November 2005 - Posts

Handler's Diary November 30th 2005

Musings on the Internet Explorer 0-day vulnerability (NEW)

Published: 2005-11-30,
Last Updated: 2005-11-30 17:16:11 UTC by Scott Fendley (Version: 1)

So are any of you like me with regard to the Internet Explorer vulnerability mentioned last week http://isc.sans.org/diary.php?storyid=874? I know that I am watching and waiting to see if Microsoft is going to release an out of cycle patch, or wait for December 13th patch day.  If I were a gambler, I might actually bet on Microsoft releasing it early.

Why do I think this way?  Well.... Glad you asked.

Yesterday, Microsoft updated the advisory located at
KB911302 with a couple of tidbits.  First, they made mention of both Proof of Conecept and malicious software which appear to be targeting the reported vulnerability.  Second, they also mention the Windows Live Safety Center where end users can scan and remove any malicious software and variants that may be running around now.

Throwing in that Microsoft has on occasion released out-of-cycle patches (June 2004 is a case in point in my mind), then I think it is a safe bet that Microsoft will take appropriate steps to fix the problem as quickly as possible.  In the meantime there are 2 things I can continue to suggest.

1) Be vigilant.  Know that a patch will be forthcoming hopefully within the next 2 weeks and be ready to deploy quickly.

2) If your organization can operate with one of the workarounds Microsoft has mentioned in KB911302, then I recommend mitigating your risk as much as possible.  We all have at least one person who is a litle too...uhm...liberal with browsing the Internet on company time.  Think about it, that very person is probably shopping for Christmas* presents right now on less-than-secure sites.  SO....I would suggest doing those workarounds to that computer first.  :-)


* For those that celebrate other holidays in December than Christmas, this statement is not meant to be offensive in any shape or form, or otherwise slight your holiday of choice.
 Handler's Diary November 30th 2005

Sun Java SDK and JRE Updates (NEW)

Published: 2005-11-30,
Last Updated: 2005-11-30 05:28:39 UTC by Scott Fendley (Version: 1)


Sun Microsystems announced Monday some updates to their Java Software Development Kit and Java Runtime Environment to address some security issues. These security vulnerabilities could allow malicious, untrusted code to compromise a user's computer.  Sun recommends that users update to the newest version of  the SDK and JRE available at http://java.sun.com .

For more information about the security issues please take a look at:
http://sunsolve.sun.com/searchproxy/document.do?assetkey=1-26-102050-1
http://sunsolve.sun.com/searchproxy/document.do?assetkey=1-26-102003-1
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102017-1
http://secunia.com/advisories/17748/

Thanks to all of the readers who have notified us of this issue this evening.


Scott Fendley
Handler on Duty

********************************************************************

Title: Microsoft Security Advisory Notification

Issued: November 29, 2005

********************************************************************

Security Advisory Updated Today

==============================================

* Security Advisory (911302)

- Title: Vulnerability in the way Internet Explorer Handles Mismatched Document Object Model Objects Could Allow Remote Code Execution.

- Reason For Update: Added information regarding proof of concept code, malicious software, and reference to Windows Live Safety Center.

- Web site: http://go.microsoft.com/fwlink/?LinkId=56599

SANS - Internet Storm Center - Cooperative Cyber Threat Monitor And Alert System

Handler's Diary November 29th 2005

DoS Exploit for MS05-053 released (NEW)

Published: 2005-11-29,
Last Updated: 2005-11-29 13:46:54 UTC by Pedro Bueno (Version: 1)

Today we received some alerts about exploits for MS05-053 that have been released and can be found on specialized websites.
This exploit claims to cause a DoS condition when viewing a special file on IE.

from the code:
"The crafted metafile from this code when viewed in internet explorer raises the CPU utilization to 100%. The code was tested on Windows 2000 server SP4. The issue does not occur with the hotfix for GDI (MS05-053) installed"

Did I say PATCH yet?
Go on...

---------------------------------------------
Pedro Bueno ( pbueno //&&// isc. sans. org)

)

Looks like we are up and running again…

SANS - Internet Storm Center - Cooperative Cyber Threat Monitor And Alert System

Handler's Diary November 27th 2005

MS05-051 POC Exploit

Published: 2005-11-27,
Last Updated: 2005-11-27 23:25:58 UTC by Johannes Ullrich (Version: 1)

A proof of concept (PoC) exploit was released against systems vulnerable
to MS05-051. MS05-051 was released in October. The vulnerability does allow for
arbitrary code execution in systems with the Microsoft Distriuted Transaction Coordinator (MSDTC) enabled.

In order to disable MSDTC, enter the following command:
sc stop MSDTC & sc config MSDTC start= disabled

By default, port 3372 is used by the exploit. The packet send will cause a denial of service condition. At this point, we see only little activity at port 3372, likely due to the fact that this PoC exploit does not actually execute any "useful" code.

MS05-051 Advisory (read for more workarounds and list of vulnerable systems)

 Bloodhound.Exploit.54 is a heuristic detection for the Microsoft Internet Explorer JavaScript Window() Vulnerability, as described in CAN-2005-1790.

You can read the details here: Symantec Security Response - Bloodhound.Exploit.54

 

Symantec has updated their Lodear removal tool to cover the following:

 November 25, 2005: Updated removal tool to version 1.3.0 to support Trojan.Lodear.D and Trojan.Lodav.B.

To date, this tool covers the following:

You can download this tool here: Symantec Security Response - Trojan.Lodear Removal Tool

 

McAfee has updated their Stinger cleaner tool to cover the latest Sober.X threat (CME-681) as well as other Trojans\viruses

Stinger version 2.5.9 covers the following:

This version of Stinger includes detection for all known variants, as of November 22, 2005:

BackDoor-AQJ BackDoor-ALI BackDoor-CEB
BackDoor-JZ Bat/Mumu.worm Downloader-DN.a
Exploit-DcomRpc Exploit-LSASS Exploit-MS04-011
HideWindow IPCScan IRC/Flood.ap.dr
IRC/Flood.bi.dr IRC/Flood.cd NTServiceLoader
ProcKill PWS-Narod PWS-Sincom.dll
W32/Anig.worm W32/Bagle@MM W32/Blaster.worm (Lovsan)
W32/Bropia.worm W32/Bugbear@MM W32/Deborm.worm.gen
W32/Doomjuice.worm W32/Dumaru W32/Elkern.cav
W32/Fizzer.gen@MM W32/FunLove W32/IRCbot.worm
W32/Klez W32/Korgo.worm W32/Lirva
W32/Lovgate W32/Mimail W32/MoFei.worm
W32/Mumu.b.worm W32/MyDoom W32/Nachi.worm
W32/Netsky W32/Nimda W32/Pate
W32/Polybot W32/Sasser.worm W32/Sdbot.worm.gen
W32/SirCam@MM W32/Sober W32/Sobig
W32/SQLSlammer.worm W32/Swen@MM W32/Yaha@MM
W32/Zafi W32/Zindos.worm W32/Zotob.worm

You can download this tool here: McAfee AVERT Stinger

 

SANS - Internet Storm Center - Cooperative Cyber Threat Monitor And Alert System


 Handler's Diary November 24th 2005

New Version of MYTOB is causing an escalation of Risk Alert

Published: 2005-11-24,
Last Updated: 2005-11-24 17:59:15 UTC by Deborah Hale (Version: 1)

We just received notification that Trend Micro has raised the Alert for the new MYTOB virus to medium.  Trend Micro has an excellent write up at:

Mytob.MX

The worm appears to be memory resident and spreads by sending a copy of itself as an attachment (account-password.zip) in an email message using its own Simple Mail Transfer Protocol (SMTP) engine. It also installs malware which Trend Micro is calling TROJ_MONURL.D. Trend Micro has removal instructions and more information about the malware at the link above.

Use extreme care when opening your email.  Do not open zip files or other attachments that you are not expecting to receive or from suspicios emails.

Thanks to Scooter for notifying us of the Trend Micro Alert elevation.

Harry Waldron posts the following:

  F-Secure and McAfee report several new variants and this list could grow. Batten down the hatches.

F-Secure - 6 new variants
http://www.f-secure.com/v-descs/bagle_eo.shtml
http://www.f-secure.com/v-descs/bagle_ep.shtml
http://www.f-secure.com/v-descs/bagle_eq.shtml
http://www.f-secure.com/v-descs/bagle_er.shtml
http://www.f-secure.com/v-descs/bagle_es.shtml
http://www.f-secure.com/v-descs/bagle_et.shtml

McAfee detection information 
http://vil.nai.com/vil/content/v_137087.htm

Quote: Several new W32/Bagle downloader variants have been widely spammed to users (November 23, 2005). To date, they are detected as W32/Bagle.gen@MM with the 4635 DATs.

These are downloader trojans. However, like previous Bagle variants, it is likely that in the near future, the author(s) will post an accompanying EXE file on a remote server, which SPAMs new versions of Bagle (not to addresses harvested on the local system, but to addresses specified in spam lists also on remote web servers). This trojan was mass-spammed in a ZIP attachment and uses peoples names as the filenames, for example:

* Edmund.zip
* Elizabeth.zip
* Fraunces.zip
* Grace.zip
* Henrie.zip
* Jeames.zip

Thanks to Harry Waldron for catching this, looks like Symantec and Trend Micro has at least one variant as well:

Symantec Security Response - Trojan.Lodear.D

Trend Micro - TROJ_BAGLE.AH

Bagle/Beagle - Several pre-Thanksgiving variants

The Bagle author didn't want to be outdone by the latest Sober variant, so batten down the hatches

F-Secure reports at least 5 new variants
http://www.f-secure.com/weblog/archives/archive-112005.html#00000718


F-Secure - 5 new variants
http://www.f-secure.com/v-descs/bagle_eo.shtml
http://www.f-secure.com/v-descs/bagle_ep.shtml
http://www.f-secure.com/v-descs/bagle_eq.shtml
http://www.f-secure.com/v-descs/bagle_er.shtml
http://www.f-secure.com/v-descs/bagle_es.shtml

McAfee detection information
http://secunia.com/virus_information/23961/bagle.genmm9725/

quote:

Several new W32/Bagle downloader variants have been widely spammed to users (November 23, 2005). To date, they are detected as W32/Bagle.gen@MM with the 4635 DATs.

Symantec has updated their Sober removal tool to cover W32.Sober.X@mm (CME-681)

 November 22, 2005: Version 1.7.1 released to add support for W32.Sober.X@mm.

To date, this tool now covers the following:

 W32.Sober@mm
W32.Sober.B@mm
W32.Sober.C@mm
W32.Sober.D@mm
W32.Sober@mm.enc
W32.Sober.gen
W32.Sober.E@mm
W32.Sober.F@mm
W32.Sober.G@mm
W32.Sober.I@mm
W32.Sober.L@mm
W32.Sober.N@mm
W32.Sober.O@mm
W32.Sober.Q@mm
W32.Sober.V@mm
W32.Sober.W@mm
W32.Sober.X@mm

You can download this tool at the following location: Symantec Security Response - W32.Sober Removal Tool

Symantec has updated their Mytob removal tool to cover a variant that just came out today.

 November 22, 2005: Published version 1.32.0, which supports removal of W32Mytob.MC@mm.

To date, this tool now covers the following:

 

You can get a copy of this tool here: Symantec Security Response - W32.Mytob@mm Removal Tool

Ex-Microsoft worker gets four years for software theft - Computerworld

Ex-Microsoft worker gets four years for software theft
He illegally sold software valued at $7.1M

News Story by Jeremy Kirk

NOVEMBER 22, 2005 (IDG NEWS SERVICE) - A former Microsoft Corp. employee was sentenced to four years in prison for illegally selling the company's software, netting him $2.3 million, court documents show.

Finn W. Contini, who worked for the company from September 1999 to February 2002, pleaded guilty in January to one count of conspiracy to commit mail fraud and four counts of money laundering. During the proceedings at the U.S. District Court in Seattle on Friday, he was also ordered to pay $7.1 million in restitution to Microsoft.

Prosecutors said Contini had access to the Microsoft Internal Product Ordering Program, which allowed employees access to an unlimited amount of software and hardware at no cost for internal use. Contini redirected e-mails that would have alerted his supervisors to the order to two accomplices who also worked for Microsoft, according to the court documents.

Three other former Microsoft employees were sentenced earlier this year for their part in the crime. Robert A. Howdeshell, indicted on the same charges as Contini, was sentenced to two years and three months in jail in August and was ordered to pay $3.3 million in restitution.

Alyson Clark and Christine Hendrickson, both charged with mail fraud, received five-month prison terms plus five months of home confinement.

Contini received at least 2,692 pieces of software valued at $7.1 million. As part of the plea agreement, Contini forfeited four properties, a 2003 Toyota Highlander and a 2002 Honda Civic, along with gold and silver coins, bars and nuggets, according to documents.

More Posts Next page »