Patch Tuesday - 2 more from MS

Well thought I was all done after WMF patchin's, however there are two more put out today:

Quote:

---

Patch Tuesday: January '06
January 10, 2006
By Pedro Hernandez

Microsoft released two more updates this month, including one for Windows that carries a 'critical' rating.

Windows contains a flaw in the way it handles embedded web fonts (MS06-002), making it possible for malware coders to create an exploit that leads to a remote attack or theft of data if a user is logged in with administrator rights. Affected versions of Windows include 2000 SP4, XP SP1/SP2, XP Pro x64, and Server 2003 SP1/x64/Itanium/Itanium SP1.

Separately, both Microsoft Office and Exchange suffer from a critical TNEF decoding flaw (MS06-003) that can eventually lead to a remote attack. TNEF (Transport Neutral Encapsulation Format) packages message attributes, such as formatting and embedded images, for use by Outlook.

According to the advisory, some versions of Outlook and affected Office (2000, XP SP3, and 2003) language modules are susceptible to a bug that can lead to a client system takeover. Similarly, the bug can also allow an attacker to hack an Exchange 5.0, 5.5 or 2000 SP3 server.

These follow an out-of-schedule update that the software giant issued last week to fix the WMF flaw and render useless the subsequent zero-days that cropped up online. During that gap, sites hosting unofficial patches and workarounds were surging in popularity as administrators weighed their options. Feedback coupled with a quick patch development period prompted Microsoft to issue the fix early.

New WMF flaws have surfaced since, but the Microsoft Security Response Center is filing them under performance issues. While they may cause a WMF application to crash, they do no otherwise affect the OS or grant access to a hacker.

The company's Malicious Software Removal Tool also gets an update this month. New signatures allow the software to detect the Parite virus along with the Maslan and Bofra worms.

Individual downloads are available by following the links contained within the security bulletins or by using Windows Update.

Source or click on the link in EIT Planet's Security News Section

---

Off to MS...


cheers

Also there is a critical security patch for Exchange and Outlook 2000\2003

http://www.microsoft.com/technet/sec.../MS06-003.mspx

Has to do with email using MS RTF (rich text file)....you can block .dat attachments til you can patch your exchange server.

By blocking .dat you may render some email unreadable....

MLF

Thanks MLF,

Gotta admit I have been booted to Linux for quite awhile so when I visited MS for the updates on XP, well... it took quite a while to patch even with dsl

:D

the wmf fix got pushed forward due to public demand/news spolight, from what i understand.
for what its worth todays patch is the rest of the scheduled monthly patch. [sarcasm] yeah go team[/sarcasm]

For the Exchange / RTF / TNEF thing, there's a set of patches for client PCs (Outlook 2000, 2002 and 2003) and a set of patches for Exchange (5.0, 5.5 and 2000).

I've read the bulletin and I'm unclear as to whether you just need to patch the server OR the client or the server AND the client. Does anyone have any thoughts on this?

Urrrggghhh... I've done some poking around and it appears that the SERVER can be infected with the TNEF attack hence the patch - so an update would be required for both. The fact that it appears that an Exchange server can be vulnerable is particularly worrying.

Quote:

---

I've read the bulletin and I'm unclear as to whether you just need to patch the server OR the client or the server AND the client. Does anyone have any thoughts on this?

---

That is why you should block the .dat attachment ...until you can patch the server.

I would patch both client and server!!!

MLF

Quote:

---

That is why you should block the .dat attachment ...until you can patch the server.

I would patch both client and server!!!

MLF [/B]

---

I hate to think what that might break though. Isn't the .dat file an integral part of an RTF formatted message?

Not one to put off patching though - although you don't need to reboot servers, the patch DOES restart the information store.

Not quite sure on how the exploit would be triggered, but because Exchange happily accepts ALL messages and gives an asynchronous bounce I guess that you might not even need a valid email address on the target system. So (and just speculating here) you could have some sort of worm rip through Exchange servers globally *very* quickly.

Remember the Witty worm?

Well we blocked the .dat file at the server level..til the weekend when I can patch.

We also recieve email from many different countries...and email clients and so far I have heard of no issues....

Most clients use HTML or text now..dont they???

MLF

I have three flat screens on my desk with real time traffic analysis of my perimeter firewalls. The one used for Exchange and general internet access started acting weird on Monday. At about 8am the traffic pattern shifted. I watch it everyday and it completely went 180 on me. A few minutes later the phone rang with Administrators saying they are getting errors accessing the web. FRUCK ME, I said and went to work. Not knowing about this patch until this morning I had to isolate the problem which appeared to be a DOS attack or Spam attack on Exchange. The SMTP traffic would build in about 5 minutes to gobble up the ENTIRE T1 every time I turned on the virtual SMTP server. Long boring story short... any way I worked all night tearing down the firewall tracking all sorts of DNS items and generally reconfiguring and changing passwords etc and tracking and blocking potential bad IPs. Then all day yesterday reconfiguring and checking exchange and the whole system so... FU MS. :p I stopped it got it all back up to find a patch ready. ACK! :mad:

I have three flat screens on my desk with real time traffic analysis of my perimeter firewalls. The one used for Exchange and general internet access started acting weird on Monday. At about 8am the traffic pattern shifted. I watch it everyday and it completely went 180 on me. A few minutes later the phone rang with Administrators saying they are getting errors accessing the web. FRUCK ME, I said and went to work. Not knowing about this patch until this morning I had to isolate the problem which appeared to be a DOS attack or Spam attack on Exchange. The SMTP traffic would build in about 5 minutes to gobble up the ENTIRE T1 every time I turned on the virtual SMTP server. Long boring story short... any way I worked all night tearing down the firewall tracking all sorts of DNS items and generally reconfiguring and changing passwords etc and tracking and blocking potential bad IPs. Then all day yesterday reconfiguring and checking exchange and the whole system so... FU MS. :p I stopped it got it all back up to find a patch ready. ACK! :mad:

RoadClosed

Sorry you got hosed by all this, but thanks much for sharing your damage control etc., we don't always get to have hands on or hear enough about the crisis management end of it. So if anyone else get hammered by the latest or future crap, please share it with us. Thanks


cheers

RoadClosed

Sorry you got hosed by all this, but thanks much for sharing your damage control etc., we don't always get to have hands on or hear enough about the crisis management end of it. So if anyone else get hammered by the latest or future crap, please share it with us. Thanks


cheers

Errr this is a bit long.

Patch report
I applied the TNEF patch to two legacy Exchange 5.5 SP4 servers OK, although one did require a reboot. Definitely time to move from *that* platform though as that was the last patch for 5.5.

Further reading
There's a good article here outlining the seriousness of this flaw. It's definitely worth reading and bringing to the attention of your management team - and there are two very chilling paragraphs:

Quote:

---

"You could take over an Exchange server with a single, simple email," he said. "From there you could target all the clients accessing that server. You would 'own' any Outlook client that connects to that server. Then an attacker could grab the Outlook users' address books.

"If you did it right, you could own every Outlook user in the world within a week," he said.

---

This is why I mentioned the Witty Worm in an earlier post (see this analysis of its spread if you don't know about it). Witty targetted firewalls and permiter security servers and basically infected 100% of vulnerable systems within a few hours and destroyed them. It was an unusual worm.. not just because of the speed it spread at and its destructiveness, but the fact that it targetted infrastructure rather than client PCs. You can see that it would be quite possible for a worm to target Exchange Servers only and spread at an incredibly fast rate untill all vulnerable servers because infected. Add a malicious payload onto the worm and... well.. it doesn't bear thinking about.

That's just the servers - of course the clients are vulnerable too and patching Office is a real pain in the backside unless you've upgraded to WSUS or some other patch management tool.. if you're still running SUS then you're gonna have to come out with an alternative plan to get systems patched.

Outlook versions
Worse still, I know a lot of people are still running Outlook 97 and 98. There's no mention of these on the MS web site, but we've all seen how these flaws go aaaaallllllllll the way back, so it's quite likely that these older systems are vulnerable too.

Workarounds
And I think the workarounds for this vulnerabilty suck. Filtering or blocking RTF formatted emails would lead potentially lead to too many important lost messages.

I put a filter on our incoming messages to take a copy of anything with "MS-TNEF" in the mail headers at the moment it looks like around 4% of incoming messages are formatted in this way. Still, it's worth considering as an option in case things start to go pear shaped. (For the record, I'm using Postini to do this).


I think this has the potential for being an extremely serious and hard to contain threat.

Errr this is a bit long.

Patch report
I applied the TNEF patch to two legacy Exchange 5.5 SP4 servers OK, although one did require a reboot. Definitely time to move from *that* platform though as that was the last patch for 5.5.

Further reading
There's a good article here outlining the seriousness of this flaw. It's definitely worth reading and bringing to the attention of your management team - and there are two very chilling paragraphs:

Quote:

---

"You could take over an Exchange server with a single, simple email," he said. "From there you could target all the clients accessing that server. You would 'own' any Outlook client that connects to that server. Then an attacker could grab the Outlook users' address books.

"If you did it right, you could own every Outlook user in the world within a week," he said.

---

This is why I mentioned the Witty Worm in an earlier post (see this analysis of its spread if you don't know about it). Witty targetted firewalls and permiter security servers and basically infected 100% of vulnerable systems within a few hours and destroyed them. It was an unusual worm.. not just because of the speed it spread at and its destructiveness, but the fact that it targetted infrastructure rather than client PCs. You can see that it would be quite possible for a worm to target Exchange Servers only and spread at an incredibly fast rate untill all vulnerable servers because infected. Add a malicious payload onto the worm and... well.. it doesn't bear thinking about.

That's just the servers - of course the clients are vulnerable too and patching Office is a real pain in the backside unless you've upgraded to WSUS or some other patch management tool.. if you're still running SUS then you're gonna have to come out with an alternative plan to get systems patched.

Outlook versions
Worse still, I know a lot of people are still running Outlook 97 and 98. There's no mention of these on the MS web site, but we've all seen how these flaws go aaaaallllllllll the way back, so it's quite likely that these older systems are vulnerable too.

Workarounds
And I think the workarounds for this vulnerabilty suck. Filtering or blocking RTF formatted emails would lead potentially lead to too many important lost messages.

I put a filter on our incoming messages to take a copy of anything with "MS-TNEF" in the mail headers at the moment it looks like around 4% of incoming messages are formatted in this way. Still, it's worth considering as an option in case things start to go pear shaped. (For the record, I'm using Postini to do this).


I think this has the potential for being an extremely serious and hard to contain threat.

I've had some further thoughts on possible attack vectors for the TNEF flaw on Exchange servers.

Looking back to the Witty Worm again, there was a definite feeling that very many of the vulnerable servers had been enumerated before the attack began - allowing the initial spread of the worm to be much quicker than a standard "organic" spread.

Now, the Bad Guys are probably reverse engineering the TNEF Exchange patch as we speak (and in any case, full disclosure of the flaw will be made in 90 days or so.) We can assume that it's going to take some time to get a working exploit together - however, in the meantime they start to collect a target list of Exchange servers.

I believe that all you would need to do to identify an Exchange server is send a mail message to an invalid address on the Exchange server and then wait for the bounce message to come back. Since most mail servers identify themselves in the bounce message, it would be relatively trivial to generate a list of domains running potentially vulnerable servers. This type of probing event would most likely be low key enough to escape detection.

Then, when the exploit is fully ready, it can be spammed out to potentially vulnerable servers from a botnet. Now, working on a worst-case-scenario of needing just one message to infect a server, you could potentially be looking at a large proportion of all vulnerable servers being infected before anyone can react.. certainly before IP addresses can be blacklisted and anti-virus signatures produced.

It looks like the latest figures for the market share of Exchange Server in corporates stands at 44% or so. How many systems will remain unpatched and vulnerable to attack? Even if you are *not* vulnerable to the TNEF flaw, you can see that there's potential for widespread business disruption.

I've had some further thoughts on possible attack vectors for the TNEF flaw on Exchange servers.

Looking back to the Witty Worm again, there was a definite feeling that very many of the vulnerable servers had been enumerated before the attack began - allowing the initial spread of the worm to be much quicker than a standard "organic" spread.

Now, the Bad Guys are probably reverse engineering the TNEF Exchange patch as we speak (and in any case, full disclosure of the flaw will be made in 90 days or so.) We can assume that it's going to take some time to get a working exploit together - however, in the meantime they start to collect a target list of Exchange servers.

I believe that all you would need to do to identify an Exchange server is send a mail message to an invalid address on the Exchange server and then wait for the bounce message to come back. Since most mail servers identify themselves in the bounce message, it would be relatively trivial to generate a list of domains running potentially vulnerable servers. This type of probing event would most likely be low key enough to escape detection.

Then, when the exploit is fully ready, it can be spammed out to potentially vulnerable servers from a botnet. Now, working on a worst-case-scenario of needing just one message to infect a server, you could potentially be looking at a large proportion of all vulnerable servers being infected before anyone can react.. certainly before IP addresses can be blacklisted and anti-virus signatures produced.

It looks like the latest figures for the market share of Exchange Server in corporates stands at 44% or so. How many systems will remain unpatched and vulnerable to attack? Even if you are *not* vulnerable to the TNEF flaw, you can see that there's potential for widespread business disruption.