Feeds

MS patches insecurity trio

Word, SQL, Help

  • alert
  • submit to reddit

5 things you didn’t know about cloud backup

Another bundle of three security issues in Microsoft products came out this week. Among them is a nasty bug in Windows-XP Help Center allowing the deletion of entire directories, as we reported a few weeks ago.

A malicious file request, the syntax of which resembles a URL, can be embedded in a Web page or an HTML e-mail. MS rolled the fix silently into SP-1 without making a public announcement at the time. The hole was discovered by Shane Hird of Distributed Systems Technology Centre, who first reported it to MS on 25 June 2002. Now there is apparently a separate patch for the issue, and MS has come forward with the dirt. In typical fashion the company also treats the announcement with far-fetched, PR-driven stretchers and face savers, as we can see from their list of 'mitigating factors'.

The vulnerability can only be exploited with "some degree of user interaction," MS says. "Even in the most attacker-favorable case, the Help and Support Center window would appear unexpectedly and the file deletion could not occur until the user responded. (Even selecting Cancel, though, would enable the deletion to occur). If the user killed the process rather than responding, the deletion could not occur."

That's right, MS considers this a mitigating factor. But wait, there's an even more desperate one: "For an attack to be successful, the user would need to visit a Web site under the attacker's control or receive an HTML e-mail from the attacker."

Which is another way of saying the deletions don't occur spontaneously.

Next, there's a bug in SQL Server allowing privilege escalation which can be exploited locally and remotely if Web tasks are used. A stored procedure fails to set permissions properly when executed and runs with the privileges of the SQL Server. An un-privileged user can run, delete, insert and update Web tasks, according to MS. The flaw affects SQL Server 2K, SQL Server 7, Data Engine 1.0 and Desktop Engine 2K. It was discovered by David Litchfield of NGSS Software and reported to MS on 23 August. Additional details and patches are available here.

Finally, a bit of a stuff up with Word and Excel which can compromise user privacy but isn't harmful to data and offers no system privileges to an attacker. The flaw affects Word 97, Word 2000, Word 2002, Excel 2002 and Word for Mac. It also affects Outlook and OE where Word is used as the editor.

Field codes, often used to automate the insertion of boilerplate in documents, can be perverted to allow an attacker to use external updates to steal data from other files on a victim's system. In a typical scenario, the attacker sends a malicious document to a victim, and entices the victim to open it and return it. Because of the amount of user interaction needed, the fact that the attacker needs to know the name and location of the file he wants to steal, and the fact that field codes can easily be viewed by the victim, it is not thought to be a terribly serious threat. MS has devised patches, available here.

Secure remote control for conventional and virtual desktops

More from The Register

next story
One HUNDRED FAMOUS LADIES exposed NUDE online
Celebrity women victimised as Apple iCloud accounts reportedly popped
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
Rubbish WPS config sees WiFi router keys popped in seconds
Another day, another way in to your home router
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
New Snowden leak: How NSA shared 850-billion-plus metadata records
'Federated search' spaffed info all over Five Eyes chums
Three quarters of South Korea popped in online gaming raids
Records used to plunder game items, sold off to low lifes
prev story

Whitepapers

Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Advanced data protection for your virtualized environments
Find a natural fit for optimizing protection for the often resource-constrained data protection process found in virtual environments.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.