>
> *****************************
> Widely Deployed Software
> *****************************
>
> (1) CRITICAL: Kodak Image Viewer/Microsoft Windows Image Format
> Vulnerability (MS07-055)
> Affected:
> Microsoft Windows 2000
> Microsoft Windows XP
> Microsoft Windows Server 2003
>
> Description: The Kodak Image Viewer, an application distributed with
> Microsoft Windows and used for viewing various image formats, contains
> a flaw in its handling of Tagged Image File Format (TIFF)
> images files.
> A specially crafted TIFF file could trigger a memory corruption
> vulnerability. An attacker could exploit this vulnerability to execute
> arbitrary code with the privileges of the current user. A
> malicious web
> site hosting such an image could also exploit this vulnerability. Full
> technical details for this vulnerability are publicly available.
>
> Status: Microsoft confirmed, updates available.
>
> References:
> Microsoft Security Bulletin
>
> BreakingPoint Systems Blog Posting (contains full technical details)
>
> -2007-microsoft-tuesday
> Wikipedia Article on TIFF
>
> SecurityFocus BID
>
>
> **************************************************************
> *********
>
> (2) CRITICAL: Microsoft Outlook Express and Windows Mail NNTP Handling
> Buffer Overflow (MS07-056)
> Affected:
> Microsoft Outlook Express on Microsoft Windows 2000/XP/Server 2003
> Microsoft Windows Mail on Microsoft Windows Vista
>
> Description: Microsoft Outlook Express and Windows Mail are
> the default
> Network News Transport Protocol (NNTP) clients on Microsoft Windows.
> NNTP, often called "netnews" or just "news" is a protocol for
> accessing
> distributed discussion groups. Microsoft Outlook Express and Windows
> Mail fail to properly handle certain malformed responses from NNTP
> servers. A specially crafted server response could exploit this
> vulnerability to execute arbitrary code with the privileges of the
> current user. The vulnerable applications are configured by default to
> open when a user accesses an NNTP URL (one beginning with "news://";),
> therefore a malicious website could also exploit this vulnerability.
> Full technical details are publicly available for this vulnerability.
>
> Status: Microsoft confirmed, updates available.
>
> References:
> Microsoft Security Bulletin
>
> BreakingPoint Systems Blog Posting (contains full technical details)
>
> -2007-microsoft-tuesday
> iDefense Security Advisory
> .
> php?id=607
> Wikipedia Article on NNTP
>
> SecurityFocus BID
>
>
> **************************************************************
> *********
>
> (3) CRITICAL: Microsoft Internet Explorer Multiple
> Vulnerabilities (MS07-057)
> Affected:
> Microsoft Windows 2000
> Microsoft Windows XP
> Microsoft Windows Server 2003
> Microsoft Windows Vista
>
> Description: Microsoft Internet Explorer contains multiple
> vulnerabilities that could lead to remote code execution or user
> interface spoofing. A failure to properly handle queued file downloads
> can lead to a memory corruption vulnerability. A specially crafted web
> page could exploit this vulnerability to execute arbitrary
> code with the
> privileges of the current user. Other vulnerabilities allow a web page
> to persist and continue to interact with the web browser after a user
> has navigated away from that web site.
>
> Status: Microsoft confirmed, updates available.
>
> References:
> Microsoft Security Bulletin
>
> SecurityFocus BIDs
>
>
>
> **************************************************************
> *********
>
> (4) CRITICAL: Microsoft Word Memory Corruption Vulnerability
> (MS07-060)
> Affected:
> Microsoft Office 2000
> Microsoft Office XP
> Microsoft Office 2004 for Mac
>
> Description: Microsoft Word contains a memory corruption vulnerability
> in the handling of certain malformed documents. A specially crafted
> Microsoft Office document could trigger this vulnerability
> and allow an
> attacker to execute arbitrary code with the privileges of the current
> user. The attack is believed to involve the file format used by the
> Apple Macintosh versions of Microsoft Office, which is not
> opened by all
> versions of the software. Note that versions of Office after
> Office 2000
> do not automatically open documents without first prompting the user.
> This vulnerability is being actively exploited in the wild.
>
> Status: Microsoft confirmed, updates available.
>
> References:
> Microsoft Security Bulletin
>
> SecurityFocus BID
>
>
> **************************************************************
> *********
>
> (5) HIGH: Microsoft Windows URI Handling Vulnerability
> Affected:
> Microsoft Windows XP and Server 2003 when using Internet Explorer 7
>
> Description: Microsoft Windows with Internet Explorer 7 fails to
> properly sanitize URIs passed from applications. A specially
> crafted URI
> could exploit this vulnerability to execute arbitrary
> commands with the
> privileges of the current user. The flaw arises from the interaction
> between applications handing URIs to the Windows Shell.
> Several example
> URIs are publicly available for this vulnerability. Some applications
> have been patched so that they validate URIs before passing
> them to the
> Windows Shell, but other applications and the Windows Shell itself are
> still vulnerable.
>
> Status: Microsoft confirmed, no updates available.
>
> References:
> Microsoft Security Advisory
>
> Microsoft Security Response Center Blog Posting
>
> itional-details-and-background-on-security-advisory-943521.aspx
> US-CERT Vulnerability Note
>
> SecurityFocus BID
>
>
>
> (9) HIGH: Kaspersky Labs Online Virus Scanner ActiveX Control Format
> String Vulnerability
> Affected:
> Kaspersky Labs Online Virus Scanner ActiveX Control
>
> Description: The Kaspersky Labs Online Virus Scanner is a web-based
> antivirus solution. This application installs an ActiveX control upon
> use, and this ActiveX control contains a format string
> vulnerability. A
> malicious web page that instantiates this control could trigger this
> vulnerability and execute arbitrary code with the privileges of the
> current user. Some technical details are publicly available for this
> vulnerability.
>
> Status: Vendor confirmed, updates available. Users can mitigate the
> impact of this vulnerability by disabling the control via Microsoft's
> "kill bit" mechanism for CLSID "0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75".
> Note that disabling this control will prevent legitimate application
> usage as well.
>
> References:
> Kaspersky Labs Advisory
>
> iDefense Security Advisory
> .
> php?id=606
> Microsoft Knowledge Base Article (details the "kill bit" mechanism)
>
> Wikipedia Article on Format String Vulnerabilities
>
> SecurityFocus BID
>
>
> **************************************************************
> *********
>
> (11) MODERATE: Asterisk IMAP Voicemail Buffer Overflow
> Affected:
> Asterisk versions prior to 1.4.13
>
> Description: Asterisk is a popular open source Voice over IP (VoIP)
> solution. Asterisk can utilize IMAP (Internet Message Access Protocol;
> a popular email retrieval and management protocol) to handle
> voice mail
> messages. A specially crafted email message, if treated as a voicemail
> by Asterisk, could trigger a buffer overflow in Asterisk, and allow an
> attacker to execute arbitrary code with the privileges of the
> vulnerable
> process. Technical details for this vulnerability are available in the
> vendor advisory, and can also be obtained by source code analysis. An
> additional buffer overflow vulnerability is also addressed in this
> security advisory, but would require write access to the application's
> configuration files to exploit.
>
> Status: Vendor confirmed, updates available.
>
> References:
> Asterisk Security Advisory
>
> Vendor Home Page
>
> SecurityFocus BID
>
>
> **************************************************************
> *********
>
> (12) LOW: Microsoft Windows RPC Denial-of-Service (MS07-058)
> Affected:
> Microsoft Windows 2000
> Microsoft Windows XP
> Microsoft Windows Server 2003
> Microsoft Windows Vista
>
> Description: The Microsoft Windows Remote Procedure Call
> (RPC) subsystem
> contains a denial-of-service condition. When a client attempts to
> authenticate with the subsystem and sends a specially crafted NTLMSSP
> (NT LAN Manager Security Support Provider) authentication request, the
> client could cause the vulnerable system to restart. An attacker would
> not need authentication to exploit this vulnerability.
>
> Status: Microsoft confirmed, updates available.
>
> References:
> Microsoft Security Bulletin
>
> Zero Day Initiative Security Advisory
>
> Wikipedia Article on NTLMSSP
>
> SecurityFocus BID
>
>
> ****************************************************
>
> Part II: Weekly Comprehensive List of Newly Discovered Vulnerabilities
> Week 41, 2007
>
>
> 07.42.100 CVE: Not Available
> Platform: Network Device
> Title: 3Com OfficeConnect Wireless Cable/DSL Router Unauthorized
> Remote Administration
> Description: The 3Com OfficeConnect Wireless Cable/DSL Router is
> a networking device identified by product number 3CRWER100-75. The
> device is exposed to an issue that can result in unauthorized remote
> administration. This issue occurs when the device is configured with
> remote management disabled.
> Ref:
> ______________________________________________________________________
>
> 07.42.101 CVE: Not Available
> Platform: Network Device
> Title: Cisco IOS Multiple Unspecified Stack Overflow Vulnerabilities
> Description: Cisco IOS is exposed to multiple unspecified stack
> overflow issues that may allow an attacker to execute arbitrary code.
> All Cisco IOS 12.x and IOS XR versions are affected. Please refer
> to the link below for further details.
> Ref:
> ______________________________________________________________________
>
>
> 07.42.103 CVE: Not Available
> Platform: Network Device
> Title: Cisco IOS LPD Remote Buffer Overflow
> Description: Cisco IOS (Internetwork Operating System) is the
> operating system used on Cisco devices. IOS includes LPD (Line Printer
> Daemon) support, so that Cisco devices may provide network printing
> services. The LPD service is not enabled by default. The application
> is exposed to a remote buffer overflow issue in its LPD service
> because it fails to perform adequate boundary checks on user-supplied
> data. Cisco IOS versions prior to 12.2(18)SXF11, 12.4(16a) and
> 12.4(2)T6 are affected.
> Ref:
> ______________________________________________________________________
>
> (c) 2007. All rights reserved. The information contained in this
> newsletter, including any external links, is provided "AS IS," with no
> express or implied warranty, for informational purposes only. In some
> cases, copyright for material in this newsletter may be held
> by a party
> other than Qualys (as indicated herein) and permission to use such
> material must be requested from the copyright owner.
>
