Latest Vulnerability Attacks Steer Clear of Vista SP1, but Not XP SP3
section: windows, for your questions: KezNews forum, 24.3.2008
The latest attacks targeting vulnerabilities in Microsoft's software products have steered clear of Windows Vista Service Pack 1.
And despite the fact that the Redmond company touted security advancements when it introduced SP1 for Vista, available as of March 18, the fact of the matter is that neither Windows Vista RTM is impacted by exploits targeting a buffer overrun vulnerability in the Microsoft Jet Database Engine. The security flaw can be exploited through Word, Microsoft informed.
Bill Sisk, Microsoft Security Response Center Communications Manager, wanted to clarify the situation and revealed that the company had detected "very limited, targeted attack exploiting a vulnerability in Microsoft Jet Database Engine. Our initial investigation has shown that this vulnerability affects customers using Microsoft Word 2000 Service Pack 3, Microsoft Word 2002 Service Pack 3, Microsoft Word 2003 Service Pack 2, Microsoft Word 2003 Service Pack 3, Microsoft Word 2007 and Microsoft Word 2007 Service Pack 1 on Microsoft Windows 2000, Windows XP, or Windows Server 2003 Service Pack 1."
Apparently, in addition to Vista RTM and Vista SP1, Windows Server 2003 SP2 is also not vulnerable. This because all three operating systems feature a Microsoft Jet Database Engine that is not impacted by the buffer overrun vulnerability. However, because of the general Windows XP reference made by Microsoft, it is clear that both SP1, SP2 and even the upcoming Service Pack 3 are vulnerable. Still, the company claims that the risk is limited.
"The attacker first created a malicious Access file exploiting the unpatched CVE-2007-6026. Next, to bypass Outlook restrictions mentioned before, the .mdb file was renamed with a different file extension (.asd, a video format). With this trick, as clearly showed in the following picture, Access files are no longer blocked by Outlook because the protection triggers just on the file extension and not on the file format itself. The attacker needs only to find a trick to force the MS Jet library to open the file and trigger the vulnerability that will run the malicious shellcode. Some social engineering and a little help from Office applications will work out well in this specific attack," explained Elia Florio, Symantec Security Response Engineer.
source:
news.softpedia.com
Send link 2 friend | Permalink
MORE RELATED ARTICLES:
XP SP3 and Vista SP1 Are in the Clear, Word Is Still Out on Windows 7 || Vista Still Breathing as XP Chokes on Latest Vulnerability || The First XP SP3 Security Vulnerability || Vista SP1 RC Leaves XP SP2 in the Dust, but What About XP SP3? || Microsoft Makes Its Own Vista SP1 vs. XP SP2, Leaves XP SP3 Out
Comments(12)
well vista has it's flaws where security is concerned. it's a big clusterfu*k anyways.
xp3 seems like a good service pack, even though my system has been acting weird lately
after the 4th re-install within a month. there is always be security holes in os's..
that's why patches were made to fix the problems.. now if ms can get off there lazy asses
and release these fixes faster then every tuesday of every lameass month we would be more
secure. i say release fixes as soon as they are sure it's not fubar. straight to windows
updates.
iloveanalchicks you are a stupid down syndrome child!
vista has a much better
security model. uac and the lack of exploits means that in order to get owned by a virus,
you likely have to manually install it yourself. it's just as secure as linux or osx in
this regard.
xp however, has no security, and virus's and spyware can install
themselves when they like. lmao if you think xp is more secure.
stupid child.
the one named "vista is more secure" *laughs*
take this in mind:
"something done by humans can be undone by humans, and faster".
the meaning?
well, all that uac crap can and is bypassed. there's no "virus-less" system, there's
no "absolute" perfection in something. there are always flaws.
if you really
think that just by having vista and (as a plus) an antivirus, you're "safe", you're as
wrong as the previous comment.
but oh no, he isn't wrong, from my pov. xp is
better than vista in the way that it lets you control more aspects of the os w/o the
stupid uac crap popping up each 3 clicks. i've never had virus in my xp. why? not because
of the antivirus, because i know what kind of things i download from the internet, unlike
yourself.
vista is for noobs. this is truly the first os that trys to protect the user from
themselves! uac is a joke! vista does not, i repeat does not come with an antivirus. all
vista has with it is windows defender (i kid you not!) and ie 7s 'protected mode'! what
a joke! if you think that is enough to protect you out of the box youre a dumba.ss!
get a real os, get xp pro. i came to that conclusion after testing vista ultimate for 2
years. vista is a train wreak, it has no reason to exist except to be microsofts new
cashcow. like office 2007, cmon how many versions of office do we need? vista is a memory
and cpu whore guzzling resources, taking your money for unecessary hardware upgraded and
leaving you high and dry, with poor performance. you dont need drm. drm calls home to
mama every 30 seconds to microsoft to uninsure youre not doing anything ilegal.
i thought that piece of junk was for gotten about long ago. there so many better and more
secure mail services out there and easier to work with then that thing.
vista is better
i am gay and like to su.ck other mens penis!
just a thought! why are all the xp fanatics always thinking about other men's penis?
jake is a stupid retarded mong child.
looks like theres no one here to seriously discuss issues, just vicious children that are
beneath my contempt-get a life already!
may i ask since when os come with anti-virus? the problem of virus and malwares is not
about the os, but rather the popularity of os itself.
you don't get that many
virii from mac or linux (doesn't means there's none, mind you) simply because their
popularity doesn't justify the virus writer to sweat on it. hypothetically, if you know
what you're doing in vista, uac alone could protect you from any kind of virus. it's as
safe as running restricted user all the time in xp.
windows defender is not an
anti-virus by any chance. it provide basic function to protect vista from unauthorized
program to change your computer settings. if microsoft bundled anti-virus with vista from
the day one, they would be sued for anti-trust and anti-competitive practice.
if you don't like uac in vista, good luck with the password boxes from macos and sudo
from linux.
asking for secure computing without certain kind of account
protection mechanism is like asking for safe s_e_x without condom - it's just not gonna
happen
"vista is for noobs. this is truly the first os that trys to protect the user from
themselves!"
do you understand how many people are so computer illiterate that
the fact they are protected by default makes the os great. also its easy to take off and
alter just as much as xp, so the aurguments of it being for "noobs" says the the os is
ready for the first time user, and just so you know you are not the only moron the system
was designed for.
also i am not sure about this drm thing, because i have not
run into anything blocking me from anything. so i think alot of you guys are so clueless
about computers. especially after saying you tested it for two years.
seriously i think you guys are blind and also the techs of the past.
at samic: myself, and other early testers of longhorn/vista all agreed that as a vista
ultimate microsoft could've, should've provided a free subscription to onelivecare. as
it is the so-called 'vista ultimate' contains no real incentive other than the name
itsself.
at codyp: its the fact that microsoft redisigned basic windows
functions layers deep that frustrates longtime users. plus, they made everyone a
'traveling user' thus limiting your priveledges, in effect eliminating the admin
account. the drm infection is baked so deep inside of vista there is seriously no way to
remove it. because in order to play encrpted content, like blu-ray the os must unecode,
encode, and back and forth. this uses too many resources. i personally refuse to support
drm with anything, my mp3s, movies, no way! drm in vista queries the os every 30 seconds
and sends a report to microsoft. this hollywood spyware is unacceptable. currently with xp
i will rent a blu-ray, rip it, and play it with no problems, no copyright full blown
glory. why should i downgrade
to an os like vista that assumes i am a criminal out of
the box? sorry, not me.
No new comments are allowed for this article.
For your questions use our KezNews Forum
geez LOUT
By iloveanalchicks on 25.03.2008 - 10:03