Chris Mosby at myITforum.com

********************************************************************

Title: Microsoft Security Bulletin Major Revisions

Issued: April 29, 2009

********************************************************************

Summary

=======

The following bulletins have undergone a major revision increment.

Please see the appropriate bulletin for more details.

* MS09-012 - Important

* MS08-076 - Important

* MS08-069 - Critical

Bulletin Information:

=====================

* MS09-012 - Important

- http://www.microsoft.com/technet/security/bulletin/ms09-012.mspx

- Reason for Revision: V2.0 (April 29, 2009): Added an entry to the section, Frequently Asked Questions (FAQ) Related to This Security Update to communicate the rerelease of the Norwegian-language update for Microsoft Windows 2000 Service

Pack 4 (KB952004). Customers who require the Norwegian-language update need to download and install the

rereleased update. No other updates or locales are affected by this rerelease.

- Originally posted: April 14, 2009

- Updated: April 29, 2009

- Bulletin Severity Rating: Important

- Version: 2.0

* MS08-076 - Important

- http://www.microsoft.com/technet/security/bulletin/ms08-076.mspx

- Reason for Revision: V4.0 (April 29, 2009): Added Windows Media Services 2008 (KB952068) on 32-bit and x64-based editions of Windows Server 2008 Service Pack 2 as affected software.  Also, added Windows Server 2008 for Itanium-based Systems Service Pack 2 as non-affected software. This is a detection change only; there were no changes to the binaries. Customers who have already successfully installed KB952068 do not need to reinstall.

- Originally posted: December 9, 2008

- Updated: April 29, 2009

- Bulletin Severity Rating: Important

- Version: 4.0

* MS08-069 - Critical

- http://www.microsoft.com/technet/security/bulletin/ms08-069.mspx

- Reason for Revision: V2.0 (April 29, 2009): Added Microsoft XML Core Services 4.0 (KB954430) on 32-bit and x64-based editions of Windows Vista Service Pack 2 and on 32-bit, x64-based, and Itanium-based editions of Windows Server 2008 Service Pack 2 as affected software. Also added as non-affected software:  Microsoft XML Core Services 3.0 and Microsoft XML Core Services 6.0 on 32-bit and x64-based editions of Windows Vista Service Pack 2 and on 32-bit, x64-based, and

Itanium-based editions of Windows Server 2008 Service Pack 2.  This is a detection change only; there were no changes to the binaries. Customers who have already successfully installed KB954430 do not need to reinstall.

- Originally posted: November 11, 2008

- Updated: April 29, 2009

- Bulletin Severity Rating: Critical

- Version: 2.0

********************************************************************

Title: Microsoft Security Bulletin Minor Revisions

Issued: April 29, 2009

********************************************************************

Summary

=======

The following bulletins have undergone a minor revision increment.

Please see the appropriate bulletin for more details.

  * MS09-013 - Critical

Bulletin Information:

=====================

* MS09-013 - Critical

  - http://www.microsoft.com/technet/security/bulletin/ms09-013.mspx

  - Reason for Revision: V1.1 (April 29, 2009): Added entry to the section, Frequently Asked Questions (FAQ) Related to This

    Security Update, to communicate that the Known issues with this security update section in the associated Microsoft

    Knowledge Base Article 960803 has been updated. This is an informational change only. 

  - Originally posted: April 14, 2009

  - Updated: April 29, 2009

  - Bulletin Severity Rating: Critical

  - Version: 1.1

********************************************************************

Title: Microsoft Security Advisory Notification

Issued: April 29, 2009

********************************************************************

Security Advisories Updated or Released Today ==============================================

* Microsoft Security Advisory (960715)

- Title: Update Rollup for ActiveX Kill Bits

- http://www.microsoft.com/technet/security/advisory/960715.mspx

- Revision Note: V1.1 (April 29, 2009): Added an entry to

Frequently Asked Questions to communicate that users with

Windows Server 2008 Server Core installation do not need to

install this update

Microsoft is turning off Auto-Run!

Published: 2009-04-29,
Last Updated: 2009-04-29 16:44:34 UTC
by Joel Esler (Version: 2)

2 comment(s) acebook witter

Well, kinda.

Yesterday morning Microsoft through their MSRC announced that they were going to further protection of Windows customers by disabling the Auto-Run "feature" in Windows for everything *except* optical media.  (Because CD-ROM's can't be written to, according to them.  I see nothing about CD-R and CD-RW specifically.)

I feel this is a good idea.  There have always been virus/malware that liked to attach itself to things like thumbdrives and removable media like diskettes.  (Does anyone use those anymore? ;)  All the Windows environments that I've ever functioned in my whole career have always had Auto-Run disabled, so this is just good security practice by now.

For more details check out Microsoft's articles on the subject here and here.

Thanks to the reader who wrote in about this.

Update:  Had a reader write in asking how to disable Auto-Run on <Win 7 machines.  I "Googled" it (I haven't done this in years) and found this:

http://features.engadget.com/2004/06/29/how-to-tuesday-disable-autorun-on-windows/

Happy regedit'ing

-- Joel Esler | http://www.joelesler.net | http://twitter.com/joelesler

Two Adobe 0-day vulnerabilities

Published: 2009-04-29,
Last Updated: 2009-04-29 03:22:48 UTC
by Jason Lam (Version: 1)

0 comment(s) acebook witter

There are two 0-day vulnerabilities on Adobe Acrobat announced today, all current versions are vulnerable. One exploits the annotation function and the other exploits the custom Dictionary function. Both of these buffer overflow vulnerabilities exist in the Javascript system of the Adobe Acrobat and can be mitigated by disabling Javascript on Adobe Acrobat.

Since the exploits for these vulnerabilities on Linux platform are posted to the Internet, we can just guess that someone will somehow make it work on Windows and use it to spread botnet agents shortly.

http://blogs.adobe.com/psirt/2009/04/update_on_adobe_reader_issue.html

Keywords: adobe acrobat 0day

0 comment(s) acebook witter

Did you check your conference goodies?

Published: 2009-04-24,
Last Updated: 2009-04-24 19:26:48 UTC
by Pedro Bueno (Version: 1)

1 comment(s) acebook witter

This year I went to the RSA to have lunch with some friends.

It was nice to get together with some other SANS ISC friends too, as Johannes, Marc and Lenny.

Good to see them again. Also while visiting the expo, something occurred to me. Some booths were giving away pen-drives with promotional material. It is easy to imagine that the booth was always crowded.

So, to get your pen drive you just put your business card and pick your pendrive among several over the table and go away...cool...

I don’t like people scanning my badge or using my business card to send me offers later, so , previously, I went to some other booths, collected a bunch of business card from sales people (they love to give them away...:) ) and went to the 'pen-drive booth' to get mine...:)

If I have a malicious intent, I would go to some other place, plug my new pen-drive, load an autorun-kind of malware, or fill it wth malicious PDFs and return it to the crowded booth table full of pen-drives...And I would be able to do it several times...

An average user would get it, plug in his computer and happily install it and be p0wned…

So, did you test your goodies on a safe environment, preferable on a non autorun-able machine, like a mac or linux? Also did you use your AV to scan those PDFs against exploits? :)

Be safe, be paranoid…:)

-----------------------------------------------------------------

Pedro Bueno ( pbueno // isc. sans. org)

http://twitter.com/besecure

Google Chrome "ChromeHTML" URI Handler Vulnerability

SECUNIA ADVISORY ID:

SA34900

VERIFY ADVISORY:

http://secunia.com/advisories/34900/

DESCRIPTION:

A vulnerability has been reported in Google Chrome, which can be exploited by malicious people to disclose certain system information and conduct cross-site scripting attacks.

The vulnerability is caused due to the improper handling of "ChromeHTML" URIs, which can be exploited to enumerate local files and folders or execute arbitrary HTML and script code in a user's browser session in context of arbitrary websites by tricking the user into clicking a specially crafted link in Internet Explorer.

Successful exploitation requires that Google Chrome is not running and that a victim follows a malicious link in Internet Explorer.

The vulnerability is reported in version 1.0.154.55 and prior.

SOLUTION:

Update to version 1.0.154.59.

PROVIDED AND/OR DISCOVERED BY:

Roi Saltzman, IBM Rational Application Security Research Group

ORIGINAL ADVISORY:

http://code.google.com/p/chromium/issues/detail?id=9860

http://googlechromereleases.blogspot.com/2009/04/stable-update-security-fix.html

----------------------------------------------------------------------

About:

This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.

Subscribe:

http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)

http://secunia.com/advisories/about_secunia_advisories/

Possible MS09-013 activity

Published: 2009-04-23,
Last Updated: 2009-04-23 21:34:10 UTC
by Kyle Haugsness (Version: 1)

0 comment(s) acebook witter

Jack sends us notice that Symantec is alerting on possible MS09-013 activity.  This information is coming from the Symantec ThreatCon Network Activity Spotlight.  Basically, their network monitoring systems are seeing an increase in activity that could be a precursor to an MS09-013 attack, but it could also be old vulnerabilities from 2002 (both Apache and IIS).  Consider it a reminder to get the recent Microsoft patchset deployed.

Keywords: MS09013

0 comment(s) acebook witter

Some trendmicro.com services down

Published: 2009-04-23,
Last Updated: 2009-04-23 23:03:42 UTC
by Kyle Haugsness (Version: 1)

0 comment(s) acebook witter

A couple of people have reported that TrendMicro is having network issues and the following site has been down many hours today:  http://esupport.trendmicro.com