New Security Challenge - It Happened One Friday

Published: 2008-03-25
Last Updated: 2008-03-25 13:06:43 UTC
by Raul Siles (Version: 1)
0 comment(s)

Hi ISC readers and  challenge fans! A new security challenge has been posted by my good friend Ed Skoudis and Matt Carpenter at Ethical Hacker dot Net. This time Ed and Matt try to test your security skills with a whole bunch of Unix/Linux commands and related logs. You can access the challenge here. Answers are due by Sunday April 20, 2008.

BTW, did you notice the Matrix look and feel? :) Personally, I had lot of fun with Ed's challenges in the past, so I encourage you to participate. Even if you think it focuses on an OS you don't have lot of knowledge about, or it is too advanced or complex, try it just to check what you can reach. Do it for the prize (an autographed book), for fun, or just to improve your skills, but... try it!
--
Raul Siles
www.raulsiles.com

Keywords: challenge
0 comment(s)

Microsoft Jet Database Engine Advisory Update (950627)

Published: 2008-03-25
Last Updated: 2008-03-25 00:41:39 UTC
by Raul Siles (Version: 1)
0 comment(s)

Last Friday we announced the recent security advisory released by Microsoft about a vulnerability in the Microsoft Jet Database Engine (aka MDB files) that can be exploited through Microsoft Word. A few minutes ago Microsoft has posted more details about this issue on the MSRC blog. Summarizing:

  • The Jet Database Engine vulnerability is well-known since March 2005. The main issue now is that it can be exploited through a new attack vector, Microsoft Word (specifically two DOC files), avoiding the mitigations enforced by Outlook and Exchange over this unsafe file type (MDB).
  •  Microsoft is currently working on the fixes, evaluating if an update may prevent Word from opening MDB files, and checking how to apply the fixed msjet40.dll currently available for Windows Server 2003 SP2, Windows Vista, and beta versions of Windows XP SP3 in other OS versions.
  •  In the meantime, apart from the general recommendation of not opening untrusted MS Word files, you can follow the two workarrounds detailed on the initial advisory:
    • Computer-based workarround: Restrict the Microsoft Jet Database Engine from running through the "cacls" command, used to modify the access control lists (ACLs) of files. Applications requiring the Jet Database Engine will not function.
    • Infrastructure-based workarround: Block specific files at your mail gateway based on string signatures (if it provides file inspection capabilities). The associated strings plus implementation details for specifc mail gateways are detailed on the advisory.

Future updates on the MSRC blog.

--
Raul Siles
www.raulsiles.com

 

Keywords: jet mdb microsoft
0 comment(s)

Comments

cwqwqwq
eweew<a href="https://www.seocheckin.com/edu-sites-list/">mashood</a>
WQwqwqwq[url=https://www.seocheckin.com/edu-sites-list/]mashood[/url]
dwqqqwqwq mashood
[https://isc.sans.edu/diary.html](https://isc.sans.edu/diary.html)
[https://isc.sans.edu/diary.html | https://isc.sans.edu/diary.html]
What's this all about ..?
password reveal .
<a hreaf="https://technolytical.com/">the social network</a> is described as follows because they respect your privacy and keep your data secure:

<a hreaf="https://technolytical.com/">the social network</a> is described as follows because they respect your privacy and keep your data secure. The social networks are not interested in collecting data about you. They don't care about what you're doing, or what you like. They don't want to know who you talk to, or where you go.

<a hreaf="https://technolytical.com/">the social network</a> is not interested in collecting data about you. They don't care about what you're doing, or what you like. They don't want to know who you talk to, or where you go. The social networks only collect the minimum amount of information required for the service that they provide. Your personal information is kept private, and is never shared with other companies without your permission
https://thehomestore.com.pk/

Diary Archives