ONLINE / BROWSER / E-MAIL — THE HEADLINES
2001/6/01
Code execution through Eudora and MS Viewer
2001/5/29
How to secure Instant Messaging
2001/5/18
Matt's ICQ Clone security holes
2001/5/17
Flaws in Web server certificate validation could enable spoofing
2001/5/11
Amaya file disclosure vulnerability
ONLINE / BROWSER / E-MAIL — THE LINKS
There are 1 links to external Web sites for this category.
The file was last modified on: Thursday; 2001/04/19, 08.04 MEST
Submit a link:
ONLINE / BROWSER / E-MAIL — THE NEWS
2001/6/01
13:11 +0100
[Online / Browser / Email] The BugTraq mailing list discussed a design flaw in the popular Eudora mail client, that allows attackers to execute code on a victim's machine or plant a trojan, after the user clicked on an innocent looking hyper-link in a mail viewed with Eudora 5.1.
The problem lies in some standard setting, which orders Eudora to "use Microsoft Viewer." Objects that are enclosed via an "IMG SRC" tag are stored in the Embedded folder. With that tag, an attacker could place executables and/or JavaScript/ActiveX Controls at a known location.
Is that object embraced by an HTML form and the link to the object acts as a button, the victim would activate the malicious code by clicking on what would look like a harmless link.
Qualcomm did not yet react or confirm tha problem. Users are advised to deactivate the "use Microsoft Viewer" setting. // RUS-CERT
::
[dre].
Comments (0)
2001/5/29
11:22 +0100
[Online / Browser / Email] Instant messaging is popular and convenient. You can get a quick yes or no from a colleague without even leaving your desk. But, unfortunately, convenience has its price. An innocent chat with a co-worker using your favorite instant messaging software could expose you to eavesdroppers or make it possible for someone to send you malicious code, ZDnet worries.
What do AOL, Yahoo, and MSN offer to protect you from malicious code? AOL Instant Messenger (AIM) does not require users to have a desktop antivirus program running, although they strongly suggest that you have one if you engage in file transfers. The author couldn't find any information on using antivirus software with Yahoo Instant Messenger or MSN Messenger Service.
File transfers: Again, AIM warns the user that (s)he might expose the IP address to the recipient. One can block the IP address from the recipient in Yahoo! Instant Messenger, but the author couldn't find any information on how to hide the IP address within MSN Messenger Service.
Plug-in antivirus help is now available for users of Yahoo or MSN's instant messaging services. Central Command has just released antivirus software designed exclusively for these popular instant messaging products. AIM users should download a desktop antivirus program if one is not currently running.
If you transfer files using your instant messaging application, you might want to switch to a more secure software one. NetLert, for example, provides instant messaging that you can host inside your company. So, instead of connecting to a third-party server, like oscar.aol.com, your company hosts the NetLert instant messaging server. Java-based NetLert also allows users to protect their conversations with Secure Socket Layer (SSL) encryption.
If you don't want to give up your AOL, Yahoo, or MSN accounts (or if you need to contact clients using each of these services and don't want to have three different applications running on your task bar), then download Jabber, v1.7. Jabber is an open source application that, like NetLert, has its own instant messaging with the added convenience of branded instant messaging services like AOL, Yahoo, MSN, or even ICQ. Jabber uses a SHA-1 hashing algorithm to authenticate users so that login passwords can't be intercepted. The latest versions allow users to select SSL encryption. However, messages sent to users on AOL, Yahoo, MSN, or ICQ will not be encrypted (as those services do not use SSL). // c.f. SecurityPortal
::
[dre].
Comments (0)
2001/5/18
10:49 +0100
[Online / Browser / Email] mICQ is a well-known ICQ emulator for Linux. Two buffer overflow vulnerabilities in Matt's ICQ clone version 0.4.6 enable a attacker that can sniff messages sent from the client to the ICQ server, to send a specially-crafted response that will trigger the buffer overflow and execute code on the victim's machine, report the PKCrew.org.
There is a buffer overflow in sprintf() in icq_response.c in function Do_Msg() at line 879 that allows to a remote attacker that is able to sniff packets sent to an ICQ server to execute arbitrary code on the victim system. There is also a local buffer overflow — if you send a URL message with a large description, the program receives a SIGSEGV, since this program is not suid there seems to be nothing much to gain from this.
The buffer overflow is due to a malicious URL message sent by the server. The client reads 1024 bytes from the UDP socket, trims the message headers and splits the remaining data in the 1024 bytes url_data and url_desc, recombining in the message char buffer, adding about fifty digits. Because the url_data is 1024 bytes long, this instruction can be used to overwrite the return address of the function and execute arbitrary code on the client machine.
The authors further line out a way to patch for this flaw and present an exploit code. // c.f. SecuriTeam
::
[dre].
Comments (0)
2001/5/17
12:27 +0100
[Online / Browser / Email] Microsoft's bulletin MS01-027 presents a patch to eliminate two newly discovered vulnerabilities affecting Microsoft Internet Explorer, both of which could enable an attacker to spoof trusted web sites.
The first vulnerability involves how digital certificates from web servers are validated. When CRL checking for such certificates is enabled, it could be possible for any or all of the following checks to no longer be performed: —Verification that the certificate has not expired —Verification that the server name matches the name on the certificate —Verification that the issuer of the certificate is trusted.
The second vulnerability could enable a web page to display the URL from a different web site in the IE address bar. This spoofing could occur within a valid SSL session with the impersonated site.
Both vulnerabilities could be used to convince a user that the attacker's web site was actually a different one — one that the user presumably trusts and would provide sensitive information to. However, Microsoft sees significant hurdles to exploiting either vulnerability.
The patch also eliminates two new variants of a previously discussed vulnerability, the "Frame Domain Verification" vulnerability, which originally was discussed in Microsoft Security Bulletin MS00-033. Like the original version, these new variants vulnerability could enable a malicious web site operator to read any file on the user's local computer that could be opened in a browser window. The patch also incorporates the functionality of the patch provided in Microsoft Security Bulletin MS01-020.
::
[dre].
Comments (0)
2001/5/11
10:39 +0100
[Online / Browser / Email] Amaya from the W3.ORG is a browser/authoring tool that allows you not only to read but also to publish documents on the Web. Sendtemp.pl of Amaya v4.2.1 suffers from a file disclosure vulnerability that allows remote attackers access files on the server's file system, with the privileges of the HTTPd, Tom Parker writes.
The vulnerability is quite simple. When the templ argument is past to sendtemp.pl it adds a link to the chosen stylesheet and a META field containing the publication's URL of the new file to the chosen template, e.g. http://localhost/cgi-bin/sendtemp.pl?templ=template.xml. However, there is no sanity checking on the parameters passed to the script (i.e.: my $temp_file = param("templ");).
So by simply issuing a GET to the following URL: http://localhost/cgi-bin/sendtemp.pl?templ=../../etc/passwd. The systems file system will be traversed and the passwd file will be read (assuming the http daemon hasn't been run under chroot()).
The original article at SecuriTeam features a respective Exploit Code.
::
[dre].
Comments (0)
|