JD @ myITforum.com

Dont they do that to everyone?

Rod posted about an old couple that was being taken advantage of by a service technician at an auto place. Every time I have been into one of these places, they always try to add on things that “according to the manufacture“, need to be replaced. That doesn’t bother so much as the data collection. Most oil change places today, write down the VIN number and license plate number on your car. The also write down any damage to the vehicle. They can then sell that information to places like car facts. In fact, it is very hard to find a place that will change your oil anonymously. I know its probably my paranoia showing up again, but I don’t want spyware installed at my auto repair shop.

On a flipside to your story Rod, I have a story that I share about a “little old lady”. I once decided to lay out in the sun at a public pool. I found a nice lounge chair by the pool. It was a sunny day, and the only other people that were at the pool, were several older ladies that were in the shallow end of the pool. They had full body bathing suits on, that reminded me of my loving grandma. I could hear their conversation, and one of the ladies asked the other, where she got the new sun glasses. The lady wearing the sun glasses giggled, and then replied “I stole them”. She then proceeded to tell a story of how she went to a gathering, and a young girl was wearing them, but then set them down. The old lady said that she put them on, and then pretended that they were hers and that she told the young girl that she must be mistaken when she inquired about the glasses.

I couldn’t believe this little old lady, whom reminded me of my grandma, would do such a thing and then brag to her friends. I had the same pit in my stomach, when I found out Santa Claus wasn’t real.

I remember the days...

Tonight I wanted to show my love a pretty funny email I received. I was booting my laptop, while complaining that it was slow. I didnt hear any sound while it was booting, so I hit the volume up button. This all happened in a matter of seconds and my chimpin was probably unjustified, but she promptly asked if I hit the “Turbo” button. I about rolled on to the floor, and yes laughing my ___ off. I cant say that I have even thought about the “Turbo” button in many years. Where did the “Turbo” button go? Why does my laptop not have one?

New vulnerabilities for all antivirus vendors?

Can they just post one advisory for all vendors? In no particular order, here are the affected vendors so far:

Symantec

Kaspersky

AVG

Avast!

Ahnlab

McAfee

I should have known

I wanted to create an app that would send a Wake on Lan Magic packet to an SMS collection. After a few attempts at writing a script to do this, I decided to check the myITforum Downloads section. Lo and behold, there were several already created. I should have known better to check there first. I want to thank everyone that contributes. If I ever come up with something that has not already been created, then I will contribute as well.

Dripping with sarcasm....

Begin sarcasm

I have a great idea. Let’s Start a Business! Let’s hire some world class expert programmers to discover vulnerabilities in Microsoft products. We will then create a product of our own to detect and fix the vulnerabilities. We could also sell the vulnerabilities to hackers so that Microsoft’s customers have to rely on our product to keep them safe. Actually, that may raise too many eyebrows. Oh, I got it now; let’s post information on our website stating that vulnerabilities exist and our product will fix it. Then we can wait for Microsoft to provide a fix and update our website with a description showing the exact vulnerability. That will allow the hackers to exploit it before administrators can apply the patches. Brilliant! That will show those administrators, if they used our product, they would have been protected. Man, I am good! We could also post information showing how long it takes Microsoft to fix the problem. This would let everyone know that we can provide protection much sooner than Microsoft. Man I haven’t seen an idea this good since that guy came up with the idea to film bums fighting. Who’s with me? We can make some mad cash.

End sarcasm

Potential threats that may follow the October updates

Just as many folks have been doing, I have been reading through the updates. I suspect that we may have a repeat of the August updates where we see an exploit very quickly for MS05-047 which replaces MS05-039. The August updates were released on 9AUG05 and I posted about Zotob.A utilizing this exploit on 14AUG05. I also see the potential for MS05-049 to be exploited by sending .lnk files via spamming or a mass mailer. I predicted this on the previously released bulletins, and as far as I know, I was wrong. A mass mailer using this exploit never happened. It would appear that MS05-051 may be cause for the most worry as it replaces some very well known security updates such as MS03-026 which was exploited by the infamous Blaster worm. SANS is reporting that MS05-052 only sets the kill bit for the affected Class Identifiers (CLSID) in these COM objects.

In brief it is going to be a long week for somefolks. As Harry Waldron would say, “test, test, test, patch, patch, patch”

Microsoft Security Updates 11OCT05

Vulnerabilities for CA, F-Secure, and Kaspersky

Computer Associates

Information regarding Computer Associates iGateway Debug Mode HTTP GET Request Buffer Overflow can be found here.

There is no fix at this time, and the vendor recommends that iGateway should not be run in debug mode.

F-Secure Anti-Virus for Linux

Information regarding the F-Secure Anti-Virus for Linux CHM File Parsing Buffer Overflow can be found here.

The vulnerability is caused due to a boundary error in the Kaspersky Anti-Virus (KAV) scan engine used by the product. The KAV scan engine has reportedly been fixed via a signature update after July 2005.

Kaspersky Anti-Virus

Information regarding the Kaspersky Anti-Virus Engine CHM File Parsing Buffer Overflow can be found here. The vulnerability has reportedly been fixed via a signature update after July 2005.

It could be me....

Common Malware Enumeration Initiative Now Available

Common Malware Enumeration Initiative Now Available

http://www.mitre.org/news/releases/05/cme_10_05_2005.html

FOR IMMEDIATE RELEASE:

MITRE Contacts:
Francis McLoughlin
(781) 271-2810

Jennifer Shearman
(781) 271-3430

Bedford, Massachusetts, October 5, 2005 —The MITRE Corporation is pleased to announce the availability of the Common Malware Enumeration (CME) initiative and its supporting website (http://cme.mitre.org). CME, which is headed by the United States Computer Emergency Readiness Team (US-CERT) and supported by an editorial board of anti-virus vendors and related organizations provides a neutral, shared identification method for malware outbreaks.

The CME initiative assigns a numerical identifier to a particular threat, providing the public with a common method for cross-referencing disparate virus names. In so doing, the CME initiative seeks to:

• Reduce the public's confusion in referencing threats during malware incidents
• Enhance communication between anti-virus vendors
• Improve communication and information sharing between anti-virus vendors and the rest of the information security community

During a virus outbreak, participants on the CME board request an identifier from an automated system by providing a sample of the virus and as much additional information as possible. An identifier in the format 'CME-N' where N is an integer between 1 and 999 is generated and distributed to the other participants. The participants then disseminate the CME identifier to their contacts in the industry and reference the CME identifier on their web pages, in their product, or when speaking to the press.

In addition to MITRE, participants on the CME editorial board include McAfee, Symantec, Trend Micro, Microsoft, Sophos, ICSA Labs, Norman, Kaspersky Lab, MessageLabs, F-Secure, and Computer Associates.

Use of the CME identifier is completely voluntary, but it is hoped that the public will encourage anti-virus vendors to adopt CME identifiers. CME is similar to the Common Vulnerabilities and Exposures (CVE) initiative, which is also operated by MITRE in support of US-CERT. Experience with CVE shows that by adopting a neutral, shared identification method, effective information sharing can happen faster and with more accuracy.

For answers to frequently asked questions, please visit the CME website at http://cme.mitre.org/news/press_qa.html.

Moderately critical Symantec scan engine buffer overflow

A vulnerability has been reported in Symantec AntiVirus Scan Engine, which can be exploited by malicious people to cause a DoS (Denial of Service) or compromise a vulnerable system.

Information on this moderate vulnerability and patch information can be found in the following locations:

http://secunia.com/advisories/17049/

http://www.idefense.com/application/poi/display?id=314&type=vulnerabilities&flashstatus=true