secpod.org

MS09-050 addresses the much talked about SMB2 Negotiation vulnerability. A crafted SMB packet could crash the Windows Vista/2008 systems with blue screen.

The OpenVAS plugin for checking MS09-050 hotfix is now available in the svn. This doesn’t require any credentials. The patched system responds differently to a particular SMB negotiation request (a crafted PID’s low_id field) from an un-patched system. The response is verified to confirm if the patch is installed. This has been tested on Windows Vista and 2008.

OpenVAS plugins for Microsoft Security Bulletins - July 2009 are now available in the SVN repository. The plugins can be also synced via openvas-nvt-sync method.

There were 6 bulletins in total, including the much in-news Video ActiveX control (MS09-032)

The news…

Passing the 10000th Network Vulnerability Test (NVT) is a perfect occasion to report about the progress of the OpenVAS project[1].

In October 2008 the systematic development of new NVTs started with a base of around 5800 Tests. With the release of OpenVAS 2.0 in December 2008, the development was boosted and has now reached an average of 10 code updates per day.  The public OpenVAS NVT Feed Service delivers 3-10 new vulnerability tests every day.

The significantly grown and globally distributed developer team will gather at the second OpenVAS developers conference[2] July 9-12 2009 in Germany. During the conference features and a roadmap for OpenVAS 3.0 will be scheduled.

The OpenVAS project is backed by a number of companies, which also supplement the project with professional services[3]. These companies include Greenbone Networks, SecPod, Intevation and SecuritySpace.
“Reaching the professional enterprise market is a good indicator that OpenVAS gained maturity very fast” says Tim Brown, founder of the OpenVAS project.

While OpenVAS 3.0 will likely appear in 2009, users of OpenVAS 1.0 should prepare to migrate as support for 1.0 will end during 2009.

Regards,

Michael Wiegand

[1] http://www.openvas.org
[2] http://www.openvas.org/openvas-devcon2.html
[3] http://www.openvas.org/professional-services.html

OpenVAS plugins for Microsoft Bulletins - April 2009 are now available in OpenVAS. Update your OpenVAS plugins by running openvas-nvt-sync or download from the SVN directly.

Conficker worm variants A, B and C are dependent on vulnerability in Microsoft server service. Microsoft had released an advisory MS08-067 back in October 2008 to address the above vulnerability. As was expected at that time, number of attacks are spreading, major one being Conficker worm.

We have plugins for OpenVAS,
900055 - secpod_ms08-067_900055.nasl
900056 - secpod_ms08-067_900056.nasl

to detect patch condition of MS08-067. The plugin 900055 requires SMB credentials and verifies if the required hotfix is installed through Windows Registry and verifying the updated file versions. The plugin 900056 is a Proof of Concept exploit that tries to crash the server service (safe_checks has to be disabled). This can work on anonymous login credentials if the target system allows anonymous login (Windows 2000 by default allows anonymous login). The plugin checks the RPC response status of an un-patched system.

If your system is found to be vulnerable, make sure to run the AV scanners to see if you are infected by Conficker worm. All major AV vendors have signature. Manual procedure to verify if you are infected is and also to clean is available at,

http://download.nai.com/products/mcafee-avert/documents/combating_w32_conficker_worm.pdf

We had earlier released SecPod plugin for Nessus for MS08-067, vulnerability. The plugin required SMB credentials for it to work.

We have now made available the exploit code for the much talked about vulnerability in here. This has been tested with Nessus and OpenVAS and works well on Microsoft Windows 2000, XP and 2003. This doesn’t require any credentials to be supplied. Since this crashes the server service on the target system (Windows 2000 system restarts), you’ll have to restart the server service. Exercise caution!

The advisory released by Microsoft yesterday, MS08-067, calls for immediate update. The vulnerability is actively being exploited. We have the SecPod plugin for Nessus and OpenVAS available here, scan your system quickly and run the missing update.

Microsoft Bulletins - Sept08

There are 4 security bulletins released addressing 8 security vulnerabilities and all are Critical.

1. MS08-052 - GDI+ Remote Code Execution Vulnerability

2. MS08-053 - Windows Media Encoder 9 Remote Code Execution Vulnerability

3. MS08-054 - Windows Media Player Remote Code Execution Vulnerability

4. MS08-055 - Microsoft Office Remote Code Execution Vulnerability

More details can be found here. Also we have released SecPod Plugins for Nessus.

One critical vulnerability, MS08-052 requires considerable effort to deploy the patches. When we did a search for gdiplus.dll (vulnerable file), in one of the system, it returned 23 different locations where it exists and all are of different sizes and file versions. This indicates that each applications have been embedded with different version of GDI+ library.

First step towards applying the patch would be manually downloading the patches from Microsoft Bulletin and applying each of them listed against category of applications. Windows Automatic Update will not help here. Secondly, list out all the applications that are using GDI+ (search for gdiplus.dll) and try and see if you can overwrite those files with the latest versions (This may not work for all applications, as each is bundled with different versions and size). Apply thought while using these applications. Hopefully each vendor will update their software seperately and soon.