BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Microsoft Patch Tuesday – January 2011

Posted January 11, 2011    Chris Silva

The ebb and flow of Microsoft Security Bulletins continued this month, with a nice slow release of only two bulletins to follow up the record set in December. Unfortunately, neither of these two bulletins patched any of the zero-day vulnerabilities that are currently affecting Microsoft products.

Microsoft continued to patch DLL preloading vulnerabilities, this time updating Windows Backup Manager on Vista (MS11-001). This is the seventh security bulleting Microsoft has released to address a DLL preloading vulnerability in one of their products. And remember from last month, it is a good idea to follow the mitigation steps outlined in KB2269637 as numerous other third-party software products are affected and unpatched.

Join Marc Maiffret and the eEye Research team tomorrow (January 12) at 11AM PST for this month’s vulnerability expert forum (VEF). Because of the small number of bulletins, tomorrow’s VEF should have ample time to discuss trends in the security industry and to answer any questions that you may have. Listeners will have a chance to win an Amazon Kindle, so make sure to sign up and listen.

Here are our recommendations for the two security updates. You can find our full write-up in newsletter format here. Retina Network Security Scanner customers can view the list of audits associated with these bulletins.

CRITICAL

MS11-002 Vulnerabilities in Microsoft Data Access Components Could Allow Remote Code Execution (2451910)

  • Analysis
    There are two vulnerabilities in Microsoft Data Access Components, both allowing for remote code execution in the context of the local user. A user must visit a specially crafted web page in order for the vulnerability to be exploited; once a user has visited a malicious page, an attacker may gain complete control of the system if the user is running as an administrator.
  • Recommendations
    Administrators are urged to patch immediately, however there is one mitigating factor and one workaround to help lessen the impact of these vulnerabilities:

    CVE-2011-0026 is not exploitable under the default Windows configuration.
    – A third-party application that uses ODBC (Open Database Connectivity) APIs in an insecure way must be installed on the system in order to be vulnerable.

    CVE-2011-0027 may be mitigated by setting the Internet and local Intranet zones to “High” within Internet Explorer or by configuring Internet Explorer to prompt the user before running Active Scripting.
    – In Internet Explorer, click the Security Tab –> Internet –> Custom Level.
    * Under Settings, in the Scripting section, under Active Scripting click “Prompt or Disable”.
    – Go back to the Security Tab –> Local Intranet –> Custom Level.
    * Under Settings, in the Scripting section, under Active Scripting click “Prompt or Disable”.

IMPORTANT

MS11-001 – Vulnerability in Windows Backup Manager Could Allow Remote Code Execution (2478935)

  • Analysis
    Windows Backup Manager contains a vulnerability when loading DLLs, causing susceptibility to DLL preloading attacks. Files that are opened with Windows Backup Manager, such as .wbcat, from attacker controlled locations (e.g. a WebDAV server or other untrusted location) could allow the attacker to execute arbitrary code in the context of the local user. This vulnerability only affects Windows Vista (both 32-bit and 64-bit).
  • Recommendations
    dministrators are urged to install the patch; however, there is a workaround that may be used to help mitigate this threat:
    Disable loading of libraries from remote network locations (http://support.microsoft.com/kb/2264107).

Leave a Reply

Additional articles

{c4eae211-3ca2-4f8e-b2b9-6df0e970aab1}_g.markhardy

The “insider” threat. Is it real, or is it being blown out of proportion?

Posted March 4, 2015    G. Mark Hardy

A lot depends on whether or not you’ve been compromised. And therein lies the problem. Cyber threats are often ignored until they cause some damage, at which point management looks for people to blame and gives all kinds of attention to fixing the problem – until the next crisis in accounting or warehousing or staffing comes along.

Tags:
, , ,
webinar_chalk

Webinar March 4th: Recreating the Carbanak Breach & Techniques for Mitigating Similar Attacks

Posted March 3, 2015    Lindsay Marsh

Join BeyondTrust Research and Development team for an in-depth live webinar that will explore the attack vectors used in the Carbanak Bank Breach and share successful mitigation techniques needed to prevent this type of attack.

Tags:
, ,
VMware Hardening Guidelines-img3

How to Audit VMware ESX and ESXi Servers Against the VMware Hardening Guidelines with Retina CS

Posted February 27, 2015    BeyondTrust Research Team

Retina CS Enterprise Vulnerability Management has included advanced VMware auditing capabilities for some time, including virtual machine discovery and scanning through a cloud connection, plus the ability to scan ESX and ESXi hosts using SSH. However, in response to recent security concerns associated with SSH, VMware has disabled SSH by default in its more recent…

Tags:
, , , ,