http://www.bleedingthreats.net/index.php/2007/03/30/ms-ani-exploit-rule-details-emerging/
________________________________ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED] Sent: Friday, March 30, 2007 3:17 PM To: [EMAIL PROTECTED]; [email protected] Subject: RE: [funsec] Amusing security advice from Microsoft are there any snort sigs that will detect this exploit? Michael P. Blanchard Antivirus / Security Engineer, CISSP, GCIH, CCSA-NGX, MCSE Office of Information Security & Risk Management EMC ² Corporation 4400 Computer Dr. Westboro, MA 01580 Office: (508)898-7102 Cell: (508)958-2780 Pager: (877)552-3945 email: [EMAIL PROTECTED] ________________________________ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED] Sent: Friday, March 30, 2007 3:00 PM To: 'FunSec [List]' Subject: [funsec] Amusing security advice from Microsoft I found Microsoft's advice pretty amusing for dealing with the new "zero-day" ANI security flaw in Windows: http://www.microsoft.com/technet/security/advisory/935423.mspx "As a best practice, users should always exercise extreme caution when opening or viewing unsolicited emails and email attachments from both known and unknown sources." I guess folks on this list should never had read this message in the first place. ;-) I don't even know what "exercise extreme caution" means. Should we all stop reading email until there is a patch available for the bug? I guess the preview pane is a bad idea also. In addition, the attached Bugtraq message points out that this ANI security hole isn't actually new. Richard Subject: 0-day ANI vulnerability in Microsoft Windows (CVE-2007-0038) From: "Alexander Sotirov" <[EMAIL PROTECTED]> Date: Fri, March 30, 2007 1:53 am To: [email protected] Cc: [email protected] Priority: Normal Options: View Full Header <https://webmail3.pair.com/src/view_header.php?mailbox=INBOX&passed_id=3148&passed_ent_id=0> | View Printable Version <https://webmail3.pair.com/src/printer_friendly_bottom.php?passed_ent_id=0&mailbox=INBOX&passed_id=3148&view_unsafe_images=> | Add to Addressbook <https://webmail3.pair.com/plugins/address_add/add.php?email=asotirov%2540determina.com&nick=asotirov&first=Alexander&last=Sotirov> Today Microsoft released a security advisory about a vulnerability in the Animated Cursor processing code in Windows: http://www.microsoft.com/technet/security/advisory/935423.mspx It seems like the vulnerability is already exploited in the wild: http://asert.arbornetworks.com/2007/03/any-ani-file-could-infect-you/ This is one of the vulnerabilities Determina discovered and reported to Microsoft back in December of last year. It was assigned CVE-2007-0038 and we published a brief advisory about it today: http://www.determina.com/security_center/security_advisories/securityadvisory_0day_032907.asp The vulnerability is trivially exploitable on all versions of Windows, including Vista. The protected mode of IE7 will lessen the impact of the vulnerability, but shellcode execution is of course still possible. Determina also discovered that under certain circumstances Mozilla Firefox uses the same underlying Windows code for processing ANI files, and can be exploited similarly to Internet Explorer. As noted in Microsoft's security advisory, workarounds for this vulnerability are limited at this point. I personally recommend browsing the web and reading mail with telnet until patches are available. Of course, Determina VPS Desktop and Server Edition have been continuously protecting against this vulnerability even prior to its discovery. Alexander Sotirov Determina Security Research
_______________________________________________ Fun and Misc security discussion for OT posts. https://linuxbox.org/cgi-bin/mailman/listinfo/funsec Note: funsec is a public and open mailing list.
