Skip to main content
MSRC

2008

MS08-020 : How predictable is the DNS transaction ID?

Wednesday, April 09, 2008

Today we released MS08-020 to address a weakness in the Transaction ID (TXID) generation algorithm in the DNS client resolver. The TXID is a 16-bit entity that is primarily used as a synchronization mechanism between DNS servers/clients; in fact, you can think of it as an Initial Sequence Number (ISN) for DNS query/response exchanges.

Read More

MS08-023: Same bug, four different security bulletin ratings

Wednesday, April 09, 2008

Security bulletin MS08-023 addressed two ActiveX control vulnerabilities, one in a Visual Studio ActiveX control and another in a Yahoo!’s Music Jukebox ActiveX control. The security update sets the killbit for both controls. For more about how the killbit works, see the excellent three-part series (1, 2, 3) from early February in this blog.

Read More

MS08-025: Win32k vulnerabilities

Wednesday, April 09, 2008

MS08-025 addresses several vulnerabilities in win32k.sys where you can execute arbitrary code in kernel mode. These bugs can only be exploited locally and there is no remote vector we are aware of. One of these vulnerabilities deals on how we can bypass some of the ProbeForWrite and ProbeForRead checks when using user supplied memory pointers.

Read More

April 2008 Monthly Release

Tuesday, April 08, 2008

April 2008 Monthly Bulletin Release I’m Simon, Release Manager in the MSRC. The April 2008 release contains 8 new bulletins, 5 of which have maximum severities of “Critical”. MS08-018 Vulnerability in Microsoft Project Could Allow Remote Code Execution (950183) MS08-019 Vulnerabilities in Microsoft Visio Could Allow Remote Code Execution (949032)

Read More

Effective Software Security: Making the most of tools

Tuesday, April 08, 2008

Hello! My name is Vinnie Liu. I am a BlueHat speaker, and the Managing Director at Stach & Liu, a security consulting firm whose primary practice area includes helping organizations establish effective application security programs. A key component of every application security program is the use of tools and experts. In this post, we discuss the relative strengths and weaknesses between tools and experts, and by doing so, we also learn how these software security resources are best applied in an organization looking to become more proactive with their secure software development lifecycle.

Read More