forwardone
12-25-04, 01:39 PM
More Windows vulnerabilities found. :(
Experts warn of new Windows vulnerabilities
Symantec's Security Response has issued a warning about three new "serious" vulnerabilities discovered in the Windows operating system.
"We believe these threats to be serious, especially given the time of year that they have been discovered," said Alfred Huger, senior director of Symantec Security Response. "Many consumers are shopping on-line and many businesses are short-staffed making these threats more worrisome. Two out of these three vulnerabilities could potentially be used to install malicious code such as spyware on an unsuspecting victim's computer, and take complete control of their computer."
The vulnerabilities were initially reported by Venustech Security Labs. Patches for these vulnerabilities are not currently available, and Microsoft has not yet confirmed the flaws exist. But Symantec Security Response says it believes that the risks posed by these reported vulnerabilities are "high," and has issued an alert to users of the operating system.
The Microsoft Windows LoadImage API Function Integer Overflow Vulnerability is a remotely exploitable vulnerability in Windows image processing. It exists in the LoadImage API instruction used by many Web browsers and e-mail clients. This security flaw can be exploited by simply visiting a malicious website, or opening an HTML e-mail containing an image that has malicious code hidden in it. No interaction from the user is required to activate the malicious code once an imagine has been viewed.
The Microsoft Windows winhlp32.exe Heap Overflow Vulnerability has been reported in the winhlp32.exe application, which is used to interpret Windows Help files (.hlp). The vulnerability is a result of decoding errors that manifest themselves in the parsing of a malicious help file. These decoding errors are exploitable to cause a heap-based buffer overflow. Malicious help files, encountered either through e-mail, or via a malicious website, may be used to exploit this vulnerability.
A third vulnerability, the Microsoft Windows Kernel ANI File Parsing Crash and DoS Vulnerability, results in a denial of service when a malicious ANI file is encountered. Exploitation of this security hole, either via e-mail or a malicious website, will result in a crash and subsequent restart of any vulnerable system, Symantec says. This vulnerability simply requires a user to view a malicious website or e-mail in order to launch an attack on the computer.
Until these issues are patched, any interaction with Internet-based content using any software package for the Microsoft Windows platform may result in a compromise, Symantec warns. The company recommends its customers update their virus definitions with the latest updates, which includes the Bloodhound.Exploit.19 signature. This signature will prevent exploitation of the Microsoft Windows LoadImage API Function Integer Overflow flaw.
Until patches are available for the other vulnerabilities, Symantec's security experts recommend blocking all e-mail attachments with the .hlp extension; avoiding untrusted or new websites; and reading e-mail messages only in plain text format. They also advise that people should not open e-mail messages from unknown sources.
Geoff
Experts warn of new Windows vulnerabilities
Symantec's Security Response has issued a warning about three new "serious" vulnerabilities discovered in the Windows operating system.
"We believe these threats to be serious, especially given the time of year that they have been discovered," said Alfred Huger, senior director of Symantec Security Response. "Many consumers are shopping on-line and many businesses are short-staffed making these threats more worrisome. Two out of these three vulnerabilities could potentially be used to install malicious code such as spyware on an unsuspecting victim's computer, and take complete control of their computer."
The vulnerabilities were initially reported by Venustech Security Labs. Patches for these vulnerabilities are not currently available, and Microsoft has not yet confirmed the flaws exist. But Symantec Security Response says it believes that the risks posed by these reported vulnerabilities are "high," and has issued an alert to users of the operating system.
The Microsoft Windows LoadImage API Function Integer Overflow Vulnerability is a remotely exploitable vulnerability in Windows image processing. It exists in the LoadImage API instruction used by many Web browsers and e-mail clients. This security flaw can be exploited by simply visiting a malicious website, or opening an HTML e-mail containing an image that has malicious code hidden in it. No interaction from the user is required to activate the malicious code once an imagine has been viewed.
The Microsoft Windows winhlp32.exe Heap Overflow Vulnerability has been reported in the winhlp32.exe application, which is used to interpret Windows Help files (.hlp). The vulnerability is a result of decoding errors that manifest themselves in the parsing of a malicious help file. These decoding errors are exploitable to cause a heap-based buffer overflow. Malicious help files, encountered either through e-mail, or via a malicious website, may be used to exploit this vulnerability.
A third vulnerability, the Microsoft Windows Kernel ANI File Parsing Crash and DoS Vulnerability, results in a denial of service when a malicious ANI file is encountered. Exploitation of this security hole, either via e-mail or a malicious website, will result in a crash and subsequent restart of any vulnerable system, Symantec says. This vulnerability simply requires a user to view a malicious website or e-mail in order to launch an attack on the computer.
Until these issues are patched, any interaction with Internet-based content using any software package for the Microsoft Windows platform may result in a compromise, Symantec warns. The company recommends its customers update their virus definitions with the latest updates, which includes the Bloodhound.Exploit.19 signature. This signature will prevent exploitation of the Microsoft Windows LoadImage API Function Integer Overflow flaw.
Until patches are available for the other vulnerabilities, Symantec's security experts recommend blocking all e-mail attachments with the .hlp extension; avoiding untrusted or new websites; and reading e-mail messages only in plain text format. They also advise that people should not open e-mail messages from unknown sources.
Geoff