SecurityFocus Microsoft Newsletter #274
----------------------------------------
This Issue is Sponsored By: 8e6 Technologies
Stop Spyware Now - Free White Paper!
Spyware remains a problem for most companies, disrupting productivity, wasting
time and money. Now 8e6 Technologies' free White Paper proposes breakthrough
solutions to counteract the Spyware problem: recognize potential infections,
stop unauthorized programs at the source. Get the Free White Paper.
http://a.gklmedia.com/sfmn/nl/110
------------------------------------------------------------------
I. FRONT AND CENTER
1. Tech support woes
2. Debunking the WMF backdoor
II. MICROSOFT VULNERABILITY SUMMARY
1. Helmsman HomeFtp Remote Denial Of Service Vulnerability
2. Microsoft Internet Explorer Malformed IMG and XML Parsing Denial of
Service Vulnerability
3. AmbiCom Blue Neighbors Bluetooth Stack Object Push Buffer Overflow
Vulnerability
4. AOL You've Got Pictures ActiveX Control Buffer Overflow Vulnerability
5. WehnTrust Path Specification Local Privilege Escalation Vulnerability
6. Mozilla Thunderbird File Attachment Spoofing Vulnerability
7. EMC Legato Networker Multiple Remote Vulnerabilities
8. Antiword Insecure Temporary File Creation Vulnerabilities
9. Kerio WinRoute Firewall Multiple Denial of Service Vulnerabilities
III. MICROSOFT FOCUS LIST SUMMARY
1. creating AD accounts for IdM solutions
IV. UNSUBSCRIBE INSTRUCTIONS
V. SPONSOR INFORMATION
I. FRONT AND CENTER
---------------------
1. Tech support woes
By Scott Granneman
Technical support that's outsourced to foreign countries can cause frustration
and have a negative impact on security when the problems remain unsolved.
http://www.securityfocus.com/columnists/381
2. Debunking the WMF backdoor
By Thomas C. Greene
Claims that the WMF vulnerability was an intentional backdoor into Windows
systems makes for an interesting conspiracy theory, but doesn't fit with the
facts.
http://www.securityfocus.com/columnists/382
II. MICROSOFT VULNERABILITY SUMMARY
------------------------------------
1. Helmsman HomeFtp Remote Denial Of Service Vulnerability
BugTraq ID: 16238
Remote: Yes
Date Published: 2006-01-14
Relevant URL: http://www.securityfocus.com/bid/16238
Summary:
Helmsman HomeFtp is prone to a remote denial of service vulnerability.
Successfully authentication is required to exploit this issue.
A remote attacker may exploit this issue to deny service for legitimate users.
2. Microsoft Internet Explorer Malformed IMG and XML Parsing Denial of Service
Vulnerability
BugTraq ID: 16240
Remote: Yes
Date Published: 2006-01-16
Relevant URL: http://www.securityfocus.com/bid/16240
Summary:
Microsoft Internet Explorer is affected by a denial of service vulnerability.
This issue presents itself when the browser handles a specially crafted IMG
element in a malformed XML block.
An attacker may exploit this issue by enticing a user to visit a malicious site
resulting in a denial of service condition in the application.
3. AmbiCom Blue Neighbors Bluetooth Stack Object Push Buffer Overflow
Vulnerability
BugTraq ID: 16258
Remote: Yes
Date Published: 2006-01-16
Relevant URL: http://www.securityfocus.com/bid/16258
Summary:
AmbiCom Blue Neighbors Bluetooth stack is prone to a buffer overflow
vulnerability. The issue exists in the Object Push Service.
This issue allows remote attackers to execute arbitrary code in the context of
the vulnerable application. Failed exploitation attempts likely result in the
application or device crashing.
4. AOL You've Got Pictures ActiveX Control Buffer Overflow Vulnerability
BugTraq ID: 16262
Remote: Yes
Date Published: 2006-01-16
Relevant URL: http://www.securityfocus.com/bid/16262
Summary:
AOL You've Got Pictures ActiveX control is prone to a buffer overflow
vulnerability.
It is possible to invoke the object from a malicious Web page to trigger the
condition. If the vulnerability were successfully exploited, this would result
in a denial of service due to a runtime error in the affected module that
causes the running instance of the client application that the object is
invoked through (typically Internet Explorer) to crash. It may also be possible
to exploit the condition to corrupt process memory, resulting in arbitrary code
execution. Arbitrary code would be executed in the context of the client
application.
The affected ActiveX control was distributed in various versions of AOL Client
Software, and on the You've Got Pictures Web site prior to 2004.
5. WehnTrust Path Specification Local Privilege Escalation Vulnerability
BugTraq ID: 16268
Remote: No
Date Published: 2006-01-16
Relevant URL: http://www.securityfocus.com/bid/16268
Summary:
Wehnus WehnTrust is prone to a vulnerability that could allow an arbitrary file
to be executed.
The application adds a registry key to automatically start a service upon
computer restarts without using properly quoted paths. Successful exploitation
may allow local attackers to gain elevated privileges.
Specific version information about affected versions of WehnTrust is
unavailable at this time. This BID will be updated as further information is
disclosed.
6. Mozilla Thunderbird File Attachment Spoofing Vulnerability
BugTraq ID: 16271
Remote: Yes
Date Published: 2006-01-17
Relevant URL: http://www.securityfocus.com/bid/16271
Summary:
Mozilla Thunderbird is prone to a file attachment spoofing vulnerability.
Successful exploitation may allow attackers to place malicious files on a
user's computer by tricking users into saving seemingly safe attachments. If
the user subsequently opens the file, this vulnerability may facilitate
arbitrary code execution in the context of the user.
Thunderbird versions prior to 1.5 are affected.
7. EMC Legato Networker Multiple Remote Vulnerabilities
BugTraq ID: 16275
Remote: Yes
Date Published: 2006-01-17
Relevant URL: http://www.securityfocus.com/bid/16275
Summary:
EMC Legato Networker is affected by multiple remote vulnerabilities. A denial
of service issue, and two remote code execution issues have been identified.
Version 7.2.1 of Legato Networker is vulnerable to these issues; prior versions
may also be affected.
8. Antiword Insecure Temporary File Creation Vulnerabilities
BugTraq ID: 16278
Remote: No
Date Published: 2006-01-17
Relevant URL: http://www.securityfocus.com/bid/16278
Summary:
Antiword creates temporary files in an insecure manner.
Exploitation would most likely result in loss of data or a denial of service if
critical files are overwritten in the attack. Other attacks may be possible as
well.
9. Kerio WinRoute Firewall Multiple Denial of Service Vulnerabilities
BugTraq ID: 16314
Remote: Yes
Date Published: 2006-01-19
Relevant URL: http://www.securityfocus.com/bid/16314
Summary:
Kerio WinRoute Firewall is prone to multiple denial of service vulnerabilities.
These issues are due to a failure in the application to properly sanitize
user-supplied input.
An attacker can exploit these vulnerabilities to crash the affected service,
effectively disabling the firewall. This may aid in further attacks.
III. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. creating AD accounts for IdM solutions
http://www.securityfocus.com/archive/88/422486
IV. UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to
[EMAIL PROTECTED] from the subscribed address. The
contents of the subject or message body do not matter. You will receive a
confirmation request message to which you will have to answer. Alternatively
you can also visit http://www.securityfocus.com/newsletters and unsubscribe via
the website.
If your email address has changed email [EMAIL PROTECTED] and ask to
be manually removed.
V. SPONSOR INFORMATION
------------------------
This Issue is Sponsored By: 8e6 Technologies
Stop Spyware Now - Free White Paper!
Spyware remains a problem for most companies, disrupting productivity, wasting
time and money. Now 8e6 Technologies' free White Paper proposes breakthrough
solutions to counteract the Spyware problem: recognize potential infections,
stop unauthorized programs at the source. Get the Free White Paper.
http://a.gklmedia.com/sfmn/nl/110
---------------------------------------------------------------------------
---------------------------------------------------------------------------
