June 2005 - Posts
If you're using the popular phpBB bulletin board package, it's time to upgrade. Version 2.0.16, released earlier this week, fixes a critical security issue that can lead to the compromise of the vulnerable web server. The problem is with the viewtopic.php script, which, according to the FrSIRT advisory, fails to properly validate input when processing the "highlight" parameter. A similar vulnerability was being exploited by the Santy worm to deface web sites about half a year ago, as we reported in the December 21, 2004 diary. Please update your copy of phpBB to help prevent another such worm from gaining steam.
For information about the phpBB 2.0.16 release, see the phpBB Group announcement. You can get the updated package from their downloads page.
The FrSIRT published new exploit for MS05-017 vulnerability. The MS05-017 is vulnerability in Message Queuing, the remote attacker can execute command from remote. It's time to patch and filter some unnecessary port.
The Veritas Backup utility suites offer advanced functionality and some of security controls associated with remote control functionality have been compromised. This includes a new in-the-wild exploit and administrators should review trusted Firewall port settings and move to the latest versions of the software as noted in the advisories below.
QUOTE: We received some reports about spikes on port 10000. The main reason for that is the release of the exploit for Veritas, and used by the Metasploit Framework. ... It seems this exploit is crashing the service listening on port 10000. If sysadmins know they have backup exec installed and they scan the system they will see port 6101 and 10000 normally. After the exploit it will show only the port 6101 still listening."
Veritas Security Bulletins
Veritas Backup Exec/NetBackup Request Packet Denial Of Service Vulnerability
Veritas Backup Exec Server Remote Registry Access Vulnerability
Veritas Backup Exec Remote Agent Null Pointer Dereference Denial Of Service Vulnerability
Veritas Backup Exec Remote Agent for Windows Servers Authentication Buffer Overflow Vulnerability
Veritas Backup Exec Admin Plus Pack Option Remote Heap Overflow Vulnerability
VERITAS Backup Exec Web Administration Console Remote Buffer Overflow Vulnerability
FrSirt - Veritas Backup Exec Agent "CONNECT_CLIENT_AUTH" Request Exploit
I've attended two past Tech Ed conferences and they provide highly focused technical training opportunties. Microsoft shares a number of post-conference links and publications as noted below:
Manuals for Hands on Labs & Instructor Led Labs
Continuing Your Education
Hopefully, most companies and individuals are up-to-date on Microsoft security patches. This new exploit has just been developed from the MS05-030 security bulletin published in June. It could be adapted for use in future computer viruses and worms.
MS05-030: Microsoft Outlook Express NNTP Buffer Overflow Exploit
MS05-030: Cumulative Security Update in Outlook Express (897715)
Hopefully, most companies and individuals are up-to-date on Microsoft security patches. This new exploit has just been developed from the MS05-011 security bulletin published in February. It could be adapted for use in future computer viruses and worms.
MS05-011 - Exploit Code to attack SMB vulnerabilities published
QUOTE: FrSIRT has published exploit code for the recent flaw in Microsoft Server Message Block (SMB). The advisory and patch related to this vulnerability were released on February 8th, 2005. If you still have not patched, you are further urged to do so in light of the release of exploit code.
FfSIRT - Published exploit (be care as POC code is here)
The June 2005 TechNet security newletter featured the following security planning guides:
Review the Latest Microsoft Server Security Guides
Microsoft's Security Guidance Center
Home Security Protection
Get the information you need to protect your home PC. This site puts valuable tips, tools, and training at your fingertips.
Learn about Computer Security At Home
Security for IT Professionals
Find the tools, training, and updates you need to assist with planning and managing a security strategy for your organization.
Find answers in the TechNet Security Center
Small Business Security Protection
Access important resources for updating software, setting up a firewall, and backing up data in a small business environment.
Visit the Small Business Security Guidance Center
Designing and Developing Secure Applications
Learn how to write more secure code with these developer-focused articles, tools, and security resources.
Get Security Guidance for Developers
If you go to the test page, please make sure no critical applications are open and test cautiously:
Secunia Browser - Dialog Origin Vulnerability Test
Click Here: Microsoft resources to prepare for SQL-Server 2005
quote: Microsoft Learning Resources
Whether you are interested in database administration, database development, or business intelligence, you will find classroom training, books, free skills assessments, and free* e-learning to help you get up to speed on the newest features of the software. The online assessments help you analyze your current skills, and provide you with a learning plan that recommends books, e-learning, classroom training, TechNet and MSDN resources. Our E-Learning courses are an effective way to learn on your own schedule and feature hands-on virtual labs that provide an in-depth, online training experience.
Accompanying the Opera 8.01 release for Windows and Linux is the final version of Opera 8 for Macintosh. Read the press release.
To download Opera 8 visit http://www.opera.com/download/
View the changelog.
Sharing a quick update on latest discoveries. The primary cause of this exposure is improper storage and use of confidential information on their servers, followed by hackers discovering this due to weak security controls.
1. A new phishing attack
has been launched to capitalize on this http://www.theregister.co.uk/2005/06/20/mastercard_phishing/
|From: Master Bank [email@example.com] To: Subject: **Your Mastercard online Confirmation** Dear User, During our regular update and verification of the accounts, we couldn't verify your current information. Either your information has changed or it is incomplete. If the account information is not updated to current information within 5 days then, your access will be restricted. |
2. According to reports, 68,000 MasterCard cardholders have already found fraudulent charges on their accounts.
3. The head of a credit card processing company whose Tucson center was hit by computer hackers says compromised consumer records shouldn't even have been in the data base. Under rules established by Visa and MasterCard, processors aren't supposed to retain cardholder information after handling transactions.
4. CardSystems Solutions C-E-O John Perry tells The New York Times the data was being stored for "research purposes" to determine why some transactions registered as unauthorized or uncompleted.
5. He says that the records known to have been stolen covered roughly 200-thousand of the 40 (m) million compromised credit card accounts. They include Visa, Mastercard and other companies.
All new versions of the Bagle/Beagle worm are important to watch as they are technically advanced and disguised well to trick users into opening attachments (use of zip extension).
Beagle.BT - (aka Bagle worm) New Variant
Beagle.BT - new version of Bagle worm
W32.Beagle.BT@mm is a mass-mailing worm that uses its own SMTP engine to send out copies of a Trojan.Tooso variant. The worm also opens a back door on the compromised computer on TCP port 80.
Message: "The password is" or "Password:"
Attachment: ZIP ... Multiple Zip files may contain copies of the virus, plus an executable copy of the Trojan.Tooso.
Please check your statements carefully during the next few billing cycles as hackers recently obtained key information related to Master Card accounts.
Google News Links
Business Week Article
Information Week Article
* As many as 40 million cards may have been exposed, making it the largest breach of personal financial data in a string of recent cases.
* The breach occurred at Card Systems Solutions, Inc., a third-party processor of payment card data who processes transactions on behalf of financial institutions and merchants.
* CardSystems has already taken steps to improve the security of its system, MasterCard said it was giving the company "a limited amount of time" to demonstrate compliance with MasterCard security requirements.
More Posts Next page »