Microsoft

Stories about Microsoft, Windows, Office and so on

Microsoft Security Bulletin MS10-070, Important, Really??

So, SANS has set it’s InfoCon level to yellow to increase the visibility of this update, and hopefully to encourage people to patch it sooner rather than later. All I can say is that I hope that it does actually get people to apply this patch quickly.

Apparently MSFT are aware of “active attacks”, which begs the question as to why is this only rated as an “Important” patch? I’m sure they have their reasons though, but if you are running any web applications, you are really advised to patch sooner rather than later on this one.

The details of the patch, taken from Microsoft’s website are the following:

—————————–

Executive Summary

This security update resolves a publicly disclosed vulnerability in ASP.NET. The vulnerability could allow information disclosure. An attacker who successfully exploited this vulnerability could read data, such as the view state, which was encrypted by the server. This vulnerability can also be used for data tampering, which, if successfully exploited, could be used to decrypt and tamper with the data encrypted by the server. Microsoft .NET Framework versions prior to Microsoft .NET Framework 3.5 Service Pack 1 are not affected by the file content disclosure portion of this vulnerability.

This security update is rated Important for all supported editions of ASP.NET except Microsoft .NET Framework 1.0 Service Pack 3. For more information, see the subsection, Affected and Non-Affected Software, in this section.

The security update addresses the vulnerability by additionally signing all data that is encrypted by ASP.NET. For more information about the vulnerability, see the Frequently Asked Questions (FAQ) subsection for the specific vulnerability entry under the next section, Vulnerability Information.

This security update also addresses the vulnerability first described in Microsoft Security Advisory 2416728.

Recommendation. Microsoft recommends that customers apply the update at the earliest opportunity.

———————-
As always people, be safe and patch asap, the Internet is a dangerous place….

Microsoft Black Tuesday Summary – August 2010

I know, I know, I’m a couple of days late in publishing this one, so apologies to all.

If you haven’t seen the latest Microsoft security patches though, then this will be an interesting read to you. Hopefully you’re already in the midst of rolling out these patches though, but if not, have a look below at the nice new patches that you have to look forward to implementing across your estates.

This month there are a total of 15 patches, 9 Critical and 6 Important.
MS10-046 Vulnerability in Windows Shell Could Allow Remote Code Execution (2286198)

This security update resolves a publicly disclosed vulnerability in Windows Shell. The vulnerability could allow remote code execution if the icon of a specially crafted shortcut is displayed. An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Rating: Critical

Restart Required: Yes

Affected Software: Microsoft Windows

MS10-049 Vulnerabilities in SChannel Could Allow Remote Code Execution (980436)

This security update resolves one publicly disclosed vulnerability and one privately reported vulnerability in the Secure Channel (SChannel) security package in Windows. The more severe of these vulnerabilities could allow remote code execution if a user visits a specially crafted Web site that is designed to exploit these vulnerabilities through an Internet Web browser. In all cases, however, an attacker would have no way to force users to visit these Web sites. Instead, an attacker would have to convince users to visit the Web site, typically by getting them to click a link in an e-mail message or in an Instant Messenger message that takes users to the attacker’s Web site.

Rating: Critical

Restart Required: Yes

Affected Software: Microsoft Windows

MS10-051 Vulnerability in Microsoft XML Core Services Could Allow Remote Code Execution (2079403)

This security update resolves a privately reported vulnerability in Microsoft XML Core Services. The vulnerability could allow remote code execution if a user viewed a specially crafted Web page using Internet Explorer. An attacker would have no way to force users to visit these Web sites. Instead, an attacker would have to persuade users to visit the Web site, typically by getting them to click a link in an e-mail message or Instant Messenger message that takes users to the attacker’s Web site.

Rating: Critical

Restart Required: Yes

Affected Software: Microsoft Windows

MS10-052 Vulnerability in Microsoft MPEG Layer-3 Codecs Could Allow Remote Code Execution (2115168)

This security update resolves a privately reported vulnerability in Microsoft MPEG Layer-3 audio codecs. The vulnerability could allow remote code execution if a user opens a specially crafted media file or receives specially crafted streaming content from a Web site or any application that delivers Web content. An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Rating: Critical

Restart Required: Maybe, dependent on configuration
Affected Software: Microsoft Windows

MS10-053 Cumulative Security Update for Internet Explorer (2183461)

This security update resolves six privately reported vulnerabilities in Internet Explorer. The most severe vulnerabilities could allow remote code execution if a user views a specially crafted Web page using Internet Explorer. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Rating: Critical

Restart Required: Yes
Affected Software: Microsoft Windows, Internet Explorer

MS10-054 Vulnerabilities in SMB Server Could Allow Remote Code Execution (982214)

This security update resolves several privately reported vulnerabilities in Microsoft Windows. The most severe of these vulnerabilities could allow remote code execution if an attacker created a specially crafted SMB packet and sent the packet to an affected system. Firewall best practices and standard default firewall configurations can help protect networks from attacks originating outside the enterprise perimeter that would attempt to exploit these vulnerabilities.

Rating: Critical

Restart Required: Yes
Affected Software: Microsoft Windows

MS10-055 Vulnerability in Cinepak Codec Could Allow Remote Code Execution (982665)

This security update resolves a privately reported vulnerability in Cinepak Codec. The vulnerability could allow remote code execution if a user opens a specially crafted media file or receives specially crafted streaming content from a Web site or any application that delivers Web content. An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Rating: Critical

Restart Required: Maybe, dependent on configuration
Affected Software: Microsoft Windows

MS10-056 Vulnerabilities in Microsoft Office Word Could Allow Remote Code Execution (2269638)

This security update resolves four privately reported vulnerabilities in Microsoft Office. The most severe vulnerabilities could allow remote code execution if a user opens or previews a specially crafted RTF e-mail message. An attacker who successfully exploited any of these vulnerabilities could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Rating: Critical

Restart Required: Maybe, dependent on configuration
Affected Software: Microsoft Office

MS10-060 Vulnerabilities in the Microsoft .NET Common Language Runtime and in Microsoft Silverlight Could Allow Remote Code Execution (2265906)

This security update resolves two privately reported vulnerabilities in Microsoft .NET Framework and Microsoft Silverlight. The vulnerabilities could allow remote code execution on a client system if a user views a specially crafted Web page using a Web browser that can run XAML Browser Applications (XBAPs) or Silverlight applications, or if an attacker succeeds in convincing a user to run a specially crafted Microsoft .NET application. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. The vulnerabilities could also allow remote code execution on a server system running IIS, if that server allows processing ASP.NET pages and an attacker succeeds in uploading a specially crafted ASP.NET page to that server and executing the page, as could be the case in a Web hosting scenario.

Rating: Critical

Restart Required: Maybe, dependent on configuration
Affected Software: Microsoft Windows, Microsoft .NET Framework, Microsoft Silverlight

MS10-047 Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (981852)

This security update resolves several privately reported vulnerabilities in Microsoft Windows. The most severe of these vulnerabilities could allow elevation of privilege if an attacker logged on locally and ran a specially crafted application. An attacker must have valid logon credentials and be able to log on locally to exploit these vulnerabilities. The vulnerabilities could not be exploited remotely or by anonymous users.

Rating: Important
Restart Required: Yes
Affected Software: Microsoft Windows

MS10-048 Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (2160329)

This security update resolves one publicly disclosed and four privately reported vulnerabilities in the Windows kernel-mode drivers. The most severe of these vulnerabilities could allow elevation of privilege if an attacker logs on to an affected system and runs a specially crafted application. An attacker must have valid logon credentials and be able to log on locally to exploit this vulnerability. The vulnerability could not be exploited remotely or by anonymous users.

Rating: Important
Restart Required: Yes
Affected Software: Microsoft Windows

MS10-050 Vulnerability in Windows Movie Maker Could Allow Remote Code Execution (981997)

This security update resolves a privately reported vulnerability in Windows Movie Maker. The vulnerability could allow remote code execution if an attacker sent a specially crafted Movie Maker project file and convinced the user to open the specially crafted file. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Rating: Important
Restart Required: Maybe, dependent on configuration
Affected Software: Microsoft Windows

MS10-057 Vulnerability in Microsoft Office Excel Could Allow Remote Code Execution (2269707)

This security update resolves a privately reported vulnerability in Microsoft Office. The vulnerability could allow remote code execution if a user opens a specially crafted Excel file. An attacker who successfully exploited this vulnerability could gain the same user rights as the logged-on user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Rating: Important
Restart Required: Maybe, dependent on configuration
Affected Software: Microsoft Office

MS10-058 Vulnerabilities in TCP/IP Could Allow Elevation of Privilege (978886)

This security update resolves two privately reported vulnerabilities in Microsoft Windows. The more severe of these vulnerabilities could allow elevation of privilege due to an error in the processing of a specific input buffer. An attacker who is able to log on to the target system could exploit this vulnerability and run arbitrary code with system-level privileges. The attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

Rating: Important
Restart Required: Yes
Affected Software: Microsoft Windows

MS10-059 Vulnerabilities in the Tracing Feature for Services Could Allow an Elevation of Privilege (982799)

This security update resolves one publicly disclosed vulnerability and one privately reported vulnerability in the Tracing Feature for Services. The vulnerabilities could allow elevation of privilege if an attacker runs a specially crafted application. An attacker must have valid logon credentials and be able to log on locally to exploit this vulnerability. The vulnerability could not be exploited remotely or by anonymous users.

Rating: Important
Restart Required: Maybe, dependent on configuration
Affected Software: Microsoft Windows

Microsoft LNK exploit added to Metasploit

With all the talk about the Microsoft LNK exploit, it was only a matter of time before the guys over at camp Metasploit added the exploit for this one to the Metasploit Framework.

You can find the details for the module over here.

If you’re one of those types of people that want to have a look at the source code for this one, then you can cast your eyes on that right here.

To get this module into MSF, all you have to do is SVN up.

Have fun 😉

Microsoft LNK exploit

The recently discovered LNK exploit; using the way Microsoft parses link or shortcut icons for display in order to get something else executed; may be a tempest in a teapot.  It is technically sophisticated, but so far we don’t appear to have seen it used widely.

Probably a good thing.

This exploit could be used in a wide variety of ways.  You can use it in removeable media, so that any time you shove a CD in a drive, or connect a USB stick/thumb drive (or any other USB device, for that matter) to a computer, it results in an infection or some malicious payload.

And remember that OLE stands for object *LINKING* and embedding.  Since it is trivially easy to embed a virus in any Windows OLE format data file, it should be just as easy to create malicious links in any such files.

Microsoft’s own information on the issue seems to indicate that there is a related, but separate, issue with Microsoft Office components, related to Web based activities.  (By the way, when accessing that site, the information about how to protect against the exploit is hidden under the “Workarounds” link, rather than being explicit on the page.)

Some of the potential effects are discussed by Randy Abrams at http://blog.eset.com/2010/07/19/it-wasn%E2%80%99t-an-army

Microsoft Black Tuesday Summary July 2010

I decided that it would be a good idea to publish summaries of MS’s patch updates on here each month, let me know your thoughts. I know that you can get these from MS directly, but I just figured that if you read SecuriTeam anyway, then here’s some more useful information for you.

My personal opinion on this one is that if there’s one patch you really should apply ASAP, then it should be MS10-042.
So without further ado.

MS10-042 (Critical – Remote Code Execution)

Vulnerability in Help and SupportCenter Could Allow Remote Code Execution (2229593)

This security update resolves a publicly disclosed vulnerability in the Windows Help and Support Center feature that is delivered with supported editions of Windows XP and Windows Server 2003. This vulnerability could allow remote code execution if a user views a specially crafted Web page using a Web browser or clicks a specially crafted link in an e-mail message. The vulnerability cannot be exploited automatically through e-mail. For an attack to be successful, a user must click a link listed within an e-mail message.

MS10-043 (Critical – Remote Code Execution)

Vulnerability in Canonical Display Driver Could Allow Remote Code Execution (2032276)

This security update resolves a publicly disclosed vulnerability in the Canonical Display Driver (cdd.dll). Although it is possible that the vulnerability could allow code execution, successful code execution is unlikely due to memory randomization. In most scenarios, it is much more likely that an attacker who successfully exploited this vulnerability could cause the affected system to stop responding and automatically restart.
MS10-044 (Critical – Remote Code Execution)

Vulnerabilities in Microsoft Office Access ActiveX Controls Could Allow Remote Code Execution (982335)

This security update resolves two privately reported vulnerabilities in Microsoft Office Access ActiveX Controls. The vulnerabilities could allow remote code execution if a user opened a specially crafted Office file or viewed a Web page that instantiated Access ActiveX controls. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

MS10-045 (Important – Remote Code Execution)

Vulnerability in Microsoft Office Outlook Could Allow Remote Code Execution (978212)

This security update resolves a privately reported vulnerability. The vulnerability could allow remote code execution if a user opened an attachment in a specially crafted e-mail message using an affected version of Microsoft Office Outlook. An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Have fun patching all, and please remember to test these patches in a non-production environment before applying directly to production environments guys and girls.

Sometimes it’s just Windows …

As well as the complexity issue I spoke about earlier, computers can do some weird things.

A couple of days ago, Gloria was doing some work that involved comparing two photographs.  She asked me to have a look at the first, then showed me the second, and then wanted to show me the first again.  Which, of course, wasn’t there any more.  Windows Picture and Fax (why fax, in this day and age?) Viewer, I explained, almost uniquely among Windows programs, doesn’t let you have more than one window open at a time.  Why not, she asked.  No reason I can think of.

In some frustration she closed the picture viewer window, preparatory to finding the other picture in the other directory.  She clicked the little red square with the white x in it, up in the top right hand corner.  The Viewer window disappeared.

So did some other stuff.

Windows chose to interpret this action as a command to delete the directory in which she had been working, and from whence came the image she had been showing me.

Why does closing a window get interpretted as a command to delete anything?

Which was rather important, since it was her email directory.  With all her email.  (No, not Outlook.  Of course not Outlook.  This is a security blog, after all.)  And various files that came as attachments.

Normally, when you ask to delete a file (from the Windows Explorer window), you get asked if you really want to delete that file.  Actually, usually you get asked if you want to send that file to the Recycle Bin, which is why I have learned to use Shift-Delete almost as a matter of course, but we’ll let that go for the moment.  In either case, you get asked something.  Not this time.  This time the first indication we got of anything happening was the dialogue box telling us that it couldn’t delete the directory, since the directory was in use.  Windows had, of course, deleted all the files already.  (Maybe Windows randomly deletes your email directory if you don’t use Outlook …)

Why, all of a sudden, no confirmation of intention to delete?

Well, regardless of the fact that we hadn’t asked Windows to delete anything, this is exactly the reason that the Recycle Bin was created in the first place.  So, I opened up the Recycle Bin, sorted the files by place of origin, and found the directory, and files, that had been deleted.  As well as other files, of course, since it had been a while since my wife last “emptied” the Recycle Bin.  No problem: retrieve them all, and then sort them out.  So, we retrieved them all, and Gloria went to work on getting rid of what she didn’t want.

When she finished, she opened a new Windows Explorer window to check and make sure that everything was OK.  It wasn’t.  The directory was still empty.  I got involved again, checking this and that.  Shut down program.  Click on the shortcut on the desktop to start up the email program.  Email comes up just fine, and all the messages are there.  How on earth did it do that, when the message files, and even the email program, didn’t exist, as far as Windows Explorer was concerned.

After a bit more checking, I even rebooted the computer, in case, for some weird Windows reason, it was still “remembering” that the files had been deleted.  Rebooted, and still nothing in the directory.  But the mail program, and mail, came up just fine.

So I started messing around with the shortcut properties.  And, lo and behold, come up with something weird.  It wasn’t looking at the email directory.  It was looking at a directory that didn’t exist.

Except, now it did, when we went to look at it.  And it contained all the files, and all the email.

When retrieving from the Recycle Bin, it had created a new and different directory.  And moved the files there, rather than where they had come from.  And had changed the properties on the desktop shortcut, so that they pointed to the new directory.  (And, we found later, had separately changed the properties on the shortcut calling the email program on startup.  But hadn’t, I confirmed today, changed the properties on the program listing under the Start button.)

Why, when you can’t retrieve to a location other than the original, does Windows randomly do that itself?  Why to a directory that doesn’t exist?  Why are (almost) all the properties changed?  Why aren’t all the properties changed?

Sometimes, when something very weird happens on the computer, and Gloria asks why, I shrug and says “It’s Windows.”  She says it makes me sound like a smart aleck when I say that.

Well, have you got a better explanation?

KHOBE: Say hello to my little friend(*)

Guess what? You personal firewall/IDS/Anti Virus/(insert next month’s buzzword here) isn’t going to save you from an attacker successfully executing code remotely on your machine:
http://www.zdnet.com/blog/hardware/update-new-attack-bypasses-every-windows-security-product/8268

So no, it’s not the doomsday weapon, but definitely worthy of the Scarface quote in the title.
This isn’t surprising, researchers find ways to bypass security defenses almost as soon as those defenses are implemented (remember non-executable stack?). Eliminating vulnerabilities in the first place is the way to go, guys, not trying to block attacks hoping your ‘shields’ hold up.

(*) If you’re reading this out loud you need to do so in a thick cuban accent