"Erroneous VeriSign-Issued Digital Certificates Pose Spoofing Hazard" Patch

Security 11021 Published by Philipp Esselbach 0

In mid-March 2001, VeriSign, Inc., advised Microsoft that on January 29 and 30, 2001, it issued two VeriSign Class 3 code-signing digital certificates to an individual who fraudulently claimed to be a Microsoft employee. The common name assigned to both certificates is "Microsoft Corporation". The ability to sign executable content using keys that purport to belong to Microsoft would clearly be advantageous to an attacker who wished to convince users to allow the content to run.

The certificates could be used to sign programs, ActiveX controls, Office macros, and other executable content. Of these, signed ActiveX controls and Office macros would pose the greatest risk, because the attack scenarios involving them would be the most straightforward. Both ActiveX controls and Word documents can be delivered via either web pages or HTML mails. ActiveX controls can be automatically invoked via script, and Word documents can be automatically opened via script unless the user has applied the Office Document Open Confirmation Tool.

Read more

First virus to infect Windows, Linux emerges

Security 11021 Published by Philipp Esselbach 0

A computer virus that can infect PCs running either the ubiquitous Windows operating system or the increasingly popular Linux operating system emerged Tuesday, which its discoverers say is a world first.

The virus, dubbed "W32.Winux" by the company that first reported it, anti-virus firm Central Command, is not destructive and does not appear to have infected any computers yet.

Read more

Visual Studio VB-TSQL Object Contains Unchecked Buffer Patch

Security 11021 Published by Philipp Esselbach 0

The VB-TSQL debugger object that ships with Visual Studio 6.0 Enterprise Edition has an unchecked buffer in the code that processes parameters for one of the object´s methods. The object can, by design, be programmatically accessed remotely. If the object were to be referenced by a program that contained specially malformed data within the parameter, eitherof two outcomes would result. In the less serious case, the attacker could cause the object to fail on the hosting machine. In the more serious case, the attacker could exploit the buffer overrun to run code of the attacker´s choice on the hosting machine.

The debugger object (vbsdicli.exe) is installed by default with Visual Studio 6.0 Enterprise Edition and runs in the context of the interactively logged-on user. The attacker could only execute a successful attack if he knew that a user had the component installed and that the user was logged in at the time of the attack.

Read more

Erroneous VeriSign-Issued Digital Certificates Pose Spoofing Hazard

Security 11021 Published by Philipp Esselbach 0

Issue:
======
VeriSign, Inc., recently advised Microsoft that on January 30 and 31,
2001, it issued two VeriSign Class 3 code-signing digital certificates to an individual who fraudulently claimed to be a Microsoft employee. The common name assigned to both certificates is "Microsoft Corporation". The ability to sign executable content using keys that purport to belong to Microsoft would clearly be advantageous to an attacker who wished to convince users to allow the content to run.
The certificates could be used to sign programs, ActiveX controls, Office macros, and other executable content. Of these, signed ActiveX controls and Office macros would pose the greatest risk, because the attack scenarios involving them would be the most straightforward. Both ActiveX controls and Word documents can be delivered via either web pages or HTML mails. ActiveX controls can be automatically invoked via script, and Word documents can be automatically opened via script unless the user has applied the Office Document Open Confirmation Tool.

Affected Software:
==================
Microsoft Windows:registered: 95
Microsoft Windows 98
Microsoft Windows Me
Microsoft Windows NT:registered: 4.0
Microsoft Windows 2000

Read more

Malformed WebDAV Request Can Cause IIS to Exhaust CPU Resources

Security 11021 Published by Philipp Esselbach 0

The original version of this bulletin provided a workaround
(discussed in Knowledge Base article Q241520) that would protect
affected systems by disabling WebDAV services. However, a security
patch is now available that eliminates the vulnerability, and
Microsoft recommends using the patch rather than the workaround.

Download

Malformed WebDAV Request Can Cause IIS to Exhaust CPU Resources

Security 11021 Published by Philipp Esselbach 0

Issue:
======
WebDAV is an extension to the HTTP protocol that allows remote authoring and management of web content. In the Windows 2000 implementation of the protocol, IIS 5.0 performs initial processing of all WebDAV requests, then forwards the appropriate commands to the WebDAV process. However, a flaw exists in the way WebDAV handles a particular type of malformed request. If a stream of such requests were directed at an affected server, it would consume all CPU availability on the server.

Because the discoverer of this vulnerability has chosen to publish code to exploit this vulnerability before a patch could be developed, Microsoft has developed a workaround that can be used to defend against attack. Knowledge Base article Q241520 provides step-by-step instructions for changing the permissions on the .DLL that provides WebDAV services in order to effectively disable it on the machine. When a patch is available, we will re-release this bulletin and provide updated information.

Read more

IE can Divulge Location of Cached Content

Security 11021 Published by Philipp Esselbach 0

The IE security architecture provides a caching mechanism that is used to store content that needs to be downloaded and processed on the user´s local machine. The purpose of the cache is to obfuscate the physical location of the cached content, in order to ensure that the web page or HTML e-mail will work through the IE security architecture to access the information. This ensures that the uses of the information can be properly restricted.

A vulnerability exists because it is possible for a web page or HTML e-mail to learn the physical location of cached content. Armed with this information, an attacker could cause the cached content to be opened in the Local Computer Zone. This would enable him to launch compiled HTML help (.CHM) files that contain shortcuts to executables, thereby enabling him to run the executables.

Read more

Norton AntiVirus Virus Definitions Update

Security 11021 Published by Philipp Esselbach 0

Symantec has released a new virus definitions update for Norton AntiVirus.

This update will work on the following products:

NAV for Lotus Notes (Intel)
NAV for MS Exchange (Intel)
NAV 4.0, 5.0 and 2000 for Win9x
NAV 4.0, 5.0 and 2000 for WinNT
NAV 2000 for Win2000
NAV for Firewalls
pcAnywhere32 7.5 and higher for WinNT
Norton Utilities for Windows 95/98 (all versions)
Norton SystemWorks (all versions)

Download

Malformed URL can cause Service Failure in IIS 5.0 and Exchange 2000

Security 11021 Published by Philipp Esselbach 0

IIS 5.0 contains a flaw affecting the way that an URL is handled if it has a specific construction and its length is within a very narrow range of values. If such an URL were repeatedly sent to an affected system, a confluence of events could cause a memory allocation error that would result in the failure of the IIS service.

Exchange 2000 is affected by the same vulnerability. To support web-based mail clients, it introduces the ability to address items on the store via URLs. This is done in part by using IIS 5.0, and in part via code that is specific to Exchange 2000. Both pieces of code contain the flaw, but the effect of exploiting the vulnerability via either would be the same -- it could be used to cause the IIS service to fail, but could not be used to attack the Exchange service itself. That is, successfully attacking an Exchange server via this vulnerability would disrupt web-based mail clients´ use of the server, but not that of MAPI-based mail clients like Outlook.

Read more/Download

Windows 2000 Event Viewer Contains Unchecked Buffer Patch

Security 11021 Published by Philipp Esselbach 0

The Windows 2000 event viewer snap-in has an unchecked buffer in a section of the code that displays the detailed view of event records. If the event viewer attempted to display an event record that contained specially malformed data in one of the fields, either of two outcomes would result. In the less serious case, the event viewer would fail. In the more serious case, code of the attacker´s choice could be made to run via a buffer overrun.

By design, unprivileged processes can log events in the System and Application logs, and interactively logged-on, unprivileged users can view them. However, only privileged processes can log events in the Security log, and only interactively logged-on administrators can view them. If the vulnerability were exploited to run code of the attacker´s choice, the code would run in the security context of the user who viewed the affected record.

Read more/Download

Outlook, Outlook Express Vcard Handler Contains

Security 11021 Published by Philipp Esselbach 0

Outlook Express provides several components that are used both by it
and Outlook, if Outlook is installed on the machine. One such
component, used to process vCards, contains an unchecked buffer.

By creating a vCard and editing it to contain specially chosen data,
then sending it to another user, an attacker could cause either of
two effects to occur if the recipient opened it. In the less serious
case, the attacker could cause the mail client to fail. If this
happened, the recipient could resume normal operation by restarting
the mail client and deleting the offending mail. In the more serious
case, the attacker could cause the mail client to run code of her
choice on the user´s machine. Such code could take any desired
action, limited only by the permissions of the recipient on the
machine.

Read more/Download

Malformed Request to Domain Controller can Cause Denial

Security 11021 Published by Philipp Esselbach 0

A core service running on all Windows 2000 domain controllers (but
not on any other machines) contains a flaw affecting how it processes
a certain type of invalid service request. Specifically, the service
should handle the request at issue here by determining that it is
invalid and simply dropping it; in fact, the service performs some
resource-intensive processing and then sends a response.

If an attacker sent a continuous stream of such requests to an
affected machine, it could consume most or all of the machine´s CPU
availability. This could cause the domain controller to process
requests for service slowly or not at all, and could limit the number
of new logons the machine could process and the number of Kerberos
tickets that could be issued.

Affected Software:
Microsoft:registered: Windows:registered: 2000 Server
Microsoft Windows 2000 Advanced Server
Microsoft Windows 2000 Datacenter Server

Download

Previous Page

Next Page

Windows

Linux

macOS

Community

  • gavindi
    Mt. Sync is a native GNOME desktop application that puts ...
  • Lexonight
    Hey everyone,Wanted to share a project I've been b ...
  • SeveG
    need some help here... situationPC= Packard BellOS= win1 ...