[guru] Microsoft biztonsagi frissitesek
DATE: Tue, 20 May 2008 10:52:05 +0200
Az I2O (Intelligent Input/Output) egy igazán soha el nem terjedt csatoló
felület, de néhányan még mindíg használják. A Windows-os meghajtóprogramja
hibás, az \\.\I2OExc eszközhöz az Everyone csoport tagjai hozzáférhetnek,
így jogosulatlan parancsokat adhatnak ki. Emellett a program még az átadott
paramétereket sem ellenőrzi, így tetszőleges felhasználói vagy kernel
memória felülírható.
Stack buffer overflow hibát találtak az MS Office JetDB struktúráinak
kezelésében. A hiba lényege, hogy az oszlopok számában megbízik a program,
és a megadott területet szó nélkül egy veremben található változóba másolja.
Az MS Word hibásan dolgozza fel az RTF állományokat, betöltés közben
heap overflow hiba léphet fel.
Az MS Word rosszul kezeli, ha HTML állományok esetén túl sok CSS (Cascading
Style Sheet) állományt használunk. Ebben az esetben double free hiba lép
fel, ami kód futtatást eredményezhet.
Az MS Office Publisher hibásan dolgozza fel a PUB állományokat, ez kód
futtatást eredményezhet.
Megjelentek a legújabb MS javítócsomagok, kiadtak erről egy CERT advisory-t
is.
--- Begin Message ---
iDefense Security Advisory 05.12.08
http://labs.idefense.com/intelligence/vulnerabilities/
May 12, 2008
I. BACKGROUND
Intelligent Input/Output (I2O) is a defunct computer input/output (I/O)
specification. i2omgmt.sys is a Windows driver for the I2O Utility
Filter. For more background information about I2O, see following
website.
http://en.wikipedia.org/wiki/I2O
II. DESCRIPTION
Local exploitation of an input validation vulnerability within version
5.1.2600.2180 of i2omgmt.sys, as included with Microsoft Corp's Windows
XP operating system, could allow an attacker to execute arbitrary code
in the context of the kernel.
This vulnerability specifically exists due to insecure permissions on
the \\.\I2OExc device interface. The permissions on this device allow
"Everyone" write access. This could allow a locally logged-in user to
access functionality designed for privileged use only.
Additionally, the IOCTL handlers for this device interface do not
properly validate user-mode buffer passed to them, so an attacker can
supply a fake DeviceObject pointer to a user-mode address. As such, it
is possible to overwrite arbitrary memory or execute attacker-supplied
code in the context of the kernel.
III. ANALYSIS
Exploitation allows an attacker to elevate privileges by overwriting
arbitrary system memory or executing code within kernel context. An
attacker needs to log-in to the target machine to exploit this
vulnerability.
This driver is related to I2O protocol and RAID devices. It is not
present by default on every Windows installation. However, iDefense
found this driver loaded on several systems we tested.
IV. DETECTION
iDefense has confirmed the existence of this vulnerability in
i2omgmt.sys version 5.1.2600.2180 as installed on some Windows XP SP2
systems. All other Windows releases with this driver, including
previous versions, are suspected to be vulnerable.
V. WORKAROUND
Removing write permissions for "Everyone" appears to prevent access to
the vulnerable code. Although no side effects were witnessed in lab
tests, normal functionality may be hindered.
VI. VENDOR RESPONSE
Microsoft has addressed this issue within Windows XP Service Pack 3. To
obtain Microsoft XP Service Pack 3, visit the following URL.
http://www.microsoft.com/downloads/details.aspx?FamilyID=5b33b5a8-5e76-401f-be08-1e1555d4f3d4
VII. CVE INFORMATION
The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CVE-2008-0322 to this issue. This is a candidate for inclusion in
the CVE list (http://cve.mitre.org/), which standardizes names for
security problems.
VIII. DISCLOSURE TIMELINE
03/20/2007 Initial vendor notification
03/20/2007 Initial vendor response
05/12/2008 Coordinated public disclosure
IX. CREDIT
This vulnerability was reported to iDefense by Rubén Santamarta of
reversemode.com.
Get paid for vulnerability research
http://labs.idefense.com/methodology/vulnerability/vcp.php
Free tools, research and upcoming events
http://labs.idefense.com/
X. LEGAL NOTICES
Copyright © 2008 iDefense, Inc.
Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of iDefense. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically,
please e-mail customerservice@idefense.com for permission.
Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct,
indirect, or consequential loss or damage arising from use of, or
reliance on, this information.
--- End Message ---
--- Begin Message ---
TPTI-08-04: Microsoft Office Jet Database Engine Column Parsing Stack
Overflow Vulnerability
http://dvlabs.tippingpoint.com/advisory/TPTI-08-04
May 13, 2008
-- CVE ID:
CVE-2007-6026
-- Affected Vendors:
Microsoft
-- Affected Products:
Microsoft Office Word
Microsoft Office Access
-- TippingPoint(TM) IPS Customer Protection:
TippingPoint IPS customers have been protected against this
vulnerability by Digital Vaccine protection filter ID 6040, 6041.
For further product information on the TippingPoint IPS, visit:
http://www.tippingpoint.com
-- Vulnerability Details:
This vulnerability allows remote attackers to execute arbitrary code on
vulnerable installations of Microsoft Office. Exploitation requires that
the target opens an Office file that contains malicious Jet DB Engine
objects.
The specific flaw exists within the parsing of a column structure. The
DWORD value from the structure that specifies the column count is
trusted. If this value is changed, an inline memcpy to the stack can
overflow while reading a column name. Typically Jet DB structures are
used within MDB files which are considered unsafe. However, it is
possible to embed such files within a trusted format, such as an Office
Document (.doc). This issue allows for remote code execution under the
context of the currently logged in user.
-- Vendor Response:
Microsoft has issued an update to correct this vulnerability. More
details can be found at:
http://www.microsoft.com/technet/security/Bulletin/ms08-028.mspx
-- Disclosure Timeline:
2008-04-19 - Vulnerability reported to vendor
2008-05-13 - Coordinated public release of advisory
-- Credit:
This vulnerability was discovered by:
* Aaron Portnoy, TippingPoint DVLabs
--- End Message ---
--- Begin Message ---
ZDI-08-023: Microsoft Office RTF Parsing Engine Memory Corruption
Vulnerability
http://www.zerodayinitiative.com/advisories/ZDI-08-023
August 14, 2007
-- CVE ID:
CVE-2008-1091
-- Affected Vendors:
Microsoft
-- Affected Products:
Microsoft Office Excel
Microsoft Office Word
-- TippingPoint(TM) IPS Customer Protection:
TippingPoint IPS customers have been protected against this
vulnerability by Digital Vaccine protection filter ID 6099.
For further product information on the TippingPoint IPS, visit:
http://www.tippingpoint.com
-- Vulnerability Details:
This vulnerability allows remote attackers to execute arbitrary code on
vulnerable installations of Microsoft Office. User interaction is
required to exploit this vulnerability in that the target must visit a
malicious page, open a malicious email, or open a malicious file.
The specific flaw exists when parsing malformed RTF documents. When
processing a combination of RTF tags a heap overflow occurs. Successful
exploitation can lead to remote compromise of a system under the
credentials of the currently logged in user.
-- Vendor Response:
Microsoft has issued an update to correct this vulnerability. More
details can be found at:
http://www.microsoft.com/technet/security/bulletin/ms08-026.mspx
-- Disclosure Timeline:
2008-01-21 - Vulnerability reported to vendor
2008-05-13 - Coordinated public release of advisory
-- Credit:
This vulnerability was discovered by:
* wushi of team509
-- About the Zero Day Initiative (ZDI):
Established by TippingPoint, The Zero Day Initiative (ZDI) represents
a best-of-breed model for rewarding security researchers for responsibly
disclosing discovered vulnerabilities.
Researchers interested in getting paid for their security research
through the ZDI can find more information and sign-up at:
http://www.zerodayinitiative.com
The ZDI is unique in how the acquired vulnerability information is
used. TippingPoint does not re-sell the vulnerability details or any
exploit code. Instead, upon notifying the affected product vendor,
TippingPoint provides its customers with zero day protection through
its intrusion prevention technology. Explicit details regarding the
specifics of the vulnerability are not exposed to any parties until
an official vendor patch is publicly available. Furthermore, with the
altruistic aim of helping to secure a broader user base, TippingPoint
provides this vulnerability information confidentially to security
vendors (including competitors) who have a vulnerability protection or
mitigation product.
Our vulnerability disclosure policy is available online at:
http://www.zerodayinitiative.com/advisories/disclosure_policy/
CONFIDENTIALITY NOTICE: This e-mail message, including any attachments,
is being sent by 3Com for the sole use of the intended recipient(s) and
may contain confidential, proprietary and/or privileged information.
Any unauthorized review, use, disclosure and/or distribution by any
recipient is prohibited. If you are not the intended recipient, please
delete and/or destroy all copies of this message regardless of form and
any included attachments and notify 3Com immediately by contacting the
sender via reply e-mail or forwarding to 3Com at postmaster@3com.com.
--- End Message ---
--- Begin Message ---
iDefense Security Advisory 05.13.08
http://labs.idefense.com/intelligence/vulnerabilities/
May 13, 2008
I. BACKGROUND
Microsoft Word is a word processing application that is distributed with
Microsoft Office. Cascading Style Sheets (CSS) is a stylesheet language
used to describe the presentation of a document written in a markup
language. For more information about Microsoft Word, visit the
following URL.
http://office.microsoft.com/en-us/word/default.aspx
II. DESCRIPTION
Remote exploitation of a memory corruption vulnerability in Microsoft
Corp.'s Word could allow attackers to execute arbitrary code with the
privileges of the logged in user.
This vulnerability exists in the way Word handles CSS rules in an HTML
document. When the number of CSS selectors is above some specific
amount, an unspecified object will be corrupted causing Word to access
a memory region that has already been freed.
III. ANALYSIS
Exploitation allows remote attackers to execute arbitrary code on the
affected host in the context of the user. Exploitation requires that
the user opens a specially crafted HTML document using Microsoft Word.
The most likely exploitation vector involves convincing a user to open
an HTML document, with a DOC extension, sent to them via e-mail or
linked on a website.
IV. DETECTION
iDefense has confirmed fully patched Microsoft Word 2003 SP2, Microsoft
Word XP SP3, Microsoft Word 2000 SP3 are vulnerable. Microsoft Word
2003 SP3 and Microsoft Word 2007 do not appear to be affected.
Microsoft reports that all supported versions of Word, Word Viewer, and
Outlook 2007 are vulnerable.
V. WORKAROUND
Users of Office 2003 and Office 2007 that have installed all security
patches as of May 2007 can use the Microsoft Office File Block policy
to prevent opening files of this type. To deploy this workaround, save
and import the following registry file for the corresponding version of
Office.
Office 2003:
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Word\Security\FileOpenBlock]
"HTMLFiles"=dword:00000001
Office 2007:
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\12.0\Word\Security\FileOpenBlock]
"HTMLFiles"=dword:00000001
VI. VENDOR RESPONSE
Microsoft has officially addressed this vulnerability with Security
Bulletin MS08-026. For more information, consult their bulletin at the
following URL.
http://www.microsoft.com/technet/security/bulletin/ms08-026.mspx
VII. CVE INFORMATION
The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CVE-2008-1434 to this issue. This is a candidate for inclusion in
the CVE list (http://cve.mitre.org/), which standardizes names for
security problems.
VIII. DISCLOSURE TIMELINE
11/08/2007 Initial vendor notification
11/08/2007 Initial vendor response
05/13/2008 Coordinated public disclosure
IX. CREDIT
This vulnerability was discovered by Jun Mao of iDefense Labs.
Get paid for vulnerability research
http://labs.idefense.com/methodology/vulnerability/vcp.php
Free tools, research and upcoming events
http://labs.idefense.com/
X. LEGAL NOTICES
Copyright © 2008 iDefense, Inc.
Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of iDefense. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically,
please e-mail customerservice@idefense.com for permission.
Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct,
indirect, or consequential loss or damage arising from use of, or
reliance on, this information.
--- End Message ---
--- Begin Message ---
/********************************************************************************************
Please join us to pray for the people still in the huge earthquake in
eastern Sichuan, China.
*********************************************************************************************/
Microsoft Office Publisher PUB File Parsing Remote Memory Corruption
Vulnerability
by cocoruder(frankruder_at_hotmail.com)
http://ruder.cdut.net
Summary:
A memory corruption vulnerability exists in Microsoft Office
Publisher while it is parsing PUB file. An attacker who successfully
exploit this vulnerability can execute arbitrary code on the affected
system.
Affected Software Versions:
Microsoft Office Publisher 2007 0
Microsoft Office Publisher 2003 SP3
Microsoft Office Publisher 2003 SP2
Microsoft Office Publisher 2002 SP3
Microsoft Office Publisher 2000 SP3
Microsoft Office Publisher 2007 SP1
Details:
Currently there is no details released.
Solution:
Microsoft has released an advisory for this vulnerability which is
available on:
http://www.microsoft.com/technet/security/bulletin/ms08-027.mspx
CVE Information:
CVE-2008-0119
Disclosure Timeline:
2007.12.10 Vendor notified
2007.12.10 Vendor responded
2008.05.13 Coordinated public disclosure
--EOF--
--- End Message ---
--- Begin Message ---
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
National Cyber Alert System
Technical Cyber Security Alert TA08-134A
Microsoft Updates for Multiple Vulnerabilities
Original release date: May 13, 2008
Last revised: --
Source: US-CERT
Systems Affected
* Microsoft Windows
* Microsoft Office
* Microsoft Jet Database Engine
* Microsoft Windows Live OneCare
* Microsoft Antigen
* Microsoft Windows Defender
* Microsoft Forefront Security
Overview
Microsoft has released updates that address vulnerabilities in
Microsoft Windows, Office, Jet Database Engine, Windows Live OneCare,
Antigen, Windows Defender, and Forefront Security.
I. Description
Microsoft has released updates to address vulnerabilities that affect
Microsoft Windows, Office, Jet Database Engine, Windows Live OneCare,
Antigen, Windows Defender, and Forefront Security as part of the
Microsoft Security Bulletin Summary for May 2008. The most severe
vulnerabilities could allow a remote, unauthenticated attacker to
execute arbitrary code. For more information, see the US-CERT
Vulnerability Notes Database.
II. Impact
A remote, unauthenticated attacker could execute arbitrary code, gain
elevated privileges, or cause a denial of service.
III. Solution
Apply updates from Microsoft
Microsoft has provided updates for these vulnerabilities in the May
2008 Security Bulletin Summary. The security bulletin describes any
known issues related to the updates. Administrators are encouraged to
note these issues and test for any potentially adverse effects.
Administrators should consider using an automated update distribution
system such as Windows Server Update Services (WSUS).
IV. References
* US-CERT Vulnerability Notes for Microsoft May 2008 updates -
<http://www.kb.cert.org/vuls/byid?searchview&query=ms08-may>
* Microsoft Security Bulletin Summary for May 2008 -
<http://www.microsoft.com/technet/security/bulletin/ms08-may.mspx>
* Microsoft Update -
<https://www.update.microsoft.com/microsoftupdate/>
* Windows Server Update Services -
<http://www.microsoft.com/windowsserversystem/updateservices/default.mspx>
____________________________________________________________________
The most recent version of this document can be found at:
<http://www.us-cert.gov/cas/techalerts/TA08-134A.html>
____________________________________________________________________
Feedback can be directed to US-CERT Technical Staff. Please send
email to <cert@cert.org> with "TA08-134A Feedback VU#534907" in the
subject.
____________________________________________________________________
For instructions on subscribing to or unsubscribing from this
mailing list, visit <http://www.us-cert.gov/cas/signup.html>.
____________________________________________________________________
Produced 2008 by US-CERT, a government organization.
Terms of use:
<http://www.us-cert.gov/legal.html>
____________________________________________________________________
Revision History
May 13, 2008: Initial release
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
iQEVAwUBSCnrE/RFkHkM87XOAQJAoAf/XrkJlT9AS30/CZwAMO9qta8TbtLQTZR3
/yAV/h2CmOKhFsbjdh8L4+GcP0n66twWhmMBfBs6BosOoaqqhkeJcE6JoyQ2Kso1
MnhXjPJuGtgEPcfYX9bg42rnZ5WDXGh9EuhoZVyUV4UeUQ8qRM8LL3OIWBHubE7R
fcOqIVDz/qtCC1U+RUdrbdeV8XB48mshiLoWjxzOT0FzeOKsBwsyHzaO5mAeEy4E
1hsLC2u4idGlq9Ezl82XODyH6vtHBKq7yKDv+FkVHbCqwB+thqPkUo2es+amASra
shcJggg39WWmPWphqnBz94rkdwitsvW3ymOWt1F27GecX1sveofLDQ==
=rhf4
-----END PGP SIGNATURE-----
--- End Message ---