Arizona IT Management

Customers are urged to visit http://www.informationarmor.com/2010/01/29/vulnerabilities/ on our sister site, there are some new vulnerabilities and fixes for them.

As another public service provided by Arizona IT Management, we have wet up a public proxy. Simply visit http://www.informationarmor.com/cloak/ and though that portal, you have the ability to surf the net anonymous.

We believe in a time and place for security, but we also think about privacy.

For further technical details on the proxy, it was built using phproxy, found at SourceForge. The source code is freely available for you to view, we only changed the name and inspected the code for malware/redirects, and found it clean.

A Proxy is when another computer requests a Web page, it is retrieved by the proxy server and then sent to the requesting computer. Useful for those behind corporate firewalls or schools.

Hello readers and visitors,

We have been experimenting with many great technologies on a personal level. Especially in the realm of website replication. There are myriad of technologies out there that can reach potential customers. Technologies such as social networking: Facebook, Twitter, MySpace, Blogger, Yahoo!, MSN Live Spaces, and RSS Feed Readers.

There are also other sites that tie into these social technologies such as Ning, Xing, LinkedIn and Plaxo. We have worked hard and researched and have come up with the right solution for replicating your blog and directing customers to one spot. Your website.

Hire Arizona IT Management to work with you to figure out your strategy and reach, so that we can get your website communicating.

If your strengths already lie in social networking, we can configure your social networks to deliver content to your blog.

Free consultation. Send us an email.

This link will lead you to our story on Backupify.

For as low as $10. Details here.

Microsoft has released MS10-002 today. The update addresses 7 privately reported and 1 publicly reported vulnerability which is associated with the widely publicized attacks associated with Security Advisory 979352. There are four (4) Uninitialized Memory Corruption Vulnerabilities, two (2) HTML Object Memory Corruption Vulnerabilities, one (1) XSS Filter Script Handling Vulnerability, and one (1) URL Validation Vulnerability. This single patch is considered Critical by Microsoft and covers the following CVE entries:

CVE-2009-4074

CVE-2010-0027

CVE-2010-0244

CVE-2010-0245

CVE-2010-0246

CVE-2010-0247

CVE-2010-0248

CVE-2010-0249

Customers should apply this update as soon as possible. The update will also be sent through the Automatic update mechanism.
http://www.microsoft.com/technet/security/bulletin/ms10-002.mspx

http://www.microsoft.com/technet/security/bulletin/ms10-jan.mspx

Microsoft Announces out of cycle Security Update schedule
Microsoft issued their Advanced Notification Service (ANS) notification to inform customers of the impending release of MS10-002 on January 21st, 2010. The update will be cumulative, in advance of the normal February release Cycle, and is intended to protect customers from the known, widely publicized attacks associated with Security Advisory 979352. Customers should apply this update as soon as possible. The update will also be sent through the Automatic update mechanism.
http://blogs.technet.com/msrc/archive/2010/01/20/advance-notification-for-out-of-band-bulletin-release.aspx
http://blogs.technet.com/msrc/archive/2010/01/19/security-advisory-979352-going-out-of-band.aspx

Additional Technical Detail

Data Execution Prevention (DEP) Bypass
There is a report of a new exploit that bypasses Data Execution Prevention (DEP). We have analyzed the Proof-of-Concept (POC) exploit code and have found that Windows Vista and later versions of Windows offer more effective protections in blocking the exploit due to the improved security protection offered by Address Space Layout Randomization (ASLR). Windows XP does not currently benefit from ASLR and will be more susceptible.

Additional details on the DEP bypass exploit are provided in a Security Research and Defense Blog published today.
http://blogs.technet.com/srd/archive/2010/01/20/reports-of-dep-being-bypassed.aspx

Microsoft E-Mail Products That Render using mshtml.dll Protected by Default
There have been reports that supported versions of Outlook, Outlook Express and Windows Live Mail are affected by the vulnerability in Security Advisory 979352.

For customers using the default configuration of all supported versions of Outlook, Outlook Express and Windows Live Mail the risk of exploit using Outlook as an attack vector is low. We are unaware of active exploit against supported versions of Outlook, Outlook Express or Windows Live. If customers have modified their default configuration to not run in Restricted sites zone, their environments will be in a less secure, more vulnerable, state.

Please review the announcement described above for more detail.

Office Applications with Active Scripting Enabled Potentially Vulnerable
Microsoft indicates that an ActiveX control in a Microsoft Access, Word, Excel, or PowerPoint file is a potentially exploitable vulnerability. Customers would have to open a malicious file to be at risk of exploitation, and Microsoft recommends disabling ActiveX Controls in Microsoft Office.

Live Briefing
On Thursday, January 21 at 1:00 p.m. PST (UTC – 8) Microsoft will host a public webcast where information on the bulletin will be presented.
Registration: http://msevents.microsoft.com/CUI/EventDetail.aspx?EventID=1032440627

Original . . .

Yesterday we updated the assessment to reflect an impending out of cycle security update from Microsoft which will address the 0-day Microsoft Internet Explorer vulnerability highlighted in recent assessments. The update is announced in an MSRC blog posting, and timing for the release is expected to be explained today. The threat level remains at AlertCon 2 while we continue to encurage review of Microsoft Security Advisory for workaround information and X-Force Protection Alert for associated IBM product coverage.
http://blogs.technet.com/msrc/archive/2010/01/19/security-advisory-979352-going-out-of-band.aspx
https://portal.mss.iss.net/mss/xftas/alertAdvisory/details.mss?alertAdvisoryId=3382
http://www.microsoft.com/technet/security/advisory/979352.mspx

Shortly after the blog posting from MSRC appeared, a new posting on Neohapsis [Full Disclosure] began to be discussed. The posting explains how a restricted Windows user can exploit the Virtual DOS Machine (VDM) to gain command access in the system context (Ring 0). Microsoft was notified of the flaw in June 2009, but there currently is no patch. Exploit code that functions under Windows XP, 2003 Server, 2008 Server, Vista, and Windows 7 has been made available, and has been confirmed to function as described.

Mitigation steps requiring the Group Policy Editor for Windows 2003 Server systems are included in the Neohapsis article. For those systems that do not include the GPE the heise security team has provided instructions for a registry hack that should work until a patch is available.
http://archives.neohapsis.com/archives/fulldisclosure/2010-01/0346.html
http://www.h-online.com/security/news/item/Windows-hole-discovered-after-17-years-Update-908917.html

Apple Computer released their Security Update 2010-001 yesterday. The update addresses several multi-media applications, as well as printer handling, and a patch to suppress renegotiation in OpenSSL while the IETF works out final changes to the renegotiation protocol. The multi-media flaws relate to MP4, TIFF, and RAW(DNG) files, as well as multiple patches to the Adobe Flash player plug-in.
http://support.apple.com/kb/HT4004

Adobe has released an update for critical vulnerabilities in Adobe Shockwave Player 11.5.2.602 and earlier versions, on the Windows and Macintosh operating systems. The vulnerabilities could allow an attacker, who successfully exploits the vulnerabilities, to run malicious code on the affected system. Adobe has provided a solution for the reported vulnerabilities. It is recommended that users update their installations to the latest version.
http://www.adobe.com/support/security/bulletins/apsb10-03.html

Additionally, the Internet Systems Consortium (ISC) announced the release of the BIND 9.6.1-P3 security patch to address two cache poisoning vulnerabilities, both of which could allow a validating recursive nameserver to cache data which had not been authenticated or was invalid. This patch targets nameservers that have DNSSEC validation enabled, which could potentially provide responses from unauthenticated records within the cache.
http://isc.sans.org/diary.html?storyid=8029

We provide a public service on security alerts at Information Armor. Or subscribe to the RSS feed.

Not many know this, but we sell voice and data lines through our trusted partners. When you contract through Arizona IT Management, we stay with you the whole time.

We offer Voice Services; Internet Access Services; Voice + Internet Solutions; Private Networking; and Communications Equipment. Whatever you need in the arena of voice and data, we got you covered.

Here are our current promotions

Holidays are the times when spammers and other anarchist types send malware related emails to everybody. Just because the holidays are now officially over, doesn’t mean your organization is safe. Many employees take vacation and the danger still exists in their mailbox awaiting for them to open. Email administrators may see an increase in infections the week after a long holiday. Apply the best security practices and maintain up-to-date software updates and patches as well as anti-virus signatures. User education is also key in mitigating this threat.

With the new year… new decade upon us, let’s work together to accomplish something. Something awesome. Something amazing. Something that will make your customers go WOW! Something that will make your staff more productive, regardless of where they are. Let’s enable and empower them to be able to securely work on anything, from anywhere.