Microsoft Security Intelligence Report (SIR) - Volume 11

Published: 2011-10-11
Last Updated: 2011-10-12 00:08:06 UTC
by Swa Frantzen (Version: 1)
3 comment(s)

Microsoft released today volume 11 of its Security Intelligence Report covering the first half of 2011.

Swa Frantzen -- Section 66

Keywords: MSFT SIR
3 comment(s)

Apple iTunes 10.5

Published: 2011-10-11
Last Updated: 2011-10-11 21:16:05 UTC
by Swa Frantzen (Version: 1)
0 comment(s)

Apple released iTunes 10.5 for Windows and Mac OS X. For those following Apple this comes as no big surprise as there are functionality changes expected due to the imminent release of a new iPhone model. What is however a bit surprising is that they also released an impressive list of fixed vulnerabilities in the windows version of iTunes.

Even more interesting is that that list also mentions that  e.g. "For Mac OS X v10.6 systems, this issue is addressed in Security Update 2011-006" or "For OS X Lion systems, this issue is addressed in OS X Lion v10.7.2". And those are respectively a security update and an OS update that are not yet released at the time of writing.

Swa Frantzen -- Section 66

Keywords: Apple iTunes patches
0 comment(s)

Critical Control 7 - Application Software Security

Published: 2011-10-11
Last Updated: 2011-10-11 19:58:02 UTC
by Swa Frantzen (Version: 1)
2 comment(s)

[the following is a guest diary contributed by Russ McRee]

Given the extraordinary burst in headlines over the last six months relating to "hacktivist "exploitation of web application vulnerabilities,  Critical Control 7: Application Software Security deserves some extra attention.

The control describes WAF (Web Application Firewall) use, input validation, testing, backend data system hardening, and other well-defined practices. Not until the 6th suggested step does the control state: “Organizations should verify that security considerations are taken into account throughout the requirements, design, implementation, testing, and other phases of the software development life cycle of all applications.
For your consideration: it can be argued that, as a canonical principle, strong SDL/SDLC practices woven into the entire development and deployment process leads to reduction of attack vectors. Reduce said vectors and mitigations provided by enhanced controls become less of a primary dependency. Long story short, moving SDL/SDLC practices to the front of the line, while not a “quick win,” can be a big win. That’s not to say that SDL/SDLC replace or supplants controls, but a reduction in risk throughout the development process puts the onus on secure code where controls become an additional layer of defense rather than the only layer of defense.
One of the advantages to a strong SDL/SDLC practice is the prescription of threat modeling where classification schemes such as STRIDE or DREAD help identify issues early as part of the development lifecycle rather than reactively or as part of controls-based activity.

OWASP offers excellent resources to help with SDL/SDLC efforts.

As you take a look at testing “in-house-developed and third-party-procured web applications for common security weaknesses using automated remote web application scanners” don’t fall victim to vendor hype. Test a number of tools before settling on one as some tools manage scale and application depth and breadth very differently. If you’re considering monthly or ongoing scans of applications that may serve thousands of unique “pages” but with very uniform code, you’ll want a scanning platform that can be configured to remove duplicate items (same URL and parameters) as well as items with media responses or certain extensions.
There is a wide array of offerings, commercial and free/open source, so test well and consider that you may want to consider more than one particularly if you’re considering inexpensive or free. Static code analysis tools are more often commercial but there are some free/open source offerings there as well. Plenty of search results will get you pointed in the right direction but again, test more than one. The diversity of results you’ll receive from different tools for both dynamic and static testing will surprise you.
Always glad to share experience with some of the tools in these categories should you have questions via russ at holisticinfosec dot org.


  • A strong SDL/SDLC program reduces dependencies on controls.
  • Test a variety of dynamic and static web application testing tools.
2 comment(s)

Microsoft Black Tuesday Overview October 2011

Published: 2011-10-11
Last Updated: 2011-10-11 18:20:21 UTC
by Swa Frantzen (Version: 2)
0 comment(s)

Overview of the October 2011 Microsoft patches and their status.

# Affected Contra Indications - KB Known Exploits Microsoft rating(**) ISC rating(*)
clients servers
MS11-075 A vulnerability allows random code execution with full system rights through loading a hostile library from a WebDAV network share. Related to SA 2269637.
Active Accessibility

KB 2623699 No publicly known exploits. Severity:Important
Critical Important
MS11-076 A vulnerability allows random code execution with full system rights through loading a hostile library from a network location. Related to SA 2269637.
Media Center

KB 2604926

Exploits are trivial to find on the Internet

Critical Less Urgent
MS11-077 Multiple vulnerabilities in windows drivers allow Denial of Service, privilege escalation and random code execution.
Replaces MS11-054.
Windows drivers

KB 2567053

No publicly known exploits

Critical Important
MS11-078 A vulnerability in .NET (XAML Browser applications) and silverlight allows random code execution with the rights of the logged on user. Also affects IIS server configured to process ASP.NET pages.
Replaces MS09-061, MS10-060 and MS10-070.
.NET framework

KB 2604930
No publicly known exploits Severity:Critical
Critical Critical
MS11-079 Multiple vulnerabilities in Forefront Unified Access Gateway allow Denial of Service, privilege escalation and random code execution with the rights of the logged-on user. It affects both the client and server components, the impact is greater on the clients.
Forefront Unified Access Gateway (UAG)

KB 2544641 No publicly known exploits Severity:Important
Critical Important
MS11-080 An input validation vulnerability in the afd.sys driver allows privilege escalation.
Replaces MS10-046.
Ancillary Function Driver (AFD)

KB 2592799 No publicly known exploits Severity:Important
Important Less Urgent
MS11-081 The usual monthly collection of vulnerabilities in Internet Explorer. Cumulative patch. All versions of IE6 to IE9 are affected.
Replaces MS11-057.

KB 2586448 No publicly known exploits Severity:Critical
Critical Important
MS11-082 Vulnerabilities in host integration server allow denial of service. The host integration server listens to udp/1478, tcp/1477 and tcp/1478.
Host Integration Server

KB2607679 Both vulnerabilities are publicly known. Severity:Important
Less Urgent Important
We will update issues on this page for about a week or so as they evolve.
We appreciate updates
US based customers can call Microsoft for free patch related support on 1-866-PCSAFETY
(*): ISC rating
  • We use 4 levels:
    • PATCH NOW: Typically used where we see immediate danger of exploitation. Typical environments will want to deploy these patches ASAP. Workarounds are typically not accepted by users or are not possible. This rating is often used when typical deployments make it vulnerable and exploits are being used or easy to obtain or make.
    • Critical: Anything that needs little to become "interesting" for the dark side. Best approach is to test and deploy ASAP. Workarounds can give more time to test.
    • Important: Things where more testing and other measures can help.
    • Less Urgent: Typically we expect the impact if left unpatched to be not that big a deal in the short term. Do not forget them however.
  • The difference between the client and server rating is based on how you use the affected machine. We take into account the typical client and server deployment in the usage of the machine and the common measures people typically have in place already. Measures we presume are simple best practices for servers such as not using outlook, MSIE, word etc. to do traditional office or leisure work.
  • The rating is not a risk analysis as such. It is a rating of importance of the vulnerability and the perceived or even predicted threat for affected systems. The rating does not account for the number of affected systems there are. It is for an affected system in a typical worst-case role.
  • Only the organization itself is in a position to do a full risk analysis involving the presence (or lack of) affected systems, the actually implemented measures, the impact on their operation and the value of the assets involved.
  • All patches released by a vendor are important enough to have a close look if you use the affected systems. There is little incentive for vendors to publicize patches that do not have some form of risk to them.

(**): The exploitability rating we show is the worst of them all due to the too large number of ratings Microsoft assigns to some of the patches.

Swa Frantzen -- Section 66

0 comment(s)
ISC StormCast for Tuesday, October 11th 2011


Diary Archives