Exploit code appears for Microsoft Agent bug
114833
(InfoWorld) - It took less than 24 hours for attackers to crank out proof-of-concept code targeting the one critical vulnerability disclosed -- and patched -- Tuesday morning by Microsoft, security researchers warned. Early Wednesday, analysts with Symantec's DeepSight threat network alerted customers of JavaScript exploit code for the critical vulnerability in Windows 2000 that was revealed in Microsoft's monthly patch cycle. The proof-of-concept was posted to the Internet by someone with a Brazilian e-mail address. An hour-and-a-half later, Symantec updated its alert to say that additional exploit code was also available to users of Immunity's popular CANVAS penetration testing ("pentest") software. To call attention to the added danger, Symantec also raised the vulnerability's threat score from Tuesday's initial 7.1 (out of a possible 10) to 8.5 today. The Windows 2000 bug -- the only one rated critical of the four patched Tuesday -- is in Windows Agent, the component that drives the operating system's interactive animated help characters. The best known, and in its time, most detested, character was dubbed "Clippy," a.k.a. the Office Assistant, a bouncy paperclip designed to answer users' questions about Microsoft Office. The developer disabled Clippy by default as of Office XP and put it to rest when Office 2007 debuted earlier this year. The JavaScript-based exploit fits nicely with analysis made yesterday by Tom Cross, a researcher with IBM Internet Security Systems' X-Force. The vulnerability, said Cross Tuesday, is in the Agent ActiveX control, which are typically exploited by duping users into visiting Web sites where malicious script code has been planted, and "attackers will use a pretty common attack vector," he said Tuesday. The quick appearance today of proof-of-concept also matches his initial impression. "This uses a pretty common attack vector, and it fits the profile of a lot of bugs." Symantec advised users who were unable to immediately apply the patch to disable their browser's script-handling capabilities. "A successful exploit requires the execution of active content," its advisory said. "To mitigate against this and other latent vulnerabilities, disable support for active content in the browser." VeriSign iDefense, which was credited by Microsoft for reporting the bug, also posted an advisory today; in it, the security vendor spells out how to set the "kill bit" in the Windows registry to disable the Agent ActiveX control. Microsoft has posted its technical write-up of the Agent vulnerability in the MS07-051 security bulletin. Tuesday's update is also a replacement for an earlier April fix of Agent, an indication that the company's developers didn't find all the bugs in the component five months ago. Computerworld is an InfoWorld affiliate
281583
InfoWorld - Security experts have spotted the first attempts to create an Internet worm that propagates using instant messages and exploits a recently disclosed flaw in Microsoft software.
357185
Just one day after&#160;Microsoft issued a massive set of security patches for its software, hackers have begun posting code showing how to exploit one of the flaws.The proof-of-concept code, posted Wednesday to the Milw0rm Web site, exploits a bug in the Microsoft Works file converter software that is part of Office 2003 and can be used to run unauthorized software on a victim&#39;s computer.The flaw also affects Works 8 and Works Suite 2005. To fall prey to the attack, a victim would first have to open a malicious Works attachment.Hackers have uncovered many of these file-format bugs in recent years, and they are generally not used in widespread attacks. In fact, security vendor Symantec predicts that we&#39;ll see fewer of these attacks in the months ahead as online criminals increasingly rely on browser bugs to do their dirty work.&quot;The bad guys, they&#39;re looking for different ways to trick people,&quot; said Wayne Periman, director of development with Symantec Security Response. &quot;The popular method of choice is to exploit plugins in browsers right now.&quot;Still, Periman expects criminals to try out this latest attack code. &quot;It&#39;s so simple,&quot; he said. &quot;All you have to do is get someone to open the document.&quot;As of Wednesday, Symantec had not seen any signs of attackers taking advantage of any of the flaws that Microsoft fixed this week.The software vendor released 11 sets of patches this week, fixing 17 flaws in its products, but this is the first exploit code to pop up following Tuesday&#39;s updates. A second program exploiting one of these vulnerabilities -- this one in an ActiveX control used by the Visual FoxPro database -- was posted to Milw0rm in September, months before Microsoft patched the issue.
42547
(InfoWorld) - Hackers have discovered a new vulnerability in Internet Explorer, and they've released code that could be used to attack users of Microsoft Corp.'s popular browser. The vulnerability is similar to a bug thatÂ Microsoft patched last month in a multimedia component of Internet Explorer, according to Vincent Hwang, a group product manager with Symantec's Security Response team. Though a sample exploit of the vulnerability was posted Wednesday by hackers on the xsec.org Web site, Symantec has yet to see the code used in any attacks, according to Hwang. To take advantage of the exploit code, attackers would first need to trick users into viewing a maliciously encoded Web page, but they could then run unauthorized code on a victim's computer. It is unclear right now which versions of Windows and Internet Explorer are affected by the vulnerability. Researchers at Secunia said they were able to create a "fully working" exploit for the latest version of Windows XP running Internet Explorer 6. Windows 2000 users are also vulnerable, Secunia said. Microsoft security researchers were unavailable to comment on the issue, but a spokesman for the company's public relations agency said that the matter was under investigation. Symantec calls the bug "critical," andÂ Secunia rates the issue as "highly critical," its most severe rating. The xsec.org hackers referred to their code as a 0day, meaning an exploit for a previously undisclosed vulnerability. But one well-known hacker said the flaw was not difficult to find using publicly available security tools, such as the AxMan ActiveX fuzzing software. "Calling it 0day is a stretch," said HD Moore, the head of the Metasploit project, via e-mail. Moore wrote an automated ActiveX testing tool called AxMan that uncovered a handful of IE bugs, including the one exploited by on xsec.org. Although Moore recently launched a project called the Month of Browser Bugs, in which he disclosed a new browser vulnerability every day for the month of July, he said he had refrained from disclosing this particular vulnerability. "This is one of the many exploitable bugs that can be discovered using AxMan and one of the few that I didn't include in Month of Browser bugs due to the ease of exploitation," he said. "I still have three or four left in IE that have similar impact." This is the second unpatched flaw that Microsoft is looking at patching right now. Earlier this month, attackers began exploiting a vulnerability in the company's Word software.
240803
(InfoWorld) - It has become a familiar pattern: A hacker posts exploit code to a security Web site; Microsoft follows soon after with a warning to customers. The pattern was repeated again Thursday, only this time Microsoft's warning that it is investigating "new public reports" of a critical bug in Windows comes more than two months after sample code showing how to take advantage of the flaw was posted to the Web. Microsoft's advisory can beÂ found here. The flaw that Microsoft warned about is in an ActiveX control (called WebViewFolderIcon) used by the Windows' graphical user interface software. It was first disclosed on July 18 as part of aÂ month-longÂ project byÂ hacker HD MooreÂ to expose problems in browser software. Moore's blog post on the flaw can beÂ found here. Moore called his project theÂ "Month of Browser Bugs"Â and ended up disclosing a total of 22 Microsoft vulnerabilities during the period. A few days ago, Moore quietlyÂ added exploit codeÂ for this latest flaw to his Metasploit hacking tool. The exploit caught Microsoft's attention after it was posted to theÂ milw0rm.com Web site,Â Moore said. But the security researcher believes that any competent hacker could have developed an exploit based on his July blog posting. So far, Microsoft has patched only two of Moore's flaws. In fact, Microsoft engineers haven't even been able to investigate close to a third of the vulnerabilities, Moore said. Microsoft executives could not immediately be reached for comment, but the company's security advisory said this latest WebViewFolderIcon bug will be patched on Oct. 10. "We have been in contact with HD Moore and at this time our investigations have revealed that most issues relating to Internet Explorer in particular will result in the browser closing unexpectedly," Microsoft's public relations agency said Thursday in a statement. "Because of their nature, most of these issues will more likely be resolved through a service pack release rather than a security update." Microsoft has been busy this month, rushing out an emergency, "out-of-cycle" fix for a flaw in Internet Explorer's Vector Markup Language (VML) rendering engine that was being widely exploited by attackers. Microsoft has even more work ahead of it, according to Moore. In early August, he handed Microsoft another 70 bugs that he had not publicly disclosed. Still, he believes that more of his flaws should have been fixed by now. "I was kind of amused that they would do an out-of-cycle patch for the VML bug, but would let all of these lapse," he said. Microsoft has told him that at least four of his bugs are "exploitable issues," meaning that an attacker could take advantage of them to run unauthorized software on a victim's computer, Moore said. Earlier this week, SymantecÂ said that Microsoft was the slowest of the major browser-makers at patching its bugs during the first half of this year. But according to Symantec's numbers, Microsoft patched IE bugs, on average, nine days after the public disclosure of a flaw. Most of the 22 Month of Browser Bugs flaws have been in public for two months now.
381915
Microsoft issues patches for holes that could allow remote attackers to gain control of your PC.
262123
A hacker posted exploit code for a Microsoft bug after being denied credit for the find because of his offensive pseudonym.
213499
Update to "critical" Internet Explorer patch repairs a serious security flaw introduced by the original version.
352797
InfoWorld - A security researcher has found a security bug that could be attacked in Internet Explorer. Mozilla said it plans to patch the problem in its next Firefox software update.
663754
Microsoft has confirmed the existence of a vulnerability affecting the Windows Shell. The issue exists in the WebViewFolderIcon ActiveX control, and exploitation could result in an attacker gaining the same rights as a local user.
2243
(InfoWorld) - With attackers finding new ways to exploit aÂ critical flaw in Internet Explorer, Microsoft Corp. has released a patch for the problem, ahead of its next scheduled round of security updates. The patch fixes a critical vulnerability in the way Internet Explorer renders VML (Vector Markup Language) graphics. Hackers had been exploiting the flaw, which also affectsÂ some versions of Outlook, for more than a week, and in recent days malicious activity had been on the upswing. More information on the update, which was released Tuesday, can be foundÂ here. The out-of-cycle release is unusual, but not unprecedented. Microsoft generally releases its security updates on the second Tuesday of every month, giving system administrators a predictable way to set aside time to test the new software. Occasionally, the company will release patches ahead of time if a flaw is being widely exploited by attackers. In January itÂ patched a critical flaw in the Microsoft Windows Metafile (WMF) image-rendering engine after it became a widespread problem. With attack code that works on the latest version of Windows XP now publicly available, the VML bug is shaping up as a very serious concern for administrators, said Ken Dunham, the director of Verisign Inc.'s iDefense Rapid Response Team. VML attacks have now "dwarfed the WMF activity in the same period of time compared to last year," he said. By Tuesday, more than 3,000 Web sites were already infecting users with malware that exploited the VML bug, according to Dunham. One week into the WMF outbreak last January, iDefense saw about 600 sites exploiting the problem. Security experts also warn that there are many variants of the VML malware, some of which may be missed by security software. Researchers at iDefense are now looking at a dozen possible variations of the VML exploit code and have confirmed the existence of seven variants, Dunham said. "With WMF there wasn't nearly as much modification. We see a lot of different permutations and obfuscation techniques being utilize with VML attacks." AÂ group of security researchers released a patch for the VML flaw late last week, independent of Microsoft, but criminals have even found a way to exploit the fix. In the past few days they have been circulating phoney e-mails, claiming to be a patch for the VML problem. If downloaded, this fake patch actually installs malicious software on the victim's system, Dunham said. Microsoft's next regularly scheduled security updates will be released Oct. 10. Â ADVERTISEMENTMAKE SOA REAL WITH IBM WEBSPHERE PODCASTStreamline processes and maximize efficiency within a proven service oriented architecture. Take back control of your business processes with IBM WebSphere.
51437
eEye Digital Security has alerted Microsoft's bug team about a remote code vulnerabilityin Office 2007. Microsoft confirmed that  it's looking into the report.
520483
New computer code that exploits a recently disclosed hole in Microsoft&#39;s Internet Explorer Web browser is circulating on the Internet and could allow remote attackers to take full control of vulnerable Windows machines, according to warnings from
222388
In what may be the first step toward a major security problem, security researchers have released attack code that will crash Windows machines that are susceptible to a recently patched bug in the operating system.The code is not available to the general public. It was released Thursday to security professionals who use Immunity&#39;s Canvas computer security testing software. It causes the Windows system to crash but does not let the attacker run malicious software on the victim&#39;s system.&quot;It reliably crashes Windows machines,&quot; said Dave Aitel, Immunity&#39;s CTO. &quot;In fact, it blue-screened our print server by accident -- this is a broadcast attack, after all.&quot;That&#39;s the biggest concern for security experts who worry that a more dangerous attack may soon follow as researchers dig further into the vulnerability. The bug is particularly troublesome for two reasons. First, it affects a widely used Windows component that is turned on by default. Worse, no user interaction is required to trigger the flaw, meaning that it could be exploited in a self-copying worm attack.Microsoft patched the flaw in its MS08-001 update, released last week, but it takes time for enterprise users to test and install Microsoft&#39;s patches.The flaw lies in the way Windows processes networking traffic that uses IGMP (Internet Group Management Protocol) and the MLD (Multicast Listener Discovery) protocol, which are used to send data to many systems at the same time. The protocols are used by a range of applications, including messaging, Web conferencing, and software distribution products.For a worm attack to work, the attacker would have to send specially crafted packets to a victim&#39;s machine, which could then allow the attacker to run unauthorized code on the PC. The worm could then spread from computer to computer within a LAN but would generally be stopped from travelling to another network by a firewall.A reliable exploit could be combined with malicious botnet software, giving attackers a way to widen the size of their networks of infected computers. The flaw is rated critical for Windows XP and Vista systems, according to Microsoft.After patching the flaw, Microsoft published some technical research indicating that it would be hard for an attacker to exploit this vulnerability.But Aitel believes that Microsoft may have overestimated how difficult it would be to create reliable attack code. Because it could spread so quickly through a network, a reliable exploit &quot;is going to be worth the effort,&quot; Aitel said. &quot;You can be assured lots of smart people are working on it.&quot;Part of the problem is that IT staff may not be aware of how widely these multicasting protocols are used within their companies, said Russ Cooper, a senior network consultant with Verizon Business. &quot;I am extremely worried that this becomes a problem simply because people are unaware of what they&#39;re already allowing,&quot; he said.If one machine were infected within a network subnet, its attempt to attack other machines might not even be noticeable, he added. &quot;It may look like a large file transfer.&quot;
146436
(InfoWorld) - Microsoft's Word and Office programs have been targeted again, with the company warning that hackers may already exploiting a new vulnerability found in the applications. The warning comes just afterÂ the company issued fixesÂ for 20 other bugs in its products on Tuesday, including six for Word. The latest problem affects Office 2000 and Office XP, Microsoft said in a security advisory on Wednesday. An attacker could create a specially-crafted Word document that, if opened, could allow them to control a victim's computer remotely. As usual it advised great caution when opening unsolicited attachments. Microsoft said it had received reports of "very limited, targeted" attacks. Danish security vendor SecuniaÂ ranked the problem as "extremely critical." The emergence of a security bug so soon after Microsoft's scheduled patch release follows a familiar pattern by hackers, who want to maximize the amount of time they have to take advantage of a vulnerability, said Thomas Kristensen, Secunia's chief technical officer. Microsoft rarely diverts from its patch schedule, set for the second Tuesday of the month, although it said it would in this case if it considers it necessary. Office applications such as Word are "low-hanging fruit" for hackers, since the programs haven't been audited as much as some others, such as Internet Explorer, Kristensen said. The hackers find a vulnerability by manipulating a document and testing how Word reads it. In this case, a modified document can corrupt system memory in a way that allows the attacker to execute code on the machine remotely. As well as sending the document via email, the hacker could embed it in a Web page and try to lure users into visiting that page. "Attacking using this vector is fairly easy," Kristensen said. However, new security features in Windows Vista, released to the general public last month, may prevent similar types of attack, so hackers may be making an extra effort to exploit them while they can, he said. Â
217347
Stop us if you've heard this before Security experts warn a new, unpatched vulnerability in Internet Explorer might be used to spread malware. A flaw in Microsoft's Direct Animation Path (daxctle.ocx) ActiveX control, rated as critical by Secunia and other security watchers, has spawned proof of concept code but has not yet become the subject of widespread, hostile attack. Memory corruption is possible even on a fully patched Windows XP system.â¦
321788
Microsoft on Tuesday issued a patch for an earlier discovered flaw in Visual Studio 2005, while yet another cumulative patch for Internet Explorer was released, as well as one for a vulnerability within the Windows Media Format.