Hackers exploit new Windows flaw

Today’s bug patches and security alerts:

Malicious hackers busy exploiting Windows flaw

Fully patched systems running Windows XP and Windows Server 2003 can be successfully attacked by malicious hackers, various security firms warned Tuesday and Wednesday. The attacks can be carried out thanks to a newly discovered vulnerability in those operating systems’ handling of corrupted .WMF (Windows Metafile) graphic files, the firms said. IDG News Service, 12/28/05.

http://www.networkworld.com/news/2005/122805-windows-flaw.html

CERT advisory:

https://www.us-cert.gov/cas/techalerts/TA05-362A.html

ISS advisory:

https://xforce.iss.net/xforce/alerts/id/211

**********

Google plugs security holes in Web site

Google has patched security flaws in its Web site that would have exposed users to phishing and other attacks designed to steal account information, according to security researchers. IDG News Service, 12/22/05.

http://www.networkworld.com/news/2005/122205-google-holes.html

Watchfire advisory:

https://www.watchfire.com/securityzone/advisories/12-21-05.aspx

**********

Recent advisories from Mandriva:

php (e-mail header flaw):

https://wwwnew.mandriva.com/security/advisories?name=MDKSA-2005:238

cpio (buffer overflow, code execution):

https://wwwnew.mandriva.com/security/advisories?name=MDKSA-2005:237

fetchmail (denial of service):

https://wwwnew.mandriva.com/security/advisories?name=MDKSA-2005:236

kernel (multiple flaws):

https://wwwnew.mandriva.com/security/advisories?name=MDKSA-2005:235

**********

Ubuntu patches kernel

Multiple flaws have been found in the kernels used by various Linux vendors. An attacker could exploit the flaws to run arbitrary code on the affected machine. For more, go to:

http://www.networkworld.com/go2/0102bug1a.html

**********

Recent updates from Debian:

dhis-tools-dns (poorly secured temp files):

https://www.debian.org/security/2005/dsa-928

tkdiff (poorly secured temp files):

https://www.debian.org/security/2005/dsa-927

ketm (buffer overflow, code execution):

https://www.debian.org/security/2005/dsa-926

phpbb2 (multiple flaws):

https://www.debian.org/security/2005/dsa-925

**********

Recent patches from Gentoo:

scponly (multiple flaws):

https://security.gentoo.org/glsa/glsa-200512-17.xml

OpenMotif, AMD64 x86 emulation X libraries (multiple buffer overflows):

https://security.gentoo.org/glsa/glsa-200512-16.xml

rssh (root privileges):

https://security.gentoo.org/glsa/glsa-200512-15.xml

Dropbear (root privileges):

https://security.gentoo.org/glsa/glsa-200512-13.xml

Mantis (multiple flaws):

https://security.gentoo.org/glsa/glsa-200512-12.xml

**********

Today’s roundup of virus alerts:

W32/Dasher-D — A new Dasher variant that tries to disable anti-virus and other security programs running on the infected host. It spreads by exploiting a known Windows vulnerability and drops a number of files on the host, including “Sqltob.exe”. (Sophos)

W32/Nosun-A — A virus that displays the message “Your computer refuses to execute that program on sundays.” on Sundays and “I hate love, i love hate!” on the 23rd of any given month. (Sophos)

W32/Crutle-A — A peer-to-peer worm that drops “WinExec.exe” in the Windows folder. It spreads through the Kazaa file-sharing network by disguising itself behind provocatively titled files. (Sophos)

W32/Rbot-ALO — An Rbot variant that spreads through network shares, dropping “npmsys.exe” in the Windows System folder. It can allow backdoor access via IRC and is used for a number of malicious purposes, including creating an FTP/Web/Proxy server and logging key presses. (Sophos)

W32/Rbot-BHQ — Another Rbot variant that spreads through network shares by exploiting weak passwords and known Windows flaws. It drops “windows32.exe” in the Windows System folder. (Sophos)

W32/Rbot-BGH — Our third Rbot variant of the day in installed as “sysmsn.exe” in the Windows System folder. (Sophos)

W32/Rbot-BFR — Rbot variant No 4 of the day uses the file “winsrt.exe” as its infection point. It too allows backdoor access via IRC. (Sophos)

W32/Hazif-C — A passwords stealing Trojan that spreads through the Yahoo messenger service. (Sophos)

Troj/Horst-C — A keylogging Trojan that drops a number of files in the Windows System folder, including “wsock32.exe”. It displays a fake error message when infecting the host. (Sophos)

W32/Loosky-M — This virus is said to spread through network attachments, but no details are given. It does drop “sachostx.exe” in the Windows folder and a number of similarly named files in the Windows System directory. (Sophos)

W32/Loosky-K — A second, similar Loosky variant. It uses the same file names as Loosky-M above. (Sophos)

W32/Sdbot-AKZ — A new Sdbot variant that drops “spoolss.exe” in the Windows System folder after spreading through a network share. It allows backdoor access via IRC. (Sophos)

W32/Sdbot-TQ — A second new Sdbot variant that allows backdoor access via IRC. It is installed as “WindowsSP2.exe” in the Windows System folder. (Sophos)

W32/Mytob-GK — A mass-mailing worm that can be used to harvest additional e-mail addresses. It drops “winsvc32.exe” in the Windows System folder and changes the HOSTS file to prevent access to security-related Web sites. (Sophos)

W32/Mytob-GF — Another Mytob mass-mailing worm that uses a message that looks like a security or account warning message. Instead of an attachment, the message provides a link to a malicious Web site. If clicked, “mqSSl;.exe” is installed in the Windows System directory. (Sophos)

Troj/Vixup-U — This virus is used to download additional malicious code to the infected machine. The original virus drops “kernels64.exe” in the Windows System folder. (Sophos)

W32/Brontok-L — A virus that harvests e-mail addresses from the infected machine and changes Internet Explorer settings. The virus drops “RakyatKelaparan.exe” on the infected host. (Sophos)

W32/Brontok-J — A second Brontok variant that can close Windows that have “.exe” in the title. (Sophos)

Troj/Feutel-B — A Trojan that installs a backdoor for downloading additional malicious code and can be used a keystroke logger. It drops “svchost.exe” or “sb.exe” in the Windows System folder. (Sophos)

Troj/RKNu-A — A rootkit for the Windows platform that tries to hide itself from discovery. (Sophos)

Troj/Bancban-LF — A Trojan that is used to target Internet banking Web sites. It drops “install.exe” in the Windows System directory. (Sophos)

Troj/Agent-TM — This Trojan communicates with pre-configured remote servers via HTTP. It is installed as “UpdaterUI.exe” in the Windows System folder. (Sophos)

Troj/Spyaks-B — A Trojan that downloads additional malicious code from remote sites and displays the popup message “Your computer is infected!”. (Sophos)

W32/Erkez-G — A peer-to-peer and e-mail worm that drops “AntiVirus Update.exe” in the Windows System folder. (Sophos)

W32/Chode-Q — A virus with IRC backdoor capability that spreads through the MSN and AOL instant messaging platforms. It is installed as “csrss.exe” in the Windows System folder. (Sophos)

W32/Tilebot-GS — A Tilebot variant that provides backdoor access via IRC and spreads through network shares by exploiting known Windows flaws. It drops “nvidcgui.exe” in the Windows folder and “remon.sys” in the Windows System directory. (Sophos)

Troj/Raker-B — A Trojan that is installed as “msjcf.exe” in the Windows System folder. (Sophos)

Troj/Bagle-AS — A new Bagle variant that drops “wintems.exe” in the Windows System folder and can allow backdoor access through a random port between 2000 to 50000. (Sophos)

W32/Bagle-EX — This Bagle variant spreads through messages titled “Happy New Year!” and drops “wind2ll2.exe” in the Windows System folder. (Sophos)

W32/Bagle-AR — The third Bagle variant that drops “windll2.exe” in the Windows System folder. (Sophos)

Troj/Small-FQ — This Trojan can be used to download and run additional malicious code to the infected host. It is installed as “snake.exe” in the Windows directory. (Sophos)

Troj/Banload-H — A virus that tries to silently download and install additional code from pre-configured Web sites via HTTP. (Sophos)

W32/Bobax-N — This Bobax variant spreads through e-mail with messages that say Osama Bin Laden has been captured or Saddam Hussein has been killed. It installs a randomly named file in the Windows System machine. (Sophos)

Troj/Torpig-U — Another virus that communicates with remote servers via HTTP. It installs “Microsoft SharedWeb Foldersibm00001.exe” on the infected machine. (Sophos)