Microsoft Updated Security Advisory (917077) and APWG Report released
Microsoft Updated Security Advisory (917077) (Vulnerability in the way HTML Objects Handle Unexpected Method Calls Could Allow Remote Code Execution) and says "Advisory updated with indication of limited attacks." In this instance, "attacks" = malicious websites. And speaking of attacks/malicious websites, the APWG January Phishing Trends Report (APWG Report graph below) was released and reports "The number of unique phishing websites detected by APWG was 9715 in January 2006, a huge increase in unique phishing sites from the previous two months.". I wonder if the authors of trojans that steal banking information are capable of deploying 9,715 "attack" websites a month with exploits for unpatched IE vulnerabilities? Handler Donald Smith mentioned how easy it'd be to spam links to the world. What's your IE threat analysis folks? Drop me a line!
Update - McAfee calls malware used with an exploit for this vulnerability PWS-PartyPooper.
Joker.com confirms DDOS Attack on Nameservers
This affects DNS resolution of Joker.com itself, and also domains which make use of Joker.com nameservers.
We are very sorry for this issue, but we are working hard for a permanent solution.
Thank you for your understanding".
Deja Vu - PHP(BB) attack increase reports
Veritas pulls (some) patches for Backup Exec
The first vulnerability, described in SYM06-004 allows a malicious user crashing of the Backup Exec Remote Agent by sending a specially malformed packet.
This leads to a DoS attack on the service, but considering that this is typically used for backups of critical data, the severity could be pretty high (it's easy to imagine a scenario when you need business critical data that was supposed to be backed up yesterday, but it wasn't due to the Backup Exec crashing).
In normal circumstances we would say to update as soon as possible, but it looks like there are some issues with some of the patches (we got a submission from one of our readers, thanks Charles). Symantec also pulled patches for Backup Exec 10d (10.1) and 10.0 for Windows Servers - the original advisory available at http://seer.support.veritas.com/docs/282255.htm says that the hotfix has temporarily been removed and will be re-released later.
The other advisory (SYM06-005) is related to a low risk vulnerability in the Job Engine service. This vulnerability can be exploited only in certain circumstances ("full details" logging has to be enabled, and a user has to host a specially formatted file on their system). Details about this vulnerability can be found at http://seer.support.veritas.com/docs/282254.htm.
UPDATE 2006-03-25
Seems like Symantec re-released the patches. You can download them from the URLs above.
Comments