Article

New threats target Microsoft apps

Bill Brenner

IT professionals have two Microsoft threats to worry about as they start the new week.

First, Microsoft is warning those who haven't deployed a patch for flaws in the Remote Access Connection Manager (RASMAN)

    Requires Free Membership to View

to do so immediately. Detailed exploit code is circulating, and attackers could use it to target the flaws.

Secondly, Cupertino, Calif.-based antivirus giant Symantec Corp. is warning of new proof-of-concept code that targets a security hole in Microsoft Windows Live Messenger, the instant messaging client formerly called MSN Messenger.

Microsoft released an advisory for the first threat Friday night, saying it targets a pair of critical remote code-execution flaws affecting versions of Windows 2000, XP and Server 2003. The RASMAN flaws could enable someone with malicious intent to take control of an affected system. Microsoft issued a patch for this problem in its MS06-025 security bulletin June 13.

"Microsoft is aware that detailed exploit code has been published on the Internet for the vulnerability addressed by Microsoft security bulletin MS06-025," a Microsoft spokesman said by email. He said the company is not currently aware of any active attacks based on this exploit code, but it is monitoring the situation closely. "Our investigation of this exploit code has verified that it does not affect users who have installed the update detailed in MS06-025 on their computers."

Symantec sent an advisory on the Windows Live Messenger issue to customers of its DeepSight Threat Management System Monday morning, saying version 8.0 is reportedly prone to a heap overflow vulnerability when processing malformed contact lists.

"This issue arises because the application fails to perform boundary checks prior to copying user-supplied data into sensitive process buffers," Symantec said. "The vulnerability presents itself when the application processes a malicious contact list (.ctt) file."

An attacker could craft a malicious contact list that supplies excessive data to the application through a large string value, such as a contact name, thus triggering the overflow condition. "This issue may lead to memory corruption," Symantec said. "An attacker may also leverage this issue to execute arbitrary code on a computer with the privileges of an affected user. Exploitation attempts may result in crashing the application as well."

While Symantec is not aware of any active exploits targeting the flaw, it confirmed that a proof-of-concept .ctt file is available. To mitigate the threat, Symantec recommended IT professionals take some of the following measures:

  • Run all software as a non-privileged user with minimal access rights.

  • Deploy network intrusion detection systems to monitor network traffic for malicious activity.

  • Do not accept or execute files from untrusted or unknown sources.

  • Avoid accepting and importing .ctt files that originate from users of questionable integrity.

  • Do not accept communications that originate from unknown or untrusted sources.

  • Implement multiple redundant layers of security.
  • There are Comments. Add yours.

     
    TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

    REGISTER or login:

    Forgot Password?
    By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
    Sort by: OldestNewest

    Forgot Password?

    No problem! Submit your e-mail address below. We'll send you an email containing your password.

    Your password has been sent to: