Hosting Provided By

SecurityFocus Microsoft Newsletter #130

From: John Boletta <jboletta(at)securityfocus.com>
Date: Mon Mar 24 2003 - 14:50:21 EST

This Issue is Sponsored by: SurfControl

Serious Enterprise E-mail and Anti-Spam Protection. SurfControl E-mail Filter for SMTP and Exchange leverages multiple layers of technology to defeat spam, viruses, and confidential data leakage with accuracy.

Get more info and download free 30-day trial: http://www.surfcontrol.com/go/zsfms032403

I. FRONT AND CENTER

IDS Logs in Forensics Investigations: An Analysis of a...
Remote Desktop Management Solution for Microsoft
The Promise and Peril of Palladium
Why the Dogs of Cyberwar Stay Leashed
SecurityFocus DPP Program II. MICROSOFT VULNERABILITY SUMMARY
XChat Server Strings Buffer Overflow Vulnerability
MyAbraCadaWeb Path Disclosure Vulnerability
MyAbraCadaWeb Search Engine Cross-Site Scripting Vulnerability
Protegrity Secure.Data XP_PTY_Insert Buffer Overflow Vulnerability
BitchX Remote Cluster() Heap Corruption Vulnerability
SIPS User Information Disclosure Vulnerability
Samba SMB/CIFS Packet Assembling Buffer Overflow Vulnerability
McAfee ePolicy Orchestrator HTTP GET Request Format String...
McAfee ePolicy Orchestrator Information Disclosure Vulnerability
Microsoft Windows 2000 ntdll.dll Buffer Overflow Vulnerability
Protegrity Secure.Data XP_PTY_CheckUsers Buffer Overflow...
Protegrity Secure.Data XP_PTY_Select Buffer Overflow...
Multiple BitchX Remote Client-Side Buffer Overflow...
BitchX Remote BX_compress_modes() Buffer Overflow Vulnerability
TCPDump Malformed RADIUS Packet Denial Of Service Vulnerability
BitchX Remote Send_CTCP() Memory Corruption Vulnerability
BitchX Remote cannot_join_channel() Buffer Overflow...
Samba REG File Writing Race Condition Vulnerability
Cyber-Cats Chitchat PHP Message Board/Guestbook Password File... III. MICROSOFT FOCUS LIST SUMMARY
Anyone have hard evidence of problems with Windows Automatic...
MS03-007 Round-up (Thread)
Expire accounts from Active Directory after a period of...
write permissions for IIS (Thread)
Microsoft Security Advisory MS 03-007 (Thread)
FW: Microsoft Security Advisory MS 03-007 (Thread)
Article Announcement: Remote Desktop Management Solution for...
Microsoft Security Advisory MS 03-007 - Problems (Thread)
Exchange/MAPI/RPC (Thread)
SecurityFocus Microsoft Newsletter #129 (Thread)
AD replication - IP site to site encryption? (Thread) IV. NEW PRODUCTS FOR MICROSOFT PLATFORMS
F-Secure Anti-Virus for Microsoft Exchange
QualysGuard Intranet Scanner
pcAnywhere
NEW TOOLS FOR MICROSOFT PLATFORMS
NetMap network scanner v0.2.1
East-Tec File Shredder v1.0
yavipin-conf v0.0.1 VI. SPONSOR INFORMATION
FRONT AND CENTER
IDS Logs in Forensics Investigations: An Analysis of a Compromised Honeypot By Alan Neville

This paper will deconstruct the steps taken to conduct a full analysis of a compromised machine. In particular, we will be examining the tool that was used to exploit a dtspcd buffer overflow vulnerability, which allows remote root access to the system. The objective of this paper is to show the value of IDS logs in conducting forensics investigations.

http://www.securityfocus.com/infocus/1676

Do you need help?

2. Remote Desktop Management Solution for Microsoft by Artur Maj

One of the many challenges facing Microsoft administrators is how to manage remote systems in a secure manner? In the world of the UNIX the answer is quite simple: using the SSH protocol is sufficient. Thanks to the SSH, we can manage remote systems not only in the text mode, but we can also run remote X-Window applications by using the protocol tunneling technique. And all of that by using strong cryptography, which protects transmitted data from unauthorized access.

http://www.securityfocus.com/infocus/1677

3. The Promise and Peril of Palladium
By Tim Mullen

Whether Microsoft's ambitious project is a security solution or a Trojan horse depends much on the company's intentions.

http://www.securityfocus.com/columnists/148

4. Why the Dogs of Cyberwar Stay Leashed By Mark Rasch

The United States could try out its much-hyped "cyberwarfare" capabilities in Iraq... but it would probably be illegal.

Do you need more help?

http://www.securityfocus.com/columnists/149

5. SecurityFocus DPP Program

Attention Universities!! Sign-up now for preferred pricing on the only global early-warning system for cyber attacks - SecurityFocus DeepSight Threat Management System.

Click here for more information:
http://www.securityfocus.com/corporate/products/dpsection.shtml

II. BUGTRAQ SUMMARY

XChat Server Strings Buffer Overflow Vulnerability BugTraq ID: 7089 Remote: Yes Date Published: Mar 14 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/7089 Summary:

XChat is a freely available, open source IRC client. It is available for the the Unix, Linux, and Microsoft Windows platforms.

XChat IRC client has been reported vulnerable, under certain circumstances, to a buffer overflow condition.

It has been reported that due to a lack of both, sufficient bounds checking and string termination, two malformed non-terminated server supplied strings may be stored contiguously in a fixed internal memory buffer.

Can we help you?

As a result of this, a malicious IRC server may be used to pass excessive data to the client and overwrite memory adjacent to the deficient buffer. If this memory contains crucial saved program state values the attacker may be able to influence the programs' flow and execute arbitrary code.

Any code successfully executed would be in the context of the user running the vulnerable IRC application.

This vulnerability was reported to affect XChat version 2.0.1 other versions may also be affected.

2. MyAbraCadaWeb Path Disclosure Vulnerability BugTraq ID: 7126
Remote: Yes
Date Published: Mar 17 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7126
Summary:

MyABraCaDaWeb is a web content management system. It is implemented in PHP and available for Unix and Linux variants and Microsoft Windows operating systems.

MyABraCaDaWeb is reported to disclose path information in error messages when handling some invalid requests. This may occur when an invalid administrative ID is requested or in some other cases. The full path to the web root directory will be included in the error output. This information could be useful in further attacks against a system hosting the software.

3. MyAbraCadaWeb Search Engine Cross-Site Scripting Vulnerability BugTraq ID: 7127
Remote: Yes
Date Published: Mar 17 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7127
Summary:

MyABraCaDaWeb is a web content management system. It is implemented in PHP and available for Unix and Linux variants and Microsoft Windows operating systems.

Can't find what you're looking for?

MyABraCaDaWeb provides a facility that allows users to search for keywords. A cross-site scripting vulnerability has been reported in MyABraCaDaWeb's search engine. HTML and script code are not sufficiently sanitized when included in URI parameters of the vulnerable search facility.

This could allow creation of malicious links to the vulnerable script which include hostile HTML and script code. If such a link was visited by a web user, attacker-supplied HTML and script code could be interpreted by the user's browser. This would occur in the security context of the site hosting the software.

4. Protegrity Secure.Data XP_PTY_Insert Buffer Overflow Vulnerability BugTraq ID: 7084
Remote: Yes
Date Published: Mar 13 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7084
Summary:

Secure.Data is library designed to provide enhanced database security functions to Microsoft SQL Server through extended stored procedures. The software is developed and distributed by Protegrity.

A problem with the software may make it possible for a user to gain unauthorized access to a system.

It has been reported that Secure.Data does not properly check input in the xp_pty_insert function. Because of this, an attacker may be able to launch an attack that could result in elevated privileges.

The problem is in a boundary condition error in the xp_pty_insert procedure. This extended stored procedure does not sufficiently check bounds on information passed to it. By passing a string of arbitrary length and shell code to the vulnerable procedure, an attacker could execute code with the privileges of the SQL Server process, typically the user SYSTEM.

This problem has been reported as affecting version 2.2.3.8 and previous.

Don't know where to look next?

5. BitchX Remote Cluster() Heap Corruption Vulnerability BugTraq ID: 7096
Remote: Yes
Date Published: Mar 14 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7096
Summary:

BitchX is a freely available, open source IRC client. It is available for Unix, Linux, and Microsoft operating systems.

BitchX has been reported prone to a heap based memory corruption vulnerability. Reportedly when an excessively long hostname is supplied to the BitchX 'cluster()' function an internal static memory buffer is overflowed.

It has been reported that 1500 bytes of data may be written past the buffer, potentially corrupting sensitive values located in the heap.

Although unconfirmed, due to the nature of heap corruption vulnerabilities, there is a potential that this issue could be exploited to corrupt memory management information. As a result, a hostile IRC server may be capable of executing arbitrary code on a target client.

This vulnerability was reported to affect BitchX 1.0c19 earlier versions may also be affected.

This issue was originally described in BID 7086 "Multiple BitchX Remote Client-Side Buffer Overflow Vulnerabilities" and is now being assigned a separate BID.

6. SIPS User Information Disclosure Vulnerability BugTraq ID: 7134
Remote: Yes
Date Published: Mar 18 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7134
Summary:

Confused? Frustrated?

SIPS is a weblog and link indexing system. It is available for Unix and Linux variants in addition to Microsoft Windows operating systems.

It has been reported that SIPS fails to authenticate users before granting users to user account information. As a result, it may be possible for an attacker to access sensitive data by making a request to a specific location, including the first letter of a username, followed by the full username.

By gaining access to sensitive user account data it may be possible for an attacker to launch further attacks.

It should be noted that this vulnerability was reported in SIPS v0.2.2 however, other versions may also be affected.

7. Samba SMB/CIFS Packet Assembling Buffer Overflow Vulnerability BugTraq ID: 7106
Remote: Yes
Date Published: Mar 15 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7106
Summary:

Samba is a freely available file and printer sharing application maintained and developed by the Samba Development Team. Samba allows file and printer sharing between operating systems on the Unix and Microsoft platforms. The Samba daemon is typically run with super user privileges.

A buffer overflow vulnerability has been reported for Samba. The vulnerability occurs when the smbd service attempts to re-assemble specially crafted SMB/CIFS packets.

An attacker can exploit this vulnerability by creating a specially formatted SMB/CIFS packet and sending it to a vulnerable Samba server. The overflow condition will be triggered when smbd attempts to re-assemble the malformed packet fragments. smbd will overwrite sensitive areas of memory with attacker-supplied values resulting in the execution of malicious code.

Call Pantek today for Open Source Technical Support at 1-877-546-8934 - 24/7/365

This vulnerability is further exacerbated by the fact that the smbd service runs with root privileges.

This vulnerability affects Samba 2.0.0 to 2.2.7a. Additionally, HP CIFS/9000 server versions up to A.01.09.01 on HP-UX 11.0, 11.11(11i), and 11.22 are vulnerable.

8. McAfee ePolicy Orchestrator HTTP GET Request Format String Vulnerability BugTraq ID: 7111
Remote: Yes
Date Published: Mar 17 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7111
Summary:

McAfee ePolicy Orchestrator is a product designed to remotely manage various policies and antivirus products. It is available for the Microsoft Windows operating system.

A format string vulnerability has been discovered in the ePolicy Orchestrator Agent which is designed to distribute log data remotely. Authentication does not occur when connecting to the ePolicy Orchestrator Agent, thus allowing an anonymous attacker to exploit this issue.

The format string bug occurs when processing HTTP GET requests via port 8081. An attacker who makes a malicious request containing format specifiers, such as '%x' or '%n', may be capable of obtaining and writing to sensitive locations in memory.

Successful exploitation of this vulnerability would allow an attacker to execute arbitrary commands with SYSTEM privileges.

It should be noted that this vulnerability has been reported to affect McAfee ePolicy Orchestrator 2.5.1; other versions may also be affected.

Do you need help?

9. McAfee ePolicy Orchestrator Information Disclosure Vulnerability BugTraq ID: 7114
Remote: Yes
Date Published: Mar 17 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7114
Summary:

McAfee ePolicy Orchestrator is a product designed to remotely manage various policies and antivirus products. It is available for the Microsoft Windows operating system.

The McAfee ePolicy Orchestrator Agent listens on port 8081 and is designed to distribute various log data to remote users. It has been discovered that the ePolicy Orchestrator Agent fails to carry out any authentication when distributing logs. As a result, it may be possible for a remote attacker to obtain sensitive information which could be used to launch further attacks.

It should be noted that this vulnerability has been reported to affect McAfee ePolicy Orchestrator 2.5.1; other versions may also be affected.

Microsoft Windows 2000 ntdll.dll Buffer Overflow Vulnerability BugTraq ID: 7116 Remote: Yes Date Published: Mar 17 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/7116 Summary:

The Windows 2000 library ntdll.dll contains a function that does not perform sufficient bounds checking.

When a request is made to WebDAV using the methods PROPFIND, LOCK, SEARCH, or GET with the Translate:f header, the request is in turn passed to a function called GetFileAttributesExW. The GetFileAttributesExW in turn makes a call to the RtlDosPathNameToNtPathName_U function which is exported by ntdll.dll. The problem lies in that RtlDosPathNameToNtPathName_U relies on unsigned shorts for string lengths. This reliance on unsigned shorts is where the vulnerability lies.

Proper bounds checking is not performed on this data, allowing a buffer to be overrun. This could result in the execution of arbitrary code with Local System privileges.

There are other attack vectors that exist other than through GetFileAttributesExW. The following functions also call RtlDosPathNameToNtPathName_U and could also be potential attack vectors:

Do you need more help?

GetShortPathNameW
CopyFileW
MoveFileW
MoveFileExW
ReplaceFileW
CreateMailslotW
GetFileAttributesW
FindFirstFileExW
CreateFileW
GetVolumeInformationW
DeleteFileW
GetDriveTypeW
GetFileAttributesExW
CreateDirectoryW
FindFirstChangeNotificationW
GetBinaryTypeW
CreateNamedPipeW
SetFileAttributesW
MoveFileWithProgressW
GetVolumeNameForVolumeMountPointW
GetDiskFreeSpaceW
CreateDirectoryExW
DefineDosDeviceW
PrivMoveFileIdentityW
GetCompressedFileSizeW
SetVolumeLabelW
CreateHardLinkW
RemoveDirectoryW

**There have been reports that this vulnerability was being actively exploited in the wild for some time before it was discovered and fixed by Microsoft. See the MSNBC link in the References section for more details of systems that were exploited by this vulnerability. It is also important to note that there is a strong possibility that this vulnerability was known to exist for some time prior to March 12th as indicated by the news story.

Protegrity Secure.Data XP_PTY_CheckUsers Buffer Overflow Vulnerability BugTraq ID: 7083 Remote: Yes Date Published: Mar 13 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/7083 Summary:

Secure.Data is library designed to provide enhanced database security functions to Microsoft SQL Server through extended stored procedures. The software is developed and distributed by Protegrity.

A problem with the software may make it possible for a user to gain unauthorized access to a system.

It has been reported that Secure.Data does not properly check input in the xp_pty_checkusers function. Because of this, an attacker may be able to launch an attack that could result in elevated privileges.

The problem is in a boundary condition error in the xp_pty_checkusers procedure. This extended stored procedure does not sufficiently check bounds on information passed to it. By passing a string of arbitrary length and shell code to the vulnerable procedure, an attacker could execute code with the privileges of the SQL Server process, typically the user SYSTEM.

This problem has been reported as affecting version 2.2.3.8 and previous.

Protegrity Secure.Data XP_PTY_Select Buffer Overflow Vulnerability BugTraq ID: 7085 Remote: Yes Date Published: Mar 13 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/7085 Summary:

Secure.Data is a library designed to provide enhanced database security functions to Microsoft SQL Server through extended stored procedures. The software is developed and distributed by Protegrity.

Can we help you?

A problem with the software may make it possible for a user to gain unauthorized access to a system.

It has been reported that Secure.Data does not properly check input in the xp_pty_select function. Because of this, an attacker may be able to launch an attack that could result in elevated privileges.

The problem is in a boundary condition error in the xp_pty_select procedure. This extended stored procedure does not sufficiently check bounds on information passed to it. By passing a string of arbitrary length and shell code to the vulnerable procedure, an attacker could execute code with the privileges of the SQL Server process, typically the user SYSTEM.

This problem has been reported as affecting version 2.2.3.8 and previous.

Multiple BitchX Remote Client-Side Buffer Overflow Vulnerabilities BugTraq ID: 7086 Remote: Yes Date Published: Mar 13 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/7086 Summary:

BitchX is a freely available, open source IRC client. It is available for Unix, Linux, and Microsoft operating systems.

Multiple vulnerabilities have been reported to exist in the BitchX IRC client. The problems occur due to a variety of client-side functions failing to carry out sufficient bounds checking. Specifically, a malicious IRC server may be capable of passing malicious data to an affected BitchX client, which could trigger a number of buffer overrun conditions.

Successful exploitation of these issues may allow a malicious server to execute arbitrary commands on the client system with the privileges of the user running the vulnerable client.

This vulnerability has been reported to affect BitchX 1.0c19. Other versions may also be affected.

The issues in this BID have been assigned individual BugtraqIDs. The new BIDs are 7096, 7097, 7099 and 7100.

Can't find what you're looking for?

This BID will be subsequently retired.

BitchX Remote BX_compress_modes() Buffer Overflow Vulnerability BugTraq ID: 7100 Remote: Yes Date Published: Mar 14 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/7100 Summary:

BitchX is a freely available, open source IRC client. It is available for Unix, Linux, and Microsoft operating systems.

BitchX has been reported prone to a buffer overflow vulnerability.

Reportedly, when the BitchX option 'compress_modes' is activated a potential circumstance for a buffer overflow condition may be created. If an excessive amount of data is supplied to the BitchX 'BX_Compress_modes()' function an internal memory buffer, 'nmodes[16]', will be overflowed. This action may cause adjacent memory to be corrupted with attacker-supplied values.

There is a potential that this issue could be exploited to corrupt crucial program management variables on the stack and thus seize control of program flow. As a result, a hostile IRC server may be capable of executing arbitrary code on a target client.

Any arbitrary code executed would be in the context of the user running the vulnerable software.

This vulnerability was reported to affect BitchX 1.0c19 earlier versions may also be affected.

This issue was originally described in BID 7086 "Multiple BitchX Remote Client-Side Buffer Overflow Vulnerabilities" and is now being assigned a separate BID.

TCPDump Malformed RADIUS Packet Denial Of Service Vulnerability BugTraq ID: 7090 Remote: Yes Date Published: Mar 14 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/7090 Summary:

Don't know where to look next?

tcpdump is a freely available, open source network monitoring tool. It is available for the Unix, Linux, and Microsoft Windows operating systems.

A vulnerability in the processing of some packet types may result in an inability to further use the tcpdump application.

It has been reported that tcpdump is vulnerable to a denial of service when some packet types are received. By sending a maliciously formatted packet to a system using a vulnerable version of tcpdump, it is possible for a remote user to cause tcpdump to ignore network traffic from the time the packet is received until the application is terminated and restarted.

The problem is in the handling of RADIUS packets. When tcpdump receives a maliciously crafted RADIUS packet, the application enters an infinite loop and ceases to further monitor network traffic. This could allow the passing of undetected network traffic that would typically be seen by tcpdump.

BitchX Remote Send_CTCP() Memory Corruption Vulnerability BugTraq ID: 7097 Remote: Yes Date Published: Mar 14 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/7097 Summary:

BitchX is a freely available, open source IRC client. It is available for Unix, Linux, and Microsoft operating systems.

A memory corruption vulnerability has been reported in the send_ctcp() function which is used when handling server-supplied data. The function takes the length of an argument, char *to, and uses it to allocate a buffer on the stack. This occurs by calling the alloca() function with an argument of 512 - (12 + strlen(to)). Delimiter characters are later appended to the buffer returned by alloca().

If a hostile IRC server were to supply a 'to' argument containing a length, -12, which is larger then 512 bytes, it would be possible to supply a negative value as the argument to alloca(). If this were to occur the negative value would be interpreted and a stack address used by a previous frame will be returned. This may allow for delimiter characters and a NULL value to be written to arbitrary stack memory.

Successful exploitation of this issue may allow a malicious server to execute arbitrary commands on the client system with the privileges of the user running the vulnerable client.

Confused? Frustrated?

This vulnerability has been reported to affect BitchX 1.0c19. Other versions may also be affected.

This issue was originally described in BID 7086 "Multiple BitchX Remote Client-Side Buffer Overflow Vulnerabilities" and is now being assigned a separate BID.

BitchX Remote cannot_join_channel() Buffer Overflow Vulnerability BugTraq ID: 7099 Remote: Yes Date Published: Mar 14 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/7099 Summary:

BitchX is a freely available, open source IRC client. It is available for Unix, Linux, and Microsoft operating systems.

A memory corruption vulnerability has been discovered in BitchX 1.0c19. This issue occurs when calling the cannot_join_channel() function. If a channel of excessive length is supplied a buffer overflow could occur which may result in predefined strings being written over sensitive stack memory.

As a result, it may be possible for a malicious IRC server to crash a vulnerable client. Although unconfirmed this vulnerability could potentially be leveraged to execute arbitrary commands within a target client.

This vulnerability has been reported to affect BitchX 1.0c19. Other versions may also be affected.

This issue was originally described in BID 7086 "Multiple BitchX Remote Client-Side Buffer Overflow Vulnerabilities" and is now being assigned a separate BID.

Samba REG File Writing Race Condition Vulnerability BugTraq ID: 7107 Remote: No Date Published: Mar 15 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/7107 Summary:

Call Pantek today for Open Source Technical Support at 1-877-546-8934 - 24/7/365

A race condition vulnerability has been reported for Samba. The vulnerability occurs when Samba attempts to write reg files. However, it may be possible to create a symbolic link in a crucial point of program execution that would result in the overwriting of files pointed to by the link. This will only occur if the files are writeable by the Samba process.

Successful exploitation may cause local files to be corrupted. If files can be corrupted with custom data, this may result in privilege elevation.

Full details of this vulnerability are not currently known. The BID will be updated as further details are disclosed.

This vulnerability is reported to exist for Samba 2.0.0 to 2.2.7a.

Cyber-Cats Chitchat PHP Message Board/Guestbook Password File Viewing Vulnerability BugTraq ID: 7136 Remote: Yes Date Published: Mar 19 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/7136 Summary:

Cyber-Cats Chitchat PHP Message Board/Guestbook permits users to interact and communicate via a virtual community. It is available for Unix, Linux, and Microsoft Operating Systems.

A problem with the software may allow a remote user unauthorized access to the board.

Cyber-Cats Chitchat PHP Message Board/Guestbook does not sufficiently limit access to files on the local system. Because of this, an attacker could potentially gain access to sensitive files.

The problem is in the limiting of access to the password file. User names and passwords for the board are stored in the $guest_board_directory/files/passwd.txt file. An attacker could gain access to this file and launch a brute force attack against the encrypted password hashes contained in the file, gaining unauthorized access to user accounts.

Do you need help?

20. Microsoft Windows PostMessage API Unmasked Password Weakness BugTraq ID: 7092
Remote: No
Date Published: Mar 13 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7092
Summary:

A weakness has been reported in the Microsoft Windows PostMessage API which could effectively allow unmasked passwords to be copied into a user's clipboard or other buffer.

PostMessage places a message in the message queue but does not sufficiently check the message type. EM_SETPASSWORDCHAR messages set the password mask character in password edit box controls. PostMessage may be abused in combination with EM_SETPASSWORDCHAR messages to cause an unmasked password to be placed into a buffer which could potentially be accessed through other means by an unauthorized process.

Exploitation would require a malicious local process to wait for an authentication prompt to be sent to a local user by another application. The attacker would then have to authenticate normally. The unmasked password can be copied while this is occurring.

>From this point, a further attack would be required to steal password
credentials.

This weakness occurs because the PostMessage API may be used in combination with EM_SETPASSWORDCHAR messages. This may occur from another process that does not belong to the process thread.

It is possible that this weakness could be incorporated into a trojan horse or backdoor. Malicious local users could also potentially exploit this to steal authentication credentials from other users.

III. MICROSOFT FOCUS LIST SUMMARY

Anyone have hard evidence of problems with Windows Automatic Updates? (Thread) Relevant URL:

Do you need more help?

http://online.securityfocus.com/archive/88/315790

2. MS03-007 Round-up (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/315792

3. Expire accounts from Active Directory after a period of inactivity (Thread) Relevant URL:

http://online.securityfocus.com/archive/88/315791

4. write permissions for IIS (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/315789

5. Microsoft Security Advisory MS 03-007 (Thread) Relevant URL:

Can we help you?

http://online.securityfocus.com/archive/88/315621

6. FW: Microsoft Security Advisory MS 03-007 (Thread) Relevant URL:

http://online.securityfocus.com/archive/88/315628

7. Article Announcement: Remote Desktop Management Solution for Microsoft (Thread) Relevant URL:

http://online.securityfocus.com/archive/88/315462

8. Microsoft Security Advisory MS 03-007 - Problems (Thread) Relevant URL:

http://online.securityfocus.com/archive/88/315452

9. Exchange/MAPI/RPC (Thread)
Relevant URL:

Can't find what you're looking for?

http://online.securityfocus.com/archive/88/315376

SecurityFocus Microsoft Newsletter #129 (Thread) Relevant URL:

http://online.securityfocus.com/archive/88/315312

AD replication - IP site to site encryption? (Thread) Relevant URL:

http://online.securityfocus.com/archive/88/315307

IV. NEW PRODUCTS FOR MICROSOFT PLATFORMS

F-Secure Anti-Virus for Microsoft Exchange by F-Secure Corporation Platforms: Windows 2000, Windows NT Relevant URL: http://www.f-secure.com/products/anti-virus/ms-exchange/ Summary:

F-Secure Anti-Virus for Microsoft Exchange protects Microsoft Exchange users from viruses, worms and Trojans, scanning both incoming and outgoing messages. The product scans not only e-mail attachments, but it also stops viruses in documents and notes posted to public folders. With F-Secure Anti-Virus for Microsoft Exchange, antivirus protection is transparent and always on as the scanning is done on the e-mail server in real-time.

2. QualysGuard Intranet Scanner
by Qualys
Platforms: N/A
Relevant URL:
http://www.qualys.com/?page=services/intranet/overview Summary:

With QualysGuard Intranet Scanner, Qualys also protects enterprises when the threat comes from within the internal network. QualysGuard Intranet Scanner is the first network appliance that provides security audits and vulnerability management inside the firewall. Combined with QualysGuard, the Intranet Scanner provides network administrators with an integrated, centralized service for managing both internal and external network vulnerabilities.

3. pcAnywhere
by Symantec
Platforms: Windows 2000, Windows 95/98, Windows NT, Windows XP Relevant URL:
http://www.symantec.com/pcanywhere/Consumer/ Summary:

Don't know where to look next?

pcAnywhere is the world's leading remote control software. With powerful encryption and authentication, it gives you peace of mind that your remote sessions will be secure. Speed up performance with the new optimization wizard. You can also use pcAnywhere with cable and DSL modems for faster remote control sessions. Now it's even faster and easier to navigate directories on both machines when you're transferring files. Use the AutoTransfer function to upload or download multiple files automatically. Whether you need to support servers, customers, or friends, choose award-winning pcAnywhere, the world's best-selling remote control solution.

V. NEW TOOLS FOR MICROSOFT PLATFORMS

NetMap network scanner v0.2.1 by Joshua Corbin Relevant URL: http://members.jdweb.com/~jcorbin/netmap/ Platforms: Perl (any system supporting perl) Summary:

NetMap is a network scanner written in Perl/GTK. It is not just another nmap frontend. It is a modularized network prober/scanner that just happens to have an nmap module. Incidentally, NetMap has nothing to do with the network weather mapper.

2. East-Tec File Shredder v1.0
by EAST Technologies
Relevant URL:
http://www.east-tec.com/erprod/etfshred/index.htm Platforms: Windows 2000, Windows 95/98, Windows NT, Windows XP Summary:

East-Tec File Shredder securely destroys (shreds) sensitive and private files beyond recovery. Simply drag & drop files to the shredder icon on your desktop, or select the files you want to destroy directly from the Windows Explorer right-click menu. The files will be gone for good.

3. yavipin-conf v0.0.1
by Hisham Mardam Bey
Relevant URL:
http://hisham.cc/files/apps/yavipin/
Platforms: N/A
Summary:

yavipin-conf is a multiple client/server configuration utility for yavipin. It provides a parser, example configuration files, and a startup script which allows the user to start/stop/restart a VPN at any point. In syntax, the configuration is similar to that of vtun.

VI. SPONSOR INFORMATION

This Issue is Sponsored by: SurfControl

Confused? Frustrated?

Get more info and download free 30-day trial: http://www.surfcontrol.com/go/zsfms032403

Received on Mon Mar 24 16:01:07 2003

This message: [ Message body ]
Next message: John Boletta: "SecurityFocus Microsoft Newsletter #131"
Previous message: John Boletta: "SecurityFocus Microsoft Newsletter #129"

Contemporary messages sorted: [ By Date ] [ By Thread ] [ By Subject ] [ By Author ] [ By messages with attachments ]

This archive was generated by hypermail 2.1.8 : Wed Aug 23 2006 - 14:02:28 EDT