Category Archives: Emerging Threats

Intel Centrino Wireless Exploit

Posted on by
Reply

A popular attack framework has released an exploit that takes advantage of a vulnerability within older Intel Centrino wireless drivers. Specifically the Intel 2200BG has this issue. The vulnerability exists with the w22n51.sys driver which has a buffer overflow. It would be a very good idea to make sure you are running the latest wireless drivers if you’re using an Intel Centrino based laptop, as the exploit will infect every machine vulnerable within the vicinity at the kernel level.

Cisco Network Admission Control Appliance Vulnerability

Posted on by
Reply

The Cisco Network Admission Control Appliance (NAC) contains a vulnerability that allows the shared secret used by the Cisco Clean Access Server (CAS) and the Cisco Clean Access Manager (CAM) to be captured. This can then be leveraged to gain control over the CAS.

The following versions of NAC are known to be vulnerable:
 All 3.5.x versions
 All 3.6.x versions prior to 3.6.4.4
 All 4.0.x versions prior to 4.0.6
 All 4.1.x versions prior to 4.1.2

For full details see Cisco’s original advisory at: http://www.cisco.com/warp/public/707/cisco-sa-20080416-nac.shtml

CA Products ActiveX Control Vulnerabilities

Posted on by
Reply

The ActiveX control gui_cm_ctrls.ocx in a number of CA products contains vulnerabilities caused by improper input validation. Successful exploits can lead to arbitrary code execution and could lead to full compromise of an affected system.

BrightStor ARCServe Backup for Laptops and Desktops r11.5 (Server only, client is not affected).
CA Desktop Management Suite r11.2 C2
CA Desktop Management Suite r11.2 C1
CA Desktop Management Suite r11.2a
CA Desktop Management Suite r11.2
CA Desktop Management Suite r11.1 (GA, a, C1)
Unicenter Desktop Management Bundle r11.2 C2
Unicenter Desktop Management Bundle r11.2 C1
Unicenter Desktop Management Bundle r11.2a
Unicenter Desktop Management Bundle r11.2
Unicenter Desktop Management Bundle r11.1 (GA, a, C1)
Unicenter Asset Management r11.2 C2
Unicenter Asset Management r11.2 C1
Unicenter Asset Management r11.2a
Unicenter Asset Management r11.2
Unicenter Asset Management r11.1 (GA, a, C1)
Unicenter Software Delivery r11.2 C2
Unicenter Software Delivery r11.2 C1
Unicenter Software Delivery r11.2a
Unicenter Software Delivery r11.2
Unicenter Software Delivery r11.1 (GA, a, C1)
Unicenter Remote Control r11.2 C2
Unicenter Remote Control r11.2 C1
Unicenter Remote Control r11.2a
Unicenter Remote Control r11.2
Unicenter Remote Control r11.1 (GA, a, C1)
CA Desktop and Server Management r11.2 C2
CA Desktop and Server Management r11.2 C1
CA Desktop and Server Management r11.2a
CA Desktop and Server Management r11.2
CA Desktop and Server Management r11.1 (GA, a, C1)

For full details see the original advisory at: https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=174256

Critical Oracle Vulnerabilities

Posted on by
Reply

Multiple vulnerabilities have been reported in the Oracle products listed below. The packages SDO_GEOM, SDO_IDX, and SDO_UTIL do not properly sanitize input, this can allow the injection of arbitrary SQL code. Additionally there are issues with the DBMS_STATS_INTERNAL package. These issues could allow an attacker to gain DBA privileges. There are additional issues that remain unspecified. See Oracle’s original advisory at: http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuapr2008.html

* Oracle Database 11g, version 11.1.0.6
* Oracle Database 10g Release 2, versions 10.2.0.2, 10.2.0.3
* Oracle Database 10g, version 10.1.0.5
* Oracle Database 9i Release 2, versions 9.2.0.8, 9.2.0.8DV
* Oracle Application Server 10g Release 3 (10.1.3), versions 10.1.3.1.0, 10.1.3.3.0
* Oracle Application Server 10g Release 2 (10.1.2), versions 10.1.2.0.2, 10.1.2.1.0, 10.1.2.2.0
* Oracle Application Server 10g (9.0.4), version 9.0.4.3
* Oracle Collaboration Suite 10g, version 10.1.2
* Oracle E-Business Suite Release 12, version 12.0.4
* Oracle E-Business Suite Release 11i, version 11.5.10.2
* Oracle PeopleSoft Enterprise PeopleTools versions 8.22.19, 8.48.16, 8.49.09
* Oracle PeopleSoft Enterprise HCM versions 8.8 SP1, 8.9, 9.0
* Oracle Siebel SimBuilder versions 7.8.2, 7.8.5

New Tools Keep Coming

Posted on by
Reply

Several new and updated tools have been released recently. These are mostly aimed at application scanning, specifically getting into the backend database. While it’s no surprise that these tools keep coming, we just want to reinforce the need for better application security. We don’t anticipate an end to attacker tools anytime soon, so keep your guards up 😉

Lotus Notes Multiple Keyview Parsing Vulnerabilities

Posted on by
Reply

Vulnerabilities in various third-party file viewing applications can leave systems using Lotus Notes open to compromise. In specific situations, specially crafted files can allow for the execution of arbitrary code. Lotus Notes versions 7.0.3 and 8.0 are known to be vulnerable, other versions may also have issues. The file types that can be used to leverage this vulnerability are:
 Applix Presents (.ag)
 Folio Flat File (.fff)
 HTML speed reader (.htm)
 KeyView document viewing engine
 Text mail (MIME)

These issues were originally discovered by the Secunia Research team. More information can be found at: http://secunia.com/advisories/28210

IBM’s response, including remediation suggestions is available at: http://www.ibm.com/support/docview.wss?rs=463&uid=swg21298453

Microsoft Security Bulletin Summary for April 2008

Posted on by
Reply

Microsoft released a total of 5 Critical and 3 Important security bulletins for the month of April. The breakdown is as follows:

MS08-018 – Critical – Vulnerability in Microsoft Project Could Allow Remote Code Execution (950183)

Undisclosed vulnerabilities in Microsoft Office Project. These could allow an attacker to use a specially crafted Project file to take complete control of the affected system.

Affected software:
Microsoft Project 2000 Service Release 1 (KB949043)
Microsoft Project 2002 Service Pack 1 (KB949005)
Microsoft Project 2003 Service Pack 2 (KB948962)

For full details see the original advisory at:
http://www.microsoft.com/technet/security/bulletin/ms08-018.mspx

MS08-021 – Critical – Vulnerabilities in GDI Could Allow Remote Code Execution (948590)

Undisclosed vulnerabilities in GDI. These could allow an attacker to use a specially      crafted EMF or WMF image files to take complete control of the affected system.

Affected Software
Microsoft Windows 2000 Service Pack 4
Windows XP Service Pack 2
Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP1 for Itanium-based Systems and Windows Server 2003 with SP2 for Itanium based Systems
(Note that for the above platforms MS08-021 replaces MS07-046)
Windows Vista and Windows Vista Service Pack 1
Windows Vista x64 Edition and Windows Vista x64 Edition Service Pack 1
Windows Server 2008 for 32-bit Systems
Windows Server 2008 for x64-based Systems
Windows Server 2008 for Itanium-based Systems

For full details see the original advisory at:
http://www.microsoft.com/technet/security/bulletin/ms08-021.mspx

MS08-022 – Critical – Vulnerability in VBScript and JScript Scripting Engines Could Allow Remote Code Execution (944338)

Undisclosed vulnerabilities in the VBScript and JScript scripting engines. These could allow an attacker to take complete control of the affected system.

Affected Software
VBScript 5.1 and JScript 5.1 on Microsoft Windows 2000 Service Pack 4
VBScript 5.6 and JScript 5.6 on Microsoft Windows 2000 Service Pack 4
VBScript 5.6 and JScript 5.6 on Windows XP Service Pack 2
VBScript 5.6 and JScript 5.6 on Windows XP Professional x64 Edition and Windows XP     Professional x64 Edition Service Pack 2
VBScript 5.6 and JScript 5.6 on Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2
VBScript 5.6 and JScript 5.6 on Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2
VBScript 5.6 and JScript 5.6 on Windows Server 2003 with SP1 for Itanium-based Systems and Windows Server 2003 with SP2 for Itanium based Systems
(Note that for the above platforms MS08-022 replaces MS06-023)

For full details see the original advisory at:
http://www.microsoft.com/technet/security/bulletin/ms08-022.mspx

MS08-023 – Critical – Security Update of ActiveX Kill Bits (948881)

An undisclosed vulnerability for ActiveX components. The vulnerability could allow an attacker to use a specially crafted Web page as a vector for remote code execution. The
severity of any compromise may depend upon the level of administrative rights of the user account.

Affected Software:
Microsoft Windows 2000 Service Pack 4 with Internet Explorer 5.01 Service Pack 4
Microsoft Windows 2000 Service Pack 4 with Internet Explorer 6 Service Pack 1
Windows XP Service Pack 2
Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP1 for Itanium-based Systems and Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista and Windows Vista Service Pack 1
Windows Vista x64 Edition and Windows Vista x64 Edition Service Pack 1
Windows Server 2008 for 32-bit Systems
Windows Server 2008 for x64-based Systems
Windows Server 2008 for Itanium-based Systems

For full details see the original advisory at:
http://www.microsoft.com/technet/security/bulletin/ms08-023.mspx

MS08-024 – Critical – Cumulative Security Update for Internet Explorer (947864)

This security update resolves one privately reported vulnerability. The vulnerability could allow remote code execution if a user viewed a specially crafted Web page using Internet Explorer. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Microsoft Windows 2000 Service Pack 4
with Internet Explorer 5.01 Service Pack 4
or Internet Explorer 6 Service Pack 1

Windows XP Service Pack 2
Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP1 for Itanium-based Systems and Windows Server 2003 with SP2 for Itanium-based Systems
with Internet Explorer 6

Windows XP Service Pack 2
Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP1 for Itanium-based Systems and Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista and Windows Vista Service Pack 1
Windows Vista x64 Edition and Windows Vista x64 Edition Service Pack 1
Windows Server 2008 for 32-bit Systems
Windows Server 2008 for x64-based Systems
Windows Server 2008 for Itanium-based Systems
with Internet Explorer 7

For full details see the original advisory at:
http://www.microsoft.com/technet/security/bulletin/ms08-024.mspx

MS08-020 – Important – Vulnerability in DNS Client Could Allow Spoofing (945553)

An undisclosed vulnerability that could allow an attacker to spoof or redirect Internet traffic on affected systems.

For full details see the original advisory at:
http://www.microsoft.com/technet/security/bulletin/ms08-020.mspx

MS08-025 – Important –Vulnerability in Windows Kernel Could Allow Elevation of Privilege (941693)

An undisclosed vulnerability in the Windows kernel. Can allow a local attacker to take complete control of an affected system.

For full details see the original advisory at:
http://www.microsoft.com/technet/security/bulletin/ms08-025.mspx

MS08-019 – Important –Vulnerabilities in Microsoft Visio Could Allow Remote Code Execution (949032)

Undisclosed vulnerabilities in Microsoft Office Visio. These could allow an attacker to use specially crafted Visio files to perform remote code execution or take complete control of an affected system.

For full details see the original advisory at:
http://www.microsoft.com/technet/security/bulletin/ms08-019.mspx

HP OpenView Network Node Manager Vulnerabilities

Posted on by
Reply

An independent researcher, Luigi Auriemma, has found several vulnerabilities in Version 7.53 of HP’s OpenView Network Node Manager. These include a format string error and stack based buffer overflows and Denial of Service issues. All of the vulnerabilities were discovered within the ovalarmsrv.exe process which listens on ports 2953 and 2954. If you are running this product you should ensure that access is limited to known and trusted parties. The original advisory can be found at: http://aluigi.altervista.org/adv/ovalarmsrv-adv.txt

Bot-nets Continue to Grow in Scope and Danger

Posted on by
Reply

There is quite a bit of talk online right now about a new bot-net that is supposedly quite a bit larger than Storm. This new bot-net, called Kraken, was discovered and initially revealed by another security team. Various folks are pointing at it as another evolutionary step in the growth of the bot-net threat and as a major new development in the area of cyber-crime.

Bot-nets, it seems, are today’s Internet worms. Their power, capability to produce FUD and impact make them on par with the Slammer, Code Red and Nimda worms of the past as significant threat evolutions. However, just like the worms of yesterday, there are some pretty common – albeit sometimes tough – things you can do to help minimize your risk of exposure.

First, segregate your network. Create enclaves that separate and manage access to servers that hold critical or sensitive data. Basically, segregate any and all user systems into untrusted areas and manage them as if they were untrusted systems (they are!!!)

Next, deploy egress controls as tightly as possible for all user -> Internet activity. Apply egress controls as tightly as possible to all enclaves.

Now, ensure that you have proper preventative and monitoring controls on all of the enclaves. Check for unneeded services, missing patches (OS and applications), bad configurations and known security issues. Mitigate or repair as many as possible. Monitor everything at the egress point for forensics and help with finding infected hosts. Deploy HoneyPoint sensors in user community and all enclaves.

Harden the user systems to the largest extent possible. AV, personal firewalls, patches, consider hardening or changing browsers. No matter what, consider user systems as untrusted hosts!

Educate your users about threats, their responsibilities and security mechanisms for their systems when outside the corporate network.

Monitor, manage and handle incidents quickly and with public consequences. If you find an infected machine and can trace it back to porn downloads on a company machine, fire the person and make a public example of the fact that actions against security policy (you have one of those, right?) have consequences…

Doing these basics will increase your overall security and greatly reduce your risk from bot-nets (and other threats). Is it easy? No. Is it expensive? It can be, depending on your size, complexity and technology level. Is it worth doing? Yes. It reduces risk and is much more interesting than ignoring the problem and/or continually working reactively to various incidents and compromises.