Bardissi Enterprises Blog

Severity: High

12 February, 2008

Summary:

• This vulnerability affects: Internet Explorer 7 and earlier versions
• How an attacker exploits it: By enticing one of your users to visit a malicious Web page
• Impact: In the worst case, the attacker an execute code on your user’s computer, gaining complete control of it
• What to do: Deploy the appropriate Internet Explorer patches immediately

Severity: Medium

14 December, 2007

Summary:

• This vulnerability affects: OS X 10.4.x (not Leopard, 10.5)
• How an attacker exploits it: By enticing your users to a malicious web site
• Impact: Attacker executes code on your user’s computer, or modifies your user’s Keychain (passwords), potentially gaining complete control of your user’s computer
• What to do: Install Java Release 6 as soon as possible

Severity: High

11 December, 2007

Summary:

Today, Microsoft released two security bulletins describing vulnerabilities that affect components Windows uses to handle multimedia (specifically, DirectX and the Windows Media File Format Runtime). A remote attacker could exploit the flaws in these components to execute code on your Windows PC, potentially gaining complete control of it. If you manage a Windows network, you should download, test, and deploy the appropriate patches throughout your network as soon as possible.

Exposure:

Microsoft’s security bulletins detail vulnerabilities found in two Windows components used to handle multimedia. We summarize these vulnerabilities below:

MS07-064: Two Remote Code Execution Vulnerabilities in DirectX

Severity: High

11 December, 2007

Summary:

Today, Microsoft released a security bulletin describing four vulnerabilities in Internet Explorer. By tricking one of your users into visiting a maliciously crafted web page or into opening a maliciously crafted HTML email, an attacker could exploit any of these new vulnerabilities to execute code on your user’s computer, with your user’s privileges. In the worst case, the attacker could gain complete control of the victim computer. If you use Internet Explorer in your network, you should download, test, and deploy the appropriate Internet Explorer patches immediately. The patches fix all previous vulnerabilities, in addition to the newly announced flaws.

Exposure:

In a security bulletin released today as part of their monthly patch update, Microsoft describes four vulnerabilities in Internet Explorer (IE) versions 5.01, 6.0, and 7.0. Though they differ technically, all four vulnerabilities share the same general flaw. IE doesn’t properly handle certain HTML objects, which causes memory corruption. By luring one of your users into visiting a maliciously crafted web page, an attacker can exploit these memory corruption vulnerabilities to execute code on that user’s computer, inheriting that user’s privileges. Typically, Windows users have local administrative privileges. In that case, the attacker could gain complete control of the victim computer.