Alert GCSA-08036 - MS08-023 Microsoft Security Update dei Kill Bit

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


******************************************************************

    Alert ID : GCSA-08036
        Data : 09 aprile 2008
      Titolo : MS08-023 Microsoft Security Update dei Kill Bit ActiveX (948881)

******************************************************************


:: Descrizione del problema

    E' stata individuata una vulnerabilita' in Windows
    (controllo ActiveX 'hxvz.dll'), che potrebbe consentire l'esecuzione
    di codice arbitratio da remoto, nel caso in cui l'utente visualizzi
    con Internet Explorer pagine web malevole create allo scopo.
    L'aggiornamento contiene anche l'impostazione del kill bit per
    il prodotto Yahoo! Music Jukebox.


:: Software interessato

    Windows 2000 SP4 (Internet Explorer 5.01 SP4)
    Windows 2000 SP4 (Internet Explorer 6 SP1)
    Windows XP SP2
    Windows XP Pro x64 Edition
    Windows XP Pro x64 Edition SP2
    Windows Server 2003 SP1
    Windows Server 2003 SP2
    Windows Server 2003 x64 Edition
    Windows Server 2003 x64 Edition SP2
    Windows Server 2003 with SP1 for Itanium-based Systems
    Windows Server 2003 with SP2 for Itanium-based Systems
    Windows Vista and Windows Vista SP1
    Windows Vista x64 Edition
    Windows Vista x64 Edition SP1
    Windows Server 2008 for 32-bit Systems
    Windows Server 2008 for x64-based Systems
    Windows Server 2008 for Itanium-based Systems


:: Impatto

    Esecuzione remota di codice arbitrario
    Denial of Service


:: Soluzioni

    Installare manualmente la patch elencata nel bollettino Microsoft,
    oppure utilizzare uno degli strumenti di aggiornamento come:
    Aggiornamenti Automatici, Windows Update, Microsoft Update,
    Windows Server Update Services.


:: Riferimenti

    Microsoft Security Bulletin
    http://www.microsoft.com/technet/security/bulletin/MS08-023.mspx

    Microsoft Knowledge Base
    http://support.microsoft.com/kb/948881

    Microsoft Update
    https://update.microsoft.com/microsoftupdate/

    Come disabilitare un controllo ActiveX in Internet Explorer
    http://support.microsoft.com/kb/240797

    Mitre's CVE ID
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1086

    Secunia advisories
    http://secunia.com/advisories/29714/

    FrSIRT
    http://www.frsirt.com/english/advisories/2008/1147

    Securityfocus Bugtraq ID
    http://www.securityfocus.com/bid/28606

    SANS Internet Storm Center
    http://isc.sans.org/diary.html?storyid=4264

    iDefense Labs Advisory
    http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=680

-----BEGIN PGP SIGNATURE-----

iQCVAwUBR/zQifOB+SpikaiRAQKJJAP9FB+6/PKgbIvD5CRKNLe9wZYdMNtMoNUp
gWh0uHjV8HfoZOfZ17C13IYEqrey76FyVJL+sDHc56Wr2qMMGwF4XDW6LCu5RpL0
UwSMPYDA/nCoRcL182nyulDLN7Evom93wD1MbOlC7dZf/0xtxL/UT1OfEvbxDYb+
yNwlFZjpKyA=
=HO+8
-----END PGP SIGNATURE-----