man in the Machine
By Federico Biancuzzi
In April 2007, when two security researchers demonstrated a flaw in the n=
ext-generation IPv6 routing scheme that would allow attackers to signific=
antly amplify any denial-of-service attack by a factor of at least 80, ne=
tworking expert Jun-ichiro "Itojun" Hagino worked to get Internet enginee=
rs to take the threat seriously.=20
http://www.securityfocus.com/columnists/459

2.Aye, Robot, or Can Computers Contract?
By Mark Rasch
A contract is usually described as a "meeting of the minds." One person m=
akes an offer for goods or services; another person sees the offer and ne=
gotiates terms; the parties enter into an agreement of the offer; and som=
e form of consideration is given in return for the provision of something=
 of value. At least that's what I remember from first year law school con=
tracts class.=20
http://www.securityfocus.com/columnists/458


II.  MICROSOFT VULNERABILITY SUMMARY
------------------------------------
1. avast! Home/Professional TAR File Handling Unspecified Vulnerability
BugTraq ID: 26702
Remote: Yes
Date Published: 2007-12-04
Relevant URL: http://www.securityfocus.com/bid/26702
Summary:
avast! is prone to an unspecified vulnerability.

This issue occurs when the application handles a TAR file.

Versions of avast! Home and Professional prior to 4.7.1098 are affected.

2. Microsoft Optical Desktop Wireless Keyboard Weak Encryption Informatio=
n Disclosure Vulnerability
BugTraq ID: 26693
Remote: Yes
Date Published: 2007-12-04
Relevant URL: http://www.securityfocus.com/bid/26693
Summary:
Microsoft Optical Desktop is prone to an information-disclosure vulnerabi=
lity.=20

Successfully exploiting this issue will allow an attacker to obtain sensi=
tive information that may lead to other attacks.=20

This issue affects Microsoft Optical Desktop 1000 and 2000; other version=
s may also be affected.

3. Microsoft Web Proxy Auto-Discovery Proxy Spoofing Vulnerability
BugTraq ID: 26686
Remote: Yes
Date Published: 2007-12-03
Relevant URL: http://www.securityfocus.com/bid/26686
Summary:
Microsoft Web Proxy Auto-Discovery is prone to a vulnerability that may a=
llow attackers to obtain sensitive information that may lead to further a=
ttacks.

4. Apple QuickTime Unspecified Remote Vulnerability
BugTraq ID: 26682
Remote: Yes
Date Published: 2007-12-03
Relevant URL: http://www.securityfocus.com/bid/26682
Summary:
Apple QuickTime is prone to an unspecified remote vulnerability.=20

Very few technical details are currently available. We will update this B=
ID as more information emerges.

This issue affects Apple QuickTime 7.2 for Microsoft Windows XP; other ve=
rsions may also be affected.

5. Microsoft Windows Media Player AIFF Parsing Divide-By-Zero Denial of S=
ervice Vulnerability
BugTraq ID: 26648
Remote: Yes
Date Published: 2007-11-30
Relevant URL: http://www.securityfocus.com/bid/26648
Summary:
Microsoft Windows Media Player is prone to a denial-of-service vulnerabil=
ity when processing a malformed AIFF file.=20

A remote attacker can exploit this issue to crash the affected applicatio=
n, denying service to legitimate users.

This issue affects Microsoft Windows Media Player 11; other versions may =
also be affected.

6. Tencent QQ LaunchP2PShare Multiple Stack Buffer Overflow Vulnerabiliti=
es
BugTraq ID: 26613
Remote: Yes
Date Published: 2007-11-27
Relevant URL: http://www.securityfocus.com/bid/26613
Summary:
Tencent QQ is prone to multiple stack-based buffer-overflow vulnerabiliti=
es because the application fails to perform adequate boundary checks on u=
ser-supplied data.=20

Successfully exploiting these issues allows remote attackers to execute a=
rbitrary code in the context of the application using the ActiveX control=
 (typically Internet Explorer). Failed exploit attempts likely result in =
denial-of-service conditions.

These issues affect Tencent QQ  2006 and prior versions.

7. VanDyke VShell Unspecified Denial Of Service Vulnerability
BugTraq ID: 26602
Remote: Yes
Date Published: 2007-11-27
Relevant URL: http://www.securityfocus.com/bid/26602
Summary:
VanDyke VShell is prone to a denial-of-service vulnerability.=20

Very few technical details are currently available. We will update this B=
ID as more information emerges.

An attacker can exploit this issue to deny access to legitimate users.

VShell 3.0.1 is vulnerable; other versions may also be affected.

8. Samhain Labs Samhain Insecure Random Number Generator Information Disc=
losure Weakness
BugTraq ID: 26597
Remote: Yes
Date Published: 2007-11-26
Relevant URL: http://www.securityfocus.com/bid/26597
Summary:
Samhain Labs Samhain is prone to an information-disclosure weakness becau=
se of an error in the use of the random number generator.

An attacker can exploit this issue to weaken encryption and other securit=
y-related algorithms, which may aid in further attacks.

The issue affects Samhain 2.4.0 and 2.4.0a. Note that versions prior to 2=
.4.0 are not vulnerable to this issue.

9. Skype Technologies Skype Voicemail URI Handler Remote Denial of Servic=
e Vulnerability
BugTraq ID: 26588
Remote: Yes
Date Published: 2007-11-26
Relevant URL: http://www.securityfocus.com/bid/26588
Summary:
Skype is prone to a remote denial-of-service vulnerability because of a N=
ULL-pointer dereference flaw.

Successfully exploiting this issue allows remote attackers to crash the a=
pplication, denying service to legitimate users.

Skype 3.6.0.216 for Microsoft Windows is vulnerable to this issue; other =
versions may also be affected.

III. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. SecurityFocus Microsoft Newsletter #370
http://www.securityfocus.com/archive/88/484378

IV.  UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to ms-secnews-unsubscribe@securityf=
ocus.com from the subscribed address. The contents of the subject or mess=
age body do not matter. You will receive a confirmation request message t=
o which you will have to answer. Alternatively you can also visit http://=
www.securityfocus.com/newsletters and unsubscribe via the website.

If your email address has changed email [email protected] and a=
sk to be manually removed.

V.   SPONSOR INFORMATION
------------------------
This issue is Sponsored by: Watchfire

The Twelve Most Common Application-level Hack Attacks
Hackers continue to add billions to the cost of doing business online des=
pite security executives' efforts to prevent malicious attacks. This whit=
epaper identifies the most common methods of attacks that we have seen, a=
nd outlines a guideline for developing secure web applications. Download =
today!=20

https://www.watchfire.com/securearea/whitepapers.aspx?id=3D70170000000940=
0