Topic: New remote-code vulnerability found in Windows and many other apps

[Samker]

Microsoft Windows and about 40 applications that run on it are vulnerable to remote-code execution attacks that are "trivial" to carry out, a noted security researcher warned Wednesday.

The flaw involves the way Windows loads "safe" file types from remote network locations, and is almost identical to one that Apple excised in iTunes last week: http://support.apple.com/kb/HT4105 , H D Moore, CSO and chief architect of the Metasploit project, told The Register. He said the bug is “trivial” to remotely exploit, but wasn't authorized to provide additional details about techniques or other vulnerable applications.

According to a more detailed advisory  for the iTunes fix, the “binary planting” vulnerability allowed attackers to execute malicious code on Windows machines by getting the media player to open a file located on the same network share as a maliciously designed DLL file.

“All a remote attacker has to do is plant a malicious DLL with a specific name on a network share and get the user to open a media file from this network location in iTunes – which should require minimal social engineering,” the advisory, which was written by ACROS Security, stated: http://www.acrossecurity.com/

“Since Windows systems by default have the Web Client service running – which makes remote network shares accessible via WebDAV – the malicious DLL can also be deployed from an Internet-based network share as long as the intermediate firewalls allow outbound HTTP traffic to the Internet.”

Microsoft said in a statement it is investigating the report.

Moore said users can protect themselves against attacks by blocking outbound SMB connections on ports 445 and 139 and on WebDAV. That will stop attacks that originate over the internet, but users may still be susceptible to LAN-based attacks where an attacker has planted malicious DLLs on a network share. In that respect, it's similar to workaround advice given for the Windows shortcut flaw that Microsoft patched earlier this month.

(ElReg)

[Samker]

Microsoft confirms code-execution bug in Windows apps

Microsoft on Monday warned of a vulnerability in Windows applications made by third-party developers that allows remote attackers to execute malicious code on end-user PCs.

The company's security team is still investigating whether any Microsoft programs are susceptible to the so-called binary planting or DLL preloading attacks. Until patches are available, it said admins should run a new software tool that changes the way Windows loads application library files or disable several networking features to blunt attempts to exploit the flaw.

“Loading dynamic libraries is basic behavior for Windows and other operating systems, and the design of some applications require the ability to load libraries from the current working directory,” members of the Microsoft Security Response Center wrote here. “Hence, this issue cannot directly be addressed in Windows without breaking expected functionality. Instead, it requires developers to ensure they code secure library loads”: http://blogs.technet.com/b/srd/archive/2010/08/23/more-information-about-dll-preloading-remote-attack-vector.aspx

The advisory confirmed previous reports that the attacks exploit a weakness in the way programs load associated libraries. The corresponding binary files can be located in a variety of directories, including those on networks controlled by a malicious hacker.

The attack works because many applications ignore best security practices and search for the library based only on the file name, rather than the full directory path, the advisory said. When the current working directory is set to one controlled by the attacker, it's possible to cause load a malicious file.

The advisory didn't say how many applications are vulnerable. In an interview last week, Mitja Kolsek, CEO of application security firm Acros Security, said his company has identified about 200 Windows susceptible programs and warned there could be more.

H D Moore, CSO and chief architect of the Metasploit project, has said at least one component of Windows is also vulnerable.

Microsoft's advisory repeated Moore's previous guidance that admins disable WebDAV and block outgoing SMB connections on ports 445 and 139. Redmond has also released a software tool that changes the way Windows searches for DLL files. Different versions of Windows requires a specific versions of the tools. Download locations are here: http://support.microsoft.com/kb/2264107

Microsoft has additional details here: http://www.microsoft.com/technet/security/advisory/2269637.mspx and here: http://blogs.technet.com/b/msrc/archive/2010/08/21/microsoft-security-advisory-2269637-released.aspx


(ElReg)

[AllSecurityUp]

Good one Samker.

I think one of the takeaways from this is the iTunes.Apple products are regarded as relatively safe but users still need to have good security and vigilance.

I sometimes fear that complacency is a breeding ground for attacks.