CyberInsecure.com

Archive for the ‘Vista’ Category

A Russian security researcher on Thursday said he has released attack code that exploits a critical vulnerability in the latest version of Mozilla’s Firefox browser.

The exploit - which allows attackers to remotely execute malicious code on end user PCs - triggers a heap corruption vulnerability in the popular open-source browser, said Evgeny Legerov, founder of Moscow-based Intevydis. He recently added it as a module to Vulndisco, an add-on to the Immunity Canvas automated exploitation system sold to security professionals.

“We’ve played a lot with it in our labs - it was very reliable,” Legerov wrote in an email to The Reg. “Works against the default install of Firefox 3.6. We’ve tested it on XP and Vista.”

The report comes as Mozilla pushed out a Firefox update that tackles three critical vulnerabilities in version 3.5.7. One of those bugs is also described as a heap corruption vulnerability, but Legerov said the flaw is different from the one his code exploits.

Mozilla issued a statement that read in part: “Mozilla takes all security vulnerabilities seriously, and have as yet been unable to confirm the claim of an exploit. We value the contributions of all security researchers and encourage them to work within our security process, responsibly disclosing vulnerabilities to ensure the highest level of security and best outcome for users.”

Legerov said his firm does not provide advanced notification to software makers under an arrangement often referred to as responsible disclosure.

If Legerov’s claim pans out, it would be one of the few times in recent memory that a zero-day vulnerability for Firefox has circulated in the wild. While the exploit is currently available only to those who pay a hefty licensing fee, wider circulation can’t be far behind.

Credit: The Register

If you use any version of Internet Explorer to surf Twitter or other Web 2.0 sites, Jorge Luis Alvarez Medina can probably read the entire contents of your primary hard drive.

The security consultant at Core Security said his attack works by clicking on a single link that exploits a chain of weaknesses in IE and Windows. Once an IE user visits the booby-trapped site, the webmaster has complete access to the machine’s C drive, including files, authentication cookies - even empty hashes of passwords.

This isn’t the first time security researchers at Core have identified security weaknesses in IE. The company issued this advisory in 2008 and this one in 2009, each identifying specific links in the chain that could potentially be abused by an attacker.

“Every time we reported this to Microsoft, they were fixing just one of the features,” Medina said in a telephone interview from Bueno Aires. “Every time they [fixed] it, we managed another way to build the attack again.”

Medina said he has fully briefed Microsoft on his latest attack, which he plans to demonstrate at next month’s Black Hat security conference in Washington, DC. Microsoft’s “rapid response team” didn’t reply to an email, but a statement sent to other news outlets said the company is investigating the vulnerability and isn’t aware of it being exploited in the wild.

The hole is difficult to close because the attack exploits an array of features IE users have come to rely on to make web application work seamlessly. Simply removing the features could neuter functions such as online file sharing and active scripting, underscoring the age-old tradeoff between a system’s functionality and its security.

Based on Medina’s characterization, it appears that fixing the weakness will require changes in a Windows network sharing technology known as SMB, or server message block, as well as the way Windows makes file caches available to a wide variety of applications.

“The things we are reporting are not bugs, they are features,” Medina said. “They are needed for many applications to work, so [Microsoft] can’t simply remove or truncate” them.

IE suffers from at least one other long-standing security bug that can enable attacks against people browsing websites that are otherwise safe to view. It can be exploited to introduce XSS, or cross-site scripting, exploits on webpages, allowing attackers to inject malicious content and code. Microsoft has said it’s unaware of this vulnerability being exploited.

Core’s previous advisories contain a number of workarounds, including setting the security level for the internet and intranet zones to high to prevent IE from running scripts or ActiveX controls.

Credit: The Register

The University of Exeter in South West of England experienced serious problems with its computer network earlier this week due to a virus outbreak. Systems running Microsoft Windows Vista with Service Pack 2 seem to have been particularly affected by the unnamed malware.

The problems started on Monday when a computer virus was introduced onto the network. “Experience of dealing with data corrupting viruses elsewhere indicates that it is essential to shut down the network ASAP to avoid so many machines and files being corrupted that it takes weeks to recover. Therefore, although this is a PC rather than a network problem, we had to shut down the network to isolate the virus,” announced David Allen, the university’s registrar and deputy chief executive.

The exact name of the virus has not been disclosed, but ZDNet cites insider sources according to which, it exploits the vulnerability described in Microsoft’s MS09-050 Security Bulletin. “This is a completely new virus and we are the only organisation in the world to experience it. None of the mainstream virus software suppliers have seen this virus, and as such, there is no fix,” a leaked internal e-mail from the IT department allegedly reads.

Mr. Allen also pointed out that a security expert had been called on site to assist with the cleaning efforts. Apparently, this malware has only been detected on computers running Windows Vista and the specialized staff plans to check all such systems. This would suggest that the “virus” can spread from one computer to another, which would technically make it a computer worm.

“University campuses are, of course, complex beasts and the IT teams who secure them can have a tough job. The problem is compounded by having a massive userbase of students who may plug their own devices into the network, or may show little care for the security of a communal computer and put it at unnecessary risk,” notes Graham Cluley, senior technology consultant at antivirus vendor Sophos.

The network is slowly being brought back online, beginning with buildings that do not use Windows Vista computers. Several services such as Outlook Web Access and the MyExeter Web portal remain functional, but other network-dependent equipment like VoIP telephones or interactive teaching boards are unusable.

The University of Exeter has almost 16,000 students and three campuses, two in Exeter and one in Cornwall. The Cornwall campus is shared with the University College Falmouth and was isolated from the affected network immediately after the threat was discovered.

Credit: Softpedia.com News

As part of its scheduled batch of patches for November, Microsoft today issued six security bulletins with fixes for a total of 15 vulnerabilities affecting its Windows and Office product lines. Four of the six bulletins include patches for Windows and Windows Server and two affect Microsoft Office products (Excel and Word).

Three of the six bulletins are rated “critical,” meaning they can be used to launch remote code execution or worm attacks without any user action. One of the Windows vulnerabilities could expose users to drive-by malware attacks via the browser, Microsoft warned.

Microsoft is urging Windows users to pay special attention to MS09-065, a “critical” bulletin that patches three documented vulnerabilities in Windows Kernel-Mode drivers. Microsoft expects to see functional exploit code for this flaw very soon.

This Patch Tuesday also brings:

MS09-063 (Maximum severity rating of Critical): Resolves one privately reported vulnerability in Windows, which could allow remote code execution if an affected Windows system receives a specially crafted packet. An attacker who successfully exploited this vulnerability could take complete control of an affected system.

MS09-064 (Maximum severity rating of Critical): Patches one privately reported vulnerability in Windows, which could allow remote code execution if an attacker sent a specially crafted network message to a computer running the License Logging Server. An attacker who successfully exploited this vulnerability could take complete control of the system.

MS09-066 (Maximum severity rating of Important): This update resolves one privately reported vulnerability in Windows, which could allow denial of service if stack space was exhausted during execution of certain types of LDAP or LDAPS requests.

MS09-067 (Maximum severity rating of Important): This update resolves eight privately reported vulnerabilities in Office, which could allow remote code execution if a user opens a specially crafted Excel file. An attacker who successfully exploited any of these vulnerabilities could gain the same user rights as the local user.

MS09-068 (Maximum severity rating of Important): This update resolves one privately reported vulnerability in Office, which could allow remote code execution if a user opens a specially crafted Word file. An attacker who successfully exploited this vulnerability could take complete control of an affected system.

Microsoft also reissued MS09-045 and MS09-051 to address detection and minor problem issues.

On the MSRC blog, Microsoft is offering charts explaining the severity and exploitability of each vulnerability and visual guidance on how to properly prioritize and deploy the updates.

The company’s Security Research & Defense Blog offers a technical breakdown of some of the more serious vulnerabilities at http://blogs.technet.com/srd.

Credit: ZDNet.com Security Blogs

Microsoft first released a public beta of its Security Essentials antivirus suite back in June and it was met with mostly positive reviews. Today Microsoft has released the final version of Security Essentials and anyone running Windows XP, Windows Vista, or Windows 7 can download it for free.

Microsoft Security Essentials offers basic antivirus, spyware, and malware protection. It also offers real-time protection and regularly updated malware signature files via Microsoft’s Dynamic Signature Service.

Since Microsoft Security Essentials provides the bare minimum protections for a Windows-based machine, other niceties such as a firewall and multi-PC management are not available. This should appease Microsoft’s competitors in the anti-malware software segment.

Microsoft Security Essentials replaces the Onecare offering and the free Defender installation standard on Vista installations. It will provide you with malware detection and removal ONLY. So do not rely on this as your one stop shop for security. It does not have the features and functionality that many of the AV vendors provide in their products. Think of this as the AV as it used to be in 2000 or so. Detect rates seem to be quite good according to testers reports.

Those who wish to try out the software can download it directly from the Microsoft Security Essentials website. The download requires that your PC pass Windows Genuine Advantage checks, so only legit Windows users will have access to the software.

Shortly after the release of Microsoft Security Essentials, Websense Security Labs has reported that search engine results related to Microsoft’s Security Essentials are returning links to Web sites that serve rogue AV.

Malware authors have used Search Engine Optimization (SEO) techniques to mix rogue search results in with legitimate results. For example, one of the rogue links is directly under a MSDN blog entry discussing Microsoft Security Essentials. The rogue redirects are hosted on compromised Web sites, including a Canadian publisher’s Web site and the British Travel Health Association.

When a user browses to the compromised Web sites, so long as they have been referred by a search engine, they are redirected to malicious Web sites with domain names such as computer-scanner21 and computervirusscanner31.

An example of one of the payload files shows that AV detection is low. One such file is named Soft_71.exe. If the user downloads the application, a file with extension .tif is downloaded in the “program files\TS” directory as TSC.exe and system.dat (the .tif file is decrypted/decompressed and split). The payload then executes “tsc.exe -dltest” apparently connects to a NASA Web site, to check internet connectivity. Finally, “tsc.exe” is executed with no parameters, and the rogue AV starts. (In the background the original file is deleted).

According to Websense, it appears that the malware authors set up a trial run of SEO poisoning techniques, before converting the redirects to deliver rogue applications today. Screenshot of Google search results:

Screenshot of rogue AV Web site:

Screenshot of download prompt:

Credit: DailyTech.com, SANS ISC, Websense Security Labs

White-hat hackers have released reliable code that remotely exploits a critical vulnerability in Microsoft’s Windows Vista operating system.

The exploit code, released Wednesday by security firm Immunity, came as separate researchers with the Metasploit penetration testing project said they were close to releasing their own software targeting the network file-sharing technology known as SMB2, or Server Message Block version 2. It was first added to Vista and has since been put into other operating systems.

The progress of ethical researchers in exploiting the bug is important because it’s an indication of how other, less scrupulous hackers are likely faring. It shows that the bug, which affects newer operating systems built under a program designed to prevent such security flaws, is far from being a mere theoretical risk to the millions of people who use the products. Rather, it means attackers can use the internet to take over vulnerable machines located half-way around the globe.

“This is the kind of vulnerability that hits everybody who is sharing files with other users,” Dave Aitel, CTO of Immunity, told El Reg. “It affects the most secure operating system Microsoft has put out other than Windows 7.”

The vulnerability, which is the result of the SMB2’s failure to adequately parse network negotiation requests, affects all versions of Vista, versions of Server 2008 other than R2 and the release candidate (but not the release to manufacture) version of Windows 7. Microsoft has said it plans to release updates patching the vulnerability as soon as they’re ready.

Members of the Metasploit project, which produces an open-source program that tests networks for a comprehensive list of vulnerabilities, indicated they are close to releasing exploits of their own. Team member Stephen Fewer has identified the exploit identification pointer needed to remotely exploit the vulnerability in Service Pack 1 version of Windows. Once an exploit is released, they expect it to work on other vulnerable platforms as well.

Beginning with Vista, Microsoft introduced a variety of counter measures designed to make it harder for hackers to exploit bugs that inevitably escape notice during development. Address space layout randomization, data execution prevention are just two of them. While they clearly making exploitation harder, Wednesday’s release by Immunity shows they are by no means foolproof.

Credit: The Register

Microsoft’s released this month 10 bulletins covering a total of 31 documented vulnerabilities affecting the Windows OS, Internet Explorer browser and Microsoft Office productivity suite (Word, Works and Excel).

Five of the 10 bulletins are rated “critical”, Microsoft’s highest severity rating. Among the patches this month are fixes for a pair of IIS WebDav flaws that were publicly disclosed last month and cover for the CanSecWest Pwn2Own vulnerability that was used to exploit Internet Explorer on Windows 7.

This month’s updates include:

MS08-018 (Critical): Fixes two privately reported vulnerabilities in implementations of Active Directory on Microsoft Windows 2000 Server and Windows Server 2003, and Active Directory Application Mode (ADAM) when installed on Windows XP Professional and Windows Server 2003. The more severe vulnerability could allow remote code execution. It is rated Critical for all supported editions of Microsoft Windows 2000 Server, and rated Important for supported versions of Windows XP Professional and Windows Server 2003.

MS09-019 (Critical): Patches seven privately reported vulnerabilities and one publicly disclosed vulnerability in Internet Explorer. The more severe of the vulnerabilities could allow remote code execution if a user views a specially crafted Web page using Internet Explorer. Affects IE 5.01, IE 6, IE 7 and IE 8 running on all supported editions of Windows.

MS09-020 (Important): Fixes one publicly disclosed vulnerability and one privately reported vulnerability in Microsoft Internet Information Services (IIS). The vulnerabilities could allow elevation of privilege if an attacker sent a specially crafted HTTP request to a Web site that requires authentication. These vulnerabilities allow an attacker to bypass the IIS configuration that specifies which type of authentication is allowed, but not the file system-based access control list (ACL) check that verifies whether a file is accessible by a given user. Affects all supported editions of Microsoft Windows 2000, Windows XP, and Windows Server 2003.

MS09-021 (Critical): Patches seven privately reported vulnerabilities that could allow remote code execution if a user opens a specially crafted Microsoft Excel file that includes a malformed record object. An attacker who successfully exploited any of these vulnerabilities could take complete control of an affected system. It affects Excel 2000, Excel 2002, Excel 2003, Excel 2007, Office 2004 for Mac, and Microsoft Office 2008 for Mac; Open XML File Format Converter for Mac; and all supported versions of Microsoft Office Excel Viewer and Microsoft Office Compatibility Pack.

MS09-022 (Critical): Covers three privately reported vulnerabilities in Windows Print Spooler. The most severe vulnerability could allow remote code execution if an affected server received a specially crafted RPC request. It applies to Windows 2000, Windows XP, Windows Server 2003, Windows Vista and Windows Server 2008.

MS09-023 (Moderate): Patches a privately reported vulnerability in Windows Search. The vulnerability could allow information disclosure if a user performs a search that returns a specially crafted file as the first result or if the user previews a specially crafted file from the search results. This security update is rated Moderate for Windows Search installed on all supported editions of Windows XP and Windows Server 2003.

MS09-024 (Critical): Fixes a privately reported vulnerability in the Microsoft Works converters. The vulnerability could allow remote code execution if a user opens a specially crafted Works file. Affects Word 2000, Word 2002, Word 2003 with the Microsoft Works 6–9 File Converter, Word 2007 Service Pack 1, Microsoft Works 8.5 and Microsoft Works 9.

MS09-025 (Important): Covers two publicly disclosed and two privately reported vulnerabilities in the Windows kernel that could allow elevation of privilege. An attacker who successfully exploited any of these vulnerabilities could execute arbitrary code and take complete control of an affected system. The vulnerabilities could not be exploited remotely or by anonymous users. Affects Microsoft Windows 2000, Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008.

MS09-026 (Important): Patches a publicly disclosed vulnerability in the Windows remote procedure call (RPC) facility where the RPC Marshalling Engine does not update its internal state appropriately. The vulnerability could allow an attacker to execute arbitrary code and take complete control of an affected system. Rated Important for all supported editions of Microsoft Windows 2000, Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008.

MS09-027 (Critical): Covers two privately reported vulnerabilities that could allow remote code execution if a user opens a specially crafted Microsoft Word file. Rated Critical for all supported editions of Microsoft Office Word 2000. For all supported editions of Microsoft Office Word 2002, Microsoft Office Word 2003, Microsoft Office Word 2007, Microsoft Office 2004 for Mac, and Microsoft Office 2008 for Mac, and all supported versions of Open XML File Format Converter for Mac, Microsoft Office Compatibility Pack, and Microsoft Office Word Viewers, this security update is rated Important.

Apple has also shipped a Safari browser update that fixes more than 50 vulnerabilities, some rated extremely critical.

The latest fixes, available in the new Safari 4.0, corrects a wide range of code execution and denial-of-service vulnerabilities and even comes with a fix for the vexing “clickjacking” issues plaguing modern Web browsers.

Several proof-of-concept examples of clickjacking, also known as URI redressing, show how clicks on one Web page can actually apply to clicks on page that’s invisible to the end user. It is a problem that affects all the major Web browsers and it appears Apple is pushing out a fix for Mac and Windows users.

Updates include:

CFNetwork: CVE-2009-1704, CVE-2009-1716

ImageIO: CVE-2009-0040

International components for Unicode: CVE-2009-0153

libxml: CVE-2008-3281, CVE-2008-3529, CVE-2008-4409, CVE-2008-4225, CVE-2008-4226

Safari: CVE-2009-1682, CVE-2009-1706, CVE-2009-1707, CVE-2009-1708

Safari windows installer (no CVE name)

Webkit (CVE-2009-1681): A design issue exists in the same-origin policy mechanism used to limit interactions between websites. This policy allows websites to load pages from third-party websites into a subframe. This frame may be positioned to entice the user to click a particular element within the frame, an attack referred to as “clickjacking”. A maliciously crafted website may be able to manipulate a user into taking an unexpected action, such as initiating a purchase. This update addresses the issue through adoption of the industry-standard ‘X-Frame-Options’ extension header, that allows individual web pages to opt out of being displayed within a subframe. Also fixed: CVE-2006-2783, CVE-2008-1588, CVE-2008-2320, CVE-2008-3632, CVE-2008-4231, CVE-2009-1681, CVE-2009-1684, CVE-2009-1685, CVE-2009-1686, CVE-2009-1687, CVE-2009-1688, CVE-2009-1689, CVE-2009-1690, CVE-2009-1691, CVE-2009-1693, CVE-2009-1694, CVE-2009-1695, CVE-2009-1696, CVE-2009-1697, CVE-2009-1698, CVE-2009-1699, CVE-2009-1700, CVE-2009-1701, CVE-2009-1702, CVE-2009-1703, CVE-2009-1709, CVE-2009-1710, CVE-2009-1711, CVE-2009-1712, CVE-2009-1713, CVE-2009-1714, CVE-2009-1715, CVE-2009-1718

The latest Safari refresh also fixes five documented several code execution issues in CoreGraphics (all could lead to complete computer takeover attacks); an ImageIO issue that could be exploited via maliciously crafted PNG images; 5 flaws in libxml; and a variety of WebKit vulnerabilities that affect Safari on both Mac and Windows systems.

Needles to say, this update comes as highly recommended for anybody using safari.

Note some CVE names are quite old … e.g. CVE-2006-2783 was first discussed more than 3 years ago in Mozilla (June 1st, 2006) and was fixed by Apple for iPhone and iPod almost a year ago (July 11th, 2008).

Credit: ZDNet.com Security Blogs
Credit: SANS Internet Storm Center

As if the fact that Adobe Acrobat Reader is bloated and slow isn’t enough, more than 47 percent of attacks this year exploit holes in it. With all the Internet attacks that exploit Adobe Acrobat Reader people should switch to using an alternative PDF reader, a security expert said at the RSA security conference on Tuesday.

Just last month, Adobe issued a fix for an Acrobat Reader hole that attackers had been exploiting for months, after issuing a patch for a critical vulnerability in Flash player the month before.

In 2008, the favored targeted attack vector was Microsoft Word, which had 15 known vulnerabilities (compared to Acrobat Reader’s 19) and which represented 34.5 percent of the attacks (compared to 28.6 percent for Acrobat Reader).

Top-level executives, defense contractors, and other people who have access to specific sensitive corporate or government information are subject to targeted attacks where an attacker sends a file that has malicious code embedded in it. Once the file is opened, the computer is infected typically with a back door that then steals data.

PDF and Flash browser plug-ins are also used in attacks known as “drive-by downloads” in which malware is surreptitiously downloaded onto a computer while the user is surfing the Web. The number of PDF files used in attacks rose from 128 between January 1 and April 16 last year to more than 2,300 in that same time period during this year, said Mikko Hypponen, chief research officer of security firm F-Secure.

Adobe “has a lot to learn from, of all places, Microsoft,” which offers regular security patches on a monthly basis as part of Patch Tuesday, Hypponen said.

Part of the problem is people don’t expect that Acrobat Reader upgrades necessarily contain important security patches like they do with Microsoft software, he said.

Hypponen did not recommend a PDF reader, but said Acrobat Reader alternatives are listed on the PDFReaders.org Web site. An obvious Acrobat Reader alternative for Windows would be Foxit Reader. A ZIP package with a latest version that needs no installation can be downloaded here.

Credit: CNET News

Microsoft’s April batch of security patches fixes at least 20 documented vulnerabilities listed in 8 bulletins. This month’s fixes cover several code execution bugs that are currently being actively exploited (Microsoft Excel and Microsoft WordPad) and two issues that have been publicly known for at least a year (token kidnapping and Safari-to-Internet Explorer blended threat).

The most serious of the flaws could lead to remote code execution attacks that give a malicious hacker complete control over a vulnerable machine. Cumulative Internet Explorer update (MS09-014) covers 4 privately reported and two publicly disclosed vulnerabilities. The vulnerabilities could allow remote code execution if a user views a specially crafted Web page using Internet Explorer or if a user connects to an attacker’s server by way of the HTTP protocol. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Microsoft’s April updates details:

MS09-009 (Excel) - Multiple memory corruption vulnerabilities allow random code execution. Also affect Excel viewer and Mac OS X versions of Microsoft Office. Replaces MS08-074. Actively exploited.

MS09-010 (Wordpad & Office converters) Multiple vulnerabilities allow random code execution. Replaces MS04-027. Actively exploited.

MS09-011 (DirectX) MJPEG input validation error allows random code execution. Replaces MS08-033. No publicly known exploits.

MS09-012 (Windows) Multiple vulnerabilites allow privilege escalation and random code execution. Affects servers with IIS and SQLserver installed and more. Replaces MS07-022, MS08-022 and MS08-064. Actively exploited, exploit code publicly available.

MS09-013 (HTTP services) Multiple vulnerabilities allow random code execution, spoofing of https certificates and NTLM credential reflection. Related to MS09-014 (below). Exploit is publicly known.

MS09-014 (IE) Cumulative MSIE patch. Replaces MS08-073, MS08-078 and MS09-002. Related to MS09-10, MS09-013 (above) and MS09-15 (below). Exploit code publicly available.

MS09-015 (SearchPath) Update to make the system search for libraries first in the system directory by default and an API to change the order. Replaces MS07-035. Related to MS09-014 (above). Attack method publicly known.

MS09-016 (ISA server) Multiple input validation vulnerabilities allow a DoS and XSS. One of the attack methods publicly known.

Users are advised to install vendor patches as soon as they are available and avoid following links or handling files from unknown or questionable sources.

Microsoft’s summary of the April releases can be found here.

Microsoft shipped yesterday three security bulletins with fixes for at least 8 documented vulnerabilities affecting Windows OS users.

The most serious is rated “critical” and could allow full remote execution attacks if a Windows user is simply lured into viewing a special image file.

The March 2009 bulletins include:

MS09-006: CVE-2009-0081, CVE-2009-0082, CVE-2009-0083 (CRITICAL) Multiple input validation vulnerabilities in the windows kernel allow random code execution though the GDI component (WMF and EMF files), and privilege escalations that allow random code to be run in kernel mode. These vulnerabilities affect all versions of Windows, including Vista and Windows Server 2008.  Microsoft expects to see exploit code for these flaws but reckons the reliability will be “inconsistent.” Replaces MS08-061.

MS09-007: CVE-2009-0085 (IMPORTANT): Secure Channel (SChannel) implements SSL and TLS. When using client certificates (X.509) the server implementation fails to properly validate that the client has access to the private key and allows impersonation using only knowledge of the public key of the client. The bulletin is available for all versions of Windows — Windows 2000 through Windows Server 2008. Replaces MS07-031.

MS09-008: CVE-2009-0093, CVE-2009-0094, CVE-2009-0233, CVE-2009-0234(IMPORTANT): Multiple vulnerabilities in the DNS and WINS server implementation. DNS spoofing is made easier by allowing a more predicable transaction ID, possible causing DNS cache poisoning. The update also fixes the problem with WPAD (Web Proxy Auto Discovery) described in security advisory 945713. A similar problem is fixed for WINS with the WPAD and ISATAP (IPv6: Intra Site Automatic Tunnel Addressing Protocol) names. Microsoft warns that “consistent exploit code” is likely. Replaces MS08-037, MS08-034 and MS08-066.

Due to “critical” nature of the bulletin, users should update their systems as soon as possible.