SecurityFocus Microsoft Newsletter #452

SecurityFocus Microsoft Newsletter #452
----------------------------------------

This issue is sponsored by Entrust

Entrust SSL Certificates - UCC certificates=20
Secure MS Exchange '07 - up to 10 host names included
Now from only $387/year

http://www.entrust.net/securityfocus-ucc


------------------------------------------------------------------
I.   FRONT AND CENTER
       1.Lazy Workers May Be Deemed Hackers
       2.The Scale of Security
II.  MICROSOFT VULNERABILITY SUMMARY
       1. Code-Crafters Ability Mail Server IMAP FETCH Request Remote Den=
ial Of Service Vulnerability
       2. Apple iTunes '.pls' File Buffer Overflow Vulnerability
       3. Snort Unified1 Output Remote Denial Of Service Vulnerability
       4. HP ProCurve Identity Driven Manager (IDM) Unspecified Privilege=
 Escalation Vulnerability
       5. Adobe Shockwave Player ActiveX Control 'PlayerVersion' Property=
 Remote Buffer Overflow Vulnerability
       6. Notepad++ 'C' and 'CPP' File Handling Remote Stack Buffer Overf=
low Vulnerability
       7. Wireshark 1.2.1 Multiple Vulnerabilities
       8. BRS WebWeaver 'Scripts' Security Bypass Vulnerability
       9. FileCOPA FTP Server 'NOOP' Command Denial Of Service Vulnerabil=
ity
       10. Proland Protector Plus Insecure Program File Permissions Local=
 Privilege Escalation Vulnerability
III. MICROSOFT FOCUS LIST SUMMARY
IV.  UNSUBSCRIBE INSTRUCTIONS
V.   SPONSOR INFORMATION

I.   FRONT AND CENTER
---------------------
1.Lazy Workers May Be Deemed Hackers
By Mark Rasch
From his office job at the Shelby City (Ohio) Wastewater Treatment plant,=
 he was browsing adult Web sites, including one called Adult Friend Finde=
r to meet women. When some of the women asked Wolf for nude pictures, he =
bought a digital camera, took pictures, and e-mailed them using his work =
computer.
http://www.securityfocus.com/columnists/504

2.The Scale of Security
By Adam O'Donnell
Human beings do not naturally understand scale. While we speak of financi=
al transactions in the hundreds of billions of dollars as being something=
 as routine as brushing our teeth, we question the value of programs that=
 cost in the single-digit millions and quibble with friends over dollars.=
 Similarly, there are many problems in our industry that, when explained =
to an outsider, sound like they should have been solved decades ago. It i=
s only when we relate the number of systems that need to be considered in=
 the repair that we truly communicate the difficulty of the problem.
http://www.securityfocus.com/columnists/503


II.  MICROSOFT VULNERABILITY SUMMARY
------------------------------------
1. Code-Crafters Ability Mail Server IMAP FETCH Request Remote Denial Of =
Service Vulnerability
BugTraq ID: 36519
Remote: Yes
Date Published: 2009-09-25
Relevant URL: http://www.securityfocus.com/bid/36519
Summary:
Ability Mail Server is prone to a denial-of-service vulnerability because=
 it fails to adequately handle IMAP requests.

Attackers can exploit this issue to cause the affected application to cra=
sh, denying service to legitimate users.=20

 Versions prior to Ability Mail Server 2.70 are affected.

2. Apple iTunes '.pls' File Buffer Overflow Vulnerability
BugTraq ID: 36478
Remote: Yes
Date Published: 2009-09-22
Relevant URL: http://www.securityfocus.com/bid/36478
Summary:
Apple iTunes is prone to a buffer-overflow  vulnerability because the sof=
tware fails to bounds-check user-supplied data before copying it into an =
insufficiently sized buffer.=20

An attacker can exploit this issue to execute arbitrary code within the c=
ontext of the affected application. Failed exploit attempts will result i=
n a denial-of-service condition.=20

Versions prior to Apple iTunes 9.0.1 are vulnerable.

3. Snort Unified1 Output Remote Denial Of Service Vulnerability
BugTraq ID: 36473
Remote: Yes
Date Published: 2009-09-21
Relevant URL: http://www.securityfocus.com/bid/36473
Summary:
Snort is affected by a denial-of-service vulnerability because the applic=
ation fails to properly process unified1 output.
=20
Attackers can leverage this issue by sending malformed network packets th=
at will produce corrupted logs and alerts, causing denial-of-service cond=
itions.

Snort 2.8.1 through 2.8.4 are affected.

4. HP ProCurve Identity Driven Manager (IDM) Unspecified Privilege Escala=
tion Vulnerability
BugTraq ID: 36462
Remote: No
Date Published: 2009-09-15
Relevant URL: http://www.securityfocus.com/bid/36462
Summary:
HP ProCurve Identity Driven Manager (IDM) is prone to an unspecified priv=
ilege-escalation scripting vulnerability.

 Few technical details are available at this time; we will update this BI=
D as more information emerges.

HP ProCurve Identity Driven Manager (IDM) A.02.03 and A.03.00 running on =
Microsoft Windows 2003 with Internet Authentication Service (IAS) or Micr=
osoft Windows 2008 with Network Policy Server (NPS) are vulnerable.

5. Adobe Shockwave Player ActiveX Control 'PlayerVersion' Property Remote=
 Buffer Overflow Vulnerability
BugTraq ID: 36434
Remote: Yes
Date Published: 2009-09-16
Relevant URL: http://www.securityfocus.com/bid/36434
Summary:
Adobe Shockwave Player ActiveX control is prone to a remote buffer-overfl=
ow vulnerability because the application fails to perform adequate bounda=
ry checks on user-supplied data.

Successful exploits allow remote attackers to execute arbitrary code in t=
he context of the application using the ActiveX control (typically Intern=
et Explorer). Failed exploit attempts likely result in denial-of-service =
conditions.

Shockwave Player 11.5.1.601 is vulnerable; other versions may also be aff=
ected.

6. Notepad++ 'C' and 'CPP' File Handling Remote Stack Buffer Overflow Vul=
nerability
BugTraq ID: 36426
Remote: Yes
Date Published: 2009-09-16
Relevant URL: http://www.securityfocus.com/bid/36426
Summary:
Notepad++ is prone to a stack-based buffer-overflow vulnerability because=
 it fails to perform adequate boundary checks on user-supplied input.

Attackers may leverage this issue to execute arbitrary code in the contex=
t of the application. Failed attacks will cause denial-of-service conditi=
ons.

Notepad++ 5.4.5 is vulnerable; other versions may also be affected.

7. Wireshark 1.2.1 Multiple Vulnerabilities
BugTraq ID: 36408
Remote: Yes
Date Published: 2009-09-15
Relevant URL: http://www.securityfocus.com/bid/36408
Summary:
Wireshark is prone to multiple denial-of-service vulnerabilities.

Exploiting these issues may allow attackers to crash the application and =
deny service to legitimate users.

These issues affect Wireshark 0.99.6 through 1.2.1.

8. BRS WebWeaver 'Scripts' Security Bypass Vulnerability
BugTraq ID: 36399
Remote: Yes
Date Published: 2009-09-15
Relevant URL: http://www.securityfocus.com/bid/36399
Summary:
BRS WebWeaver is prone to a security-bypass vulnerability because it fail=
s to properly validate user-supplied input.

Attackers can exploit this issue to access scripts or perform actions wit=
hout proper authorization.

 BRS WebWeaver 1.33 is vulnerable; other versions may also be affected.

9. FileCOPA FTP Server 'NOOP' Command Denial Of Service Vulnerability
BugTraq ID: 36397
Remote: Yes
Date Published: 2009-09-15
Relevant URL: http://www.securityfocus.com/bid/36397
Summary:
FileCOPA FTP Server is prone to a denial-of-service vulnerability.=20

A successful exploit may allow attackers to halt the server process, resu=
lting in a denial-of-service condition.

FileCOPA FTP Server 5.01 is vulnerable; other versions may also be affect=
ed.

10. Proland Protector Plus Insecure Program File Permissions Local Privil=
ege Escalation Vulnerability
BugTraq ID: 36396
Remote: No
Date Published: 2009-09-15
Relevant URL: http://www.securityfocus.com/bid/36396
Summary:
Proland Protector Plus is prone to a local privilege-escalation vulnerabi=
lity.

A local attacker can exploit this issue to execute arbitrary code with SY=
STEM-level privileges, resulting in a complete compromise of the affected=
 computer.=20

The following versions are affected:

Protector Plus 2009 8.0.E03 for Windows Desktops=20
Protector Plus 2009  8.0.E03 for Windows Server
Protector Plus Professional 9.1.001

III. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
IV.  UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to ms-secnews-unsubscribe@securityf=
ocus.com from the subscribed address. The contents of the subject or mess=
age body do not matter. You will receive a confirmation request message t=
o which you will have to answer. Alternatively you can also visit http://=
www.securityfocus.com/newsletters and unsubscribe via the website.

If your email address has changed email [email protected] and a=
sk to be manually removed.

V.   SPONSOR INFORMATION
------------------------
This issue is sponsored by Entrust

Entrust SSL Certificates - UCC certificates=20
Secure MS Exchange '07 - up to 10 host names included
Now from only $387/year

http://www.entrust.net/securityfocus-ucc