Vulnerabilita’ in Microsoft Windows Internet Printing Service (953155)

Pubblicato il 18 10 2008 da Silvio Passalacqua

Descrizione del problema

Questo aggiornamento di sicurezza risolve una vulnerabilita’
relativa al Microsoft Windows Internet Printing Service.

La vulnerabilita’ consente ad un attaccante remoto di eseguire codice
arbitrario nel contesto dell’utente corrente.

:: Software e Sistemi affetti

Microsoft Windows 2000 SP4

Microsoft Windows XP SP2
Microsoft Windows XP SP3

Microsoft Windows XP Professional x64
Microsoft Windows XP Professional x64 SP2

Microsoft Windows Server 2003 SP1
Microsoft Windows Server 2003 SP2

Microsoft Windows Server 2003 x64
Microsoft Windows Server 2003 x64 SP2

Microsoft Windows Server 2003 per Itanium SP1
Microsoft Windows Server 2003 per Itanium SP2

Microsoft Windows Vista
Microsoft Windows Vista SP1

Microsoft Windows Vista x64
Microsoft Windows Vista x64 SP1

Microsoft Windows Server 2008 per sistemi 32-bit
Microsoft Windows Server 2008 per sistemi x64
Microsoft Windows Server 2008 per sistemi Itanium

:: Impatto

Esecuzione remota di codice arbritario

:: Soluzioni

Applicare la patch segnalata nel bollettino Microsoft MS08-062
http://www.microsoft.com/technet/security/bulletin/ms08-062.mspx

:: Riferimenti

Microsoft Security Bulletin MS08-062
http://www.microsoft.com/technet/security/bulletin/ms08-062.mspx

FrSirt:
http://www.frsirt.com/english/advisories/2008/2813

SecurityFocus:
http://www.securityfocus.com/bid/31682

CVE Mitre:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1446

Pubblicato in Sicurezza | Contrassegnato , , , , , , , , , , , , , , , , , , , , , | Commenti disabilitati su Vulnerabilita’ in Microsoft Windows Internet Printing Service (953155)

Vulnerabilita’ in Microsoft SMB (957095)

Pubblicato il 17 10 2008 da Silvio Passalacqua

Descrizione del problema

Questo aggiornamento di sicurezza risolve una vulnerabilita’
relativa a Microsoft Server Message Block Protocol (SMB).

La vulnerabilita’ consente ad un attaccante remoto di eseguire codice
arbitrario.

:: Software e Sistemi affetti

Microsoft Windows 2000 SP4

Microsoft Windows XP SP2
Microsoft Windows XP SP3

Microsoft Windows XP Professional x64
Microsoft Windows XP Professional x64 SP2

Microsoft Windows Server 2003 SP1
Microsoft Windows Server 2003 SP2

Microsoft Windows Server 2003 x64
Microsoft Windows Server 2003 x64 SP2

Microsoft Windows Server 2003 per Itanium SP1
Microsoft Windows Server 2003 per Itanium SP2

Microsoft Windows Vista
Microsoft Windows Vista SP1

Microsoft Windows Vista x64
Microsoft Windows Vista x64 SP1

Microsoft Windows Server 2008 per sistemi 32-bit
Microsoft Windows Server 2008 per sistemi x64
Microsoft Windows Server 2008 per sistemi Itanium

:: Impatto

Esecuzione remota di codice arbritario

:: Soluzioni

Applicare la patch segnalata nel bollettino Microsoft MS08-063
http://www.microsoft.com/technet/security/bulletin/Ms08-063.mspx

:: Riferimenti

Microsoft Security Bulletin MS08-063
http://www.microsoft.com/technet/security/bulletin/Ms08-063.mspx

FrSirt:
http://www.frsirt.com/english/advisories/2008/2814

Secunia:
http://secunia.com/advisories/32249/

SecurityFocus:
http://www.securityfocus.com/bid/31647

CVE Mitre:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4038

Pubblicato in Sicurezza | Contrassegnato , , , , , , , , , , , , , , , , , | Commenti disabilitati su Vulnerabilita’ in Microsoft SMB (957095)

Oracle Critical Patch Update (Ottobre 2008)

Pubblicato il 16 10 2008 da Silvio Passalacqua

Descrizione del problema

Oracle ha rilasciato una Critical Patch Update Ottobre 2008.
Tale aggiornamento e’ una collezione di patch nata per porre
soluzione a 36 difetti di sicurezza presenti in vari prodotti
Oracle.

:: Software interessato

Oracle Database 11g, version 11.1.0.6
Oracle Database 10g Release 2, versions 10.2.0.2, 10.2.0.3, 10.2.0.4
Oracle Database 10g, version 10.1.0.5
Oracle Database 9i Release 2, versions 9.2.0.8, 9.2.0.8DV

Oracle Application Server 10g Release 3 (10.1.3), versions
10.1.3.3.0, 10.1.3.4.0
Oracle Application Server 10g Release 2 (10.1.2), versions
10.1.2.2.0, 10.1.2.3.0
Oracle Application Server 10g (9.0.4), version 9.0.4.3

Oracle E-Business Suite Release 12, version 12.0.4
Oracle E-Business Suite Release 11i, version 11.5.10.2

Oracle PeopleSoft Enterprise PeopleTools versions 8.48.18, 8.49.14
Oracle PeopleSoft Enterprise Portal versions 8.9, 9.0

Oracle WebLogic Server (formerly BEA WebLogic Server) 10.0 released
through MP1, 10.3 GA
Oracle WebLogic Server (formerly BEA WebLogic Server) 9.0 GA, 9.1 GA,
9.2 released through MP3
Oracle WebLogic Server (formerly BEA WebLogic Server) 8.1 released
through SP6
Oracle WebLogic Server (formerly BEA WebLogic Server) 7.0 released
through SP7
Oracle WebLogic Server (formerly BEA WebLogic Server) 6.1 released
through SP7

Oracle Workshop for WebLogic (formerly BEA WebLogic Workshop) 10.0
released through MP1, 10.2 GA, 10.3 GA
Oracle Workshop for WebLogic (formerly BEA WebLogic Workshop) 9.0,
9.1, 9.2 released through MP3
Oracle Workshop for WebLogic (formerly BEA WebLogic Workshop) 8.1
released through SP6

:: Impatto

Security Bypass
Exposure of sensitive information
Privilege escalation
DoS
System access

L’impatto delle vulnerabilita’ varia in base alla configurazione
del sistema, del prodotto o della componente considerata.

:: Soluzioni

Applicare le patch appropriate o procedere all’opportuno
aggiornamento secondo le istruzioni rilasciate da Oracle:

http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujul2008.html

:: Riferimenti

Oracle Critical Patch Updates and Security Alerts
http://www.oracle.com/technology/deploy/security/alerts.htm

SecurityFocus
http://www.securityfocus.com/bid/31683

Mitre’s CVE ID
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4008
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4009
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4010
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4011
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4012
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4013
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4000
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4001
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4002
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4003
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4004
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3985
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3988
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3998
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3619
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3993
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3975
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3977
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3588
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3986
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3987
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3989
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2624
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3996
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3992
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3976
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3982
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3983
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3984
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3994
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3980
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4005
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2625
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3990
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3991

Pubblicato in Sicurezza | Contrassegnato , , , , , , , , , , , , , , , , , , , | Commenti disabilitati su Oracle Critical Patch Update (Ottobre 2008)

Vulnerabilita’ in Microsoft Office

Pubblicato il 16 10 2008 da Silvio Passalacqua

Descrizione del problema

Questo aggiornamento di sicurezza risolve una vulnerabilita’
relativa a Microsoft Office.

La vulnerabilita’ consente accesso ad informazioni sensibili se
l’utente visita siti web appositamente predisposti.

:: Software e Sistemi affetti

Microsoft Office XP SP3

:: Impatto

Accesso ad informazioni sensibili

:: Soluzioni

Applicare la patch segnalata nel bollettino Microsoft MS08-056
http://www.microsoft.com/technet/security/bulletin/ms08-056.mspx

:: Riferimenti

Microsoft Security Bulletin MS08-056
http://www.microsoft.com/technet/security/bulletin/ms08-056.mspx

FrSirt:
http://www.frsirt.com/english/advisories/2008/2807

Secunia:
http://secunia.com/advisories/32138/

SecurityFocus:
http://www.securityfocus.com/bid/31693

CVE Mitre:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4020

Pubblicato in Sicurezza | Contrassegnato , , , , , , , , , , , , , | Commenti disabilitati su Vulnerabilita’ in Microsoft Office

Vulnerabilita’ in Microsoft Message Queuing (951071)

Pubblicato il 16 10 2008 da Silvio Passalacqua

Descrizione del problema

Questo aggiornamento di sicurezza risolve una vulnerabilita’
relativa a Microsoft Message Queuing Service (MSMQ) su sistemi
Microsoft Windows 2000.

La vulnerabilita’ consente ad un utente remoto l’esecuzione di codice
arbitrario su sistemi Microsoft Windows 2000 che abbiano il servizio
MSMQ abilitato.
:: Software e Sistemi affetti

Microsoft Windows 2000 SP4

:: Impatto

Esecuzione da remoto di codice arbitrario

:: Soluzioni

Applicare la patch segnalata nel bollettino Microsoft MS08-065
http://www.microsoft.com/technet/security/bulletin/ms08-065.mspx

:: Riferimenti

Microsoft Security Bulletin MS08-065
http://www.microsoft.com/technet/security/bulletin/ms08-065.mspx

FrSirt:
http://www.frsirt.com/english/advisories/2008/2816

Secunia:
http://secunia.com/advisories/32260/

SecurityFocus:
http://www.securityfocus.com/bid/31637

CVE Mitre:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3479

Pubblicato in Sicurezza | Contrassegnato , , , , , , , , , , , , , , , , , , | Commenti disabilitati su Vulnerabilita’ in Microsoft Message Queuing (951071)

Vulnerabilita’ in Microsoft Virtual Address Descriptor (956841)

Pubblicato il 16 10 2008 da Silvio Passalacqua

Descrizione del problema

Questo aggiornamento di sicurezza risolve una vulnerabilita’
relativa a Microsoft Virtual Address Descriptor.

La vulnerabilita’ consente escalation di privilegi se un utente
esegue applicazioni appositamente predisposte.

:: Software e Sistemi affetti

Microsoft Windows XP SP2
Microsoft Windows XP SP3

Microsoft Windows XP Professional x64
Microsoft Windows XP Professional x64 SP2

Microsoft Windows Server 2003 SP1
Microsoft Windows Server 2003 SP2

Microsoft Windows Server 2003 x64
Microsoft Windows Server 2003 x64 SP2

Microsoft Windows Server 2003 per Itanium SP1
Microsoft Windows Server 2003 per Itanium SP2

Microsoft Windows Vista
Microsoft Windows Vista SP1

Microsoft Windows Vista x64
Microsoft Windows Vista x64 SP1

Microsoft Windows Server 2008 per sistemi 32-bit
Microsoft Windows Server 2008 per sistemi x64
Microsoft Windows Server 2008 per sistemi Itanium

:: Impatto

Escalation di privilegi

:: Soluzioni

Applicare la patch segnalata nel bollettino Microsoft MS08-064
http://www.microsoft.com/technet/security/bulletin/ms08-064.mspx

:: Riferimenti

Microsoft Security Bulletin MS08-064
http://www.microsoft.com/technet/security/bulletin/ms08-064.mspx

FrSirt:
http://www.frsirt.com/english/advisories/2008/2815

Secunia:
http://secunia.com/advisories/32251/

SecurityFocus:
http://www.securityfocus.com/bid/31675

CVE Mitre:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4036

Pubblicato in Sicurezza | Contrassegnato , , , , , , , , , , , , , , , | Commenti disabilitati su Vulnerabilita’ in Microsoft Virtual Address Descriptor (956841)

Gli ufo cambiano idea e vanno a Shangay

Pubblicato il 15 10 2008 da Silvio Passalacqua

come preannunciato ieri, una cosa di aliena doveva accadere infatti gli omini verdi hanno pensato di andare a Shangay come riporta un video a voi le considerazioni del caso !

Ne abbiamo parlato ieri qui

Pubblicato in Bufale e Hoax, Leggende Metropolitane, Storielle e Aneddoti | Contrassegnato , , , , , , , , , , , , , , , | Commenti disabilitati su Gli ufo cambiano idea e vanno a Shangay

FALSA E-MAIL MICROSOFT KB584432.exe VIRUS Security Update for OS Microsoft Windows

Pubblicato il 15 10 2008 da Silvio Passalacqua

NON APRITE LA FALSA E-MAIL DELLA MICROSOFT CHE STA ARRIVANDO IN QUESTI GIORNI !

DA : Microsoft Customer Service” <customerservice@microsoft.com>

OGGETTO : Security Update for OS Microsoft Windows

SEGUE TESTO E ALLEGATO DI 33 KB

QUESTA E-MAIL E’ ASSOLUTAMENTE FALSA E DANNOSA GLI AUTORI DELLA MAIL IN OGGETTO HANNO UTILIZZATO UN SERVER NELLA REPUBBLICA CECA, NULLA A CHE FARE CON I SERVER MICROSOFT.

ALLEGO TESTO E-MAIL :

Dear Microsoft Customer,

Please notice that Microsoft company has recently issued a Security Update for OS Microsoft Windows. The update applies to the following OS versions: Microsoft Windows 98, Microsoft Windows 2000, Microsoft Windows Millenium, Microsoft Windows XP, Microsoft Windows Vista.

Please notice, that present update applies to high-priority updates category. In order to help protect your computer against security threats and performance problems, we strongly recommend you to install this update.

Since public distribution of this Update through the official website http://www.microsoft.com would have result in efficient creation of a malicious software, we made a decision to issue an experimental private version of an update for all Microsoft Windows OS users.

As your computer is set to receive notifications when new updates are available, you have received this notice.

In order to start the update, please follow the step-by-step instruction:
1. Run the file, that you have received along with this message.
2. Carefully follow all the instructions you see on the screen.

If nothing changes after you have run the file, probably in the settings of your OS you have an indication to run all the updates at a background routine. In that case, at this point the upgrade of your OS will be finished.

We apologize for any inconvenience this back order may be causing you.

Thank you,

Steve Lipner
Director of Security Assurance
Microsoft Corp.

—–BEGIN PGP SIGNATURE—–
Version: PGP 7.1

0849JB5RD2VW1QL4NWFGQUL1LDPE49EPZHWG85DIC99Z9CZ9Z7SR9J7JLD1FY61TJ
6NXM1VC8DTKWAI9PSPH9T8SD2JSPH1L0EL8M968TUEHSG5UFTHUQUD95RNU3DKRQ6
4FO81Y6QTTK452ORNUVXKI8HB8TU0N4F1TGWVJ9KQQ8W3UNG2VV3AN5Q7GZVQ2PFF
B87089F03JDELY8ZJ11XUF7NILGF8D8S9QT14YS2LYLMVM478NDMDNK4H263S8KIC
66UB1N5V47OLP117AAZVQUZ9TE966UDXJFK==
—–END PGP SIGNATURE—–

SEGUE ANALISI DETTAGLIATA VIRUS

AhnLab-V3 – – Win-Trojan/Goldun.33398.B
AntiVir – – TR/Drop.HeadJoe.N
Authentium – – W32/Trojan3.CI
Avast – – Win32:Trojan-gen {Other}
AVG – – BackDoor.Haxdoor.EJ
BitDefender – – Trojan.PWS.Goldun.SZR
CAT-QuickHeal – – TrojanSpy.Goldun.bce
ClamAV – – Trojan.Goldun-305
DrWeb – – Trojan.PWS.GoldSpy.2278
eSafe – – –
eTrust-Vet – – Win32/ProcHide.Z
Ewido – – –
F-Prot – – W32/Trojan3.CI
F-Secure – – Trojan-Spy.Win32.Goldun.bce
Fortinet – – W32/Goldun.BCE!tr.spy
GData – – Trojan.PWS.Goldun.SZR
Ikarus – – Trojan-Spy.Win32.Goldun.bce
K7AntiVirus – – –
Kaspersky – – Trojan-Spy.Win32.Goldun.bce
McAfee – – BackDoor-BAC.gen
Microsoft – – Backdoor:Win32/Haxdoor
NOD32 – – Win32/Spy.Goldun.NDO
Norman – – –
Panda – – Trj/Goldun.TL
PCTools – – Trojan-Spy.Goldun!sd6
Prevx1 – – Suspicious
Rising – – Trojan.Spy.Win32.Goldun.zzt
SecureWeb-Gateway – – Trojan.Drop.HeadJoe.N
Sophos – – Mal/EncPk-CZ
Sunbelt – – Goldun.Fam
Symantec – – Infostealer
TheHacker – – –
TrendMicro – – BKDR_HAXDOOR.MX
VBA32 – – Malware-Cryptor.Win32.General.2
ViRobot – – Trojan.Win32.Goldun.33398
VirusBuster – – TrojanSpy.Goldun.AQI
Informazioni addizionali
MD5: 1ffcb1ea024c228ade6d8dad681c6ed7
SHA1: f665f9a30e72d3d5f994993a6a7649d98b5a2686
SHA256: 87f9fa50a42a8761f29d4f44fba35f0d638bcbc0036e00f1b78632526d5f5432
SHA512: bf9299112d25a3f121825f852ca5c8caf0861beb750df9a21a9ba55b97f5a3380538ef305b007b71ae171ec9a72fd7a5061bd63641aaeec1c554956bc6dba7f5
Pubblicato in Exploits, Phishing e Truffe | Contrassegnato , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , | Commenti disabilitati su FALSA E-MAIL MICROSOFT KB584432.exe VIRUS Security Update for OS Microsoft Windows