RE: Amusing security advice from Microsoft

[Blanchard_Michael () emc com]

are there any snort sigs that will detect this exploit?
 
Michael P. Blanchard 
Antivirus / Security Engineer, CISSP, GCIH, CCSA-NGX, MCSE
Office of Information Security & Risk Management 
EMC ² Corporation 
4400 Computer Dr. 
Westboro, MA 01580 
Office: (508)898-7102      
Cell:     (508)958-2780 
Pager:  (877)552-3945 
email:  Blanchard_Michael () EMC COM 
 

________________________________

From: funsec-bounces () linuxbox org [mailto:funsec-bounces () linuxbox org] On Behalf Of rms () computerbytesman com
Sent: Friday, March 30, 2007 3:00 PM
To: 'FunSec [List]'
Subject: [funsec] Amusing security advice from Microsoft



I found Microsoft's advice pretty amusing for dealing with the new "zero-day" ANI security flaw in Windows:

 

  http://www.microsoft.com/technet/security/advisory/935423.mspx

 

   "As a best practice, users should always exercise extreme caution when opening or viewing 

   unsolicited emails and email attachments from both known and unknown sources."

 

I guess folks on this list should never had read this message in the first place. ;-)  I don't even know what "exercise 
extreme caution" means.  Should we all stop reading email until there is a patch available for the bug?  I guess the 
preview pane is a bad idea also.

 

In addition, the attached Bugtraq message points out that this ANI security hole isn't actually new.

 

Richard

 

Subject:  

0-day ANI vulnerability in Microsoft Windows (CVE-2007-0038)

From:  

"Alexander Sotirov" <asotirov () determina com>

Date:  

Fri, March 30, 2007 1:53 am

To:  

bugtraq () securityfocus com

Cc:  

full-disclosure () lists grok org uk

Priority:  

Normal

Options:  

View Full Header <https://webmail3.pair.com/src/view_header.php?mailbox=INBOX&passed_id=3148&passed_ent_id=0>  | View 
Printable Version 
<https://webmail3.pair.com/src/printer_friendly_bottom.php?passed_ent_id=0&mailbox=INBOX&passed_id=3148&view_unsafe_images=>
  | Add to Addressbook 
<https://webmail3.pair.com/plugins/address_add/add.php?email=asotirov%2540determina.com&nick=asotirov&first=Alexander&last=Sotirov>
 

        

 

 

Today Microsoft released a security advisory about a vulnerability in the
Animated Cursor processing code in Windows:
http://www.microsoft.com/technet/security/advisory/935423.mspx
 
It seems like the vulnerability is already exploited in the wild:
http://asert.arbornetworks.com/2007/03/any-ani-file-could-infect-you/
 
This is one of the vulnerabilities Determina discovered and reported to
Microsoft back in December of last year. It was assigned CVE-2007-0038 and we
published a brief advisory about it today:
http://www.determina.com/security_center/security_advisories/securityadvisory_0day_032907.asp
 
The vulnerability is trivially exploitable on all versions of Windows, including
Vista. The protected mode of IE7 will lessen the impact of the vulnerability,
but shellcode execution is of course still possible. Determina also discovered
that under certain circumstances Mozilla Firefox uses the same underlying
Windows code for processing ANI files, and can be exploited similarly to
Internet Explorer.
 
As noted in Microsoft's security advisory, workarounds for this vulnerability
are limited at this point. I personally recommend browsing the web and reading
mail with telnet until patches are available.
 
Of course, Determina VPS Desktop and Server Edition have been continuously
protecting against this vulnerability even prior to its discovery.
 
 
Alexander Sotirov
Determina Security Research

 

_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.