Advisory #241 - Microsoft (Multiple), Safari, Multiple News

[Sunnet Beskerming Alert mailing list]

Sûnnet Beskerming Alert List Advisory #241

You are receiving this message because you have subscribed to our  
Information Security Alert Mailing List, or have been selected for a  
specific one-off copy.  If you believe that you are receiving this  
message in error, please contact info@... to resolve the  
error.

Why not upgrade to get same day notification on security threats?  
Details and rates available online -
(http://www.beskerming.com/premium/generic_advisory.html).

Why not go the next step and get delivery tailored just for your  
company?
(http://www.beskerming.com/premium/focussed_advisory.html)


Contents
--------------------------------------------------------------------
1. SECURITY
--------------------------------------------------------------------
1.1 Microsoft (Multiple)
        - Remote Hacker Automatic Control
        - Time Since Discovery - 1 Day
1.2 Safari
        - Remote Hacker Automatic Control
        - Time Since Discovery - 2 Days
=======================================
/*
        - Remote or Local - Can it be achieved through a network or does it  
require physical access?
        - Hacker - The bad guy
        - Manual or Automatic  - Does the vulnerability need to be manually  
performed, or can it be automated?
        - Control, Denial of Service or Data Theft - Will the hacker get  
control of your system / website, will they prevent you from using  
it, or will they steal data.
*/
--------------------------------------------------------------------
2.    NEWS
--------------------------------------------------------------------
2.1 Microsoft's June Security Patch Release
2.2 From Release to Attack in a Few Hours
2.3 An Apple a Day
2.4 Gaming the System = $1,000,000 USD?
=====================================

1. SECURITY

1.1 Microsoft (Multiple) - Remote Hacker Automatic Control

        -- Products Affected --
        Windows 2000, XP, 2003, Vista
        Visio 2002, 2003
        Outlook Express
        Windows Mail

        -- Technical Description --
        MS07-030 - Visio.  Arbitrary remote code execution.  Important
        MS07-031 - Schannel.  Arbitrary remote code execution.  Critical
        MS07-032 - Vista.  Information disclosure.  Moderate
        MS07-033 - Internet Explorer. Cumulative update for multiple  
vulnerabilities.  Critical
        MS07-034 - Outlook Express / Windows Mail. Cumulative update for  
multiple vulnerabilities.  Critical
        MS07-035 - Windows.  Arbitrary remote code execution.  Critical

        -- Description --
        Microsoft delivered six patches as part of the June Security Update  
release.  Four of the patches have been rated as critical, with one  
as Important, and the remaining patch as Moderate.  Exploit code has  
already begun to circulate for the vulnerabilities that have been  
patched today.  It should be noted that Microsoft have re-released  
MS07-012 and MS07-018 as well.

        -- Recommended Action --
        All users and administrators should apply the updates at the  
earliest opportunity.

        -- Source --
        http://www.beskerming.com/premium/patch_pack.html
        http://store.eSellerate.net/s.asp?
s=STR3448907936&Cmd=CATALOG&CategoryID=9811

        -- Updates Available --
        (Paid subscription required to access)

        -- External Tracking Data --
        (Paid subscription required to access)

        -- Threat Matrix --
                        U O
        Home User 10 10 (Highly Critical)
        Corporate 10 10 (Highly Critical)


1.2 Safari - Remote Hacker Automatic Control

        -- Products Affected --
        Safari At least version 3.0

        -- Technical Description --
        Numerous arbitrary remote code execution and denial of service  
vulnerabilities have been discovered in the new Safari 3 Beta. Most  
vulnerabilities target the Windows version, though some affect both  
versions. Exploit code is readily available for some of the  
vulnerabilities, but details and exploit code for others are being  
withheld until the release of Leopard (OS X 10.5) for greater impact.

        -- Description --
        The brand new Safari 3 Beta has been discovered to have numerous  
vulnerabilities affecting it, including a number of vulnerabilities  
that will allow a remote attacker to take complete control of a  
vulnerable system, and dozens that will prevent use of the browser by  
the local user. Exploits are readily available from a number of  
sources, and it is recommended that users refrain from downloading  
the Beta if they are planning to use it for general Internet usage.  
While most vulnerabilities target the Windows version, some also  
affect the OS X Beta.

        -- Recommended Action --
        Avoid using the Safari 3 Beta outside of a testing environment until  
Apple is able to release security patches to address the issue.

        -- Source --
        (Paid subscription required to access)

        -- Updates Available --
        (Paid subscription required to access)

        -- External Tracking Data --
        (Paid subscription required to access)

        -- Threat Matrix --
                        U O
        Home User 9 9  (Critical)
        Corporate 9 9  (Critical)

=======================================
/*
Threat Matrix:
        U - User
        O - Operator
        Harmless - 0 ----- 10 - Highly Critical
*/
=======================================

2. NEWS

2.1 Microsoft's June Security Patch Release

As expected, Microsoft released six patches yesterday as part of the  
June 2007 Security Update release. What was not expected was the re-
release of two earlier patches, MS07-012 (Microsoft MFC) and MS07-018  
(Microsoft CMS). The re-release of these patches was to address some  
relatively minor issues that had been encountered since their  
original release, as well as to add support for extra OS versions.

Closely following the release of the patches has come a range of  
sample exploits that target the vulnerabilities patched by the  
Updates. At this stage there is not much sign of the '0-day'  
Wednesday that follows some Patch Tuesdays, but it is likely that  
there will be some previously unseen vulnerabilities that are  
released over the next few days.


2.2 From Release to Attack in a Few Hours

Within a matter of hours of the announcement at Apple's WWDC that the  
Beta version of Safari 3 was available for download on Windows and OS  
X came news that several security researchers had already found  
serious vulnerabilities affecting the software.

Even though the software is in Beta, the semi-production quality of  
many Beta releases from other companies (such as Google, who are  
notorious for leaving their products in an extended Beta phase, even  
after supposed public release) has given most users a false sense of  
the stability that they should expect from a Beta release.

The public announcement of the vulnerability existence before  
notifying the vendor (Apple) has been widely criticised, especially  
as the announcement was accompanied by statements that the  
researchers were intentionally not notifying Apple of the issue.

Some of the vulnerabilities discovered so far will affect both  
Windows and OS X versions of Safari, so OS X users should not be  
ignoring the vulnerability reports just because they initially work  
on the Windows version of the browser.


2.3 An Apple a Day

Apple Inc's WorldWide Developer's Conference (WWDC) is currently  
running in California and one of the highlights that many look  
forward to, even amongst the wider technical community that otherwise  
has little interest in an Apple event, is the opening Keynote address  
delivered by Steve Jobs on Monday.

In amongst confirmation of delivery dates for products like the  
iPhone (Late June for North America), and OS X 10.5 - Leopard  
(October 2007), and the availability of Leopard for developers, is  
surprising news that Apple have developed their flagship Internet  
browser Safari for the Windows platform. This beta product, Safari 3,  
has already gained the attention of a number of security researchers  
who are busily pulling it apart as quickly as they can (see earlier  
commentary).

In terms of security technology concerns, Safari 3 and Leopard are  
obvious choices, but the announcement of how applications will be  
developed to target the iPhone came as a surprise to many. Steve Jobs  
announced that while applications from third party developers would  
not be developed to run directly on the phone, they would be running  
an effectively complete application platform through the browser on  
the phone. Making use of existing technology, such as that which  
comprises AJAX / Web 2.0, developers should be able to create  
'applications' for the iPhone.

 From a practical perspective it means that if you can host it on the  
web, then an iPhone can use it.

 From a security perspective, the level of access to background  
iPhone data (like the address book and call parameters) by these  
externally hosted applications is likely to throw up some very  
interesting challenges and vulnerabilities in coming months.


2.4 Gaming the System = $1,000,000 USD?

Business news channel CNBC has recently been running a competition  
where the holder of the best virtual investment portfolio over a  
certain period would win $1 million USD.

It appears that the lure of so much cash was too much for some  
people. Claims have been made that the winners of the competition may  
have exploited a weakness in the browser-based system that was used  
to track and manage the competitor's virtual portfolios.

Specifically, it appears that if a competitor opened a browser window  
with a pending trade prior to the closure of the stock market at 4  
pm, then it was possible to conduct an after-hours trade at the  
closing price. This meant that competitors could observe stock price  
movement in after hours trading, especially large movement associated  
with major company news and dividend allotment, and adjust their  
trade accordingly.

Because the system being used by CNBC did not flag these trades as  
improper, it allowed competitors to build a significant advantage  
over those not using the system.

The case was highlighted by a competitor who was using 1,600 virtual  
portfolios to try and cover the movement in the market (a practice  
that some regard as outside the spirit of the competition).

While CNBC have engaged the services of some external security  
experts, there could be grounds for legal action against CNBC by  
affected competitors (especially with so much money at stake). CNBC  
have also suggested that other attempts to defeat the system were  
used, though apparently not as successful.

It should be noted that the exploitation of the system weakness  
actually parallels a real but unethical trading problem that some  
markets have faced in the past, where preferable trades between  
interested parties have been made using significantly outdated  
pricing data.

=======================================

Sincerely,

Sûnnet Beskerming Team
info@...
Sûnnet Beskerming Pty. Ltd.
Adelaide, Australia
http://www.beskerming.com
Tel: [phone]

** Sûnnet Beskerming Pty. Ltd. **

Established in mid 2004, Sûnnet Beskerming Pty. Ltd. is the sister  
company to Jongsma & Jongsma Pty. Ltd., and was formed to develop and  
commercialise the research coming out of Jongsma & Jongsma Pty. Ltd..  
Sûnnet Beskerming Pty. Ltd. is an Information Security specialist  
and, in conjunction with the tools developed by Jongsma & Jongsma  
Pty. Ltd., provides total security solutions and services, from the  
perimeter to internal data stores, including web application security  
and security testing and analysis.
_______________________________________________
Alertmailinglist mailing list
Alertmailinglist@...
http://skiifwrald.com/mailman/listinfo/alertmailinglist_skiifwrald.com