SourceForge.net: watobo

SourceForge.net: watobo

Microsoft Windows Picture and Fax Viewer Library

 Taken from http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=890

I. BACKGROUND

The Windows Picture and Fax Viewer "shimgvw.dll" library is used by Windows Explorer to generate thumbnail previews for media files.

II. DESCRIPTION

Remote exploitation of a buffer overflow vulnerability in multiple versions of Microsoft Corp.'s Windows could allow attackers to execute arbitrary code on the targeted host.

An integer overflow vulnerability exists in the "shimgvw" library. During the processing of an image within a certain function, a bitmap containing a large "biWidth" value can be used to cause an integer calculation overflow. This condition can lead to the overflow of a heap buffer and may result in the execute arbitrary code on the targeted host.

III. ANALYSIS

Exploitation could allow attackers to execute arbitrary code on the targeted host under the privileges of the current logged-on user. Successful exploitation would require the attacker to entice his or her victim into viewing a specially-crafted thumbnail leveraging the vulnerability.

Some vectors of attack include e-mail, the browser and network shares. In an e-mail-based attack, the attacker must entice his or her victim into opening or previewing a specially-crafted Office document containing a specially-crafted thumbnail. In a browser-based attack, the victim must simply view a maliciously crafted website. In a network share attack, such as UNC or WebDAV, an attacker would require the victim to simply navigate to the folder containing the crafted thumbnail.

IV. DETECTION

iDefense has confirmed the existence of this vulnerability in Microsoft Windows XP SP3. A full list of vulnerable Microsoft products can be found in Microsoft Security Bulletin MS11-006.

V. WORKAROUND

Microsoft has included an automated Microsoft Fix it solution for the Modify the Access Control List (ACL) on shimgvw.dll workaround, which can be found at the following link:

http://support.microsoft.com/kb/2483185

VI. VENDOR RESPONSE

Microsoft Corp. has released patches which address this issue. Information about downloadable vendor updates can be found by clicking on the URLs shown.

http://www.microsoft.com/technet/security/bulletin/ms11-006.mspx

VII. CVE INFORMATION

The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2010-3970 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org/), which standardizes names for security problems.

VIII. DISCLOSURE TIMELINE

01/12/2011 Initial Vendor Notification
01/12/2011 Initial Vendor Reply
02/08/2011 Coordinated Public Disclosure

IX. CREDIT

This vulnerability was reported to iDefense by Kobi Pariente and Yaniv Miron.

Get paid for vulnerability research
http://labs.idefense.com/methodology/vulnerability/vcp.php

Free tools, research and upcoming events
http://labs.idefense.com/

X. LEGAL NOTICES

Copyright � 2011 iDefense, Inc.

Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without the express written consent of iDefense. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please e-mail customer service for permission.

Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.

http://magazine.hackinthebox.org/index.html

Issue #5 is now available!

A very Happy New Year and a warm welcome to Issue 05 - The first HITB Magazine release for 2011

http://magazine.hackinthebox.org/index.html

Preventing Layer 7 DDoS Attacks

Preventing Layer 7 DDoS Attacks

VAST Live Distro beta 2.77

VAST is a VIPER Lab live distribution that contains VIPER developed tools such as UCsniff, videojak, videosnarf and more. Along with VIPER tools and other essential VoIP security tools, it also contains tools penetration testers utilize such as Metasploit, Nmap, and Hydra.This distribution is a work in progress. If you would like to see a tool or package included please feel free to suggest them and I will do what I can to make it happen. VAST also has built into synaptic package manager a third party repository link for the VIPER tools, so when we update a tool it's as easy as "apt-get".VAST beta 2.74 has been released with UCSniff 3.0 which includes GUI interface, VoIP video realtime monitoring, TFTP MitM modification of IP phone features, Gratuitous ARP disablement bypass support, and support for several compression codecs. The new VAST also has a new look as well.


http://vipervast.sourceforge.net/

Researchers turn USB cable into attack tool

Two researchers have figured out a way to attack laptops and smartphones through an innocent-looking USB cable.

Angelos Stavrou, an assistant professor of computer science at George Mason University, and student Zhaohui Wang wrote software that changes the functionality of the USB driver so that they could launch a surreptitious attack while someone is charging a smartphone or syncing data between a smartphone and a computer.

Basically, the exploit works by adding keyboard or mouse functionality to the connection so an attacker can then start typing commands or click the mouse in order to steal files, download additional malware, or do other things to take control of the computer, Stavrou told CNET in an interview. The exploit is enabled because the USB protocol can be used to connect any device to a computing platform without authentication, he said.

He and his partner were scheduled to demonstrate an attack at the Black Hat DC conference today.

The exploit software they wrote identifies what operating sysetm is running on the device the USB cable is connected to. On Macintosh and Windows machines, a message pops up saying the system has detected a new human interface device, but there is no easily recognizable way to halt the process, Stavrou said. The Mac pop-up can be quickly removed by an attacker with a command sent via the smartphone so the laptop owner may not even see it, while the Windows pop-up lasts only one or two seconds in the lower left corner, making that an ineffective warning too, he said.

Linux machines offer no warning, so users will have no idea that something out of the ordinary is happening, particularly since the regular keyboard and mouse continue to function normally during an attack, Stavrou said.

"The operating system should present a pop-up and ask if the user really wants to connect the device" and specify what type of device is being identified to the system, he said.

The researchers wrote the exploit for Android devices only at this point. "It can be done for iPhone, but we didn't do it yet," Stavrou said. "It can work on any computing device that uses USB," and it can work between two smartphones by connecting a USB cable between then, he said.

"Say your computer at home is compromised and you compromise your Android phone by connecting them," he said. "Then, whenever you connect the smartphone to another laptop or computing device I can take over that computer also, and then compromise other computers off that Android. It's a viral type of compromise using the USB cable."

The original compromise can happen by downloading the exploit from the Web or running an app that is compromised. The researchers have created exploit software to run on a computer, and an exploit to run on Android that is a modification of the Android operating system kernel. Scripts can then be written for the actual attack.

Antivirus software wouldn't necessarily stop this because it can't tell that the activities of the exploit are not controlled or sanctioned by the user, Stavrou said. "It's hard to separate good behavior from bad behavior when it comes from the keyboard," he said.

There's not much a person can do to protect against this at this time, according to Stavrou. The operating systems should have the capability for devices to inspect USB traffic and alert users about what exactly is happening over the connection and give them the option of refusing an action, he said.

Read more: http://news.cnet.com/8301-27080_3-20028919-245.html#ixzz1BeJL6c6x

SAP Management Console Information Disclosure

It has been detected that many of the available methods in the sapstartsrv SOAP server do not require user authentication, allowing remote and
unauthenticated users to obtain sensitive information from the SAP system, such as the list of log files and their content, profile parameters,
developer traces, etc.

Furthermore, some of the unauthenticated methods perform security sensitive operations that may impact over the integrity, confidentiality and/or
availability of the SAP system.

Technical details about this issue are not disclosed at this moment with the purpose of providing enough time to affected customers to patch their
systems and protect against the exploitation of the described vulnerability.

- - Original Advisory: http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2011-002