Original URL: http://www.channelregister.co.uk/2007/04/11/new_microsoft_zerodays/
Hot on the heels of yesterday's batch of updates from Microsoft patching five critical Windows vulnerabilities (http://www.theregister.com/2007/04/11/ms_april_patch_tuesday/) come reports of new zero-day exploits, some that appear to allow the commandeering of a PC. They underscore a growing pattern in which miscreants release their payloads shortly before or after Patch Tuesday.
According to an entry (http://www.avertlabs.com/research/blog/?p=253) on the McAfee Avert Labs blog, "several" attacks exploiting weaknesses in Office were released in security forums on Monday. Also making the rounds is proof-of-concept code that attacks Windows.
Two of the flaws - one in Office and the other in Windows - involve heap overflow flaws and appear to allow the execution of code on a victim's machine. The Windows POC targets the handling of .HLP files. McAfee didn't provide details on the Office flaws, except to say that all but one appeared to result in a pesky, but much less critical, denial of service.
Microsoft says it is investigating the reports and isn't aware of any customers being targeted by the flaws. It also reiterated an advisory (http://support.microsoft.com/kb/925330/en-us) deeming .HLP files as unsafe unless the user is assured they are not malicious.
Among others, yesterday's patch binge fixed flaws in Universal Plug and Play, Windows CSRSS, Microsoft Agent and Microsoft Content Management Server. It also repaired a bug in last week's emergency patch of a critical hole in the way Windows processed animated cursors. Both the cursor vulnerability and CSRSS patch affected Windows Vista, which Microsoft has called its most secure operating system ever.
The simultaneous release of the patches and new zero-days is most likely not by accident. Malicious hackers know Microsoft is reluctant to issue out-of-schedule updates, so timing the release of malware around Patch Tuesday helps ensure a longer shelf life for their precious zero-day exploits. Prior to yesterday's report, Office already suffered from at least two zero-day vulnerabilities, according to eEye Security's zero-day tracker (http://research.eeye.com/html/alerts/zeroday/index.html).
According to McAfee, the tally of patches released to date this year well exceeds the number for this time in 2006. Which either means the software behemoth is getting better at identifying and repairing flaws or its security assurances are only so much hot air. ®
Macrovision update plugs zero-day DRM exploit (6 November 2007)
http://www.channelregister.co.uk/2007/11/06/macrovision_drm_update/
MS update sends PCs 'haywire' (12 July 2007)
http://www.channelregister.co.uk/2007/07/12/ms_patch_problems/
MS Patch Tuesday to include trio of 'critical' fixes (5 July 2007)
http://www.channelregister.co.uk/2007/07/05/microsoft_july_patch_tuesday/
Vista and IE 7 to receive 'critical' fixes on Patch Tuesday (7 June 2007)
http://www.channelregister.co.uk/2007/06/07/microsoft_june_patch_tuesday/
Microsoft releases security tool for Office 2003 (22 May 2007)
http://www.channelregister.co.uk/2007/05/22/office_moice/
Seven flaws lanced in MS patch batch (9 May 2007)
http://www.channelregister.co.uk/2007/05/09/ms_may_patch_tuesday/
Critical DNS fix stars in upcoming Patch Tuesday (4 May 2007)
http://www.channelregister.co.uk/2007/05/04/ms_patch_tuesday_pre-alert/
Microsoft preps seven bulletins for Patch Tuesday (3 May 2007)
http://www.channelregister.co.uk/2007/05/03/patch_tuesday_outline/
Month of ActiveX bugs yields results (2 May 2007)
http://www.channelregister.co.uk/2007/05/02/moaxb_yields_results/
Poisoned MP4 files threaten Winamp users (2 May 2007)
http://www.channelregister.co.uk/2007/05/02/winamp_0-day/
0wning Vista from the boot (26 April 2007)
http://www.channelregister.co.uk/2007/04/26/vbootkit_authors_interview/
Notes on Vista forensics (16 April 2007)
http://www.channelregister.co.uk/2007/04/16/vista_forensics_2/
Attacks exploit Windows DNS server flaw (13 April 2007)
http://www.channelregister.co.uk/2007/04/13/windows_dns_flaw/
Wanna copy of Windows XP next year? Forget it (12 April 2007)
http://www.channelregister.co.uk/2007/04/12/windows_vista_xp_withdrawal/
Britney fears used as ANI exploit lure (5 April 2007)
http://www.channelregister.co.uk/2007/04/05/britney_ani_malware_lure/
The rise of zero-day patches (2 March 2007)
http://www.channelregister.co.uk/2007/03/02/zero-day_patches_interviews/
Microsoft probes new Office vulnerability (15 February 2007)
http://www.channelregister.co.uk/2007/02/15/office_vuln/
Hackers target unpatched Office flaw (5 February 2007)
http://www.channelregister.co.uk/2007/02/05/0-day_office_flaw/
Bug brokers offering higher bounties (25 January 2007)
http://www.channelregister.co.uk/2007/01/25/bug_brokers_offering_higher_bouties/
Third unpatched vuln menaces Word (15 December 2006)
http://www.channelregister.co.uk/2006/12/15/word_flaw_three/
Trojan targets unpatched Word flaw (again) (11 December 2006)
http://www.channelregister.co.uk/2006/12/11/0-day_word_flaw/
Unpatched Word flaw menaces civilisation (6 December 2006)
http://www.channelregister.co.uk/2006/12/06/unpatched_word_flaw/
Attackers end-run around IE security (8 November 2006)
http://www.channelregister.co.uk/2006/11/08/ie_security_analysis/
Targeted Trojan attacks on the rise (15 October 2006)
http://www.channelregister.co.uk/2006/10/15/targeted_trojan_attacks_on_the_rise/
Another day, another zero-day MS exploit (28 September 2006)
http://www.channelregister.co.uk/2006/09/28/0-day_powerpoint_threat/
© Copyright 2008