From security em unicamp.br  Wed Nov  5 10:43:00 2008
From: security em unicamp.br (CSIRT - UNICAMP)
Date: Wed, 5 Nov 2008 10:43:00 -0200
Subject: [SECURITY-L] US-CERT Technical Cyber Security Alert TA08-309A --
	Adobe Reader and Acrobat Vulnerabilities
Message-ID: <20081105124259.GC6598@unicamp.br>

----- Forwarded message from US-CERT Technical Alerts <technical-alerts em us-cert.gov> -----

From: US-CERT Technical Alerts <technical-alerts em us-cert.gov>
Subject: US-CERT Technical Cyber Security Alert TA08-309A -- Adobe Reader and Acrobat Vulnerabilities
To: technical-alerts em us-cert.gov
Date: Tue, 4 Nov 2008 16:43:33 -0500
Organization: US-CERT - +1 202-205-5266


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


                     National Cyber Alert System

               Technical Cyber Security Alert TA08-309A


Adobe Reader and Acrobat Vulnerabilities

   Original release date: November 04, 2008
   Last revised: --
   Source: US-CERT


Systems Affected

     * Adobe Reader version 8.1.2 and earlier
     * Adobe Acrobat (Professional, 3D, and Standard) version 8.1.2 and earlier


Overview

   Adobe  has  released  Security  Bulletin APSB08-19 to address multiple
   vulnerabilities affecting Adobe Reader and Acrobat. The most severe of these
   vulnerabilities could allow a remote attacker to execute arbitrary code.


I. Description

   Adobe Security Bulletin APSB08-19 addresses a number of vulnerabilities that
   affect  the  Adobe Acrobat family of products, including Adobe Reader.
   Versions 8.1.2 and earlier are vulnerable. Further details are available in
   the Vulnerability Notes Database.
   An attacker could exploit these vulnerabilities by convincing a user to load
   a specially crafted Adobe Portable Document Format (PDF) file. Acrobat
   integrates with popular web browsers, and visiting a website is usually
   sufficient to cause Acrobat to load PDF content.


II. Impact

   The  impacts  of  these vulnerabilities vary. The most severe of these
   vulnerabilities allows a remote attacker to execute arbitrary code.


III. Solution

   Upgrade

   According to the information in Adobe Security bulletin APSB08-19, users
   with version 8 of Adobe Reader or Acrobat should upgrade to version 8.1.3.

   Disable web browser display for PDF documents

   Preventing PDF documents from opening inside a web browser may mitigate this
   vulnerability.  Applying  the following workaround in conjunction with
   upgrading may prevent similar vulnerabilities from being automatically
   exploited.

   To prevent PDF documents from automatically being opened in a web browser
   with Acrobat or Reader:
    1. Open Adobe Acrobat or Adobe Reader
    2. Open the Edit menu
    3. Choose the Preferences option
    4. Choose the Internet section
    5. De-select the "Display PDF in browser" check box

   Disable automatic opening of PDF documents in Microsoft Internet Explorer

   Disabling automatic opening of PDF files in Microsoft Internet Explorer (IE)
   requires a second step. To configure IE to prompt before opening a PDF file,
   disable the "Display PDF in browser" feature (as described above) and then
   make the following changes to the Windows registry:

        Windows Registry Editor Version 5.00
        [HKEY_CLASSES_ROOTAcroExch.Document.7]
        "EditFlags"=hex:00,00,00,00

   Disable JavaScript in Adobe Reader and Acrobat

   Disabling  JavaScript  in  Adobe  Reader  and Acrobat may prevent this
   vulnerability from being exploited. In Acrobat Reader, JavaScript can be
   disabled in the General preferences dialog:
    1. Open the Edit menu
    2. Choose the Preferences option
    3. Choose the JavaScript option
    4. De-select "Enable Acrobat JavaScript"


IV. References

     * Adobe Security Bulletin APSB08-19 -
       <http://www.adobe.com/support/security/bulletins/apsb08-19.html>

     * US-CERT Vulnerability Notes for Adobe Security Bulletin APSB08-19 -
       <http://www.kb.cert.org/vuls/byid?searchview&query=APSB08-19>

     * Securing Your Web Browser -
       <http://www.us-cert.gov/reading_room/securing_browser/>


 ____________________________________________________________________

   The most recent version of this document can be found at:

     <http://www.us-cert.gov/cas/techalerts/TA08-309A.html>
 ____________________________________________________________________

   Feedback can be directed to US-CERT Technical Staff. Please send
   email to <cert em cert.org> with "TA08-309A Feedback VU#593409" in the
   subject.
 ____________________________________________________________________

   For instructions on subscribing to or unsubscribing from this
   mailing list, visit <http://www.us-cert.gov/cas/signup.html>.
 ____________________________________________________________________

   Produced 2008 by US-CERT, a government organization.

   Terms of use:

     <http://www.us-cert.gov/legal.html>
 ____________________________________________________________________


Revision History

   November 4, 2008: Initial release




-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)

iQEVAwUBSRDArXIHljM+H4irAQJZJQf9GoIZXze1mSCRNUNdukDTkYmIDJhBMW2g
+alVpAQzPpHFnxZvaq63LkuMZx7RxHfxkSLYMTdeLGiFkRrQTzQc+4NweCCmCJUA
bnh3y3uwtWklak9lxl63PNoyffTn/BnJoFUv2fW935fmsc3Te6DvG8UJLB1Xl3re
HBLVXTnbyDs4ODe3VPXdVpAaw6Yhr7qDFvGzr8vGBMb9fczI8+sZ4jCQBwq0K9vf
lc9NpMr71YnkRE1WnH7a627M7R2Z7o1kykYvXdpsY8drhSiH1V0sKylbqrEocBOj
tD1w7NDwnqx6HR3VH74jv2MPERGfkTXVf+IVJckQPF1iin+nYuM2vQ==
=T2hA
-----END PGP SIGNATURE-----

----- End forwarded message -----


From security em unicamp.br  Wed Nov 12 10:24:00 2008
From: security em unicamp.br (CSIRT - UNICAMP)
Date: Wed, 12 Nov 2008 10:24:00 -0200
Subject: [SECURITY-L] US-CERT Technical Cyber Security Alert TA08-316A --
	Microsoft Updates for Multiple Vulnerabilities
Message-ID: <20081112122353.GA37675@unicamp.br>

----- Forwarded message from US-CERT Technical Alerts <technical-alerts em us-cert.gov> -----

From: US-CERT Technical Alerts <technical-alerts em us-cert.gov>
Subject: US-CERT Technical Cyber Security Alert TA08-316A -- Microsoft Updates for Multiple Vulnerabilities
To: technical-alerts em us-cert.gov
Date: Tue, 11 Nov 2008 16:45:20 -0500
Organization: US-CERT - +1 202-205-5266


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

          National Cyber Alert System

   Technical Cyber Security Alert TA08-316A


Microsoft Updates for Multiple Vulnerabilities

   Original release date: November 11, 2008
   Last revised: --
   Source: US-CERT


Systems Affected

     * Microsoft Windows
     * Microsoft Office XP, 2003, and 2007
     * Microsoft XML Core Services


Overview

   Microsoft has released updates that address vulnerabilities in Microsoft
   Windows, Microsoft Office, and Microsoft XML Core Services.


I. Description

   As  part of the Microsoft Security Bulletin Summary for November 2008,
   Microsoft released updates to address vulnerabilities that affect Microsoft
   Windows, Microsoft Office, and Microsoft XML Core Services. The most severe
   vulnerabilities could allow a remote, unauthenticated attacker to execute
   arbitrary code.


II. Impact

   A remote, unauthenticated attacker could execute arbitrary code or cause a
   vulnerable application to crash.


III. Solution

   Apply updates from Microsoft
   Microsoft has provided updates for these vulnerabilities in the Microsoft
   Security Bulletin Summary for November 2008. The security bulletin describes
   any known issues related to the updates. Administrators are encouraged to
   note  these  issues  and  test  for  any  potentially adverse effects.
   Administrators should consider using an automated update distribution system
   such as Windows Server Update Services (WSUS).


IV. References

     * Microsoft   Security   Bulletin   Summary   for  November  2008  -
       <http://www.microsoft.com/technet/security/bulletin/ms08-nov.mspx>

     * Microsoft Update - <https://www.update.microsoft.com/microsoftupdate/>

     * Windows Server Update Services -
       <http://www.microsoft.com/windowsserversystem/updateservices/default.mspx>

   _________________________________________________________________

   Feedback can be directed to US-CERT.
   _________________________________________________________________

   Produced 2008 by US-CERT, a government organization. Terms of use
   Revision History

   November 11, 2008: Initial release
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)

iQEVAwUBSRn7pXIHljM+H4irAQLn6Qf8CUJFNrMMKALPzPyFx66QKkFtrpkdLoKV
C4hZwsQ1LTQNSo845PdtQl9WQHL2Gpw49iq3Yn8cfCp0XO457Xk58BoLKCBAuPNi
9AJJN8C94VSV1O1YpikUGSLIY+D58kZRsmqAaShy+lc1H4whqGeJk5U3HCEMMneY
csnhefV30rdEVFIByghQZu11jq0XbDUGPTVaz9+5Jv6Hi0cthICteHa6jSsGiHbO
2FmXtrvUIKkK8IuSFnc6YkI+/ahKOnXjVswAO5SODXWH/Gzh2tPw8JQkc77ke1ZD
FSREn2lWHF6i7VfrcTxm1COMG5PiZF1dXPDAGt5FOI5qCU/VO+hWsw==
=QrVj
-----END PGP SIGNATURE-----

----- End forwarded message -----


From security em unicamp.br  Thu Nov 13 10:37:50 2008
From: security em unicamp.br (CSIRT - UNICAMP)
Date: Thu, 13 Nov 2008 10:37:50 -0200
Subject: [SECURITY-L] CAIS-Alerta: Resumo dos Boletins de Seguranca
	Microsoft - Novembro 2008
Message-ID: <20081113123745.GA52479@unicamp.br>

----- Forwarded message from Centro de Atendimento a Incidentes de Seguranca <cais em cais.rnp.br> -----
From: Centro de Atendimento a Incidentes de Seguranca <cais em cais.rnp.br>
Subject:  CAIS-Alerta: Resumo dos Boletins de Seguranca Microsoft - Novembro
 2008
To: pop-seg em cais.rnp.br, rnp-alerta em cais.rnp.br, rnp-seg em cais.rnp.br
Date: Wed, 12 Nov 2008 15:41:13 -0200 (BRST)

-----BEGIN PGP SIGNED MESSAGE-----


Prezados,

A Microsoft publicou 2 boletins de seguranca em 11 de novembro, que 
abordam ao todo 4 vulnerabilidades que afetam produtos Microsoft. Estas 
vulnerabilidades permitem desde a divulgacao nao autorizada de informacoes 
do sistema ate' a execucao remota de codigo.

No momento da publicacao deste resumo nao tivemos noticias de codigo 
malicioso (exploit) disponivel publicamente ou atividade que explore as 
vulnerabilidades em questao.


SEVERIDADE

. Critica

  - MS08-069: Vulnerabilidades no Microsoft XML Core Services
    A mais severa das vulnerabilidades cobertas por este boletim permite a 
    execucao remota de codigo se um usuario for levado a visitar uma 
    pagina especialmente preparada para explorar a vulnerabilidade com o 
    navegador Internet Explorer.

. Importante

  - MS08-068: Vulnerabilidade no protocolo Microsoft Server Message Block (SMB)
    Permite a execucao de codigo arbitrario. O impacto desta 
    vulnerabilidade e' maior se o usuario explorado tiver privilegios de 
    administrador.

. Moderada

  - Nenhum boletim

. Baixa

  - Nenhum boletim

O sistema de classificacao de severidade das vulnerabilidades adotado pelo 
CAIS neste resumo e' o da propria Microsoft. O CAIS recomenda que se 
aplique, minimamente, as correcoes para vulnerabilidades classificadas 
como Criticas e Importantes. No caso de correcoes para vulnerabilidades 
classificadas como Moderadas o CAIS recomenda que ao menos as 
recomendacoes de mitigacao sejam seguidas.

. Critica - Vulnerabilidades cuja exploracao possa permitir a propagacao
  de um worm sem a necessidade de interacao com o usuario.

. Importante - Vulnerabilidades cuja exploracao pode resultar no
  comprometimento de confidencialidade, integridade ou disponibilidade de 
  dados de usuarios ou a integridade ou disponibilidade de recursos de 
  processamento.

. Moderada - exploracao e' mitigada significativamente por fatores como 
  configuracao padrao, auditoria ou dificuldade de exploracao.

. Baixa - uma vulnerabilidade cuja exploracao seja extremamente dificil ou 
  cujo impacto seja minimo.


CORRECOES DISPONIVEIS

Recomenda-se fazer a atualizacao para as versoes disponiveis em:

. Microsoft Update
  https://www.update.microsoft.com/microsoftupdate/

. Windows Server Update Services
  http://www.microsoft.com/windowsserversystem/updateservices/default.mspx


MAIS INFORMACOES

. Microsoft Security Bulletin Summary for November 2008
  http://www.microsoft.com/technet/security/bulletin/ms08-nov.mspx

. SANS ISC Handler's Diary 2008-11-11: November Black Tuesday Overview
  http://isc.sans.org/diary.html?storyid=5330

. Microsoft Security Vulnerability Research & Defense
  http://blogs.technet.com/swi/

. MS08-068: Vulnerability in SMB Could Allow Remote Code Execution (957097)
  http://www.microsoft.com/technet/security/bulletin/ms08-068.mspx

. MS08-069: Vulnerabilities in Microsoft XML Core Services Could Allow Remote Code Execution (955218)
  http://www.microsoft.com/technet/security/bulletin/ms08-069.mspx

. Microsoft Brasil Security
  http://www.microsoft.com/brasil/security

. Technet Brasil - Central de Seguranca
  http://www.technetbrasil.com.br/seguranca

. Windows Live OneCare
  http://safety.live.com/site/pt-BR/default.htm


Identificador CVE (http://cve.mitre.org):
CVE-2007-0099, CVE-2008-4029, CVE-2008-4033, CVE-2008-4037


O CAIS recomenda que os administradores mantenham seus sistemas e 
aplicativos sempre atualizados, de acordo com as ultimas versoes e 
correcoes oferecidas pelos fabricantes.


Os Alertas do CAIS tambem sao oferecidos no formato RSS/RDF:
http://www.rnp.br/cais/alertas/rss.xml


Atenciosamente,

################################################################
#   CENTRO DE ATENDIMENTO A INCIDENTES DE SEGURANCA (CAIS)     #
#       Rede Nacional de Ensino e Pesquisa (RNP)               #
#                                                              #
# cais em cais.rnp.br       http://www.cais.rnp.br                #
# Tel. 019-37873300      Fax. 019-37873301                     #
# Chave PGP disponivel   http://www.rnp.br/cais/cais-pgp.key   #
################################################################
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (GNU/Linux)
Comment: Made with pgp4pine 1.76

iQCVAwUBSRsVQ+kli63F4U8VAQHHywQAo6u41TLpLXbxbQ267YL8kTrEk51kxHR2
rh9adI+8eV5zEjcxQptw2hzUiZqe3L0GT++G7LLK4bklYq2n1F/GrdNAH6lzmHoQ
tMJDRyt/1e1dceCjT0VL63gxdX75GYbxhKeM9wnPC4wkPVrBYCu2ssKn3JPhFesW
XIDa0+qEywY=
=erKX
-----END PGP SIGNATURE-----


----- End forwarded message -----


From security em unicamp.br  Mon Nov 17 10:48:48 2008
From: security em unicamp.br (CSIRT - UNICAMP)
Date: Mon, 17 Nov 2008 10:48:48 -0200
Subject: [SECURITY-L] US-CERT Technical Cyber Security Alert TA08-319A --
	Mozilla Updates for Multiple Vulnerabilities
Message-ID: <20081117124847.GA69216@unicamp.br>

----- Forwarded message from US-CERT Technical Alerts <technical-alerts em us-cert.gov> -----

From: US-CERT Technical Alerts <technical-alerts em us-cert.gov>
Subject: US-CERT Technical Cyber Security Alert TA08-319A -- Mozilla Updates for Multiple Vulnerabilities
To: technical-alerts em us-cert.gov
Date: Fri, 14 Nov 2008 15:01:19 -0500
Organization: US-CERT - +1 202-205-5266


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


                    National Cyber Alert System

              Technical Cyber Security Alert TA08-319A


Mozilla Updates for Multiple Vulnerabilities

   Original release date: November 14, 2008
   Last revised: --
   Source: US-CERT


Systems Affected

     * Mozilla Firefox
     * Mozilla Thunderbird
     * Mozilla SeaMonkey
     
     Other products based on Mozilla components may also be affected.


Overview

   New versions of Firefox, Thunderbird, and SeaMonkey address several
   vulnerabilities, the most severe of which could allow a remote
   attacker to execute arbitrary code on an affected system.


I. Description

   The Mozilla and the SeaMonkey projects have released new versions
   of Firefox, Thunderbird and SeaMonkey to address several
   vulnerabilities. Further details about these vulnerabilities are
   available in Mozilla Foundation Security Advisories. An attacker
   could exploit these vulnerabilities by convincing a user to view a
   specially crafted HTML document, such as a web page or an HTML
   email message.


II. Impact

   While the impacts of the individual vulnerabilities vary, the most
   severe could allow a remote, unauthenticated attacker to execute
   arbitrary code on a vulnerable system. An attacker may also be able
   to cause a denial of service or execute cross-site scripting
   attacks.


III. Solution

   Upgrade
   
   These vulnerabilities are addressed in  Mozilla Firefox 3.0.4,
   Firefox  2.0.0.18, Thunderbird 2.0.0.18, and SeaMonkey 1.1.13.


IV. References

 * Mozilla Foundation Security Advisories -
   <http://www.mozilla.org/security/announce/>

 * Known Vulnerabilities in Mozilla Products -
   <http://www.mozilla.org/projects/security/known-vulnerabilities.html>

 * Mozilla-Based Applications -
   <http://www.mozilla.org/projects/mozilla-based.html>

 * Securing Your Web Browser -
   <http://www.us-cert.gov/reading_room/securing_browser/>

 * NoScript Firefox Extension - <http://noscript.net/>

 ____________________________________________________________________

   The most recent version of this document can be found at:

     <http://www.us-cert.gov/cas/techalerts/TA08-319A.html>
 ____________________________________________________________________

   Feedback can be directed to US-CERT Technical Staff. Please send
   email to <cert em cert.org> with "TA08-319A Feedback VU#456083" in
   the subject.
 ____________________________________________________________________

   For instructions on subscribing to or unsubscribing from this
   mailing list, visit <http://www.us-cert.gov/cas/signup.html>.
 ____________________________________________________________________

   Produced 2008 by US-CERT, a government organization.

   Terms of use:

     <http://www.us-cert.gov/legal.html>
 ____________________________________________________________________

Revision History
  
  November 14, 2008: Initial release


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)

iQEVAwUBSR3YHHIHljM+H4irAQJMuwgAiOsps6zaDiVcoeNN3AU4ZYVTzbhj/EUP
eiM8qXdvPTrtzp/6nA5jXZha/FLaSjXakkYhySF4OvcGzQrHi3aLjbEUrS8Xd/wP
EE3y6KUThuNnwHzSs55EeV2Nyz51BgErFL1fF5Uk6Jqjg8Ki0BKaOiYtYzDgmfN0
CmfqefxtnD/CG0UCRtDJYL7WOeXhgJzvUvvw1rn2BAZGzRTpX80CitJO3Lf43f2W
Ol+PBoSlBpmvM+v0aBmf/t2hztJScclT9cV4JB3toItfc2vSclQ7LrBGpfnqRNL/
iDDUF3gODbwGLqooB4GRiK/jC+fFZ7QB4KSBsn48/5llRAbFzOdDnA==
=zSUd
-----END PGP SIGNATURE-----

----- End forwarded message -----