MULTI-STATE INFORMATION SHARING AND ANALYSIS CENTER CYBER SECURITY ADVISORY  (posted 8/19/10)

 

MS-ISAC ADVISORY NUMBER:
2010-067

DATE(S) ISSUED:
8/11/2010

 

SUBJECT:
Multiple Vulnerabilities Discovered in Adobe Products

 

OVERVIEW:
Six vulnerabilities have been discovered in Adobe Flash Player and Adobe AIR. Adobe Flash Player is a widely distributed multimedia and application player for Microsoft Windows, Mozilla, and Apple systems. Adobe AIR is a cross-platform runtime for developing Internet applications on the desktop. These vulnerabilities can be exploited if a user visits a website hosting malicious content or opens an email attachment containing Flash media designed to exploit these vulnerabilities.

 

Successful exploitation of five of these vulnerabilities could result in an attacker gaining the same privileges as the logged on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. The remaining vulnerability could allow an attacker to obtain confidential information.

 

SYSTEMS AFFECTED:

 

• Adobe Flash Player 10.1.53.64 and earlier

• Adobe AIR 2.0.2.12610 and earlier

 

RISK:

Government:

• Large and medium government entities: High

• Small government entities: High

 

Businesses:

• Large and medium business entities: High

• Small business entities: High

 

Home users: High

 

DESCRIPTION:

Six vulnerabilities have been identified in Adobe Flash Player and Adobe AIR, which include remote code execution and click-jacking. These vulnerabilities can be exploited if a user visits a website hosting malicious content or opens an email attachment containing a Flash media file designed to trigger these issues. Details of these vulnerabilities are as follows:

 

• Five vulnerabilities caused by unspecified Memory Corruption errors could result in remote code-execution.

• A click-jacking vulnerability affecting Flash Player 10 on unspecified platforms. Click-jacking is a technique that involves embedding code or a script into a web page that tricks a user into performing unintended actions. This occurs when a user mistakenly clicks on a concealed link or when the user clicks on a button that triggers the malicious action.

 

Successful exploitation of these vulnerabilities could allow an attacker to gain the same privileges as the logged on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

 

RECOMMENDATIONS:
We recommend the following actions be taken:

• Apply the appropriate updates which have been provided by Adobe to vulnerable systems immediately after appropriate testing.

• Systems running Adobe Flash Player 10.1.53.64 and earlier versions should be updated to version 10.1.82.76.

• Systems running Adobe AIR 2.0.2.12610 and earlier versions should be updated to version 2.0.3.

• Run all software as a non-privileged user (one without administrative privileges) to diminish the effects of a successful attack.

• Inform and educate users regarding the threats posed by hypertext links contained in emails or attachments especially from un-trusted sources.

 

REFERENCES:

 

Adobe:

http://www.adobe.com/support/security/bulletins/apsb10-16.html

 

Security Focus:

http://www.securityfocus.com/bid/42361

http://www.securityfocus.com/bid/42362

http://www.securityfocus.com/bid/42363

http://www.securityfocus.com/bid/42364

 

CVE:

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0209

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2188

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2213

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2214

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2215

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2216

 

 

MULTI-STATE INFORMATION SHARING AND ANALYSIS CENTER CYBER SECURITY ADVISORY (posted 8/19/10)

 

MS-ISAC ADVISORY NUMBER:
2010-066

DATE(S) ISSUED:
8/11/2010

 

SUBJECT:
Multiple Vulnerabilities in Internet Explorer Could Allow Remote Code Execution (MS10-053)

 

OVERVIEW:
Six vulnerabilities have been discovered in Microsoft's web browser, Internet Explorer, which could allow an attacker to take complete control of an affected system. Exploitation may occur if a user visits or is redirected to a web page which is specifically crafted to take advantage of these vulnerabilities. Successful exploitation of these vulnerabilities could result in an attacker gaining the same privileges as the logged on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

 

SYSTEMS AFFECTED:

 

• Internet Explorer 6

• Internet Explorer 7

• Internet Explorer 8

• Windows XP SP3

• Windows Server 2003

• Windows Server 2008

• Windows Vista

• Windows 7

 

RISK:

Government:

• Large and medium government entities: High

• Small government entities: High

 

Businesses:

• Large and medium business entities: High

• Small business entities: High

 

Home users: High

 

DESCRIPTION:

Six vulnerabilities have been discovered in Microsoft Internet Explorer. Details of these vulnerabilities are as follows:

Event Handler Cross-Domain Vulnerability

An information disclosure vulnerability exists in Microsoft Internet Explorer that could allow a remote attacker access to sensitive data.  More specifically, a script could be written that would allow the attacker to gain access in another domain or Internet Explorer zone. Exploitation may occur if a user visits a web page which is specifically crafted to take advantage of this vulnerability. Successful exploitation of this vulnerability could result in an attacker viewing content from the local computer or another browser window in another domain or Internet Explorer zone.

 

Three Uninitialized Memory Corruption Vulnerabilities

Three remote code execution vulnerabilities exist in the way that Microsoft Internet Explorer accesses an object that has not been correctly initialized or deleted. Exploitation may occur if a user visits a web page which is specifically crafted to take advantage of this vulnerability. When a user views the Web page, the vulnerability could allow remote code execution. Successfully exploiting this issue will give the attacker access in the context of the currently logged on user.  Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. 

 

Race Condition Memory Corruption Vulnerability

A remote code execution vulnerability exists in the way that Internet Explorer accesses an object that may have been corrupted due to a race condition. Exploitation may occur if a user visits a web page which is specifically crafted to take advantage of this vulnerability. Successful exploitation of this vulnerability could result in an attacker gaining the same privileges as the logged on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

 

HTML Layout Memory Corruption Vulnerability

A remote code execution vulnerability has been discovered in the way that Internet Explorer accesses an object that has not been correctly initialized or deleted. Exploitation may occur if a user visits a web page which is specifically crafted to take advantage of this vulnerability. When a user views the Web page, the vulnerability could allow remote code execution. Successfully exploiting this issue may give the attacker access in the context of the currently logged on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. 

 

It should be noted that, by default, Internet Explorer on Windows Server 2003 and Windows Server 2008 runs in a restricted mode that is known as Enhanced Security Configuration. Enhanced Security Configuration is a group of preconfigured settings in Internet Explorer that can reduce the likelihood of a user or administrator downloading and running specially crafted Web content on a server. This mode sets the security level for the Internet zone to High. This is a mitigating factor for Web sites that have not been added to the Internet Explorer Trusted sites zone.

 

RECOMMENDATIONS:
We recommend the following actions be taken:

• Apply appropriate patches provided by Microsoft to vulnerable systems immediately after appropriate testing.

• Run all software as a non-privileged user (one without administrative privileges) to diminish the effects of a successful attack.

• Consider configuring Internet Explorer to prompt before running Active Scripting or to disable Active Scripting.

• Inform and educate users regarding the threats posed by hypertext links contained in emails or attachments especially from un-trusted sources.

 

REFERENCES:

 

Microsoft:

http://www.microsoft.com/technet/security/bulletin/MS10-053.mspx

 

Security Focus:

http://www.securityfocus.com/bid/42288

http://www.securityfocus.com/bid/42289

http://www.securityfocus.com/bid/42257

http://www.securityfocus.com/bid/42292

http://www.securityfocus.com/bid/42290

http://www.securityfocus.com/bid/42258

 

Secunia:

http://secunia.com/advisories/40895/

 

CVE:

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1258

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2556

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2557

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2558

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2559

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2560

 

MULTI-STATE INFORMATION SHARING AND ANALYSIS CENTER CYBER SECURITY ADVISORY (posted 8/19/10)

MS-ISAC ADVISORY NUMBER:
2010-062

DATE(S) ISSUED:
8/10/2010

 

SUBJECT:
Vulnerability in Microsoft Office Excel Could Allow Remote Code Execution (MS10-057)

 

OVERVIEW:
A vulnerability has been discovered in Microsoft Office Excel, a spreadsheet application. This vulnerability could allow remote code execution if a user opens a specially crafted Excel file. The file may be received as an email attachment, or downloaded via the web. Successful exploitation could result in an attacker gaining the same privileges as the logged on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

 

SYSTEMS AFFECTED:

 

• Microsoft Office XP

• Microsoft Office 2003

• Microsoft Office 2004 for Mac

• Microsoft Office 2008 for Mac

• Open XML File Format Converter for Mac

 

RISK:

Government:

• Large and medium government entities: High

• Small government entities: High

 

Businesses:

• Large and medium business entities: High

• Small business entities: High

 

Home users: High

 

DESCRIPTION:
A vulnerability has been identified in Microsoft Office Excel that could allow an attacker to take complete control of an affected system. This vulnerability exists because of the way Microsoft Office Excel parses the Excel file format when processing Excel files (.xls). This can be triggered by opening a specially crafted Excel file and can be exploited via email or through the web. In an email based scenario, the user would have to open the specially crafted Excel file as an email attachment. In a web based scenario, a user would have to open the specially crafted Excel file that is hosted on a website. When the user opens the Excel file, the attacker's supplied code will execute.

 

Successful exploitation of this vulnerability could result in an attacker gaining the same privileges as the logged on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

 

RECOMMENDATIONS:
We recommend the following actions be taken:

• Apply appropriate patches provided by Microsoft to vulnerable systems immediately after appropriate testing.

• Remind users not to open e-mail attachments from unknown users or suspicious e-mails from un-trusted sources.

• Run all software as a non-privileged user (one without administrative privileges) to diminish the effects of a successful attack.

• Remind users not to visit un-trusted websites or follow links provided by unknown or un-trusted sources.

• Consider using the Microsoft Office Isolated Conversion Environment (MOICE - http://support.microsoft.com/kb/935865).

REFERENCES:

 

Microsoft:

http://www.microsoft.com/technet/security/bulletin/ms10-057.mspx

http://support.microsoft.com/kb/935865

 

CVE:

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2562

 

Security Focus:

http://www.securityfocus.com/bid/42199

 

MULTI-STATE INFORMATION SHARING AND ANALYSIS CENTER CYBER SECURITY ADVISORY (posted 8/19/10)

 

MS-ISAC ADVISORY NUMBER:
2010-061

 

DATE(S) ISSUED:
8/10/2010

 

SUBJECT:
Vulnerabilities in Microsoft Office Word Could Allow Remote Code Execution (MS10-056)

 

OVERVIEW:
Four vulnerabilities have been discovered in Microsoft Office Word. These vulnerabilities can be exploited by opening a malicious Word document received as an email attachment, or by visiting a web site that is hosting a malicious Word document. Successful exploitation could result in an attacker gaining the same privileges as the logged on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Failed exploitation could result in denial-of-service conditions.

 

SYSTEMS AFFECTED:

 

• Microsoft Office XP

• Microsoft Office 2003

• 2007 Microsoft Office System

• Microsoft Office 2004 for Mac

• Microsoft Office 2008 for Mac

• Open XML File Format Converter for Mac

• Microsoft Office Word Viewer

• Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats

• Microsoft Works 9

 

RISK:

Government:

• Large and medium government entities: High

• Small government entities: High

 

Businesses:

• Large and medium business entities: High

• Small business entities: High

 

Home users: High

 

DESCRIPTION:
Four vulnerabilities have been discovered in Microsoft Office Word. Details of these vulnerabilities are as follows:

 

Word Record Parsing Vulnerability

A remote code execution vulnerability exists in the way that Microsoft Office Word handles malformed records inside a specially crafted Word file. When Microsoft Office Word opens a specially crafted Word file, it may corrupt system memory in such a way that an attacker could execute arbitrary code.

 

Word RTF Parsing Engine Memory Corruption Vulnerability

A remote code execution vulnerability exists in the way that Microsoft Office Word parses rich text data. Microsoft Office Word does not perform sufficient data validation when handling rich text data. When Word opens and parses a specially crafted rich text format (RTF) e-mail message or file, it may corrupt memory in such a way that an attacker could execute arbitrary code.

 

Word RTF Parsing Buffer Overflow Vulnerability

A remote code execution vulnerability exists in the way that Microsoft Office Word parses certain rich text data. Microsoft Office Word does not perform sufficient data validation when handling rich text data. When Word opens and parses a specially crafted rich text format (RTF) e-mail message or file, it may corrupt memory in such a way that an attacker could execute arbitrary code. 

 

Word HTML Linked Objects Memory Corruption Vulnerability

A remote code execution vulnerability exists in the way that Microsoft Office Word handles a specially crafted Word file that includes a malformed record. When Microsoft Office Word opens a specially crafted Word file, it may corrupt system memory in such a way that an attacker could execute arbitrary code.

 

Successful exploitation of these vulnerabilities will result in an attacker gaining the same privileges as the logged on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Failed exploitation could result in denial-of-service conditions.

 

RECOMMENDATIONS:
We recommend the following actions be taken:

• Apply appropriate patches provided by Microsoft to vulnerable systems immediately after appropriate testing.

• Remind users not to open e-mail attachments from unknown users or suspicious e-mails from trusted sources.

• Run all software as a non-privileged user (one without administrative privileges) to diminish the effects of a successful attack.

• Remind users not to visit un-trusted websites or follow links provided by unknown or un-trusted sources.

• Consider using the Microsoft Office Isolated Conversion Environment (MOICE - http://support.microsoft.com/kb/935865).

 

 

REFERENCES:

 

Microsoft:

http://www.microsoft.com/technet/security/bulletin/MS10-056.mspx

 

CVE:
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1900
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1901
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1902
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1903

 

MULTI-STATE INFORMATION SHARING AND ANALYSIS CENTER CYBER SECURITY ADVISORY (posted 8/6/10)

MS-ISAC ADVISORY NUMBER:
2010-053 - Updated

DATE(S) ISSUED:
7/17/2010
7/20/2010 – UPDATED
7/21/2010 – UPDATED

8/2/2010 – UPDATE

SUBJECT:
Vulnerability in Windows Shell Could Allow Automatic File Execution

ORIGINAL OVERVIEW:

A vulnerability has been discovered in Windows Shell, component of Microsoft Windows Operating System, that could allow automatic file execution. Specifically this vulnerability exists because Microsoft Windows incorrectly parses shortcuts (LNK files) in such a way that malicious code may be executed when the user views the displayed icon of a specially crafted shortcut. Successful exploitation may result in an attacker gaining at least the same user privileges as the logged on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

It has been confirmed that this vulnerability is being exploited in limited targeted attacks, however, we should anticipate more widespread exploitation in the short term.

There is currently no patch available for this vulnerability.

July 20 - UPDATED OVERVIEW:
Exploit code is publicly available. The exploit code has also been added to the Metasploit exploitation framework. We have tested the exploit code in our lab and confirmed that the exploit allows for code execution.

July 21 UPDATED OVERVIEW:
Microsoft Knowledge Base Article 2286198 has been updated to reflect that Program Information Files (PIF) are also affected by this vulnerability. The Microsoft Knowledge Base Article includes a FixIt tool that will disable LNK and PIF file functionality ( http://support.microsoft.com/kb/2286198). This workaround only applies to systems affected listed below.

Microsoft has also updated Security Advisory 2286198 to include additional attack vectors for this vulnerability which increases the possibility of exploitation. An attacker could embed an exploit in a document that supports embedded shortcuts or hosted browser controls, such as, Microsoft Office documents, e-mail attachments, or web sites.

August 2 UPDATED OVERVIEW:

Microsoft has issued an Out of Band patch to address this vulnerability. Please note that this patch will not undo the previously indicated workarounds or the changes applied by the “Fix it” tool.

SYSTEMS AFFECTED:

RISK:
Government:

Businesses:

Home users: High

ORIGINAL DESCRIPTION:
A vulnerability has been discovered in Windows Shell in the way it processes shortcut 'LNK' files that could allow automatic file execution. Exploitation may occur when the user views the displayed icon of a specially crafted shortcut. No user interaction is required other than viewing a folder while the specially crafted shortcut is displayed. Successful exploitation may result in an attacker gaining the same user privileges as the logged on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

Current reports indicate that this vulnerability is being exploited with USB and other removable media. It is possible for this vulnerability to be exploited through network shares.

This vulnerability is being exploited in limited targeted attacks and currently being detected as W32.temphid (Symantec), Troj/Stuxnet-A (Sophos), or Rootkit.TmpHider (VirusBlokAda). The malware created to exploit this vulnerability appears to be targeting Siemens WinCC SCADA systems at this time according to independent researcher Frank Boldewin.

It should be noted that having AutoPlay disabled will prevent automatic file execution on removable disks. However, the attack could still be successful it the user browses to the root folder of the removable disk. Windows 7 has AutoPlay functionality for removable disks disabled by default.

There is currently no patch available for this vulnerability.

Microsoft has not released a patch for this vulnerability at this time, and is currently provided a workaround for disabling the displaying of icons for shortcuts and disabling the use of WebDAV which are known current attack vectors.

To disable the displaying of icons perform the following steps:

To disable the WebClient service perform the following steps:

July 20 - UPDATED DESCRIPTION:
Exploit code is publicly available. The exploit code has also been added to the Metasploit exploitation framework. We have tested the exploit code in our lab and confirmed that the exploit allows for code execution.

July 21 UPDATED DESCRIPTION:
Microsoft Knowledge Base Article 2286198 has been updated to reflect that Program Information Files (PIF) are also affected by this vulnerability. The Microsoft Knowledge Base Article includes a FixIt tool that will disable LNK and PIF file functionality ( http://support.microsoft.com/kb/2286198 ). This workaround only applies to affected systems listed above. Please note, if the Fixit tool is employed, be sure to consider how to return systems to their original state when the patch for this vulnerability is released.

Microsoft has also updated Security Advisory 2286198 to include additional attack vectors for this vulnerability which increases the possibility of exploitation. An attacker could embed an exploit in a document that supports embedded shortcuts or hosted browser controls, such as, Microsoft Office documents, e-mail attachments, or web sites.

To manually disable the displaying of icons for PIF files perform the following steps:

August 2 UPDATED DESCRIPTION:

Microsoft has issued an Out of Band patch to address this vulnerability. Please note that this patch will not undo the previously indicated workarounds or the changes applied by the “Fix it” tool.

ORIGINAL RECOMMENDATIONS:
We recommend the following actions be taken:

July 21 UPDATED RECOMMENDATIONS:
We recommend the following actions be taken:

August 2 UPDATED RECOMMENDATIONS:
We recommend the following actions be taken:

ORIGINAL REFERENCES:
Security Focus:
http://www.securityfocus.com/bid/41732

US-CERT:
http://www.kb.cert.org/vuls/id/940193

Krebs on Security Blog:
http://krebsonsecurity.com/2010/07/experts-warn-of-new-windows-shortcut-flaw/

F-Secure:
http://www.f-secure.com/weblog/archives/00001986.html
http://www.f-secure.com/weblog/archives/new_rootkit_en.pdf

VirusBlokAda:
http://www.anti-virus.by/en/tempo.shtml

Microsoft:
http://support.microsoft.com/kb/2286198
http://www.microsoft.com/technet/security/advisory/2286198.mspx

CVE:
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2568

July 20 UPDATED REFERENCES:
SANS:
http://isc.sans.edu/diary.html?storyid=9199
http://isc.sans.edu/diary.html?storyid=9181

July 21 UPDATED REFERENCES:
F-Secure:
http://www.f-secure.com/weblog/archives/00001987.html
http://www.f-secure.com/weblog/archives/00001989.html
http://www.f-secure.com/weblog/archives/00001991.html
http://www.f-secure.com/weblog/archives/00001992.html
http://www.f-secure.com/weblog/archives/00001993.html
http://www.f-secure.com/weblog/archives/00001994.html

Sophos:
http://www.sophos.com/blogs/chetw/g/2010/07/15/windows-day-vulnerability-shortcut-files-usb/
http://www.sophos.com/blogs/chetw/g/2010/07/20/shortcut-mitigation-certificate-revocation/
http://www.sophos.com/blogs/chetw/g/2010/07/20/certified-uncertainty/

August 2 UPDATED REFERENCES:

http://www.microsoft.com/technet/security/bulletin/ms10-046.msp

MS-ISAC
30 South Pearl Street, Suite P2
Albany, NY 12207
(518) 474-0865
7x24 SOC 1-866-787-4722