Tag Archives: updates

Blackhat and More – WSWiR Episode 116

Blackhat Summary,Lots of Patches, and MonsterMind

Times have changed. Cyber attacks have increased 10-fold, causing a ton of information security (infosec) news each week. Can’t keep up with it all? Let me help out. In this weekly video summary, I highlight the biggest information and security news every week.

Last week, I had meant to post a Black Hat video summary, but simply couldn’t find the time during my two week travel schedule. I try to make up for it in this week’s episode. In today’s video, I share a bit about Black Hat, cover the latest security patches, comment on the alleged huge password theft, and highlight Snowden’s latest interview and disclosures. Watch the video for the details.

Also, don’t forget to check out the big reference section below for two weeks of security news links, and some videos from Black Hat. Have a great weekend.

(Episode Runtime: 9:09)

Direct YouTube Link: https://www.youtube.com/watch?v=Xv1fUT15AP8

Episode References:

Extras:

— Corey Nachreiner, CISSP (@SecAdept)

Office Patches Mend SharePoint and OneNote

Severity: High

Summary:

  • These vulnerabilities affect: Microsoft Office related products like OneNote and SharePoint Server
  • How an attacker exploits them: Varies. Typically by enticing users to open or interact with maliciously crafted Office documents
  • Impact: Many. In the worst case, an attacker can gain complete control of your Windows computer
  • What to do: Install the appropriate Microsoft patches as soon as possible, or let Windows Automatic Update do it for you

Exposure:

Today, Microsoft released two security bulletins that fix a like number of vulnerabilities in OneNote and SharePoint. We summarize these security bulletins below, in order from highest to lowest severity.

  • MS14-048OneNote Code Execution Vulnerability

OneNote is a collaborative, multiuser note taking application that ships with Office. It suffers from an unspecified vulnerability having to do with how it handles specially crafted OneNote files. If an attacker can lure you into opening such a file, she could exploit this flaw to execute code on your computer, with you privileges. As usual, if you are a local administrator, the attacker gains complete control of your PC.

Microsoft rating: Important

  • MS14-050: SharePoint Elevation of Privilege Vulnerability

SharePoint Server is Microsoft’s web and document collaboration and management platform. It suffers from a privilege escalation vulnerability. SharePoint offers an extensibility model that allows you to create apps that can access and use SharePoint resources. However, SharePoint suffers some unspecified flaw that allows specially crafted apps to bypass permission management. In short, by running a specially crafted application, an attacker may be able to access all the SharePoint resources of the currently logged-in user.

Microsoft rating: Important

Solution Path:

Microsoft has released Office and SharePoint-related patches that correct these vulnerabilities. You should download, test, and deploy the appropriate updates throughout your network as soon as possible. If you choose, you can also let Windows Update automatically download and install these updates for you.

Keep in mind, however, that we highly recommend you test updates before running them in your production environment; especially updates for critical production servers.

The links below point directly to the “Affected and Non-Affected Software” section of each bulletin, where you can find all of Microsoft’s update links:

For All WatchGuard Users:

We recommend you install Microsoft’s updates to completely protect yourself from these flaws.

Status:

Microsoft has released patches correcting these issues.

References:

This alert was researched and written by Corey Nachreiner, CISSP (@SecAdept).


What did you think of this alert? Let us know at your.opinion.matters@watchguard.com.

SQL Server Update Fixes XSS and DoS Vulnerability

Severity: Medium

Summary:

  • These vulnerabilities affect: Most current versions of SQL Server
  • How an attacker exploits it: Various, including enticing someone to click a specially crafted link
  • Impact: In the worst case, an attacker can steal your web cookie, hijack your web session, or essentially take any action you could on the SQL server
  • What to do: Deploy the appropriate SQL Server updates as soon as possible

Exposure:

SQL Server is Microsoft’s popular database server. According to Microsoft’s security bulletin, SQL Server suffers from both a Cross-site Scripting (XSS) and Denial of Service (DoS) vulnerability.

The XSS flaw poses the most risk. The SQL Master Data Services (MDS) component suffers from a Cross-site Scripting (XSS) vulnerability due to its inability to properly encode output. By enticing someone to click a specially crafted link, an attacker could leverage this flaw to inject client-side script into that user’s web browser. This could allow the attacker to steal web cookie, hijack the web session, or essentially take any action that user could on your SQL Server’s associated web site. In some cases, attackers can even leverage XSS attacks to hijack your web browser, and gain unauthorized access to your computer.

The DoS flaw poses less risk, but is worth patching too. Essentially, if an attacker can send specially crafted queries to you SQL server, he could lock it up. However, since most administrator block SQL queries from the Internet, the attacker would have to reside on the local network to launch this attack.

Solution Path:

Microsoft has released SQL Server updates  to correct this vulnerability. You should download, test, and deploy the appropriate update as soon as possible. You can find the updates in the “Affected and Non-Affected Software” section of Microsoft’s SQL Server bulletin.

As an aside, the Cross-site Scripting (XSS) protection mechanisms built into many modern web browsers, like Internet Explorer (IE) 8 and above, can often prevent these sorts of attacks. We recommend you enable these mechanisms, if you haven’t already.

For All WatchGuard Users:

Since attackers might exploit some of these attacks locally, we recommend you download, test, and apply the SQL Server patches as quickly as possible.

Status:

Microsoft has released updates to fix this vulnerability.

References:

This alert was researched and written by Corey Nachreiner, CISSP (@SecAdept).


What did you think of this alert? Let us know at your.opinion.matters@watchguard.com.

Windows Updates for Media Center, .NET, and LRPC

Severity: Medium

Summary:

  • These vulnerabilities affect: All current versions of Windows (and related components like .NET Framework)
  • How an attacker exploits them: Multiple vectors of attack, such as enticing you into opening maliciously crafted Office file.
  • Impact: In the worst case, an remote attacker can gain complete control of your Windows computer
  • What to do: Install the appropriate Microsoft patches as soon as possible, or let Windows Automatic Update do it for you

Exposure:

Today, Microsoft released five security bulletins describing seven vulnerabilities in Windows and related components, such as the .NET Framework. A remote attacker could exploit the worst of these flaws to potentially gain complete control of your Windows PC. We recommend you download, test, and deploy these critical updates as quickly as possible.

The summary below lists the vulnerabilities, in order from highest to lowest severity.

  • MS14-043:  Windows Media Center Code Execution Flaw

Windows Media Center is the media player and Digital Video Recording (DVR) application that ships with the popular operating system. MCplayer.dll, a component Media Center uses for audio and video playback, suffers from a “use after free” vulnerability. By tricking you into running a specially crafted Office file, a remote attacker could leverage this flaw to execute code on your computer, with your privileges. If you’re a local adminstrator, the attacker could gain complete control of your machine. Note, this flaw mostly affects the latest versions of Windows.

Microsoft rating: Critical

  • MS14-045:  Multiple Kernel-Mode Driver Elevation of Privilege Vulnerabilities

The kernel is the core component of any computer operating system. Windows also ships with a kernel-mode device driver (win32k.sys), which handles the OS’s device interactions at a kernel level. The Windows kernel-mode driver suffers from three local code execution flaws. The flaws differ technically, but most have to do with the kernel-mode driver improperly handling certain objects, which can result in memory corruptions. Smart attackers can leverage memory corruption flaws to execute code. In a nutshell, if a local attacker can run a specially crafted application, he could leverage most of these flaws to gain complete control of your Windows computers. However, in order to run his malicious program, the attacker first needs to gain local access to your Windows computer, or needs to trick you into running the program yourself, which somewhat lessens the severity of this vulnerability.

Microsoft rating: Important

  • MS14-046:  .NET Framework ASLR Bypass Flaw

The .NET Framework is software framework used by developers to create new Windows and web applications. Address Space Layout Randomization (ASLR) is a memory obfuscation technique that some operating systems use to make it harder for attackers to find specific things in memory, which in turn makes it harder for them to exploit memory corruption flaws. In short, the .NET framework doesn’t use ASLR protection. This means attackers can leverage .NET to bypass Windows’ ASLR protection features. This flaw alone doesn’t allow an attacker to gain access to your Windows computer. Rather, it can help make other memory corruption vulnerabilities easier to exploit. This update fixes the ASLR bypass hole.

Microsoft rating: Important

Local Remote Procedure Call (LRPC) is a protocol Microsoft Windows uses to allow processes to communicate with each other and execute tasks, whether on the same computer or another computer over the network. It suffers from a ASLR bypass vulnerability that has the same scope and impact as the .NET one described above.

Microsoft rating: Important

  • MS14-049:  Windows Installer Service Elevation of Privilege Flaw

As its name suggests, the Windows Installer services is a component that helps you install and configure stuff in Windows. It suffers from a privilege escalation vulnerability involving the way it improperly handles the repair of a previous application. If a local attacker can log into one of your Windows systems and run a specially crafted application, he could exploit this flaw to gain complete control of the system (even if he started out with only Guest privileges). Of course, the attacker would need valid login credentials, which significantly lowers the severity of this issue.

Microsoft rating: Important

Solution Path:

Microsoft has released various updates that correct all of these vulnerabilities. You should download, test, and deploy the appropriate updates throughout your network immediately. If you choose, you can also let Windows Update automatically download and install them for you. As always, you should test your updates before deploying them.

The links below point directly to the “Affected and Non-Affected Software” section of each bulletin, where you can find links to the various updates:

For All WatchGuard Users:

Though WatchGuard’s XTM appliances offer defenses that can mitigate the risk of some of these flaws (such as blocking Office files), attackers can exploit others locally. Since your gateway XTM appliance can’t protect you against local attacks, we recommend you install Microsoft’s updates to completely protect yourself from these flaws.

Status:

Microsoft has released patches correcting these issues.

References:

This alert was researched and written by Corey Nachreiner, CISSP (@SecAdept).


What did you think of this alert? Let us know at your.opinion.matters@watchguard.com.

Nine Microsoft Security Bulletins Coming Tomorrow; Two Critical

Is it just me, or are the months flying by this year? It’s already time for yet another Microsoft Patch Day. According to their advanced notification post for August, Microsoft will release nine security bulletins tomorrow, two with a Critical severity rating. The bulletins will include updates to fix flaws in Windows, Internet Explorer, Office, the .NET Framework, SQL server, and other Microsoft Server Software. You can find a little more color about the upcoming patches at Microsoft’s Security Response Center blog.

In short, if you are a Microsoft administrator, you should prepare yourself for a busy day of patching. I’ll post more details about these updates tomorrow, as they come out. However, I am traveling this week to attend a show, so my posts may not go live as quickly as normal. Be sure to keep you eye on their summary post tomorrow, if you’d like to get the details early. — Corey Nachreiner, CISSP (@SecAdept)

BadUSB – WSWiR Episode 115

Android Fake ID, Backoff PoS Attack, and BadUSB

With Blackhat and DEF CON only a week away, it’s not surprising to see news of new vulnerabilities and attack vectors popping up as researchers hint at their upcoming presentations. If you are interesting in this threat news, but have no time to track it down yourself, this weekly video can fill you in.

Today’s show shares details about the Android Fake ID vulnerability, talks about a new PoS system attack campaign, and warns of an industry-wide USB problem researchers will disclose at Blackhat. Check out the video for the details and some advice, then scroll down to the Reference section if you are interested in other infosec news from the week.

As an aside, I will be attending Blackhat next week, which means I may not post the video at its regular time. However, it also means I’ll cover my favorite briefings from the show, so if you can’t attend be sure to tune in to get a taste of the popular security conference. Have a great weekend.

(Episode Runtime: 10:52)

Direct YouTube Link: https://www.youtube.com/watch?v=51VT-CJJKB4

Episode References:

Extras:

— Corey Nachreiner, CISSP (@SecAdept)

iOS Backdoor – WSWiR Episode 114

Firefox 31, Tails 0day, and iOS Backdoor

Are you curious about the latest network breaches, dangerous new zero day exploits, or breaking security research, but too busy to find all this information on your own? No worries. We summarize the most important security news for you in our weekly security video every Friday.

In this week’s episode, you’ll learn how the latest Firefox update makes it harder to download malware, why you can’t rely on some anonymizers, and whether or not you should worry about the rumored backdoor in iOS. Check out the video for the full scoop, and don’t forget to peruse the extra stories in the Reference section below.

(Episode Runtime: 7:51)

Direct YouTube Link: https://www.youtube.com/watch?v=qg1wsjzjC4Q

Episode References:

Extras:

— Corey Nachreiner, CISSP (@SecAdept)

Weak Passwords are Good? – WSWiR Episode 113

Oracle Patches, Project Zero, and Password Problems

Another week, another big batch of InfoSec news. If your IT job is already overwhelming you with tasks, leaving you no time to keep up with computer and network security, “I’ve got ya bro.” Check out our weekly security news summary for all the important action.

Today’s episode covers Oracle’s quarterly Critical Patch Update (CPU), a neat security project from Google, and a bevy of password security related news and issues. It’s all in the video, so give it a play. Also, don’t forget the Reference section below for other interesting news.

Enjoy your summer weekend, and stay safe!

(Episode Runtime: 8:59)

Direct YouTube Link: https://www.youtube.com/watch?v=yOtbuwhqZVo

Episode References:

Extras:

— Corey Nachreiner, CISSP (@SecAdept)

Hardware Malware – WSWiR Episode 112

Tons of Patches, Facebook Botnets, and Infected Hand Scanners

After a couple weeks of hiatus, we’re finally back with our weekly security news summary video. If you want to learn about all the week’s important security news from one convenience resource, this is the place to get it.

This episode covers the latest popular software security updates from the last two weeks, and interesting Litecoin mining botnet that Facebook helped eradicate, and an advanced attack campaign that leverages pre-infected hardware products. Watch the video for the details, and check out the Reference’s for more information, and links to many other interesting InfoSec stories.

Enjoy your summer weekend, and stay safe!

(Episode Runtime: 7:37)

Direct YouTube Link: https://www.youtube.com/watch?v=oAHYUW1KkM0

Episode References:

Extras:

— Corey Nachreiner, CISSP (@SecAdept)

Microsoft Service Bus DoS Mostly Affects Enterprise Web Developers.

Among this week’s Microsoft security bulletins is one that likely only affects a small subset of Microsoft customers, and thus not worth a full security alert.

Microsoft Service Bus is a messaging component that ships with server versions of Windows, providing enterprise developers with the means to create message-driven applications. According to Microsoft’s bulletin, Service Bus suffers from a denial of service (DoS) vulnerability involving it’s inability to properly handle a sequence of specially crafted messages. If you have created an application that uses Service Bus, an attacker who could send specially crafted messages to your application could exploit this flaw to prevent the application from responding to further messages. You’d have to restart the service to regain functionality.

Windows itself doesn’t really use Service Bus for anything, but if you have internal applications that do, this vulnerability may be significant to you. If you use Service Bus, be sure to check out the bulletin to get your updates. — Corey Nachreiner, CISSP (@SecAdept)

Follow

Get every new post delivered to your Inbox.

Join 7,664 other followers

%d bloggers like this: