Microsoft Internet Explorer Cookie Path Attribute Vulnerability

Microsoft Internet Explorer Cookie Path Attribute Vulnerability

Date of Discovery: 17.11.2004
Criticality: Critical
Affects: Microsoft Internet Explorer 6.x

Compromise From: From remote
Compromise Type: Hijacking

Summary
A vulnerability has been reported in Internet Explorer, which potentially can be exploited by malicious people to conduct session fixation attacks.

Detailed Description
A vulnerability has been reported in Internet Explorer, which potentially can be exploited by malicious people to conduct session fixation attacks.

The vulnerability is caused due to a validation error in the handling of the path attribute when accepting cookies. This can potentially be exploited by a malicious website, if the trusted site supports wildcard domains or the domain name contains the malicious sites domain, using a specially crafted path attribute to overwrite cookies for the trusted site.

The vulnerability has been reported in Internet Explorer 6.0 SP1 on Microsoft Windows XP SP1. Microsoft Windows XP SP2 is reportedly not affected.

Note: Successful exploitation also requires that the trusted site handles cookies and authentication in an inappropriate or insecure manner.

Solution
Update to Windows XP SP2.

Disable cookies except when needed.

CVE Reference
CVE-2004-1527

Apple's Mac Isn't as Secure as Some Want Us to Believe

An interesting article on eweek.com

Source: http://www.eweek.com/c/a/Security/Apples-Mac-Isnt-as-Secure-as-Some-Want-Us-to-Believe-183583/

SecurityOrb.com News Updates

1. Mass-compromise attack injects malware into pages and redirects victims to a site that then downloads Trojans and keylogger code

Source: http://www.infoworld.com/d/security-central/nine-ball-attack-strikes-40000-web-sites-882?source=rss_security_central


2. Google is testing using HTTPS by default on all Gmail pages, though the move would likely inhibit performance

Source: http://www.infoworld.com/d/applications/google-try-more-security-gmail-860?source=rss_security_central


3. Researchers at Finjan outlined a sophisticated one-stop show for cyber-criminals buying and trading in infected computers. Called Golden Cash, the network has been linked to the compromises of around 100,000 PCs and FTP credentials.

Source: http://www.eweek.com/c/a/Security/Finjan-Researchers-Uncover-Marketplace-for-Botnets-595200/

Mac4Lin Gives Linux Desktops the Complete Mac Look

Linux: Mac4Lin, a package of skins, wallpapers, icons, and interface refinements that brings a completist Mac look to Linux with an automated installation, has reached the 1.0 stage with an impressive array of features.

Besides basic theming changes to your desktop covering login windows, window look and feel, a modified app launcher dock, and more, Mac4Lin plugs into and plays nice with a lot of third-party apps. Thunderbird, Rhythmbox, Songbird, Pidgin, Firefox 3, and others are supported and receive theme integrations, while a customized Cairo or AWN dock are rolled into your system during the installation.

It goes without saying, but there are, obviously, areas where the Linux desktop can't replicate the Mac's. Still, if you like the Cupertino look for your system, Mac4Lin is an easy way to get there, without an afternoon-consuming step-by-step process.

Mac4Lin 1.0 is a free download for Linux systems. Hit the link below for a list of features, standing bugs, and screenshots.

Mac4Lin ver.1.0 Released! [via Peng Hardin]

Source: http://lifehacker.com/5290955/mac4lin-gives-linux-desktops-the-complete-mac-look

Hacker Halted USA Conference to Offer Complimentary Security Training worth $599 to All Delegates

Hacker Halted USA Conference to Offer Complimentary Security Training worth $599 to All Delegates

Unique opportunity for attendees of information security conference in Miami to attend specially designed one-day training workshops covering some of the most popular security topics.

Attendees of Hacker Halted USA 2009, a world-class information security conference to be hosted in Miami, Florida, from September 23 – 25, will be entitled to attend one of three security workshops led by EC-Council Master Instructors. These one-day workshops will cover three of the most popular security topics, namely Identifying Threats and Deploying Countermeasures; Principles of Incident Handling; and Exposing Virtualization Security Threats. Read More.....

Link: http://www.hackerhalted.com/NewsCenter/HackerHaltedUpdates/BreakingNewsJune10/tabid/167/Default.aspx

Microsoft Zero-Day DirectX Flaw

Vulnerability Details

Microsoft has reported a critical new vulnerability in Microsoft DirectX affecting older versions of Windows. The vulnerability could allow remote code execution if a user opens a rogue QuickTime media file. Microsoft reports limited, active attacks that use this exploit code.

The vulnerability exists in the way a DirectX application programming interface known as DirectShow handles supported QuickTime files. By manipulating the format, attackers can gain the same system privileges assigned to the logged-in user. The Microsoft Security Advisory states: “If a user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.”

Affected Software

• Windows 2000 Service Pack 4
• Windows XP
• Windows Server 2003

All versions of Windows Vista, Windows Server 2008, and the beta version of Windows 7 are NOT vulnerable. In addition, Apple’s Quick Time player is NOT affected.

Please consult the official Microsoft Security Advisory for details on workarounds, fixes and patch availability.

Workaround

Microsoft has issued a workaround that disables the automatic QuickTime parsing on machines running Window 2000, Windows XP or Windows Server 2003.

Recommendations

Keep your anti-virus products up-to-date with the current pattern files.