A couple of readers have indicated that this evening when they started Firefox it disabled the Microsoft plug-ins Windows Presentation Foundation and Microsoft .NET Framework Assistant 1.1. These plug-ins have been the source of some controversy since it was revealed earlier this week that Microsoft had patched them as part of patch Tuesday.

While the people over at Mozilla have recommended disabling these plug-ins, their is no indication over at the Mozilla Blogs of why this action was taken.

Anybody have any details of what is going on?

Microsoft GDI+ WMF File Processing Remote Code Execution Vulnerability

URL: http://www.securityfocus.com/bid/36619

Secunia Research: Microsoft Office BMP Image Colour Handling Integer Overflow

URL: http://www.securityfocus.com/archive/1/507174

The Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2003 SP3, Office XP Web Components SP3, Office 2003 Web Components SP3, Office 2003 Web Components SP1 for the 2007 Microsoft Office System, Internet Security and Acceleration (ISA) Server 2004 SP3 and 2006 SP1, and Office Small Business Accounting 2006 does not properly allocate memory, which allows remote attackers to execute arbitrary code via unspecified vectors that trigger “system state” corruption, aka “Office…

URL: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-0562

<!–
Envelope-to: email@address
Delivery-date: Mon, 27 Jul 2009 22:22:29 +0100
Received: from outgoing.securityfocus.com ([205.206.231.27] helo=outgoing3.securityfocus.com)
by lt.network5.net with esmtp (Exim 4.43)
id 1MVXeP-0004ru-8D
for email@address; Mon, 27 Jul 2009 22:22:29 +0100
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing3.securityfocus.com (Postfix) with QMQP
id 7CBE42371F8; Mon, 27 Jul 2009 15:19:13 -0600 (MDT)
Mailing-List: contact <a
href=”mailto:bugtraq-help@securityfocus.com”>bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: &lt;bugtraq.list-id.securityfocus.com&gt;
List-Post: &lt;mailto:bugtraq@securityfocus.com&gt;
List-Help: &lt;mailto:bugtraq-help@securityfocus.com&gt;
List-Unsubscribe: &lt;mailto:bugtraq-unsubscribe@securityfocus.com&gt;
List-Subscribe: &lt;mailto:bugtraq-subscribe@securityfocus.com&gt;
Delivered-To: mailing list <a
href=”mailto:bugtraq@securityfocus.com”>bugtraq@securityfocus.com
Delivered-To: moderator for <a
href=”mailto:bugtraq@securityfocus.com”>bugtraq@securityfocus.com
Received: (qmail 10596 invoked from network); 27 Jul 2009 21:15:21 -0000
Content-class: urn:content-classes:message
MIME-Version: 1.0
Subject: RE: computer crime statistics
X-MimeOLE: Produced By Microsoft Exchange V6.5
Date: Mon, 27 Jul 2009 15:15:13 -0600
Content-Type: multipart/signed;
micalg=SHA1;
protocol=&quot;application/x-pkcs7-signature&quot;;
boundary=&quot;—-=_NextPart_000_057C_01CA0ECD.09DC2F70&quot;
Message-ID: &lt;631BA9640B7F2246936CD03153E2F92E20F909@Libmail2.ualibrary.ualberta.ca&gt;
In-Reply-To: &lt;001a01ca0dfa$d7dde8b0$8799ba10$@com&gt;
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
Thread-Topic: computer crime statistics
Thread-Index: AcoN+oX+xKj011IHRImdAYPfW8fNdQAADRdwAEEC6NA=
References: &lt;001a01ca0dfa$d7dde8b0$8799ba10$@com&gt;
From: &quot;McDonnell, Michael&quot; &lt;michael.mcdonnell@ualberta.ca&gt;
To: &quot;Choon Ming&quot; &lt;choonming2002@gmail.com&gt;,
&lt;bugtraq@securityfocus.com&gt;,
&lt;full-disclosure-bounces@lists.grok.org.uk&gt;
X-IMAPbase: 1176125385 9714
Status: O
X-UID: 9714
Content-Length: 5925
X-Keywords:

Microsoft DirectX DirectShow Length Record Remote Code Execution Vulnerability

URL: http://www.securityfocus.com/bid/35616

Vuln: Microsoft ISA Server Radius OTP Authentication Bypass Vulnerability

Microsoft ISA Server Radius OTP Authentication Bypass Vulnerability

URL: http://www.securityfocus.com/bid/35631

Microsoft Silverlight vs Google Wave: Why Karma Matters

Inevitable comparisons are made between the hugely enthusiastic developer response (including from us at Zoho) to Google Wave yesterday with the relatively tepid reponse to Microsoft’s new search engine Bing. The real interesting contrast to us, as independent software developers, is the way developers responded to Silverlight as opposed to the reaction yesterday to Google Wave. Both Silverlight and Wave are aimed at taking the internet experience to the next level. To be perfectly honest, Silverlight is a great piece of technology. Google Wave, as yet, is not much more than a concept and an announcement.

It is easy to dismiss all this with “Oh, the press just loves to hype everything Google, and loves to hate Microsoft,” but that cannot explain why even competitors like us are willing to embrace Google’s innovations, but stay away from perfectly good innovations from Microsoft, such as Silverlight?

URL: http://www.hackinthebox.org/index.php?name=News&file=article&sid=31537

Microsoft DirectShow Remote Code Execution Vulnerability

Summary:

Fortinet’s FortiGuard Global Security Research Team investigates a vulnerability in Microsoft DirectX (DirectShow) through a specially crafted QuickTime media file.

Impact:

Remote Code Execution.

Affected Software:

• DirectX 7.0 on Microsoft Windows 2000 Service Pack 4
• DirectX 8.1 on Microsoft Windows 2000 Service Pack 4
• DirectX 9.0 on Microsoft Windows 2000 Service Pack 4
• DirectX 9.0 on Windows XP Service Pack 2 and Windows XP Service Pack 3
• DirectX 9.0 on Windows XP Professional x64 Edition Service Pack 2
• DirectX 9.0 on Windows Server 2003 Service Pack 2
• DirectX 9.0 on Windows Server 2003 x64 Edition Service Pack 2
• DirectX 9.0 on Windows Server 2003 with SP2 for Itanium-based Systems

Solutions:

• The FortiGuard Global Security Research Team released a signature “MS.DirectShow.NULL.Byte.Overwrite”, which covers this specific vulnerability.

The FortiGuard Global Security Research Team continues to monitor attacks against this vulnerability.

Fortinet customers who subscribe to Fortinetˇ¦s intrusion prevention (IPS) service should be protected against this remote code execution vulnerability. Fortinetˇ¦s IPS service is one component of FortiGuard Subscription Services, which also offer comprehensive solutions such as antivirus, Web content filtering and antispam capabilities. These services enable protection against threats on both application and network layers. FortiGuard Services are continuously updated by the FortiGuard Global Security Research Team, which enables Fortinet to deliver a combination of multi-layered security intelligence and true zero-day protection from new and emerging threats. These updates are delivered to all FortiGate, FortiMail and FortiClient products. Fortinet strictly follows responsible disclosure guidelines to ensure optimum protection during a threat’s lifecycle.

References:

• Microsoft Security Advisory: http://www.microsoft.com/technet/security/advisory/971778.mspx
• CVE ID: CVE-2009-1537

URL: http://www.fortiguardcenter.com/advisory/FGA-2009-20.html

Microsoft DirectShow vulnerability, (Thu, May 28th)

Microsoft have recently announced aMicrosoft DirectShow vulnerability via an advisory and multiple blog entries.
The advisory indicates that Microsoft are investigating public reports of a vulnerability within the DirectShow element of DirectX – CVE-2009- 1537 has been allocated to this vulnerability.
Microsoft have published quite a detailed set of actions which provide a temporary workaround for this issue to prevent the download of a crafted QuickTime formated file.
The following information has been posted:
blogs.technet.com/msrc/default.aspx />

www.microsoft.com/technet/security/advisory/971778.mspx />

blogs.technet.com/srd/ /> In the advisory Microsoft have indicated that a patch will be produced for this but give no timescales. To reduce the potential risk you should consider the impact of applying the workaround versus the period of nil-protection whilst it’s MAPP/MSRA partners get definitions out for detection, etc.
SecurityFocus have reported that targeted exploits of this issue have been seen in the wild.

URL: http://isc.sans.org/diary.php?storyid=6481&rss

Tool Release: Technitium MAC Address Changer v5 R3 (FREEWARE) Released

Posted by Shreyas Zare on May 29

Hi,

I am happy to announce that Technitium MAC Address Changer v5 R3 has
been released. Release 3 adds support for Microsoft Windows
Vista/Server 2008 Service Pack 2. Visit tmac.technitium.com for
more information and to download the software.

Technitium MAC Address Changer allows you…

URL: http://seclists.org/pen-test/2009/May/0065.html

New Windows zero-day

Microsoft on Thursday issued a security advisory for a new vulnerability in DirectX, used on Windows to enable graphics and sound, that could enable a remote hacker to execute arbitrary code if users open specially crafted QuickTime files. Microsoft said that it was aware of active attacks using exploit code for the vulnerability. Windows 2000 (SP4), Windows XP, and Windows Server 2003 are vulnerable; all versions of Windows Vista and Windows Server 2008 are not. ˇX CAM

URL: http://feedproxy.google.com/~r/SCMagazineHome/~3/ia20FTYLVFQ/

Microsoft Security Advisory (971778): Vulnerability in Microsoft DirectShow Could Allow Remote Code Execution – 5/28/2009

Revision Note: Advisory published. Advisory Summary:Microsoft is investigating new public reports of a new vulnerability in Microsoft DirectX. The vulnerability could allow remote code execution if user opened a specially crafted Quicktime media file. Microsoft is aware of limited, active attacks that use this exploit code. While our investigation is ongoing, our investigation so far has shown that Windows 2000 Service Pack 4, Windows XP, and Windows Server 2003 are vulnerable; all versions of Windows Vista and Windows Server 2008 are not vulnerable. Microsoft has activated its Software Security Incident Response Process (SSIRP) and is continuing to investigate this issue.

URL: http://www.microsoft.com/technet/security/advisory/971778.mspx

Vuln: Microsoft DirectX DirectShow QuickTime Video Remote Code Execution Vulnerability

Microsoft DirectX DirectShow QuickTime Video Remote Code Execution Vulnerability

URL: http://www.securityfocus.com/bid/35139

Bugtraq: New paper: Understanding Microsoft’s KB971492 IIS WebDAV Vuln

New paper: Understanding Microsoft’s KB971492 IIS WebDAV Vuln

URL: http://www.securityfocus.com/archive/1/503857