TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to [EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems! ----------------------------------------------------------------------------
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 INTERNET RISK UPDATE for 06-24-2002 ISS X-Force Internet Threat Intelligence Center www.iss.net - Click on the AlertCon logo for more information. ******************************************** ALERTCON 3 Projected: AlertCon 3 ******************************************** ALERTCON 3 - We are at AlertCon 3 to bring attention to the Apache vulnerability. VULNERABILITIES: Apache Remote Compromise: X-Force has verified that this issue is exploitable on Apache HTTP Server for Windows (Win32) version 1.3.24 as well as Apache HTTP Server version 1.3.24 for OpenBSD. It has been reported that exploit code has been developed for the following operating systems and platforms: Sun Solaris 6-8 (sparc/x86); FreeBSD 4.3-4.5 (x86); OpenBSD 2.6-3.1 (x86); and Linux (GNU) 2.4 (x86). These vulnerabilities may lead to modified Web content, denial of service, or further compromise. Apache accounts for over 63% of all active Web sites. Microsoft Corporation has released Microsoft Security Bulletin MS02-031, " Cumulative Patches for Excel and Word for Windows." According to a 19 June Microsoft Security Bulletin, four newly discovered vulnerabilities each could enable an attacker to run macro code on a user's machine. The attacker's macro code could take any actions on the system that the user was able to. Microsoft has made a patch available to close the vulnerabilities. The vulnerabilities include the following: An Excel macro execution vulnerability related to how inline macros that are associated with objects are handled could enable macros to execute and bypass the Macro Security Model. An Excel macro execution vulnerability relates to how macros are handled in workbooks are opened via a hyperlink on a drawing shape. It is possible for macros in a workbook so invoked to run automatically. An HTML script execution vulnerability that can occur when an Excel workbook with an XSL Stylesheet that contains HTML scripting is opened. The script within the XSL Stylesheet could be run in the local computer zone. A new variant of the "Word Mail Merge" vulnerability previously addressed by a Microsoft alert could enable an attacker's macro code to run automatically if the user had Microsoft Access present on the system and chose to open a mail merge document that had been saved in HTML format. VIRUSES/WORMS: WORM_DOTOR.A - This mass-mailing worm arrives as the attachment, DOCTOR.EXE, to an email message. It sends an email message with the following format to all addresses listed in the infected user's contact list: Subject: NewTool for Word Macro Virus Message Body: This tool allows you to protect you against unknown macro virus. Click on the attached file to run this freeware. Best Regards. Have a nice day. Attachment: DOCTOR.EXE ******************************************** RECOMMENDATIONS ******************************************** Apache: The X-Force has released an advisory with patching instructions for the default setting of the Apache HTTP Server. This advisory requires immediate action on behalf of all system users with Apache HTTP Server. See Apache for additional details. http://bvlive01.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=2052 4 The NIPC issued an updated advisory to highlight the significance of the Apache vulnerability that can be viewed at: http://www.nipc.gov/warnings/advisories/2002/02-005.1.htm Additional information on the Microsoft Bulletin and a patch to fix vulnerability can be viewed at: <http://microsoft.com/technet/treeview/default.asp?url=/technet/securi ty/bulletin/MS02-031.asp> For a list of current vulnerabilities, please see: https://gtoc.iss.net/vulnerabilities.php For information on the current Virus/Worm of the day, please refer to: <http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_ DOTOR.A> Information regarding other viruses and worms please see: https://gtoc.iss.net/viruses.php ******************************************** FACTOID: Microsoft Corp., the world's largest software maker, is developing a computer- security system that will allow users to control and protect their information, Newsweek reported, citing company executives. Intel Corp. and Advanced Micro Devices Inc. have agreed to produce the special chips for the system, known as "Palladium". Palladium, expected to ship with the next version of the Windows operating system, is named after a Greek statue that protected the city of Troy. It is crafted to block hackers and viruses while allowing users to control information even after it leaves their computers, Newsweek said. ******************************************** ATTACK SIGNATURE RANKING - global IDS, midnight - midnight, previous Day, % of total ******************************************** Protocol Decode 44.83% Unauthorized Access Attempt 37.29% Suspicious Activity 08.85% Denial Of Service 04.64% Pre-Attack Probe 04.38% ******************************************** TOP ATTACK DESTINATION PORTS - global IDS, midnight - midnight, previous day, % of top ports (ports found at) http://www.neohapsis.com/neolabs/neo-ports/neo-ports.html ******************************************** 80 (http) 80.24% 161 (SNMP) 04.35% 25 (smtp) 03.97% 69 (tftp) 03.74% 162 (SNMPTrap) 02.67% 21 (ftp) 01.95% 22 (ssh) 01.20% 139 (NetBIOS) 00.91% 111 (sunrpc) 00.50% 53 (DNS) 00.45% ******************************************** BACKGROUND, COPYRIGHT NOTICE, and DISCLAIMER ******************************************** Background. We provide this information in the spirit of PDD 63 to help security professionals wage the war against Internet threats more effectively. Information in this update derived primarily from global, real time, 24 x 7 IDS feeds, ISS X-Force R&D Team research, and professional liaison. Other sources as noted. AlertCon 1 reflects the global, malicious, determined, 24 x 7 attacks experienced by all networks. AlertCon 2 means increased vigilance/action recommended due to a specific threat or concern. AlertCon 3 means increased attacks against specific targets or vulnerabilities on a scale that is unusually high, action required. AlertCon 4 reflects an Internet emergency for a target or group of targets whose business continuity may depend on some sort of immediate, decisive action. All summaries cover 24 hours the previous workday, GMT. Monday summaries may cover some weekend activity. Copyright 2002 Internet Security Systems, Inc. Permission is granted for the redistribution of the Internet Risk electronically. It is not to be sold or edited in any way without express consent of ISS. Refer comments or questions to: [EMAIL PROTECTED] or [EMAIL PROTECTED] Disclaimer: This information is subject to change without notice. Use of this information constitutes acceptance for use in an 'as is' condition. There are no warranties with regard to this information. In no event shall the author be liable for any damages whatsoever arising out of or in connection with the use or spread of this information. Any use of this information is at the user's own risk. No other use authorized. FOIA Exemption 4. Patrick Gray Manager, X-Force Internet Threat Intelligence Center Internet | Security | Systems The Power to Protect www.iss.net -----BEGIN PGP SIGNATURE----- Version: PGP 7.1.1 iQA/AwUBPRce35G41ROSQPncEQKsTACfb79z6B7gw4dNOU+2zEzEV2EATyQAn1MI rLHrWR2xudAUgE6rKtNbOsOr =DyH4 -----END PGP SIGNATURE-----
