Tag Archives: security

ZeroAccess Modifies Peer-to-Peer Protocol for Resiliency

      No Comments on ZeroAccess Modifies Peer-to-Peer Protocol for Resiliency

ZeroAccess has always distributed its malicious payloads to infected computers using a peer-to-peer protocol. The use of a peer-to-peer protocol removes the need to maintain centralized command-and-control (C&C) servers to distribute malicious payloads. In 2011, ZeroAccess’ peer-to-peer protocol communicated over TCP, but in the second quarter of 2012 the protocol was modified to use UDP. This was the last significant update to the ZeroAccess peer-to-peer protocol until June 29, 2013.

Symantec has been closely monitoring the ZeroAccess peer-to-peer networks since its discovery. On June 29, 2013, we noticed a new module being distributed amongst ZeroAccess peers communicating on the UDP-based peer-to-peer network that operates on ports 16464 and 16465. ZeroAccess maintains a second UDP-based network that operates on ports 16470 and 16471. ZeroAccess peers communicate to other peers connected to the same network; peers do not communicate across networks.

The module discovered on June 29 modifies the peer-to-peer functionality of ZeroAccess to make its peer-to-peer network more robust and resilient against outside manipulation. The following is a summary of the key code changes made on June 29, 2013, affecting ZeroAccess peer-to-peer functionality:

  • The number of supported peer-to-peer protocol messages has been decreased from three to two.
  • A secondary internal peer list is now used that can hold over 16 million peer IP addresses, up from 256 IP addresses.
  • The secondary internal peer list is stored as a Windows NTFS alternate data stream.
  • The logic of how a ZeroAccess peer will contact other peers has been modified.
  • Error checks and timeouts have been added to the malicious file download TCP connections.

In addition to the code update being available on the UDP 16464/16465 peer network for existing peers, after June 29, 2013, we have observed new ZeroAccess installers for the UDP 16464/16465 network which infect computers with ZeroAccess also contain the new peer-to-peer protocol and code changes.

Interestingly, the ZeroAccess UDP 16470/16471 network has not yet received the code update. The new ZeroAccess installer samples for the UDP 16470/16471 network also do not contain the new code. In the past, both the UDP 16464/16465 and UDP 16470/16471 networks generally received new features and code modifications at approximately the same time.

Most of the code changes made by the ZeroAccess authors in this update seem to be in response to published research on ZeroAccess or other perceived weaknesses the authors found in the code. These changes are also further evidence that ZeroAccess continues to be actively developed and remains a threat. Symantec expects development of ZeroAccess to continue and will actively monitor the threat for those changes.

The following sections provide further technical details on the peer-to-peer protocol and related code changes made to ZeroAccess.
 

Modified peer-to-peer protocol

When discovered in 2012, ZeroAccess’ UDP-based peer-to-peer protocol supported three message types: getL, retL, and newL. A number of security researchers have described the messages and pointed out flaws in the protocol, especially regarding the newL message type. The newL message type is used by ZeroAccess to share directly routable IP addresses (often called super nodes or super peers) amongst its peers. When a peer receives a newL message it adds the included IP address within the newL message type into its internal peer list. The peer also forwards the newL message to other peers it knows about, magnifying the message’s effect. Prior to June 29, by crafting a newL message and sending it to a ZeroAccess peer it was possible to introduce a rogue IP address into an infected ZeroAccess peer’s internal peer list and have that rogue newL message distributed to other ZeroAccess peers.

The new peer-to-peer protocol removes the newL message type, allowing the botnet to filter out rogue peer IPs.
 

Expanded internal peer-list

Another flaw previously identified regarding ZeroAccess’ peer-to-peer protocol is the fixed internal peer list size. Prior to the June 29 update, a ZeroAccess’ internal peer list was capped at 256 peers. After June 29, a secondary peer list was added and memory reserved to hold up to 16 million peer IP addresses. The list of 256 peers continues to be the “working set” of peers that are periodically contacted. The secondary peer list is used for redundancy purposes.

When the peer list was only 256 peers in length it was feasible that a significant ZeroAccess clean-up action could cut off ZeroAccess peers from the peer-to-peer network because none of their 256 known peers were online. It also became theoretically feasible to replace a ZeroAccess peer’s 256 internal peer list with rogue IP addresses. The secondary peer list makes both of these actions more difficult.

The secondary peer list is written to disk, along with the 256 peer working set. Previous to June 29, the 256 peers from the internal peer list were stored in a file named “@”. After June 29, the @ file still exists and continues to contain 256 peer IP addresses from the working set of peers. The secondary peer list, containing up to 16 million IP address, is stored as an NTFS alternate data stream of the @ file. The NTFS alternate data stream also uses the @ filename.
 

Altered run-time peer contact behavior

Prior to June 29, one of the peers from the 256 peers in ZeroAccess’ internal peer list would be contacted using a getL each second to ask for any data on new malicious modules and new ZeroAccess peer IP addresses. This behavior continues after June 29. However, for any remote peer that responds to a message, that responding peer’s IP address and response time-stamp will be added to the secondary peer list.

The IP’s in the secondary contact list are also contacted when ZeroAccess first starts up. At startup, as many as 16 IPs from the secondary peer list will be contacted each second. This secondary peer list communication will continue until at least 16 remote peers have responded to the infected host. Once an infected peer has been contacted by 16 remote peers, peers from the secondary list will not be contacted until the infected computer is restarted. The secondary peer list will continue to be added to and updated as remote peers respond as part of the normal periodic contact with the 256 peers from the working set. This behavior allows a ZeroAccess client to keep a large list of previously contacted peers for redundancy and still operate with a small working set of 256 peers in order for malicious payloads to be quickly distributed throughout the ZeroAccess network.

Another runtime peer-contact behavior change is the keeping of a contacted-peer state table. ZeroAccess peers continue to send unsolicited getL messages to remote peers and expect to receive retL messages in response. The retlL responses contain malicious payload metadata as well as new peer IP addresses. Prior to June 29, an infected peer would accept any UDP message from any IP address, regardless of whether the infected host had contacted that remote IP address before or not. After June 29, a ZeroAccess peer will continue to accept getL messages from any remote IP, but will only accept a retL message from an IP address that the receiving peer had previously sent a getL message to. Basically, when a ZeroAccess peer sends a getL message to a remote IP address it will add that remote IP address to a table in memory. When a ZeroAccess peer receives a retL message, it will scan its table of IP addresses that it previously sent a getL message to, if the peer’s IP address that sent the retL message does not appear in the table the ZeroAccess peer that received the retL message will disregard it. This change ensures that unsolicited retL messages are ignored and makes using retL messages as a means of introducing rogue IP addresses (like newL messages could be used in the previous protocol) more difficult.
 

Improved payload file transfer resiliency

A ZeroAccess peer already contains checks to ensure it does not download a rogue payload file from a remote host. A payload file’s metadata in retL messages is digitally signed and cannot be easily forged. In addition, the malicious payload files themselves are digitally signed, the signature is checked after the file is downloaded. The digital signatures prevent a rogue peer from introducing an arbitrary executable module into the peer-to-peer network. The June 29 code change adds checks to ensure that TCP file transfers are not taking too long to complete. These changes seem to be designed to protect against a kind of denial-of-service attack where a rogue peer attempts to trick a ZeroAccess peer into downloading a large number of files from a rogue peer that would deliver the file data too slowly. Using this attack it would be possible to occupy all TCP ports on an infected computer, not allowing it to download the intended malicious payloads.

Instascam: Instagram for PC Leads to Survey Scam

      No Comments on Instascam: Instagram for PC Leads to Survey Scam

Instagram, the popular photo and video sharing service acquired by Facebook, is often a target for spam and scams, some of which we have written about over the past year. This week, a friend shared an in-stream advertisement for a program called Instag…

?????????????????????

      No Comments on ?????????????????????

寄稿: Sujay Kulkarni

image1_9.png

ジ・アッシズ（The Ashes）は、イングランド代表とオーストラリア代表の間で競われるクリケットのテストマッチとして人気の高いシリーズです。両国の間で最も古いテストマッチであり、イングランドとオーストラリアで 1 年ごとに交互に開催されます。クリケットファンであれば、この注目のシリーズを観戦するためにテレビとインターネットに釘付けになっていることでしょう。

現在のところイングランドが 3-0 でリードしていて、最後のテストマッチでイングランドが快勝することになれば（実現しそうです）、対オーストラリア戦における転換点になるでしょう。とはいえ、今話題になっているのは、スコールズ（Scholes）、キャリック（Carrick）、ロビン・ファン・ペルシ（Robin Van Persie）といったサッカー選手ではなく、打倒オーストラリアをもくろむキャプテンのアラステア・クック（Alastair Cook）と彼が率いる精鋭チームです。

この興味深いシナリオを悪用しようと、詐欺師が待ち構えています。詐欺師は、あなたの電子メールアドレスが「2013 年アッシズシリーズで 242,500,000 ドルに当選（242,500,000 USD in the 2013 ASHES SERIES）」したと称して、個人情報をメールで送信させようとします。

詐欺の手口としてユーザーに求められるのはただ 1 つ、詐欺師に個人情報を返信することだけです。それだけで、後は詐欺師の思いのままになるというわけです。

これは典型的な 419 スパムです。電子メールの中で詐欺師は、あなたが抽選に当たった（たとえば、50,000 ドルの賞金が当たった）と説明し、それを受け取るために今すぐ個人情報を返信するようにと要求してきます。

シマンテック製品をお使いのお客様は、安全対策として以下の予防措置をお守りください。

  • オペレーティングシステムのパッチが公開されたらすぐに適用する。
  • ウイルス対策定義を定期的に更新する。
  • 送信者や件名に覚えがない迷惑メールは開かないようにし、疑わしい添付ファイルもクリックしないようにする。
  • 迷惑メールを扱うときは、不明な相手に個人情報を送信しないよう特に注意する。

詐欺師の攻撃に不意を突かれないよう注意しながら、今年のアッシズシリーズをお楽しみください。

 

* 日本語版セキュリティレスポンスブログの RSS フィードを購読するには、http://www.symantec.com/connect/ja/item-feeds/blog/2261/feed/all/ja にアクセスしてください。

Spammer’s Googly Over Ongoing Ashes Series

      No Comments on Spammer’s Googly Over Ongoing Ashes Series

Contributor: Sujay Kulkarni

image1_9.png

The Ashes Test cricket series, one of most popular Test series in cricket, is played between England and Australia. It is played alternately in England and Australia and is the oldest test rivalry between these two sides. Cricket fans are glued to the TV and their online devices to watch this riveting series.

In the current Ashes series England is leading 3-0 and is on the cusp of creating history against Australia—if they beat them hands down in the last test match, which now is a real possibility. However, what is making the rounds is not Scholes, Carrick, or Robin Van Persie, but Captain Cook and his elite squad waiting to steamroll Australia.

This interesting scenario has got scammers smacking their lips. They have come up with a trick to lure you into sending them your personal information over email because your email address has won  “242,500,000 USD in the 2013 ASHES SERIES”.

Here is the catch, you have one obligation to fulfill by replying back to the scammer with your “personal details”. Well, that would set the ball rolling for the scammer, wouldn’t it?

In a typical 419 spam, the scammer mentions in the email that you have won—an award of $50,000 USD for example—and asks you to reply back with your personal details, immediately to claim the money.

Symantec customers should take the following precautionary measures to stay safe:

  • Update operating system patches when prompted
  • Update the antivirus patches regularly
  • Do not open any unsolicited emails when you do not recognize the sender or the subject and avoid clicking on suspicious email attachments
  • When dealing with unsolicited mails avoid sending any personal details, especially to unknown persons

Enjoy the ongoing the Ashes Test cricket series without getting bowled over by any Spammer’s googly.

E-commerce in the Middle East – On the Up and Up!

      No Comments on E-commerce in the Middle East – On the Up and Up!

E-commerce is on a massive upward trajectory in the Middle East and North Africa (MENA) region. According to a recent report issued by Visa[1], nowhere else in the world is growing as fast: MENA experienced a 45% increase in 2012, compared to the previous year, with transactions soaring from $10 to $15 billion.[2] The fastest growing markets

For retailers who have tended to ignore or avoid this market, in favour of others that have seemed both more stable and lucrative, those figures are bound to make them think again. This is fertile territory and many of their rivals are now clearly reaping the rewards to be had there. So expect to see competition hotting up!

What are people buying online right now and how can the MENA region overcome some fundamental factors to drive growth even higher? The popular and growing areas for e-commerce right now are banking, paying bills and booking travel. Purchasing items and/or services is still not as developed as in the major European markets, and clearly this offers vast promise for those who can exploit its vast potential in the MENA region[3].

That said, and despite its impressive performance of late, the MENA region is still not actually expanding at nearly the same rate as the rest of the globe when it comes to e-commerce.  Why is this? In part it’s down to lack of confidence and trust online; according to a recent survey by Onecard, 56 per cent of respondents based in the Middle East said they were concerned about credit card fraud and the region faces the same barriers seen elsewhere around the world, where lack of trust and payment security are regularly highlighted as key concerns for people when choosing to shop online. Additionally a report from Deloitte highlights[4] that it is there are three other factors that are holding growth back:

First, there are the logistical issues around physical addresses (they are not well defined enough) and also the postal system itself, whose infrastructure is poor.

Secondly, there is an absence of the relevant e-laws necessary to provide proper levels of protection for consumers and vendors.

And, finally, it can be expensive for small businesses to set up payment gateways, thus deterring them from entering the market – a factor that is reflected in the widespread popularity of cash on delivery (COD) payments across the region. Strikingly, while there are an estimated 90 million internet users in the Middle East, a mere 15% of Middle East companies have an online presence.[5] Moreover, some 70-80% of online purchases are COD, with just 30% paid for online – and that despite almost 50% of consumers owning credit cards.

At the same time, it should be said that such flexibility of payment types has certainly made e-commerce more accessible, and more attractive, to users; and no doubt has contributed substantially to the surge in sales that has taken place recently. Whilst ‘cash on delivery’ is a good solution to consumers’ lack of trust in online transactions, it can hinder the growth of e-commerce in the region due to difficulty in coordinating home delivery services and ultimately it’s much less cost effective than taking payments online. As mentioned above, ecommerce comes branded with what is a typical online question for end users and retailers alike: ‘Are you safe?’ Because, unless they truly believe that they can operate securely online – and that transactions can be undertaken and completed in a tightly protected environment – the massive potential that MENA offers will simply not be realised.

These issues are of course being addressed and in anticipation of this it’s worth considering that in order to Be successful online, and to capture more consumer mindshare and business, sites need to be:

  • Accessible (particularly for mobile) – consider responsive design to meet the needs of your visitors
  • Easy to use – e.g. clear navigation and extensive search
  • Trustworthy – demonstrate that your site can be trusted with credit card details using clear security indicators such as SSL, and through the use of online trust marks such as the Norton Secured Seal
  • Fully localised into your target markets language.

All well and good… in theory. The reality is that, while it’s relatively simple to set up an e-commerce site, there is still widespread ignorance of the potential hazards that exist when sending data via unsecured connections. In fact, many customers still do not even know that SSL certificates exist to protect them online.

Clearly, sites in the Middle East region that really want to be successful should be using SSL and trust marks to demonstrate that they are professional, dependable and safe to do business with. Indeed in my opinion SSL certificates should be mandatory for any ecommerce site or for anyone else that asks customers to submit any kind of personal information. Using SSL is also the clever option for companies that don’t ask for personal information from visitors – something that can act as a barrier on line. Companies such as Google use SSL to pass along certain information about what searchers are looking for – and are requiring this higher level of security to perform that service. This trend seems likely to continue, making SSL certificates vital to virtually any website – but especially those with e-commerce in mind.

One question when considering which security vendor can add the most value to your existing or newly established site is “how can I can demonstrate my trustworthiness to potential customers?” According to a survey carried out this year by the independent web research organisation Baymard Institute in conjunction with Google, the Norton Secured Seal is by far the most trusted, with 35.6% of the votes – nearly 13% ahead of its nearest rival. It was shown to be the seal that gave customers the strongest sense of trust when purchasing online, making it the de facto choice[6].

Such reassurance will play a major role, as the internet spreads it reach and e-commerce gathers ever greater momentum throughout MENA capturing and keeping customers is where success lies.

 

AVAST detects and blocks 100% of Zeus Trojans in Banking Security Test

      No Comments on AVAST detects and blocks 100% of Zeus Trojans in Banking Security Test

avast! Internet Security detects and blocks 100% of the world’s most malicious Zeus Trojan strains. The Zeus Trojan is the most prevalent type of financial malware. Zeus infects a user’s computer and lies in wait until the user logs on to a banking website. Once that occurs, it attempts to steal the user’s bank account […]

Targeted Attacks Delivering Fruit

      No Comments on Targeted Attacks Delivering Fruit

Contributor: Lionel Payet
Political news has always been one of the top topics used in targeted attacks. Last week we came across unique malicious emails targeting high-profile companies in Europe and Asia (in sectors such as finance, mining, telecom, …

Android Cryptographic Issue May Affect Hundreds of Thousands of Apps

      No Comments on Android Cryptographic Issue May Affect Hundreds of Thousands of Apps

There’s been a lot of confusion over the last few days, since bitcoin.org announced that an Android component responsible for generating secure random numbers contained a critical weakness that rendered many Android bitcoin wallets vulnerable.
Th…

Microsoft Patch Tuesday – August 2013

      No Comments on Microsoft Patch Tuesday – August 2013

Hello, welcome to this month’s blog on the Microsoft patch release. This month the vendor is releasing eight bulletins covering a total of 23 vulnerabilities. 14 of this month’s issues are rated ’Critical’.

As always, customers are advised to follow these security best practices:

  • Install vendor patches as soon as they are available.
  • Run all software with the least privileges required while still maintaining functionality.
  • Avoid handling files from unknown or questionable sources.
  • Never visit sites of unknown or questionable integrity.
  • Block external access at the network perimeter to all key systems unless specific access is required.

Microsoft’s summary of the July releases can be found here:
http://technet.microsoft.com/en-us/security/bulletin/ms13-Aug

The following is a breakdown of the issues being addressed this month:

  1. MS13-066 Vulnerability in Active Directory Federation Services Could Allow Information Disclosure (2873872)

    AD FS Information Disclosure Vulnerability (CVE-2013-3185) MS Rating: Important

    An information disclosure vulnerability exists in Active Directory Federation Services (AD FS) that could allow the unintentional disclosure of account information.

  2. MS13-062 Vulnerability in Remote Procedure Call Could Allow Elevation of Privilege (2849470)

    Remote Procedure Call Vulnerability (CVE-2013-3175) MS Rating: Important

    An elevation of privilege vulnerability exists in the way that Windows handles asynchronous RPC requests. An attacker who successfully exploited this vulnerability could execute arbitrary code and take complete control of an affected system. An attacker could then install programs, view, change, or delete data, or create new accounts with full user rights.

  3. MS13-064 Vulnerability in Windows NAT Driver Could Allow Denial of Service (2849568)

    Windows NAT Denial of Service Vulnerability (CVE-2013-3182) MS Rating: Important

    A denial of service vulnerability exists in the Windows NAT Driver that could cause the target system to stop responding until restarted.

  4. MS13-060 Vulnerability in Unicode Scripts Processor Could Allow Remote Code Execution (2850869)

    Uniscribe Font Parsing Engine Memory Corruption Vulnerability (CVE-2013-3181) MS Rating: Critical

    A remote code execution vulnerability exists in the Unicode Scripts Processor included in affected versions of Microsoft Windows. An attacker who successfully exploited this vulnerability could run arbitrary code as the current user.

  5. MS13-065 Vulnerability in ICMPv6 could allow Denial of Service (2868623)

    ICMPv6 Vulnerability (CVE-2013-3183) MS Rating: Important

    A denial of service vulnerability exists in the Windows TCP/IP stack that could cause the target system to stop responding until restarted. The vulnerability is caused when the TCP/IP stack does not properly allocate memory for incoming ICMPv6 packets.

  6. MS13-059 Cumulative Security Update for Internet Explorer (2862772)

    Internet Explorer Process Integrity Level Assignment Vulnerability (CVE-2013-3186) MS Rating: Moderate

    An elevation of privilege vulnerability exists in the way that Internet Explorer handles process integrity level assignment in specific cases. An attacker who successfully exploited this vulnerability could allow arbitrary code to execute with elevated privileges.

    EUC-JP Character Encoding Vulnerability (CVE-2013-3192) MS Rating: Moderate

    An information disclosure vulnerability exists in Internet Explorer that could allow script to perform cross-site scripting attacks. An attacker could exploit the vulnerability by inserting specially crafted strings into a website, resulting in information disclosure when a user viewed the website.

    Internet Explorer Memory Corruption Vulnerability (CVE-2013-3184) MS Rating: Critical

    A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    Internet Explorer Memory Corruption Vulnerability (CVE-2013-3187) MS Rating: Critical

    A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    Internet Explorer Memory Corruption Vulnerability (CVE-2013-3188) MS Rating: Critical

    A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    Internet Explorer Memory Corruption Vulnerability (CVE-2013-3189) MS Rating: Critical

    A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    Internet Explorer Memory Corruption Vulnerability (CVE-2013-3190) MS Rating: Critical

    A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    Internet Explorer Memory Corruption Vulnerability (CVE-2013-3191) MS Rating: Critical

    A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    Internet Explorer Memory Corruption Vulnerability (CVE-2013-3193) MS Rating: Critical

    A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    Internet Explorer Memory Corruption Vulnerability (CVE-2013-3194) MS Rating: Critical

    A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    Internet Explorer Memory Corruption Vulnerability (CVE-2013-3199) MS Rating: Critical

    A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

  7. MS13-063 Vulnerability in Windows Kernel Could Allow Security Feature Bypass (2859537)

    ASLR Security Feature Bypass Vulnerability (CVE-2013-2556) MS Rating: Important

    A security feature vulnerability exists in Windows due to the improper implementation of the Address Space Layout Randomization (ASLR). The vulnerability could allow an attacker to bypass the ASLR security feature, most likely during, or in the course of exploiting, a remote code execution vulnerability. The attacker could then load a DLL in the process.

    Windows Kernel Memory Corruption Vulnerability(CVE-2013-3196) MS Rating: Important

    An elevation of privilege vulnerability exists in the Windows kernel due to a memory corruption condition in the NT Virtual DOS Machine (NTVDM). An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs, view, change, or delete data, or create new accounts with full user rights.

    Windows Kernel Memory Corruption Vulnerability(CVE-2013-3197) MS Rating: Important

    An elevation of privilege vulnerability exists in the Windows kernel due to a memory corruption condition in the NT Virtual DOS Machine (NTVDM). An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs, view, change, or delete data, or create new accounts with full user rights.

    Windows Kernel Memory Corruption Vulnerability(CVE-2013-3198) MS Rating: Important

    An elevation of privilege vulnerability exists in the Windows kernel due to a memory corruption condition in the NT Virtual DOS Machine (NTVDM). An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs, view, change, or delete data, or create new accounts with full user rights.

  8. MS13-061 Vulnerabilities in Microsoft Exchange Server Could Allow Remote Code Execution (2876063)

    Oracle Outside In Contains Multiple Exploitable Vulnerabilities (CVE-2013-2393) MS Rating: Critical

    Remote Code Execution vulnerabilities exist in Exchange Server 2007 and Exchange Server 2010 through the WebReady Document Viewing feature. The vulnerabilities could allow a remote code execution as the LocalService account if a user views a specially crafted file through Outlook Web Access in a browser.

    Oracle Outside In Contains Multiple Exploitable Vulnerabilities (CVE-2013-3776) MS Rating: Critical

    Remote Code Execution vulnerabilities exist in Exchange Server 2007 and Exchange Server 2010 through the WebReady Document Viewing feature. The vulnerabilities could allow a remote code execution as the LocalService account if a user views a specially crafted file through Outlook Web Access in a browser.

    Oracle Outside In Contains Multiple Exploitable Vulnerabilities (CVE-2013-3781) MS Rating: Critical

    Remote Code Execution vulnerabilities exist in Exchange Server 2007 and Exchange Server 2010 through the WebReady Document Viewing feature. The vulnerabilities could allow a remote code execution as the LocalService account if a user views a specially crafted file through Outlook Web Access in a browser.

More information on the vulnerabilities being addressed this month is available at Symantec’s free SecurityFocus portal and to our customers through the DeepSight Threat Management System.