Tag Archives: code execution

Another OS X Java Update to Mitigate Flashback-like Malware

In two posts [ 1 / 2 ] last week, I warned you about an Apple OS X Java update that fixed a vulnerability attackers were leveraging to spread a mac trojan called Flashback. According to reports, this botnet trojan infected over 600,000 Mac users.

Today, Apple released yet another OS X Java update, this time designed to remove Flashback infections and to potentially mitigate future Java attacks.

According to Apple’s advisory, Java for OS X Lion 2012-003 configures the Java web plug-in to disable automatic execution of Java applets. This means if you visit a web page containing malicious (or legitimate) Java code, that code will not run automatically; thereby possibly preventing a drive-by download attack. The update does still allow you to manually re-enable automatic Java applet execution. However, if you do so, the plug-in will re-disable it if it detects you haven’t run Java applets for a long period of time.

This update also tries to detect and remove Flashback infections from your computer. It will inform you if it finds and removes an infection, otherwise it will remain silent when installed.

Though I don’t think the 2012-003 Java update is as critical as the first ones (which actually corrected Java vulnerabilities), it can help mitigate future Java-based attacks. If you’re a Mac user, I recommend you install it as soon as you can, or let Apple’s Software Updater do it for you. One note though…at the time of writing, though Apple had released their advisory and email about this update’s availability, I could not locate the update on their download page. I can only assume they either haven’t finished posting it, or have pulled it temporarily for some reason. In any case, I suspect it will show up on their download page, or in their Software Updater shortly.  — Corey Nachreiner, CISSP (@SecAdept)

Update OS X Java to Avoid Spreading Mac Malware

Summary:

  • This vulnerability affects: OS X 10.7.x (Lion) and 10.6.x (Snow Leopard)
  • How an attacker exploits it: By enticing you to a website containing maliciously crafted Java
  • Impact: In the worst case, an attacker executes code on your user’s computer, with that user’s privileges
  • What to do: Install Java for OS X Lion 2012-002 or Java for OS X 10.6 Update 7 immediately, or let Apple’s updater do it for you.

Exposure:

Yesterday, Apple released an advisory describing a Java security update for OS X 10.6.x and 10.7.x. The update fixes 12 vulnerabilities in OS X’s Java components (number based on CVE-IDs).

Apple doesn’t describe each flaw in technical detail, but they do share the worst case impact. If an attacker can lure you to a website containing specially crafted Java code, he can exploit many of these vulnerabilities to execute code on your OS X computer, with your privileges.

This Apple update finally brings the Java updates Oracle released in February to OS X users. Unfortunately, attackers have already been exploiting one of these Java vulnerabilities against Mac users in the wild. A Mac trojan called Flashback has reportedly infected over 600,000 Macs, by leveraging one of these Java flaws (as well as a Flash vulnerability in the past). If you have any Mac computers in your organization, we highly recommend you install Apple’s OS X Java update immediately. You can also find instructions for checking your Mac for the Flashback malware here.

Solution Path:

[UPDATE] On Friday, Apple quietly changed the Lion Java update from 2012-001 to 2012-002 for undisclosed reasons (likely the original update didn’t fully work). We have updated this alert to include the new patch. If you updated OS X before Friday, be sure to do so again.

Apple has issued Java for OS X Lion 2012-002 [dmg file] and Java for OS X 10.6 Update 7 [dmg file] to correct these flaws. If you manage OS X 10.6.x or 10.7.x computers, we recommend you download and deploy these updates immediately, or let OS X’s automatic Software Update utility install it for you.

For All WatchGuard Users:

Some of these attacks rely on one of your users visiting a web page containing malicious Java bytecode. The HTTP-Proxy policy that ships with most WatchGuard appliances automatically blocks Java bytecode by default, which somewhat mitigates the risk posed by some of these vulnerabilities.

Status:

Apple has released Java updates to fix these issues.

References:

This alert was researched and written by Corey Nachreiner, CISSP.

Critical IE Cumulative Patch Closes Eight Code Execution Flaws

Severity: High

11 October, 2011

Summary:

  • This vulnerability affects: All current versions of Internet Explorer (including IE9)
  • How an attacker exploits it: By enticing one of your users to visit a malicious web page, or click a malicious link
  • Impact: In the worst case an attacker can execute code on your user’s computer, gaining control of it
  • What to do: Deploy the appropriate Internet Explorer patches immediately, or let Windows Automatic Update do it for you

Exposure:

In a security bulletin released today as part of Patch Day, Microsoft describes eight new vulnerabilities in Internet Explorer (IE) 9.0 and earlier versions, running on all current versions of Windows (including Windows 7 and Windows Server 2008). Microsoft rates the aggregate severity of these new flaws as Critical.

The eight vulnerabilities differ technically, but share the same general scope and impact. They’re all remote code execution flaws having to do with how IE handles various HTML objects and elements. If an attacker can lure one of your users to a web page containing malicious web code, he could exploit any one of these vulnerabilities to execute code on that user’s computer, inheriting that user’s privileges. Typically, Windows users have local administrative privileges. In that case, the attacker could exploit these flaws to gain complete control of the victim’s computer.

If you’d like to know more about the technical differences between these flaws, see the “Vulnerability Information” section of Microsoft’s bulletin. Technical differences aside, these remote code execution flaws in IE pose significant risk and allow attackers to launch drive-by download attacks. You should download and install the IE cumulative patch immediately.

Solution Path:

These patches fix serious issues. You should download, test, and deploy the appropriate IE patches immediately, or let Windows Automatic Update do it for you.

* Note: These flaws do not affect Windows Server 2008 administrators who installed using the Server Core installation option.

For All WatchGuard Users:

These attacks travel as normal-looking HTTP traffic, which you must allow if your network users need to access the World Wide Web. Therefore, the patches above are your best solution.

Status:

Microsoft has released patches to fix these vulnerabilities.

References:

This alert was researched and written by Corey Nachreiner, CISSP.

Windows Updates Fix WINS Issues & Insecure DLL Loading Vulnerability

Severity: Medium

12 July, 2011

Summary:

  • These vulnerabilities affect: All current versions of Windows and components that ship with it
  • How an attacker exploits them: Multiple vectors of attack, including sending specially crafted WINS messages and enticing users to open malicious documents
  • Impact: Various. In the worst case, an attacker can gain control of your Windows computer
  • What to do: Install the appropriate Microsoft patches immediately, or let Windows Automatic Update do it for you.

Exposure:

Today, Microsoft released two security bulletins describing a couple of vulnerabilities that affect Windows and components that ship with it. Each vulnerability affects different versions of Windows to varying degrees. However, a remote attacker could exploit the worst of these flaws to gain complete control of your Windows PC. The summary below lists the vulnerabilities, in order from highest to lowest severity (according to Microsoft’s summary).

  • MS11-070: WINS Elevation of Privilege Vulnerability

Windows Internet Name Service (WINS) is essentially Microsoft’s version of the NetBIOS Name Service (NBNS) — a service that allows you to give computers human friendly names (kind of like a DNS for your local network computers). According to Microsoft, the WINS service suffers from a elevation of privilege flaw due to its inability to properly handle specially crafted WINS messages on the loopback interface. By sending such WINS packets, an attacker can leverage this flaw to force your WINS server to execute code with SYSTEM privileges, thus gaining full control of the server. However, certain factors significantly mitigate the scope of this flaw:

  1. The attacker needs valid Windows credentials to exploit this flaw
  2. The attack only works locally (not over a network), since it involves the loopback interface.

  Microsoft rating: Important

  • MS11-071  Another Insecure DLL Loading Vulnerability

Over the past year, Microsoft has contended with various “insecure Dynamic Link Library (DLL) loading” vulnerabilities affecting many of their products. This class of flaw is also sometimes referred to as a binary planting flaw. We first described this issue in a September Wire post, which describes this Microsoft security advisory. In a nutshell, this class of flaw involves an attacker enticing one of your users into opening some sort of malicious file from the same location as a specially crafted DLL file. If you do open the malicious file, it will execute code in the malicious DLL file with your privileges. If you have local administrative privileges, the attacker could exploit this type of issue to gain complete control of your computer. This new bulletin fixes yet another insecure DLL loading issue. This time, an attacker can trigger the latest issue by enticing you to open, .rtf, .txt, or .doc documents.
Microsoft rating: Important

Solution Path:

Microsoft has released patches for Windows which correct all of these vulnerabilities. You should download, test, and deploy the appropriate patches throughout your network immediately. If you choose, you can also let Windows Update automatically download and install these for you.

MS11-070:

MS11-071:

For All WatchGuard Users:

Attackers can exploit these flaws using diverse exploitation methods. Furthermore, the Firebox cannot protect you from local attacks. Therefore, installing Microsoft’s updates is your most secure course of action.

Status:

Microsoft has released patches correcting these issues.

References:

This alert was researched and written by Corey Nachreiner, CISSP.


What did you think of this alert? Let us know at your.opinion.matters@watchguard.com.
More alerts and articles: Log into the LiveSecurity Archive.

Two Visio Document Parsing Vulnerabilities

Severity: Medium

10 August, 2011

Summary:

  • This vulnerability affects: All current versions of Microsoft Visio
  • How an attacker exploits it: By enticing one of your users into opening a maliciously crafted Visio document
  • Impact: An attacker can execute code, potentially gaining complete control of your users’ computers
  • What to do: Deploy the appropriate Visio patches as soon as possible, or let Windows Update do it for you

Exposure:

Microsoft Visio is a very popular diagramming application, which many administrators use to create network diagrams. It also ships with some Office packages.

In a security bulletin released yesterday, Microsoft describes two security vulnerabilities that affect all current versions of Visio. The vulnerabilities differ technically, but share the same scope and impact. They both involve flaws in how Visio parses Visio documents. If an attacker can entice one of your users into opening a specially crafted Visio file (such as .vsd, .vdx, .vst, or .vtx), he could exploit either of these flaws to execute code on that user’s computer with that user’s  privileges. If your user has administrative privileges, the attacker could gain complete control of their computer.

Solution Path:

Microsoft has released Visio patches to fix this flaw. You should download, test, and deploy the appropriate patches as soon as possible, or let Windows Update do it for you.

For All WatchGuard Users:

If the practice fits your business environment, you can use the HTTP, SMTP, and/or POP3 proxies to block Visio documents by extension (such as .vsd, .vdx, .vst, or .vtx). However, doing so blocks both malicious and legitimate file.

If you would like to use our proxies to block Visio documents, follow the links below for instructions:

Status:

Microsoft has released a fix.

References:

This alert was researched and written by Corey Nachreiner, CISSP.


What did you think of this alert? Let us know at your.opinion.matters@watchguard.com.

More alerts and articles: Log into the LiveSecurity Archive.

Microsoft DNS Server NAPTR Code Execution Vulnerability

Severity: High

9 August, 2011

Summary:

  • This vulnerability affects: The DNS service that ships with the Server versions of Windows
  • How an attacker exploits it: By sending specially crafted DNS queries
  • Impact: In the worst case, an attacker gains complete control of your DNS server
  • What to do: Deploy the appropriate Windows  update immediately, or let Windows Automatic Update do it for you

Exposure:

The Server versions of Windows ships with a DNS Server to allow administrators to offer Domain Name System services on their networks.

In a security bulletin released today as part of Patch Day, Microsoft describes two vulnerabilities that affects the DNS Server that ships with Server versions of Windows. While this is technically a Windows flaw, which we typically include in a combined Windows alert, we feel that it deserves individual attention due to its high severity.

The worst of the two issues is a remote code execution flaw involving the way the DNS server handles specially crafted Naming Authority Pointer (NAPTR) DNS resource records (RR). By sending a specially crafted NAPTR query to your DNS server, and attacker could exploit this vulnerability to gain complete control of your server. However, the attacker would have to own the malicious domain name, and the authoritative DNS server for that domain name, in order for this attack to succeed. Despite this slight mitigating factor, the DNS server vulnerability poses a serious risk to your network. You should patch your Microsoft DNS servers immediately.

The DNS Server also suffers from a less serious  Denial of Service (DoS) flaw, which an attacker could exploit to cause your DNS server to stop responding. If an attacker can prevent your users from accessing DNS services, they essentially prevent access to the Internet (by making it difficult for users to find resources by name).

Solution Path:

Download, test, and deploy the appropriate DNS server patches immediately, or let Windows Automatic Update do it for you.

For All WatchGuard Users:

This attack leverages seemingly normal DNS traffic. You should apply the updates above.

Status:

Microsoft has released patches to fix this vulnerability

References:

This alert was researched and written by Corey Nachreiner, CISSP.


What did you think of this alert? Let us know at your.opinion.matters@watchguard.com.

More alerts and articles: Log into the LiveSecurity Archive.

Cumulative Patch Corrects Drive-by Download Flaws in IE9

Severity: High

9 August, 2011

Summary:

  • This vulnerability affects: All current versions of Internet Explorer, including IE9
  • How an attacker exploits it: In most cases, by enticing one of your users to visit a malicious web page
  • Impact: Various, in the worst case an attacker can execute code on your user’s computer, gaining complete control of it
  • What to do: Deploy the appropriate Internet Explorer patches immediately, or let Windows Automatic Update do it for you

Exposure:

In a security bulletin released today as part of Patch Day, Microsoft describes seven new vulnerabilities in Internet Explorer (IE) 9.0 and earlier versions, running on all current versions of Windows (including Windows 7 and Windows Server 2008). Microsoft rates the aggregate severity of these new flaws as Critical.

The seven vulnerabilities differ technically, but the three worst share the same general scope and impact. These three issues involve remote code execution flaws having to do with how IE handles various HTML objects and URIs. If an attacker can lure one of your users to a web page containing malicious web code, he could exploit any one of these vulnerabilities to execute code on that user’s computer, inheriting that user’s privileges. Typically, Windows users have local administrative privileges. In that case, the attacker could exploit these flaws to gain complete control of the victim’s computer.

The remaining vulnerability consists mostly of Information Disclosure flaws.

Keep in mind, today’s attackers commonly hijack legitimate web pages and booby-trap them with malicious code. Typically, they do this via hosted web ads or through SQL injection and XSS attacks. Even recognizable and authentic websites could pose a risk to your users if hijacked in this way.

If you’d like to know more about the technical differences between these flaws, see the “Vulnerability Information” section of Microsoft’s bulletin. Technical differences aside, the remote code execution flaws in IE pose significant risk and allow attackers to launch drive-by download attacks. You should download and install the IE cumulative patch immediately.

Solution Path:

These patches fix serious issues. You should download, test, and deploy the appropriate IE patches immediately, or let Windows Automatic Update do it for you.

* Note: These flaws do not affect Windows Server 2008 administrators who installed using the Server Core installation option.

For All WatchGuard Users:

These attacks travel as normal-looking HTTP traffic, which you must allow if your network users need to access the World Wide Web. Therefore, the patches above are your best solution.

Status:

Microsoft has released patches to fix these vulnerabilities.

References:

This alert was researched and written by Corey Nachreiner, CISSP.

Evil Visio 2003 Documents Could Install Malware

Severity: Medium

12 July, 2011

Summary:

  • This vulnerability affects: Visio 2003, only
  • How an attacker exploits it: By enticing one of your users into opening a maliciously crafted Visio document
  • Impact: An attacker can execute code, potentially gaining complete control of your users’ computers
  • What to do: Deploy the Visio 2003 patch as soon as possible, or let Windows Update do it for you

Exposure:

Microsoft Visio is a very popular diagramming application, which many administrators use to create network diagrams. It also ships with some Office packages.

In a security bulletin released today, Microsoft describes a security vulnerability that only affects Visio 2003. Specifically, Visio 2003 suffers from an insecure Dynamic Link Library (DLL) loading vulnerability, sometimes referred to as a binary planting flaw. We first described this class of flaw in a September Wire post, which describes this Microsoft security advisory. If an attacker can entice one of your users into opening a Visio related filw (such as .vsd, .vdx, .vst, or .vtx) file from the same location as a specially crafted DLL, he could exploit this flaw to execute code on that user’s computer with full system privileges, thus gaining complete control of the computer.

Solution Path:

Microsoft has released a Visio 2003 patch to fix this flaw. You should download, and deploy the patch as soon as possible, or let Windows Update do it for you.

For All WatchGuard Users:

If the practice fits your business environment, you can use the HTTP, SMTP, and/or POP3 proxies to block Visio documents by extension (such as .vsd, .vdx, .vst, or .vtx). However, doing so blocks both malicious and legitimate file.

If you would like to use our proxies to block Visio documents, follow the links below for instructions:

Status:

Microsoft has released a fix.

References:

This alert was researched and written by Corey Nachreiner, CISSP.


What did you think of this alert? Let us know at your.opinion.matters@watchguard.com.

More alerts and articles: Log into the LiveSecurity Archive.

Three Windows Updates: Critical Wireless Bluetooth Attack

Also, Flaws in CSRSS and Kernel-Mode Drivers

Severity: High

12 July, 2011

Summary:

  • These vulnerabilities affect: All current versions of Windows and components that ship with it
  • How an attacker exploits them: Multiple vectors of attack, including sending specially crafted wireless Bluetooth traffic
  • Impact: An attacker can gain complete control of your Windows computer
  • What to do: Install the appropriate Microsoft patches immediately, or let Windows Automatic Update do it for you.

Exposure:

Today, Microsoft released three security bulletins describing 21 vulnerabilities that affect Windows and components that ship with it. Each vulnerability affects different versions of Windows to varying degrees. However, a remote attacker could wirelessly exploit the worst of these flaws to gain complete control of your Windows PC. The summary below lists the vulnerabilities, in order from highest to lowest severity (according to Microsoft’s summary).

  • MS11-053: Bluetooth Stack Code Execution Vulnerability

Bluetooth is an open wireless technology and standard for transmiting data over short distances.  The Bluetooth stack that ships with more recent versions of Windows suffers from a code execution vulnerability involving how it accesses memory that hasn’t been deleted or initialized. By wirelessly sending a series of specially crafted Bluetooth packets, an attacker could leverage this flaw to gain complete control of your vulnerable computers. However, an attacker would need to remain in Bluetooth range to carry out this attack. The average range of Bluetooth varies from 5 to 100 meters. However, using special gear, Bluetooth “Snipers” have extended the range up to a Kilometer. This flaw only affects Windows Vista and 7. 
Microsoft rating: Critical

  • MS11-054  15 Kernel-Mode Driver Elevation of Privilege Flaws

The kernel is the core component of any computer operating system. Windows also ships with a kernel-mode device driver (win32k.sys) which handles many kernel-level devices. This kernel-mode driver suffers from 15 elevation of privilege (EoP) vulnerabilities. The flaws all differ technically, but generally share the same scope and impact. By running a specially crafted program, a local attacker could leverage these flaws to gain complete control of your Windows computers. However, the attacker would first need to gain local access to your Windows computers using valid credentials. This factor significantly reduces the risk of this flaw.
Microsoft rating: Important

  • MS11-056: CSRSS Local Elevation of Privilege Vulnerability

The Client/Server Run-time SubSystem (CSRSS) is an essential Windows component responsible for console windows and creating and deleting threads. It suffers from five technically different, but functionally similar, Elevation of Privilege (EoP) vulnerabilities. Like the Kernel-Mode Driver flaw above, by running a specially crafted program, an authenticated attacker could leverage these flaws to gain complete, SYSTEM-level  control of your Windows computers. However, like before, the attacker would first need to gain local access to your Windows computers using valid credentials, which somewhat reduces the risk of these flaws.

  • Microsoft rating: Important

Solution Path:

Microsoft has released patches for Windows which correct all of these vulnerabilities. You should download, test, and deploy the appropriate patches throughout your network immediately. If you choose, you can also let Windows Update automatically download and install these for you.

MS11-053:

* Note: Windows Vista SP1 is only affected if you install the optional Feature Pack for Wireless

MS11-054:

MS11-056:

For All WatchGuard Users:

Attackers exploit these flaws either locally, or via Bluetooth Wireless transmitions. WatchGuard’s wired and 802.11 wireless appliances do not protect these vectors. Therefore, installing Microsoft’s updates is your most secure course of action.

Status:

Microsoft has released patches correcting these issues.

References:

This alert was researched and written by Corey Nachreiner, CISSP.


What did you think of this alert? Let us know at your.opinion.matters@watchguard.com.
More alerts and articles: Log into the LiveSecurity Archive.

Apple OSX: Take Your Leopards In For a Checkup

Summary:

  • These vulnerabilities affect: All current versions of OS X 10.5.x (Leopard) and OS X 10.6.x (Snow Leopard)
  • How an attacker exploits them: Multiple vectors of attack, including enticing your users to visit a malicious web site, or into downloading and viewing various documents or images
  • Impact: Various results; in the worst case, an attacker executes code on your user’s computer
  • What to do: OS X administrators should download, test and install OS X 10.6.8 or Security Update 2011-004 as soon as possible, or let Apple’s Software updater do it for you.

Exposure:

Today, Apple released a security update to fix vulnerabilities in all current versions of OS X. The update fixes around 39 (number based on CVE-IDs) security issues in 22 components that ship as part of OS X or OS X Server, including Airport, Quicktime, and MobileMe. Some of the fixed vulnerabilities include:

  • Two ImageIO Code Execution Flaws. ImageIO is one of the components that helps OS X handle various image file types. Unfortunately, it also suffers from two security vulnerabilities involving the way it handles certain types of image files (such as a buffer overflow vulnerabilities). Though these vulnerabilities differ technically, they generally share the same scope and impact. If an attacker can get a victim to view a specially crafted image file (perhaps hosted on a malicious website), he could exploit any of these flaws to either crash an application or to execute attack code on the victim’s computer. By default, the attacker would only execute code with that user’s privileges. The affected image types include JEPG2000, and TIFF.
  • ATS Buffer Overflow Vulnerability. The Apple Type Service (ATS) helps OS X machines handle fonts. ATS suffers from a buffer overflow vulnerability having to do with the way it handles embedded fonts TrueType fonts. By tricking one of your users into downloading and viewing a malicious document containing a specially crafted font, an attacker can exploit this flaw to execute code on that user’s computer. By default, the attacker would only execute code with that user’s privileges.
  • Five Quicktime Vulnerabilities. Quicktime is the popular video and media player that ships with OS X (and iTunes). Quicktime suffers from five security issues  involving how it handles certain image,audio, and video files. While the vulnerabilities differ technically, they share the same basic scope and impact. If an attacker can trick one of your users into viewing a maliciously crafted media in QuickTime, he could exploit any of these flaws to execute code on that user’s computer, with that user’s privileges.

Apple’s alert also describes many other code execution vulnerabilities, as well as some Denial of Service (DoS) flaws, privilege escalation vulnerabilities, and information disclosure flaws. Components patched by this security update include:

AirPort App Store
ATS Certificate Trust Policy
ColorSync CoreFoundation
CoreGraphics FTP Server
ImageIO International Components for Unicode
Kernel Libsystem
libxslt MobileMe
MySQL OpenSSL
patch QuickLook
QuickTime Samba
servermgrd subversion

Please refer to Apple’s OS X 10.5.x and 10.6.x alert for more details.

Solution Path:

Apple has released OS X Security Update 2011-004 and OS X 10.6.8 to fix these security issues. OS X administrators should download, test, and deploy the corresponding update as soon as they can.

Note: If you have trouble figuring out which of these patches corresponds to your version of OS X, we recommend that you let OS X’s Software Update utility pick the correct updates for you automatically.

For All Users:

These flaws enable many diverse exploitation methods. Some of the exploits are local, meaning that your perimeter firewall never encounters the attack (unless you use firewalls internally between departments). Installing these updates, therefore, is the most secure course of action.

Status:

Apple has released updates to fix these flaws.

References:

This alert was researched and written by Corey Nachreiner, CISSP. (@SecAdept)

%d bloggers like this: