SpawnPoint

National Cyber Alert System

Technical Cyber Security Alert TA08-071A

Microsoft Updates for Multiple Vulnerabilities

Original release date: March 11, 2008

Last revised: --

Source: US-CERT

Systems Affected

* Microsoft Office

* Microsoft Outlook

* Microsoft Excel

* Microsoft Excel Viewer

* Microsoft Office for Mac

* Microsoft Office Web Componenets

Overview

Microsoft has released updates that address vulnerabilities in

Microsoft Office, Outlook, Excel, Excel Viewer, Office for Mac, and

Office Web Components.

I. Description

Microsoft has released updates to address vulnerabilities that affect

Microsoft Office, Outlook, Excel, Excel Viewer, Office for Mac, and

Office Web Components as part of the Microsoft Security Bulletin

Summary for March 2008. The most severe vulnerabilities could allow a

remote, unauthenticated attacker to execute arbitrary code. For more

information, see the US-CERT Vulnerability Notes Database.

II. Impact

A remote, unauthenticated attacker could execute arbitrary code, gain

elevated privileges, or cause a denial of service.

III. Solution

Apply updates from Microsoft

Microsoft has provided updates for these vulnerabilities in the March

2008 security bulletin. The security bulletin describe any known

issues related to the updates. Administrators are encouraged to note

these issues and test for any potentially adverse effects.

Administrators should consider using an automated update distribution

system such as Windows Server Update Services (WSUS).

IV. References

* US-CERT Vulnerability Notes for Microsoft March 2008 updates

- <

* Microsoft Security Bulletin Summary for March 2008

- <

* Microsoft Update - <

* Windows Server Update Services - <

_________________________________________________________________

The most recent version of this document can be found at:

<

_________________________________________________________________

Feedback can be directed to US-CERT Technical Staff. Please send

email to <cert@cert.org> with "TA08-071A Feedback VU#393305" in the

subject.

_________________________________________________________________

For instructions on subscribing to or unsubscribing from this

mailing list, visit <

_________________________________________________________________

Produced 2008 by US-CERT, a government organization.

Terms of use:

<

-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1.2.1 (GNU/Linux)

iQEVAwUBR9b0APRFkHkM87XOAQLTUwf9HHlM9vQfwMpmCv77RuJKdZgdn5bNTPQA

HjsABoxmVZzE4XnArclHPyMivO8x/oel6UFvZgG/h2oGFarK7h1WpvCFQKE/cNO8

c5o0tRhxMx+ri7w7DnkhmhbWTLQ8coqKjzAioKoc2mboNz+PamQO22INjS3ktOyL

dRA+qwxSsPN3Bi7NDS2DOdUeAA+VdMn0cQTDLHJ7ZPhzy7JOiVXwQwyO3CwNDeOl

C6+FGSk8o1BsMjdP6kRaGnQkgivBi1ID4dcAQA8h0K2IGDPkCBIYiGTvj9pNnpwZ

lrP6DdHyd2idzGEXr2R0VlTQPrhabs+YpZq+qzVh6f2tg+Lc9xBwHg==

=aCnE

-----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1

National Cyber Alert System

Technical Cyber Security Alert TA07-319A

Apple Updates for Multiple Vulnerabilities

Original release date: November 15, 2007

Last revised: --

Source: US-CERT

Systems Affected

* Apple Mac OS X version 10.3.x and 10.4.x

* Apple Mac OS X Server version 10.3.x and 10.4.x

These vulnerabilities affect both Intel-based and PowerPC-based Apple

systems.

Overview

Apple has released Mac OS X 10.4.11 and Security Update 2007-008 to

address multiple vulnerabilities affecting Apple Mac OS X and Mac OS X

Server. The most serious of these vulnerabilities may allow a remote

attacker to execute arbitrary code. Attackers may take advantage of

the less serious vulnerabilities to bypass security restrictions or

cause a denial of service.

I. Description

Apple Mac OS X 10.4.11 and Security Update 2007-008 address a number

of vulnerabilities affecting Apple Mac OS X and OS X Server. Further

details are available in the related vulnerability notes.

Several of the fixes included in this update address vulnerabilities

in products from other vendors that ship with Apple OS X or OS X

Server. These products include

* BIND

* bzip2

* Adobe Flash

* MIT Kerberos

Apple Mac OS X 10.4.11 and Security Update 2007-008 address

vulnerabilities for versions 10.3.x and 10.4.x.

II. Impact

The impacts of these vulnerabilities vary. Potential consequences

include remote execution of arbitrary code or commands, bypass of

security restrictions, and denial of service.

III. Solution

Install updates from Apple

Install Mac OS X 10.4.11 or Apple Security Update 2007-008. This and

other updates are available via Apple Update or via Apple Downloads.

IV. References

* Vulnerability notes for Apple Security Update 2007-008 -

<

* About the security content of Mac OS X 10.4.11 and Security Update

2007-008 - <

* Mac OS X: Updating your software -

<

* Apple downloads - <

* ISC BIND - <

* bzip2 : Home - <

* Adobe - Adobe Flash Player -

<

* Kerberos: The Network Authentication Protocol -

<

____________________________________________________________________

The most recent version of this document can be found at:

<

____________________________________________________________________

Feedback can be directed to US-CERT Technical Staff. Please send

email to <cert@cert.org> with "TA07-319A Feedback VU#498105" in the

subject.

____________________________________________________________________

For instructions on subscribing to or unsubscribing from this

mailing list, visit <

____________________________________________________________________

Produced 2007 by US-CERT, a government organization.

Terms of use:

<

____________________________________________________________________

Revision History

November 15, 2007: Initial release

-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1.2.1 (GNU/Linux)

iQEVAwUBRzx7ZvRFkHkM87XOAQJfIQgAmTZfjJAY/QTweUmvZtOJ9JQ4e/Gj0sE9

OPSrK/SplP92WUL1Ucb8I/VUSQEXXJhNv9dTCMcy7IMpqhx4UxPA6fBKWDJ+nUFi

sx/60EOAiIVW+yYK79VdoI1jrSs48E+CNdqEJCQcjUCVi29eGAdW63H2jOZV37/F

4iQBZYRqhiycZ9FS+S+9aRfMhfy8dEOr1UwIElq6X/tSwss1EKFSNrK5ktGifUtB

AJ+LJVBt2yZOIApcGhsxC3LYUDrDfhqGLIVM2XBc1yuV7Y2gaH4g9Txe+fWK79X2

LYHvhv2xtgLweR12YC+0hT60wSdrDTM6ZW0//ny25LZ7Y7D46ogSWQ==

=AgEr

-----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1

National Cyber Alert System

Technical Cyber Security Alert TA07-317A

Microsoft Updates for Multiple Vulnerabilities

Original release date: November 13, 2007

Last revised: --

Source: US-CERT

Systems Affected

* Microsoft Windows

* Microsoft Windows DNS Server

Overview

Microsoft has released updates that address critical vulnerabilities

in Microsoft Windows and Microsoft Windows DNS Server. Exploitation of

these vulnerabilities could allow a remote, unauthenticated attacker

to execute arbitrary commands or to cause a Windows DNS server to

provide incorrect DNS responses.

I. Description

Microsoft has released updates to address vulnerabilities that affect

Microsoft Windows and Microsoft Windows DNS Server as part of the

Microsoft Security Bulletin Summary for November 2007. The most severe

vulnerabilities could allow a remote, unauthenticated attacker to

execute arbitrary commands or cause a Windows DNS server to provide

incorrect DNS responses.

Further information about the vulnerabilities addressed by these

updates is available in the Vulnerability Notes Database.

II. Impact

A remote, unauthenticated attacker could execute arbitrary commands on

a vulnerable system. An attacker may also be able to cause a Windows

DNS server to provide incorrect responses to DNS queries.

III. Solution

Apply updates from Microsoft

Microsoft has provided updates for these vulnerabilities in the

November 2007 security bulletins. The security bulletins describe any

known issues related to the updates. Administrators are encouraged to

note any known issues that are described in the bulletins and test for

any potentially adverse effects.

System administrators should consider using an automated patch

distribution system such as Windows Server Update Services (WSUS).

IV. References

* US-CERT Vulnerability Notes for Microsoft November 2007 updates -

<

* Microsoft Security Bulletin Summary for November 2007 -

<

* Microsoft Update - <

* Windows Server Update Services -

<

* Securing Your Web Browser -

<

____________________________________________________________________

The most recent version of this document can be found at:

<

____________________________________________________________________

Feedback can be directed to US-CERT Technical Staff. Please send

email to <cert@cert.org> with "TA07-317A Feedback VU#484649" in the

subject.

____________________________________________________________________

For instructions on subscribing to or unsubscribing from this

mailing list, visit <

____________________________________________________________________

Produced 2007 by US-CERT, a government organization.

Terms of use:

<

____________________________________________________________________

Revision History

November 13, 2007: Initial release

-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1.2.1 (GNU/Linux)

iQEVAwUBRzn+L/RFkHkM87XOAQIP7wgAmXsO3NefxyFn/eFlaLvWeGpVNLUQKdso

VuU2/ktEtMNKQeFgsoZnFMHuKWp2hIMXZPCrelegVHszYHwSmE92QsHvumxVg863

iP3e4wXoL5uYpoYXJuZRl8Ee65GdRlsZBp2HS5bqDm2yWAdKLyEfyVArkmvjJFkM

LydRRMVYnyl4aLBGDh/xzowu6jtKmdMRtFQYDac6A/lNdJpAm6lo8OKPG2mY80vh

8acL6ObfFT45UpYkxCFaCvRMn4/Ts24j3cpnQxmNE9/veENVJxumT6sUH56rrkw/

vLZIK1QMWGPXOXOg9rc7UktWqc9iYFsHmTVC8kwB8ksfk26drpmu1w==

=24yY

-----END PGP SIGNATURE-----

National Cyber Alert System

Technical Cyber Security Alert TA07-310A

Apple QuickTime Updates for Multiple Vulnerabilities

Original release date: November 06, 2007

Last revised: --

Source: US-CERT

Systems Affected

Vulnerabilities in Apple QuickTime affect

* Apple Mac OS X

* Microsoft Windows

Overview

Apple QuickTime contains multiple vulnerabilities. Exploitation of

these vulnerabilities could allow a remote attacker to execute

arbitrary code or cause a denial-of-service condition.

I. Description

Apple QuickTime 7.3 resolves multiple vulnerabilities in the way

different types of image and media files are handled. An attacker

could exploit these vulnerabilities by convincing a user to access a

specially crafted image or media file that could be hosted on a web

page.

Note that Apple iTunes installs QuickTime, so any system with iTunes

is vulnerable.

II. Impact

These vulnerabilities could allow a remote, unauthenticated attacker

to execute arbitrary code or commands and cause a denial-of-service

condition. For further information, please see About the security

content of QuickTime 7.3.

III. Solution

Upgrade QuickTime

Upgrade to QuickTime 7.3. This and other updates for Mac OS X are

available via Apple Update.

Secure your web browser

To help mitigate these and other vulnerabilities that can be exploited

via a web browser, refer to Securing Your Web Browser.

References

* About the security content of the QuickTime 7.3 Update -

<

* How to tell if Software Update for Windows is working correctly when no updates are available -

<

* Apple QuickTime Download - <

* Mac OS X: Updating your software -

<

* Securing Your Web Browser -

<

_________________________________________________________________

The most recent version of this document can be found at:

<

_________________________________________________________________

Feedback can be directed to US-CERT Technical Staff. Please send

email to <cert@cert.org> with "TA07-310A Feedback VU#208011" in the

subject.

_________________________________________________________________

For instructions on subscribing to or unsubscribing from this

mailing list, visit <

_________________________________________________________________

Produced 2007 by US-CERT, a government organization.

Terms of use:

<

Adobe has released updates for the Adobe Reader and Adobe Acrobat

product families. The update addresses a URI handling vulnerability in

Microsoft Windows XP and Server 2003 systems with Internet Explorer 7.

Public reports indicate that this vulnerability is being actively

exploited with malicious PDF files. Adobe has released Adobe Reader

8.1.1 and Adobe Acrobat 8.1.1, which mitigate this vulnerability.

http://www.adobe.com/support/security/bulletins/apsb07-18.htm>http://www.microsoft.com/technet/security/advisory/943521.mspx>http://www.kb.cert.org/vuls/id/403150>

* Adobe Security Bulletin APSB07-18 -

<

* Microsoft Security Advisory (943521) -

<

* US-CERT Vulnerability Note VU#403150 -

<

Gates writes an email to us all.  Thanks Bill for the heads up.

-----Original Message-----

From: Bill Gates [

Sent: Tuesday, October 16, 2007 1:05 PM

To: SpawnPoint

Subject: The Age of Software-Powered Communications

If you've been in the work force for 20 years or more, you can remember a time when the pace of business-and life in general-was quite a bit slower than it is today. Back then we read newspapers and magazines and watched the network news to stay informed. Faxes were just becoming a common way to share written business information. A phone call might elicit a busy signal or no one would answer at all. In those days, no one expected to send documents to coworkers on the other side of the globe instantly, collaborate in real-time with colleagues in distant cities, or share photographs the very day they were taken.

These and similar advances have delivered remarkable results. The ability to access and share information instantly and communicate in ways that transcend the boundaries of time and distance has given rise to an era of unprecedented productivity and innovation that has created new economic opportunities for hundreds of millions of people around the world and paved the way for global economic growth that is unparalleled in human history.

But few people would argue that there is no room for improvement. Although we have once-unimaginable access to people and information, we struggle today to keep track of emails and phone calls across multiple inboxes, devices, and phone numbers; to remember a growing number of passwords; and to synchronize contacts, appointments, and data between desktop PCs and mobile devices. The fact is that the proliferation of communications options has become a burden that often makes it more difficult to reach people than it used to be, rather than easier.

In 2006, I wrote about how unified communications innovations were already beginning to transform the way we communicate at work. Because you are a subscriber to executive emails from Microsoft, I want to provide you with an update on the progress we're making toward achieving our vision for unified communications. I also want to share my thoughts on how rapid advances in hardware, networks, and the software that powers them are laying the foundation for groundbreaking innovations in communications technology. These innovations will revolutionize the way we share information and experiences with the people who are important to us at work and at home, and help make it possible to put the power of digital technology in the hands of billions of people around the globe who have yet to reap the benefits of the knowledge economy.

Moving Beyond Disconnected Communications

A fundamental reason that communicating is still so complex is the fact that the way we communicate is still bound by devices. In the office, we use a work phone with one number. Then we ask people to call us back on a mobile device using another number when we are on the go, or reach us on our home phone with yet another number. And we have different identities and passwords for our work and home email accounts, and for instant messaging.

This will change in the very near future. As more and more of our communications and entertainment is transmitted over the Internet thanks to email, instant messaging, video conferencing, and the emergence of Voice over Internet Protocol (VoIP), Internet Protocol Television (IPTV), and other protocols, a new wave of software-driven innovations will eliminate the boundaries between the various modes of communications we use throughout the day. Soon, you'll have a single identity that spans all of the ways people can reach you, and you'll be able to move a conversation seamlessly between voice, text, and video and from one device to another as your location and information sharing needs change. You'll also have more control over how you can be reached and by whom: when you are busy, the software on the device at hand will know whether you can be interrupted, based on what you are doing and who is trying to reach you.

One of the best examples of how communication is changing-and how technology is integrating the way people share experiences across devices-starts in the world of video games. With Xbox Live, the online gaming and entertainment network for Xbox 360, people can play games with friends who are in distant locations. Xbox Live also provides a comprehensive range of communications options including video chat and instant messaging, as well as text, voice, and picture messaging, all seamlessly integrated into the video game experience. With more than 7 million subscribers, Xbox Live is quickly redefining the way people access entertainment of all kinds. And it is enabling them to share experiences with each other in real time without being constrained by the limits of location.

But that's just the start. We recently launched Games for Windows - Live, which links Xbox 360 gamers with the millions of people who play games on their PCs. Now, Windows and Xbox 360 video game players can compete and communicate with each other without being constrained by the limits of devices.

The communications expectations that young people-and anybody else who has adopted the latest digital communications tools-bring to the workplace are already changing how we do business. To them, the desk phone is an anachronism that lacks the flexibility and range of capabilities that their mobile device can provide. A generation that grew up on text messaging is driving the rapid adoption of instant messaging as a standard business communications tool. Accustomed to forming ad hoc virtual communities, they want tools that facilitate the creation of virtual workgroups. Used to collecting and storing information online, they look for team Web sites, Wikis, and other digital ways to create and share information.

All of these expectations are prompting companies to adapt by implementing new communications strategies and technologies. Those that do are already seeing a wide range of benefits including significant cost savings and important productivity gains. At Microsoft, for example, we replaced our old voice mail system with Exchange Server 2007 unified messaging, a move that is saving the company $5 million annually by lowering hardware and maintenance costs. More importantly, Exchange Server 2007 provides a software solution that enables integration of traditional telephone infrastructure and VoIP with corporate messaging, calendaring, and directories. This convergence of telephony and messaging increases employee productivity and decreases the administrative workload for IT professionals.

The Next Wave of Communications Technologies

Today in San Francisco, Microsoft is launching the next wave of enterprise VoIP and unified communications products for business. Among the products we'll launch are Microsoft Office Communications Server 2007 and Microsoft Office Communicator 2007, which bring together a broad range of communications options including voice, instant messaging, and video into a single, consistent experience. Office Communications Server 2007 and Office Communicator make it easier for employees to communicate and collaborate with each other in real-time by letting them see at a glance if the people they want to contact are available. They will also be able to initiate a conversation by email, voice, video, or instant messaging from within Microsoft Office system applications, making communication and collaboration an integral part of day-to-day work processes, rather than an interruption. In addition, when they use the new version of Office Communicator Mobile that is launching today, they will be able to stay connected using Windows Mobile-powered devices.

We're also announcing the availability of Microsoft RoundTable, an advanced video and VoIP conferencing device that provides a 360-degree view of a meeting room, along with wideband audio and video that tracks the flow of conversation between multiple speakers. With RoundTable and Office Live Meeting or Office Communications Server, meeting participants in different locations will be able to converse and share information as if they were in the same room. RoundTable also enables companies to record meetings for later use.

All of these products are important steps toward achieving our long-term vision for streamlined, integrated communications that will enable people to be more productive, more creative, and to stay in touch more easily without being limited by the device they have at hand or the network they are connected to.

A Foundation for Future Innovation

It would be hard to overstate the magnitude of the changes that are coming. Standardized, software-powered communications technologies will be the catalyst for the convergence of voice, video, text, applications, information, and transactions, making it possible to create a seamless communications continuum that extends across people's work and home lives. This will provide the foundation for new products, services, and capabilities that will change the world in profound and often unexpected ways.

This will happen not only in developed countries where access to digital technology is the norm, but also in emerging economies around the world. Currently, about 1 billion of us have a PC, just a fraction of the world's 6 billion people. As we make technology more accessible and simpler to use-often in the form of affordable mobile devices-we can extend new social and economic opportunities to hundreds of millions of people who have never been able to participate in the global knowledge economy. And as more and more of the world's people are empowered to use their ideas, talents, and hard work to the fullest, the results will be new innovations that make everyone's lives richer, more productive, and more fulfilling.

Bill Gates