Threat Level: green Handler on Duty: Daniel Wesemann

SANS ISC InfoSec Handlers Diary Blog


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

Upcoming Infocon Test and new Color

Published: 2008-08-12
Last Updated: 2008-08-15 15:02:52 UTC
by Johannes Ullrich (Version: 2)
11 comment(s)


Testing finished. Please let us know if you saw any issues. Please note that the various infocon indicators can take about 15 minutes to update.

 

 

This Friday, we will change the infocon to test a new admin interface. The test will last from 10:00-11:00 EDT (14:00-15:00 UTC). We will cycle through all colors. The pager notifications will be disabled during the test.

In the future, we are planning more regular infocon tests. Probably once a month, but the schedule has yet to be determined. In order ot conduct the tests, we will use a new color "Blue". Blue is used only for tests. Pager alerts will not be disabled for these tests to allow you to test them as well.

For details about the infocon, see http://isc.sans.org/infocon.html .

------
Johannes B. Ullrich, Ph.D.
SANS Technology Institute

Keywords: infocon
11 comment(s)

August 2008 Black Tuesday Overview

Published: 2008-08-12
Last Updated: 2008-08-13 17:26:02 UTC
by Stephen Hall (Version: 1)
1 comment(s)

Overview of the August 2008 Microsoft patches and their status.

# Affected Contra Indications Known Exploits Microsoft rating ISC rating(*)
clients servers
MS08-041 Vulnerability in the ActiveX Control for the Snapshot Viewer for Microsoft Access Could Allow Remote Code Execution
Access, Snapshot Viewer

CVE-2008-2463

KB 955617

Known expoit code being actively exploited. 

This is a workaround by implementing a kill bit.

Critical Critical Important
MS08-042 Vulnerability in Microsoft Word Could Allow Remote Code Execution
Word

CVE-2008-2244
KB 955048

Known expoit code being actively exploited.

Important Critical Important
MS08-043

Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution

Excel
CVE-2008-3003

CVE-2008-3004

CVE-2008-3005

CVE-2008-3006

KB 954066 No publicly known exploits Critical Critical Important
MS08-044

Vulnerabilities in Microsoft Office Filters Could Allow Remote Code Execution

Office 2000, XP 2003, Works 8, Project

CVE-2008-3018
CVE-2008-3019
CVE-2008-3020

CVE-2008-3021

CVE-2008-3460

KB 924090
No publicly known exploits Critical Critical Important
MS08-045

Cumulative Security Update for Internet Explorer

Internet Explorer

CVE-2008-2254

CVE-2008-2255

CVE-2008-2256

CVE-2008-2257

CVE-2008-2258

CVE-2008-2259

KB 953838
Publically disclosed vulnerability but no known exploits. Critical PATCH NOW! PATCH NOW!
MS08-046

Vulnerability in Microsoft Windows Image Color Management System Could Allow Remote Code Execution

Windows 2000, XP, 2003


CVE-2008-2245

KB 952954
No publicly known exploits Critical Critical Important
MS08-047

Vulnerability in IPsec Policy Processing Could Allow Information Disclosure

Vista, 2008

CVE-2008-2246

KB 95373
No publicly known exploits Important Important Important
MS08-048

Security Update for Outlook Express and Windows Mail

Windows (OE, Mail)

CVE-2008-1448

KB 951066
No publicly known exploits Important Important Important
MS08-049

Vulnerability in Event System Could Allow Remote Code Execution

Windows

CVE-2008-1456

CVE-2008-1457

KB 950974
No publicly known exploits Important Important Important
MS08-050

Vulnerability in Windows Messenger Could Allow Information Disclosure

Windows Messenger

CVE-2008-0082

KB 955702
Publically disclosed vulnerability but no known exploits. Important Important Important
MS08-051

Vulnerabilities in Microsoft PowerPoint Could Allow Remote Code Execution

PowerPoint

CVE-2008-0120

CVE-2008-0121

CVE-2008-1455

KB 949785
No publicly known exploits Critical Critical Important
 
We will update issues on this page for about a week or so as they evolve.
We appreciate updates
US based customers can call Microsoft for free patch related support on 1-866-PCSAFETY

(*): ISC rating

  • We use 4 levels:
    • PATCH NOW: Typically used where we see immediate danger of exploitation. Typical environments will want to deploy these patches ASAP. Workarounds are typically not accepted by users or are not possible. This rating is often used when typical deployments make it vulnerable and exploits are being used or easy to obtain or make.
    • Critical: Anything that needs little to become "interesting" for the dark side. Best approach is to test and deploy ASAP. Workarounds can give more time to test.
    • Important: Things where more testing and other measures can help.
    • Less Urgent: Typically we expect the impact if left unpatched to be not that big a deal in the short term. Do not forget them however.
  • The difference between the client and server rating is based on how you use the affected machine. We take into account the typical client and server deployment in the usage of the machine and the common measures people typically have in place already. Measures we presume are simple best practices for servers such as not using outlook, MSIE, word etc. to do traditional office or leisure work.
  • The rating is not a risk analysis as such. It is a rating of importance of the vulnerability and the perceived or even predicted threat for affected systems. The rating does not account for the number of affected systems there are. It is for an affected system in a typical worst-case role.
  • Only the organization itself is in a position to do a full risk analysis involving the presence (or lack of) affected systems, the actually implemented measures, the impact on their operation and the value of the assets involved.
  • All patches released by a vendor are important enough to have a close look if you use the affected systems. There is little incentive for vendors to publicize patches that do not have some form of risk to them.

 

1 comment(s)

Defcon 16 reflections

Published: 2008-08-12
Last Updated: 2008-08-12 17:56:07 UTC
by Joel Esler (Version: 3)
2 comment(s)

As promised I thought I would send up a post about Defcon, since it's fresh on alot of our minds.

Despite what people think, this is still a good con.  Still breakthrough talks happening, still "zero" days coming out.  Thousands of Thousands of people there. 

The Goons did a great job keeping everything flowing and organized.  (Although, could have ordered more badges on day 1?)  Even though the hotel posted guards around the ATMs, the Nevada Gaming Commission and some Cops were investigating a Horse Race Betting Machine (could have been totally legit, I didn't ask, I don't want to know.  It was just funny and coincidental), and various other interesting tidbits.

There were alot of interesting talks, obviously I couldn't attend them all, but from the ones that I heard were very interesting (BTW -- I am going to link to the presentations that I can, Click through AT YOUR OWN RISK :

Kaminsky -- Although I heard that there was basically nothing new posted, (I wasn't there, I was on a plane), it was interesting to hear him present about the vuln.

BGP Hack -- I did hear that this WAS the most interesting talk.  From what I heard/read, the guys that were presenting were able to successfully demonstrate how they changed the BGP routing at Defcon and sent everything through a box in New York, only to come back to Vegas.  Apparently they did this live.  Nice.

Snort plugin development -- Of personal interest to me, I sat in on this talk about Snort dynamic-preprocessor and rule development. 

The Medical Identity Theft talk at DC16 had an unannounced software release...  They wrote a tool to strip the headers off of LWAPP packets and output a regular pcap file showing the regular wireless client traffic.

Fyodor's Talk on Nmap -- Funny, excellent, interesting!

As always, the Capture the Flag contests were great and interesting.  Spot the fed was funny (as always), as were several of the other contests:

Sit through 30 hours of vendor presentations without sleeping to split US10k.

Automate a pellet/paintball gun to shoot targets.

Guitar Hero 3 (Holy cow, the guys that play this on Expert are CRAZY fast!)

The Freakshow party (as most the parties I went to were) on Saturday was awesome.  Props go to Sunshine and whomever was on her side for planning that one!  Great conference everyone.

 UPDATE:  Added URL from The Medical Identify Theft talk, corrected post about the same -- Corrected Fyodor's URL.

-- Joel Esler http://www.joelesler.net

Keywords:
2 comment(s)

VMWare ESX 3.5u2 Errors

Published: 2008-08-12
Last Updated: 2008-08-12 14:56:48 UTC
by Johannes Ullrich (Version: 1)
0 comment(s)

VMWare has an important announcement if you are using VMWare ESX 3.5u2: This particular version will "expire" today (August 12th). If you restart the server, or move a virtual machine, you will get an error and you will not be able to start up the machine or use VMotion.

In short: If you use this exact version of VMWare ESX: Don't touch it until you hear from VMware about a solution. As a work around, you can change the system time to a date before Aug. 12th and turn off NTP.

Links:
communities.vmware.com/thread/162377

www.vdi.co.nz/

 

(thanks to a number of readers who alerted us about this! And thanks to all the Australian VMware users who of course ran into this first)

------
Johannes B. Ullrich, Ph.D.
SANS Technology Institute

Keywords: vmware
0 comment(s)

Gmail Outage?

Published: 2008-08-12
Last Updated: 2008-08-12 13:38:40 UTC
by Joel Esler (Version: 3)
1 comment(s)

Getting reports here at the Storm Center of an outage for Gmail.  I can't replicate it, it works fine from me from two Internet access points.  Is it still down on the interwebz for you guys?

Update:   I have received a few emails indicating that it works, and I've received a couple indicating that its down.  So perhaps it's regional?  Or account based?

Update 2:  Apparently Google had a whoopsie.  Look at the top right of this page for further info.  Issue closed.  Thanks all!

-- Joel Esler http://www.joelesler.net

Keywords:
1 comment(s)

SBC Outage in Cleveland?

Published: 2008-08-12
Last Updated: 2008-08-12 01:45:51 UTC
by Joel Esler (Version: 1)
1 comment(s)

SBC Outage in Cleveland?  Perhaps? 

We've only had one report today of any problems, however, we don't know if SBC has changed their routes to avoid InternetHealth, or what the deal is, but it looks like something is up.

 

-- Joel Esler http://www.joelesler.net

Keywords:
1 comment(s)
Diary Archives