Microsoft Security Advisory (951306)

Vulnerability in Windows Could Allow Elevation of Privilege

Microsoft is investigating new public reports of a vulnerability which could allow elevation of privilege from authenticated user to LocalSystem, affecting Windows XP Professional Service Pack 2 and all supported versions and editions of Windows Server 2003, Windows Vista, and Windows Server 2008. Customers who allow user-provided code to run in an authenticated context, such as within Internet Information Services (IIS) and SQL Server, should review this advisory. Hosting providers may be at increased risk from this elevation of privilege vulnerability.

Currently, Microsoft is not aware of any attacks attempting to exploit the potential vulnerability. Upon completion of this investigation, Microsoft will take the appropriate action to protect our customers, which may include providing a solution through a service pack, our monthly security update release process, or an out-of-cycle security update, depending on customer needs.

General Information

Purpose of Advisory: To provide customers with the initial notification and provide additional information regarding the impact to Windows service accounts. For more information, see the Workarounds and Suggested Actions sections of the security advisory.

Advisory Status: Advisory published.

Recommendation: Review the suggested actions and configure as appropriate.

This advisory discusses the following software.

Frequently Asked Questions

Originally posted at Photo Matt

Since people are asking, this so-called alert on Security Focus appears to be completely false and has no information that an attacker or the WordPress developers could use. It is completely content-free, except for making claims that every version of WP since 2.0 is vulnerable.

Online, apparently, it’s fine for someone to run into a crowded theatre and yell “fire” and the less basis there is in fact the more people link to them. It’s not uncommon to see crying-wolf reports like the above several times in a week, and a big part of what the WP security team is sifting through things to see what’s valid or not.  [More ...]

Secunia Advisory: SA29526
Release Date: 2008-03-26
Critical: Highly critical

Description:
Some vulnerabilities and weaknesses have been reported in Mozilla Firefox, which can be exploited by malicious people to bypass certain security restrictions, disclose potentially sensitive information, conduct cross-site scripting and phishing attacks, and potentially compromise a user’s system.

1. An unspecified error in the handling of “XPCNativeWrappers” can lead to the execution of arbitrary Javascript code with the user’s privileges via “setTimeout()” calls.

2. Various errors in the handling of Javascript code can be exploited to conduct cross-site scripting attacks or execute arbitrary code.

3. Various errors in the layout engine can be exploited to cause a memory corruption.

4. Various errors in the Javascript engine can be exploited to cause a memory corruption.

Successful exploitation of these vulnerabilities may allow execution of arbitrary code.

5. An error within the handling of HTTP “Referer:” headers sent with requests to URLs containing “Basic Authentication” credentials having an empty username can be exploited to bypass cross-site request forgery protections.

6. The problem is that Firefox offers a previously configured private SSL certificate when establishing connections to webservers requesting SSL Client Authentication. This can potentially be exploited to disclose sensitive information via a malicious webserver.

7. An error in the handling of the “jar:” protocol can be exploited to establish connections to arbitrary ports on the local machine.

8. An error when displaying XUL pop-up windows can be exploited to hide the window’s borders and facilitate phishing attacks.

The vulnerabilities are reported in versions prior to 2.0.0.13.

Solution:
Update to version 2.0.0.13.

Provided and/or discovered by:
1. moz_bug_r_a4
2. moz_bug_r_a4, Boris Zbarsky, and Johnny Stenback
3. Tom Ferris, Seth Spitzer, Martin Wargers, John Daggett, and Mats Palmgren
4. georgi, tgirmann, and Igor Bukanov
5, 7. Gregory Fleischer
6. Peter Brodersen and Alexander Klink
8. Chris Thomas

Original Advisory:
http://www.mozilla.org/security/announce/2008/mfsa2008-14.html
http://www.mozilla.org/security/announce/2008/mfsa2008-15.html
http://www.mozilla.org/security/announce/2008/mfsa2008-16.html
http://www.mozilla.org/security/announce/2008/mfsa2008-17.html
http://www.mozilla.org/security/announce/2008/mfsa2008-18.html
http://www.mozilla.org/security/announce/2008/mfsa2008-19.html

Other References:
SA27311: http://secunia.com/advisories/27311/

Bugtraq ID: 27812
Class: Design Error
Remote: Yes
Local: No
Published: Feb 15 2008 12:00AM
Updated: Feb 15 2008 11:05PM
Credit: carl hardwick is credited with the discovery of this issue.

Mozilla Firefox is prone to a remote denial-of-service vulnerability because of the way the browser handles IFrames.

Attackers can exploit this issue to make the browser unresponsive and cause denial-of-service conditions.

Firefox 2.0.0.12 is vulnerable; other versions may also be affected.

Bad day for Firefox, Opera, and SeaMonkey users. All three browsers received updates today to patch multiple vulnerabilities.

Some vulnerabilities have been reported in Opera, where one vulnerability has an unknown impact and others can be exploited by malicious people to conduct cross-site scripting attacks and to compromise a user’s system.

Opera may launch external email or newsgroup clients incorrectly. This can be exploited to execute arbitrary commands by e.g. visiting a malicious website.

Successful exploitation requires that the user has configured an external email or newsgroup client.

An error when processing frames from different websites can be exploited to bypass the same-origin policy. This allows to overwrite functions of those frames and to execute arbitrary HTML and script code in a user’s browser session in context of other sites.

An unspecified error exists in Opera in combination with Adobe Flash Player 9.0.47.0 and earlier on Mac OS X. No further information is currently available.

The vulnerabilities are reported in all versions of Opera for Desktop prior to version 9.24.

Opera users are urged to update to version 9.24 http://www.opera.com/download/

Some vulnerabilities and a weakness have been reported in Mozilla Firefox, which can be exploited by malicious people to disclose sensitive information, conduct phishing attacks, manipulate certain data, and potentially compromise a user’s system.

Various errors in the browser engine can be exploited to cause a memory corruption.

Various errors in the Javascript engine can be exploited to cause a memory corruption.

Successful exploitation of these vulnerabilities may allow execution of arbitrary code.

An error in the handling of onUnload events can be exploited to read and manipulate the document’s location of new pages.

Input passed to the user ID when making an HTTP request using Digest Authentication is not properly sanitised before being used in a request. This can be exploited to insert arbitrary HTTP headers into a user’s request when a proxy is used.

An error when displaying web pages written in the XUL markup language can be exploited to hide the window’s title bar and facilitate phishing attacks.

An error exists in the handling of “smb:” and “sftp:” URI schemes on Linux systems with gnome-vfs support. This can be exploited to read any file owned by the target user via a specially crafted page on the same server.

Successful exploitation requires that the attacker has write access to a mutually accessible location on the target server and the user is tricked into loading the malicious page.

An unspecified error in the handling of “XPCNativeWrappers” can lead to execution of arbitrary Javascript code with the user’s privileges via subsequent access by the browser chrome (e.g. when a user right-clicks to open a context menu).

Firefox users are urged to update to version 2.0.0.8.

SeaMonkey users are urged to update to version 1.1.5

NOTE: Additional fixes have been added to prevent the exploitation of a URI handling vulnerability in Microsoft Windows.

Thunderbird users are urged to update to version 2.0.0.8. Thunderbird uses the Firefox engine and is susceptible to the same exploits.

Note: (Saturday, 20 October, 2007) Thunderbird 2.0.0.8 has not yet been released.

Update: (Wednesday, 24 October, 2007) Thunderbird 2.0.0.8 release on hold. Possible forth coming release of Firefox 2.0.0.9 to fix bugs introduced in FF 2.0.0.8.