OFFICE SOFTWARE — THE HEADLINES

 2001/12/20 

W32.Maldal.C@mm

 2001/12/19 

New pack fixes Office XP bugs

 2001/11/02 

Attacking Lotus

 2001/10/08 

Malformed Excel or PowerPoint document can bypass macro security

 2001/8/30 

BSCW symlink vulnerability

OFFICE SOFTWARE — THE LINKS

• HNS Overview: Antigen for Lotus Notes

  Disclaimer: These hyper-links can be placed by visitors of this site. The link, the description and the content of the linked pages do not fall under the responsibility of the SYS-2064 editors and do not represent their opinion. The editors may modify or delete any entries.

OFFICE SOFTWARE — THE NEWS

2001/12/20

13:24 +0100

W32.Maldal.C@mm

[Office Software] W32.Maldal.C@mm alias W32/Zacker-C, W32/Reeezak-A is a mass-mailing worm. The worm is written in Visual Basic, and it requires Visual Basic runtime libraries to execute. When the worm is executed, it emails itself to all contacts in the Microsoft Outlook address book.

The email has the following characteristics: Subject Happy New Year, message Hii — I can't describe my feelings But all i can say is Happy New Year :) — bye. Attachment: Christmas.exe

It changes the name of the computer to Zacker and makes modifications in the registry, so that the worm runs each time that you start Windows. Next, the worm changes your Internet Explorer home page a malicious page that was created by the author of the worm. Next, the worm will display a window with the text: "From the heart. Happy new year !"

Finally, the worm disables the keyboard. This means that the keyboard cannot be used until the computer is restarted without the worm being executed.

The webpage that this worm sets as the Internet Explorer start page is malicious for Wintel PCs. When visited, it contains code that will create the file %Windows%\Rol.vbs. This file will then be executed. It deletes several antivirus and security products and infects all local .html, .htm, and .asp files. It then overwrites files that have the following extensions: .lnk, .zip, .jpg, .jpeg, .mpg, .mpeg, .doc, .xls, .mdb, .txt, .ppt, .pps, .ram, .rm, .mp3, .mdb, or .swf with a copy of Zacker.vbs.

If Mirc.ini is found, all .ini files in that folder will be overwritten with a string that will cause an infected computer to send the URL to other users over the IRC network. Finally, the worm will display a political message and attempt to exit Windows. // c.f. golem.de :: [dre].

Comments (0)

2001/12/19

18:50 +0100

New pack fixes Office XP bugs

[Office Software] Microsoft released the first major collection of bug fixes for its Office XP business software. Service Pack 1, a 17MB download, is supposed to enhance Office XP's performance, security and stability, while fixing a wide range of glitches, Microsoft said. The download for system administrators, which includes additional tools, is 40MB, says CNET News.com.

The service pack also consolidates other separately released enhancements and fixes, such as Outlook 2002 security updates. David Jaffe, Office XP lead product manager, said Microsoft hopes the service pack release will help nudge companies to install the software. "We see this as a key driver for organizations that recently purchased Windows XP and Office XP that haven't deployed yet."

The security fixes close vulnerabilities that would allow hackers to run malicious code in Word, Excel and PowerPoint. Another security patch prevents hackers from remotely manipulating files or data. The service pack further resolves a problem with Outlook not notifying users when their main data file had reached its size limit. It also handles problems sending e-mail when instant messaging is running and crashes caused when using custom bullets in PowerPoint. // c.f. Tech-Alerts :: [dre].

Comments (1)

2001/11/02

14:13 +0100

Attacking Lotus

[Office Software] A security vulnerability in Lotus Notes Mail (all releases, versions 4.6 & 5) allows users to create LotusScript (an internal interpreted language) with a malicious intent, and to cause it to execute without the user's control—even out of Notes.

The attack is based on some ActiveX (or other object you choose) is executed during the reading of the mail. There can be infinite possibilities such as formatting hard drives, sending emails, replicating the script to send it to the whole address-book, sending files, stealing files from the victim hard drives without him noticing it and more. The only solution is to deactivate the preview, and to delete the malicious memo before reading it.

In the meantime, three more Lotus vulnerabilities have been reported on a security mailing list by David Litchfield:

Lotus Domino View ACL by-pass — If a user has been denied access to a database view, NISR have discovered that it is possible to by-pass the permissions set on that view and access the documents one would expect it to protect. The solution to this problem is to ensure that, if you are applying ACLs to a view, the documents in that view are also protected.

Lotus Domino Default Navigator Protection By-pass — A Lotus Notes databases designer can create a navigator that allows a user to navigate the database for documents and each database comes with a default navigator called $defaultNav. This default navigator exposes a list of visible views to the user. If a web user was to access the default navigator over the web this may pose a mild security risk and as such a workaround was created to prevent this.

Lotus Domino Web Administrator Template ReplicaID Access — NISR have discovered a feature of Domino's web server that allows an anonymous user to access the Web Administrator template file (webadmin.ntf) and use some of its functionality. Normally, webadmin.ntf should not be accessible and as such this poses a high security threat to systems running Lotus Domino.

A check for the latter three problems already exist in "DominoScan", NGSSoftware's Lotus Domino application security scanner. NISR have also written a white paper on how to secure Lotus Domino's web server available from NextGenSS. // c.f. SecuriTeam, VulnWatch :: [dre].

Comments (0)

2001/10/08

17:23 +0100

Malformed Excel or PowerPoint document can bypass macro security

[Office Software] In Microsoft Security Bulletin MS01-050, the company confirms the findings of Symantec, that a flaw exists in the way macros are detected that can allow a malicious user to bypass macro checking.

Excel and PowerPoint have a macro security framework that controls the execution of macros and prevents macros from running automatically. Under this framework, any time a user opens a document the document is scanned for the presence of macros. If a document contains macros, the user is supposed to be notified and asked if he wants to run the macros or the macros are disabled entirely, depending on the security setting.

Affected Software are Microsoft Excel 2000/2002 for Windows, Excel 98/2001 for Macintosh, Microsoft PowerPoint 2000/2002 for Windows and PowerPoint 98/2001 for Macintosh.

A malicious attacker could attempt to exploit this vulnerability by crafting a specially formed Excel or PowerPoint document with macro code that would run automatically when the user opened it. The attacker could carry out this attack by hosting the malicious file on a web site, a file share, or by sending it through email.

MS Office users are urged to download and install the patches for MS Windows and Apple MacOS // c.f. Golem, intern :: [dre].

Comments (0)

2001/8/30

10:19 +0100

BSCW symlink vulnerability

[Office Software] GMD's BSCW (Basic Support for Cooperative Work) enables collaboration over the Web. BSCW is a 'shared workspace' system that supports document upload, event notification, group management and much more. BSCW follows symbolic links in an insecure manner, allowing attackers to execute arbitrary commands/programs, writes "neovatar".

BSCW does not correctly handle symlinks. Instead of detecting them and avoiding from blindly following them, the program will incorrectly follow them. Since the program offers users the ability to extract .tar files into their "data-bag" (private space), symlink following can be exploited by a malicious user.

An attacker can view any file on a system, as long as the UID, under which the BSCW system is running, can access it. In most cases, this will be the same UID as the web server UID (nobody, wwwrun). Since the BSCW files have the same permission settings a malicious user can access to BSCW data items. The early "op_extract" fixes that but leaves a few other exploitable issues.

Another vulnerability occurs in the standard installation. The standard installation includes a call to the "zip" tool, the "zip tool is used for converting .tar files to .zip files. After the "op_extract" patch, you will not be able to access the symlink, since the new extract function checks for symlinks after tar is called. But by converting the attacker's tar file to a .zip file, the "zip" tool extraction will follow the symlink and pack the file that was targeted by the symlink.

The latest patch "untar.py" introduces a wrapper, which looks for symlinks and seems to fix all symlink vulnerabilities. You can download the patches and view the installation instructions at bscw.gmd.de/pycXX , where XX is the version of your installed python package (e.g. bscw.gmd.de/pyc20 for python 2.0). // c.f. SecuriTeam :: [dre].

Comments (0)