Microsoft Patches Flaw That Could Trigger Worm Attack
266105
Microsoft fixes a critical flaw in the Windows operating system that could be used by criminals to create a self-copying PC worm attack.
438457
(InfoWorld) - Microsoft on Tuesday issued six security updates for Windows, Office, and .Net Framework, patching a total of 11 vulnerabilities -- five of them rated critical. The most serious of the batch is MS07-039, said security analysts who, unlike lastÂ  month, had no trouble naming that critical update as the one which should beÂ  patched first. "By far, this is the top of the list this month," said Andrew Storms, director of security operations at nCircle Network Security Inc. MS07-039 patches a pair of bugs in Active Directory in Windows 2000 Server and Windows Server 2003, the two supported server editions of Microsoft's operating system. The most dangerous of the two is a vulnerability in the way Active Directory validates an LDAP (Lightweight Directory Access Protocol) request.Â  According to Microsoft's write-up, "an attacker who successfully exploited this vulnerability could take complete control of an affected system." "Definitely at the top of today's list," agreed David Dewey, a researcher with IBM Internet Security Systems' X-Force team. "It's definitely exploitable." Dewey should know, since it was a colleague at ISS, Neel Mehta, who discovered the flaw last summer. "Neel's created proof-of-concept code in-house during the time we worked on this with Microsoft," said Dewey. "It would certainly be worth the effort" to exploit this, added Storms. "Active Directory is in the center of every Windows network. There's a lot in there, including the group policy objects that set security -- and everything about every user." Unlike most vulnerabilities, the Active Directory bug can be exploited without any user interaction, and on Windows 2000 Server, the older of the two operating systems, it can be attacked by an anonymous user. Although Windows Server 2003 may look safer at first glance -- an attacker must have valid credentials to exploit the bug on that edition -- looks can be deceiving, said Tom Cross, another X-Force researcher. "In this case, the authentication requirements become less important," said Cross. "Anyone on the network -- an employee, for example -- would by definition have credentials." Worse, said Cross, is that outside attackers could exploit this without a lot of trouble by bundling an MS07-039 exploit with a multi-strike attack that figures on compromising some fraction of enterprise laptops while they're outside the network. Once back inside the enterprise's perimeter, the Active Directory exploit could fire up -- using the credentials of the hijacked notebook -- to grab systems running the supposedly more secure Windows Server 2003. Two of the remaining five bulletins were pegged "critical" by Microsoft, while another two were marked "important." The final update was tagged as "moderate." MS07-036, which patches three vulnerabilities, two of them judged critical and oneÂ  of them a zero-day flaw already out in public, repairs bugs in Excel 2000, 2002, 2003 and 2007. Similar vulnerabilities in other Microsoft Office document formats, including those in Word and PowerPoint, have been used by attackers to slip malicious code into corporations. Some of these attacks have been so narrowly targeted that they're launched against just one user at one company. What's interesting about this update, said a Symantec researcher in an e-mail, is that Microsoft got it wrong back in February when it downplayed the initial report of the Excel threat. Then, Symantec's DeepSight threat network analysts reported Excel 2003 was susceptible to a denial-of-service bug which, if exploited, could crash the program. Four months ago, Microsoft denied that the bugs were actually vulnerabilities. "Microsoft has completed its investigation of new public reports of possibleÂ  vulnerabilities in Microsoft Office 2003 and Microsoft Excel 2003 [and] hasÂ  confirmed that these are not product vulnerabilities," a spokeswoman toldÂ  Computerworld at the time. "They are issues that can cause the application to become unresponsive. Users can restart the application," she said. "[Today's] bulletin includes a fix for a previously disclosed denial-of-service issue from February 2007 which is now billed as having the potential for remote code execution," noted Oliver Friedrichs, director of Symantec's security response group. As Friedrichs pointed out, Microsoft characterized all three bugs patched by MS07-036 as having a "remote code execution" impact, meaning that hackers couldÂ  inject their own malware into a PC after exploiting the Excel flaws. The third critical update, MS07-040, plugs three holes in the .Net Framework, the primary Windows runtime environment called on by developers. Notably, all three vulnerabilities were previewed during a sneak peek at the Syscan'07 security conference last week in Singapore. But the patches may be a ton of trouble to corporate IT managers, said Storms, because the .Net Framework is so widely used by corporate developers of in-house software. "Not only will [companies] have to run QA on the patches, they'll have to run QA on the code that runs on .Net," said Storms. The fixes in MS07-040 apply to all but Version 3.x of .Net Framework, adding additional complexity to in-enterprise application testing. Of the remaining security updates, one fixes a flaw in Publisher 2007, another patches Internet Information Services 5.1 on Windows XP Professional SP2, and the thirdÂ  quashes a bug in Windows Vista's bundled firewall. That last, although rated "moderate," second-from-the-bottom in Microsoft's four-step severity rating system, is worth some reflection, said Symantec's Friedrichs. "Microsoft's decision to rewrite the Windows network stack and its accompanying firewall [for Vista] continues to have long-term security implications," Friedrichs said. "A network stack can take decades of heavy scrutiny in order to become battle hardened. As an operating system's first line of defense, its quality is directly related to its ability to withstand attack." On its own, added Friedrichs, the firewall bug isn't a big deal; the result of an exploit is that the attacker can "see" the system when it should actually be completely invisible to outside probes. "[But] if this logic flaw were combined with a vulnerability in one of the exposed services, this could have more serious, widespread implications." As usual, Microsoft's monthly updates have been posted to Microsoft Update and Windows Update services, and they can also be retrieved through Windows Server Update Services (WSUS).
284458
Microsoft (Nasdaq: MSFT) has released a patch for a potentially serious configuration flaw in the firewall that ships with the company's Windows XP Service Pack 2.
524507
A variant of a bug that uses an Internet Explorer 6 vulnerability exposes Microsoft Windows systems patched with Service Pack 2. A security researcher claims to have crafted a simpler version of a bug first identified in late October.
121334
Microsoft issued a patch for what it says is a &quot;critical&quot; security flaw in the way Windows programs handle JPEG images. According to a security bulletin accompanying the patch, the flaw
42644
(InfoWorld) - With Microsoft's monthly patch release expected on Tuesday, scammers are sending out fake security bulletins that attempt to install malicious software on victim's computers. The e-mail messages claim to describe a "Cumulative Security Update for Internet Explorer" that fixes a critical security flaw in the browser. It comes with a link entitled "Download this update." When users click on this link, they are taken to a server that attempts to install malicious software known as Trojan-Downloader.Win32.Agent.avk. This Trojan software then attempts to reach out to other computers on the Internet in order to install more programs on the victim's computer. The SANS Internet Storm Center received its first and only report of the scam on Thursday night, but a second sample has also been posted to the Chinese Internet Security Response Team blog. SANS volunteer Lenny Zeltser believes that the criminals behind this scam may be gearing up for more activity. The trojan looks for three different servers, and two of them have domains that haven't yet been registered. He suspects the authors of the scam may be planning to register those domains before embarking on a more widespread campaign. The two e-mail samples contained obvious errors that would be caught by technically savvy users. For example, although the patch Zeltser examined claimed to have been issued in June 2007, it was entitled MS06-4 instead of the more-plausible MS07-004. Still, these scams need to fool only a small percentage of victims in order to be successful, said Zeltser, information security practice leader at Gemini Systems in New York. "You wonder, does it really matter that there are these strange discrepancies in the way the fake security alert is written," he said. "People who would notice probably would be the kind of people who wouldn't click on the link." Another tip-off: Microsoft does send out notification e-mail when it publishes security bulletins, but the links in these alerts take users to the bulletins themselves, not to executable downloads
642533
(InfoWorld) - MicrosoftÂ released its February set of security updates Tuesday, including critical fixes for bugs in Office and the scanning engine used by the company's security products. The security software flaw is of particular concern because it could, in theory, be very easily exploited by an attacker to run unauthorized software on a victim's PC. The bug has to do with the way that Microsoft's Malware Protection Engine, used by Windows Live One Care and Windows Defender, processes PDF files. Windows Defender is available for free and ships with Microsoft's Vista operating system. "An attacker could exploit the vulnerability by constructing a specially crafted PDF File that could potentially allow remote code execution when the target computer system receives, and the Microsoft Malware Protection Engine scans, the PDF file," Microsoft said in its bulletin on the patch. This engine is also used by Microsoft's Antigen and Windows Forefront Security products, meaning that Exchange servers running these products could also be compromised. Although there is not yet any known attack that exploits this flaw, it could become a serious problem for Windows users running Microsoft's security products, according to Amol Sarwate, vulnerability lab manager at Qualys. "These attacks are very difficult to avoid," he said. "These products run automatically in the background." Symantec rated this scanning engine flaw the most critical of the vulnerabilities patched on Tuesday. Microsoft actually released the patch for this flaw on Jan. 26, although it did not notify customers of this bug until Tuesday's bulletin, said Mark Griesi, a security program manager with the company's Trustworthy Computing group. Griesi said that there was no particular reason why Microsoft declined to notify customers of the update. But the fact that this was Microsoft's first security product patch since implementing its monthly system apparently contributed to the decision. "It was one of those first-time situations: 'Should we say something now or should we just wait,'" he said. "This time we decided to wait. We won't do it again." In total, six of Microsoft's 12 updates are rated as "critical," the other six have the less-serious rating of "important." Among the patches is a widely anticipated update for Microsoft Word , which fixes six bugs in Microsoft's word processing software. Hackers had been exploiting a number of these bugs in very targeted attacks over the past few months. The updates fix 20 bugs in total, including all four of the Word flaws that hackers had been exploiting, Griesi said. Other critical patches fix bugs in the ActiveX HTML Help control and Microsoft Data Access Components, both used by Windows, as well as flaws in Office and Internet Explorer.
689953
A recently detected exploit code foreshadows a likely worm-style attack on Windows machines plagued with the JPEG vulnerability made public last week, security experts said Thursday.
640711
Microsoft Corp.  on  Tuesday released three security patches to fix holes in its  Windows and Office software and warned one of the  vulnerabilities was "critical" because it could allow an  attacker to take over a user's computer.
381915
Microsoft issues patches for holes that could allow remote attackers to gain control of your PC.
549045
In sharp contrast to last month&#39;s barrage of critical patches, Microsoft has offered up just one &quot;important&quot; fix for users to implement in its scheduled round of security updates for November.
534160
A new variant of the MyDoom worm that exploits an unpatched flaw in Microsoftâs Internet Explorer browser has emerged to threaten small business and home users in particular, security experts warned this week.
645767
Microsoft Corp. MSFT.O on   Tuesday released three security patches to fix holes in its   Windows and Office software and warned one of the   vulnerabilities was "critical" because it could allow an   attacker to take over a user's computer.
551854
InfoWorld - A hacker has released attack code that could be used to exploit a critical bug in some versions of the Windows operating system.
738931
In sharp contrast to last month&#39;s barrage of critical patches, Microsoft today offered up just one &quot;important&quot; fix for users to implement in its scheduled round of security updates for November.
355993
The emergence of a new Internet virus targeting a Microsoft Windows security flaw could cause more damage than usual because the company's system for fixing the problem is so complex that many people will not bother to download it, security experts warned.
734229
Microsoft has released a "critical" patch to fix a security flaw affecting how Windows, Office and developer tools software programs process images in the JPEG image format.