Maximum PC vulnerabilities RSS Feed

Microsoft Discusses OS Vulnerabilities, Dangerous Software

Paul Lilly — Tue, 28 Jul 2009 15:00:50 -0500

During the Black Hat conference in Las Vegas this week, Microsoft plans to provide a progress report on the security initiatives that it launched last summer, as well as release new security tools to better equip IT professionals and security researchers.

"There's a race between attackers and defenders and if we want to win, we have to share information, said Mike Reavey, director of the Microsoft Security Response Center.

One way the software maker plans to do this is by releasing the Microsoft Office Visualization Tool, a utility which provides a graphical overview of the Office binary file format. According to Microsoft, the software will make it easier for programmers to understand how attacks target Office files, noting that most malware attacks application vulnerabilities and not the OS itself.

"In order to build protections, you have to understand how a specific file format is meant to be used, so then you can understand how it's being misused," Reavey added.

During the conference, Microsoft also plans to release Project Quant, an online information resource designed to provide organizations with a framework for evaluating the cost of patch management processes. In addition, the company also plans to release the Microsoft Security Update Guide, a publication that explains the entire Microsoft update process, and a publish a report titled, "Building a Safer, More Trusted Internet Through Information Sharing."

China Testing Green Dam for Mac OSX and Still Pushing Ahead Despite Security Warnings

Justin Kerr — Sat, 04 Jul 2009 16:25:26 -0500

Despite recently announced delays in China’s requirement to include Green Dam anti-pornography software on new PCs, the initiative is far from dead. PC makers who unanimously decried the hasty July 1st deadline managed to buy themselves an extension, but are still being told they to comply with the new requirements. The Chinese Ministry of Industry and Information Technology re-affirmed its commitment to Green Dam Youth Escort on Thursday, and claims that it sees the software as being an important tool for protecting young people from pornography and violence on the internet. To further reinforce its commitment to total penetration, software publisher Jinhui has been told to write a Mac OSX version of the software, and it is currently in beta testing.

Critics of the Green Dam filtering software continue to question the motivation behind the initiative, and have accused the Ministry of using the software to further political repression. This may be a valid concern when you consider that the Ministry in charge of Green Dam’s implantation is also responsible for suppressing illegal political activity. The situation for the Chinese gets even worse when you consider that several industry tests have shown multiple security vulnerabilities in the filtering software, and it even appears to have a high occurrence of false positives in the filtering algorithm. The vulnerabilities are considered so serious in fact, that Sony is including a disclaimer with all new PCs.

Will Linux be the only safe haven for the Chinese?

China’s War Against Pornography Targets Google

Justin Kerr — Sun, 28 Jun 2009 14:10:58 -0500

The Chinese Health Ministry has been waging a very public war against pornography lately, and although they appeared to be softening their approach, new developments on Thursday have left Google scrambling. In what some people are calling “a rigged demo”, a CCTV state-owned television monopoly broadcast an interview demonstrating the dangers of the Google Suggested Search feature which attempts to auto complete simple search terms with popular related queries. At one point during the interview, when the host typed the word “son” into Google, a suggested search was returned stating, “abnormal relationship between son and mother”.

Google has formally commented on the matter, and has explained that the suggested search feature is based on popularity. In their defense, Google claims that nobody had entered this phrase for several months, but the term suddenly became popular in Beijing in the days leading up to the show. Though this is hardly conclusive evidence of a conspiracy, it certainly falls into the category of “suspicious” if true. Regardless, Google claims to be working on a new system that would help it remove all traces of pornography from its Chinese database, but describes it as “a major engineering effort”. "Google has been working to remove pornography from our search results in China, in accordance with our operating license there," the company said.

Google already filters a significant amount of political content from its search results, and critics fear that further censorship will only complicate the efforts of rights activists. It is also worth noting that the government agency charged with cracking down on pornography, is also responsible for suppressing illegal political activity. American officials have been critical of knee jerk restrictions on companies trying to comply with Chinas increasing demand for pornography censorship, and I’m sure we will hear more on this issue in the coming months.

What do you think of the ongoing developments in China?

Image Credit: floriswiegerinck.nl

CyberSitter Code Found in China Censorship Software

Mark Edward Soper — Thu, 18 Jun 2009 16:51:23 -0500

What do Solid Oak Software's CyberSitter and China's Green Dam Youth Escort Internet filtering programs have in common? According to the BBC, the answer is CyberSitter code. The BBC reports that both Solid Oak's Brian Milburn and a report from the University of Michigan conclude that the developer of Green Dam Youth Escort, Computer System Engineering Inc, have incorporated code from CyberSitter into Green Dam - without a license.

According to the China Daily, Solid Oak is sending "cease and desist" letters to HP and Dell to stop shipping computers bundled with Green Dam, and may seek legal action against the developers. The legal-technical drama is being played out against the background of China's requirement that all new systems sold as of July 1 include Green Dam, as we reported last week.

Green Dam now appears to be taking steps to clean up its act. Version 3.174 of Green Dam has been modified from earlier versions, according to an updated report from the University of Michigan dated today (June 18th). The new version does not use blacklist files from CyberSitter and makes other changes to help improve security, although the researchers conclude the software is still vulnerable to attacks. Stay tuned to MaximumPC.com for more in the continuing saga of Green Dam.

Image adapted from Wikimedia Commons image.

China's New Censorship Software a Potential "Large-Scale Disaster"

Mark Edward Soper — Fri, 12 Jun 2009 14:21:23 -0500

The Chinese government is requiring all PC makers selling into the China market to bundle Green Dam Youth Escort web filtering software as of July 1, as we reported earlier this week. This software, already widely used in China's schools and elsewhere, has plenty of flaws, BBC News reports:

Unencrypted connections between client PCs and the company's servers, which could lead to information theft or the PCs being turned into botnet nodes for malware attacks
Filtering only Internet Explorer browsers, not Firefox
Support only for Microsoft Windows
Inaccurate web site blocking
Potential privacy risks for users because the software logs all web pages the user attemps to access

Right now, it seems as if Green Dam Youth Escort is incapable of meeting its specified goals of "healthy development of the internet" and "effectively manag[ing] harmful material for the public and prevent it from being spread," while providing a terrific opportunity for malware providers. Have you encountered similar problems with web filtering software? Hit Comment to sound off.

A Patch Tuesday "Two-Fer" Secures Both Microsoft and Adobe Programs

Mark Edward Soper — Thu, 11 Jun 2009 19:11:41 -0500

June 9th saw a rare 'double-header' in security updates: Microsoft's monthly Patch Tuesday was joined by Adobe's quarterly security updates for Acrobat and Adobe Reader. How big was this month's 10-update Patch Tuesday? According to a Microsoft spokesperson quoted by Cnet, the 31 vulnerabilities covered by updates are "the most since Microsoft started releasing updates on a regular schedule of the second Tuesday of every month in October 2003."

Here's what Microsoft patched this week:

Critical remote code execution vulnerabilities in Active Directory on Windows 2000 Server, Windows Server 2003, and ADAM on Windows Server 2003 and Windows XP Professional (MS09-018)

Critical to Moderate remote code execution vulnerabilities in Windows Print Spooler in Windows 2000 SP4, Windows XP SP2/SP3 and x64, Windows Server 2003 SP2 and x64 SP2, Windows Vista RTM/SP1/SP2 and x64 and Windows Server 2008 RTM/SP2 (MS09-022).

Critical to Moderate remote code execution vulnerabilities in IE5.01, IE6, IE 6SP1, IE7, and IE8. Note that IE8 in Windows 7 RC is not included (MS09-019).

Critical to Important remote code execution vulnerabilities in Microsoft Office Word 2000, 2002 (XP), 2003, and 2007 for Windows; 2004 and 2008 for Mac, Open XML converter for Mac; Microsoft Office Word Viewers and Compatibility Packs for 2007 file formats SP1 and SP2 (MS09-027).

Critical to Important remote code execution vulnerabilities in Microsoft Office Excel 2000, 2002 (XP), 2003, and 2007 for Windows; 2004 and 2008 for Mac, Open XML converter for Mac; Microsoft Office Excel Viewers and Compatibility Packs for 2007 file formats SP1 and SP2 (MS09-021).

Critical to important remote code execution vulnerabilities for Microsoft Works 8.5, 9 and Office 2000 SP3, Office XP SP3, Office 2003 SP3, and Office 2007 SP1 (MS09-024).

Important elevation of privilege vulnerabilities in the RPC function in Windows 2000 SP4, Windows XP SP2/SP3 and x64, Windows Server 2003 SP2 and x64 SP2, Windows Vista RTM/SP1/SP2 and x64 and Windows Server 2008 RTM/SP2 (MS09-026).

Important elevation of privilege vulnerabilities in Windows Kernel in Windows 2000 SP4, Windows XP SP2/SP3, Windows Server 2003 SP2 and x64 SP2, Windows Vista RTM/SP1/SP2 and x64 and Windows Server 2008 RTM/SP2 (MS09-025).

Important elevation of privilege vulnerabilities in IIS 5.0, 5.1, and 6.0 when running on Windows 2000 SP4, Windows XP SP2/SP3 and x64 SP2, and Windows Server 2003 SP2 and x64 SP2 (MS09-020).

Moderate information disclosure vulnerabilities in Windows Search 4.0 when running on Windows XP SP2, SP3, x64 SP2; Windows Server 2003 SP2 and x64 SP2 only (MS09-023).

For details about the exploitability rating for each vulnerability (1-3, 1 being the most severe), see the security bulletin summary. To find out about Windows Media Center and other updates, and where to get the Adobe updates, join us on page 2.

Microsoft also rolled out these updates in June:

The June 2009 version of the Windows Malicious Software Removal Tool (KB890830)
The June 2009 update for the Windows Mail Junk email filter (KB905866)
Cumulative updates for Windows Media Center for Windows Vista (KB967632) and Windows Media Center TV Pack for Windows Vista (KB966315)
An update to the ActiveX kill bits security pack (KB969898).

Adobe was also busy sticking its fingers in the security dike this month, rolling out critical security update APSB09-07 with updates for Adobe Reader and Acrobat 9.x, 8.x, and 7.x. Vulnerabilities patched by the updates include stack overflow, integer overflow, memory corruption and heap overflow, all of which could be used to trigger arbitrary code execution.

Stay safe out there!

February's Patch Tuesday Has Something for Everyone

Mark Edward Soper — Mon, 09 Feb 2009 10:48:26 -0600

Whether you're using Windows and IE, managing Microsoft Exchange or SQL Server at work, or using Microsoft Office, this month's Patch Tuesday has a security update for you. All four security bulletins address Remote Code Execution vulnerabilities in recent and current service packs for each product listed:

IE 7: Windows XP, Windows Vista, Windows Server 2003
Microsoft Office: Visio 2002, 2003, 2007
SQL: SQL Server 2000 Desktop Engine on Windows 2000 and Windows Server 2003; Windows Internal Database (WYukon) on Windows Server 2003 and Windows Server 2008; SQL Server 2000 and SQL Server 2005
Exchange Server: Exchange 2000 Server, Exchange Server 2003, Exchange Server 2007

But Wait, There's More!

Other updates to be released tomorrow include:

Cumulative Update for Windows Vista Media Center (KB960544)
Cumulative Update for Windows Vista Media Center TVPack (KB958653)
Upgrade Rollup for ActiveX Killbits for Windows (KB960715)
February 2009 updates for Windows Mail Junk Email Filter (KB905866) and Windows Malicious Software Removal Tool (KB890830)

For details, look up the KB article numbers starting Tuesday.