SecurityFocus Microsoft Newsletter #387

SecurityFocus Microsoft Newsletter #387
----------------------------------------

This issue is sponsored by bmighty:

Is Vista Meeting Expectations?
New research from InformationWeek reveals what 600 business-technology pr=
ofessionals have to say about Vista's costs, enhancements & adoption chal=
lenges. A $199 value for FREE.
http://www.bmighty.com/drivers/vista.jhtml?cid=3DLSM-sfV


SECURITY BLOGS
SecurityFocus has selected a few syndicated sources that stand out as con=
veying topics of interest for our community. We are proud to offer conten=
t from Matasano at this time and will be adding more in the coming weeks.
http://www.securityfocus.com/blogs

------------------------------------------------------------------
I.   FRONT AND CENTER
       1.On the Border
       2.Catch Them if You can
II.  MICROSOFT VULNERABILITY SUMMARY
       1. Apple Safari Window.setTimeout Variant Content Spoofing Vulnera=
bility
       2. Apple Safari File Download Remote Denial of Service Vulnerabili=
ty
       3. RETIRED: Microsoft Jet Database Engine MDB File Parsing Remote =
Code Execution Vulnerability
       4. Microsoft Internet Explorer 7 'setRequestHeader()' Multiple Vul=
nerabilities
       5. Microsoft Windows Vista NoDriveTypeAutoRun Automatic File Execu=
tion Vulnerability
       6. Apple Safari CFNetwork Arbitrary Secure Website Spoofing Vulner=
ability
       7. Adobe Flash FLA File Processing Remote Code Execution Vulnerabi=
lities
       8. Apple Safari Web Inspector Remote Code Injection Vulnerability
       9. Apple Safari WebKit Frame Method Cross-Site Scripting Vulnerabi=
lity
       10. Apple Safari WebKit JavaScript Regular Expression Handling Buf=
fer Overflow Vulnerability
       11. Apple Safari WebCore History Object Cross-Site Scripting Vulne=
rability
       12. Apple Safari WebCore 'document.domain' Variant Cross-Site Scri=
pting Vulnerability
       13. Apple Safari WebCore Java Frame Navigation Cross-Site Scriptin=
g Vulnerability
       14. Apple Safari WebCore 'window.open()' Function Cross-Site Scrip=
ting Vulnerability
       15. Apple Safari WebCore 'document.domain' Cross-Site Scripting Vu=
lnerability
       16. Apple Safari Javascript URL Parsing Cross-Site Scripting Vulne=
rability
       17. Apple Safari WebCore 'Kotoeri' Password Field Information Disc=
losure Vulnerability
       18. Apple Safari Error Page Cross-Site Scripting Vulnerability
       19. Check Point VPN-1 IP Address Collision Denial of Service Vulne=
rability
       20. Microsoft Internet Explorer CreateTextRange.text Denial of Ser=
vice Vulnerability
       21. RETIRED: Apple Safari Prior to 3.1 Multiple Security Vulnerabi=
lities
       22. Home FTP Server Remote Denial of Service Vulnerability
III. MICROSOFT FOCUS LIST SUMMARY
       1. SecurityFocus Microsoft Newsletter #386
       2. More along the lines of malware disinfection
IV.  UNSUBSCRIBE INSTRUCTIONS
V.   SPONSOR INFORMATION

I.   FRONT AND CENTER
---------------------
1.On the Border
By Mark Rasch
Recently, I was going through an airport with my shoes, coat, jacket, and=
 belt off as well as with my carry-on bag, briefcase, and laptop all sepa=
rated for easy inspection. I was heading through security at the Washingt=
on D.C., Ronald Reagan National Airport in Arlington, Virginia, or "Natio=
nal" as we locals call it. As I passed through the new magnetometer which=
 gently puffed air all over my body -- which to me seems to be a cross be=
tween a glaucoma test and Marilyn Monroe in Gentlemen Prefer Blondes -- a=
 TSA employee absent-mindedly asked if he could "inspect" my laptop compu=
ter. While the inspection was cursory, the situation immediately gave me =
pause: What was in my laptop anyway?
http://www.securityfocus.com/columnists/469

2.Catch Them if You Can
By Don Parker
High-profile network security breaches have proliferated over the past fe=
w years. While many "breaches" consist of lost data or a stolen laptop, t=
rue breaches -- where a online attacker compromises a network and removes=
 data -- have become very common
http://www.securityfocus.com/columnists/468


II.  MICROSOFT VULNERABILITY SUMMARY
------------------------------------
1. Apple Safari Window.setTimeout Variant Content Spoofing Vulnerability
BugTraq ID: 28405
Remote: Yes
Date Published: 2008-03-22
Relevant URL: http://www.securityfocus.com/bid/28405
Summary:
Apple Safari is prone to a content-spoofing vulnerability that allows att=
ackers to populate a vulnerable Safari browser window with arbitrary mali=
cious content. During such an attack, the URL and window title will displ=
ay the intended site, while the body of the webpage is spoofed.

Safari 3.1 running on Microsoft Windows is reported vulnerable.

NOTE: This issue may be related to the vulnerability discussed in BID 244=
57 (Apple Safari for Windows Window.setTimeout Content Spoofing Vulnerabi=
lity).

2. Apple Safari File Download Remote Denial of Service Vulnerability
BugTraq ID: 28404
Remote: Yes
Date Published: 2008-03-22
Relevant URL: http://www.securityfocus.com/bid/28404
Summary:
Apple Safari is prone to a remote denial-of-service vulnerability.=20

An attacker can exploit this issue to crash the affected application, den=
ying service to legitimate users. Arbitrary code execution may be possibl=
e, but this has not been confirmed.

This issue affects Safari 3.1 running on Microsoft Windows.

3. RETIRED: Microsoft Jet Database Engine MDB File Parsing Remote Code Ex=
ecution Vulnerability
BugTraq ID: 28398
Remote: Yes
Date Published: 2008-03-22
Relevant URL: http://www.securityfocus.com/bid/28398
Summary:
Microsoft Jet Database Engine is prone to a remote code-execution vulnera=
bility.

Remote attackers can exploit this issue to execute arbitrary machine code=
 in the context of a user running affected applications. Successful explo=
its will compromise the affected applications and possibly the underlying=
 computer. Failed attacks will likely cause denial-of-service conditions.

This issue does not affect Windows Server 2003 Service Pack 2, Windows Vi=
sta, and Windows Vista Service Pack 1as they run a non-vulnerable version=
 of the Jet Database Engine.=20

This issue does affect Microsoft Word 2000 Service Pack 3, Microsoft Word=
 2002 Service Pack 3, Microsoft Word 2003 Service Pack 2, Microsoft Word =
2003 Service Pack 3, Microsoft Word 2007, and Microsoft Word 2007 Service=
 Pack 1 on Microsoft Windows 2000, Windows XP, or Windows Server 2003 Ser=
vice Pack 1.

NOTE: This issue is a duplicate of the vulnerability discussed in BID 264=
68 (Microsoft Jet DataBase Engine MDB File Parsing Remote Buffer Overflow=
 Vulnerability).

4. Microsoft Internet Explorer 7 'setRequestHeader()' Multiple Vulnerabil=
ities
BugTraq ID: 28379
Remote: Yes
Date Published: 2008-03-21
Relevant URL: http://www.securityfocus.com/bid/28379
Summary:
Microsoft Internet Explorer 7 is prone to multiple vulnerabilities that a=
llow for referer-spoofing, HTTP-request-splitting, and HTTP-request-smugg=
ling attacks.

A remote attacker may leverage these classes of attacks to poison web cac=
hes, steal credentials, evade IDS signatures, and launch cross-site scrip=
ting, HTML-injection, and session-hijacking attacks. Other attacks are al=
so possible.

This issue reportedly affects Microsoft Internet Explorer 7.

5. Microsoft Windows Vista NoDriveTypeAutoRun Automatic File Execution Vu=
lnerability
BugTraq ID: 28360
Remote: No
Date Published: 2008-03-20
Relevant URL: http://www.securityfocus.com/bid/28360
Summary:
Microsoft Windows Vista is prone to a vulnerability that may allow a file=
 to automatically run because the software fails to handle the 'NoDriveTy=
peAutoRun' registry value.

An attacker may exploit this issue to execute arbitary code. The attacker=
 must entice a victim into attaching a form of removable media, such as a=
 USB drive or CD-ROM.

6. Apple Safari CFNetwork Arbitrary Secure Website Spoofing Vulnerability
BugTraq ID: 28356
Remote: Yes
Date Published: 2008-03-18
Relevant URL: http://www.securityfocus.com/bid/28356
Summary:
Apple Safari is prone to a vulnerability that could allow a malicious HTT=
PS proxy server to spoof a secure website.
=20
 An attacker could exploit this issue to harvest potentially sensitive in=
formation; other attacks are also possible.

NOTE: This vulnerability was previously covered in BID 28290 (Apple Safar=
i Prior to 3.1 Multiple Security Vulnerabilities), but has been given its=
 own record to better document the issue.

7. Adobe Flash FLA File Processing Remote Code Execution Vulnerabilities
BugTraq ID: 28349
Remote: Yes
Date Published: 2008-03-20
Relevant URL: http://www.securityfocus.com/bid/28349
Summary:
Adobe Flash is prone to multiple remote code-execution vulnerabilities.

An attacker may exploit these issues to execute arbitrary code in the con=
text of the affected application. Failed exploit attempts will likely res=
ult in denial-of-service conditions.

These issues affect Flash CS3 Professional, Flash Professional 8, and Fla=
sh Basic 8.

8. Apple Safari Web Inspector Remote Code Injection Vulnerability
BugTraq ID: 28347
Remote: Yes
Date Published: 2008-03-18
Relevant URL: http://www.securityfocus.com/bid/28347
Summary:
Apple Safari is prone to a remote code-injection vulnerability.=20

Attackers may exploit this issue to run script code in other domains and =
access the vulnerable computer's filesystem.
=20
These issues affect versions prior to Apple Safari 3.1 running on Apple M=
ac OS X 10.4.1 and 10.5.2, Microsoft Windows XP, and Windows Vista.

NOTE: This vulnerability was previously covered in BID 28290 (Apple Safar=
i Prior to 3.1 Multiple Security Vulnerabilities), but has been given its=
 own record to better document the issue.

9. Apple Safari WebKit Frame Method Cross-Site Scripting Vulnerability
BugTraq ID: 28342
Remote: Yes
Date Published: 2008-03-18
Relevant URL: http://www.securityfocus.com/bid/28342
Summary:
Apple Safari is prone to a cross-site scripting vulnerability because it =
fails to properly sanitize user-supplied input.

An attacker may leverage this issue to access frame methods in another do=
main. This may help the attacker steal potentially sensitive information =
and launch other attacks.=20

This issue affects versions prior to Apple Safari 3.1 running on Mac OS X=
 10.4.11, and 10.5.2, Microsoft Windows XP, and Windows Vista.

NOTE: This vulnerability was previously covered in BID 28290 (Apple Safar=
i Prior to 3.1 Multiple Security Vulnerabilities), but has been given its=
 own record to better document the issue.

10. Apple Safari WebKit JavaScript Regular Expression Handling Buffer Ove=
rflow Vulnerability
BugTraq ID: 28338
Remote: Yes
Date Published: 2008-03-18
Relevant URL: http://www.securityfocus.com/bid/28338
Summary:
Apple Safari is prone to a buffer-overflow vulnerability.=20

Attackers may exploit this issue to execute arbitrary code or to crash th=
e affected application. Other attacks are also possible.
=20
This issue affects versions prior to Apple Safari 3.1 running on Apple Ma=
c OS X 10.4.1 and 10.5.2, Microsoft Windows XP, and Windows Vista.

NOTE: This vulnerability was previously covered in BID 28290 (Apple Safar=
i Prior to 3.1 Multiple Security Vulnerabilities), but has been given its=
 own record to better document the issue.

11. Apple Safari WebCore History Object Cross-Site Scripting Vulnerabilit=
y
BugTraq ID: 28337
Remote: Yes
Date Published: 2008-03-18
Relevant URL: http://www.securityfocus.com/bid/28337
Summary:
Apple Safari is prone to a cross-site scripting vulnerability because it =
fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in o=
ther frames loaded from the same web page. This may help the attacker ste=
al potentially sensitive information and launch other attacks.=20

This issue affects versions prior to Apple Safari 3.1 running on Mac OS X=
 10.4.11, and 10.5.2, Microsoft Windows XP, and Windows Vista.

NOTE: This vulnerability was previously covered in BID 28290 (Apple Safar=
i Prior to 3.1 Multiple Security Vulnerabilities), but has been given its=
 own record to better document the issue.

12. Apple Safari WebCore 'document.domain' Variant Cross-Site Scripting V=
ulnerability
BugTraq ID: 28336
Remote: Yes
Date Published: 2008-03-18
Relevant URL: http://www.securityfocus.com/bid/28336
Summary:
Apple Safari is prone to a cross-site scripting vulnerability because it =
fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in t=
he browser of an unsuspecting user in the context of another site. This m=
ay help the attacker steal potentially sensitive information and launch o=
ther attacks.=20

This issue affects versions prior to Apple Safari 3.1 running on Mac OS X=
 10.4.11, and 10.5.2, Microsoft Windows XP, and Windows Vista.

NOTE: This vulnerability was previously covered in BID 28290 (Apple Safar=
i Prior to 3.1 Multiple Security Vulnerabilities), but has been given its=
 own record to better document the issue.

13. Apple Safari WebCore Java Frame Navigation Cross-Site Scripting Vulne=
rability
BugTraq ID: 28335
Remote: Yes
Date Published: 2008-03-18
Relevant URL: http://www.securityfocus.com/bid/28335
Summary:
Apple Safari is prone to a cross-site scripting vulnerability because it =
fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in t=
he browser of an unsuspecting user in the context of another site. This m=
ay help the attacker steal cookie-based authentication credentials and la=
unch other attacks.=20

This issue affects versions prior to Apple Safari 3.1 running on Mac OS X=
 10.4.11, and 10.5.2, Microsoft Windows XP, and Windows Vista.

NOTE: This vulnerability was previously covered in BID 28290 (Apple Safar=
i Prior to 3.1 Multiple Security Vulnerabilities), but has been given its=
 own record to better document the issue.

14. Apple Safari WebCore 'window.open()' Function Cross-Site Scripting Vu=
lnerability
BugTraq ID: 28332
Remote: Yes
Date Published: 2008-03-18
Relevant URL: http://www.securityfocus.com/bid/28332
Summary:
Apple Safari is prone to a cross-site scripting vulnerability because it =
fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in t=
he browser of an unsuspecting user in the context of another site. This m=
ay help the attacker steal cookie-based authentication credentials and la=
unch other attacks.=20

This issue affects versions prior to Apple Safari 3.1 running on Mac OS X=
 10.4.11, and 10.5.2, Microsoft Windows XP, and Windows Vista.

NOTE: This vulnerability was previously covered in BID 28290 (Apple Safar=
i Prior to 3.1 Multiple Security Vulnerabilities), but has been given its=
 own record to better document the issue.

15. Apple Safari WebCore 'document.domain' Cross-Site Scripting Vulnerabi=
lity
BugTraq ID: 28330
Remote: Yes
Date Published: 2008-03-18
Relevant URL: http://www.securityfocus.com/bid/28330
Summary:
Apple Safari is prone to a cross-site scripting vulnerability because it =
fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in t=
he browser of an unsuspecting user in the context of another site. This m=
ay help the attacker steal cookie-based authentication credentials and la=
unch other attacks.=20

This issue affects versions prior to Apple Safari 3.1 running on Mac OS X=
 10.4.11, and 10.5.2, Microsoft Windows XP, and Windows Vista.

NOTE: This vulnerability was previously covered in BID 28290 (Apple Safar=
i Prior to 3.1 Multiple Security Vulnerabilities), but has been given its=
 own record to better document the issue.

16. Apple Safari Javascript URL Parsing Cross-Site Scripting Vulnerabilit=
y
BugTraq ID: 28328
Remote: Yes
Date Published: 2008-03-18
Relevant URL: http://www.securityfocus.com/bid/28328
Summary:
Apple Safari is prone to a cross-site scripting vulnerability because it =
fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in t=
he browser of an unsuspecting user in the context of another site. This m=
ay help the attacker steal cookie-based authentication credentials and la=
unch other attacks.=20

This issue affects versions prior to Apple Safari 3.1 running on Mac OS X=
 10.4.11, and 10.5.2, Microsoft Windows XP, and Windows Vista.

NOTE: This vulnerability was previously covered in BID 28290 (Apple Safar=
i Prior to 3.1 Multiple Security Vulnerabilities), but has been given its=
 own record to better document the issue.

17. Apple Safari WebCore 'Kotoeri' Password Field Information Disclosure =
Vulnerability
BugTraq ID: 28326
Remote: Yes
Date Published: 2008-03-18
Relevant URL: http://www.securityfocus.com/bid/28326
Summary:
Apple Safari is prone to an information-disclosure vulnerability.

An attacker can exploit this issue to obtain potentially sensitive inform=
ation that may aid in further attacks.

This issue affects versions prior to Apple Safari 3.1 running on Apple Ma=
c OS X 10.4.1 and 10.5.2, Microsoft Windows XP, and Windows Vista.

NOTE: This vulnerability was previously covered in BID 28290 (Apple Safar=
i Prior to 3.1 Multiple Security Vulnerabilities), but has been given its=
 own record to better document the issue.

18. Apple Safari Error Page Cross-Site Scripting Vulnerability
BugTraq ID: 28321
Remote: Yes
Date Published: 2008-03-18
Relevant URL: http://www.securityfocus.com/bid/28321
Summary:
Apple Safari is prone to a cross-site scripting vulnerability because it =
fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in t=
he browser of an unsuspecting user in the context of another site. This m=
ay help the attacker steal cookie-based authentication credentials and la=
unch other attacks.=20

This issue affects versions prior to Apple Safari 3.1 running on Microsof=
t Windows XP, and Windows Vista.

NOTE: This vulnerability was previously covered in BID 28290 (Apple Safar=
i Prior to 3.1 Multiple Security Vulnerabilities), but has been given its=
 own record to better document the issue.

19. Check Point VPN-1 IP Address Collision Denial of Service Vulnerabilit=
y
BugTraq ID: 28299
Remote: Yes
Date Published: 2008-03-18
Relevant URL: http://www.securityfocus.com/bid/28299
Summary:
Check Point VPN-1 is prone to a denial-of-service vulnerability that can =
allow attackers to obtain sensitive information. The issue occurs because=
 the application fails to adequately handle IP address collisions.

Attackers can exploit this issue to break site-to-site VPN connectivity b=
etween a VPN-1 gateway and a third party, denying access to legitimate us=
ers. If SecuRemote back-connections are enabled, the attacker can leverag=
e this issue to re-route site-to-site VPN traffic from the VPN gateway to=
 their SecuRemote client. Under certain conditions, this will cause data =
that was destined for the third party to be sent to the attacker's client=
 instead. This could contain sensitive information that would aid in furt=
her attacks.

20. Microsoft Internet Explorer CreateTextRange.text Denial of Service Vu=
lnerability
BugTraq ID: 28295
Remote: Yes
Date Published: 2008-03-18
Relevant URL: http://www.securityfocus.com/bid/28295
Summary:
Microsoft Internet Explorer is prone to a denial-of-service vulnerability=
 because the application fails to handle certain JavaScript code.

This issue is triggered when a remote attacker entices a victim to visit =
a malicious site.

Attackers may exploit this issue to crash Internet Explorer, effectively =
denying service to legitimate users.

21. RETIRED: Apple Safari Prior to 3.1 Multiple Security Vulnerabilities
BugTraq ID: 28290
Remote: Yes
Date Published: 2008-03-18
Relevant URL: http://www.securityfocus.com/bid/28290
Summary:
Apple Safari is prone to 12 security vulnerabilities.=20

Attackers may exploit these issues to execute arbitrary code, steal cooki=
e-based authentication credentials, spoof secure websites, obtain sensiti=
ve information, and crash the affected application. Other attacks are als=
o possible.
=20
These issues affect versions prior to Apple Safari 3.1 running on Apple M=
ac OS X 10.4.1 and 10.5.2, Microsoft Windows XP, and Windows Vista.

NOTE: This BID is being retired. The following individual records have be=
en created to fully document all the vulnerabilities that were described =
in this BID:

28356 Apple Safari CFNetwork Arbitrary Secure Website Spoofing Vulnerabil=
ity
28321 Apple Safari Error Page Cross-Site Scripting Vulnerability
28328 Apple Safari Javascript URL Parsing Cross-Site Scripting Vulnerabil=
ity
28330 Apple Safari WebCore 'document.domain' Cross-Site Scripting Vulnera=
bility
28347 Apple Safari Web Inspector Remote Code Injection Vulnerability
28326 Apple Safari WebCore 'Kotoeri' Password Field Information Disclosur=
e Vulnerability
28332 Apple Safari WebCore 'window.open()' Function Cross-Site Scripting =
Vulnerability
28335 Apple Safari WebCore Java Frame Navigation Cross-Site Scripting Vul=
nerability
28336 Apple Safari WebCore 'document.domain' Variant Cross-Site Scripting=
 Vulnerability
28337 Apple Safari WebCore History Object Cross-Site Scripting Vulnerabil=
ity
28338 Apple Safari WebKit JavaScript Regular Expression Handling Buffer O=
verflow Vulnerability
28342 Apple Safari WebKit Frame Method Cross-Site Scripting Vulnerability

22. Home FTP Server Remote Denial of Service Vulnerability
BugTraq ID: 28283
Remote: Yes
Date Published: 2008-03-17
Relevant URL: http://www.securityfocus.com/bid/28283
Summary:
Home FTP Server is prone to a remote denial-of-service vulnerability beca=
use it fails to handle user-supplied input.
=20
Successfully exploiting this issue allows remote attackers to crash the a=
ffected application, denying service to legitimate users.

III. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. SecurityFocus Microsoft Newsletter #386
http://www.securityfocus.com/archive/88/489849

2. More along the lines of malware disinfection
http://www.securityfocus.com/archive/88/489751

IV.  UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to ms-secnews-unsubscribe@securityf=
ocus.com from the subscribed address. The contents of the subject or mess=
age body do not matter. You will receive a confirmation request message t=
o which you will have to answer. Alternatively you can also visit http://=
www.securityfocus.com/newsletters and unsubscribe via the website.

If your email address has changed email [email protected] and a=
sk to be manually removed.

V.   SPONSOR INFORMATION
------------------------
This issue is sponsored by bmighty:

Is Vista Meeting Expectations?
New research from InformationWeek reveals what 600 business-technology pr=
ofessionals have to say about Vista's costs, enhancements & adoption chal=
lenges. A $199 value for FREE.
http://www.bmighty.com/drivers/vista.jhtml?cid=3DLSM-sfV