Microsoft August 2006 Patches: STATUS

Published: 2006-09-11. Last Updated: 2006-09-11 23:05:04 UTC
by Swa Frantzen (Version: 13)
0 comment(s)
Overview of the known problems and publicly known exploits ofthe August 2006 Microsoft patches.

# Known Problems with this patch
 Known Exploits
 client rating server rating
MS06-040 Issue with:
  • Huge memory allocations on Windows 2003 server SP1 (32bit & 64bit), XP (64bit) and 32bit application.
  • Microsoft Business Solutions?Navision 3.70 on above platform.
  • Websense Manager when using terminal services
Fix:
  • Hotfix available by calling Microsoft.
More information:
 Botnets actively exploiting this in  the WILD

Exploit available in easy to use package

read more...
 PATCH NOW
 PATCH NOW
MS06-041 No reported problems
Critical Critical
MS06-042 Critical issue:
  • This patch introduces a new arbitrary code execution vulnerability on MSIE 6 SP1.
Fix:
  • Microsoft re-released MS06-042 on Aug 24th 2006.
  • It is unclear if the hotfix that was available earlier fixes this problem as well.

More info:

Issue #1:
  • MSIE 6 SP1 crashes while using multiple application such as Peoplesoft, Siebel, Sage CRM and websites using HTTP 1.1 and compression such as the register.
  • Roll-up patch so it has all older issues as well.
Workaround:
  • Workaround to disable HTTP/1.1
  • Use alternate browser (for problem sites)
Fix:
  • Upgrade to MSIE 6 SP2
  • The re-release of the August 24th is intended to fix this. The fix was supposed to be published by Microsoft on August 22nd, 2006 but was delayed.
More Information:
Issue #2:
  • CA Unicenter Service Desk can cause MSIE to crash, on XP SP2 and Windows 2003 SP1
Workaround:
  • Use the supported Firefox or Mozilla browsers
  • KB923996
Fix:
  • The re-release of MS06-042 is not fixing this problem as far as we know.
More information:
Original MS06-42: fixes a.o. a  FTP vulnerability that;s well-known since 2004

First revision of the MS06-042  patch's buffer overglow has details public.
  • Microsoft released it first on the 22nd
  • actual code fragments were publicly released on the 24th after the patch was updated
 PATCH NOW
 Important
MS06-043 No reported problems
Important Less urgent
MS06-044 No reported problems
Critical Critical
MS06-045 No confirmed problems
Critical Less urgent
MS06-046 No reported problems
Critical Important
MS06-047 No reported problems Trojan dropper reported in word document by Symantec, Trendmicro(1) and Trendmicro(2).  The dropper loads a backdoor: Trendmicro, Symantec. 

See also diary.
 Critical Less urgent
MS06-048 No reported problems Trojan dropper in Powerpoint Critical Less urgent
MS06-049 Unconfirmed reports about corruption of files on compressed volumes.
[Windows 2000 only patch]
Important
 Less urgent
MS06-050 No reported problems
Critical Important
MS06-051 Although unconfirmed by Microsoft so far, there seem to be problems related to Terminal Services and multiple users loading certain DLLs as part of some applications. Details and fixes or workarounds are too sketchy so far.

See also the problem with .ini files and citrix at the citrix support forum.

We're still lookign for a more detailed discription of the problems.
Critical Critical

We will update issues on this page as they evolve.
We appreciate updates
US based customers can call Microsoft for free patch related support on 1-866-PCSAFETY
Keywords: Microsoft patch problems status
0 comment(s)

TOR servers seized by police in Germany

Published: 2006-09-11. Last Updated: 2006-09-11 21:36:51 UTC
by Daniel Wesemann (Version: 1)
0 comment(s)
Several sources report that last Thursday, a handful of TOR anonymizing proxy servers were seized by the law enforcement in Germany, apparently because the anonymizers were (next to their normal, privacy-protecting use) also abused to stealthily access and propagate child porn. A short write-up is posted on http://tor.eff.org/ , most of the other information (like in the Heise Blog ) is in German.

Keywords:
0 comment(s)

Log analysis and marketing decisions don't mix

Published: 2006-09-11. Last Updated: 2006-09-11 06:49:13 UTC
by Daniel Wesemann (Version: 1)
0 comment(s)
As Jim wrote in yesterday's diary, there are several good tools available to check for suspicious patterns in your log files. But every now and then, vendor marketing decisions will throw you a curve ball - like happened to me when we upgraded a Cisco PIX to one of the shiny new "Adaptive Security Appliances (ASA)" from same vendor. Yes it does come with a few new features, but pretty much still looks like a PIX.  Except for one little detail:

Sep 10 08:22:07 raz1-fw Sep 10 08:22:07 %PIX-3-313001: Denied ICMP type=8, code=0 from 67.x.y.z on interface outside
Sep 10 23:45:15 raz1-fw Sep 10 23:45:15 %ASA-3-313001: Denied ICMP type=8, code=0 from 64.x.y.z on interface outside

Anyone spot the difference? At least exchanging %PIX against %ASA in all log filtering regexpes is something that can be done with a script on SEC and its Bleedingsnort rules. But if you are using an off the shelf (closed source) log "correlation" product and happen to upgrade your Cisco Firewall, be wary of the peace and quiet that will set in on your alert screen...


Keywords:
0 comment(s)

Comments

Login here to join the discussion.


Diary Archives