Microsoft Security Advisory (2286198)

General Information
Executive Summary

Microsoft is investigating reports of limited, targeted attacks exploiting a vulnerability in Windows Shell, a component of Microsoft Windows. This advisory contains information about which versions of Windows are vulnerable as well as workarounds and mitigations for this issue.

The vulnerability exists because Windows incorrectly parses shortcuts in such a way that malicious code may be executed when the user clicks the displayed icon of a specially crafted shortcut. This vulnerability is most likely to be exploited through removable drives. For systems that have AutoPlay disabled, customers would need to manually browse to the root folder of the removable disk in order for the vulnerability to be exploited. For Windows 7 systems, AutoPlay functionality for removable disks is automatically disabled.

http://www.microsoft.com/technet/security/advisory/2286198.mspx

New Job Posted @ PSR Consulting - Field Technician

https://psrconsulting.net/jobs/index.php

Login and create your account

Adobe Acrobat and Reader Multiple Code Execution Vulnerabilities

Adobe Acrobat and Reader Multiple Code Execution Vulnerabilities

Title : Adobe Acrobat and Reader Multiple Code Execution Vulnerabilities
VUPEN ID : VUPEN/ADV-2010-1636
CVE ID : CVE-2010-1240 - CVE-2010-1285 - CVE-2010-1295 - CVE-2010-1297 - CVE-2010-2168 - CVE-2010-2201 - CVE-2010-2202 - CVE-2010-2203 - CVE-2010-2204 - CVE-2010-2205 - CVE-2010-2206 - CVE-2010-2207 - CVE-2010-2208 - CVE-2010-2209 - CVE-2010-2210 - CVE-2010-2211 - CVE-2010-2212
CWE ID : VUPEN VNS Only
CVSS V2 : VUPEN VNS Only
Rated as : Critical
Remotely Exploitable : Yes
Locally Exploitable : Yes
Release Date : 2010-06-29


Technical Description Receive VUPEN Security alerts in a Text format Receive VUPEN Security alerts in a PDF format Receive VUPEN Security alerts in an XML format

Multiple vulnerabilities have been identified in Adobe Reader and Acrobat, which could be exploited by attackers to cause a denial of service or compromise a vulnerable system. These issues are caused by memory corruptions, invalid pointers, uninitialized memory, array-indexing and use-after-free errors when processing malformed data within a PDF document, which could be exploited by attackers to crash an affected application or execute arbitrary code by tricking a user into opening a specially crafted PDF document.

Affected Products

Adobe Reader version 9.3.2 and prior
Adobe Reader version 8.2.2 and prior
Adobe Acrobat version 9.3.2 and prior
Adobe Acrobat version 8.2.2 and prior

Solution

Upgrade to Adobe Acrobat and Reader version 9.3.3 or 8.2.3 :
http://www.adobe.com/support/security/bulletins/apsb10-15.html

References

http://www.vupen.com/english/advisories/2010/1636
http://www.adobe.com/support/security/bulletins/apsb10-15.html

Sandboxie

Sandboxie runs your programs in an isolated space which prevents them from making permanent changes to other programs and data in your computer.

http://www.sandboxie.com/

Yum not workingon Fedora Constantine

Downloaded the new Fedora 12 and had issues using yum..

Here is the fix

*Edit two of your repository files: /etc/yum.repos.d/fedora.repo and /etc/yum.repos.d/fedora-updates.repo.
*Un-comment all the lines that start with the term baseurl and place a comment before all lines that start with mirrorlist. .

* Edit your /etc/hosts file and append the following to it’s contents:

80.239.156.215 mirrors.fedoraproject.org
213.129.242.84 mirrors.rpmfusion.org

OSSIM

OSSIM stands for Open Source Security Information Management. Its goal is to provide a comprehensive compilation of tools which, when working together, grant network/security administrators with a detailed view over each and every aspect of his or her networks, hosts, physical access devices, server, etc.

Besides getting the most out of well known open source tools, some of which are briefly described below, OSSIM provides a strong correlation engine, detailed low, medium and high level visualization interfaces, and reporting and incident management tools, based on a set of defined assets such as hosts, networks, groups and services.

All of this information can be restricted by network or sensor in order to provide only the required information to specific users; allowing for a fine grained multi–user security environment. Finally, the ability to perform as an IPS (Intrusion Prevention System), using correlated information from virtually any source, will be a useful addition to any security professional’s arsenal.

Components
OSSIM features the following software components:

* Arpwatch – used for MAC anomaly detection.
* P0f – used for passive OS detection and OS change analysis.
* Pads – used for service anomaly detection.
* Nessus – used for vulnerability assessment and for cross correlation (IDS vs Security Scanner).
* Snort – the IDS, also used for cross correlation with nessus.
* Tcptrack – used for session data information which can prove useful for attack correlation.
* Ntop – which builds an impressive network information database from which we can identify aberrant behavior/anomaly detection.
* Nagios – fed from the host asset database, it monitors host and service availability information.
* Osiris – a great HIDS.
* OCS-NG – cross-platform inventory solution.
* OSSEC – integrity, rootkit, registry detection, and more.

http://www.alienvault.com/community.php?section=Home

Hacked US Treasury websites serve visitors malware

Websites operated by the US Treasury Department are redirecting visitors to websites that attempt to install malware on their PCs, a security researcher warned on Monday.

The infection buries an invisible iframe in bep.treas.gov, moneyfactory.gov, and bep.gov that invokes malicious scripts from grepad.com, Roger Thompson, chief research officer of AVG Technologies, told The Register. The code was discovered late Sunday night and was active at time of writing, about 12 hours later.

http://www.theregister.co.uk/2010/05/03/treasury_websites_attack/