Jump to content


Photo

MS Security Advisories


  • Please log in to reply
313 replies to this topic

#51 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 8,913 posts

Posted 06 September 2006 - 04:23 PM

FYI...

Microsoft Security Advisory (925059)
Vulnerability in Word Could Allow Remote Code Execution
- http://www.microsoft...ory/925059.mspx
Published: September 6, 2006
"Microsoft is investigating new public reports of limited “zero-day” attacks using a vulnerability in Microsoft Word 2000. In order for this attack to be carried out, a user must first open a malicious Word file attached to an e-mail or otherwise provided to them by an attacker...
Mitigating Factors for Microsoft Word Remote Code Execution Vulnerability...
• Users who have installed and are using the Office Document Open Confirmation Tool for Office 2000* will be prompted with Open, Save, or Cancel before opening a document.
* http://www.microsoft...E6-C9538E9F2A2F ...
Workarounds for Microsoft Word Remote Code Vulnerability...
• Use Word Viewer 2003 to open and view files. Word Viewer 2003 does not contain the vulnerable code and is not susceptible to this attack. To download the Word Viewer 2003 for free, visit the following website**:
** http://www.microsoft...89-AB826E7B8FDF ...

.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#52 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 8,913 posts

Posted 12 September 2006 - 03:49 PM

FYI...

Microsoft Security Advisory (925143)
Adobe Security Bulletin: APSB06-11 Flash Player Update to Address Security Vulnerabilities
- http://www.microsoft...ory/925143.mspx
Purpose of Advisory: To make customers aware of a security bulletin and updates that are available from Adobe for Flash Player.
See: http://www.adobe.com.../apsb06-11.html

Microsoft Security Advisory (922582)
Update for Windows
- http://www.microsoft...ory/922582.mspx
Published: September 12, 2006
"Today we are announcing the availability of an update that does not address a security vulnerability, but is a high priority for customers in keeping their systems updated. The update addresses the following issue:
You may receive error code 0x80070002 when you try to update a computer running on Microsoft Windows that has a minifilter-based application installed..."

.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#53 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 8,913 posts

Posted 15 September 2006 - 06:07 AM

FYI...

Microsoft Security Advisory (925444)
Vulnerability in the Microsoft DirectAnimation Path ActiveX Control Could Allow Remote Control Execution
- http://www.microsoft...ory/925444.mspx
Published: September 14, 2006
"Microsoft is investigating new public reports of vulnerability in Microsoft Internet Explorer on Windows 2000 Service Pack 4, on Windows XP Service Pack 1, and on Windows XP Service Pack 2. Customers who are running Windows Server 2003 and Windows Server 2003 Service Pack 1 in their default configurations, with the Enhanced Security Configuration turned on, are not affected. We are also aware of proof of concept code published publicly but we are not aware of any attacks attempting to use the reported vulnerability or of customer impact at this time. We will continue to investigate these public reports. The ActiveX control is the Microsoft DirectAnimation Path ActiveX control, which is included in Daxctle.ocx. Upon completion of this investigation, Microsoft will take the appropriate action to help protect our customers. A security update will be released through our monthly release process or an out-of-cycle security update will be provided, depending on customer needs...
Overview
Purpose of Advisory: To provide customers with initial notification of the publicly disclosed vulnerability. For more information see the “Suggested Actions” section of the security advisory for more information.
Advisory Status: Issue Confirmed, Security Update Planned ..."

.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#54 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 8,913 posts

Posted 19 September 2006 - 01:51 PM

FYI...

Microsoft Security Advisory (925568)
Vulnerability in Vector Markup Language Could Allow Remote Code Execution
- http://www.microsoft...ory/925568.mspx
Published: September 19, 2006
"Microsoft has confirmed new public reports of a vulnerability in the Microsoft Windows implementation of Vector Markup Language (VML) Microsoft is also aware of the public release of detailed exploit code that could be used to exploit this vulnerability. Based on our investigation, this exploit code could allow an attacker to execute arbitrary code on the user's system. Microsoft is aware that this vulnerability is being actively exploited. A security update to address this vulnerability is now being finalized through testing to ensure quality and application compatibility Microsoft’s goal is to release the update on Tuesday, October 10, 2006, or sooner depending on customer needs...
Workarounds -
Microsoft has tested the following workarounds. Although these workarounds will not correct the underlying vulnerability, they help block known attack vectors. When a workaround reduces functionality, it is identified..."

(More detail at the MS Advisory URL.)

.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#55 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 8,913 posts

Posted 22 September 2006 - 10:11 AM

Updated:

Microsoft Security Advisory (925568)
Vulnerability in Vector Markup Language Could Allow Remote Code Execution
- http://www.microsoft...ory/925568.mspx
"• September 21, 2006: Advisory updated with new CVE reference, un-register vgx.dll workaround updated, and Outlook Express mitigation added."

(Use the URL above to review updated detail.)

Also see: http://www.us-cert.g.../TA06-262A.html
Revised - September 21, 2006

.

Edited by apluswebmaster, 22 September 2006 - 10:11 AM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#56 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 8,913 posts

Posted 22 September 2006 - 08:24 PM

Updated (again):

Microsoft Security Advisory (925568)
Vulnerability in Vector Markup Language Could Allow Remote Code Execution
- http://www.microsoft...ory/925568.mspx
"• September 22, 2006: Advisory updated with third party security updates FAQ, un-register vgx.dll workaround updated, and ISA Server workaround added."

(Use the URL above to review updated detail.)

.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#57 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 8,913 posts

Posted 26 September 2006 - 03:41 PM

FYI...

Microsoft Security Advisory (925568)
Vulnerability in Vector Markup Language Could Allow Remote Code Execution
- http://www.microsoft...ory/925568.mspx
Updated: September 26, 2006
"...We have issued MS06-055* to address this issue..."
* http://www.microsoft...n/ms06-055.mspx

.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#58 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 8,913 posts

Posted 27 September 2006 - 10:50 PM

FYI...

Microsoft Security Advisory (925984)
Vulnerability in PowerPoint Could Allow Remote Code Execution
- http://www.microsoft...ory/925984.mspx
Published: September 27, 2006
"Microsoft is investigating new public reports of limited “zero-day” attacks using a vulnerability in Microsoft PowerPoint 2000, Microsoft PowerPoint 2002, Microsoft Office PowerPoint 2003, Microsoft PowerPoint 2004 for Mac, and Microsoft PowerPoint v. X for Mac. In order for this attack to be carried out, a user must first open a malicious PowerPoint file attached to an e-mail or otherwise provided to them by an attacker. As a best practice, users should always exercise extreme caution when opening unsolicited attachments from both known and unknown sources..."

.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#59 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 8,913 posts

Posted 29 September 2006 - 06:17 AM

FYI...

Microsoft Security Advisory (926043)
Vulnerability in Windows Shell Could Allow Remote Code Execution
- http://www.microsoft...ory/926043.mspx
Published: September 28, 2006
"Microsoft is investigating new public reports of a vulnerability in supported versions of Microsoft Windows. Customers who are running Windows Server 2003 and Windows Server 2003 Service Pack 1 in their default configurations, with the Enhanced Security Configuration turned on, are not affected. We are also aware of proof of concept code published publicly. We are not aware of any attacks attempting to use the reported vulnerability or of customer impact at this time. We will continue to investigate these public reports. The ActiveX control called out in the public reports and in the Proof of Concept code is the Microsoft WebViewFolderIcon ActiveX control (Web View). The vulnerability exists in Windows Shell and is exposed by Web View. We are working on a security update currently scheduled for an October 10 release..."

(See/use the advisory's URL above for "Mitigating Factors" and "Workarounds".)

.

Edited by apluswebmaster, 29 September 2006 - 06:18 AM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#60 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 8,913 posts

Posted 03 October 2006 - 10:33 AM

FYI...

Microsoft Security Advisory (926043)
Vulnerability in Windows Shell Could Allow Remote Code Execution
- http://www.microsoft...ory/926043.mspx
Revisions:
• October 2, 2006: Advisory updated to advise customers that Web sites that attempt to use this vulnerability to perform limited attacks have been discovered..."

.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#61 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 8,913 posts

Posted 10 October 2006 - 02:18 PM

FYI...

Microsoft Security Advisory (926043)
Vulnerability in Windows Shell Could Allow Remote Code Execution
- http://www.microsoft...ory/926043.mspx
Last Updated: 10/10/2006
"...We have issued MS06-057* to address this issue..."
* http://www.microsoft...n/ms06-057.mspx

Microsoft Security Advisory (925984)
Vulnerability in PowerPoint Could Allow Remote Code Execution
- http://www.microsoft...ory/925984.mspx
Last Updated: 10/10/2006
"...We have issued MS06-058** to address this issue..."
** http://www.microsoft...n/ms06-058.mspx

Microsoft Security Advisory (925059)
Vulnerability in Word Could Allow Remote Code Execution
- http://www.microsoft...ory/925059.mspx
Last Updated: 10/10/2006
"...We have issued MS06-060*** to address this issue..."
*** http://www.microsoft...n/ms06-060.mspx

(Also see : http://www.spywarein...showtopic=86960 )

.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#62 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 8,913 posts

Posted 18 October 2006 - 12:00 PM

FYI...

Microsoft Security Advisory (917021)
Description of the Wi-Fi Protected Access 2 support for Wireless Group Policy in Windows XP Service Pack 2
- http://www.microsoft...ory/917021.mspx
Published: October 17, 2006
"...Overview
Purpose of Advisory: Notification of the availability of an update that enables Wi-Fi Protected Access 2 (WPA2) support for Wireless network Group Policy settings in Windows XP Service Pack 2. Clarification that this update also includes defense-in-depth changes that helps prevent systems from connecting with wireless networks other than those a user intends to connect to.
Advisory Status: Microsoft Knowledge Base Article and associated update were released.
Recommendation: Review the suggested actions and configure as appropriate...
> http://support.microsoft.com/kb/917021
Last Review: October 18, 2006
Revision:3.0...
...Related Software: Microsoft Windows XPSP2 ..."

.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#63 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 8,913 posts

Posted 01 November 2006 - 06:27 AM

FYI...

Microsoft Security Advisory (927709)
Vulnerability in Visual Studio 2005 Could Allow Remote Code Execution
- http://www.microsoft...ory/927709.mspx
Published or Last Updated: 10/31/2006
"Microsoft is investigating public reports of a vulnerability in an ActiveX control in Visual Studio 2005 on Windows. We are aware of proof of concept code published publicly and of the possibility of limited attacks that are attempting to use the reported vulnerability. Customers who are running Visual Studio 2005 on Windows Server 2003 and Windows Server 2003 Service Pack 1 in their default configurations, with the Enhanced Security Configuration turned on, are not affected. Visual Studio 2005 customers who are running Internet Explorer 7 with default settings, are not at risk until this control has been activated through the ActiveX Opt-in Feature in the Internet Zone. Customers would need to visit an attacker’s Web site to be at risk. We will continue to investigate these public reports. The ActiveX control is the WMI Object Broker control, which is included in WmiScriptUtils.dll.
Upon completion of this investigation, Microsoft will take the appropriate action to help protect our customers. A security update will be released through our monthly release process or an out-of-cycle security update will be provided, depending on customer needs..."
(Also see "Mitigating Factors" at the URL above.)

- http://secunia.com/advisories/22603/
Release Date: 2006-11-01
Critical: Extremely critical
"...Solution: Microsoft has recommended various workarounds including setting the kill-bit for the affected ActiveX control (see the vendor's advisory for details)..."

EDIT/ADD:
- http://blogs.technet...709-posted.aspx
November 01, 2006
"...We are aware of the possibility of limited attacks that are attempting to use the reported vulnerability..."
- http://isc.sans.org/...hp?storyid=1813
Last Updated: 2006-11-01 20:45:19 UTC
"...This vulnerability is being **actively exploited**. The advisory states that Microsoft is planning an update for this problem and it should go out in the next monthly patch cycle..."
- http://www.kb.cert.org/vuls/id/854856
Date Last Updated: 11/01/2006
"...Solution: ...Disable the WMI Object Broker ActiveX control in Internet Explorer. The WMI Object Broker ActiveX control can be disabled in Internet Explorer by setting the kill bit for the following CLSID:
{7F5B7F63-F06F-4331-8A26-339E03C0AE3D}
More information about how to set the kill bit is available in Microsoft Support Document 240797*."
* http://support.microsoft.com/kb/240797

.

Edited by apluswebmaster, 01 November 2006 - 04:02 PM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#64 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 8,913 posts

Posted 04 November 2006 - 11:00 AM

FYI...

Microsoft Security Advisory (927892)
Vulnerability in Microsoft XML Core Services Could Allow Remote Code Execution
- http://www.microsoft...ory/927892.mspx
Published: November 3, 2006
"Microsoft is investigating public reports of a vulnerability in the XMLHTTP 4.0 ActiveX Control, part of Microsoft XML Core Services 4.0 on Windows. We are aware of limited attacks that are attempting to use the reported vulnerability. Customers who are running Windows Server 2003 and Windows Server 2003 Service Pack 1 in their default configurations, with the Enhanced Security Configuration turned on, are not affected. Customers would need to visit an attacker’s Web site to be at risk. We will continue to investigate these public reports. Upon completion of this investigation, Microsoft will take the appropriate action to help protect our customers. A security update will be released through our monthly release process or an out-of-cycle security update will be provided, depending on customer needs..."

(Also see "Mitigating Factors" at the URL above.)

EDIT/ADD:
- http://secunia.com/advisories/22687/
Last Update: 2006-11-06
Critical: Extremely critical
Impact: System access
Where: From remote
Solution Status: Unpatched...
Other References: US-CERT VU#585137: http://www.kb.cert.org/vuls/id/585137

- http://www.frsirt.co...ories/2006/4334
Release Date: 2006-11-04
"...Solution:
Set a kill bit for the CLSID {88d969c5-f192-11d4-a65f-0040963251e5} :
http://support.microsoft.com/kb/240797
Or disable Active Scripting in the Internet and Local intranet security zones..."

EDIT/ADD:
- http://www.symantec....-110611-5730-99
Updated: November 6, 2006
"...Type: Trojan Horse, Worm
Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP
> Bloodhound.Exploit.96 is a heuristic detection for web pages attempting to exploit the Microsoft XML Core Services setRequestHeader Vulnerability (as described in Microsoft Security Advisory 927892)."

.

Edited by apluswebmaster, 07 November 2006 - 12:03 PM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#65 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 8,913 posts

Posted 14 November 2006 - 08:21 PM

FYI...

Microsoft Security Advisory (927892)
Vulnerability in Microsoft XML Core Services Could Allow Remote Code Execution
- http://www.microsoft...ory/927892.mspx
Last Updated: 11/14/2006
"...We have issued MS06-071* to address this issue...."
* http://www.microsoft...n/MS06-071.mspx

Microsoft Security Advisory (925444)
Vulnerability in the Microsoft DirectAnimation Path ActiveX Control Could Allow Remote Code Execution
- http://www.microsoft...ory/925444.mspx
Last Updated: 11/14/2006
"...We have issued MS06-067** to address this issue..."
** http://www.microsoft...n/ms06-067.mspx

Microsoft Security Advisory (925143)
Adobe Security Bulletin: APSB06-11 Flash Player Update to Address Security Vulnerabilities
- http://www.microsoft...ory/925143.mspx
Last Updated: November 14, 2006
"...We have issued MS06-069*** to address these issues..."
*** http://www.microsoft...n/ms06-069.mspx

.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#66 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 8,913 posts

Posted 18 November 2006 - 08:58 AM

FYI...

Microsoft Security Advisory (928604)
Exploit Code Published Affecting the Workstation Service on Windows 2000
- http://www.microsoft...ory/928604.mspx
Published: November 16, 2006
"Microsoft is aware of public proof of concept code targeting the vulnerability addressed by security update MS06-070. At this time Microsoft has not seen any indications of active exploitation of the vulnerability Microsoft has activated its emergency response process and is continuing to investigate this public report. Microsoft continues to recommend that customers apply the November updates as soon as possible with additional urgency and consideration given to the update detailed in MS06-070*..."
* http://www.microsoft...n/ms06-070.mspx

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#67 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 8,913 posts

Posted 05 December 2006 - 11:15 PM

FYI...

Microsoft Security Advisory (929433)
Vulnerability in Microsoft Word Could Allow Remote Code Execution
- http://www.microsoft...ory/929433.mspx
December 5, 2006
"Microsoft is investigating a new report of limited “zero-day” attacks using a vulnerability in Microsoft Word 2000, Microsoft Word 2002, Microsoft Office Word 2003, Microsoft Word Viewer 2003, Microsoft Word 2004 for Mac, and Microsoft Word 2004 v. X for Mac, as well as Microsoft Works 2004, 2005, and 2006. In order for this attack to be carried out, a user must first open a malicious Word file attached to an e-mail or otherwise provided to them by an attacker. As a best practice, users should always exercise extreme caution when opening unsolicited attachments from both known and unknown sources... Upon completion of this investigation, Microsoft will take the appropriate action to help protect our customers. This may include providing a security update through our monthly release process or providing an out-of-cycle security update, depending on customer needs..."

> http://secunia.com/advisories/23232/
Last Update: 2006-12-17
Critical: Extremely critical
Impact: System access
Where: From remote
Solution Status: Unpatched...

- http://blogs.technet...ty-reports.aspx
December 15, 2006
"...Microsoft Security Advisory 929433 applies to all three issues..."

.

Edited by apluswebmaster, 17 December 2006 - 12:15 PM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#68 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 8,913 posts

Posted 14 December 2006 - 10:23 AM

FYI...

Microsoft Security Advisory (927709)
Vulnerability in Visual Studio 2005 Could Allow Remote Code Execution
- http://www.microsoft...ory/927709.mspx
Updated: December 12, 2006
"...We have issued MS06-073* to address this issue..."
* http://www.microsoft...n/ms06-073.mspx

.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#69 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 8,913 posts

Posted 26 January 2007 - 05:56 PM

FYI...

Microsoft Security Advisory (932114)
Vulnerability in Microsoft Word 2000 Could Allow Remote Code Execution
- http://www.microsoft...ory/932114.mspx
January 26, 2007
"Microsoft is investigating new public reports of limited “zero-day” attacks using a vulnerability in Microsoft Word 2000. In order for this attack to be carried out, a user must first open a malicious Word file attached to an e-mail or otherwise provided to them by an attacker. As a best practice, users should always exercise extreme caution when opening unsolicited attachments from both known and unknown sources... Upon completion of this investigation, Microsoft will take the appropriate action to help protect our customers. This may include providing a security update through our monthly release process or providing an out-of-cycle security update, depending on customer needs..."

> http://nvd.nist.gov/...e=CVE-2007-0515

MSRC blog:
- http://blogs.technet...114-posted.aspx
January 26, 2007 ~ "...We are currently investigating a report of a posting of proof of concept code which could allow an attacker to execute code on a user’s machine in their security context by convincing them to open a specially-crafted Word document..."

.

Edited by apluswebmaster, 26 January 2007 - 09:31 PM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#70 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 8,913 posts

Posted 03 February 2007 - 05:42 AM

FYI...

Microsoft Security Advisory (932553)
Vulnerability in Microsoft Office Could Allow Remote Code Execution
- http://www.microsoft...ory/932553.mspx
February 2, 2007
"Microsoft is investigating new public reports of very limited Microsoft Excel “zero-day” attacks using a vulnerability in Microsoft Office 2000, Microsoft Office XP, Microsoft Office 2003, and Microsoft Office 2004 for Mac. In order for this attack to be carried out, a user must first open a malicious Office file attached to an e-mail or otherwise provided to them by an attacker. While we are currently only aware that Excel is the current attack vector, other Office applications are potentially vulnerable..."

.

Edited by apluswebmaster, 03 February 2007 - 05:42 AM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#71 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 8,913 posts

Posted 13 February 2007 - 07:43 PM

FYI...

Microsoft Security Advisory (932553)
Vulnerability in Microsoft Office Could Allow Remote Code Execution
- http://www.microsoft...ory/932553.mspx
Last Updated: 2/13/2007 ~ "...We have issued MS07-015* to address this issue..."
* http://www.microsoft...n/MS07-015.mspx

Microsoft Security Advisory (932114)
Vulnerability in Microsoft Word 2000 Could Allow Remote Code Execution
- http://www.microsoft...ory/932114.mspx
Last Updated: 2/13/2007 ~ "...We have issued MS07-014** to address this issue..."
** http://www.microsoft...n/MS07-014.mspx

Microsoft Security Advisory (929433)
Vulnerability in Microsoft Word Could Allow Remote Code Execution
- http://www.microsoft...ory/929433.mspx
Last Updated: 2/13/2007 ~ "...We have issued MS07-014** to address this issue..."


.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#72 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 8,913 posts

Posted 15 February 2007 - 06:21 AM

FYI...

Microsoft Security Advisory (933052)
Vulnerability in Microsoft Word Could Allow Remote Code Execution
- http://www.microsoft...ory/933052.mspx
February 14, 2007 ~ "Microsoft is investigating new public reports of very limited, targeted attacks against Microsoft Word “zero-day” using a vulnerability in Microsoft Office 2000 and Microsoft Office XP. In order for this attack to be carried out, a user must first open a malicious Office file attached to an e-mail or otherwise provided to them by an attacker. As a best practice, users should always exercise extreme caution when opening unsolicited attachments from both known and unknown sources..."

> http://secunia.com/advisories/24122/

.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#73 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 8,913 posts

Posted 29 March 2007 - 03:46 PM

FYI...

Microsoft Security Advisory (935423)
Vulnerability in Windows Animated Cursor Handling
- http://www.microsoft...ory/935423.mspx
March 29, 2007 ~ "Microsoft is investigating new public reports of targeted attacks exploiting a vulnerability in the way Microsoft Windows handles animated cursor (.ani) files. In order for this attack to be carried out, a user must either visit a Web site that contains a Web page that is used to exploit the vulnerability or view a specially crafted e-mail message or email attachment sent to them by an attacker. As a best practice, users should always exercise extreme caution when opening or viewing unsolicited emails and email attachments from both known and unknown sources... ."

- http://isc.sans.org/...ml?storyid=2534
Last Updated: 2007-03-29 19:35:05 UTC
"...Mitigation:
- Microsoft is reporting that users of Internet Explorer 7 with Protected Mode* are protected from active exploitation. Note that this does not apply to Outlook !;
- Anti-virus detection is very spotty. We've tested some of the exploits and they were detected by Windows Live OneCare 1.2306 and McAfee 4995. One specific file was also discovered by a product triggering on a signature written for MS05-002, a similar vulnerability from 2005. This will not apply to most exploits in the wild..."
* http://www.microsoft...ware.mspx#EZPAC
"...This setting only works in Internet Explorer 7 with Windows Vista..."

> http://www.avertlabs...rch/blog/?p=230
"...Preliminary tests demonstrate that Internet Explorer 6 and 7 running on a fully patched Windows XP SP2 are vulnerable to this attack. Windows XP SP0 and SP1 do not appear to be vulnerable, nor does Firefox 2.0..."

> http://preview.tinyurl.com/26y4f8
(TrendMicro)

> http://nvd.nist.gov/...e=CVE-2007-1765

- http://isc.sans.org/...ml?storyid=2539
Last Updated: 2007-03-30 10:40:08 UTC ~ "A short overview of how the different email clients (in the supported list of Microsoft) are reacting to the animated cursor vulnerability depending on the actions and settings of the email client. The surprising element is that read in plain text mode makes some of the clients more vulnerable and actually only offers real added value for Outlook 2003..."
(Chart available at the URL above.)

> http://www.us-cert.gov/current/#WINANI

.

Edited by apluswebmaster, 31 March 2007 - 06:41 AM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#74 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 8,913 posts

Posted 31 March 2007 - 10:22 PM

FYI...

Microsoft Security Advisory (935423)
Vulnerability in Windows Animated Cursor Handling
- http://www.microsoft...ory/935423.mspx
... • March 31, 2007: Advisory revised to add additional information regarding Windows 2003 Service Pack 2, Microsoft Windows Server 2003 with SP2 for Itanium-based Systems, and Microsoft Windows Server 2003 x64 Edition Service Pack 2 in the “Related Software” section."

:eek:

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#75 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 8,913 posts

Posted 03 April 2007 - 09:09 PM

FYI...

Microsoft Security Advisory (935423)
Vulnerability in Windows Animated Cursor Handling
- http://www.microsoft...ory/935423.mspx
Updated: April 3, 2007 ~ "Microsoft has completed the investigation into a public report of attacks exploiting a vulnerability in the way Microsoft Windows handles animated cursor (.ani) files. We have issued MS07-017 to address this issue..."
* http://www.microsoft...n/MS07-017.mspx

.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#76 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 8,913 posts

Posted 13 April 2007 - 05:08 AM

FYI...

Microsoft Security Advisory (935964)
Vulnerability in RPC on Windows DNS Server Could Allow Remote Code Execution.
- http://www.microsoft...ory/935964.mspx
April 12, 2007 ~ "Microsoft is investigating new public reports of a limited attack exploiting a vulnerability in the Domain Name System (DNS) Server Service in Microsoft Windows 2000 Server Service Pack 4, Windows Server 2003 Service Pack 1, and Windows Server 2003 Service Pack 2. Microsoft Windows 2000 Professional Service Pack 4, Windows XP Service Pack 2, and Windows Vista are not affected as these versions do not contain the vulnerable code. Microsoft’s initial investigation reveals that the attempts to exploit this vulnerability could allow an attacker to run code in the security context of the Domain Name System Server Service, which by default runs as Local SYSTEM.
Upon completion of this investigation, Microsoft will take appropriate action to help protect our customers..."

> http://isc.sans.org/...ml?storyid=2627
Last Updated: 2007-04-13 04:42:08 UTC ...(Version: 2)
"...Microsoft has a few suggested actions that can mitigate the risk with the caveat that some tools may break.
1. Disable remote management over RPC for the DNS server via a registry key setting.
2. Block unsolicited inbound traffic on ports 1024-5000 using IPsec or other firewall.
3. Enable the advanced TCP/IP Filtering options on the appropriate interfaces of the server..."

> http://www.us-cert.gov/current/#winrpc

.

Edited by apluswebmaster, 13 April 2007 - 05:42 AM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#77 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 8,913 posts

Posted 13 April 2007 - 04:58 PM

More info...

- http://isc.sans.org/...ml?storyid=2633
Last Updated: 2007-04-13 21:06:53 UTC ~ "...We have knowledge of a successful attack that occurred on April 4, 2007. This appears to be an opportunistic attack (instead of a targeted attack). So it's likely that others have been compromised as well. If you have a vulnerable MS DNS server (Win2K SP4 or Win2003 SP1 or SP2) accessible to the Internet and don't have ports above 1024 blocked, then you may have already been targeted in an attack. At this point, there seems to be a very small number of known compromises...
Update: If you have a large number of domain controllers and want to automate the disabling of RPC, check out this blog entry: http://preview.tinyurl.com/2ymwsv "

:!:

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#78 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 8,913 posts

Posted 14 April 2007 - 05:49 PM

Updated...

- http://isc.sans.org/...ml?storyid=2633
Last Updated: 2007-04-14 14:30:08 UTC ...(Version: 2)
"Update 2: We have two confirmed sources that were attacked on April 4th and 5th. Both were universities in the US. The initial report was from the Information Security Office at Carnegie Mellon University. Nice catch guys! The attacking source IP was the same in both cases: 61.63.227.125
Here is the attack details from the Carnegie Mellon folks. First, a TCP port scan to ports 1024-2048. Then a TCP connection to the right TCP port running the vulnerable RPC service. Shellcode binds to TCP port 1100. Attacker uploads a VBscript on this port and then runs it. VBscript downloads an executable DUP.EXE (MD5: a5ae220fec052a1f2cd22b4eb89a442e) from 203.66.151.92/images/. Executable is self-extracting and contains PWDUMP v5 and an associated DLL.
Update 3: There is now a publicly available exploit for this
vulnerability in Metasploit 3"

:!:

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#79 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 8,913 posts

Posted 18 April 2007 - 06:49 AM

Updates...

Microsoft Security Advisory (935964)
Vulnerability in RPC on Windows DNS Server Could Allow Remote Code Execution.
- http://www.microsoft...ory/935964.mspx
Revisions:
• April 12, 2007: Advisory published.
• April 13, 2007: Advisory updated to include additional details about Windows Small Business Server. Mitigations also updated to include additional information regarding the affected network port range and firewall configuration. Additional details also provided for registry key mitigation values. .
• April 15, 2007: Advisory “Suggested Actions” section updated to include additional information regarding TCP and UDP port 445 and the 15 character computer name known issue.
• April 16, 2007: Advisory updated: Ongoing monitoring indicates that we are seeing a new attack that is attempting to exploit this vulnerability.

.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#80 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 8,913 posts

Posted 21 April 2007 - 11:28 AM

FYI...

New KB article to help deploy DNS remote RPC block workaround throughout enterprise
- http://preview.tinyurl.com/2a65ba
April 20, 2007 7:06 PM ~ "...You can find the KB at
http://support.microsoft.com/kb/936263 ..."
Last Review: April 21, 2007
Revision: 1.0

.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#81 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 8,913 posts

Posted 04 May 2007 - 01:36 PM

FYI...

- http://blogs.technet...tification.aspx
May 03, 2007 ~ "...MS Advisory 935964... The listing of updates slated for Tuesday (May 8, 2007) -does- include the update we’ve been working on for this issue..."

> http://www.spywarein...showtopic=98487


:!:

Edited by apluswebmaster, 04 May 2007 - 01:37 PM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#82 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 8,913 posts

Posted 08 May 2007 - 03:17 PM

FYI...

Microsoft Security Advisory (935964)
Vulnerability in RPC on Windows DNS Server Could Allow Remote Code Execution
- http://www.microsoft...ory/935964.mspx
Updated: May 8, 2007 ~ "...We have issued MS07-029* to address this issue..."

* http://www.microsoft...n/MS07-029.mspx

Also: http://www.spywarein...showtopic=98749

.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#83 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 8,913 posts

Posted 22 May 2007 - 09:03 AM

FYI...

Microsoft Security Advisory (937696)
MS Office Isolated Conversion Environment (MOICE) and File Block Functionality for MS Office
- http://www.microsoft...ory/937696.mspx
Published: May 21, 2007 ~ "...Both features are designed to make it easier for customers to protect themselves from Office files that may contain malicious software, such as unsolicited Office files received from unknown or known sources. MOICE makes it easier by providing new security mitigation technologies designed to convert specific Microsoft Office files types, while File Block provides a mechanism that can control and block the opening of specific Microsoft Office file types. The Microsoft Office Isolated Conversion Environment (MOICE) uses the 2007 Microsoft Office system converters to convert Office 2003 binary documents to the newer Office open XML format. The Conversion process helps protect customers by converting the Office 2003 binary file format to the Office open XML format in an isolated environment. In summary, MOICE provides a mechanism for customers to pre-process potentially unsafe Office 2003 binary documents, by virtue of the conversions process it provides customers with a greater degree of certainty that the document can be considered safe. We encourage Microsoft Office customers to review the related Knowledge base article and consider whether MOICE can help protect users in your IT environment. For more information about this release, see Microsoft Knowledge Base Article 935865*... for MS Office 2003 and the 2007 MS Office..."
* http://support.microsoft.com/kb/935865

.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#84 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 8,913 posts

Posted 23 May 2007 - 04:06 AM

FYI...

Microsoft Security Advisory (927891)
Fix for Windows Installer (MSI)
- http://www.microsoft...ory/927891.mspx
Published: May 22, 2007
"Today we are announcing the availability of an update that does not address a security vulnerability, but is a high priority for customers in keeping their systems updated. The update addresses the following issue:

Your system may appear to become unresponsive when Windows Update or Microsoft Update is scanning for updates that use Windows installer, and you may notice that the CPU usage for the svchost process is showing 100%.
When you try to install an update from Windows Update or from Microsoft Update, you experience the following symptoms:
• Your system may appear to become unresponsive when Windows Update or Microsoft Update is scanning for updates that use Windows Installer.
• You receive an access violation error in svchost.exe. This access violation stops the Server service and the Workstation service.
• A memory leak occurs when Windows Update or Microsoft Update is scanning for updates that use Windows Installer.
• Windows Update or Microsoft Update scans take a very long time, sometimes hours, to complete.

We encourage Windows customers to review and install this update. This update will be offered automatically through Automatic Updates. For more information about this issue, including download links for the available non-security update, please review Microsoft Knowledge Base Article 927891*.
Please note that this update is the first part of a two-part fix that is the comprehensive solution to the problem. In June, another update will involve the Windows Update client. The update for the Windows Update client will also be automatically offered through Automatic Updates."

* http://support.microsoft.com/kb/927891

- http://blogs.technet...ty-updates.aspx
May 22, 2007 ~ "...the issue may prevent you from installing other updates (including security updates) until you apply this new update, so we encourage customers to apply this right away."

:eek:

Edited by apluswebmaster, 23 May 2007 - 04:50 AM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#85 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 8,913 posts

Posted 15 August 2007 - 07:03 AM

FYI...

Microsoft Security Advisory (932596)
Update to Improve Kernel Patch Protection
- http://www.microsoft...ory/932596.mspx
August 14, 2007 - "An update is available for Kernel Patch Protection included with x64-based Windows operating systems. Kernel Patch Protection protects code and critical structures in the Windows kernel from modification by unknown code or data. This update adds additional checks to this protection for increased reliability, performance, and resiliency of Windows. For more information about this release, see Microsoft Knowledge Base Article 932596*..."

* http://support.microsoft.com/kb/932596

.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#86 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 8,913 posts

Posted 11 October 2007 - 05:25 PM

FYI...

Microsoft Security Advisory (943521)
URL Handling Vulnerability in Windows XP and Windows Server 2003 with Windows Internet Explorer 7 Could Allow Remote Code Execution
- http://www.microsoft...ory/943521.mspx
Published: October 10, 2007
"Microsoft is investigating public reports of a remote code execution vulnerability in supported editions of Windows XP and Windows Server 2003 with Windows Internet Explorer 7 installed. We are not aware of attacks that try to use the reported vulnerability or of customer impact at this time. Microsoft is investigating the public reports.
• This vulnerability does not affect Windows Vista or any supported editions of Windows where Internet Explorer 7 is not installed..."

MSRC blog
> http://preview.tinyurl.com/yoadp8
October 10, 2007

Edited by apluswebmaster, 12 October 2007 - 07:11 AM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#87 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 8,913 posts

Posted 26 October 2007 - 07:45 AM

FYI...

URL Update to IE URL Handling Vuln
- http://isc.sans.org/...hp?storyid=3547
Last Updated: 2007-10-26 02:05:06 UTC - "Earlier this month, Microsoft published KB943521. This article acknowledged that third party software had to validate URLs before passing them to Internet Explorer, as Internet Explorer will not validate them. Today, Microsoft published an update to the advisory, suggesting limited exploitation of this vulnerability.
Microsoft does not appear to plan to fix the issue in Internet Explorer. Instead, it asks vendors releasing tools that pass URLs to Internet Explorer to validate them...

Links:

http://www.microsoft...ory/943521.mspx
Revisions:
• October 10, 2007: Advisory published
• October 25, 2007: Advisory updated to reflect increased threat level

http://blogs.technet...ory-943521.aspx "

.

Edited by apluswebmaster, 26 October 2007 - 08:56 AM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#88 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 8,913 posts

Posted 06 November 2007 - 08:02 AM

FYI...

Microsoft Security Advisory (944653)
Vulnerability in Macrovision SECDRV.SYS Driver on Windows Could Allow Elevation of Privilege
- http://www.microsoft...ory/944653.mspx
November 5, 2007 - "Microsoft is working with Macrovision, investigating new public reports of a vulnerability in the Macrovision secdrv.sys driver on supported editions of Windows Server 2003 and Windows XP. This vulnerability does not affect Windows Vista. We are aware of limited attacks that try to use the reported vulnerability. Microsoft is actively monitoring this situation to keep customers informed and to provide customer guidance as necessary. Upon completion of this investigation, Microsoft will take the appropriate action to help protect our customers. This will include providing a security update through our monthly release process..."

> http://www.macrovisi...anding/7352.htm

- http://nvd.nist.gov/...e=CVE-2007-5587

.

Edited by apluswebmaster, 06 November 2007 - 08:26 AM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#89 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 8,913 posts

Posted 08 November 2007 - 06:44 AM

FYI...

Follow-up on Macrovision Secdrv exploit
- http://www.symantec....ion_secdrv.html
November 6, 2007 - "...Microsoft posted Microsoft Security Advisory (944653) about this issue. With the release of this advisory, I’d like to answer a few follow-up questions for blog readers:
Q: I don’t play games and I don’t use Macrovision software, so am I safe?
A: No. The vulnerable component affected by the bug is the Macrovision driver SECDRV.SYS, which is shipped by default with Windows systems. It is usually installed under the %System%\drivers folder.
Q: Is Windows Vista affected by this vulnerability?
A: Vista is not affected. Only SECDRV versions shipped with Windows XP and 2003 are. Instead the version shipped with Vista is a completely different driver, reworked and not vulnerable to this attack.All users should keep in mind that, in a multi-layered defense perspective, it is possible that malware dropped on the system via some other exploit (e.g. browser vulnerability or the recent PDF exploit) could potentially take advantage of the SECDRV bug to take further control of the computer and bypass other layers of protection.
Q: Where is the patch?
A: Macrovision released a version of the driver today (almost identical to the one shipped with Vista) that fixes this problem. The update is available here:
http://www.macrovisi...anding/7352.htm
It’s not clear at the moment if Microsoft will distribute this update with the next cycle of Windows Update."

- http://www.microsoft...ory/944653.mspx
Revisions:
• November 05, 2007: Advisory published
• November 07, 2007: Advisory revised to include indentified workarounds for this vulnerability and additional information on what is secdrv.sys.

.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#90 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 8,913 posts

Posted 04 December 2007 - 07:42 AM

FYI...

Microsoft Security Advisory (945713)
Vulnerability in Web Proxy Auto-Discovery (WPAD) Could Allow Information Disclosure
- http://www.microsoft...ory/945713.mspx
December 3, 2007 - "Microsoft is investigating new public reports of a vulnerability in the way Windows resolves hostnames that do not include a fully-qualified domain name (FQDN). The technology that the vulnerability affects is Web Proxy Auto-Discovery (WPAD). Microsoft has not received any information to indicate that this vulnerability has been publicly used to attack customers, and Microsoft is not aware of any customer impact at this time. Microsoft is aggressively investigating the public reports. Customers whose domain name begins in a third-level or deeper domain, such as “contoso.co.us”, or for whom the following mitigating factors do not apply, are at risk from this vulnerability. Upon completion of this investigation, Microsoft will take the appropriate action to help protect our customers...
Mitigating Factors:
• Customers who do not have a primary DNS suffix configured on their system are not affected by this vulnerability. In most cases, home users that are not members of a domain have no primary DNS suffix configured. Connection-specific DNS suffixes may be provided by some Internet Service Providers (ISPs), and these configurations are not affected by this vulnerability.
• Customers whose DNS domain name is registered as a second-level domain (SLD) below a top-level domain (TLD) are not affected by this vulnerability. Customers whose DNS suffixes reflect this registration would not be affected by this vulnerability. An example of a customer who is not affected is contoso.com or fabrikam.gov, where “contoso” and “fabrikam” are customer registered SLDs under their respective “.com” and “.gov” TLDs.
• Customers who have specified a proxy server via DHCP server settings or DNS are not affected by this vulnerability.
• Customers who have a trusted WPAD server in their organization are not affected by this vulnerability. (See the Workaround section for specific steps in creating a WPAD.DAT file on a WPAD server.)
• Customers who have manually specified a proxy server in Internet Explorer are not at risk from this vulnerability when using Internet Explorer.
• Customers who have disabled 'Automatically Detect Settings' in Internet Explorer are not at risk from this vulnerability when using Internet Explorer..."

- http://secunia.com/advisories/27901/
"...WPAD feature resolves "wpad" hostnames up to the second-level domain, which is potentially untrusted. This can be exploited to conduct man-in-the-middle attacks against third-level or deeper domains..."

.

Edited by apluswebmaster, 04 December 2007 - 07:57 AM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#91 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 8,913 posts

Posted 12 December 2007 - 07:57 AM

FYI...

Microsoft Security Advisory (944653)
Vulnerability in Macrovision SECDRV.SYS Driver on Windows Could Allow Elevation of Privilege
- http://www.microsoft...ory/944653.mspx
Updated: December 11, 2007 - "...We have issued MS07-067* to address this issue..."

* http://www.microsoft...n/MS07-067.mspx

:ph34r:

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#92 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 8,913 posts

Posted 09 January 2008 - 12:13 PM

FYI...

Microsoft Security Advisory (943411)
Update to Improve Windows Sidebar Protection
- http://www.microsoft...ory/943411.mspx
January 8, 2008 - "An update is available for currently supported editions of the Windows Vista operating system. The update to improve Windows Sidebar Protection enables Windows Sidebar to help block gadgets from running in Sidebar. For more information about installing this update, see Microsoft Knowledge Base Article 943411*. For more information about how Windows Sidebar Protection helps block installed gadgets from running in Windows Sidebar, see Microsoft Knowledge Base Article 941411**..."

* http://support.microsoft.com/kb/943411

** http://support.microsoft.com/kb/941411

.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#93 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 8,913 posts

Posted 11 January 2008 - 02:27 PM

FYI...

Microsoft Security Advisory (945713)
Vulnerability in Web Proxy Auto-Discovery (WPAD) Could Allow Information Disclosure
- http://www.microsoft...ory/945713.mspx
Updated: January 9, 2008
Revisions:
• December 3, 2007: Advisory published.
• January 9, 2008: Advisory updated: The registry key for the Configure a Domain Suffix Search List workaround has been corrected to the proper key of SearchList.

.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#94 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 8,913 posts

Posted 16 January 2008 - 06:30 AM

FYI...

Microsoft Security Advisory (947563)
Vulnerability in Microsoft Excel Could Allow Remote Code Execution
- http://www.microsoft...ory/947563.mspx
January 15, 2008 - "Microsoft is investigating new public reports of a vulnerability in Microsoft Office Excel 2003 Service Pack 2, Microsoft Office Excel Viewer 2003, Microsoft Office Excel 2002, Microsoft Office Excel 2000, and Microsoft Excel 2004 for Mac. At this time, our initial investigation indicates that customers who are using Microsoft Office Excel 2007 or Microsoft Excel 2008 for Mac, or who have installed Microsoft Office Excel 2003 Service Pack 3 are not affected by this vulnerability. Microsoft is investigating the public reports and customer impact. Upon completion of this investigation, Microsoft will take the appropriate action... At this time, we are aware only of targeted attacks that attempt to use this vulnerability. Additionally, as the issue has not been publicly disclosed broadly, we believe the risk at this time to be limited...
Note: There are no known workarounds for Microsoft Office Excel 2002 or Microsoft Office Excel 2000 at this time..."

Edited by apluswebmaster, 16 January 2008 - 10:08 AM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#95 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 8,913 posts

Posted 11 March 2008 - 02:25 PM

FYI...

Microsoft Security Advisory (947563)
Vulnerability in Microsoft Excel Could Allow Remote Code Execution
- http://www.microsoft...ory/947563.mspx
Updated: March 11, 2008 - "...We have issued MS08-014* to address this issue..."
* http://www.microsoft...n/MS08-014.mspx

.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#96 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 8,913 posts

Posted 21 March 2008 - 10:50 PM

FYI...

Microsoft Security Advisory (950627)
Vulnerability in Microsoft Jet Database Engine (Jet) Could Allow Remote Code Execution
- http://www.microsoft...ory/950627.mspx
March 21, 2008 - "Microsoft is investigating new public reports of very limited, targeted attacks using a vulnerability in the Microsoft Jet Database Engine that can be exploited through Microsoft Word.
Customers running Windows Server 2003 Service Pack 2, Windows Vista, and Windows Vista Service Pack 1 are not vulnerable to the buffer overrun being attacked, as they include a version of the Microsoft Jet Database Engine that is not vulnerable to this issue.
Customers using Microsoft Word 2000 Service Pack 3, Microsoft Word 2002 Service Pack 3, Microsoft Word 2003 Service Pack 2, Microsoft Word 2003 Service Pack 3, Microsoft Word 2007, and Microsoft Word 2007 Service Pack 1 on Microsoft Windows 2000, Windows XP, or Windows Server 2003 Service Pack 1 are vulnerable to these attacks.
Microsoft is investigating the public reports and customer impact. We are also investigating whether the vulnerability can be exploited through additional applications. Upon completion of this investigation, Microsoft will take the appropriate action to help protect our customers..."

- http://secunia.com/advisories/14896/
Last Update: 2008-03-24
Critical: Highly critical
Impact: System access
Where: From remote
Solution Status: Unpatched...
...affects versions of msjet40.dll prior to 4.0.9505.0...

:ph34r:

Edited by apluswebmaster, 24 March 2008 - 06:29 AM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#97 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 8,913 posts

Posted 25 March 2008 - 06:24 AM

RE: http://www.microsoft...ory/950627.mspx

- http://isc.sans.org/...ml?storyid=4192
Last Updated: 2008-03-25 00:41:39 UTC - "...A few minutes ago Microsoft has posted more details about this issue on the MSRC blog*. Summarizing:
- The Jet Database Engine vulnerability is well-known since March 2005. The main issue now is that it can be exploited through a new attack vector, Microsoft Word (specifically two DOC files), avoiding the mitigations enforced by Outlook and Exchange over this unsafe file type (MDB).
- Microsoft is currently working on the fixes, evaluating if an update may prevent Word from opening MDB files, and checking how to apply the fixed msjet40.dll currently available for Windows Server 2003 SP2, Windows Vista, and beta versions of Windows XP SP3 in other OS versions.
- In the meantime, apart from the general recommendation of not opening untrusted MS Word files, you can follow the two workarounds detailed on the initial advisory:
o Computer-based workaround: Restrict the Microsoft Jet Database Engine from running through the "cacls" command, used to modify the access control lists (ACLs) of files. Applications requiring the Jet Database Engine will not function.
o Infrastructure-based workaround: Block specific files at your mail gateway based on string signatures (if it provides file inspection capabilities). The associated strings plus implementation details for specific mail gateways are detailed on the advisory..."
* http://preview.tinyurl.com/2lvatz

.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#98 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 8,913 posts

Posted 18 April 2008 - 06:57 AM

FYI...

Microsoft Security Advisory (951306)
Vulnerability in Windows Could Allow Elevation of Privilege
- http://www.microsoft...ory/951306.mspx
April 17, 2008 - "Microsoft is investigating new public reports of a vulnerability which could allow elevation of privilege from authenticated user to LocalSystem, affecting Windows XP Professional Service Pack 2 and all supported versions and editions of Windows Server 2003, Windows Vista, and Windows Server 2008. Customers who allow user-provided code to run in an authenticated context, such as within Internet Information Services (IIS) and SQL Server, should review this advisory. Hosting providers may be at increased risk from this elevation of privilege vulnerability. Currently, Microsoft is not aware of any attacks attempting to exploit the potential vulnerability. Upon completion of this investigation, Microsoft will take the appropriate action to protect our customers..."

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#99 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 8,913 posts

Posted 16 May 2008 - 11:36 AM

FYI...

Microsoft Security Advisory (950627)
Vulnerability in Microsoft Jet Database Engine Could Allow Remote Code Execution
- http://www.microsoft...ory/950627.mspx
Updated: May 13, 2008 - "...We have issued Microsoft Security Bulletin MS08-028 to address this issue. For more information about this issue, including download links for an available security update, please review MS08-028*... In addition to immediately installing the update in Microsoft Security Bulletin MS08-028, we recommend that customers with Microsoft Word also immediately install the update in Microsoft Security Bulletin MS08-026**: Vulnerabilities in Microsoft Word Could Allow Remote Code Execution (951207), for the most up-to-date protection against the attack vector for these types of attacks..."

* http://go.microsoft..../?LinkId=114750

** http://go.microsoft..../?LinkId=117295

.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#100 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 8,913 posts

Posted 31 May 2008 - 12:54 AM

FYI...

Microsoft Security Advisory (953818)
Blended Threat from Combined Attack Using Apple’s Safari on the Windows Platform
- http://www.microsoft...ory/953818.mspx
Published: May 30, 2008 - "Microsoft is investigating new public reports of a blended threat that allows remote code execution on all supported versions of Windows XP and Windows Vista when Apple’s Safari for Windows has been installed. Safari is not installed with Windows XP or Windows Vista by default; it must be installed independently or through the Apple Software Update application. Customers running Safari on Windows should review this advisory.
At the present time, Microsoft is unaware of any attacks attempting to exploit this blended threat. Upon completion of this investigation, Microsoft will take the appropriate measures to protect our customers. This may include providing a solution through a service pack, the monthly update process, or an out-of-cycle security update, depending on customers needs.
Mitigating Factors:
Customers who have changed the default location where Safari downloads content to the local drive are -not- affected by this blended threat."
- http://blogs.technet...818-posted.aspx
May 30, 2008

- http://secunia.com/advisories/30467/
Release Date: 2008-06-02
Critical: Highly critical
Impact: System access
Where: From remote
Solution Status: Unpatched
OS: Microsoft Windows Vista, Microsoft Windows XP Home Edition, Microsoft Windows XP Professional
Software: Safari for Windows 3.x
...The vulnerability is reported in Safari running on Windows XP or Vista.
Solution: Set the download location in Safari to a location other than "Desktop"...
Original Advisory: http://www.microsoft...ory/953818.mspx

Edited by apluswebmaster, 02 June 2008 - 05:01 AM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.





2 user(s) are reading this topic

0 members, 2 guests, 0 anonymous users

Member of ASAP and UNITE
Support SpywareInfo Forum - click the button