From security em unicamp.br  Thu May 14 11:16:10 2009
From: security em unicamp.br (CSIRT - UNICAMP)
Date: Thu, 14 May 2009 11:16:10 -0300
Subject: [SECURITY-L] US-CERT Technical Cyber Security Alert TA09-133A --
	Apple Updates for Multiple Vulnerabilities
Message-ID: <20090514141610.GB56531@unicamp.br>

----- Forwarded message from US-CERT Technical Alerts <technical-alerts em us-cert.gov> -----

From: US-CERT Technical Alerts <technical-alerts em us-cert.gov>
Subject: US-CERT Technical Cyber Security Alert TA09-133A -- Apple Updates for Multiple Vulnerabilities
To: technical-alerts em us-cert.gov
Date: Wed, 13 May 2009 15:23:20 -0400
Organization: US-CERT - +1 202-205-5266


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


                    National Cyber Alert System

              Technical Cyber Security Alert TA09-133A


Apple Updates for Multiple Vulnerabilities

   Original release date: May 13, 2009
   Last revised: --
   Source: US-CERT


Systems Affected

     * Apple Mac OS X versions prior to and including 10.4.11 (Tiger) and 10.5.6 (Leopard)
     * Apple Mac OS X Server versions prior to and including 10.4.11 (Tiger) and 10.5.6 (Leopard)
     * Safari 3 for Windows,  Mac OS X 10.4, and Mac OS X 10.5


Overview

   Apple has released multiple Security Updates, 2009-002 / Mac OS X
   version 10.5.7 and Safari 3.2.3, to correct multiple
   vulnerabilities affecting Apple Mac OS X , Mac OS X Server, and the
   Safari web browser. Attackers could exploit these vulnerabilities
   to execute arbitrary code, gain access to sensitive information, or
   cause a denial of service.


I. Description

   Apple Security Update 2009-002 / Mac OS X v10.5.7 addresses a
   number of vulnerabilities affecting Apple Mac OS X and Mac OS X
   Server, the Safari security update addresses vulnerabilities
   affecting the Safari web browser (for Windows and OS X). These
   updates also address vulnerabilities in other vendors' products
   that ship with Apple Mac OS X or Mac OS X Server.


II. Impact

   The impacts of these vulnerabilities vary. Potential consequences
   include arbitrary code execution, sensitive information disclosure,
   denial of service, or privilege escalation.


III. Solution

   Install Apple Security Update 2009-002 / Mac OS X v10.5.7, or
   Safari 3.2.3. These and other updates are available via Software
   Update or via Apple Downloads.


IV. References

 * Apple Security Update 2009-002 -
   <http://support.apple.com/kb/HT3549>

 * Safari 3.2.3 - <http://support.apple.com/kb/HT3550> 

 * Apple Downloads - <http://support.apple.com/downloads/>

 * Software Update -
   <https://support.apple.com/kb/HT1338?viewlocale=en_US>

 ____________________________________________________________________

   The most recent version of this document can be found at:

     <http://www.us-cert.gov/cas/techalerts/TA09-133A.html>
 ____________________________________________________________________

   Feedback can be directed to US-CERT Technical Staff. Please send
   email to <cert em cert.org> with "TA09-133A Feedback VU#175188" in
   the subject.
 ____________________________________________________________________

   For instructions on subscribing to or unsubscribing from this
   mailing list, visit <http://www.us-cert.gov/cas/signup.html>.
 ____________________________________________________________________

   Produced 2009 by US-CERT, a government organization.

   Terms of use:

     <http://www.us-cert.gov/legal.html>
 ____________________________________________________________________

Revision History
  
  May 13, 2009: Initial release


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)

iQEVAwUBSgsdiHIHljM+H4irAQIsGAf+IykbS/FD1X/R2ooezndAmZjrcT29XnpV
HO4DiMlKmqW+dUffk4mdJLVR7y8pwUuP4TbjwncoT39SDR9UoEankv7+Dao/qkM/
Jp0flkEpb5qtcIm9VnuWvpCE31OZZgwBwJ7f2WWzbBLqoZ5FIWAhCcW6E5v6mjVy
J+Z4BmHYUIapPLzGzV8+HT6/7LRNpg+mZoldEBUoXXjik8o78v5A7iGyMSXoaBlV
vL8N/3GG9a9xecLqbbv5N6ABsncHA9f/GzBnfJUqVHkUM1xnjqmgd7TZikObw+fJ
xcgWvmYmoRdCMzM3b1jPqWPDGJDbo0oHZM3J3hKE+opsLe9xChM1qA==
=dQ2L
-----END PGP SIGNATURE-----

----- End forwarded message -----


From security em unicamp.br  Thu May 14 11:32:38 2009
From: security em unicamp.br (CSIRT - UNICAMP)
Date: Thu, 14 May 2009 11:32:38 -0300
Subject: [SECURITY-L] US-CERT Technical Cyber Security Alert TA09-133B --
	Adobe Reader and Acrobat JavaScript Vulnerabilities
Message-ID: <20090514143238.GC56531@unicamp.br>

----- Forwarded message from US-CERT Technical Alerts <technical-alerts em us-cert.gov> -----

From: US-CERT Technical Alerts <technical-alerts em us-cert.gov>
Subject: US-CERT Technical Cyber Security Alert TA09-133B -- Adobe Reader and Acrobat JavaScript Vulnerabilities
To: technical-alerts em us-cert.gov
Date: Wed, 13 May 2009 16:38:11 -0400
Organization: US-CERT - +1 202-205-5266


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


                    National Cyber Alert System

              Technical Cyber Security Alert TA09-133B


Adobe Reader and Acrobat JavaScript Vulnerabilities

   Original release date: May 13, 2009
   Last revised: --
   Source: US-CERT


Systems Affected

     * Adobe Reader versions 9.1, 8.1.4, 7.1.1 and earlier

     * Adobe Acrobat Standard, Pro, and Pro Extended versions 9.1,
       8.1.4, 7.1.1 and earlier


Overview

   Adobe has released Security Bulletin APSB09-06, which describes
   Adobe Reader and Acrobat updates for two JavaScript vulnerabilities
   that could allow a remote attacker to execute arbitrary code.


I. Description

   Adobe Security Bulletin APSB09-06 announces updates for two
   JavaScript vulnerabilities that affect Adobe Reader and Acrobat.
 
     * A vulnerability in the getAnnots() method (CVE-2009-1492)
       affects Adobe Reader and Acrobat for Microsoft Windows, Apple
       Mac OS X, and UNIX.

     * A vulnerability in the customDictionaryOpen() method
       (CVE-2009-1493) appears to only affect Adobe Reader for UNIX.

   Further details are available in Vulnerability Note VU#970180.

   An attacker could exploit these vulnerabilities by convincing a
   user to open a specially crafted Adobe Portable Document Format
   (PDF) file. Acrobat integrates with popular web browsers, and
   visiting a website is usually sufficient to cause Reader or Acrobat
   to open a PDF file.


II. Impact

   By convincing a victim to open a specially crafted PDF file, a
   remote, unauthenticated attacker may be able to execute arbitrary
   code.


III. Solution

   Update
   
     Adobe has released updates to address this issue. Users are
     encouraged to read Adobe Security Bulletin APSB09-06 and update
     vulnerable versions of Adobe Reader and Acrobat. According to
     APSB09-06, these vulnerabilities are addressed in versions 9.1.1,
     8.1.5, and 7.1.2 of Adobe Reader and Acrobat.

   Disable JavaScript in Adobe Reader and Acrobat

     Disabling JavaScript prevents these vulnerabilities from being
     exploited and reduces attack surface. If this workaround is
     applied to updated versions of the Adobe Reader and Acrobat, it
     may protect against future vulnerabilities.
   
     To disable JavaScript in Adobe Reader:
   
       1. Open Adobe Acrobat Reader.
       2. Open the Edit menu.
       3. Choose the Preferences... option.
       4. Choose the JavaScript section.
       5. Uncheck the Enable Acrobat JavaScript check box.

     Disabling JavaScript will not resolve the vulnerabilities, it
     will only disable the vulnerable JavaScript component. When
     JavaScript is disabled, Adobe Reader and Acrobat prompt to
     re-enable JavaScript when opening a PDF that contains JavaScript.
   
   Prevent Internet Explorer from automatically opening PDF documents

     The installer for Adobe Reader and Acrobat configures Internet
     Explorer to automatically open PDF files without any user
     interaction. This behavior can be reverted to the safer option of
     prompting the user by importing the following as a .REG file:
   
       Windows Registry Editor Version 5.00
       [HKEY_CLASSES_ROOT\AcroExch.Document.7]"EditFlags"=hex:00,00,00,00
   
   Disable the display of PDF documents in the web browser

     Preventing PDF documents from opening inside a web browser
     reduces attack surface. If this workaround is applied to updated
     versions of the Adobe Reader and Acrobat, it may protect against
     future vulnerabilities.  To prevent PDF documents from
     automatically being opened in a web browser with Adobe Reader:
   
       1. Open Adobe Acrobat Reader.
       2. Open the Edit menu.
       3. Choose the preferences option.
       4. Choose the Internet section.
       5. Un-check the "Display PDF in browser" check box.
   
   Rename or remove Annots.api

     To disable the vulnerable getAnnots() method, rename or remove
     the Annots.api file. This will disable some Annotation
     functionality, however annotations can still be viewed. This does
     not protect against the customDictionaryOpen() vulnerability.  On
     Windows, Annots.api is typically located here:
   
       "%ProgramFiles%\Adobe\Reader 9.0\Reader\plug_ins"
   
     Example location on GNU/Linux:
   
       /opt/Adobe/Reader8/Reader/intellinux/plug_ins/Annots.api
   
   Do not access PDF documents from untrusted sources

     Do not open unfamiliar or unexpected PDF documents, particularly
     those hosted on web sites or delivered as email
     attachments. Please see Cyber Security Tip ST04-010.


IV. References

 * Vulnerability Note VU#970180 -
   <http://www.kb.cert.org/vuls/id/970180>

 * Cyber Security Tip ST04-010: Using Caution with Email Attachments -
   <http://www.us-cert.gov/cas/tips/ST04-010.html>

 * Adobe Security Bulletin APSB09-06 -
   <http://www.adobe.com/support/security/bulletins/apsb09-06.html>

 * CVE-2009-1492 -
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1492>

 * CVE-2009-1493 -
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1493>

 ____________________________________________________________________

   The most recent version of this document can be found at:

     <http://www.us-cert.gov/cas/techalerts/TA09-133B.html>
 ____________________________________________________________________

   Feedback can be directed to US-CERT Technical Staff. Please send
   email to <cert em cert.org> with "TA09-133B Feedback VU#970180" in
   the subject.
 ____________________________________________________________________

   For instructions on subscribing to or unsubscribing from this
   mailing list, visit <http://www.us-cert.gov/cas/signup.html>.
 ____________________________________________________________________

   Produced 2009 by US-CERT, a government organization.

   Terms of use:

     <http://www.us-cert.gov/legal.html>
 ____________________________________________________________________

Revision History
  
  May 13, 2009: Initial release


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)

iQEVAwUBSgsuwnIHljM+H4irAQLRAQf+OjeDGX/M6wdh8SkqOru0HB3KsqmzZjOq
BvwX7B3Z/my9FVUmxIz1nQH4MjZqSlxIZdmAVU2YW+jv1oFgyT9ltminL4v6RGM1
oEaQHIEiu+N+dXwWqvtsOrszEN/Q9GMOckxUGkDNran/9OvplZJfh6pFjCxP02Im
2Y07Z0eIBqx5ULoIXHzfvGBe/7k5djxr2F2KaEZFwL3vSmw3Xlz9+/OD2iJC/yT6
sxuiKXX8OCRRiLe0B5pInFgS9o01L8y5AMqfET6QqyIqkFq2KnwV5eKhWqLNAljq
EFOKJHN8IQPTwJi+qbd9uHlRrqf6ekOkfkql49ZXvSbUSdYcnlfMPQ==
=uewj
-----END PGP SIGNATURE-----

----- End forwarded message -----


From security em unicamp.br  Mon May 18 09:15:07 2009
From: security em unicamp.br (CSIRT - UNICAMP)
Date: Mon, 18 May 2009 09:15:07 -0300
Subject: [SECURITY-L] CAIS-Alerta: Resumo dos Boletins de Seguranca
	Microsoft - Maio 2009
Message-ID: <20090518121506.GA73569@unicamp.br>

----- Forwarded message from Centro de Atendimento a Incidentes de Seguranca <cais em cais.rnp.br> -----

From: Centro de Atendimento a Incidentes de Seguranca <cais em cais.rnp.br>
Subject:  CAIS-Alerta: Resumo dos Boletins de Seguranca Microsoft - Maio 2009
To: pop-seg em cais.rnp.br, rnp-alerta em cais.rnp.br, rnp-seg em cais.rnp.br
Date: Fri, 15 May 2009 20:00:23 -0300 (BRT)

-----BEGIN PGP SIGNED MESSAGE-----


Prezados,

A Microsoft publicou 1 boletim de seguranca em 12 de maio, que aborda ao 
todo 14 vulnerabilidades que afetam produtos Microsoft, mais 
especificamente o Microsoft Office PowerPoint. A exploracao de qualquer 
uma destas vulnerabilidades permite o controle total sobre o sistema 
afetado.

No momento da publicacao deste resumo ha' exploracao ativa de uma das 
vulnerabilidades do boletim MS09-017 (CVE-2009-0556).


SEVERIDADE

. Critica

  - MS09-017: Vulnerabilidades no Microsoft Office PowerPoint
    Um atacante que explore com sucesso qualquer uma das 14 
    vulnerabilidades pode obter controle total sobre um sistema afetado.

. Importante

  - Nenhum boletim

. Moderada

  - Nenhum boletim

. Baixa

  - Nenhum boletim
   

O sistema de classificacao de severidade das vulnerabilidades adotado pelo 
CAIS neste resumo e' o da propria Microsoft. O CAIS recomenda que se 
aplique, minimamente, as correcoes para vulnerabilidades classificadas 
como Criticas e Importantes. No caso de correcoes para vulnerabilidades 
classificadas como Moderadas o CAIS recomenda que ao menos as 
recomendacoes de mitigacao sejam seguidas.

. Critica - Vulnerabilidades cuja exploracao possa permitir a propagacao
  de um worm sem a necessidade de interacao com o usuario.

. Importante - Vulnerabilidades cuja exploracao pode resultar no
  comprometimento de confidencialidade, integridade ou disponibilidade de
  dados de usuarios ou a integridade ou disponibilidade de recursos de
  processamento.

. Moderada - exploracao e' mitigada significativamente por fatores como
  configuracao padrao, auditoria ou dificuldade de exploracao.

. Baixa - uma vulnerabilidade cuja exploracao seja extremamente dificil ou
  cujo impacto seja minimo.


CORRECOES DISPONIVEIS

Recomenda-se fazer a atualizacao para as versoes disponiveis em:

. Microsoft Update
  https://www.update.microsoft.com/microsoftupdate/

. Windows Server Update Services
  http://www.microsoft.com/windowsserversystem/updateservices/default.mspx


MAIS INFORMACOES

. Microsoft Security Bulletin Summary for May 2009
  http://www.microsoft.com/technet/security/bulletin/ms09-may.mspx

. Vulnerability in Microsoft Office PowerPoint Could Allow Remote Code Execution (969136)
  http://www.microsoft.com/technet/security/advisory/969136.mspx

. SANS ISC Handler's Diary 2009-04-12: May Black Tuesday Overview
  http://isc.sans.org/diary.html?storyid=6376

. MSFT's version of responsible disclosure (SANS ISC Handler's Diary)
  http://isc.sans.org/diary.html?storyid=6379

. Microsoft Security Vulnerability Research & Defense
  http://blogs.technet.com/swi/

. Microsoft Brasil Security
  http://www.microsoft.com/brasil/security

. Technet Brasil - Central de Seguranca
  http://www.technetbrasil.com.br/seguranca

. Windows Live OneCare
  http://safety.live.com/site/pt-BR/default.htm


Identificador CVE (http://cve.mitre.org):
CVE-2009-0220, CVE-2009-0221, CVE-2009-0222, CVE-2009-0223,
CVE-2009-0224, CVE-2009-0225, CVE-2009-0226, CVE-2009-0227,
CVE-2009-0556, CVE-2009-1128, CVE-2009-1129, CVE-2009-1130,
CVE-2009-1131, CVE-2009-1137


O CAIS recomenda que os administradores mantenham seus sistemas e 
aplicativos sempre atualizados, de acordo com as ultimas versoes e 
correcoes oferecidas pelos fabricantes.

Os Alertas do CAIS tambem sao oferecidos no formato RSS/RDF:
http://www.rnp.br/cais/alertas/rss.xml


Atenciosamente,

################################################################
#   CENTRO DE ATENDIMENTO A INCIDENTES DE SEGURANCA (CAIS)     #
#       Rede Nacional de Ensino e Pesquisa (RNP)               #
#                                                              #
# cais em cais.rnp.br       http://www.cais.rnp.br                #
# Tel. 019-37873300      Fax. 019-37873301                     #
# Chave PGP disponivel   http://www.rnp.br/cais/cais-pgp.key   #
################################################################

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (GNU/Linux)
Comment: Made with pgp4pine 1.76

iQCVAwUBSg30Rekli63F4U8VAQFfnwP+IyQ2mCUsmYxfKX1mYDPtZQnfrApRJm4y
0sOycQw3J8lgc3Fbb+34eOqardEzxTpxdZy3hab5dbqVdTzcy4LNq2JUJllfIdTZ
AK2kXO/9ZCDQznyRxWuEZBU94iUkBv8qwclUmDIgGMFS6MVBMOqJT9MWIdz0Jp0l
3DFgHjZXQ7U=
=GhHf
-----END PGP SIGNATURE-----


----- End forwarded message -----


From security em unicamp.br  Wed May 20 14:33:48 2009
From: security em unicamp.br (CSIRT - UNICAMP)
Date: Wed, 20 May 2009 14:33:48 -0300
Subject: [SECURITY-L] CAIS-Alerta: Vulnerabilidade em Microsoft Internet
	Information Services (IIS)
Message-ID: <20090520173348.GE46221@unicamp.br>

----- Forwarded message from Centro de Atendimento a Incidentes de Seguranca <cais em cais.rnp.br> -----

From: Centro de Atendimento a Incidentes de Seguranca <cais em cais.rnp.br>
Subject:  CAIS-Alerta: Vulnerabilidade em Microsoft Internet Information
 Services (IIS)
To: pop-seg em cais.rnp.br, rnp-alerta em cais.rnp.br, rnp-seg em cais.rnp.br
Date: Wed, 20 May 2009 12:11:04 -0300 (BRT)

-----BEGIN PGP SIGNED MESSAGE-----


Prezados,

O CAIS esta' repassando o boletim da Microsoft, intitulado "Vulnerability 
in Internet Information Services Could Allow Elevation of Privilege 
(971492)", que trata de uma vulnerabilidade moderada nas versoes 5.0, 5.1 
e 6.0 do servidor Web Microsoft Internet Information Services (IIS).

Web-based Distributed Authoring and Versioning, ou simplesmente WebDAV, e' 
uma extensao do protocolo HTTP que permite que usuarios editem e gerenciem 
arquivos colaborativamente em servidores Web.

Foi descoberta uma vulnerabilidade na maneira como a extensao WebDAV do 
IIS trata requisicoes do protocolo HTTP.

Esta vulnerabilidade permite a elevacao de privilegios. Um atacante pode 
criar requisicoes HTTP anonimas que explorem esta vulnerabilidade. Nao ha' 
relatos de exploracao desta vulnerabilidade no momento.

Este boletim de seguranca foi divulgado fora do ciclo mensal de boletins 
de seguranca, por esta razao o CAIS recomenda a aplicacao imediada da 
correcao.


SISTEMAS AFETADOS

. Microsoft Internet Information Services 5.0
. Microsoft Internet Information Services 5.1
. Microsoft Internet Information Services 6.0


CORRECOES DISPONIVEIS

Recomenda-se atualizar os sistemas para as versoes disponiveis em:

. Microsoft Windows Update
  http://windowsupdate.microsoft.com/

Caso nao seja possivel realizar a atualizacao e' possivel mitigar a 
vulnerabilidade simplesmente desabilitando WebDAV no sistema afetado.

. IIS 5.0 e 5.1: WebDAV pode ser desabilitado conforme descrito em:

  Help and Support - How to disable WebDAV for IIS 5.x
  http://support.microsoft.com/kb/241520

. IIS 6.0: WebDAV pode ser desabilitado pelo MMC, no snap-in 
  "IIS Manager". Em "Web Service Extensions" selecionar "Prohibit" para o 
  item "WebDAV".

Para mais informacoes por favor consulte a secao "General Information", 
"Suggested Actions", "Workarounds" do boletim original da Microsoft.


MAIS INFORMACOES

. Vulnerability in Internet Information Services Could Allow Elevation of Privilege (971492)
  http://www.microsoft.com/technet/security/advisory/971492.mspx

. Microsoft IIS 6.0 WebDAV Remote Authentication Bypass (VU#787932)
  http://www.kb.cert.org/vuls/id/787932

. SANS ISC Handler's Diary 2009-05-15: IIS6.0 WebDav Remote Auth Bypass
  http://isc.sans.org/diary.html?storyid=6397

. Microsoft Security Vulnerability Research & Defense
  http://blogs.technet.com/swi/

. Microsoft Brasil Security
  http://www.microsoft.com/brasil/security

. Technet Brasil - Central de Seguranca
  http://www.technetbrasil.com.br/seguranca

. Windows Live OneCare
  http://safety.live.com/site/pt-BR/default.htm


Identificador CVE (http://cve.mitre.org): CVE-2009-1535


O CAIS recomenda que os administradores mantenham seus sistemas e 
aplicativos sempre atualizados, de acordo com as ultimas versoes e 
correcoes oferecidas pelos fabricantes.


Os Alertas do CAIS tambem sao oferecidos no formato RSS/RDF:
http://www.rnp.br/cais/alertas/rss.xml


Atenciosamente,

################################################################
#   CENTRO DE ATENDIMENTO A INCIDENTES DE SEGURANCA (CAIS)     #
#       Rede Nacional de Ensino e Pesquisa (RNP)               #
#                                                              #
# cais em cais.rnp.br       http://www.cais.rnp.br                #
# Tel. 019-37873300      Fax. 019-37873301                     #
# Chave PGP disponivel   http://www.rnp.br/cais/cais-pgp.key   #
################################################################

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (GNU/Linux)
Comment: Made with pgp4pine 1.76

iQCVAwUBShQdlOkli63F4U8VAQHzIQQAhjwd+KtZmzSjrdoWJLS2Lu8hJ3Od5AbK
nnI3Yi45pZ2xzmxFSYpY8eNKexRcUY+PHeYxJzrXkENubb/tVmxu5AKzRxOKIt9o
jQtmUIt7KjSIRUgC3tehn+eTZ0lURWq0dWdgnC43Y8fLxn2fn2B52qDVDVTKilAl
w5YarFgJbhQ=
=0OkW
-----END PGP SIGNATURE-----


----- End forwarded message -----