March Black Tuesday Overview
Overview of the March 2008 Microsoft patches and their status.
| # | Affected | Contra Indications | Known Exploits | Microsoft rating | ISC rating(*) | |
|---|---|---|---|---|---|---|
| clients | servers | |||||
| MS08-014 | Multiple vulnerabilities allow code execution when opening a malicious file. Replaces MS07-044, MS07-036 and MS08-013. |
|||||
|
Excel |
At least one vulnerability was abused in targeted attacks. MSRC blog Past diary |
Critical | PATCH NOW | Important | ||
| MS08-015 | Vulnerability in parsing of "mailto:" URIs allows Remote Code Execution. Replaces MS07-003. |
|||||
| Outlook CVE-2008-0110 |
KB 949031 |
No publicly known exploits | Critical | Critical | Important | |
| MS08-016 | Multiple vulnerabilities allow for code execution upon opening a malicious document. Replaces MS07-015, MS07-025 and MS08-013. |
|||||
| Office CVE-2008-0113 CVE-2008-0118 |
KB 949030 | No publicly known exploits | Critical | Critical | Important | |
| MS08-017 | Multiple vulnerabilities allow Remote Code Execution. Affects clients through the web vector and for as of yet, unexplained reasons also certain versions of BizTalk, Commerce and ISA servers. | |||||
| Office web components CVE-2006-4695 CVE-2007-1201 |
KB 933103 |
No publicly known exploits | Critical | Critical | Critical(**) | |
We appreciate updates
US based customers can call Microsoft for free patch related support on 1-866-PCSAFETY
- We use 4 levels:
- PATCH NOW: Typically used where we see immediate danger of exploitation. Typical environments will want to deploy these patches ASAP. Workarounds are typically not accepted by users or are not possible. This rating is often used when typical deployments make it vulnerable and exploits are being used or easy to obtain or make.
- Critical: Anything that needs little to become "interesting" for the dark side. Best approach is to test and deploy ASAP. Workarounds can give more time to test.
- Important: Things where more testing and other measures can help.
- Less Urgent: Typically we expect the impact if left unpatched to be not that big a deal in the short term. Do not forget them however.
- The difference between the client and server rating is based on how you use the affected machine. We take into account the typical client and server deployment in the usage of the machine and the common measures people typically have in place already. Measures we presume are simple best practices for servers such as not using outlook, MSIE, word etc. to do traditional office or leisure work.
- The rating is not a risk analysis as such. It is a rating of importance of the vulnerability and the perceived or even predicted threat for affected systems. The rating does not account for the number of affected systems there are. It is for an affected system in a typical worst-case role.
- Only the organization itself is in a position to do a full risk analysis involving the presence (or lack of) affected systems, the actually implemented measures, the impact on their operation and the value of the assets involved.
- All patches released by a vendor are important enough to have a close look if you use the affected systems. There is little incentive for vendors to publicize patches that do not have some form of risk to them.
(**): Default classification due to lack of information at this point in time
--
Swa Frantzen -- Gorilla Security
MSIE 5 and 6 FTP vulnerability
The many out there still using older versions of MSIE (such as Internet Explorer 5 or 6), might well be interested in two new vulnerabilities discovered and made public today on full disclosure.
It looks somewhat like a Cross Site Request Forgery (CSRF) attack: A malicious URL you (somehow) hit. It can be unintentional on the user's part through e.g. an injected iframe on a forum. The URL tells the client to contact another server and does some bad things there that the user never intended, but had the authorization to do. The twist in this case is that the second hit doing damage can also be a FTP request, not just a HTTP request.
Still normally you can only log in and download (GET) files using a URL, and if the FTP server is requiring authentication, the user or the URL should enter the login/password, tipping them off something strange is going on or the attacker already knowing the credential.
That's true, till you see the duo of bugs in IE:
- Apparently IE5 and IE6 allow other commands too, such as deleting files by constructing a URL with %-encoded line-breaks.
- Similarly IE 5 and IE6 allow the URL to be constructed in such a manner as to try to re-authenticate with cached credentials.
IE7 is claimed not to suffer from this, so if you need a bit more incentive to (be allowed to) upgrade, this might just be it.
--
Swa Frantzen -- Gorilla Security
Firewire in the limelight
Let's start with a warning: there's little news in here as it was made public by Adam Boileau at RUXCON 2006 (presentation), but went by relatively unnoticed by the big public at that time. Still in the aftermath of the "coldboot" paper the Firewire attack vector gained some more attention.
The short story: Just like (cold) DRAM doesn't behave like most of us thought, neither is Firewire that similar in features to USB. Firewire allows much more than USB. E.g. Firewire connected peripheral devices can read and write RAM on the host directly (using DMA, so the CPU doesn't come into play at all). So a Firewire device connected to e.g. a screen-locked machine could gain access to the machine or it's secrets like encryption keys.
The attack vector is physical access to a bus on a computer just like your PCI bus. Introduce a malicious device into a system and the entire system is untrustworthy. This however can also be used in forensic cases, and as such there is possibility for good use too.
How to defend against this attack vector becomes very complex as those which physical access could simply add a Firewire adapter to a PCCARD bus and wait for the OS to install the drivers and activate the card. Also noticing the attack isn't trivial as e.g. a (somewhat modified) iPod can be used to perform the attack.
Firewire is also known as IEEE-1394 or "iLink" (Sony).
UPDATE: Thorsten wrote in to reference the even earlier work by Max Dornseif, who published about this attack back in 2004 at PacSec and 2005 at CanSec.
--
Swa Frantzen -- Gorilla Security
Real player exploit made public
Real player is probably installed on many of your computers, and an exploit for an unpatched vulnerability was made public on the full-disclosure mailing list.
As a result, those using ActiveX capable browsers (read: MSIE) are vulnerable to attack, with no patch on the horizon yet.
Workarounds:
- Set killbits for:
rmoc3260.dll version 6.0.10.45
{2F542A2E-EDC9-4BF7-8CB1-87C9919F7F93}
{CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA}
But this will also remove the genuine functionality of the player. - Use a browser that doesn't support ActiveX (there's plenty of those).
--
Swa Frantzen -- Gorilla Security
Comments