Category Archives: Emerging Threats

In Other News

Posted on by
Reply

WordPress – Another SQL injection vector has been discovered. This time the vulnerability is in the search function.  At this time it is known to be exploitable using the character sets Big5 and GBK. Other character sets may that use a backslash as a part of the character may also be exploitable. Successful attacks can reveal the contents of the underlying database or be used in conjunction with other vulnerabilities to gain administrative privileges on the host server.

HP Laptops – Multiple Hewlett-Packard notebooks are vulnerable to a remote code execution via the pre-loaded “HP Info Center” software. An ActiveX control within the software is the cause of the vulnerability. A patch is not yet available for this issue.

SquirrelMail GPG Plugin – Two vulnerabilities have been discovered in this plugin. The first issue can allow a user to delete or modify files that are owned by the web site user. The second issue allows users to modify the html of the displayed message.

Latest Set of Microsoft Patches

Posted on by
Reply

A total of seven new Microsoft patches were released yesterday. Three were rated by MS as being Critical with the remaining four being rated as Important. There are exploits available for MS07-065, MS07-067 and MS07-069. Below is a quick summary of the releases. More details can be obtained from the original MS advisories:
http://www.microsoft.com/protect/computer/updates/bulletins/200712.mspx

Rated Critical
MS07-069 Cumulative Security Update for Internet Explorer [Could Allow Remote Code Execution] (942615)
MS07-064 Vulnerabilities in DirectX Could Allow Remote Code Execution (941568)
MS07-068 Vulnerability in Windows Media File Format Could Allow Remote Code Execution (941569 and 944275)
MS07-069 Cumulative Security Update for Internet Explorer (942615)

Rated Important
MS07-063 Vulnerability in SMBv2 Could Allow Remote Code Execution (942624)
MS07-065 Vulnerability in Message Queuing Could Allow Remote Code Execution (937894)
MS07-066 Vulnerability in Windows Kernel Could Allow Elevation of Privilege (943078)
MS07-067 Vulnerability in Macrovision Driver Could Allow Local Elevation of Privilege (944653)

A Plethora of New Issues for Today

Posted on by
Reply

It’s been a busy morning for vulnerabilities so far. We are tracking new vulnerabilities in the following applications:

Squid Proxy – a DoS problem has been identified in the ICAP implementation that could allow attackers to spike the CPU of the server, a patch is available and should be applied on your next maintenance process

Samba – A buffer overflow in Samba version 3.0.27a allows remote execution of code if the “domain logons” option is enabled, patches are available on the Samba site for the problem.

WordPress – A SQL injection has been found in the charset implementation. Dumping the database is possible and when combined with other exploits already available can allow remote compromise of the WordPress Admin password. There is a workaround, but it is very specific to each WordPress deployment, so check the WordPress site carefully for info on this issue.

We are also tracking a few new tools of interest, that might increase some of the scan and probe traffic over the next few weeks while attackers play with their new toys. They are:

HttpRecon – a tool for advanced web server fingerprinting, likely to increase web server probes as the tool is examined and included into other tools

BurpSuite – a new revision of this tool for testing websites for things like SQL injection and XSS is now available, likely to cause scans for web application problems

EchoVNC – a firewall, proxy and network access control avoidance enabled version of the VNC server has been released, this is likely to be a useful tool for attackers and bot-masters as they compromise networks

Lastly, Microsoft is releasing a large load of patches today. Amongst them are 3 remotely exploitable “critical” patches. Look for exploits and such to follow very quickly if they are not already available. Wide scale exploit distribution and inclusion into bot-net clients is likely to follow in the next few days. As always, patches should be tested and applied as soon as possible.

VMWare ESX Update, XSS Testing for Webmail Systems

Posted on by
Reply

A recent update of VMWare ESX server contains many fixes, but a few of them are critical to the security of the application. Now should be the time to look in to updating VMWare on you computers.

A new XSS testing tool has been released. XSS testing tools are nothing new, however this is the first dedicated solely to testing XSS in webmail applications. Written in perl, it tests XSS in mail messages sent to an account you specify. It’s called Excess, and can be found at http://www.scanit.be/excess.html

Also, striking similarities between the Quicktime bug found in 2002 and the recent RTSP bug have been noticed. CVE 2002-0252 and 2007-6166 are very much alike each other. Has Apple reintroduced the same bug from 2002?

Buffer Overflow Ouchies for Skype and HP OpenView

Posted on by
Reply

Two traditional buffer overflow vulnerabilities have emerged today. The first is in the Skype product. It suffers from a heap overflow in the skype4com module. Attackers can exploit this by getting users to visit a malicious page, triggering the overflow. Obviously, Skype users should beware of any links, files or other items sent to them through the Skype network. User awareness of issues with trusting Skype content is the best solution, if your organization allows Skype at all.

Skype users should ensure that they are running the most current version, which is protected from this attack.

The second buffer overflow, this one in HP OpenView’s Network Node Manager, only impacts the following versions:

HP OpenView Network Node Manager (OV NNM) 6.41, 7.01, 7.51 running on HP-UX B.11.00, B.11.11, and B.11.23, Solaris, Windows NT, Windows 2000, Windows XP, and Linux

Attackers can leverage this issue to execute arbitrary code on the vulnerable system. Patches are available through the OpenView support site. Patches should be applied as soon as possible!

Vulnerable HSQLDB; ARCServe and BorderManager

Posted on by
Reply

Two different applications implementing HSQLDB contain vulnerabilities. The first is in OpenOffice, where there is an unspecified error in the HSQLDB database that can be exploited to execute Java code through a malicious database document. OpenOffice versions prior to 2.3.1 are affected. Next, JBOSS is affected by remote command injection vulnerability. Due to certain flaws, an attacker can pass commands to the HSQLDB component on TCP port 1701 (for JBOSS 3.2.1) or TCP port 1476 (for JBOSS 3.0.8). Multiple attacks can be performed leveraging this vulnerability, such as command execution in the database and potentially the OS, Denial of Service, etc. This issue is reported to exist with JBOSS 3.2.1/3.0.8 on any Java 1.4.x-enabled platforms. Other versions may also be affected.

CA BrightStor ARCServe BackUp R11.5 is affected by a remote stack overflow vulnerability. The flaw exists in the CA BrightStor Message Engine. This is a result of errors in the handling of RPC requests to TCP port 6504. Successful exploitation of this vulnerability will result in remote code execution. CA has released an update for this issue, available at http://supportconnectw.ca.com/public/storage/infodocs/basb-secnotice.asp

Novell BorderManager 3.8 SP5 contains multiple vulnerabilities. An issue in the Novell Client Trust can be exploited to execute arbitrary code. An error in handling certain encoded HTTP traffic can be exploited to bypass security controls. Also, proxy authentication can be bypass when the traffic is sourced from another proxy. Novell has released Support Pack5 Interim Release 1, available at http://download.novell.com/Download?buildid=_E_defvCXnE~.

Cisco Vulns, OS X DoS, SWFIntruder

Posted on by
Reply

A cross site scripting vulnerability has been found in CiscoWorks. The XSS is present in the initial login page. Attackers could use this to steal cookies or execute arbitrary html or script code on a remote user. CiscoWorks versions 2.6 and prior are vulnerable, and Cisco has released a patch for this issue.

The Cisco 7940 SIP Phone is vulnerable to an interesting denial of service. Sending malformed SIP INVITE messages to a 7940 phone can cause the device to reboot, or be put under the DoS condition. If INVITE packets are then sent at certain intervals, the DoS condition will persist. The phone will be in a seemingly working condition, where it continues to send REGISTER commands to the server, but will ring busy on incoming calls and return busy on any calls made by the user. There was no patch or update listed with the advisory.

Cisco Security Agent (CSA) for Windows and Cisco Security Manager are vulnerable to a remote buffer overflow attack. This can be exploited by sending a specially crafted TCP message to port 139 or 445 on a system running the CSA. This could result in a stop error (blue screen) or remote code execution. Cisco has released a free software update to address this vulnerability.

Two Denial of Service attacks for MacOS X have had their exploit code released. The first is in the vpnd which has been tested in Apple MACOS X 10.5.0. The second DoS in a local one in the kernel. This has been testing in Apple MACOS X 10.4 (xnu-792.22.5~1/RELEASE_I386), Apple MACOS X 10.5.1 (xnu-1228.0.2~1/RELEASE_I386) and Apple MACOS X 10.5.1 (xnu-1228.0.2~1/RELEASE_PPC).

WabiSabi Labs (the online exploit auction group), reportedly has a QuickTime vulnerability that could result in remote code execution that is different from the one we mention in “QuickTime 7.2/7.3 RTSP Exploits” (https://stateofsecurity.com/?p=162). We have no way to accurately verify this information though.

A new tool has been released yesterday. The tool, SWFIntruder, is “the first tool specifically developed for analyzing and testing security of Flash applications at runtime.” [1] This looks to be a powerful tool to test flash implementations for the presence of XSS of XSF issues in a semi automated manner. If you are responsible for testing web applications, this may be a tool you’ll want to have a look at.

1. https://www.owasp.org/index.php/Category:SWFIntruder

Multiple XSS Vulnerabilities and 27MHz Research

Posted on by
Reply

Two cross site scripting vulnerabilities were announced today in F5 Firepass 4100 SSL VPN and Apache 2.2.3 and 2.0.46 and above. In the F5 device, input passed to my.activation.php3 and my.logon.php3 is not properly sanitized before returning to the user. In Apache, input via the HTTP method is not properly sanitized before being sent to the user when a “413 Request Entity Too Large” error page is displayed. Both issues can be exploited to execute script or HTML code in a user’s browser session.

A security research team has demonstrated the ability to intercept communications between 27 Mhz keyboards and a computer. The team was able to reverse engineer the packets and break the trivial encryption to sniff commands entered between the keyboard and the computer. Reportedly this can be performed up to 10 m away. Maybe it’s time to take a look at your company’s security policy and see what’s in it about wireless keyboards and reevaluate those decisions.

Two New HP-UX vulnerabilities

Posted on by
Reply

The first is a potential remote execution of code on HP-UX systems that are running Apache. HP-UX B.11.11, B.11.23, B.11.31 running Apache v2.0.59.00.0 or earlier are known to be vulnerable. While the HP security bulletin is a vague, it does cite CVE-2007-5135 which details an off-by-one error in the SSL_get_shared_ciphers function of OpenSSL 0.9.7 – 0.9.7l, and 0.9.8 – 0.9.8f. HP’s original security bulletin is HPSBUX02292 SSRT071499 rev.1. Updates are available.

The second is an XSS issue in HP OpenView Network Node Manager. It appears to be remotely exploitable. Affected versions are HP OpenView Network Node Manager (OV NNM) 6.41, 7.01, 7.51 running on HP-UX B.11.00, B.11.11, and B.11.23, Solaris, Windows NT, Windows 2000, Windows XP, and Linux. The original HP security bulletin is HPSBMA02283 SSRT071319 rev.1. Updates are available for this as well.

Avaya Products Multiple Vulnerabilities

Posted on by
Reply

Avaya has released information on multiple vulnerabilities within their products. The first issue is an error in certain OpenSSL functions.  A certain function can be exploited to cause a buffer overlow and a weakness in the RSA implementation can be exploited to reveal the private keys. The following products are affected:

  • Avaya Communication Manager (CM 3.0)
  • Avaya EMMC (1.017, 1.021)
  • Avaya CCS/SES (3.1 and earlier)
  • Avaya AES (AES 3.1.4 and earlier)

The next set of issues lies in the PCRE libraries. When parsing certain regular expressions an integer overflow can occur and result in a denial of service or potentially compromise an application using the library.  Additionally, an error processing multiple unspecified character classes can be exploited to cause insufficient memory allocation.

The following versions are affected:

  • Avaya Communication Manager (CM 3.1, CM 4.x)
  • Avaya Intuity AUDIX LX (IALX 2.0)
  • Avaya Messaging Storage Server (MSS 3.x)
  • Avaya Message Networking (MN 3.1)
  • Avaya CCS/SES (3.1.1, 3.1.2, 4.0)
  • Avaya AES (AES 4.0.1)