F Y I ... presently floating ... If you have seen it before,
please excuse.
==>
"Microsoft Warns of New Security Flaws"
Reuters - 06/13/02
Microsoft disclosed a trio of critical software vulnerabilities on
Wednesday. The company has issued a patch for a hole that can cause system
shutdowns or enable hackers to run malicious code on a computer; the flaw
affects users of Windows XP, Windows Routing and Remote Access Server,
Windows NT 4.0, NT 4.0 Terminal server edition, and Windows 2000. The
other security flaws include an Internet Explorer vulnerability that could
allow intruders to commandeer computers via an old Internet protocol, and
a hole in Microsoft's instant messaging and chat programs that would
permit hackers to run their code on victim machines. The Wednesday
announcement brings the total number of security bulletins Microsoft has
released this year to 30, demonstrating the company has made little actual
progress toward its target of more secure software since making it a
primary goal about six months ago. Nevertheless, David Gardner of
Microsoft's Security Response Center claims that the initiative has had
positive effects--for one thing, engineers are detecting these flaws
before they are identified and revealed by outside researchers.
"Coding Flaw Might Assist Hackers"
By Riva Richmond
The Wall Street Journal - 06/13/02
P. B4
Computer-security specialists are exploring whether the Internet
infrastructure could become a ripe target for hackers because of findings
that faulty deployments of the Abstract Syntax Notation One (ASN.1)
computer language makes Simple Network Management Protocol (SNMP)
vulnerable to intrusions. At the core of the problem are certain versions
of programming code used to read ASN.1, which fail when attempting to deal
with very long or distorted messages, giving rise to system crashes or
memory overflow that hackers could exploit. If such errors have widely
proliferated, other protocols may be open to attacks that could shut down
routers and switches, severely hampering online access. Such protocols
are used by the telecom sector, and are also incorporated into
nuclear-control systems, power-control systems, printer-job management,
package tracking, secure communications, and online multimedia
applications. Sourcefire founder Martin Roesch and other experts say that
the problem is being investigated by tech firms, private researchers, and
government agencies. The National Infrastructure Protection Board's
Debbie Weierman notes that her agency has been collaborating with experts
from the NSA, the Federal Computer Incident Response Center, CERT, private
groups, and others since March to see how widespread the ASN.1 flaw is.
Microsoft, Lucent, and Oracle are among the private-sector companies that
have investigated or are investigating how their products may be affected
by the ASN.1 problem. Meanwhile, TruSecure's Paul Robertson believes
high-level hackers have devised malicious programs that exploit the flaw.