Postfix:

/^Content-(Disposition|Type).*name\s*=\s*"?(.*\.(
  bat|exe|scr))(\?=)?"?\s*(;|$)/x
   REJECT 598 Attachment name "$2" may not end with ".$3" 

Procmail:

Amavisd-new:

Sendmail:

References:

• Symantec Trojan.Mdropper.X

• Make sure your Anti Virus solution works with Vista.
• Windows Vista's firewall is configured by default to allow all outbound connections. You may want to tighten this down. There are a few specific outbound "allow" rules which you should probably keep enabled (for example for DNS and DHCP). So by default, the outbound firewall comes with "all traffic allowed" + specific "allowed" rules. I know, this sounds reduntant. But the idea is to keep your system working even if you switch the default rule to block outbound traffic.
  
• Note that Windows Vista will not prevent users (or administrators) from doing stupid stuff ;-). If ou know how to secure XP or your current Windows version, stick with it for production use until you are familiar with Vista.

Last Thursday, the Internet Systems Consortium released new versions of the popular BIND DNS server software. The new releases, 9.2.8, 9.3.4 and 9.4.0rc2 contain fixes for two security vulnerabilities that were identified early January.

The first vulnerability, assigned CVE-2007-0494, is only exploitable in those BIND configurations that use DNSSEC validation through the use of trusted-keys. During the validation of responses to type * (ANY) queriesthat returns multiple RRsets certain assertion checks can be triggered (which could cause the daemon to exit). This is still a fairly low impact vulnerability – the SECspider at UCLA only knows of 722 DNSSEC enabled zones on the internet.

In the second vulnerability, assigned CVE-2007-0493, certain requests could cause named, the actual DNS server of the BIND software, to read a freed fetch context. This would cause named to exit, allowing a remote attacker to perform a DoS attack against the server.

The impact of many DNS vulnerabilities can be mitigated by using best practices in the design of a DNS architecture. For example, disabling the ability of external users to run recursive lookups against your servers can simultaneously limit the scope of the above vulnerabilities, increase performance for legitimate users and prevent your servers from being used in an amplification denial-of-service attack. Nevertheless, measurements by the Measurement Factory show that as recently as August 2006, 52% of all DNS servers on the internet still allowed recursion by clients outside of their administrative domain.

Even though these specific vulnerabilities are ranked as low impact, if there’s one security improvement you consider this week, make it a thorough check of your public DNS servers – do they allow functionality that isn’t required, such as open recursion? The NIST has an excellent document on implementing secure DNS, and Team Cymru's Secure BIND template can prove most useful.

Maarten Van Horenbeeck

One media source reported earlier this week of a ‘breakthrough finding’ in attacks on SHA1. Some readers wrote us quoting the article, asking what was up. The article in fact referred to a well-known finding in early February 2005, when a Chinese research team announced they had found ways to identify collisions in a much faster way than purely through brute force attack.

As SHA1 generates 160 bits of output, there are 2¹⁶⁰ potential output values. Due to the birthday paradox, brute force attacks against SHA1 would as such have taken 2⁸⁰ iterations to find a collision – two messages with an identical hash value. Technically this attack would be difficult to achieve on current hardware.

The 2005 findings by Xiaoyun Wang and her research team decreased this to 2⁶⁹ hash operations. As this is purely a collision attack, its use as an attack strategy is limited to certain situations in which system designers require strong collision resistance.

There are already certain hash functions that are not affected by these recent attacks. NESSIE, a European Commission research project identified a number of recommended hash functions. These included Whirlpool, as well as the SHA-based functions SHA-256, SHA-384 and SHA-512. The project reported negatively on SHA1 due to its short output length of 160 bits. In March of 2006, the National Institute for Standards and Technology (NIST) started advising against the use of SHA-1 for implementations that require collision resistance and suggested some of those same alternatives.

This week, NIST released a draft minimum requirements list for candidate hash algorithms to replace SHA-1 as the Secure Hash Standard. They are actively soliciting input in order to allow for the organization of a new public competition, similar to that used to select Rijndael as the AES standard.

The advice fellow handler Dan gave back in 2005 still stands:
- know where the affected hash functions are used in your organization;
- identify the cryptographic services they deliver in each instance;
- identify which types of service are affected by new attacks;
- liaise with your vendors and developers to ensure availability of alternatives where necessary;
- closely track standardization efforts to ensure implemented alternatives are peer-reviewed and widely supported.

Maarten Van Horenbeeck

ISC reader Ng Keng Lim shared with us a malware specimen that poses as Windows Live Messenger. The messenger attempts to steal the victim's Windows Live logon credentials by capturing them, saving them to a local text file, and emailing them to the attacker. It is available as a free download from the author's website.

The most interesting aspect of this specimen is not its functionality per se, but its purpose. As far as I can tell, its main goal is to bring attention to its author's website, probably to generate ad revenue or to use the site for launching browser-based attacks.

When launched, the program presents a standard login screen that users of Windows Live Messenger are accustomed to seeing. When the user attempts to log on, the program writes the credential to a local file. By default, this file is called "pas.txt" and is placed in the root of  the C: drive. Its contents look like this:

www.malwareauthorwebsite.com
Username: victim@example.com
Password: password1
www.malwareauthorwebsite.com

Size: 1513472 bytes
MD5 hash: a7a75a56b4b960c8532c37d3c705f88f
SHA1 hash: e69d26db431e383131826fab5db213559ee68814

Several readers have written in that Cisco just released three security bulletins regarding issues in the Cisco IOS software:

Crafted TCP Packet can cause denial of service
A remotely-exploitable memory leak in the Cisco IOS software could lead to a denial of service condition. This vulnerability applies to much of the IOS 12.0, 12.1 and 12.2 code base.

Crafted IP Option vulnerability
Routers and switches running IOS or IOS XR could be vulnerable to a remotely exploitable craft IP option DoS attack. This is a significant issue as in some cases it has the potential to allow for arbitrary code execution.

IPv6 Routing Header vulnerability
Certain crafted IPv6 Type 0 routing headers could crash a device running IOS.

We are currently performing a more detailed analysis of each of these vulnerabilities and will post updates to these issues shortly. As a form of triage we believe organizations are most likely to be affected by the 'Crafted IP Option vulnerability', which simultaneously has the highest potential impact. 

If you run Cisco switches or routers in your network, we advise you to review these bulletins in detail and take mitigative action where required.

We probably all know the situation. It is when we reach out for help, to share information, or just to chat. At the other end you don't get that warm cosy feeling. Your National/Organizational/Local CERT/SIRT/CSIRT... doesn't appear to care or have time for you. They are supposed to support the constituency you represent, excepting that there seems to be a discrepancy in between how you perceive it and they do. What to do?

Option 1: Completely ignore them. Stop sending any incident data, stop answering their calls. You know it isn't the best way to behave but you don't feel you have a choice.

Option 2: Smile and nod. Slowly stop sending them any data, but politely answer their calls.

Option 3: Grin and bear it. Not the most fun option. Although you might not receive anything of perceived value in return you still feed data and hope for a better day.

You actually do have a choice, and I urge you to use it. Always voice your concerns to your local, organizational, association, national and law enforcement representation. They might not always immediately pay you back, but I do believe that good turns do pay back dividends.

As new versions of the Sun Java JRE keep coming out to address security vulnerabilities do NOT forget to remove the old versions. It is possible that you may be running Java code in your applications that absolutely require a specific version of the JRE to run, update the applications and then update the JRE, and then remove the old JRE versions.  Why? A Java applet can request which version of JRE it wishes to use, that's why.

UPDATE 26/01/2007

Readers Jim and John both wrote in to let us know that  since 1.5.0_06 Sun has changed the way Applets and applications can specify the Java version to run.

More information here.

And here.

How to.

Corporate silent install/uninstall (Thanks Andrew!)

Active Directory Deployment.

BTW: "The Sun Java Runtime Environment contains multiple vulnerabilities that can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system"  released today. Either permanently disable Java AND Jscript in your browser(S) or keep as close an eye on JRE versions as you do Microsoft Windows patches.

http://sunsolve.sun.com/search/document.do?assetkey=1-26-102731-1

http://sunsolve.sun.com/search/document.do?assetkey=1-26-102729-1

http://sunsolve.sun.com/search/document.do?assetkey=1-26-102760-1

Cheers, Adrien de Beaupré

The US-CERT info linked to in the Diary says;
Systems Affected
Sun Java Runtime Environment versions
a.. JDK and JRE 5.0 Update 9 and earlier
b.. SDK and JRE 1.4.2_12 and earlier
c.. SDK and JRE 1.3.1_18 and earlier
Update at;
http://java.com/en/download/index.jsp

BSSI/Cinnabar

• cf6c72dfa5a05beb46f21a21cb6d3487  for the original version
• b9a0d6c8493ad79c2c09137871b95672  for the new variant

• Chinese missile shot down USA aircraft
• Chinese missile shot down USA satellite
• Chinese missile shot down Russian satellite
• Russian missile shot down USA aircraft
• Russia missile shot down USA satellite
• Russian missile shot down Chinese aircraft
• Radical Muslim drinking enemies' blood
• Sadam Hussein alive!
• Sadam Hussein safe and sound! 

This vulnerability allows attackers to execute arbitrary code on vulnerable installations of Computer Associates BrightStor ARCserve Backup. User interaction is not required to exploit this vulnerability.

The specific flaw exists in the Tape Engine RPC service which listens by default on TCP port 6503 with the following UUID:

    2b93df0-8b02-11ce-876c-00805f842837

The service exposes a buffer overflow in the handler for RPC opnum 0xCF that allows for arbitrary code execution when handling user-supplied data from the RPC request.

Symantec has widely reported vulnerabilities in clients 10.0.2.2000 and below.  It is a remotely exploitable vulnerability that does not require user intervention.  10.0.2.2002 remediates the problem.

Over the last several days, we've experienced a significant number of systems (missing the Symantec patch) that have been exploited by a worm.  The worm spreads by a number of mechanisms, but namely the Symantec vulnerbility over port TCP 2967.   I was able to capture traffic from an infected host, see attached file.  The worm tries to phone home to 89.163.145.15:6667.  By blocking this on the outbound firewall or router, the worm will stop attempting to spread.  Long story short, be sure to patch your systems!

Port 2968 is getting quite a jump recently. Take a look at the graph below.



We suspect the jump is due to the recent Symantec AV 10.1 exploitation. The previous exploits generally hit on port 2967 since that's the port that Symantec AV listens on (for Windows). According to documentation from Symantec, port 2968 is only used for AV running on Netware servers. We are not sure at this point whether the attackers are targeting Netware server since other hosts have all been exploited already or if Symantec AV listens on port 2968 as a backup port. If you have any info on the port 2968 traffic, please let us know.

Overview of the January 2007 Microsoft patches and their status.

--
Swa Frantzen -- Section 66

Port 6502 is showing a significant increase in unwanted traffic:



The increase is almost purely TCP.

It seems possible this is related to the activity reported earlier by US-CERT regarding the CA BrightStor ARCserve Backup Tape Engine. It exploits a vulnerability disclosed on November 24th, 2006 for which there doesn't seem to be a patch available.

To be sure what it is, we'd like some packets. Please note we don't need just SYN packets, they are useless for this. We need you to set up something that listens and actively tries to talk as a server on port 6502.   "nc" with the right options comes to mind (options are system dependent, check your man page).

It's interesting to note the length of time that passed on this one if this is indeed still the same vulnerability they are attempting to exploit.

--
Swa Frantzen -- Section 66

This is a quick reminder that isc.sans.org as well as dshield.org will be down for a while starting at 8pm EST. Once I start moving files, you will see just a static image ( isc.sans.org/images/newdesign.png ).

This diary was already written using the new editor (with spell checker!!).

$sQuery="select id from users where email='$sEmail'";
$hResult=mysql_query($sQuery);

The big problem here is SQL injection. What if we don't validate $sEmail well and end up with Mr. '; drop table users; registering?

So how do prepared statements help? Prepared statements execute in stages. At first, you will send the statement to the database, but replace all variables with "?":

$hStmt=mysqli_prepare($dblink,"select id from suers where email=?")

Note that there are no quotes around the ?. Next, we have to associate values to the parameter. This is done using the "bind" statement.

mysqli_stmt_bind_param($hStmt,"s",$sEmail);

The trick here is that MySQL will always consider "$sEmail" as a single value, no matter how many quotes and semi-colons you insert. Did you see that I am now using "mysqli", not "mysql"? mysqli is phps improved MySQL module which enables you to take full advantage of new features like prepared statements. I used the procedural style above, to point out the differences with respect to prepared statements. But in addition, mysqli provides a nice object oriented interface.

mysqli_stmt_execute($hStmt);
mysqli_stmt_bind_result($hStmt,$nID);

The real beauty of prepared statements comes to play if you try to execute the same statement multiple times with different parameters. All you have to do is change the content of your bound variable, execute the statement again, and retrieve the results from your already bound result variable. So you don't have to redo the "prepare". MySQL only has to parse your statement once.

But on the other hand, for a quick value retrieval like in the example above, thinks look overly complex.

Enter the object zone. As mentioned above, mysqli is available as a class. And you are free to extend it. You can find the extended class I use on DShield and ISC in our Sourceforge.Net CVS repository.

$nID=$oDB->simple_query("select id from users where email=?","s",$sEmail);

All the prepare and bind mess is hidden inside the class.

Or a more complex example. Lets say you would like to dump the output of a query into an HTML table. Something I do a lot for this site ;-):

$sTemplate="  %%port%%  %%count%%  ";
$sQuery="select port, count from port_summary where date=?";
print $oDB->template_query($sQuery,'s',$dDate,$sTemplate,'oddrow','evenrow',600);

"template_query" will fill the results retrieved from the database into a template, one row at a time. "oddrow" and "evenrow" are styles that will be used for odd and even rows respectively. The last parameter specifies a "cache time". The resulting HTML snippet will be cached for just that many seconds in order to save a lot of work if people ask for he same query over and over.

1. They are still out there. Usually bottom feeding on the scraps left by bots (or using bots to their advantage of course).
2. "Best Practices": Its hard to run a hacker-proof website. But its like anything... a little effort goes a long way and keeps out most of the riff-raff.
3. Shared Servers: Don't use them for business critical web sites. They are fine to run a hobby site from. But for anything else: Get a dedicated system. IMHO, the jury is still out if virtual machines provide enough separation.

Vulnerabilites that are widely known and/or actively exploited are of great interest to our readers, here we try to keep an overview of them

--
Swa Frantzen -- Section 66

• Unchangeable shared secret
• Readable snapshot files

 The Month of the Apple bugs seems to have started. The first bug is in the handling of RTSP URL's within Quicktime, leading to arbitrary code execution on both Windows and Mac OS. You can find the advisory here:
http://projects.info-pull.com/moab/MOAB-01-01-2007.html.  The MOAB blog states that you should disable the rtsp:// URL handler, however I have not determined how this is done.

Update 1:

Robert helped me find something I was missing.  Guess I am just blind today or was just paying a little too much attention to the bowl games.  To disable RTSP URLs in QuickTime, open the QuickTime control panel.  Then, select the File Types tab.  Expand the Streaming category and make sure the RTSP stream descriptor is unchecked.  Here is a screen capture of this from my Windows based computer.  I assume MacOS X computers have a similar control panel.   I recommend that you make sure that this is unchecked.