Microsoft Word Memory Corruption Remote Code Execution Vulnerability |
|
A vulnerability exists in Microsoft Word due to a memory corruption error when processing crafted RTF files. A remote attacker could exploit this vulnerability to execute arbitrary code on vulnerable systems. | |
Technical Analysis |
|
Microsoft Word is a word processing application included as a part of the Microsoft Office suite. A vulnerability exists in Microsoft Word 2003, 2007, 2010, 2013, and 2013 RT; Microsoft Word Viewer; the Microsoft Office Compatibility Pack; Microsoft Office for Mac 2011; Microsoft SharePoint Server 2010 and 2013; and Microsoft Office Web Apps 2010 and Office Web Apps Server 2013 due to improper handling of objects in memory when parsing RTF files. Parsing a specially crafted RTF file may allow remote attackers to corrupt memory and execute arbitrary code on vulnerable systems with the privileges of the logged on user. Successful exploitation may lead to a system compromise if the user operates with administrative privileges. | |
Solution |
|
The vendor has released an update to address this vulnerability. Users of Microsoft Word should apply Microsoft Fix it 51010, which can be downloaded from https://support.microsoft.com/kb/2953095. | |
References |
|
Page 3 of 7
Ok…well, maybe not 99 – But I told my wife I’d send these to her and I forgot too…so I’m posting them here so y’all can be aware of them too.
Android Hole Allows Data Capture
http://www.isssource.com/android-hole-allows-data-capture/
Android.HeHe: Malware Now Disconnects Phone Calls
http://www.fireeye.com/blog/technical/2014/01/android-hehe-malware-now-disconnects-phone-calls.html
Windows Malware Attempts to Infect Android Devices
http://www.symantec.com/connect/blogs/windows-malware-attempts-infect-android-devices
So there are a few others that are in the works and I can’t fully disclose just yet, but as soon as I figure them out or someone else posts them in public – I’ll update this thread and let ya know…I’ll give you a hint:
Multiple vulnerabilities exist in Google Chrome for Android due to unspecified security flaws. A remote attacker could exploit these vulnerabilities to cause an unknown impact on vulnerable systems.
Yes…it’s a new year – and I suck at posting to this blog b/c facebook has pwned me something awful. But hey…I just wanted to post so that you know I still exist. Here I am…
Intego, a Mac security company, was the first to report seeing a new Mac Trojan that attempts to create a backdoor on its victim’s system. The article indicates this attack appears to be a targeted attack by an unknown delivery mechanism. Intego reported that the command and control (C&C) server appeared to be down at the time of the article. During their testing, the Trojan attempted to download an image that implied links to the Syrian Electronic Army. We advise our Mac users to review the article closely for more details. In some cases, Gatekeeper may issue an alert should a user attempt to download the Trojan. We highly advise that all operating system and application patches as well as anti-virus definition files are at their latest versions. Readers should also be wary of unsolicited emails with attachments. Applications should only be downloaded from trusted, known sources.
http://www.intego.com/mac-security-blog/new-mac-trojan-discovered-related-to-syria/
Microsoft has issued a Security Advisory (2887505) detailing a zero day vulnerability that affects all versions of Microsoft Internet Explorer. While it appears that this attack is currently only exploiting Windows XP and Windows 7 in a limited geographical region, hackers will be able to examine the patch and may produce a more wide spread attack.
Strongly recommend that you begin installing the Microsoft “Fix it” described in the Advisory.
http://technet.microsoft.com/en-us/security/advisory/2887505
http://www.trusteer.com/blog/trusteer%E2%80%99s-exploit-prevention-stops-attacks-targeting-new-ie-zero-day-cve-2013-3893
https://community.qualys.com/blogs/laws-of-vulnerabilities/2013/09/17/september-2013–new-ie-0-day
http://www.symantec.com/connect/blogs/new-internet-explorer-zero-day-found-targeted-attacks
F-Secure’s Timo Hirvonen has spotted a Java 6 Zero-Day in the wild that is exploiting the vulnerability, CVE-2013-2463, a few days after proof-of-concept code was published. He also indicated that the exploit has been integrated into the Neutrino exploit kit. Successful exploitation could allow an attacker to execute arbitrary code after tricking the victim into visiting a malicious web page. Readers are advised to update to Java 7 Update 25 if Java 6 is still deployed. Users that don’t require Java in their daily duties may consider uninstalling Java.
http://news.softpedia.com/news/Java-6-Zero-Day-Spotted-in-the-Wild-Users-Advised-to-Update-to-Java-7-378432.shtml
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2463
http://www.f-secure.com/weblog/archives/00002589.html
Multiple Vulnerabilities in PuTTY
An updated version of PuTTY, a very popular free SSH, Telnet and Serial client, addresses a number of vulnerabilities. The vulnerabilities could lead to heap corruption, memory overwriting, buffer overflow and data left in memory. Potential impacts are reported to be limited to denial of service conditions and leakage of sensitive information. We recommend updating to the lastest fixed version, 0.63, promptly.
http://www.chiark.greenend.org.uk/~sgtatham/putty/
Firefox Updates Address Remote Code Execution Vulnerabilities
The Mozilla Foundation has released new versions of Firefox that address thirteen vulnerabilities in the Firefox web browser. Of the thirteen vulnerabilities, four are rated by Mozilla as critical, seven as high, one as moderate and one as low. The most serious potential impact of the vulnerabilities is the remote execution of arbitrary code. Links to the details of each of the individual vulnerabilities can be found in the Mozilla security advisory. We recommend updating to the latest fixed versions as soon as possible.
http://www.mozilla.org/security/announce/
The end of an era…
I’m working on shutting down my colo server this week. I’ve been running this server and others like it since EfNet IRC war and hell days. It was early 1997 when I took the reigns of the.mafia and began running dual servers in a world of excitement. We pulled our weight with the best of the best back then. Changing over to x-mafia and starting the crimelords server was a new splinter in life. We turned more towards protecting channels and offering mob like protection Continue reading