<![CDATA[C.I.S.R.T.]]> http://www.cisrt.org/blog/index.php zh-cn http://www.cisrt.org/blog/read.php?507 <![CDATA[Microsoft Security Advisory (977981)]]> 小陌 <smallmo@cisrt.com> Wed, 25 Nov 2009 01:01:37 +0000 http://www.cisrt.org/blog/read.php?507 Microsoft Security Advisory (977981)
Vulnerability in Internet Explorer Could Allow Remote Code Execution
Published: November 23, 2009

Version: 1.0

Microsoft is investigating new public reports of a vulnerability in Internet Explorer. This advisory contains information about which versions of Internet Explorer are vulnerable as well as workarounds and mitigations for this issue.

Our investigation so far has shown that Internet Explorer 5.01 Service Pack 4 and Internet Explorer 8 on all supported versions of Microsoft Windows are not affected, and that Internet Explorer 6 Service Pack 1 on Microsoft Windows 2000 Service Pack 4, and Internet Explorer 6 and Internet Explorer 7 on supported editions of Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008 are affected.

The vulnerability exists as an invalid pointer reference of Internet Explorer. It is possible under certain conditions for a CSS/Style object to be accessed after the object is deleted. In a specially-crafted attack, Internet Explorer attempting to access a freed object can lead to running attacker-supplied code.

............

Tags - , ]]> http://www.cisrt.org/blog/read.php?505 <![CDATA[Microsoft Office Web 组件控件中的0-day漏洞（973472）]]> 小陌 <smallmo@cisrt.com> Tue, 14 Jul 2009 01:25:05 +0000 http://www.cisrt.org/blog/read.php?505 Microsoft Security Advisory (973472)

MS 知识库：http://support.microsoft.com/kb/973472


Tags - , , ]]> http://www.cisrt.org/blog/read.php?504 <![CDATA[Green Dam-Youth Escort，绿坝]]> 小陌 <smallmo@cisrt.com> Fri, 12 Jun 2009 08:00:10 +0000 http://www.cisrt.org/blog/read.php?504
Analysis of the Green Dam Censorware System


Tags - , ]]> http://www.cisrt.org/blog/read.php?502 <![CDATA[五一期间爆三个新0day,暴风影音和中国游戏中心大厅漏洞被用在挂马新宠]]> hzqedison <hzqedison@cisrt.org> Sun, 03 May 2009 07:48:46 +0000 http://www.cisrt.org/blog/read.php?502

暴风影音2009(mps.dll)ActiveX远程栈溢出漏洞
引用

受影响的系统:
暴风影音2009 <=[3.09.04.17]

细节:
CLSID:6BE52E1D-E586-474F-A6E2-1A85A9B4D9FB
文件:mps.dll
Sub OnBeforeVideoDownload(ByVal URL  As String)

当参数URL是一个超长字符串时，发生栈溢出，利用堆填充技术，攻击者可以很轻松的利用此漏洞执行任意代码。


暴风影音2009(Config.dll)ActiveX远程栈溢出漏洞
引用

受影响的系统:
暴风影音2009 <=[3.09.04.17]

细节:
CLSID:BD103B2B-30FB-4F1E-8C17-D8F6AADBCC05
文件:Config.dll
Sub SetAttributeValue (
  ByVal lpQueryStr  As String ,
  ByVal bstrAttributeName  As String ,
  ByVal lpValueStr  As String
)

当参数lpQueryStr是一个超长字符串时，发生栈溢出，利用堆填充技术，攻击者可以很轻松的利用此漏洞执行任意代码。


............

Tags - , , , , , ]]> http://www.cisrt.org/blog/read.php?474 <![CDATA[微软发布更新修复“自动播放”设置]]> 海色の月 <amezhs@cisrt.org> Wed, 25 Feb 2009 03:03:00 +0000 http://www.cisrt.org/blog/read.php?474
现在越来越多的病毒会利用自动播放的便利来传播自身，也有不少病毒更会破坏系统的自动播放设置，可能就是出于此原因微软发布了这个更新程序。这个更新程序将会通过自动更新发布，用户也可以自行下载安装：http://support.microsoft.com/kb/967715

............

Tags - , , , , ]]> http://www.cisrt.org/blog/read.php?473 <![CDATA[Adobe APSB09-01 Security Bulletin]]> 小陌 <smallmo@cisrt.com> Wed, 25 Feb 2009 01:35:35 +0000 http://www.cisrt.org/blog/read.php?473 Adobe针对旗下Adobe Flash Player产品发布了一个最新的安全补丁 —— APSB09-01。

根据Adobe的报告，受影响的Flash Player版本包括：
Adobe Flash Player 10.0.12.36 and earlier
Adobe Flash Player 10.0.15.3 and earlier for Linux


建议广大网友尽快将自己的Adobe Flash Player版本升级至最新的10.0.22.87，同时Adobe针对Flash Player 9的用户也提供了相应的补丁下载地址。

............

Tags - , , ]]> http://www.cisrt.org/blog/read.php?472 <![CDATA[Microsoft Security Advisory (968272)]]> 小陌 <smallmo@cisrt.com> Wed, 25 Feb 2009 01:20:52 +0000 http://www.cisrt.org/blog/read.php?472 Microsoft Security Advisory (968272) — Vulnerability in Microsoft Office Excel Could Allow Remote Code Execution。

与此同时，国外一些反病毒厂商也捕获了利用此漏洞的木马样本。

根据微软的报告，受影响的Excel版本包括：
Microsoft Office Excel 2000 Service Pack 3
Microsoft Office Excel 2002 Service Pack 3
Microsoft Office Excel 2003 Service Pack 3
Microsoft Office Excel 2007 Service Pack 1
Microsoft Office Excel Viewer 2003
Microsoft Office Excel Viewer 2003 Service Pack 3
Microsoft Office Excel Viewer
Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Service Pack 1
Microsoft Office 2004 for Mac
Microsoft Office 2008 for Mac

............

Tags - , , , ]]> http://www.cisrt.org/blog/read.php?467 <![CDATA[Adobe Reader和Acrobat 0-day漏洞攻击]]> 小陌 <smallmo@cisrt.com> Fri, 20 Feb 2009 06:09:34 +0000 http://www.cisrt.org/blog/read.php?467 Adobe产品安全事件响应团队（PSIRT）发布APSA09-01安全公告说，Adobe Reader和Acrobat 9.0及以前的版本存在缓冲区溢出漏洞。

受影响的版本包括：
Adobe Reader 9 and earlier versions
Adobe Acrobat Standard, Pro, and Pro Extended 9 and earlier versions


而根据Shadowserver的报告说，一些反病毒厂商已经可以检测到这些恶意的pdf文件，Symantec命名为Trojan.Pidief.E，TrendMicro命名为TROJ_PIDIEF.IN。
............

Tags - , , ]]> http://www.cisrt.org/blog/read.php?462 <![CDATA[计划外补丁 MS08-078 发布]]> 海色の月 <amezhs@cisrt.org> Thu, 18 Dec 2008 12:29:26 +0000 http://www.cisrt.org/blog/read.php?462 IE 0-day 漏洞的计划外补丁 MS08-078，请大家及时安装此补丁以免受针对此漏洞的攻击。

相关链接：

Microsoft 安全公告 MS08-078 - 严重
Internet Explorer 安全更新 (960714)
http://www.microsoft.com/china/technet/security/bulletin/ms08-078.mspx

Microsoft Security Bulletin MS08-078 - Critical
Security Update for Internet Explorer (960714)
http://www.microsoft.com/technet/security/bulletin/ms08-078.mspx
Tags - , , , ]]> http://www.cisrt.org/blog/read.php?461 <![CDATA[微软又将于明日发布一个计划外补丁]]> 小陌 <smallmo@cisrt.com> Wed, 17 Dec 2008 11:51:54 +0000 http://www.cisrt.org/blog/read.php?461 Advance Notification，将于明日发布一个计划外（out-of-band）补丁，这个补丁将修补上周发现的IE XML 0day漏洞。

这已是微软今年第二个计划外补丁，上一次计划外补丁是于今年10月24日发布的MS08-067。

让我们一起等待明天发布的补丁。


Tags - , , , , , ]]>