Recent Microsoft vulnerabilities

[darin.marais]

I recently read the following article http://news.zdnet.co.uk/internet/0,39020369,39208852,00.htm

I would like to find out if there are any currently enabled signatures to capture this vulnerability yet or are they on there way:

 Microsoft Color Management Module, a component of Windows that handles colors.

Microsoft Security Bulletin MS05-036

http://go.microsoft.com/fwlink/?linkid=49316

 JView Profiler, part of Microsoft's Java Virtual Machine

Microsoft Security Bulletin MS05-037

http://go.microsoft.com/fwlink/?linkid=49999

[darin.marais]

My apologies, I have just visited the Cisco Intrusion Prevention Alert Center and I was able to find the answer to my question there.

13 July 2005: Breaking News

Cisco PSIRT has released three (3) recent advisories.

Additional details can be found here:

http://www.cisco.com/en/US/products/products_security_advisories_listing.html

Microsoft has released 3 security bulletins.

Additional details can be found here:

http://www.microsoft.com/technet/security/bulletin/ms05-jul.mspx

Signature release S180 contains signatures related to MS05-037.

We are currently investigating the remaining vulnerabilities for possible signatures.

[rupadras]

Signature 5556 and its subsigs cover the JView Profiler vulnerability. They all are enabled by default. Subsigs 2 and 3 are available on 5.x platforms only. The signatures are released in S180 and S181.

For the Windows Color Management Module vulnerability, we have released signature 5557 in S181. This signature is available on 5.x platforms only. All the subsigs are enabled by default.

[darin.marais]

I see that Cisco have released an update s181 that contains the added signatures for these vulnerabilities but they have only been installed on version 5.x sensors.

Does anyone know the reason why it has not been implemented for version 4.x?

[wsulym]

Whenever possible, the signature team will release new signatures for both 5.x and 4.x, but only when they both have the appropriate engine available or there is a suitable method for writing the signature

without a significant loss in fidelity or performance. In this case, we were not able to come up with a 4.x signature that meets those requirements while ensuring we delivered a timely response to our

customers.

The signature team will continue to review the vulnerability and, if possible, release a 4.x signature for the issue. This is consistent with our goal to provide quality signatures to all of our customers.

Walter.