New Windows SMB 0-Day Vulnerability

Windows 0-day SMB mrxsmb.dll vulnerability, (Wed, Feb 16th): "A new vulnerability has been discovered exploiting SMBcomponent of Windows. The attack involve ...(more)..."

More Windows XP Problems, the F1 key?

Even though it's one of the most widely used operating systems on the planet, Windows XP has its problems. It won't be long before it goes the way of IE6 in recent news.

---

Microsoft Says, Don't Press the F1 Key In XP: "Ian Lamont writes 'Microsoft has issued a security advisory warning users not to press the F1 key in Windows XP, owing to an unpatched bug in VBScript discovered by Polish researcher Maurycy Prodeus. The security advisory says that the vulnerability relates to the way VBScript interacts with Windows Help files when using Internet Explorer, and could be triggered by a user pressing the F1 key after visiting a malicious Web site using a specially crafted dialog box.'

Microsoft "Zero-Day" Really a "180-Day"

Doesn't this make it a "180-Day", since they have known about it since September? I never understand why they don't patch these things sooner. If they really knew about it, why the delay? Is there some kind of denial system deep in the bowels of the Microsoft machine?

Threat Level Report on Microsoft's Latest Zero-Day IE Vulnerability

Microsoft Response to Holiday IIS Zero Day

Here is the response from Microsoft. Looks like they are blaming it on configuration errors.

---

Results of Investigation into Holiday IIS Claim:

We’ve completed our investigation into the claims that came up over the holiday of a possible vulnerability in IIS and found that there is no vulnerability in IIS.

What we have seen is that there is an inconsistency in IIS 6 only in how it handles semicolons in URLs. It’s this inconsistency that the claims have focused on, saying this enables an attacker to bypass content filtering software to upload and execute code on an IIS server.

The key in this is the last point: for the scenario to work, the IIS server must already be configured to allow both “write” and “execute” privileges on the same directory. This is not the default configuration for IIS and is contrary to all of our published best practices. Quite simply, an IIS server configured in this manner is inherently vulnerable to attack.

However, customers who are using IIS 6.0 in the default configuration or following our recommended best practices don’t need to worry about this issue. If, however, you are running IIS in a configuration that allows both “write” and “execute” privileges on the same directory like this scenario requires, you should review our best practices and make changes to better secure your system from the threats that configuration can enable. Once again, here’s a list of best practices resources:

· IIS 6.0 Security Best Practices

· Securing Sites with Web Site Permissions

· IIS 6.0 Operations Guide

· Improving Web Application Security: Threats and Countermeasures

The IIS folks are evaluating a change to bring the behavior of IIS 6.0 in line with the other versions. In the meantime, they’ve put more information up about this on their weblog.

I hope this helps answer any questions.

Happy Holidays and Happy New Year.

Christopher

*This posting is provided 'AS IS' with no warranties, and confers no rights*

Possible IIS 6 0-day

News from SANS

---

Microsoft responds to possible IIS 6 0-day, (Tue, Dec 29th): "Following up to recent diaries 7816 and 7810 and numerous other sources regarding a possible IIS&nbs ...(more)..."

Adobe Warns of Reader, Acrobat Attack

Adobe Warns of Reader, Acrobat Attack: "itwbennett writes "Monday afternoon, Adobe 'received reports of a vulnerability in Adobe Reader and Acrobat 9.2 and earlier versions being exploited in the wild,' the company said in a post to the company's Product Security Incident Response Team blog. According to malware tracking group Shadowserver, the vulnerability is due to a bug in the way Reader processes JavaScript code. Several 'tests have confirmed this is a 0-day vulnerability affecting several versions of Adobe Acrobat [Reader] to include the most recent versions of 8.x and 9.x. We have not tested on 7.x, but it may also be vulnerable,' Shadowserver said in a post on its Web site. The group recommends that concerned users disable JavaScript within Adobe's software as a work-around for this problem. (This can be done by un-checking the 'Enable Acrobat JavaScript' in the Edit -> Preferences -> JavaScript window). 'This is legit and is very bad,' Shadowserver added."
Read more of this story at Slashdot.

Microsoft Security Advisory (977544): Vulnerabilities in SMB Could Allow Denial of Service

What a surprise... Ok, I was kinda surprised. I guess this is why we have firewalls.

---

Microsoft Security Advisory (977544): Vulnerabilities in SMB Could Allow Denial of Service: "Revision Note: V1.0 (November 13, 2009): Advisory published.Summary: Microsoft is investigating new public reports of a possible denial of service vulnerability in the Server Message Block (SMB) protocol. This vulnerability cannot be used to take control of or install malicious software on a user’s system. However, Microsoft is aware that detailed exploit code has been published for the vulnerability. Microsoft is not currently aware of active attacks that use this exploit code or of customer impact at this time. Microsoft is actively monitoring this situation to keep customers informed and to provide customer guidance as necessary."