Exploit code appears for Microsoft Agent bug
688615
Announced, patched and exploited within 24 hours: The bug in Windows 2000's much-patched Windows Agent component -- the software that manages the notorious "Clippy" office assistant -- is proving just as popular as that once-notorious animated paperclip.
283001
Microsoft Corp. rushed out a fix Tuesday for a security flaw in its Internet Explorer Web browser after attackers had begun exploiting the vulnerability to take control of computers.
191229
A bug in Microsoft&#39;s Internet Security and Acceleration (ISA) Server 2000 and Proxy Server 2 can let hackers spoof Web content, such as a trusted site, with their own fake content, the Redmond
114833
(InfoWorld) - It took less than 24 hours for attackers to crank out proof-of-concept code targeting the one critical vulnerability disclosed -- and patched -- Tuesday morning by Microsoft, security researchers warned. Early Wednesday, analysts with Symantec's DeepSight threat network alerted customers of JavaScript exploit code for the critical vulnerability in Windows 2000 that was revealed in Microsoft's monthly patch cycle. The proof-of-concept was posted to the Internet by someone with a Brazilian e-mail address. An hour-and-a-half later, Symantec updated its alert to say that additional exploit code was also available to users of Immunity's popular CANVAS penetration testing ("pentest") software. To call attention to the added danger, Symantec also raised the vulnerability's threat score from Tuesday's initial 7.1 (out of a possible 10) to 8.5 today. The Windows 2000 bug -- the only one rated critical of the four patched Tuesday -- is in Windows Agent, the component that drives the operating system's interactive animated help characters. The best known, and in its time, most detested, character was dubbed "Clippy," a.k.a. the Office Assistant, a bouncy paperclip designed to answer users' questions about Microsoft Office. The developer disabled Clippy by default as of Office XP and put it to rest when Office 2007 debuted earlier this year. The JavaScript-based exploit fits nicely with analysis made yesterday by Tom Cross, a researcher with IBM Internet Security Systems' X-Force. The vulnerability, said Cross Tuesday, is in the Agent ActiveX control, which are typically exploited by duping users into visiting Web sites where malicious script code has been planted, and "attackers will use a pretty common attack vector," he said Tuesday. The quick appearance today of proof-of-concept also matches his initial impression. "This uses a pretty common attack vector, and it fits the profile of a lot of bugs." Symantec advised users who were unable to immediately apply the patch to disable their browser's script-handling capabilities. "A successful exploit requires the execution of active content," its advisory said. "To mitigate against this and other latent vulnerabilities, disable support for active content in the browser." VeriSign iDefense, which was credited by Microsoft for reporting the bug, also posted an advisory today; in it, the security vendor spells out how to set the "kill bit" in the Windows registry to disable the Agent ActiveX control. Microsoft has posted its technical write-up of the Agent vulnerability in the MS07-051 security bulletin. Tuesday's update is also a replacement for an earlier April fix of Agent, an indication that the company's developers didn't find all the bugs in the component five months ago. Computerworld is an InfoWorld affiliate
688424
(InfoWorld) - Microsoft Corp. may be waiting until next month to patch a nasty bug in Outlook and Internet Explorer, but security researchers are offering users a more immediate option. A loose affiliation of security researchers going by the name of ZERT (Zeroday Emergency Response Team) has released a patch for the VML (Vector Markup Language) vulnerability, which increasingly is beingÂ exploited by criminals in malware attacks. Microsoft is scheduled to fix the bug on Oct. 10, the date it has set to release its monthly batch of security updates, but the company is under increasing pressure to release an earlier, "out-of-cycle" patch. On Friday the SANS Internet Storm CenterÂ raised its alert level from green to yellow, an indication that attacks are becoming more widespread. Microsoft has suggested a number of work-arounds to the problem, and the software vendor does not recommend that users install the ZERT patch, released Friday. "We think itâs great that there are people out there working to help protect our customers. But as we've always said, we cannot endorse third party updates," wrote Microsoft Security Response center program manager Scott Deacon in aÂ blog posting Friday. Microsoft's suggested work-around can be foundÂ here. Microsoft rigorously tests its patches to try to cut off any problems that the new software might introduce. The ZERT patch has not been widely tested and could introduce new problems when installed, security experts warn. ZERT plans to continue to release its own patches when particularly critical unpatched flaws begin to pose a "serious risk to the public, the infrastructure of the Internet or both," the group claims in a manifesto, published on itsÂ Web site . "The purpose of ZERT is not to 'crack' products, but rather to 'uncrack' them by averting security vulnerabilities in them before they can be widely exploited," the group says. ZERT sprang out of discussions on e-mail lists set up a few years ago by security researcher Gadi Evron, said ZERT member Randy Abrams, director of technical education with Eset LLC in San Diego. "Microsoft wants to assign a monthly patch and we understand that," said ZERT member Roger Thompson, who is chief technology officer with Atlanta's Exploit Prevention Labs Inc. "There's a certain benefit of staying on the monthly patch, but when things start to pop, as we think this VML thing is, there's a need to do something." The group's formation was spurred by Microsoft's WMF (Windows Metafile) vulnerability, which emerged in late 2005. Tens of thousands of Microsoft users downloaded third-party patches to fix that bug and Microsoft was eventually forced to release an out-of-cycle patch to address the problem. "This has been the first real vulnerability [since then] that the members have felt can be patched fairly quickly," Abrams said. Microsoft clearly does not want its users to get into the habit of installing third-party security patches, so if the ZERT software is widely downloaded, Microsoft may move more quickly with its own VML patch, Abrams said. "It might force Microsoft's hand on an out-of-cycle patch," he said
80980
An exploit discovered yesterday by security consultancy Sunbelt and verified by Microsoft this afternoon involving the Vector Markup Language (VML) library in Windows could potentially affect not only users of Internet Explorer, but also of the current beta of Office 2007.
42644
(InfoWorld) - With Microsoft's monthly patch release expected on Tuesday, scammers are sending out fake security bulletins that attempt to install malicious software on victim's computers. The e-mail messages claim to describe a "Cumulative Security Update for Internet Explorer" that fixes a critical security flaw in the browser. It comes with a link entitled "Download this update." When users click on this link, they are taken to a server that attempts to install malicious software known as Trojan-Downloader.Win32.Agent.avk. This Trojan software then attempts to reach out to other computers on the Internet in order to install more programs on the victim's computer. The SANS Internet Storm Center received its first and only report of the scam on Thursday night, but a second sample has also been posted to the Chinese Internet Security Response Team blog. SANS volunteer Lenny Zeltser believes that the criminals behind this scam may be gearing up for more activity. The trojan looks for three different servers, and two of them have domains that haven't yet been registered. He suspects the authors of the scam may be planning to register those domains before embarking on a more widespread campaign. The two e-mail samples contained obvious errors that would be caught by technically savvy users. For example, although the patch Zeltser examined claimed to have been issued in June 2007, it was entitled MS06-4 instead of the more-plausible MS07-004. Still, these scams need to fool only a small percentage of victims in order to be successful, said Zeltser, information security practice leader at Gemini Systems in New York. "You wonder, does it really matter that there are these strange discrepancies in the way the fake security alert is written," he said. "People who would notice probably would be the kind of people who wouldn't click on the link." Another tip-off: Microsoft does send out notification e-mail when it publishes security bulletins, but the links in these alerts take users to the bulletins themselves, not to executable downloads
177209
Security experts have spotted the first attempts to create an Internet worm that propagates using instant messages and exploits a recently disclosed flaw in Microsoft software.
457591
Hackers revealed exploit code for JavaScript vulnerability.
112380
(InfoWorld) - One day after patching a widely exploited flawÂ in its Internet Explorer browser, Microsoft Corp. has a new bug to worry about, this time in PowerPoint. Attackers have been exploiting a newly discovered bug in Microsoft's Office presentation software in extremely targeted attacks, McAfee Inc. reported Wednesday. Researchers were made aware of the attacks when a customer submitted two different malicious PowerPoint files, both of which exploited the same vulnerability, said Craig Schmugar, a virus researcher at McAfee. Both files installed malicious remote access Trojan software that then attempted to connect to an outside Web server, he said. Though McAfee is not releasing technical details of the exploit, the security vendor says that it has confirmed that the attack works on three versions of Office running on the Windows 2000 operating system: Office 2000, Office XP, and Office 2003. Other platforms and other Office applications may also be affected, but McAfee has not yet had time to complete its testing, Schmugar said. Schmugar has blogged about the issueÂ  . Microsoft issued a security advisory on the matter Wednesday, saying that the issue affects users of Microsoft Office 2000, Microsoft Office 2003, and Microsoft Office XP, as well as Microsoft PowerPoint 2004 for Mac. Microsoft's advisory can beÂ found here. As a workaround, Microsoft suggests that users open and view files using PowerPoint Viewer 2003. This software "does not contain the vulnerable code and is not susceptible to this attack," the advisory states. The PowerPoint viewer can beÂ downloaded here. Microsoft and other security vendors, including Symantec Corp. and McAfee, have added signatures to their security products so that they can detect this malicious code. Over the past few months, attackers have focused on Office, exploiting a number of undisclosed Office bugs in extremely targeted attacks, often on government agencies or contractors. These attacks usually take the form of an e-mail that has a malicious Office document attached and is sent to a small number of target victims This latest PowerPoint attack fits that pattern and was sent to a defense contractor, Schmugar said. He declined to provide further details on the intended victim. Because the attack has been extremely limited in scope it is considered to be a low risk for most users, Schmugar said. News of the attack comes the day afterÂ Microsoft issued an emergency patch for a widely exploited bug that affected the VML (Vector Markup Language) rendering engine used by Internet Explorer and Outlook. Hackers are exploiting this critical flaw in the browser via mass e-mail and on thousands of Web sites, security experts said. Microsoft's next set of security patches will be released Oct. 10. The software vendor did not say whether it plans to patch this latest PowerPoint flaw.
378682
A critical weakness found in many Microsoft programs looks like it is about to be exploited by virus writers. The bug only came to light last week, but code is now circulating that could be used to attack vulnerable machines.
352797
InfoWorld - A security researcher has found a security bug that could be attacked in Internet Explorer. Mozilla said it plans to patch the problem in its next Firefox software update.
116542
(InfoWorld) - For the second week in a row, independent security researchers have fixed a hole in Microsoft Corp.'s software. On Friday, Determina Inc.Â published a free patch for a critical bug in an ActiveX control (called WebViewFolderIcon) that is used by Windows' graphical user interface. Security experts consider the flaw to be critical because it could be exploited by attackers to run unauthorized code on a victim's PC. To make this happen, the victim would have to visit a Web site with Internet Explorer (IE) and allow it to run a malicious ActiveX control. Security researcher HD MooreÂ published details of the bug on July 18, but he recently added attack code that exploited the flaw to his widely-used Metasploit hacking toolkit. Determina says that the availability of the Metasploit code has boosted the risk of attacks. There seems to be no shortage of Windows attacks this week. On Tuesday, MicrosoftÂ issued a rare emergency patch for a separate problem in Outlook and IE's Vector Markup Language (VML) rendering engine, after that flaw was widely exploited by attackers. And criminals have also launched extremely limited attacks that exploit an unpatched flaw in PowerPoint. The VML flaw had first been fixed four days ahead of Microsoft's patch by a group of security researchers calling themselves the Zeroday Emergency Response Team. This latest bug is not likely to be as widely exploited as the VML vulnerability, Moore said. "This bug is not as severe as the VML flaw, since it depends on ActiveX, and would not be exploitable by default through Outlook," he said in an e-mail. Nevertheless, Microsoft found the issue to be serious enough to meritÂ a security advisory, published Thursday. Microsoft plans to patch the WebViewFolderIcon flaw in its next scheduled set of security updates, due Oct. 10. So far, Microsoft doesn't know of "any attacks attempting to use the reported vulnerability or of customer impact at this time," the security advisory states. Microsoft does not recommend that users install third-party patches, because this software has not gone through the rigorous quality assurance testing process that Microsoft applies to its security updates. Determina's patch works on Windows 2000, XP and 2003 systems. Â
660529
Just a week after Microsoft released a patch to plug a security flaw in the way at least 13 of its programs handle the JPEG imaging format, code appeared on the Internet on Wednesday showing how to exploit those holes.
178847
A bug in Microsoft&#39;s Internet Security and Acceleration (ISA) Server 2000 and Proxy Server 2.0 can let hackers spoof Web content, such as a trusted site, with their own fake content, the Redmond
177244
Symantec issued an alert after exploit code was posted to the Securityfocus Web site. The alert raised the urgency and severity of an earlier warning about the security holes in ARCServe Backup versions 9.01 through 11.5 SP1, as well as CA's Business Protection Suite software.
308058
For the third time this week, hackers have released attack code that exploits a critical vulnerability in Microsoft Word. The proof-of-concept code, which addresses a previously unknown Word vulnerability, was posted Tuesday.