Last day to save $500 for SANS San Diego 2013

@RISK: The Consensus Security Vulnerability Alert

Volume: VI, Issue: 37
September 10, 2007

SANS Newsletters Home

As an MIT grad, I always took a little (unearned) pride in the fact that MIT created Kerberos - the powerful authentication systems used by many large organizations that really care about security. So this week's critical flaws found in Kerberos - and in numerous unnamed derivative products - was a bummer. An iTunes vulnerability was also discovered that affects both Widows and Mac implementations. Alan

@RISK is the SANS community's consensus bulletin summarizing the most important vulnerabilities and exploits identified during the past week and providing guidance on appropriate actions to protect your systems (PART I). It also includes a comprehensive list of all new vulnerabilities discovered in the past week (PART II).

Summary of the vulnerabilities reported this week:

    • Category
    • # of Updates & Vulnerabilities
    • Platform Number of Updates and Vulnerabilities
    • - ------------------------ -------------------------------------
    • Other Microsoft Products
    • 2 (#4)
    • Third Party Windows Apps
    • 13 (#5, #8, #9)
    • Linux
    • 4
    • Solaris
    • 1
    • Aix
    • 9
    • Apple
    • 1 (#2)
    • Unix
    • 1
    • Cross Platform
    • 16 (#1, #3, #7)
    • Web Application - Cross Site Scripting
    • 4
    • Web Application - SQL Injection
    • 7
    • Web Application
    • 20
    • Network Device
    • 3 (#6)

********************* Sponsored By Sourcefire, Inc. ************************

"Who is not following our network compliance policies?" "Who is being targeted by this external threat?" "Who is consuming the most bandwith on that network segment?" "Who is initiating this internal attack?"

Finally you can immediately identify the "who" behind the "what" with Sourcefire RUA(tm) (Real-time User Awareness)! Click to learn more. http://www.sans.org/info/15806

*************************************************************************

TRAINING UPDATE Where can you find Hacker Exploits, Security Essentials and SANS other top-rated courses? Las Vegas (9/23-9-28): http://www.sans.org/ns2007/event.php Chicago (11/2-11/7): http://www.sans.org/chicago07/event.php Tokyo (11/5-11/10): http://www.sans.org/sanstokyo2007_autumn/event.php London (11/26 - 12/1): http://www.sans.org/london07/ Washington DC (12/13-12/18): http://www.sans.org/london07/ New Orleans (1/12-1/17): http://www.sans.org/security08/event.php Plus in 100 other cities and even on line at your convenience. How good are the courses? Here's what past attendees said: "An extraordinary amount of information covered in a week, backed up with excellent documentation for those long winter nights." (Keith Mellism, Canada Life) "This course has valuable information that can be implemented immediately in the work place." (Christopher O'Brien, Booz Allen Hamilton) "You will never ever find anything more valuable than SANS super knowledge. Worth the price!!" (Carlos Fragoso, CESCA)

*************************************************************************

PART I Critical Vulnerabilities

Part I for this issue has been compiled by Rob King at TippingPoint, a division of 3Com, as a by-product of that company's continuous effort to ensure that its intrusion prevention products effectively block exploits using known vulnerabilities. TippingPoint's analysis is complemented by input from a council of security managers from twelve large organizations who confidentially share with SANS the specific actions they have taken to protect their systems. A detailed description of the process may be found at http://www.sans.org/newsletters/cva/#process

Widely Deployed Software
  • (1) CRITICAL: MIT Kerberos Multiple Vulnerabilities
  • Affected:
    • MIT Kerberos versions prior to 1.6.3 and 1.5.5

  • Description: MIT's implementation of the Kerberos authentication protocol contains multiple vulnerabilities in its "kadmind" administration daemon. This daemon runs on servers that act as Kerberos controllers. This server exports a Sun RPC (also called ONC RPC) interface that can be used to administer the service. The first vulnerability lies in the handling of RPCSEC_GSS authentication information and can be exploited by unauthenticated users. The second vulnerability stems from a failure to properly parse arguments to certain exported procedures, and requires authentication to exploit. An attacker who successfully exploited these vulnerabilities would be able to execute arbitrary code with the privileges of the vulnerable process (usually root). Note that the first vulnerability exists in the RPC library shipped with Kerberos; other products using this library may also be vulnerable. MIT Kerberos or products based thereupon are shipped by default with numerous Unix and Unix-like systems. Technical details for these vulnerabilities are available via source code analysis.

  • Status: MIT confirmed, updates available.

  • References:
  • (2) HIGH: Apple iTunes Music File Buffer Overflow
  • Affected:
    • Apple iTunes versions prior to 7.4

  • Description: Apple iTunes contains a buffer overflow in its handling of album cover art. These images can be embedded in music files so that iTunes can display the cover art for that song. A specially crafted song file containing malicious cover art data could trigger this buffer overflow and execute arbitrary code with the privileges of the current user. Note that iTunes on both Apple Mac OS X and Microsoft Windows is vulnerable.

  • Status: Apple confirmed, updates available.

  • References:
  • (3) HIGH: Apache Struts/OpenSymphony WebWork OGNL Remote Code Execution
  • Affected:
    • Apache Struts versions prior to 2.0.9
    • OpenSymphony WebWork versions prior to 2.0.4
    • OpenSymphony XWork versions prior to 2.0.4

  • Description: Apache Struts and OpenSymphony WebWork provide a Java-based development environment for internet applications. A failure to properly handle invalid user form input could allow an attacker to execute arbitrary Open Graph Navigation Language (OGNL) code. OGNL is an expression language for Java that allows simpler interaction with JavaBeans. An attacker who submitted a specially crafted web form to a vulnerable system could cause the server to execute arbitrary OGNL code with the privileges of the vulnerable process. This could in turn lead to arbitrary Java code execution. Technical details are available for this vulnerability, both in the advisory and through source code analysis. A simple proof-of-concept is included in the advisory.

  • Status: Apache and OpenSymphony confirmed, updates available.

  • References:
  • (4) MODERATE: Microsoft Visual FoxPro ActiveX Control Buffer Overflow
  • Affected:
    • Microsoft Visual FoxPro version 6.0 and possibly prior

  • Description: Microsoft Visual FoxPro is Microsoft's integrated development environment for the FoxPro programming language. It installs the "FPLOE.OCX" ActiveX control, which contains a buffer overflow in its "FoxDoCmd" method. A malicious web page that instantiated this control could exploit this buffer overflow to execute arbitrary code with the privileges of the current user. A proof-of-concept for this vulnerability is publicly available.

  • Status: Microsoft has not confirmed, no updates available. Users can mitigate the impact of this vulnerability by disabling the control via Microsoft's "kill bit" mechanism for CLSID EF28418F-FFB2-11D0-861A-00A0C903A97F.

  • References:
  • (5) MODERATE: Intuit QuickBooks Online Edition ActiveX Control Multiple Vulnerabilities
  • Affected:
    • Intuit Quickbooks Online Edition ActiveX Control versions prior to 10

  • Description: Intuit QuickBooks Online Edition is a version of Intuit's popular QuickBooks bookkeeping application implemented as an ActiveX control that can be run within Microsoft Internet Explorer. This ActiveX control contains multiple buffer overflows in several methods. Additionally, the "httpGETToFile" and "httpPOSTFromFile" methods can be used to overwrite or upload arbitrary files on the victim's system. Some technical details are available for these vulnerabilities.

  • Status: Intuit confirmed, updates available. Users can mitigate the impact of this vulnerability by disabling the vulnerable control via Microsoft's "kill bit". Doing so will impact normal application functionality.

  • References:
Other Software
  • (8) MODERATE: Borderbund Expressit 3DGreetings Player ActiveX Control Multiple Vulnerabilities
  • Affected:
    • Broderbund Expressit 3DGreetings Player ActiveX Control

  • Description: The Broderbund Expressit 3DGreetings Plaer is an ActiveX player for 3D web-based greeting cards. Several buffer overflow vulnerabilities have been discovered in various exported methods of this control. A malicious web page that instantiated this control could exploit these vulnerabilities to execute arbitrary code with the privileges of the current user. Note that no technical details are currently available for these vulnerabilities, but that several tools exist that can automatically audit arbitrary ActiveX controls.

  • Status: Broderbund has not confirmed, no updates available. Users can mitigate the impact of this vulnerability by disabling the vulnerable control via Microsoft's "kill bit" mechanism for CLSID 0C3F7D74-ADA5-4976-8908-A8189590DAFA. Note that disabling this control will impact normal application functionality.

  • References:
  • (9) MODERATE: Earth Resource Mapper JPEG2000 Plug-In ActiveX Control Multiple Buffer Overflows
  • Affected:
    • Earth Resource Mapper ECW JPEG2000 Plug-In versions prior to 8.1

  • Description: Earth Resource Mapper is a geospatial image processing application. Its ECW JPEG 2000 Plug-In package installs an ActiveX control that has been discovered to contain multiple buffer overflow vulnerabilities in exported methods. A malicious web page that instantiated this control could trigger one of these buffer overflows and execute arbitrary code with the privileges of the current user.

  • Status: Vendor confirmed, updates available. Users can mitigate the impact of this vulnerability by disabling the vulnerable control via Microsoft's "kill bit" mechanism for CLSID 8EC18CE2-D7B4-11D2-88C8-006008A717FD.

  • References:
Part II: Weekly Comprehensive List of Newly Discovered Vulnerabilities
Week 37, 2007

This list is compiled by Qualys ( www.qualys.com ) as part of that company's ongoing effort to ensure its vulnerability management web service tests for all known vulnerabilities that can be scanned. As of this week Qualys scans for 5549 unique vulnerabilities. For this special SANS community listing, Qualys also includes vulnerabilities that cannot be scanned remotely.

(c) 2007. All rights reserved. The information contained in this newsletter, including any external links, is provided "AS IS," with no express or implied warranty, for informational purposes only. In some cases, copyright for material in this newsletter may be held by a party other than Qualys (as indicated herein) and permission to use such material must be requested from the copyright owner.

Subscriptions: @RISK is distributed free of charge by the SANS Institute to people responsible for managing and securing information systems and networks. You may forward this newsletter to others with such responsibility inside or outside your organization.

504 was a great course to better enhance my understanding of attack methods and how to better defend my systems
-Dustin Odsa, Indiana University

CyberTalent Assessments

Latest Whitepapers

Building and Maintaining a "Certifiable" Workforce
By Robert J. Mavretich

How Can You Build and Leverage SNORT IDS Metrics to Reduce Risk?
By Tim Proffitt

Daisy Chain Authentication
By Courtney Imbert

Latest Tweets

NEW #SANS Survey: Security Analytics & Intelligence 2nd [...]
October 1, 2013 - 6:30 PM

Tips on how to convince your boss to let you train online wi [...]
October 1, 2013 - 6:23 PM

#2 Tip on how 2 convince your boss 2 let u train online: Fle [...]
October 1, 2013 - 3:00 PM

Contact Us

(301) 654-SANS (7267)
Mon-Fri 9am - 8pm EST/EDT
info@sans.org

"It was a great learning experience that helped open my eyes wider. The instructor's knowledge was fantastic."
- Manuja Wikesekera, Melbourne Cricket Club

"Because of the use of real-world examples it's easier to apply what you learn."
- Danny Hill, Friedkin Companies, Inc.

"Expertise of the trainer is impressive, real life situations explained, very good manuals. Best training ever!"
- Jerry Robles de Medina, Godo CU