• On MovieTome: See the villain of IRON MAN 2!

Zero Days

Read all 'Browsers and extensions' posts in Zero Days
April 10, 2007 10:31 AM PDT

Windows dynamic DNS update mechanism

Share
The dynamic DNS update mechanism within the DNS Server service in Microsoft Windows does not properly authenticate clients. This occurs with certain configurations, and can allow remote attackers to change DNS records for a web proxy server and conduct man-in-the-middle (MITM) attacks on web traffic. The can also use this flaw to conduct pharming attacks by poisoning DNS records, and cause a denial of service attack.

Additional Resources

MILW0RM: Advisory 3544

April 10, 2007 10:26 AM PDT

Windows Web Proxy Autodiscovery flaw

Share
Versions of Microsoft Windows 2000 and Windows Server 2003 use the Web Proxy Autodiscovery Protocol (WPAD) within Internet Explorer. WPAD allows IE to locate a Web proxy's auto-config file and thus configure the browser's proxy settings. The way the system is currently implemented, a malicious user could configured a WINS or DNS proxy server on a site, then when a vulnerable IE browser connects, intercept all subsequent traffic.

Additional Resources

Microsoft: Advisory 934864

FRsirt: 1115

CNET News.com: Windows weakness can lead to network traffic hijacks

April 10, 2007 10:22 AM PDT

Windows animated cursor attack

Share
There's a new Microsoft Windows vulnerability being exploited across the Internet on over 100 Web sites, according to security vendor Websense. The vulnerability is caused by an unspecified error in the way Windows 2000, XP, and Vista handles animated cursors. Animated cursors allow a mouse pointer to appear animated on a Web site. The feature is often designated by the .ani suffix, but attacks for this vulnerability are not constrained by this file type so simply blocking .ani files won't necessarily protect a PC. Users need not do anything but visit a compromised site to become infected. Antivirus vendor F-Secure reports there's also a worm associated with this vulnerability.

Successful exploitation can result in memory corruption when processing cursors, animated cursors, and icons. According to Arbor Networks, the malicious code on compromised Web sites exploiting this flaw appears to be originating from the following sites, which you may want to block:

wsfgfdgrtyhgfd.net

85.255.113.4

uniq-soft.com

fdghewrtewrtyrew.biz

newasp.com.cn

To become infected, users must be using Internet Explorer 6 or 7; there is no need to click, just visiting an infected site is enough for an infection. The flaw does not affect Firefox or Opera Internet Browsers. Microsoft released a patch within its security bulletin MS07-017.

Additional Resources

Microsoft: MS07-017

Zeroday Emergency Response Team (ZERT): Unofficial patch

NIST: CVE-2007-0038

Arbor Networks: Any Ani file could infect you

Websense: Alert

F-Secure: Blog post

February 1, 2007 2:38 PM PST

Update for Internet Explorer 7

Share
If you've disabled the antiphishing filter in Internet Explorer 7, you're not alone. The filter, as it currently works, takes something short of forever to process each site, deciding whether to mark it as safe for viewing or suspect as a potential phishing site. In response, Microsoft has quietly issued a service update for users of Internet Explorer 7 for XP and Windows Vista, running on Windows Vista (all editions, including x64 editions), Windows XP SP2, Windows XP Professional x64, Windows Server 2003 SP1, and Windows Server 2003 SP1 x64 editions.
January 8, 2007 11:13 AM PST

Integer overflow in Microsoft Internet Explorer 6

Share

There's a vulnerability within Microsoft Internet Explorer 6 while running on a fully patched Windows XP SP2 system that allows remote attackers to cause a denial of service (crash). This flaw is due to an integer overflow error in the Common Controls library "comctl32.dll" when processing a "WebViewFolderIcon" object with a specially crafted "setSlice()" method. Specifically, a 0x7fffffff argument to the setSlice method on a WebViewFolderIcon ActiveX object may lead to an invalid memory copy, which can be exploited by attackers. Successful execution, however, requires that the victim visit a specially crafted Web page.

Additional resources:

January 8, 2007 11:11 AM PST

Internet Explorer "FolderItem" Object Access Remote Denial of Service Vulnerability

Share

This vulnerability may cause a denial of service (crash) within Microsoft Internet Explorer 6. By accessing the object references of a FolderItem ActiveX object--specifcally, by creating a NULL pointer dereference error when accessing a "FolderItem" object--attackers may crash the Microsoft browser. Successful execution, however, requires a victim to access a malicious Web page.

Additional Resources:

January 3, 2007 3:35 PM PST

Adobe Reader Open Parameters XSS

Share

In a conference paper titled "Subverting Ajax," security researchers Stefano Di Paola and Giorgio Fedon identified multiple cross-site scripting (XSS) vulnerabilities. One flaw in particular, the open parameters vulnerability, is quite easy to execute on vulnerable versions of Adobe Reader. A malicious attack can be carried out by referencing any Web-based PDF file and supplying potentially malicious JavaScript code as an open parameter to any Web-based PDF file. For example

http://www.(domain name).com/file.pdf#whatever_name_you_want=javascript:your_code_here

The researchers contacted Adobe in October with their findings and only recently made their work public. Adobe has since released version 8 of Adobe Reader which no longer allows appended JavaScript within site URLs. However, many users continue to use older versions of the Adobe Reader plug-in and should update as soon as possible.

Additional Resources:

December 1, 2006 12:37 PM PST

Cross-domain vulnerability in Microsoft Internet Explorer 6

Share

This vulnerability restricts information from other domains via an object tag. A data parameter within that tag references a link on the attacker's originating site. The link on the attacker's originating site then specifies a Location HTTP header on a target site. The flaw makes that potentially malicious content available through the outerHTML attribute of the object.

On August 8, 2006, Microsoft issued MS06-040, a cumulative patch for Internet Explorer, that addresses this vulnerability.

Additional Resources:

December 1, 2006 12:35 PM PST

Internet Explorer HTML Help ActiveX Control Memory Corruption

Share

This vulnerability is caused by an error in the HTML Help ActiveX control (hhctrl.ocx). When handling the "Image" property within an HTML file, the vulnerability can be exploited by using a long string to cause memory corruption (buffer overflow). Successful exploit could lead to the execution of remote code on a compromised PC.

Additional Resources:

December 1, 2006 12:32 PM PST

Internet Explorer HTA Application Execution

Share

The Internet Explorer HTA Application Execution was assigned two vulnerability numbers by the National Institute of Standards in Technology National Vulnerabilities Database. The vulnerability in Inter Explorer allows remote attackers to execute arbitrary code via a link to an SMB file share, and the flaw itself might be within other components used by the Microsoft browser. If executed, the vulnerability may disclose potentially sensitive information and potentially compromise a user's system. Exploitation requires user interaction, however.

On August 8, 2006, Microsoft released two patches which addressed these vulnerabilities.

Additional Resources:

advertisement

About Zero Days

Zero Days are security threats released before or concurrent with the public disclosure of software vulnerabilities. Our new blog will keep you ahead of the criminal hackers by informing you what you are up against.

Add this feed to your online news reader

Zero Days topics