• Microsoft Security Advisory:http://www.microsoft.com/technet/security/advisory/2028859.mspx

• Memory Corruption occurs when Shockwave Player parses ".dir" media file that can lead to exploitation. (CVE-2010-1280,CVE-2010-1286,CVE-2010-1287,CVE-2010-1289,CVE-2010-1290,CVE-2010-1291).
• Heap overflow that can lead to exploitation. (CVE-2010-1288).

• Users should apply the solution provided by Adobe.
• FortiGuard Labs released the following signatures to protect against these vulnerabilities
  • "Adobe.Shockwave.Player.Dir.Invalid.Length.Code.Execution", previously released as "FG-VD-10-013-Adobe" (CVE-2010-1280)
  • "Adobe.Shockwave.Player.Dir.File.DEMX.Tag.Memory.Corruption", previously released as "FG-VD-10-004-Adobe" (CVE-2010-1286)
  • "Adobe.Shockwave.Player.Dir.File.Length.Field.Memory.Corruption", previously released as "_FG-VD-10-006-Adobe" (CVE-2010-1287)
  • "Adobe.Shockwave.Player.Dir.File.Parsing.Heap.Exhaustion", previously released as "FG-VD-10-007-Adobe" (CVE-2010-1288)
  • "Adobe.Shockwave.Player.Dir.File.Handling.Memory.Corruption", previously released as "FG-VD-10-008-Adobe" (CVE-2010-1289)
  • "Adobe.Shockwave.Player.IML32.Dll.Memory.Corruption", previously released as "FG-VD-10-011-Adobe" (CVE-2010-1290)
  • "Adobe.Shockwave.Player.Dir.File.Parsing.Access.Violation", previously released as "FG-VD-10-009-Adobe" (CVE-2010-1291)

• Adobe Security Bulletin::http://www.adobe.com/support/security/bulletins/apsb10-12.html
• CVE ID:CVE-2010-1280
• CVE ID:CVE-2010-1286
• CVE ID:CVE-2010-1287
• CVE ID:CVE-2010-1288
• CVE ID:CVE-2010-1289
• CVE ID:CVE-2010-1290
• CVE ID:CVE-2010-1291

• Honggang Ren of Fortinet's FortiGuard Labs (CVE-2010-1280,CVE-2010-1286,CVE-2010-1287,CVE-2010-1289,CVE-2010-1290,CVE-2010-1291,CVE-2010-1288).

Threat Remediation

Fortinet provides coverage on Adobe vulnerabilities in May 11, 2010.

CVE Number	Signature Name
CVE-2010-1293	Adobe.ColdFusion.logintowizard.cfm.XSS
CVE-2010-0127	Adobe.Shockwave.Player.Dir.File.Boundary.Error
CVE-2010-0128	Adobe.Shockwave.Player.Dir.File.Signedness.Error
CVE-2010-0129	Adobe.Shockwave.Player.Dir.File.Integer.Overflow
CVE-2010-0130	Adobe.Shockwave.Player.Dir.File.Memory.Corruption
CVE-2010-0986	Adobe.Shockware.Player.Parsing.Dir.File.Memory.Corruption
CVE-2010-0987	Adobe.Shockware.Player.Parsing.Dir.File.Buffer.Overflow
CVE-2010-1280	Adobe.Shockwave.Player.Dir.Invalid.Length.Code.Execution [Previous Name: FG-VD-10-013-Adobe]
CVE-2010-1281	Adobe.Shockwave.Player.Offset.Underflow.Memory.Corruption
CVE-2010-1282	Adobe.Shockwave.Player.Dir.File.ATOM.Size.DoS
CVE-2010-1283	Adobe.Shockwave.Player.3D.Parsing.Memory.Corruption
CVE-2010-1284	Adobe.Shockwave.Player.Dir.Invalid.Value.Code.Execution
CVE-2010-1286	]]> http://www.fortiguard.com/advisory/FGA-2010-23.html http://www.fortiguard.com/advisory/FGA-2010-23.html Tue, 11 May 2010 00:00:00 -0800 MS Bulletin Number Microsoft Bulletin Title Severity Impact of Vulnerability Affected Software CVE ID MS10-030 Vulnerability in Outlook Express and Windows Mail Could Allow Remote Code Execution (978542) Critical Remote Code Execution Microsoft Windows CVE-2010-0816 MS10-031 Vulnerability in Microsoft Visual Basic for Applications Could Allow Remote Code Execution (978213) Critical Remote Code Execution Microsoft Office, Microsoft Visual Basic for Applications CVE-2010-0815 Threat Remediation Fortinet provides coverage on Microsoft vulnerabilities in May 12, 2010. CVE Number Signature Name CVE-2010-0815 MS.Windows.VBE6.DLL.Stack.Memory.Corruption CVE-2010-0816 MS.Windows.Mail.Client.Integer.Overflow For more information on new and enhanced signatures, visit the IPS Service Update History. If you require more information, contact the FortiGuard Team using our Contact Us web page. Document History Revision Date Version Number Tuesday, May 11 2010 1 Initial Documentation. Reference: Microsoft Security Bulletin Summary for May 11, 2010: http://www.microsoft.com/technet/security/bulletin/ms10-may.mspx ]]> http://www.fortiguard.com/advisory/FGA-2010-22.html http://www.fortiguard.com/advisory/FGA-2010-22.html Tue, 11 May 2010 00:00:00 -0800 Adobe Vulnerability Identifier Adobe Bulletin Description Severity Affected Software CVE ID APSB10-10 A vulnerability being exploited by opening a malicious .TIFF file in Photoshop CS4. Critical Adobe Photoshop CS4 version 11.0.0 CVE-2010-1279 Threat Remediation Fortinet provides coverage on Adobe vulnerabilities in May 05, 2010. CVE Number Signature Name CVE-2010-1279 Adobe.Photoshop.CS4.TIFF.File.Processing.Code.Execution For more information on new and enhanced signatures, visit the IPS Service Update History. If you require more information, contact the FortiGuard Team using our Contact Us web page. Document History Revision Date Version Number Friday, April 30 2010 1 Initial Documentation. Reference: Adobe Security Bulletin Summary for April 30, 2010: http://www.adobe.com/support/security/bulletins/apsb10-10.html ]]> http://www.fortiguard.com/advisory/FGA-2010-21.html http://www.fortiguard.com/advisory/FGA-2010-21.html Tue, 04 May 2010 00:00:00 -0800 Summary: Fortinet's FortiGuard Labs Protects Against a Vulnerability in Microsoft SharePoint. Impact: Privilege Escalation Risk: Medium Affected Software: For a list of Microsoft SharePoint versions affected, please see the references below. Additional Information: It is a vulnerability that could allow an attacker to inject a script resulting in an elevation of privilege within the SharePoint site. FortiGuard Labs continues to monitor this vulnerability world wide while developing additional mitigation strategies / solutions based off our findings. Solutions: FortiGuard Labs released the following signature which covers this specific vulnerability "MS.SharePoint.Server.Help.aspx.XSS" on May 03, 2010 Fortinet customers who subscribe to Fortinet's intrusion prevention (IPS) service should be protected against this vulnerability. Fortinet's IPS service is one component of FortiGuard Subscription Services, which also offer comprehensive solutions such as antivirus, Web content filtering and antispam capabilities. These services enable protection against threats on both application and network layers. FortiGuard Services are continuously updated by FortiGuard Labs, which enables Fortinet to deliver a combination of multi-layered security intelligence and true zero-day protection from new and emerging threats. These updates are delivered to all FortiGate, FortiMail and FortiClient products. Fortinet strictly follows responsible disclosure guidelines to ensure optimum protection during a threat's lifecycle. References: CVE ID:CVE-2010-0817 Microsoft Security Advisory:http://www.microsoft.com/technet/security/advisory/983438.mspx ]]> http://www.fortiguard.com/advisory/FGA-2010-20.html http://www.fortiguard.com/advisory/FGA-2010-20.html Fri, 30 Apr 2010 00:00:00 -0800 Table of Contents: Exploits and Intrusion Prevention Top 10 Exploitations & Regions New Vulnerability Coverage Malware Today Top 10 Variants Regions & Volume Spam and Email Threats Spam Rate & Regions Top 3 In The Wild Crawling the Web Threat Traffic & Growth Activity Recap FortiGuard Labs Exploits and Intrusion Prevention Top 10 Attacks & Regions The top 10 attack attempts detected for this period follow, ranked by the number of valid attack cases reported. Valid attack cases are defined as threats we have listed as a Threat Outbreak on our FortiGuard Center (RSS feed here). Percentage indicates the portion of activity for which the attack accounted out of the accumulated daily incidents reported during this period. Severity indicates the general risk factor involved with the exploitation of the vulnerability, rated from medium to critical. Critical issues are outlined in bold. Top 100 shifts indicate positional changes compared to last edition's Top 100 ranking, with "new" highlighting the attack's debut in the Top 100. Figure 1a shows a daily record of attack cases reported for this period's Top 5 attacks. Figure 1b below shows the Top 5 regions attacked in comparison to total attack cases reported this period. Rank Vulnerability Percentage Severity Top 100 Shift 1 Gumblar.Botnet 42.8 Critical - 2 MS.IE.Userdata.Behavior.Code.Execution 22.2 Critical - 3 MS.DCERPC.NETAPI32.Buffer.Overflow 21.5 Critical - 4 Sasfis.Botnet 7.2 High +1 5 FTP.USER.Command.Overflow 5.9 High +1 6 AWStats.Rawlog.Plugin.Logfile.Parameter.Input.Validation 5.5 High +1 7 Apache.Expect.Header.XSS 5.3 Medium +1 8 SMTP.Auth.Buffer.Overflow 3.3 Critical +1 9 MS.Content.Management.Server.Code.Execution 3.1 Critical +1 10 Crystal.Reports.Path.Traversal 3.0 Critical new Figure 1a: Daily attack case activity for top 5 attacks Figure 1b: Top 5 regions by number of attack cases New Vulnerability Coverage There were a total of 108 vulnerabilities added to FortiGuard IPS coverage this period. Of these added vulnerabilities, 30 were reported to be actively exploited (27.8%). Figure 1c breaks down added vulnerabilities by severity, coverage and active exploitation in the wild. For more information, observe the detailed reports for this period at: Intrusion Prevention - Service Update History Figure 1c: New vulnerability coverage for this edition, categorized by severity Malware Today Top 10 Variants Top 10 malware activity by individual variant. Percentage indicates the portion of activity the malware variant accounted for out of all malware threats reported in this edition. Top 100 shifts indicate positional changes compared to last edition's Top 100 ranking, with "new" highlighting the malware's debut in the Top 100. Figure 2 below shows the detected volume for the malware variants listed within the Top 5: w Rank Malware Variant Percentage Top 100 Shift 1 W32/FraudPack.fam!tr 28.7 ]]> http://www.fortiguard.com/reports/roundup_april_2010.html http://www.fortiguard.com/reports/roundup_april_2010.html Wed, 28 Apr 2010 00:00:00 -0800 Adobe Vulnerability Identifier Adobe Bulletin Description Severity Affected Software CVE ID APSB10-09 Vulnerabilities that could cause the application to crash and could allow an attacker to control the compromised system. Critical Adobe Reader, Adobe Acrobat CVE-2010-0190 CVE-2010-0191 CVE-2010-0192 CVE-2010-0193 CVE-2010-0194 CVE-2010-0195 CVE-2010-0196 CVE-2010-0197 CVE-2010-0198 CVE-2010-0199 CVE-2010-0201 CVE-2010-0202 CVE-2010-0203 CVE-2010-0204 CVE-2010-1241 Threat Remediation Fortinet provides coverage on Adobe vulnerabilities in April 13, 2010. CVE Number Signature Name CVE-2010-0192 Adobe.Reader.Embeded.Font.Memory.Corruption [Previous Name: Adobe.0day.20812] CVE-2010-0194 Adobe.Reader.LineSetContinuation.Memory.Corruption [Previous Name: FG-VD-10-003-Adobe] CVE-2010-0195 Adobe.Reader.Font.Parsing.Code.Execution [Previous Name: Adobe.0day.20803] CVE-2010-0196 Adobe.Reader.U3D.CLODMeshDeclaration.Memory.Corruption [Previous Name: Adobe.0day.20805] CVE-2010-0197 Adobe.Reader.RichMedia.Memory.Corruption [Previous Name: Adobe.0day.20807] CVE-2010-1241 Adobe.Reader.Acrobat.Pro.CFF.Encodings.Handling.Heap.Overflow [Previous Name: FG-VD-10-005-Adobe] For more information on new and enhanced signatures, visit the IPS Service Update History. If you require more information, contact the FortiGuard Team using our Contact Us web page. Document History Revision Date Version Number Tuesday, April 13 2010 1 Initial Documentation. Reference: Adobe Security Bulletin Summary for April 13, 2010: http://www.adobe.com/support/security/bulletins/apsb10-09.html ]]> http://www.fortiguard.com/advisory/FGA-2010-19.html http://www.fortiguard.com/advisory/FGA-2010-19.html Tue, 13 Apr 2010 00:00:00 -0800 Summary: Fortinet's FortiGuard Labs has discovered two memory corruption vulnerabilities in Adobe Reader / Acrobat, which allow a remote attacker to compromise a system through a malicious document. Impact: Remote Code Execution. Risk: High. Affected Software: For a list of affected software, please refer to the Adobe Security Bulletin reference below. Additional Information: Two memory corruption vulnerabilities were discovered in Adobe Reader / Acrobat, each of which is highlighted below: Memory corruption in "3difr.x3d". The vulnerable X3D component is a plugin used to display 3D material, which when present in a PDF document, can lead to exploitation (CVE-2010-0194). Memory corruption through heap overflow in "CoolType.dll" (CVE-2010-1241). The vulnerabilities are triggered when opening and rendering a PDF document. A remote attacker could craft a malicious document which exploits either one of these vulnerabilities, allowing them to compromise a system. Solutions: Users should apply the solution provided by Adobe. FortiGuard Labs released the following signatures to protect against these vulnerabilities "Adobe.Reader.DeviceRGB.Subtype.Stream.Memory.Corruption", previously released as "FG-VD-10-003-Adobe" (CVE-2010-0194). "Adobe.Reader.Acrobat.Pro.CFF.Encodings.Handling.Heap.Overflow", previously released as "FG-VD-10-005-Adobe" (CVE-2010-1241). References: Adobe Security Bulletin: http://www.adobe.com/support/security/bulletins/apsb10-09.html CVE ID: CVE-2010-0194 CVE ID: CVE-2010-1241 Acknowledgment: Bing Liu of Fortinet's FortiGuard Labs (CVE-2010-0194) Haifei Li of Fortinet's FortiGuard Labs (CVE-2010-1241) ]]> http://www.fortiguard.com/advisory/FGA-2010-18.html http://www.fortiguard.com/advisory/FGA-2010-18.html Tue, 13 Apr 2010 00:00:00 -0800 Summary: Fortinet's FortiGuard Labs has discovered two memory corruption vulnerabilities in Microsoft Office Visio, which allow a remote attacker to compromise a system through a malicious document. Impact: Remote Code Execution. Risk: High. Affected Software: For a list of affected software, please refer to the Microsoft Security Bulletin reference below. Additional Information: Two memory corruption vulnerabilities were discovered in Microsoft Office Visio, each of which is highlighted below: Memory corruption in "vislib.dll" (CVE-2010-0254) Memory corruption in "vislib.dll" (CVE-2010-0256) The vulnerabilities are triggered when opening and rendering a Visio file. A remote attacker could craft a malicious document which exploits either one of these vulnerabilities, allowing them to compromise a system. Solutions: Users should apply the solution provided by Microsoft. FortiGuard Labs released the following signatures to protect against these vulnerabilities "MS.Visio.Attribute.Memory.Corruption", previously released as "FG-VD-09-006-Microsoft" (CVE-2010-0254). "MS.Visio.objectID.Memory.Corruption", previously released as "FG-VD-09-005-Microsoft" (CVE-2010-0256). References: Microsoft Security Bulletin: http://www.microsoft.com/technet/security/bulletin/ms10-028.mspx CVE ID: CVE-2010-0254 CVE ID: CVE-2010-0256 Acknowledgment: Bing Liu of Fortinet's FortiGuard Labs. ]]> http://www.fortiguard.com/advisory/FGA-2010-17.html http://www.fortiguard.com/advisory/FGA-2010-17.html Tue, 13 Apr 2010 00:00:00 -0800