Calm down!

Cứ bình tĩnh! Bạn đã tập lái xe hơi chưa? Còn nhớ buổi đầu ra sao chứ? Mình cứng đơ ngồi trên chiếc nệm, nắm chặt lấy tay bánh; bạn chăm chú nghĩ tới cử động sắp làm, loay hoay tới nỗi máy kẹt, không chạy được nữa. Tại sao thần kinh bạn căng thẳng như vậy? Tại bạn không vững bụng, sợ có một cử động nào vụng về trước mặt người dạy lái xe. Nếu người này thông minh thì tức đã bảo bạn: "Cứ ngồi cho thoải mái, đừng nắm chặt cái tay bánh, cứ bình tĩnh thở, với lại tôi ngồi bên cạnh mà ngại cái gì?" Nhiều người cũng mắm môi mắm lợi lái cuộc đời họ như bạn lái xe hơi hồi đó. Tại sao? Tại sao họ sợ. Sợ những nỗi khó khăn nó xảy ra hoài (phần nhiều là bất thần), sợ lầm lẫn, sợ thất bại. Họ có tham vọng muốn làm cái gì cũng hoàn hảo, mà chỉ tin ở sức mình thôi. Họ không chịu tự nhận là kẻ tập sự, học nghề, nên không tự phó thác cho một "hướng dẫn viên". Tinh thần họ căng thẳng, môi họ mím lại, mắt họ ngó trừng trừng, tư thế họ cứng đơ, cử chỉ họ vụng về. Những kẻ khốn khổ đó hầu hết là nạn nhân một nền giáo dục gia đình lầm lẫn: ngay từ hồi nhỏ, cha mẹ họ đã nhồi vào óc họ rằng hễ có nghị lực là làm được những việc oanh liệt, mà quên không dạy cho họ điều cốt yếu này: biết tin cậy vào "hướng dẫn viên". Nhưng hướng dẫn viên đó là ai? Ở gần Bắc Cực và Nam Cực, có những tảng băng lớn vô cùng, nổi lềnh bềnh trên biển, người ta gọi là băng đảo (iceberg). Những tảng băng đó chỉ có một phần nhỏ nổi trên mặt nước, còn phần lớn chìm ở dưới. Con người cũng vậy, có một phần ý thức hiện ra ngoài và một phần vô thức không hiện ra: tôi gọi phần trên là hiện thức, phần dưới là tiềm thức. Cái "ngã" tự ti, cái "ngã" hiện thức chỉ là một phần nhỏ của toàn thể cái "ngã". So sánh cái "ngã" của ta với một cây thì phần hiện thức của cây, cành và lá còn phần tiềm thức là rễ ăn sâu ở dưới đất. Chính phần tiềm thức này chứa và phân phối các sinh lực của ta. Chính nó phát ra cái mà ta gọi là bản năng, trực giác, năng lực sáng tạo; ta nằm mộng, linh cảm, tiên tri được cũng là nhờ nó. Nó sáng suốt hơn phần hiện thức của chúng ta. Trên đường đời ta tiến dễ dàng hơn, nếu ta tin cậy nó mà đừng day tay mắm miệng bắt ý chí của ta gắng sức quá mức (...) Các y sĩ, các nhà trị bệnh bằng tâm lí và các mục sư thường thấy các bệnh nhân hoặc tín đồ phàn nàn và hỏi như vầy: "Tôi đã gắng sức làm mà không có kết quả, tôi tuyệt vọng rồi. Biết làm sao bây giờ?". Và luôn luôn các vị đó đáp lại đại ý như sau: "Đừng làm gì nữa". Như vậy không có nghĩa là phải an phận, buông xuôi, mà có nghĩa là cứ tiếp tục chiến đấu bằng cách ngược hẳn lại, đừng lo lắng, co rút lại nữa, mà cứ bình thản cho gân cốt dãn ra. Nói cách khác là đừng bắt trí óc, nghị lực phải căng thẳng mà cứ hoàn toàn tin cậy ở "hướng dẫn viên" của mình và tin ở tiềm thức của mình. Mới rồi tôi nằm mơ thấy mình sắp chết, đương hoảng hốt, thì bỗng nghe thấy có ai bảo: "Cứ thản nhiên, đừng lo sợ". Tôi nghe lời và thấy mình như ở trên một con tàu lênh đênh trên làn nước phẳng lặng của một con sông rộng, trôi tới những miền tối tăm, bí mật, mà không sợ sệt, không đau đớn, êm như ru. Hễ nằm mơ thấy chết thì luôn luôn là một dấu hiệu sắp có sự thay đổi. Cái tiềm thức của tôi lần đó đã khuyên tôi cứ tin ở một sức mạnh lớn hơn, để mặc nó chỉ huy đời tôi. Làm một công việc gì, tới khi thấy bí, gắng sức hoài mà không có lối thoát, thì tôi bỏ ngay công việc đó mà làm công việc khác cho tới hết ngày. Sáng hôm sau, sự khó khăn hôm trước tự nó giải quyết xong vì trong khi cái hiện thức của tôi ngủ thì cái tiềm thức của tôi vẫn tiếp tục làm việc. Trong đời tôi, mỗi lần gặp một vấn đề đặc biệt gai góc nào, tôi cũng dùng phương pháp đó (tôi phải thú thực rằng tôi phải khó nhọc mới tập áp dụng nó được): sau một thời gian suy nghĩ, tôi quyết tâm bỏ mặc nó, không thắc mắc về nó nữa. Như vậy không có nghĩa rằng tôi "xô lùi" vấn đề lại, để có ảo tưởng rằng mọi sự đã được giải quyết thỏa đáng; trái lại tôi nhận ra rằng tôi không thể giải quyết được nó bằng những phương tiện của tôi, và tôi giao vấn đề cho "hướng dẫn viên" của tôi. Thế là tôi được bình tĩnh và đó là bước đầu tiên tiến tới giải pháp được rồi, vì có bình tĩnh thì mới sẵn sàng nhận được sự giúp đỡ của người khác hay của hoàn cảnh. Khi tôi bảo rằng "tiềm thức" có thể giúp đỡ ta được là tôi nói theo tâm lí học. Xét theo một khía cạnh khác thì có thể gọi sức mạnh đó là thần phù hộ cho mình, là Thượng Đế; nhưng Thượng Đế và tiềm thức không hoàn toàn như nhau, (...). Trong đạo Phật, có một phái gọi là Thiền. Không thể giảng cho bạn hiểu trong vài hàng thế nào là thiền được, nhưng tôi xin kể chuyện dưới đây để bạn có một khái niệm về thiền. Trong một cuộc thi bắn cung, một người Âu thấy một bậc thầy trong thiền môn giương một cây cung rất lớn và nặng. Vì quen dùng sức mạnh của bắp thịt, người Âu đó ngạc nhiên rằng nhà tu hành giương cung sao mà dễ dàng thế. Nhà tu hành bảo: "Ông thử nắn bắp thịt ở cánh tay tôi mà xem". Bắp thịt hoàn toàn mềm như thường, cơ hồ không vận dụng tới. Mũi tên nhẹ nhàng phóng ra, bay rất xa mà nhà tu hành không mệt sức chút nào cả. Theo đạo thiền, nghệ thuật bắn cung là nhận định cho đúng cái đích phải nhắm, tưởng tượng trước trong óc rằng mũi tên bay trúng đích, rồi thản nhiên để cho cái sức ở nội tâm giúp cánh tay của mình.

Trích một đoạn trong tác phẩm dịch "Chấp nhận cuộc đời" của cụ Nguyễn Hiến Lê.

Xin cám ơn.

The Golden Rules of Permissions Administration

The following are what I call the Golden Rules of Permissions Administration. These rules were developed through years of file server administration but generally apply to any application administration like SQL Server, Sharepoint server, Active Directory, etc.

The Golden Rules of Permissions Administration can be thought of as a hierarchy of best practices, the very best practice being the last rule in the list. Each “rule” represents an evolutionary step forward in the way administration is performed. As you gain understanding of the purpose of each rule you will start to appreciate that as each rule is implemented greater and greater flexibility and ease of administration is achieved. 

The ultimate goal of these rules and administration in general is to simplify (greatly reduce the amount of time it takes to perform) daily administration of permissions over the long run. However, to achieve this goal there is more initial setup and configuration involved. If you find yourself reading the rules and concerning yourself with the extra work it takes to implement the next rule, then you are thinking about your work in the wrong terms…reactively, while the Golden Rules of Permissions Administration is truly a proactive approach and ultimately a time saver.

The Golden Rules of Permissions Administration

         1) Never give “end users” the ability to administer permissions
                 a. Instead insure that only professional administrators for the application can administer permissions. This will prevent problems in the long run.

         2) Never assign permissions to an individual user
                 a. Instead place the user into a group and assign permissions to the group.

         3) Never assign permissions to an individual file (or object).
                 a. Instead place the file (or object) into a folder (or group, etc) and assign permissions to the folder (or group, etc).

          4) Never assign permissions to a “user group”
                 a. Instead create a specific “resource group” and place the users and/or “user groups” into that “resource group.”

          5) Always assign permissions in a Resource Security Model
                 a. This requires a very high level view of the organization and great understanding of the individual application and needs of the organization.

Rule 1: Never give “end users” the ability to administer permissions.

First lets start be defining what an “end user” is. As it pertains to these rules an “end user” is anyone not willing to and/or not trained to follow all of these Golden Rules of Permissions Administration. That’s a pretty broad spectrum of people. I assume that most people reading this document have an Information Technology (IT) background, so the “end users” could be IT managers, developers or programmers, system administrators, helpdesk, security engineers, SQL server administrators, and other application specific IT professionals, in addition to the more common “end users” of non IT employees. Yes, as it pertains to this rule all these people are considered “end users” if they are not willing, not properly trained, or simply unable to follow (because lack of access to appropriate tools) the Golden Rules of Permissions Administration.

The entire point of defining “end users” is to highlight the importance of properly defining how administration should be done in your environment and not viewing administration as an “anyone can do it” type of job, because no one can do administration equally as well as a professional administrator following these rules.

The other item to note about “end users” that do permission administration is that they will never move beyond rule 2 or 3 of the Golden Rules of Permissions Administration. Therefore, these sub par implementations will forever burden professional administrators that will come in after the fact to fix the issues and problems. The reason for this is not simply because of a lack of skill or a lack of training, it is more likely they will not have access to the higher level administrative tools needed to create and/or access groups needed for rules 4 and 5 to be implemented. Also, even if they had access to these tools, the “end users” view of the company and technology may be so limited that their implementations usually have short comings in the long run.

Rule 2: Never assign permissions to an individual user

So much has been written about this rule that it almost seems pointless to discuss, but yet still poorly trained or lazy administrators will give access to individual users. There is only one instance in which an individual user should be assigned permissions directly to an object, which is when implementing a user home directory. This is the only time it is deemed necessary to assign permissions directly to the user. However, a caveat to this rule is that Rule 1 should also be followed. By not allowing the user to modify rights to their home directory you allow for a more secure environment. This is because when done properly only on administrator will have the ability to modify permissions to gain entry into the user directory, thus maintaining a solid barrier from tampering by other employees or by the individual users themselves.


Rule 3: Never assign permissions to an individual file (or object)

A core theme of the Golden Rules of Permission Administration is that individual objects and users are grouped together and permissions are always assigned by groups of users to groups of objects that require the same permissions. If you assign permissions to individual files or other objects that can be grouped together using folders (or other grouping methods) then you have missed a major opportunity to simplify your administration. The reason your administration will be simplified is because you can simply add files to the folder (or other grouping method) to assign the same permissions in the future to the same files.

Unfortunately, not all items that you can assign permissions to can be grouped. If this is the case then you are left with no choice but to assign a group of users to the individual item. This is rare and is the exception and not the rule. But you should always assign permissions to a grouping object and not the individual object when possible.

Rule 4: Never assign permissions to a “User Group”

To simplify this explanation we will use the following definition of a “User Group”. A “User Group” is a group created with members based on the idea that the users have something in common other than a resource to which they are being given access to. These are things that users will always have in common, and are things that other users clearly lack. These groups should always be strictly enforced to maintain the integrity of the group. Examples are: Departmental groups, location groups, and role groups like SQL DBA, or security admin, etc. Users that are clearly not members of these organizational structures should not be placed in these groups. Users are typically grouped in this manner. However, administrators make two common mistakes implementing these types of groups.

The biggest mistake administrators make in implementing these types of groups is using these groups to apply permissions directly to one or more individual objects, folders, etc. This action makes support and access of these resources more difficult to administer over time.

The second mistake is not adhering to a strict policy of keeping these groups made of members that clearly meet the defined organizational (departments, locations, etc) and role requirements (DBA, security admin, etc). When administrators place users into these groups because it is convenient they tend to unknowingly give access to other resources. This can lead to unauthorized access and other issues.

Properties of a User Group Security Model

       1) Users are assigned directly to groups that are then directly assigned to resources
       2) More than one group per access type (Read and Write, Read Only, Full Control, etc) is assigned to resources

Below is a very common example of a user group security model that you will find at many companies. Notice how a single group is directly assigned permissions to various folders. This is type of implementation is not recommended because it is more difficult to support.

For example assume an existing user, James is already in the “IT Users” group but now needs Read and Write (RW) access to Folder1 but no access to Folder2. In this scenario, there is no choice but to create a new group and assign that group to the Folder1 with RW access, then place James into the newly created group. You could assign James directly to Folder1 but that is a violation of previous rules. You could add James to HR Users but that would grant James access to Folder2 as well as other permissions not shown in the picture. All of these workarounds and can be avoided and simplified administration can be achieved by gaining an understanding of the next rule.

Rule 5: Always assign permissions in a Resource Security Model

The Resource Security Model is a multiple tier security model that is both flexible and easy to administer. The general types of objects used in a Resource Security Model are: Users objects, Organizational Groups (grouped by departments, locations, regions, etc), Role Groups (DBA, Security Admin, Helpdesk, etc), and Resource Groups.

Because of its flexibility the basic implementation of a Resource Security Model can be either two tier, three tier, or four tier. More tiers are normally implemented within the Organizational Groups because they easily lend themselves to group nesting. But for the purpose of this discussion the Organizational Groups are considered a single tier. All forms of this model can be used in a single environment allowing the greatest flexibility and ease of implementation.

Below is a diagram showing how these objects related to each other to create the Resource Security Model.

Descriptions of the different types of a Resource Security Model
               * Two tier model: Resource groups are used to secure the object per access type, users are then placed directly into the Resource group.
               * Three tier model:
                      - Type A: Resource groups are used to secure the object per access type, Role based groups are used to create a role with specific permissions via placement into different Resource groups. Users are place directly into each Role group.
                      - Type B: Resource groups are used to secure the object per access type, Organizational groups are then placed into the appropriate Resource group as appropriate for that department, location, etc. The users that are members of the Organizational group are automatically given access to the specified resources.
               * Four tier model: Resource groups are used to secure the object per access type. Role based groups are used to create a role with specific permissions via placement into different Resource groups. Organizational groups are then placed into the appropriate Resource group as appropriate for that department, location, etc. The users that are members of the Organizational group are automatically given access to the specified resources.
           
In general using the Resource Security Model will result in the most flexible and easy to administrate security model your company can implement.

Properties of a Resource Security Model

      1) Only one group per access type is assigned to the resources.
               a. For example separate resource groups are created to secure a folder with Read Only (RO) and Read Write (RW) permissions.
               b. Example names:
                       i. Foldername.RO
                       ii. Foldername.RW

      2) Role Groups are used to place users into multiple Resource groups to create a specific “role” allowing multiple permissions to be given out with a single group if needed.

      3) Organizational Groups are used to group users based on the organizational requirements of the company. These are an important requirement to help grant access quickly to users based on any of the following common organizational needed.
               a. Department
               b. Unit (a subset of a department)
                    i. For example Accounting may payroll, and accounts payable as a Unit of the Accounting Department.
               c. Location
               d. Region (a collection of locations)
               e. Department by Location
               f. Unit by Location
               g. Department by Region
               h. Unit by Region

If we go back to the previous permissions example given for James in Rule 4 and instead implement a Resource Security Model the solution would look like this:

At the very beginning of this article I warned readers that the Golden Rules of Permissions Administration was a proactive approach that had a small cost, more initial setup and implementation time. That cost ultimately saves a lot more administration time post implementation because most changes are just a matter of adding users to groups versus redesigning and re-implementing security post implementation.

Summary

In most companies implementing the Golden Rules of Permission Administration and ultimately a Resource Security Model is not something that is done over night. It will take years of continual effort to replace the old security model with the new proper implementation. However, it can be done. All that is required is a single administrator that continually follows these rules when implementing new security, replaces the old security as needed, and makes the effort every day to follow these rules. Eventually, other administrators will also learn this method and your environment will become easier to administer.

I have personally setup and implemented this very model at several different companies with great success.

Definitions

The Long Run: This is a long term view of how a company or the technology that a company uses may change over time. For instance, acquisitions and divestitures, departmental restructuring, technology upgrades, technology abandonment, and new technology implementations. All of these things professional administrators encounter year after year, and administrators that follow the Golden Rules of Permissions Administration will make each one of these a less painful experience.

Simplify Administration: is easily talked about but rarely properly verbalized. As far as it applies to the Golden Rules of Permission Administration it is a practice of using a flexible Resource Security Model and a centralized administration console to assign permissions to all applications in the enterprise using methods that increase the efficiency of post implementation administration. Another key feature that a simplified administration model uses is a view that the ease of post implementation administration is more important than initial implementation time.

The last feature that is important to simplifying administration is the ability to have a highly trained engineer setup the initial security configuration and then have lower level administrators place the users into the groups as the need arises over time. This adds to the simplicity of administration by having a centralized administration console (like Active Directory) to provide permissions administration for all applications in the enterprise.

User Group: is a group created with members based on the idea that the users have something in common other than a resource to which they are being given access to. Typically theses groups can have names like “HR Department”, “Accounting Department”, “Managers”, “Domain Users”, “Domain Admins”, etc. It is important to note that these groups tend to fall into one of two types: Organizational Group or Role Group.

Organizational Group: is a group created with members based purely on the organizational structure of the company. These are usually considered a foundational level group for granting access to resources within the company. Users must be a member of the respective departments to be a member of these groups.

Role Group: is a group created to facilitate special types of access that may cross organizational boundaries. This type of group is very beneficial in allowing users from different department’s access to multiple resources quickly and easily.

Resource Group: is a group created specifically for a single resource and a specific access type. For example, granting access to a specific folder with Read/Write access.


Source: http://networkadminkb.com/Shared%20Documents/The%20Golden%20Rules%20of%20Permissions%20Administration.aspx 
thanks!

2010: The Year of the Exploit

"If ignorant both of your enemy and yourself, you are certain to be in peril." - Sun Tzu 

Microsoft Patch Disclosure

Overview
This month, Microsoft released 17 patches which repair a total of 40 vulnerabilities. Of these 17 patches, 10 address Remote Code Execution vulnerabilities, 4 address Elevation of Privilege vulnerabilities, and 3 address Denial of Service.

eEye's Blink Endpoint Security solutions protect from memory-corruption vulnerabilities generically without the need for any updates.

Patch Precedence
eEye advises administrators to patch MS10-090 and MS10-091, followed by MS10-092, MS10-093, MS10-094, MS10-095, MS10-096, MS10-097, MS10-098, MS10-099, MS10-100, MS10-101, MS10-102, MS10-103, MS10-104, and MS10-105, and then patch MS10-106. For those unable to deploy the patches in a timely fashion, see the mitigation sections below.

As always, eEye suggests that all users apply Microsoft patches as fast as possible, preferably after testing the impact on internal applications and network continuity. For those who would like further information regarding the potential risks and remediation requirements of the patches announced today, please consider attending tomorrow's Vulnerability Expert Forum hosted by the eEye Security Research Team. Register Here >>

For more information on patch precedence, see the eEye Versa Newsletter article Patch Tuesday Prioritization for a Large Enterprise.


Bulletin/Advisory Summary

Critical
MS10-090 - Cumulative Security Update for Internet Explorer (2416400)
MS10-091 - Vulnerabilities in the OpenType Font (OTF) Driver Could Allow Remote Code Execution (2296199)

Important
MS10-092 - Vulnerability in Task Scheduler Could Allow Elevation of Privilege (2305420)
MS10-093 - Vulnerability in Windows Movie Maker Could Allow Remote Code Execution (2424434)
MS10-094 - Vulnerability in Windows Media Encoder Could Allow Remote Code Execution (2447961)
MS10-095 - Vulnerability in Microsoft Windows Could Allow Remote Code Execution (2385678)
MS10-096 - Vulnerability in Windows Address Book Could Allow Remote Code Execution (2423089)
MS10-097 - Insecure Library Loading in Internet Connection Signup Wizard Could Allow Remote Code Execution (2443105)
MS10-098 - Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (2436673)
MS10-099 - Vulnerability in Routing and Remote Access Could Allow Elevation of Privilege (2440591)
MS10-100 - Vulnerability in Consent User Interface Could Allow Elevation of Privilege (2442962)
MS10-101 - Vulnerability in Windows Netlogon Service Could Allow Denial of Service (2207559)
MS10-102 - Vulnerability in Hyper-V Could Allow Denial of Service (2345316)
MS10-103 - Vulnerabilities in Microsoft Publisher Could Allow Remote Code Execution (2292970)
MS10-104 - Vulnerability in Microsoft SharePoint Could Allow Remote Code Execution (2455005)
MS10-105 - Vulnerabilities in Microsoft Office Graphics Filters Could Allow for Remote Code Execution (968095)

Moderate
MS10-106 - Vulnerability in Microsoft Exchange Server Could Allow Denial of Service (2407132)



Bulletin/Advisory Details

MS10-090
Cumulative Security Update for Internet Explorer (2416400)
Microsoft Severity Rating: Critical
eEye Severity Rating: Critical

Description
This security update resolves four privately reported vulnerabilities and three publicly disclosed vulnerabilities in Internet Explorer. The most severe vulnerabilities could allow remote code execution if a user views a specially crafted Web page using Internet Explorer. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. The security update addresses the vulnerabilities by modifying the way that Internet Explorer handles objects in memory and script during certain processes.
             * HTML Object Memory Corruption Vulnerability - CVE-2010-3340
                A remote code execution vulnerability exists in the way that Internet Explorer accesses an object that has not been correctly initialized or has been deleted. An attacker could exploit the vulnerability by constructing a specially crafted Web page. When a user views the Web page, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the logged-on user. If a user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
              * Cross-Domain Information Disclosure Vulnerability - CVE-2010-3342
              An information disclosure vulnerability exists in Internet Explorer that could allow script to gain access to information in another domain or Internet Explorer zone. An attacker could exploit the vulnerability by constructing a specially crafted Web page that could allow information disclosure if a user viewed the Web page. An attacker who successfully exploited this vulnerability could view content from another domain or Internet Explorer zone.
               * HTML Object Memory Corruption Vulnerability - CVE-2010-3343
                A remote code execution vulnerability exists in the way that Internet Explorer accesses an object that has not been correctly initialized or has been deleted. An attacker could exploit the vulnerability by constructing a specially crafted Web page. When a user views the Web page, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the logged-on user. If a user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
               * HTML Element Memory Corruption Vulnerability - CVE-2010-3345
               A remote code execution vulnerability exists in the way that Internet Explorer accesses an object that has not been correctly initialized or has been deleted. An attacker could exploit the vulnerability by constructing a specially crafted Web page. When a user views the Web page, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the logged-on user. If a user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
               * HTML Element Memory Corruption Vulnerability - CVE-2010-3346
               A remote code execution vulnerability exists in the way that Internet Explorer accesses an object that has not been correctly initialized or has been deleted. An attacker could exploit the vulnerability by constructing a specially crafted Web page. When a user views the Web page, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the logged-on user. If a user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
               * Cross-Domain Information Disclosure Vulnerability - CVE-2010-3348
               An information disclosure vulnerability exists in Internet Explorer that could allow script to gain access to information in another domain or Internet Explorer zone. An attacker could exploit the vulnerability by constructing a specially crafted Web page that could allow information disclosure if a user viewed the Web page. An attacker who successfully exploited this vulnerability could view content from another domain or Internet Explorer zone.
                * Uninitialized Memory Corruption Vulnerability - CVE-2010-3962
               A remote code execution vulnerability exists in the way that Internet Explorer accesses an object that has not been correctly initialized or has been deleted. An attacker could exploit the vulnerability by convincing the user to open a malicious Word document. When a user closes the document, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the logged-on user. If a user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

Analysis
This bulletin addresses multiple vulnerabilities in Internet Explorer; 5 remote code execution vulnerabilities and 2 information disclosure vulnerabilities. To exploit the remote code execution vulnerabilities, an attacker would need to create a malicious web page and convince a user to view that web page. For four of the remote code execution vulnerabilities, exploitation would occur immediately.

Mitigations
Configure Internet Explorer to either disable Active Scripting entirely or prompt before executing Active Scripts. Block ActiveX scripting. Read emails in plain text. Disable mstime.dll by using the Access Control List. Finally, apply a custom CSS style sheet, by running the Fix-It tool at http://support.microsoft.com/kb/2458511.

MS10-091
Vulnerabilities in the OpenType Font (OTF) Driver Could Allow Remote Code Execution (2296199)
Microsoft Severity Rating: Critical
eEye Severity Rating: Critical

Description
This security update resolves several privately reported vulnerabilities in the Windows Open Type Font (OTF) driver that could allow remote code execution. An attacker could host a specially crafted OpenType font on a network share. The affected control path is then triggered when the user navigates to the share in Windows Explorer, allowing the specially crafted font to take complete control over an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. The security update addresses the vulnerabilities by correcting the way that the OpenType Font (OTF) driver indexes arrays when parsing OpenType fonts, resets pointers when freeing memory, and parses the CMAP table when rendering OpenType fonts.
                 * OpenType Font Index Vulnerability - CVE-2010-3956
                 A remote code execution vulnerability exists in the way that the OpenType Font (OTF) driver improperly parses specially crafted OpenType fonts. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
                  * OpenType Font Double Free Vulnerability - CVE-2010-3957
                  A remote code execution vulnerability exists in the way that the OpenType Font (OTF) driver improperly parses specially crafted OpenType fonts. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
                  * OpenType CMAP Table Vulnerability - CVE-2010-3959
                  A remote code execution vulnerability exists in the way that the OpenType Font (OTF) driver improperly parses specially crafted OpenType fonts. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

Analysis
This bulletin addresses three remote code execution font parsing vulnerabilities within the OpenType Font (OTF) driver. These vulnerabilities are caused by improperly parsing OpenType Fonts. Attackers could use this vulnerability to gain the ability to execute malicious code with kernel privileges on a victim's machine. Attackers would simply need to host the malicious font on a network share and convince the user to open a document that used that font. Alternatively, the user could also view the malicious file's preview via Windows Explorer, by navigating to the malicious font's location within Windows Explorer.

Mitigations
Disable the ability for users to preview fonts in the Preview or Details Pane within Windows Explorer.

MS10-092
Vulnerability in Task Scheduler Could Allow Elevation of Privilege (2305420)
Microsoft Severity Rating: Important
eEye Severity Rating: Important

Description
This security update resolves a publicly disclosed vulnerability in Windows Task Scheduler. The vulnerability could allow elevation of privilege if an attacker logged on to an affected system and ran a specially crafted application. An attacker must have valid logon credentials and be able to log on locally to exploit this vulnerability. The vulnerability could not be exploited remotely or by anonymous users. The security update addresses the vulnerability by correcting the way Task Scheduler conducts integrity checks to validate that tasks run with the intended user privileges.
                     * Task Scheduler Vulnerability - CVE-2010-3338
                      An elevation of privilege vulnerability exists in the way that the Windows Task Scheduler improperly validates whether scheduled tasks run within the intended security context. An attacker who successfully exploited this vulnerability could run arbitrary code in the security context of the local system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

Analysis
This bulletin addresses an elevation of privilege vulnerability within the Windows Task Scheduler which could allow for an attacker to run arbitrary code with local system rights. The vulnerability is caused by the fact that the Task Scheduler does not always run tasks within the intended security context. The local attacker would likely use elevated privileges, gained by exploiting this vulnerability, to install malicious software and install backdoors to the compromised system.

Mitigations
Disable the Task Scheduler service within the Windows Registry at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Schedule by changing the Start value from 2 to 4.

MS10-093
Vulnerability in Windows Movie Maker Could Allow Remote Code Execution (2424434)
Microsoft Severity Rating: Important
eEye Severity Rating: Important

Description
This security update resolves a publicly disclosed vulnerability in Windows Movie Maker. The vulnerability could allow remote code execution if an attacker convinces a user to open a legitimate Windows Movie Maker file that is located in the same network directory as a specially crafted library file. For an attack to be successful, a user must visit an untrusted remote file system location or WebDAV share and open a document from this location that is then loaded by a vulnerable application. The security update addresses the vulnerability by correcting the way Windows Movie Maker loads external libraries.
                      * Insecure Library Loading Vulnerability - CVE-2010-3967
                      A remote code execution vulnerability exists in the way that Windows Movie Maker handles the loading of DLL files. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Analysis
This bulletin addresses an insecure DLL loading vulnerability within Windows Movie maker which could lead to remote code execution. Successful exploitation would lead to the attacker having gained the ability to execute remote arbitrary code within the context of the current user.

Mitigations
Disable loading DLLs from network network/WebDAV shares. Disable the WebClient Service. Block TCP 139/445 on external firewall.

MS10-094
Vulnerability in Windows Media Encoder Could Allow Remote Code Execution (2447961)
Microsoft Severity Rating: Important
eEye Severity Rating: Important

Description
This security update resolves a publicly disclosed vulnerability in Windows Media Encoder. The vulnerability could allow remote code execution if an attacker convinces a user to open a legitimate Windows Media Profile (.prx) file that is located in the same network directory as a specially crafted library file. For an attack to be successful, a user must visit an untrusted remote file system location or WebDAV share and open a document from this location that is then loaded by a vulnerable application. The security update addresses the vulnerability by correcting the way the Windows Media Encoder loads external libraries.
                         * Insecure Library Loading Vulnerability - CVE-2010-3965
                         A remote code execution vulnerability exists in the way that Microsoft Windows handles the loading of DLL files. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Analysis
This bulletin addresses a remote code execution vulnerability in the way Windows Media Encoder loads DLLs. Successful exploitation would lead to the attacker having gained the ability to execute remote arbitrary code within the context of the current user.

Mitigations
Disable loading DLLs from network network/WebDAV shares. Disable the WebClient Service. Block TCP 139/445 on external firewall.

MS10-095
Vulnerability in Microsoft Windows Could Allow Remote Code Execution (2385678)
Microsoft Severity Rating: Important
eEye Severity Rating: Important

Description
This security update resolves a privately reported vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if a user opens a file type such as .eml and .rss (Windows Live Mail) or .wpost (Microsoft Live Writer) located in the same network folder as a specially crafted library file. For an attack to be successful, a user must visit an untrusted remote file system location or WebDAV share and open a document from this location that is then loaded by a vulnerable application. The security update addresses the vulnerability by correcting the manner in which the Windows BranchCache loads external libraries.
                          * BranchCache Insecure Library Loading Vulnerability - CVE-2010-3966
                          A remote code execution vulnerability exists in the way that Microsoft Windows opens specific files on platforms that do not support the BranchCache functionality. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Analysis
This bulletin addresses a remote code execution vulnerability caused by the way Windows loads DLLs on systems where BranchCache functionality is unavailable. Successful exploitation would result in the attacker being able to execute arbitrary code within the context of the current user.

Mitigations
Disable loading DLLs from network network/WebDAV shares. Disable the WebClient Service. Block TCP 139/445 on external firewall.

MS10-096
Vulnerability in Windows Address Book Could Allow Remote Code Execution (2423089)
Microsoft Severity Rating: Important
eEye Severity Rating: Important

Description
This security update resolves a publicly disclosed vulnerability in Windows Address Book. The vulnerability could allow remote code execution if a user opens a Windows Address Book file located in the same network folder as a specially crafted library file. For an attack to be successful, a user must visit an untrusted remote file system location or WebDAV share and open a document from this location that is then loaded by a vulnerable application. The security update addresses the vulnerability by correcting the manner in which the Windows Address Book loads external libraries.
                     * Insecure Library Loading Vulnerability - CVE-2010-3147
                      A remote code execution vulnerability exists in the way that Windows Address Book handles the loading of DLL files. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Analysis
This bulletin addresses a remote code execution vulnerability caused by the way Windows Address Book loads DLLs. Successful exploitation would result in the attacker being able to execute arbitrary code within the context of the current user.

Mitigations
Disable loading DLLs from network network/WebDAV shares. Disable the WebClient Service. Block TCP 139/445 on external firewall.

MS10-097
Insecure Library Loading in Internet Connection Signup Wizard Could Allow Remote Code Execution (2443105)
Microsoft Severity Rating: Important
eEye Severity Rating: Important

Description
This security update resolves a publicly disclosed vulnerability in the Internet Connection Signup Wizard of Microsoft Windows. This security update is rated Important for all supported editions of Windows XP and Windows Server 2003. All supported editions of Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2 are not affected by the vulnerability. The security update addresses the vulnerability by correcting the manner in which the Internet Connection Signup Wizard loads external libraries.
                 * Internet Connection Signup Wizard Insecure Library Loading Vulnerability - CVE-2010-3144
                A remote code execution vulnerability exists in the way that the Internet Connection Signup Wizard, a component of Microsoft Windows, handles the loading of DLL files. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Analysis
This is a standard DLL Hijacking error that has been seen in the past with other applications. When opened, Internet Connection Signup Wizard will attempt to load one of its DLLs from a network or WebDAV share. An attacker could place a specially crafted DLL in a share that, when loaded, would execute arbitrary code with the same permissions as the user.

Mitigations
Disable loading DLLs from network network/WebDAV shares. Disable the WebClient Service. Block TCP 139/445 on external firewall.

MS10-098
Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (2436673)
Microsoft Severity Rating: Important
eEye Severity Rating: Important

Description
This security update resolves one publicly disclosed vulnerability and several privately reported vulnerabilities in Microsoft Windows. The vulnerabilities could allow elevation of privilege if an attacker logged on locally and ran a specially crafted application. An attacker must have valid logon credentials and be able to log on locally to exploit these vulnerabilities. The vulnerabilities could not be exploited remotely or by anonymous users. The security update addresses the vulnerabilities by correcting the way the Windows kernel-mode drivers allocate memory, free objects that are no longer in use, manage kernel-mode driver objects, and validate input passed from user mode.
               * Win32k Buffer Overflow Vulnerability - CVE-2010-3939
               An elevation of privilege vulnerability exists in the way that Windows kernel-mode drivers improperly allocate memory when copying data from user mode. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
               * Win32k PFE Pointer Double Free Vulnerability - CVE-2010-3940
               An elevation of privilege vulnerability exists due to the way that the Windows kernel-mode drivers free objects that are no longer in use. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
               * Win32k Double Free Vulnerability - CVE-2010-3941
               An elevation of privilege vulnerability exists due to the way that the Windows kernel-mode drivers free objects that are no longer in use. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
               * Win32k WriteAV Vulnerability - CVE-2010-3942
               An elevation of privilege vulnerability exists in the way that Windows kernel-mode drivers improperly allocate memory when copying data from user mode. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
               * Win32k Cursor Linking Vulnerability- CVE-2010-3943
                An elevation of privilege vulnerability exists due to the way that Windows Kernel-mode drivers manage kernel-mode driver objects. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
                 * Win32k Memory Corruption Vulnerability - CVE-2010-3944
                 An elevation of privilege vulnerability exists in the way that the Windows kernel-mode drivers improperly validate input passed from user mode. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

Analysis
This bulletin addresses multiple elevation of privilege vulnerabilities within Windows kernel drivers. They range from improper allocation of data sent from userland to the kernel, double free vulnerabilities, and improperly managing kernel driver objects. They all lead to the attacker gaining the ability to run arbitrary code with kernel privileges.

Mitigations
Five of the six vulnerabilities have no mitigation. For CVE-2010-3941, administrators can disable the NTVDM subsystem through gpedit.msc or by modifying the registry key DisallowedPolicyDefault, at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WOW, to 1.

MS10-099
Vulnerability in Routing and Remote Access Could Allow Elevation of Privilege (2440591)
Microsoft Severity Rating: Important
eEye Severity Rating: Important

Description
This security update addresses a privately reported vulnerability in the Routing and Remote Access NDProxy component of Microsoft Windows. This security update is rated Important for all supported editions of Windows XP and Windows Server 2003. All supported editions of Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2 are not affected by the vulnerability. The security update addresses the vulnerability by correcting the validation in the Routing and Remote Access component.
                 * Kernel NDProxy Buffer Overflow Vulnerability - CVE-2010-3963
                 An elevation of privilege vulnerability exists in the Routing and Remote Access NDProxy component of the Windows kernel due to improper validation of input passed from user mode to the kernel. The vulnerability could allow an attacker to run code with elevated privileges. A local attacker who successfully exploited this vulnerability could execute arbitrary code and take complete control of an affected system. The attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

Analysis
This bulletin addresses an elevation of privilege vulnerability within the Routing and Remote Access NDProxy portion of the kernel. This is caused by the improper validation of data sent from userland to the kernel. This could allow an attacker to execute arbitrary code with kernel rights on the compromised system.

Mitigations
No mitigations have been provided my Microsoft.

MS10-100
Vulnerability in Consent User Interface Could Allow Elevation of Privilege (2442962)
Microsoft Severity Rating: Important
eEye Severity Rating: Important

Description
This security update resolves a privately reported vulnerability in the Consent User Interface (UI). The vulnerability could allow elevation of privilege if an attacker runs a specially crafted application on an affected system. An attacker must have valid logon credentials and the SeImpersonatePrivilege and be able to log on locally to exploit this vulnerability. The vulnerability could not be exploited remotely or by anonymous users. The security update addresses the vulnerability by correcting the manner in which the Consent UI processes values read from the registry.
                  * Consent UI Impersonation Vulnerability - CVE-2010-3961
                  An elevation of privilege vulnerability exists in the way that the Consent User Interface (UI) improperly processes special values read from the registry. The vulnerability could allow an attacker to run code with elevated privileges. An attacker who successfully exploited this vulnerability could execute arbitrary code and take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

Analysis
This bulletin addresses an elevation of privilege vulnerability that occurs within the Consent User Interface in Windows. This occurs due to the improper validation of certain registry values, which would allow an attacker to run arbitrary code with elevated privileges.

Mitigations
No mitigations have been provided my Microsoft.

MS10-101
Vulnerability in Windows Netlogon Service Could Allow Denial of Service (2207559)
Microsoft Severity Rating: Important
eEye Severity Rating: Important

Description
This security update resolves a privately reported vulnerability in the Netlogon RPC Service on affected versions of Windows Server that are configured to serve as domain controllers. The vulnerability could allow denial of service if an attacker sends a specially crafted RPC packet to the Netlogon RPC Service interface on an affected system. An attacker requires administrator privileges on a machine that is joined to the same domain as the affected domain controller in order to exploit this vulnerability. The security update addresses the vulnerability by correcting the validation of user-provided data in the Netlogon RPC Service interface.
              * Netlogon RPC Null dereference DOS Vulnerability - CVE-2010-2742
               A remote authenticated denial of service vulnerability exists in implementations of the Netlogon RPC Service on affected versions of Windows Server. An attacker who successfully exploited this vulnerability could cause affected versions of the Windows Server to restart.

Analysis
This bulletin addresses a remote authenticated denial of service vulnerability within the Netlogon RPC Service on certain versions of Windows Server. The attacker must be authenticated in order to successfully cause the DoS. Upon successful exploitation the attacker causes the server to restart.

Mitigations
No mitigations have been provided my Microsoft.

MS10-102
Vulnerability in Hyper-V Could Allow Denial of Service (2345316)
Microsoft Severity Rating: Important
eEye Severity Rating: Important

Description
This security update resolves a privately reported vulnerability in Windows Server 2008 Hyper-V and Windows Server 2008 R2 Hyper-V. The vulnerability could allow denial of service if a specially crafted packet is sent to the VMBus by an authenticated user in one of the guest virtual machines hosted by the Hyper-V server. An attacker must have valid logon credentials and be able to send specially crafted content from a guest virtual machine to exploit this vulnerability. The vulnerability could not be exploited remotely or by anonymous users. The security update addresses the vulnerability by correcting the way that the Hyper-V server validates malformed packets sent to the VMBus inside its guest virtual machines.
              * Hyper-V VMBus Vulnerability - CVE-2010-3960
              A vulnerability exists in Windows Server 2008 Hyper-V and Windows Server 2008 R2 Hyper-V that could allow denial of service if a specifically crafted packet is sent to the VMBus by an authenticated user in one of the guest virtual machines hosted by the Hyper-V server. An attacker must have valid logon credentials and be able to log on locally into a guest virtual machine to exploit this vulnerability. The vulnerability could not be exploited remotely or by anonymous users.

Analysis
This bulletin addresses a denial of service vulnerability within the Hyper-V portion of Server 2008 and Server 2008 R2. This requires an attacker to be an authenticated user of one of the guest virtual machines running on the server. The attacker would need to send a malicious packet to VMBus which would exploit the vulnerability. This attack is not possible if the user is remotely authenticated or not unauthenticated at all.

Mitigations
No mitigations have been provided my Microsoft.

MS10-103
Vulnerabilities in Microsoft Publisher Could Allow Remote Code Execution (2292970)
Microsoft Severity Rating: Important
eEye Severity Rating: Important

Description
This security update resolves five privately reported vulnerabilities in Microsoft Publisher that could allow remote code execution if a user opens a specially crafted Publisher file. An attacker who successfully exploited any of these vulnerabilities could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. The update addresses the vulnerabilities by correcting the way that Microsoft Publisher parses specially crafted Publisher files.
                  * Size Value Heap Corruption in pubconv.dll Vulnerability - CVE-2010-2569
                  A remote code execution vulnerability exists in the way that Microsoft Publisher parses Publisher files. An attacker could exploit the vulnerability by creating a specially crafted Publisher file that could be included as an e-mail attachment, or hosted on a specially crafted or compromised Web site, and then convincing the user to open the specially crafted Publisher file. If a user were logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less affected than users who operate with administrative user rights.
                   * Heap Overrun in pubconv.dll Vulnerability - CVE-2010-2570
                   A remote code execution vulnerability exists in the way that Microsoft Publisher parses Publisher files. An attacker could exploit the vulnerability by creating a specially crafted Publisher file that could be included as an e-mail attachment, or hosted on a specially crafted or compromised Web site, and then convincing the user to open the specially crafted Publisher file. If a user were logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less affected than users who operate with administrative user rights.
                    * Memory Corruption Due To Invalid Index Into Array in Pubconv.dll Vulnerability - CVE-2010-2571
                   A remote code execution vulnerability exists in the way that Microsoft Publisher opens Publisher files. An attacker could exploit the vulnerability by creating a specially crafted Publisher file that could be included as an e-mail attachment, or hosted on a specially crafted or compromised Web site, and then convincing the user to open the specially crafted Publisher file. If a user were logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less affected than users who operate with administrative user rights.
                   * Microsoft Publisher Memory Corruption Vulnerability - CVE-2010-3954
                   A remote code execution vulnerability exists in the way that Microsoft Publisher opens Publisher files. An attacker could exploit the vulnerability by creating a specially crafted Publisher file that could be included as an e-mail attachment, or hosted on a specially crafted or compromised Web site, and then convincing the user to open the specially crafted Publisher file. If a user were logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less affected than users who operate with administrative user rights.
                   * Array Indexing Memory Corruption Vulnerability - CVE-2010-3955
                   A remote code execution vulnerability exists in the way that Microsoft Publisher opens Publisher files. An attacker could exploit the vulnerability by creating a specially crafted Publisher file that could be included as an e-mail attachment, or hosted on a specially crafted or compromised Web site, and then convincing the user to open the specially crafted Publisher file. If a user were logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less affected than users who operate with administrative user rights.

Analysis
This bulletin addresses multiple remote code execution vulnerabilities within Microsoft Office Publisher. The vulnerabilities are caused by improper parsing of publisher files. Successful exploitation results in giving the attacker the ability to execute arbitrary code within the context of the current user.

Mitigations
Four of the five vulnerabilities can be fixed by using CACLS to prevent use of pubconv.dll within the office10 suite. CVE-2010-3954 has no mitigation available.

MS10-104
Vulnerability in Microsoft SharePoint Could Allow Remote Code Execution (2455005)
Microsoft Severity Rating: Important
eEye Severity Rating: Important

Description
This security update resolves a privately reported vulnerability in Microsoft SharePoint. The vulnerability could allow remote code execution in the security context of a guest user if an attacker sent a specially crafted SOAP request to the Document Conversions Launcher Service in a SharePoint server environment that is using the Document Conversions Load Balancer Service. By default, the Document Conversions Load Balancer Service and Document Conversions Launcher Service are not enabled in Microsoft Office SharePoint Server 2007. The update addresses the vulnerability by modifying the way that the Document Conversion Launcher Service validates specially crafted SOAP requests.
                   * Malformed Request Code Execution Vulnerability - CVE-2010-3964
                   A remote code execution vulnerability exists in the way that the Document Conversions Launcher Service validates SOAP requests before processing on a SharePoint server. An attacker who successfully exploited this vulnerability could run arbitrary code on an affected SharePoint server under the security context of a guest account.

Analysis
A remote code execution vulnerability exists within the Document Conversions Launcher Service which is caused by improperly validating SOAP requests prior to processing them on a SharePoint server. Successful exploitation would permit an attacker to execute remote arbitrary code on the SharePoint server, but only with guest user rights.

Mitigations
Stop and disable the dclauncher service. Block Office Document Conversions Launcher Service port, which is normally 8082.

MS10-105
Vulnerabilities in Microsoft Office Graphics Filters Could Allow for Remote Code Execution (968095)
Microsoft Severity Rating: Important
eEye Severity Rating: Important

Description
This security update resolves seven privately reported vulnerabilities in Microsoft Office. The vulnerabilities could allow remote code execution if a user viewed a specially crafted image file using Microsoft Office. An attacker who successfully exploited any of these vulnerabilities could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. The update addresses the vulnerabilities by modifying the way that Microsoft Office parses certain image formats and validates data when rendering images.
                * CGM Image Converter Buffer Overrun Vulnerability - CVE-2010-3945
                 A remote code execution vulnerability exists in the way that Microsoft Office allocates buffer size when handling CGM image files. The vulnerability could allow remote code execution if a user opens an Office document containing a specially crafted CGM image. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
                * PICT Image Converter Integer Overflow Vulnerability - CVE-2010-3946
                A remote code execution vulnerability exists in the way that Microsoft Office allocates buffer size when handling PICT image files. The vulnerability could allow remote code execution if a user opens an Office document containing a specially crafted PICT image. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
                 * TIFF Image Converter Heap Overflow Vulnerability - CVE-2010-3947
                 A remote code execution vulnerability exists in the way that Microsoft Office parses specially crafted TIFF image files. The vulnerability could allow remote code execution if a user opens an Office document containing a specially crafted TIFF image. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
                      * TIFF Image Converter Buffer Overflow Vulnerability - CVE-2010-3949
                      A remote code execution vulnerability exists in the way that Microsoft Office parses specially crafted TIFF image files. The vulnerability could allow remote code execution if a user opens an Office document containing a specially crafted TIFF image. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
                       * TIFF Image Converter Memory Corruption Vulnerability - CVE-2010-3950
                       A remote code execution vulnerability exists in the way that Microsoft Office parses specially crafted TIFF image files. The vulnerability could allow remote code execution if a user opens an Office document containing a specially crafted TIFF image. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
                        * FlashPix Image Converter Buffer Overflow Vulnerability - CVE-2010-3951
                        A remote code execution vulnerability exists in the way that Microsoft Office parses specially crafted FlashPix image files. The vulnerability could allow remote code execution if a user opens an Office document containing a specially crafted FlashPix image. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
                       * FlashPix Image Converter Heap Corruption Vulnerability - CVE-2010-3952
                        A remote code execution vulnerability exists in the way that Microsoft Office parses specially crafted FlashPix image files. The vulnerability could allow remote code execution if a user opens an Office document containing a specially crafted FlashPix image. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Analysis
Multiple vulnerabilities exist within Microsoft Office due to improper parsing of TIFF images, FlashPix images, and improper buffer size allocation while parsing CGM and PICT images. Successful exploitation permits an attacker to execute remote arbitrary code with the same rights as the current user.

Mitigations
Use CACLS to deny all users' access to cgmimp32.flt, pictim32.flt, tiffim32.flt, mspcore.dll, and fpx32.flt.

MS10-106
Vulnerability in Microsoft Exchange Server Could Allow Denial of Service (2407132)
Microsoft Severity Rating: Moderate
eEye Severity Rating: Moderate

Description
This security update resolves a privately reported vulnerability in Microsoft Exchange Server. The vulnerability could allow denial of service if an authenticated attacker sent a specially crafted network message to a computer running the Exchange service. Firewall best practices and standard default firewall configurations can help protect networks from attacks that originate outside the enterprise perimeter. Best practices recommend that systems that are connected to the Internet have a minimal number of ports exposed. The security update addresses the vulnerability by correcting the manner in which the Exchange Server store processes RPC requests.
                     * Exchange Server Infinite Loop Vulnerability - CVE-2010-3937
                     A denial of service vulnerability exists in the way that the Microsoft Exchange store processes specially crafted RPC calls. The vulnerable code path is only accessible to authenticated users. An authenticated attacker could exploit the vulnerability by sending a specially crafted network message to a computer running the Exchange service. An attacker who successfully exploited this vulnerability could cause the Exchange service to stop responding until manually restarted.

Analysis
This bulletin addresses a remote denial of service vulnerability within Microsoft Exchange caused by Exchanges' improper processing of certain RPC calls. Successful exploitation will cause Exchange to stop responding until it is manually restarted.

Mitigations
No mitigations have been provided my Microsoft.


Soure: http://www.eeye.com/Resources/Security-Center/Patch-Tuesday/Alert/December-2010#MS10-092
Thanks for Exploit of Year

Merry Christmas! And "Happy Holidays"

May the good times and treasures of the present
become the golden memories of tomorrow.
Wish you lots of love, joy and happiness.
MERRY CHRISTMAS!

And Social-Engineer Toolkit (SET) v1.1 Released

SET v1.1 Codename: “Happy Holidays” Released
This release adds new Metasploit-based client-side attacks (4 in total), many optimizations on the SET web server including proper threading to make it run faster as well as an overall of optimizations through the entire code base. The next version 1.2 will be an overhaul of function calls and centralization of modules to allow easier additions for third party contributions.

Also added in this release is a new set_config option that will automatically disable the auto redirection on the Java Applet so in examples with Multi-Attack where you use Java Applet + Credential Harvester it will now only redirect once the credential harvester is executed. This is especially useful when you get your payload execution and harvest credentials all within one attack.

Lastly, another great option is I've added UPX support for the Java Applet and Payload Generator attacks. In the set_config is a new option called "UPX_ENCODE=ON", this is on by default and checks to see if UPX is in the default Back|Track path. If it's not it will automatically disable the UPX packing, otherwise it will automatically pack the executable with the UPX packer. You can turn this off in the set_config by specifying UPX_ENCODE=OFF. Enjoy the latest version of SET, there is more to come with the next 1.2 release which is currently under development.

Download: http://www.secmaniac.com

Source: 

http://www.pentestit.com/2010/12/25/merry-christmas-2/

http://security-sh3ll.blogspot.com/2010/12/social-engineer-toolkit-set-v11.html

Thanks. 
 

Have a safe day!

Một bài viết về rock

Không phải tất cả những ai mê Rock sau này sẽ vẫn còn theo đuổi việc mê nhạc, nhưng chắc rằng những ai mà giờ đây vẫn phải tìm tới âm nhạc sau những bộn bề của cuộc sống thì hẳn là đã có một dạo từng đắm đuối với Rock. Đó là thời của những kỷ niệm đẹp, hay là một góc của niềm tự hào riêng tư, thật khó gọi thành danh tính, nhưng rõ ràng là vời vợi rạng ngời. Trong ngổn ngang những trào lưu âm nhạc hiện tại, bài viết này mong muốn sẽ khơi lại những niềm rất nhỏ trong vô vàn những hoài niệm của một thời - Thời của những ai từng mê Rock.

Thanh niên dạo ấy - khoảng thập niên 80-90 của thế kỷ trước - nghe thứ Rock rất khác với bây giờ, khác về chấc nhạc và kể cả tác phong nghe nhạc. Phải nói thế nào về những điều này ? Giàu nhạc tính hơn hay thuần chất hơn? Phong phú hơn hay phong sương hơn? Nhận định thế nào thì cũng đã lồng vào đó chút chủ quan của kỷ niệm.  Thôi thì chỉ nên gói gọn lại một điều, thời ấy Rock lãng mạn hơn!

Buổi này thất khó để người nghe nhạc Rock có thể nghe được một bài thật sự tử tế, vậy mà độ trước bất cứ ai mê Rock đều có thể ghi tạc trong lòng ít nhất một bài cho riêng mình, Có quá nhiều những ca khúc để có thể là tri âm của một tâm hồn yêu Rock nào đó. Là Hotel California(bản original) của The Eagle huyền thoại, với khúc solo lead đã trở thành kinh điển. Hầu như dân nghe Rock không ai là ko nghe như nuốt lấy từng nốt nhạc khi nghe đoạn 2 cây guitar solo song tấu trên 2 cung khác nhau để tạo thành một điệu bè bất hủ. Dư âm để lại cho người nghe quá sâu đậm đến nỗi nhiều anh bạn "nhiễm" nặng đến độ bỏ ra suốt nữa năm trời để cố gắng tập lại đoạn lead đó trên Guitar "thùng"! Rồi cố gắng làm tăng độ méo tiếng bằng cách lồng một lọ thủy tinh vào ngón tay để vuốt lên dây đàn. Hoặc một gã khác hầu như lúc nào trong miệng cũng ầm ì, léo nhéo theo tiếng đàn, mà nếu thử nghe kĩ thì thật đáng kinh ngạc,không bỏ sót nốt nào! Cơn nghiện này chỉ tạm chuyển hướng khi Love Song (tesla) ra đời.

Rồi một chiều nọ trời đât bâng khuâng khi chợt nghe phải đoạn intro trong bài When the Children Cry (White Lion), nhìn ra đường thấy cái gì cũng có vẻ màu nâu hoặc màu xanh dương, và xe cộ dường như chạy chậm lại, vì tâm hồn người nghe đã trở nên bát ngát và rộng mở quá. Hoặc cá biệt là có "gã" nào đó mắt thật sự rơm rớm nước mắt khi nghe phải Love of Life time (Fire House). Thời "ủy mị" đó thật sự là những ngày vàng của những tâm hồn mới bén duyên với Rock, cũng những cơ man nào là Home Sweet Home (Motley Crue), Mama,I'm coming Home (Ozzy Osbourne), Heartbreak Station (Cinderella), To be with You (Mr.Big), I'll be there for you (Bon Jovi)......, dẫu khi có được biết đến muộn màng thì cũng đủ để làm tím lại mọi ánh nắng chói chang của đất Sài thành

Để rồi cơn lậm đã ngày một lậm hơn băng qua suốt thời trai trẻ. Phải có một thứ gì đó kịch tính hơn, tự do hơn."hoang đàng" hơn. Màu mè một chút là Gun N' Roses với Don't Cry...November Rain, Civil War...cuồng loạn và dữ dội hơn là Cowboys From Hell, This Love (Pantera). nhưng chân thật và ám ảnh nhất là Nothing Else Matters, Sad But True, One...(Metallica). làm sống mãi hình ảnh của những anh bạn ngồi nghe Rock bất động như phỗng, cằm cúi xuống gần đụng ngực khi nghe phải siêu phâm The Unforgiven, trái ngược với 1 gã người trước màn hình tivi đã nhập tâm đến độ gã cứ ngồi lắc đầu suốt cả bài... Những thứ đó dẫu gì cũng chỉ là nông nỗi để trước khi " dày dặn" và "chín chắn" hơn...Không thể nào quên được thời khắc mà một gã đàn anh dúi vào tay một cuốn băng cassette mà như dúi một bảo vật..

Nếu những từ viết hoa trên có gợi lại tâm trí bạn điều gì thì âu rằng đó cũng là một trong những điều hạnh phúc nhất của người nghe nhạc-sự đồng điệu. Còn nếu như bạn vẫn chưa thấy đủ, thì hãy nhớ lại xem thời vàng son đó có khi nào bạn phải chạy ngược chạy xuôi để cố thu cho được một cuốn băng cassette chọn lọc với những ca khúc Rock tri âm, để rồi hân hoan niềm vui sướng và tay run run ghi lại cái list nhạc để dán vào sau hộp băng.  Hoặc đêm nằm nhét headphone vào tai nghe tới nghe lui một ca khúc vài chục lần và tự gào thét trong óc. Hay nuôi mấy tháng trời một mái tóc dài để khi ngồi tụm với đám bạn và thầm tự hào khi nó bay lất phất trong gió. Và kể cả việc một hôm nỗi hứng lấy dao lam rạch vào chiếc quần jeans thường mặc ngay khoảng ngang đầu gối, xé cho chỉ tua ra để thách thức mọi ánh mắt khó chịu của đời thường.

Những điều này. Thật sự là nông nỗi...nhưng nó đẹp vì nó thuộc về một thời mà bạn đã sống vì âm nhạc. Có thể bây giờ thị hiếu âm nhạc của bạn đã khác, nhưng tin chắc nếu bạn đã từng trải qua một thời "rock" thì đó mãi là giai đoạn mà bạn luôn nhớ về và tự hào với nó. Bởi xét riêng về mặc âm nhạc và thái độ đối với âm nhạc, thì có phải đó là thời mà cảm xúc âm nhạc của bạn là hồn nhiên và tinh khôi nhất. Mà điều này trong quảng đời còn lại không phải lúc nào bạn cũng gặp lại được nhiều hoài niệm nhiệm mầu khi thuở còn đôi mươi.

Nguồn: Tạp chí Nghe nhìn

Xin cám ơn người viết.

Bài viết trên chỉ lột tả phần nào đó của những ai nghe rock từ lâu và người đã nghe rock và bây giờ vẫn đang tìm hiểu, nghe về rock. Còn những người mới bây giờ họ có cách nghe khác, cảm nhận của họ.

Tất nhiên có mỗi người một cảm nhận, sở thích riêng: người thích Power, Symphony, Gothic, Viking, Death, Brutal, Black, Doom, Progressive, … hay pha trộn giữa các dòng Rock/Metal.  Nhưng cũng đã nghe và đọc về rock đó chính là nền tảng để bạn, tôi có thể nghe được những dòng, thể loại nhạc khó tính hơn. Và có thể bây giờ ai cũng có cái nghe riêng của mình hoặc có thể họ không nghe nữa nhưng khi nào google họ vẫn tìm đến một “từ khóa” chung .. rock

Một số album dưới đây theo ý mình nghĩ là “must have” khi bạn đã từng đi vào tìm hiểu và nghe rock. Đó  là những album đẹp … không biết vì sao nữa.

Melodic Death Metal

Eternal Tears Of Sorrow - A Virgin and a Whore

Dark Tranquillity - The Gallery

Doom/Folk Metal

Estatic Fear - A Sombre Dance

Uaral – Laments (EP)

Progressive Metal

Opeth – Morningrise

Opeth -  Still Life

Opeth - Damnation

Green Carnation - Acoustic Verses

Haggard - Eppur Si Muove

Pink Floyd - The Division Bell

Have a fun!