This week's report presents a series of Microsoft vulnerabilities, MS06-066, MS06-067, MS06-068, MS06-069, MS06-070, and MS06-071, the TelnetOn.A worm and the Briz.S Trojan.
Bulletins MS06-067 to MS06-071 refer to a number of critical vulnerabilities, including a cumulative update for Internet Explorer (MS06-067), a flaw in Flash Player (MS06-069) and another in XML Core Services (MS06-071). The MS06-066 bulletin is classified as "important" and is about problems in the client service for NetWare.
Microsoft has prepared security updates for these problems for users. It is wise to install them as soon as possible, as a lot of of these flaws could compromise system security by permitting malicious code to be run.
The TelnetOn.A worm creates an Administrator account on the infected computer, which allows it to take full command of the target system through the Telnet service. One of the main actions that this worm performs is ending processes which belong to several security tools, such as antivirus or firewall programs. It also kills processes belonging to other malicious code.
Once installed on the affected computer, TelnetOn.A prevents access to certain websites, including websites of antivirus applications. This worm spreads through the P2P programs eMule, KaZaA and Morpheus, the mIRC program and email.
As a final point, Briz.S is a password-stealer Trojan made up of several components downloaded via the Internet. Its aim is to take private information from the affected computer, such as the IP address, and capture data entered by users in Web forms through Internet Explorer (usernames and passwords for accessing email, banking services and other online services).
It also prevents the attacked computer from accessing certain websites belonging to antivirus vendors. It uses the affected computer as a gateway to anonymously connect to third-party Telnet, SMTP, FTP and HTTP services. Briz.S needs an attacker's intervention to spread, and can reach computers in many ways: CD-ROMs, email messages with attachments, Internet downloads, or IRC channels.
Users wondering whether their computers have been attacked by these or other malicious code can use ActiveScan, the free solution available at: www.activescan.com. Users can carry out a complete inspection of all the areas of their computers that they suspect might be infected, free of charge.
|
