Adobe Security Advisory APSB09-05 for Flash Media Server

APSB09-05 Updates available to address Flash Media Server privilege escalation issue

Release date: April 30, 2009

Vulnerability identifier: APSB09-05

CVE number: CVE-2009-1365

Platform: Windows and Linux

Summary

A potential vulnerability has been identified in Flash Media Server 3.5.1 and earlier that could allow an attacker to execute remote procedures in Flash Media Interactive Server or Flash Media Streaming Server. Adobe recommends users update to the most current version of Flash Media Server (3.5.2 or 3.0.4 or greater)

Affected software versions

Adobe Flash Media Streaming Server 3.5.1, Adobe Flash Media Interactive Server 3.5.1 and earlier

To verify the Adobe Flash Media Server version, launch the Flash Media Server Administration console, click the Manage Servers > License tab, and note the release version.

Solution

Adobe recommends Flash Media Server administrators install the Flash Media Server 3.5.2 or 3.0.4 update.

LandzDown Forum Stops Updates for Security Products with IAC/Ask

Not only Calendar of Updates stops posting updates information on security software that have Ask but also LanzDown.  Check the blog of our friend, MS MVP Corrine Chorney at her Security Garden.

Some says nothing wrong with security vendors adding Ask Search or Ask Toolbar.  I don’t think so.  When a security software added unwanted, unnecessary and questionable service…. many internet users cannot trust their detection or services anymore.  They can easily remove detection or warning on such actions just because they are doing the same thing by making their product “Adware”or Freeware with Crapware/Craplets or Trialware with Crapware.

Expiration Reminder: Windows 7 BETA and RC

Windows 7 Beta will expire on August 1, 2009, and bi-hourly shutdowns will begin July 1, 2009.

RC will expire June 1, 2010, and the bi-hourly shutdowns will begin on March 1, 2010.

The Windows 7 RC is available now to TechNet and MSDN subscribers and on http://www.microsoft.com/springboard starting May 5th.

http://blogs.technet.com/springboard/archive/2009/04/30/plan-ahead-for-windows-7-beta-and-rc-expiration-dates.aspx

I opted to download Windows 7 RC via MS Connect site

I tried to download Windows 7 RC via MSDN and I don’t like the download speed (estimated time to finish is 10 hours)…. I cancelled it. 

I am now downloading it via MS Connect since I’m a registered beta-tester for Windows.  I find the speed in MS Connect is much better than MSDN because we get to choose the download location:  Asia, Europe or US. 

I selected the download server in Asia that’s why it’s faster and now I’m 2 hours left to finish downloading it! 

Windows Vista Neighbor Discovery Spoofing Vulnerability

Microsoft Windows Vista is prone to a discovery-spoofing vulnerability.
An attacker can exploit this issue to conduct redirect attacks on another host on the network. This may lead to further attacks.

Note that to exploit this issue, the attacker must have access to the local network segment of a target computer.

Vulnerable:
Microsoft Windows Vista December CTP
Microsoft Windows Vista Ultimate
Microsoft Windows Vista Home Premium
Microsoft Windows Vista Home Basic
Microsoft Windows Vista Enterprise
Microsoft Windows Vista Business
Microsoft Windows Vista beta 2
Microsoft Windows Vista Beta 1
Microsoft Windows Vista Beta
Microsoft Windows Vista 0

http://www.securityfocus.com/bid/23293/discuss

Google Joins Mozilla, Blames IE for Chrome Bug

Google has fixed a bug in its Chrome browser which could allow cross-site scripting and other dangerous policy violations under interesting circumstances: when Chrome is called from Internet Explorer because a link is executed in IE with the "chromehtml" protocol handler.

Update Chrome to get to the new version 1.0.154.59, which they say fixes the problem, but that’s not what’s really interesting about this bug.

What’s interesting is that it’s actually a new manifestation of an old problem: external protocol handlers are called from Internet Explorer with malicious input; IE just calls the handler with the supplied input. In this case, IBM researcher Roi Saltzman found three main attacks that could be launched through this mechanism that would be blocked through normal Chrome access methods.

It’s very similar to a series of bugs that were found in the combination of Internet Explorer and Firefox back in July of 2007. Similar stuff, some abusing the firefoxurl protocol handler.

In both cases, the other company chose to blame Microsoft for the bug, claiming that Internet Explorer should have sanitized the inputs before passing them on to the external protocol handler. The Mozilla security vulnerability advisory on the subject contains the following: "Internet Explorer calls registered URL protocols without escaping quotes and may be used to pass unexpected and potentially dangerous data to the application that registers that URL Protocol….This patch does not fix the vulnerability in Internet Explorer."

Google wasn’t quite so ostentatious in blaming Microsoft, but they did it just the same. Roi Saltzman didn’t attempt to blame Microsoft, but in the Chrome vulnerability database writeup on their report, someone at Google puts it this way: "Because of a known silliness of MSIE, calls to registered URL handlers for protocols such as chromehtml: are not constructed with sufficient escaping. We previously combated cases where this could be used to pass unsolicited –no-sandbox or –renderer-path to the browser."

http://www.eweek.com/c/a/Security/Google-Joins-Mozilla-Blames-IE-for-Chrome-Bug-179337

Service Pack 2 Fever

Why SP2 Fever? Because it’s what Microsoft announced:

  1. Office Service Pack 2 – I’m done with this.  I have it installed.  400+MB (including the Help files!). I hope and pray that my connection will not disconnects and it did not :-)
  2. Vista Service Pack 2 – It’s coming Q2 of 2009 and the benefits is posted in Vista Team blog.  See also the Release Notes for Vista SP2. BTW, check the updated version of Vista and XP Security Guides.

Today is April 30 at my location but it’s not April 30 yet in the US which means I can still sleep before I can start downloading the RC version of Windows 7. Alright, that’s not SP2 but I still want to mention about Windows 7 RC so you are reminded also :-)  I made a full back-up already!

Panda Cloud Antivirus – free AV thin-client

Panda Research Blog announced the first *BETA version of Panda Cloud Antivirus, a free cloud-based antivirus thin-client.

Panda Cloud Antivirus consists of a lightweight antivirus agent that is connected in real-time to PandaLabs’ Collective Intelligence servers to protect faster against the newest malware variants while barely impacting PC performance.

http://research.pandasecurity.com/archive/Panda-Cloud-Antivirus-_2D00_-Free-AV-thin_2D00_client.aspx

*BETA – Use at your own risk!