New Security Challenge - It Happened One Friday
Hi ISC readers and challenge fans! A new security challenge has been posted by my good friend Ed Skoudis and Matt Carpenter at Ethical Hacker dot Net. This time Ed and Matt try to test your security skills with a whole bunch of Unix/Linux commands and related logs. You can access the challenge here. Answers are due by Sunday April 20, 2008.
BTW, did you notice the Matrix look and feel? :) Personally, I had lot of fun with Ed's challenges in the past, so I encourage you to participate. Even if you think it focuses on an OS you don't have lot of knowledge about, or it is too advanced or complex, try it just to check what you can reach. Do it for the prize (an autographed book), for fun, or just to improve your skills, but... try it!
--
Raul Siles
www.raulsiles.com
Microsoft Jet Database Engine Advisory Update (950627)
Last Friday we announced the recent security advisory released by Microsoft about a vulnerability in the Microsoft Jet Database Engine (aka MDB files) that can be exploited through Microsoft Word. A few minutes ago Microsoft has posted more details about this issue on the MSRC blog. Summarizing:
- The Jet Database Engine vulnerability is well-known since March 2005. The main issue now is that it can be exploited through a new attack vector, Microsoft Word (specifically two DOC files), avoiding the mitigations enforced by Outlook and Exchange over this unsafe file type (MDB).
- Microsoft is currently working on the fixes, evaluating if an update may prevent Word from opening MDB files, and checking how to apply the fixed msjet40.dll currently available for Windows Server 2003 SP2, Windows Vista, and beta versions of Windows XP SP3 in other OS versions.
- In the meantime, apart from the general recommendation of not opening untrusted MS Word files, you can follow the two workarrounds detailed on the initial advisory:
- Computer-based workarround: Restrict the Microsoft Jet Database Engine from running through the "cacls" command, used to modify the access control lists (ACLs) of files. Applications requiring the Jet Database Engine will not function.
- Infrastructure-based workarround: Block specific files at your mail gateway based on string signatures (if it provides file inspection capabilities). The associated strings plus implementation details for specifc mail gateways are detailed on the advisory.
Future updates on the MSRC blog.
--
Raul Siles
www.raulsiles.com
Comments