Vulnerability Expert Forum eEye Research February 10, 2010

Title Agenda  About eEye’s Research and Development  eEye Preview Overview  Microsoft’s February Security Bulletins  Security Landscape – Other InfoSec News  Securing Your Networks  Q&A

Title “Having a great R&D team issuing advisories and being on the ‘front lines’ of discovering security issues is assuring and was a primary decision factor in choosing eEye when migrating from ISS”. Robert Timko, Information Security Director  eEye has discovered more high risk vulnerabilities than any other Research Team  eEye’s Research Team regularly consults with government agencies and congressional committees  R&D discoveries and innovation drives unrivaled capabilities of eEye products  eEye’s Research Team provides leading edge insight, tools and resources, defining the security industry Vulnerability Research Powerhouse

Title  eEye Preview Security Intelligence Advanced Vulnerability Information Full Zero-Day Analysis and Mitigation Custom Malware Analysis eEye Research Tool Access Includes Managed Perimeter Scanning  eEye AMP Any Means Possible Penetration Testing Gain true insight into network insecurities “Capture-The-Flag” Scenarios  eEye Custom Research Services Exploit Development Malware Analysis Forensics Support Compliance Review eEye Research Services

Title Microsoft February Security Bulletins  13 total bulletins; 26 Issues Fixed 5 Critical Severity Bulletins MS Vulnerabilities in SMB Client Could Allow Remote Code Execution (978251) MS Vulnerability in Windows Shell Handler Could Allow Remote Code Execution (975713) MS Cumulative Security Update of ActiveX Kill Bits (978262) MS Vulnerabilities in Windows TCP/IP Could Allow Remote Code Execution (974145) MS Vulnerability in Microsoft DirectShow Could Allow Remote Code Execution (977935) 7 Important Severity Bulletins MS Vulnerability in Microsoft Office (MSO) Could Allow Remote Code Execution (978214) MS Vulnerabilities in Microsoft Office PowerPoint Could Allow Remote Code Execution (975416) MS Vulnerability in Windows Server 2008 Hyper-V Could Allow Denial of Service (977894) MS Vulnerability in Windows Client/Server Run-time Subsystem Could Allow Elevation of Privilege (978037) MS Vulnerabilities in SMB Server Could Allow Remote Code Execution (971468) MS Vulnerability in Kerberos Could Allow Denial of Service (977290) MS Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (977165) 1 Moderate Severity Bulletin MS Vulnerability in Microsoft Paint Could Allow Remote Code Execution (978706)

Title Microsoft’s Security Bulletin: MS Vulnerability in Microsoft Office (MSO) Could Allow Remote Code Execution (978214)  A single vulnerability fixed in bulletin MSO.DLL Buffer Overflow - CVE  Criticality: Critical for Office XP SP3 and Office 2004 for Mac  What Does It Affect? How critical is it? Microsoft Word and Excel Vulnerability Details are public – attackers will likely attempt to use this in the wild  Mitigation Apply Patch ASAP Block Office File types at the (mail) gateway and firewall Use Blink Professional / Personal

Title Microsoft’s Security Bulletin: MS Vulnerabilities in Microsoft Office PowerPoint Could Allow Remote Code Execution (975416)  6 Vulnerabilities fixed in bulletin PowerPoint File Path Handling Buffer Overflow Vulnerability - CVE PowerPoint LinkedSlideAtom Heap Overflow Vulnerability - CVE PowerPoint OEPlaceholderAtom 'placementId' Invalid Array Indexing Vulnerability - CVE PowerPoint OEPlaceholderAtom Use After Free Vulnerability - CVE PowerPoint Viewer TextBytesAtom Record Stack Overflow Vulnerability - CVE Office PowerPoint Viewer TextCharsAtom Record Stack Overflow Vulnerability - CVE  Criticality: Critical for Office XP and Office 2003 and PowerPoint Viewer  Office Vulnerabilities Are High Profile Targets They make ideal drive-by exploits as well as and IM social engineering  Mitigation Apply Patch ASAP Block PPT files Use Blink Professional / Personal

Title Microsoft’s Security Bulletin: MS Vulnerability in Microsoft Paint Could Allow Remote Code Execution (978706)  1 Vulnerability fixed in bulletin MS Paint Integer Overflow Vulnerability - CVE  Criticality: Moderate  Just Paint?! Microsoft Claims vulnerability only within MSPaint Low threat  Mitigation Disable Microsoft Paint Use Blink Professional / Personal

Title Microsoft’s Security Bulletin: MS Vulnerabilities in SMB Client Could Allow Remote Code Execution (978251)  2 Vulnerabilities fixed in bulletin SMB Client Race Condition Vulnerability - CVE SMB Client Pool Corruption Vulnerability - CVE  Criticality: Critical  Windows 7 SMB Redux Remote Unauthenticated Remote Code execution but….. Worm implications  Mitigation Firewall rules Use Blink Professional / Personal

Title Microsoft’s Security Bulletin: MS Vulnerability in Windows Shell Handler Could Allow Remote Code Execution (975713)  1 Vulnerability fixed in bulletin URL Validation Vulnerability - CVE  Criticality: Moderate  Why is this Moderate? This vulnerability was actually addressed partially by MS API Abuse issue – allows potential File Execution – not a memory corruption  Mitigation Apply BOTH Patches ASAP – MS and MS Use Blink Professional / Personal

Title Microsoft’s Security Bulletin: MS Cumulative Security Update of ActiveX Kill Bits (978262)  1 Vulnerability fixed in bulletin Microsoft Data Analyzer ActiveX Control Vulnerability - CVE  Criticality: Moderate  Good ‘ol ActiveX Will give attacker RCE on all versions of Windows/IE Requires user to have previously installed  Mitigation Set kill-bits Use Blink Professional / Personal

Title Microsoft’s Security Bulletin: MS Vulnerabilities in Windows TCP/IP Could Allow Remote Code Execution (974145)  4 Vulnerabilities fixed in bulletin TCP/IP Selective Acknowledgement Vulnerability - CVE ICMPv6 Route Information Vulnerability - CVE Header MDL Fragmentation Vulnerability - CVE ICMPv6 Router Advertisement Vulnerability - CVE  Criticality: Critical  IPv6!!! IPv6 vulnerabilities becoming “mainstream” – adjust firewalls accordingly! Double check for IPv6 machines on networks!  Mitigation Apply firewall rules Use Blink Professional / Personal

Title Microsoft’s Security Bulletin: MS Vulnerability in Windows Server 2008 Hyper-V Could Allow Denial of Service (977894)  1 Vulnerability fixed in bulletin Hyper-V Instruction Set Validation Vulnerability - CVE  Criticality: Important for 2008 and 2008 R2 only  Researchers Beware! Limited Environments Bad Instruction Set calls result in double BSOD – both Host and Guest  Mitigation Apply patch where applicable Use Blink Professional / Personal

Title Microsoft’s Security Bulletin: MS Vulnerability in Windows Client/Server Run-time Subsystem Could Allow Elevation of Privilege (978037)  1 Vulnerability fixed in bulletin CSRSS Local Privilege Elevation Vulnerability - CVE  Criticality: Important  Malware Authors’ Dream Ideal for pairing with malware Ideal target would be public computers or machines with multiple user logins.  Mitigation Apply Patch ASAP Use Blink Professional / Personal

Title Microsoft’s Security Bulletin: MS Vulnerabilities in SMB Server Could Allow Remote Code Execution (971468)  4 Vulnerabilities fixed in bulletin SMB Pathname Overflow Vulnerability - CVE SMB Memory Corruption Vulnerability - CVE SMB Null Pointer Vulnerability - CVE SMB NTLM Authentication Lack of Entropy Vulnerability - CVE  Criticality: Critical  How critical are these? A security bypass, an authenticated RCE, and 2 DoS – these are ideal for attackers to cause havoc on LANs – potential malware wormable.  Mitigation Apply Patch ASAP Use Blink Professional / Personal

Title Microsoft’s Security Bulletin: MS Vulnerability in Microsoft DirectShow Could Allow Remote Code Execution (977935)  1 Vulnerability fixed in bulletin DirectShow Heap Overflow Vulnerability - CVE  Criticality: Critical – All Windows versions  What is affected? Any media player that uses DirectX to render AVI files Drive-by exploitable as well as and IM Client machines should be patched immediately  Mitigation Apply Patch ASAP Remember media files extensions can be ‘incorrect’ Use Blink Professional / Personal

Title Microsoft’s Security Bulletin: MS Vulnerability in Kerberos Could Allow Denial of Service (977290)  1Vulnerability fixed in bulletin Kerberos Null Pointer Dereference Vulnerability - CVE  Criticality: Important – Only if you run Kerberos Auth  How is this triggered? What does it cause Requires a valid login session through Kerberos Malicious user sends a malformed TGT request DoS can last until the server is restarted - not a bugcheck / BSOD Attackers could use this to cause administrators to focus on issues while they silently attack other systems  Mitigation Apply Patch ASAP Use Blink Professional / Personal

Title Microsoft’s Security Bulletin: MS Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (977165)  2 Vulnerabilities fixed in bulletin Windows Kernel Exception Handler Vulnerability - CVE Windows Kernel Double Free Vulnerability - CVE  Criticality: Critical – Affects every version of Windows since 3.1 AND its being used by malware in the wild.  How critical are these? Attackers already using them in malware – they could start using them with exploits as well. The exploit is very reliable and publicly available  Mitigation Apply Patch ASAP Use Blink Professional / Personal

Title Security Landscape - More Than A Microsoft World  CTO/CSO/CxO News US Navy Cyber Command PGP buys Chose Security China  IT Admin News iPhone Holes Patched BIND Flaws Patched BlackBerry Spyware Source Unleashed  Researcher News Black Hawk Safety Net BackTrack Final 4 Echo Mirage

Title eEye Digital Security – Award Winning Products Retina® Network Security Scanner Unsurpassed vulnerability assessment & remediation Blink® Unified Client Security with Anti-virus Multi-layer threat mitigation & system protection Iris® Network Traffic Analyzer Visual data monitoring & reassembly SecureIIS ™ Web Server Protection Proactive web server security

eEye Research - eEye Research Service Inquiries – CONTACT