Outlook vulnerable to critical VML bug
603807
(InfoWorld) - A critical bug in the Internet Explorer (IE) browser also affects users of the Outlook 2003 e-mail client, making it much more serious than previously thought. The vulnerability can be triggered when IE or Outlook 2003 processes Web-based graphics code written in the Vector Markup Language (VML). It wasÂ first reported Monday by researchers at Sunbelt Software Inc. Attackers have not yet begun exploiting the e-mail attack, but aÂ handful of Web sitesÂ now serve the code, and hackers have publicly posted software that exploits the vulnerability. Initially, researchers thought that only Internet Explorer was vulnerable to attacks that exploited this flaw, but Sunbelt has now concluded that Outlook 2003 users are also at risk. That's because researchers have discovered a way to execute malicious code without using scripting code, which would normally be blocked by Outlook. By embedding a machine-language "shellcode" program in the VML tags, researchers have been able run unauthorized software on systems running the latest version of Outlook 2003. This has raised concerns because it means that some victims could have their PCs compromised with little or no user action. To attack Internet Explorer, criminals would first need to trick users into visiting a malicious Web site. But with an Outlook attack, it becomes much easier to target a victim. "All you have to do is send an HTML e-mail and the user is hosed," said Eric Sites, Sunbelt's vice president of research and development. Researchers at VeriSign Inc's iDefense unit have also confirmed that some configurations of Outlook will launch the code with no user action, said Ken Dunham, the director of the iDefense Rapid Response Team. Users who have Outlook's Reading Pane enabled to read messages in HTML are particularly vulnerable to this attack, Dunham said. Outlook Express users do not appear to be at risk, said Sites. Microsoft is advising users who want to protect themselves to set Outlook to read e-mail messages in plain text format. Instructions describing how to do this can beÂ found here. Microsoft's advisory on the VML issue can beÂ found here. Sunbelt has posted aÂ workaround for the vulnerability. According to one researcher, Outlook 2003 should not be rendering VML code automatically, but the product appears to be vulnerable due to a second bug in Microsoft's software. "Some versions of Outlook will render VML despite the fact that they shouldn't," said Russ Cooper, a senior information security analyst with Cybertrust Inc. "We should be raking Microsoft over the coals for this." Sites agreed that "there seems to be a bug in the latest version of Outlook." Microsoft executives were not immediately available to comment for this story. Microsoft plans to patch the VML problem as part of its next set of security patches, due Oct. 10, but Sites believes that hackers may force the software vendor to rush out an early fix. "I think it will get bad enough that they will have to," he said. Â
681694
Windows XP Service Pack 2 gets a 'hotfix' for VPNs, part of the \
739239
(InfoWorld) - Microsoft Corp. has rolled out its monthly security updates for December, patching critical flaws in Internet Explorer, Windows Media Format, and the Visual Studio 2005 development software. The seven security patches address 11 bugs, including two in the Windows Media Player software. However, no fixes were provided for two Microsoft Word flaws that have been used in a small number of attacks during the past week. Microsoft had said it would release only six patches on Tuesday, but the company added the Windows Media Format update at the last minute, after reports of attacks based on this vulnerability began surfacing. The Windows Media Format is used by Microsoft's Windows Media Player software. In late November, security vendors warned that a buffer overflow error could occur when the Windows Media Player processed ".asx" (Advanced Stream Redirector) media files, meaning that users would first need to be tricked into opening a malicious media file for the attack to work. In its update Tuesday, Microsoft also patched a similar bug in the way the media player processes ".asf" (Advanced Systems Format) files. The Internet Explorer patch fixes four bugs. It is also rated critical, and is noteworthy because some of these bugs will probably begin to be exploited by hackers by week's end, said Gunter Ollmann, director of IBM Corp.'s Internet Security System's X-Force threat analysis service. Enterprise administrators should also pay close attention to an SNMP (Simple Network Monitoring Protocol) patch issued Tuesday, Ollmann said. Microsoft has rated this patch as "important," rather than critical because SNMP is normally blocked at the firewall and turned off by default on Windows systems. However, it is widely deployed as part of the network monitoring infrastructure in the enterprise, and is often used on critical servers, Ollmann said. Ollmann believes this SNMP patch is the "most important" update for enterprise customers. "Since the service is widely deployed in the enterprise and since it's commonly deployed on servers, we think this would be an important attack vector for enterprises," he said. The remaining updates include a "critical" fix for Visual Studio 2005, and "important" updates for Windows and Outlook Express, Microsoft said. Microsoft defines "critical" flaws as bugs that could allow the propagation of an Internet worm without any action on the part of the victim. The company's next set of security updates are due Jan. 9.
213499
Update to "critical" Internet Explorer patch repairs a serious security flaw introduced by the original version.
325298
Webcam! library! peril! ActiveX controls - so often the source of Internet Explorer flaws - are the font of two newly discovered flaws in Yahoo! Messenger.â¦
647942
The effectiveness of a patch issued last September for a Microsoft Word vulnerability, where .DOC files opened in Word 2003 and earlier versions via Internet Explorer or Outlook could enable remote code execution, is being called into question today.
17746
SEATTLE -- Microsoft released a patch for its latest &quot;critical&quot; rated security flaw affecting its Windows, Office and developer tools software programs, the company said Tuesday.
97619
(InfoWorld) - Attackers have targeted the zero-day VML vulnerability on an unknown number of Windows-based machines, using a layered approach that first involved exploiting a hole in cpanel, an application that's popular with Web hosting services. AccordingÂ to posts on the support forum of HostGator, criminals accessed the company's servers using the cpanel hole, which was also a zero-day vulnerability. Once in, they planted code on many of the Web sites of HostGator's customers. End users who used Internet Explorer to visit those sites and had not followed work-around procedures were then infected with a virus, which attacks vector markup language in Windows. "The person or group that did this is very intelligent, and obviously knows how to plan a big attack," a HostGator official wrote in the forum. "Since this exploit could have worked on anyone running cpanel it had nothing to do with how secure we were. We suspect it was done by someone in china as we have a small piece of information supporting this." HostGator says the vulnerability in cpanel has been patched. The attack demonstrates the growing sophistication of computer attacks. According to HostGator, the cpanel vulnerability was discovered about a month ago, leading officials to speculate that the attackers waited for a zero-day to emerge before exploiting it.ADVERTISEMENTMAKE SOA REAL WITH IBM WEBSPHERE PODCASTStreamline processes and maximize efficiency within a proven service oriented architecture. Take back control of your business processes with IBM WebSphere.
81544
A set of newly discovered flaws in components of VMware Inc.&#39;s virtual machine software has called attention to some of the security risks associated with the practice of running virtual computers on a single system.
145367
(InfoWorld) - In a public mea culpa, Mozilla's chief security officer acknowledged Monday that Firefox includes the same flaw that the company called a "critical vulnerability" in Internet Explorer during a two-week ruckus over responsibility for a Windows zero-day bug. "Over the weekend, we learned about a new scenario that identifies ways that Firefox could also be used as the entry point," said Window Snyder of Mozilla. "While browsing with Firefox, a specially crafted URL could potentially be used to send bad data to another application. "We thought this was just a problem with Internet Explorer," Snyder continued. "It turns out, it is a problem with Firefox as well." The argument over responsibility for a flaw that involved both Internet Explorer and Firefox began two weeks ago when Danish researcher Thor Larholm argued that Internet Explorer contained an input validation bug that passes potentially malicious URLs to other applications. Larholm called out Firefox's "firefoxurl://" protocol as one that Internet Explorer mishandled. He staked out the position that Internet Explorer was to blame, while other security experts said it was Firefox's fault. As fingers pointed, Mozilla patched the Internet Explorer-Firefox interaction bug by releasing an update, Version 2.0.0.5. Even so, Snyder and others continued to argue that Internet Explorer was the problem. "Microsoft needs to patch Internet Explorer," Snyder said last Wednesday. That same day, Asa Dotzler, director of community development, contrasted what he said were the differences between Microsoft and Mozilla on the bug. "We think it's Firefox's job to ensure that users are protected from malicious Web sites when they're surfing the Web in Firefox. Apparently, Microsoft doesn't think the same for Internet Explorer," Dotzler said then. Friday, Jesper Johansson, a former Microsoft security strategist but now a security program manager at Amazon.com, spelled out how Firefox was as guilty as Internet Explorer of failing to validate input. In a post that leaned on the metaphor of "glass houses," Johansson showed how Firefox passes potentially malicious URLs to other applications, including the multiple-service instant messaging client Trillian. "Firefox is subject to the exact same flaw that they blame on Internet Explorer. Firefox also does not escape quotes in URLs before it passes them on to protocol handlers," he said. Snyder did not credit Johansson by name for alerting Mozilla to the Firefox bug, but she admitted that the flaw should have been spotted. "We should have caught this scenario when we fixed the related problem in 2.0.0.5," she said. She did not specify when a patch would be issued, but one is in the works, according to an entry in Bugzilla.
313451
PDF attack prompts round-the-clock patch fest Escalating attacks exploiting a serious weakness in PDF files have prompted Microsoft to issue an all-hands-on-deck call to fix a vulnerability that lurks in the bowels of Windows XP.â¦
584817
Will a trifecta try at fixing Internet Explorer patch be the charm?
374738
(InfoWorld) - A set of newly discovered flaws in components of VMware's virtual machine software has called attention to some of the security risks associated with the practice of running virtual computers on a single system. VMware has updated its products to fix the security bugs, disclosed Wednesday, but users who have not updated their software could face serious security risks thanks to a trio of flaws in the DHCPÂ server that ships with VMware. The DHCP software is used to assign IP addresses to the different virtual machines running within VMware, but IBM researchers discovered that it can be exploited to gain control of the computer. That could be very bad news for someone running a lot of applications on the same VMware box, said Tom Cross, a researcher with IBM's Internet Security Systems group. "By exploiting this vulnerability, you get complete control of any of the machines that are running on that virtual environment," he said. IBM's researchers have developed exploit code for three separate flaws in the DHCP software, all of which are now patched, Cross said. In order to attack a system, however, an attacker would first need to gain access to software running within the virtual machine. Typically VMware's DHCP server is not configured to be accessible to systems on other machines. Virtualization software is one of the hottest areas in enterprise IT these days. Enterprises are increasingly looking at this type of product as a way to cut down on datacenter costs. VMware lets a single computer act as if it is a kind of mini datacenter, running a number of separate virtual machines on the same box. These virtual machines act as if they are truly separate from one another. They can run different operating systems, and if one virtual machine crashes, it does not affect the others on the server. VMware is also extremely popular with security researchers, who set up virtual machines on their PCs to test potentially malicious code without putting their computers at risk. Unfortunately, this architecture also gives attackers a single point of failure: the VMware software itself. "This is important because servers often run a vulnerable machine in one VM and have supersecret information in another VM, isolated by VMWare," said Dave Aitel, CTO with security vendor Immunity, in an e-mail interview. "VMWare ESX has been getting massively popular among hosting environments, so this sort of bug becomes a force multiplier if you can find a remote vulnerability in a [virtual machine]." The DCHP flaws affect VMware's ACE, Player, Server, and Workstation products running on Linux and the Windows operating system, IBM said. VMware, a division of EMC, has also patched a fourth serious flaw in its software, discovered by McAfee. This one could also be used to run unauthorized code on a VMware machine, but it would be difficult for an attacker to exploit, said David Marcus, security research and communications manager with McAfee's Avert Labs. "The attacker has to pass a whole bunch of parameters to the vulnerable service," he said. "You have to be engaging in some behavior inside that VMware machine to get the [exploit code] to work. So it's certainly not easy to exploit." Still, Marcus agreed with Cross that virtual machines will get more attention from security researchers in the near future. "If you have the ability to attack that virtual machine and get outside that virtual machine shell to the host OS, then you can gain control of every virtual machine that's on the box."
378682
A critical weakness found in many Microsoft programs looks like it is about to be exploited by virus writers. The bug only came to light last week, but code is now circulating that could be used to attack vulnerable machines.
217347
Stop us if you've heard this before Security experts warn a new, unpatched vulnerability in Internet Explorer might be used to spread malware. A flaw in Microsoft's Direct Animation Path (daxctle.ocx) ActiveX control, rated as critical by Secunia and other security watchers, has spawned proof of concept code but has not yet become the subject of widespread, hostile attack. Memory corruption is possible even on a fully patched Windows XP system.â¦
83975
Three different ActiveX vulnerabilities affect Yahoo Instant Messenger version 3.5,  and Yahoo Messenger versions 4.0, 5.0, and 5.5
424439
10.3.7 fixes bugs, fills security holes