Blog Moved to http://blog.sharpesecurity.com

This blog has moved to http://blog.sharpesecurity.com. Please update your links and RSS feeds accordingly.


email: david @ sharpesecurity.com
website: www.sharpesecurity.com
Twitter: twitter.com/sharpesecurity

SAP BusinessObjects Security Patch Released

SAP has released a security patch for certain versions of SAP BusinessObjects for the Axis2 component. According to the US-CERT write-up:

... anyone with access to the Axis2 port can gain full access to the machine via arbitrary remote code execution. This requires the attacker to upload a malicious web service and to restart the instance of Tomcat. This issue may apply to other products and vendors that embed the Axis2 component. The username is "admin" and the password is "axis2", this is also the default for standalone Axis2 installations.

For further details please refer to the links below. An exploit is currently available for this.


References:
http://www.kb.cert.org/vuls/id/989719
http://spl0it.org/files/talks/source_barcelona10/Hacking%20SAP%20BusinessObjects.pdf?bcsi_scan_896CC636179ADAAE=0&bcsi_scan_filename=Hacking%20SAP%20BusinessObjects.pdf
https://websmp230.sap-ag.de/sap/support/notes/1432881 (requires login)


email: david @ sharpesecurity.com
website: www.sharpesecurity.com
Twitter: twitter.com/sharpesecurity

BlackBerry Attachment Service PDF Distiller Remote Buffer Overflow Vulnerability

RIM has published a bulletin announcing a possible remotely exploitable issue with their Blackberry Attachment Service PDF Distiller. There is no known publicly available exploit code at this time (as of 13 Oct 2010).


References:
http://www.blackberry.com/btsc/search.do?cmd=displayKC&docType=kc&externalId=KB24547#


email: david @ sharpesecurity.com
website: www.sharpesecurity.com
Twitter: twitter.com/sharpesecurity

Oracle October 2010 Patches Released

Oracle has released its October 2010 set of patch. There are 85 total security fixes. 29 of those are for Java.

Several of these fixes address remotely exploitable vulnerabilities. For details please refer to the links below.


References:
http://www.oracle.com/technetwork/topics/security/javacpuoct2010-176258.html (for Java-related patches)
http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html



email: david @ sharpesecurity.com
website: www.sharpesecurity.com
Twitter: twitter.com/sharpesecurity

New Adobe Reader 9.4 and 8.2.5 Versions Released

Adobe has released versions 9.4 and 8.2.5 of their Acrobat and Reader products. These versions contain fixes for several vulnerabilities - one of which is being actively exploited in the wild.


References:
http://www.adobe.com/support/security/bulletins/apsb10-21.html


email: david @ sharpesecurity.com
website: www.sharpesecurity.com
Twitter: twitter.com/sharpesecurity

Hex-Rays Version 1.4 x86 and ARM Decompilers Released

Hex-Rays has released version 1.4 of their x86 and ARM decompilers. The major update is that the decompilers can now be used on the Linux and Apple Mac OS X platforms now. See the link below for a list of all of the fixes and updates.

References:
http://www.hex-rays.com/news1.shtml#101001


email: david @ sharpesecurity.com
website: www.sharpesecurity.com
Twitter: twitter.com/sharpesecurity

IDA Pro 6.0 Released

Hex-Rays has released IDA Pro 6.0. The major change is that the GUI for MS Windows, Linux, and Mac OS X are all the same now (Qt framework-based). A complete list of fixes and updates is at the link below.

References:
http://www.hex-rays.com/idapro/60/index.html


email: david @ sharpesecurity.com
website: www.sharpesecurity.com
Twitter: twitter.com/sharpesecurity

ISC BIND 9.7.x DoS and Security Bypass Vulnerability

Certain downlevel versions of ISC BIND 9.7 have both a security bypass vulnerability and a denial of service vulnerability. ISC Bind versions 9.7.2 and 9.7.2-P1 are vulnerable. ISC Bind 9.7.2-P2 is not.


References:
http://www.kb.cert.org/vuls/id/784855
https://lists.isc.org/pipermail/bind-announce/2010-September/000655.html
http://ftp.isc.org/isc/bind9/9.7.2-P2/RELEASE-NOTES-BIND-9.7.2-P2.html


email: david @ sharpesecurity.com
website: www.sharpesecurity.com
Twitter: twitter.com/sharpesecurity

Cisco Announces Several Vulnerabilities

Cisco has released details on several vulnerabilites today. Details are in the link below. Exploits exists for at least one of these despite the fact that the announcement below says that there are no known exploits.


References:
http://www.cisco.com/warp/public/707/cisco-sa-20100922-igmp.shtml
http://www.cisco.com/warp/public/707/cisco-sa-20100922-sip.shtml
http://www.cisco.com/warp/public/707/cisco-sa-20100922-sslvpn.shtml
http://www.cisco.com/warp/public/707/cisco-sa-20100922-nat.shtml
http://www.cisco.com/warp/public/707/cisco-sa-20100922-h323.shtml
http://www.cisco.com/en/US/products/products_security_advisory09186a0080b4a313.shtml



email: david @ sharpesecurity.com
website: www.sharpesecurity.com
Twitter: twitter.com/sharpesecurity

MANDIANT Memoryze 1.4.2900 Released

Jamie Butler and friends at MANDIANT have released Memoryze 1.4.2900. This new version supports Windows 7 32- and 64-bit and Windows Server 2008 64-bit. Despite how well the Volatility Framework works with Windows XP, I am fairly certain it has now been firmly relegated to third place behind HBGary Responder and MANDIANT Memoryze in the Windows RAM dump analysis space.


References:
http://blog.mandiant.com/archives/1459


email: david @ sharpesecurity.com
website: www.sharpesecurity.com
Twitter: twitter.com/sharpesecurity

Adobe Flash Player 10.1.85.3 Released

Adobe has released versions 10.1.85.3 of their Flash player product for Windows, Apple Mac, Solaris, and Linux. This new version contains a security-related update that addresses a vulnerability that is being actively exploited in the wild.

References:
http://www.adobe.com/support/security/bulletins/apsb10-22.html


email: david @ sharpesecurity.com
website: www.sharpesecurity.com
Twitter: twitter.com/sharpesecurity

Google Chrome 6.0.472.62 Released

Google Chrome 6.0.472.62 has been released for Windows, Mac, and Linux. The update includes fixes for 3 vulnerabilities, all 3 of which are classified as high or critical.


References:
http://sites.google.com/a/chromium.org/dev/Home/chromium-security
http://www.google.com/chrome/index.html?hl=en&brand=CHMA&utm_campaign=en&utm_source=en-ha-na-us-bk&utm_medium=ha



email: david @ sharpesecurity.com
website: www.sharpesecurity.com
Twitter: twitter.com/sharpesecurity

Samba 3.5.5 Released - Contains Important Security Fix

Samba 3.5.5 has been released. This release contains an important security fix for a remotely exploitable buffer overrun issue. Details are in the links below.


References:
http://www.samba.org/samba/history/security.html
http://www.samba.org/samba/history/samba-3.5.5.html
http://www.samba.org/


email: david @ sharpesecurity.com
website: www.sharpesecurity.com
Twitter: twitter.com/sharpesecurity

IBM DB2 9.7 Fixpack 3 Released

IBM has released IBM DB2 9.7 Fixpack 3. This contains a number of important security-related fixes. For more detail, please refer to the links below.


References:
http://www-01.ibm.com/support/docview.wss?uid=swg1IC68015

http://www-01.ibm.com/support/docview.wss?uid=swg1IC70406

http://www-01.ibm.com/support/docview.wss?uid=swg21446455



email: david @ sharpesecurity.com
website: www.sharpesecurity.com
Twitter: twitter.com/sharpesecurity

Apple Quicktime Player 7.6.8 Released

Apple has released version 7.6.8 of their Quicktime Player for Windows. This version contains security fixes as described in the first link below, including a fix to address the remotely exploitable "_Marshaled_pUnk" vulnerability (for which publicly available exploit code exists).

References:
http://support.apple.com/kb/HT4339


email: david @ sharpesecurity.com
website: www.sharpesecurity.com
Twitter: twitter.com/sharpesecurity

Google Chrome 6.0.472.59 Released

Google Chrome 6.0.472.59 has been released for Windows, Mac, and Linux. The update includes fixes for 10 vulnerabilities, 6 of which are classified as critical.


References:
http://sites.google.com/a/chromium.org/dev/Home/chromium-security
http://www.google.com/chrome/index.html?hl=en&brand=CHMA&utm_campaign=en&utm_source=en-ha-na-us-bk&utm_medium=ha



email: david @ sharpesecurity.com
website: www.sharpesecurity.com
Twitter: twitter.com/sharpesecurity

New Vulns Used by Stuxnet Patched in Microsoft's Sept 2010 Patches

According to this article by Symantec, it looks like the top countries affected Stuxnet (by infection count) were Iran and some of its closest neighbors geographically. To me, it looks like an intelligence service lost a couple of arrows out of its quiver here. Microsoft is closing one of the vulnerabilites used by Stuxnet in the September 2010 Microsoft monthly patches.

The smart money is on the U.S. or Israel, but I guess the public storyline will never tell us for sure. Nation-state intelligence services cannot wait for a time of war to penetrate and exploit the infrastructure of potential enemies. That type of offensive penetration and espionage activity happens all the time. Like some others, the U.S. is very good at cyber offense and computer network exploitation. It very well could have been us that lost a couple privately held vulns this time around.



References:
http://www.symantec.com/connect/blogs/w32stuxnet-network-information
http://krebsonsecurity.com/2010/09/stuxnet-worm-far-more-sophisticated-than-previously-thought/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+KrebsOnSecurity+%28Krebs+on+Security%29


email: david @ sharpesecurity.com
website: http://www.sharpesecurity.com/
Twitter: twitter.com/sharpesecurity

Recent VBmania Mass Mailer Malware Deleted the Windows Automatic Updates Service

It looks like the recent VBmania ("Here You Have" and "Just for You") mass mailer malware deleted the Automatic Updates service from infected machines. Microsoft Automatic Updates, WSUS, and SCCM-integrated WSUS need the Automatic Updates service working to successfully install monthly Microsoft patches and other updates.

It looks like reinstalling the Automatic Updates service fixes the damage on affected machines.  Your antivirus tool won't restore this broken configuration for you.  You will need to do that as a follow up activity after the initial infections have been removed.

A quick way to tell if a machine lost its Automatic Updates service is to run services.msc (Start --> Run --> services.msc --> hit enter).  On a clean and healthy Windows XP machine, you should see an entry like what is circled in red below. 

Below is the disassembly of a portion of the relevant code from the most common variant of the malware referencing the "wuauserv" service name in preparation for disabling that service.  The malware deletes the wuauserv service entirely.   Click the image for a more legible view of the disassembly.

We have prepared a completely silent software deployment package to deploy out through your normal software deployment tool to fix Automatic Updates service instances broken by the VBmania/MM mass mailer worm. A normal reinstallation doesn't work due to the way the malware broke the service.  This fixer package takes care of repairing that damage for you.  This package will work through SCCM, Tivoli, Marimba, CA DSM, ZENworks, or any other software deployment system you might have. You can also PSexec it out silently as required.  Given the serious nature of this problem, we are offering our fixer package for the low price of $50 USD - and that includes whatever follow up email-based support you need for cleanup and to answer any questions you might have about the data and access credential leakage vector this malware has.  As always that is backed by our 100% money back satisfaction guarantee.  Please contact us at sales@sharpesecurity.com if you need any assistance cleaning up after, or if you need help determining if any sensitive data or access credentials leaked during this outbreak.


email: david @ sharpesecurity.com
website: http://www.sharpesecurity.com/
Twitter: twitter.com/sharpesecurity

Cisco Patches Vulns for Several Wireless LAN Controllers

Cisco lists the following devices as all being affected by at least one of the vulnerabilities. These devices are commonly found in enterprise environments, so it is likely you need to take action if you are a Cisco shop.

Cisco 2000 Series WLCs
Cisco 2100 Series WLCs
Cisco 4100 Series WLCs
Cisco 4400 Series WLCs
Cisco 5500 Series WLCs
Cisco Wireless Services Modules (WiSMs)
Cisco WLC Modules for Integrated Services Routers (ISRs)
Cisco Catalyst 3750G Integrated WLCs


References:
http://cisco.com/warp/public/707/cisco-sa-20100908-wlc.shtml


email: david @ sharpesecurity.com
website: www.sharpesecurity.com
Twitter: twitter.com/sharpesecurity

Apple iOS 4.1 Released for iPhone and iPod Touch

Apple has released iOS version 4.1. This version includes several security fixes (see link below) alongside many feature updates.


References:
http://support.apple.com/kb/HT4334



email: david @ sharpesecurity.com
website: www.sharpesecurity.com
Twitter: twitter.com/sharpesecurity