Microsoft Releases Security patch for old Windows versions

Microsoft has rereleased an update that patches a remote code execution security issue in the Graphics Rendering Engine in old versions of Windows. Most users do not have to worry about installing the update.

Microsoft has rereleased a security update that was originally released back in 2005. It was revised to address minor issues "unrelated to the stability of the update or the security of the intended target systems." Most users have already applied this update and don't need to apply it again. The vulnerability is only found in older versions of Windows, 32-bit and 64-bit versions of Windows Server 2003, Windows Small Business Server 2003, Windows XP Tablet PC Edition, Windows 2000 SP4, and Small Business Server 2000.

However, the rereleased update (4.8MB) is only for various editions of Windows Server 2003 64-bit. Server 2003 customers who never installed the previous update will now be offered the revised one. The update should be offered automatically to these users.

When originally disclosed, the vulnerability was given a Critical rating by Microsoft because it included a remote code execution security issue in the Graphics Rendering Engine that could allow an attacker to remotely compromise the Windows-based system and gain control over it. Microsoft Security Bulletin MS05-053 has more information about the security issue that was fixed.

Source: http://arstechnica.com/microsoft/news/2009/02/security-patch-rereleased-for-old-windows-versions.ars

Windows Server 2003 Security

Windows Server 2003 has some of the following features to help protect your corporate enviroment:

There is now forest trust that allows you to authenticate other companies in your WAN thru Active Directory, this simplifies some security issues for security and network administrators.

Kerberos is now availiable through Windows Server 2003 to allow for better and more secure authentication.

Credential Manager allows secure storage for usernames and passwords as well as certificates. You can now delegate what services can access other resources on your network.

.NET password is now integrated with Active Directory aloowing SSO or single sign on.

RBAC or Remote Based Access Control you can assign more efficient restrictions to manage access to information.

Systems administrators can disallow software to run, with the Software Restrcition Policy. In Windows 2003 you can audit system alerts and even set up audits of individual users!

Account Management logs IP addresses and even calls for Logon and Logoff events.

You can now log security events in real time and export them to a SQL database to anaylze later.

PKI or Public Key Infrastructure is is system of digital certificates and CA or Certificate Authorities to verify you are who you really say you are. This is great for ecommerce systems, think E-Bay. You want to know if your really giving your credit card information to E-Bay or E-fake.

Windows Server 2003 now helps with Wireless 802.1x., you can enable PEAP which is protected EAP for authentication. I suggest using WPA in conjuction. he encrytpion protocl they use is called EFS.EFS uses AES-256 which is very strong encryption. There should be security in depth applied.Two form authentication should be applied such as biometrics and passwords.Take a look at RSA secure ID cards.

Source: http://www.anyarticles.com/Computers-and-Technology/Software/Windows-Server-2003-Security.html

Key Small Business Server 2008 Log Files

In SBS 2008 we have centralized the location of log files, all log files will now be placed in C:\Program Files\Windows Small Business Server\Logs. From a server support perspective this is a big plus in simplifying troubleshooting as you will always know where the log file will be located. We have compiled a list of important logs and their associated wizards below.

C:\Program Files\Windows Small Business Server\Logs
Console.log	SBS Console Log
CTIW.log	Logs events of the "Connect to the Internet" wizard
DCPromo_yymmdd.xxxxxx.log	DCPromo that ran during SBS install
DPCW.log	Logs events of the "Set up your Internet address" wizard
ERRORLOG.TXT	Logs any errors that occurred during SBS setup
ExtSchemaTask.log	Logs result of SBS AD schema additions
FinishSetup.log	Logs the completion of the SBS 2008 install
GPOTask.log	Logs the creation of the SBS Group Policy objects
olsignupwiz.log	Logs events of the "Set up your Microsoft Office Live Small Business Web site" wizard
pop3connectorinstall.log	Install log for the POP3 Connector
SBSHook.log	Logs hooking of SBS install shell to Windows install and runonce modification
SBSSetup.log	Logs all events that occurred during SBS setup
adduser.log	Logs events of the "Add a new user account" wizard
addgroup.log	Logs events of the "Add a new group" wizard
CreateUserRole.log	Logs events of the "Add a new user role" wizard
CopyConnectComputer.log	Logs events of the "Connect computers to your network" wizard
SBCW.log	Logs events of the "Configure server backup" wizard
fncw.log	Logs events of the "Fix My Network" wizard
AddMultipleUsers.log	Logs events of the "Add multiple user accounts" wizard
FaxRoleInstallation.log	Install log for Fax
FaxCW.log	Logs events of the "Configure the fax service" wizard
MoveData.log	Logs events of the "Move Exchange Server Data", "Move Windows SharePointServices Data", "Move User's Shared Data", "Move User's Redirected Documents Data", and "Move Windows Update Repository Data" wizards
CIMW.log	Logs events of the "Configure a Smart Host for Internet e-mail" wizard
TrustedCert.log	Logs events of the "Add a trusted certificate" wizard
VPNCW.log	Logs events of the "Configure a virtual private network" wizard
C:\Program Files\Windows Small Business Server\Logs\MonitoringServiceLogs
Contains logs for SBS Monitoring and it's associated data collection tasks
C:\Program Files\Windows Small Business Server\Logs\pop3connector
Pop3service.log	POP3 Connector log
C:\Program Files\Windows Small Business Server\Logs\WebWorkplace
W3WP.log	IIS worker process log for RWW

Please note that you will also find many event log (*.evt) files in the SBS log directory. These files are a snapshot of the event logs at the completion of the SBS install. These are kept for historical purposes and for trouble-shooting installs.

Source: http://blogs.technet.com/sbs/archive/2008/10/01/key-small-business-server-2008-log-files.aspx

How to Apply Security on a Windows Server 2003-based cCuster Server

1. You must test the deployment of a security template in a lab environment before you deploy it in a production environment if the following conditions are true:
* The Default Domain Policy setting has been changed.
* The cluster server nodes already exist in the domain.
* The cluster server nodes have received domain policies from a Group Policy object (GPO).
Typically, GPOs are implemented by making changes to registry keys on the computers where these GPOs are applied. Many of the changes to the registry that are made by a GPO are not removed or returned to their default settings if the GPO is no longer applied. Therefore, even when a GPO is no longer applied, this does not guarantee that the effects of the GPO are successfully reversed.

2. Before you configure the Domain policies on your computer to use the No Override option, you must determine how the reconfigured Domain policies will affect the cluster server nodes. Typically, reconfigured Domain policies affect the cluster server nodes in several ways. For example, if you configure the Domain policies on your computer to use the No Override option, the No Override option may generate the following behavior:
* User rights that the cluster service account needs are removed.
* The cluster service account is removed from the local administrators group because of a Restricted Groups policy.
* Strict LAN Manager authentication levels are implemented.
* More restrictive remote procedure call (RPC) authentication policies are imposed.

3. If the No Override option is not configured for use by the Domain policies, you must configure a separate organizational unit (OU) for the cluster server nodes with inheritance blocked. If inheritance is blocked, policies from the domain are not applied to the OU. If the No Override option is selected on a domain level policy, the setting on the OU has no effect.

4. Before you join the cluster server nodes to the domain, you must pre-stage the computer accounts in an OU where inheritance is blocked. This prevents the cluster server nodes from picking up policies that are applied to the default Computers container in the Active Directory directory service.

Note You must not modify the default cluster OU policy now.

5. After you have joined the cluster server nodes to the domain, you must configure and verify the basic cluster server functionality. Then, you must apply more restrictive security settings by using the security template. Alternatively, configure an OU GPO, and then import the template after you make modifications and export the template.

Note We recommend that you do not modify the default GPO for a container. Create a new policy instead. Modify the new policy that you have created, or import a security template into this new policy.

6. Before you install an additional cluster resource or individual program, you must confirm that the cluster functionality works correctly with the security settings that you have applied. Additionally, you must review the security guidelines and the hardening procedures of each cluster server resource and of each program that you want to install.

For example, to view the Microsoft Exchange Server 2003 Security Hardening Guide, visit the following Microsoft TechNet Web page:

7. Apply the hotfix that is described in the following Knowledge Base article to each cluster server node before you apply the security settings that are included in the template:
890761 (http://support.microsoft.com/kb/890761/ ) You receive an "Error 0x8007042b" error message when you add or join a node to a cluster if you use NTLM version 2 in Windows Server 2003
Notes
* Hotfix 890761 is included in Windows Server 2003 Service Pack 1.
* If Hotfix 890761 is not applied to the cluster server nodes, you must modify both the LAN Manager authentication process and RPC security in the security template.

8. After you apply the hotfix that is described in step 7, load the template into the Security Configuration and Analysis snap-in. Then, verify the configuration and the functionality of each cluster server node.

9. After you complete step 8, you may have to change the Cluster Service and Distributed Transaction Coordinator Service settings in the template. Both of these settings are set to Disabled in the template. Reset them to Enabled. The Distributed Transaction Coordinator Service setting is specifically mentioned here because this service frequently must be clustered.

10. Restart the cluster servers. The cluster server services now function correctly.

Source: http://support.microsoft.com/kb/891597

Microsoft Updates Critical SMB Server Flaws

Microsoft issued a single SMB server security update Tuesday, patching critical flaws in the Server Message Block (SMB) that could be exploited by an attacker to access sensitive data or create a new account with full user rights.

The update addressed two critical remote code execution vulnerabilities and a denial-of-service flaw in the way the server handles SMB packets. An attacker could pass a message with malicious code to a computer running the server service. Microsoft said an attacker would not require authentication to exploit the flaw.

Paul Henry, security and forensic analyst at patch management vendor Lumension Security Inc., called the update some "fine tuning" of an earlier update issued by Microsoft. Microsoft bulletin MS08-068 addressed Windows authentication protocols affecting the SMB server. The SMB mishandled the challenge/response procedure, allowing an attacker who exploits it properly to gain access to files and assign full user rights.

"It's rated critical but [Microsoft is] saying that there's a very low likelihood of exploit code being generated for it," Henry said. "The critical rating follows the legacy products but it drops to a medium with Vista and Windows Server 2008. The code base for [Windows Server] 2008 and Vista is showing its strength."

Henry said the update should be relatively easy to deploy, but it will require a restart. The last SMB update caused some problems for administrators who attempted to deploy a workaround. Some had printers and other devices fail, Henry said.

Eric Schultze, chief technology officer at patch management vendor Shavlik Technologies LLC, said the update should be a high priority. In a statement, Schultze said the vulnerabilities are similar to what prompted the Blaster and Sasser worms a few years ago.

"We expect to see a worm released for this in the very near future," he said. "The only pre-requisite for this attack to be successful is a connection from the attacker to the victim over the NetBIOS (File and Printer Sharing) ports (TCP 139 or 445). By default, most computers have these ports turned on."

As a workaround, users can block TCP ports 139 and 445 at the firewall, although blocking those ports can halt important applications or services, Microsoft said.

"Remote attackers, even without a username and password, can take advantage of this issue and execute any commands they wish on the vulnerable server," Alfred Huger, vice president of Symantec Security Response wrote in an email message.

In Microsoft's MS09-001 bulletin, it said the flaws could be exploited remotely and rated it as critical for Microsoft Windows 2000, Windows XP, and Windows Server 2003, and moderate for all supported editions of Windows Vista and Windows Server 2008.

Source: http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1344842,00.html

Enhance Terminal Services Gateway Security with ISA Server 2006

Following on the success of Outlook Anywhere in Exchange Server 2007, Windows Server 2008 in turn delivers the capability to access your desktop from anywhere in a secure and controlled manner.

The new Terminal Server Gateway service (TS Gateway) in Windows Server 2008 offers the flexibility of Windows® Terminal Server Services plus the ability to connect to a Terminal Server from anywhere over an HTTP connection. This service uses Remote Desktop Protocol (RDP) over HTTPS (SSL) to increase security while providing a single client interface for accessing Terminal Services resources.



This new TS Gateway service offers significant benefits to those who need to access their computers remotely:

* No need to establish a Virtual Private Network (VPN) session prior to connecting to internal resources using RDP.
* Enhanced security using Network Access Protection (NAP) and Windows Security Health Checks to control RDP connections.
* No need to open TCP port 3389 inbound to enable more secure Web publishing through firewalls.

You can use Microsoft Internet Security and Acceleration Server 2006 to enhance the security of TS Gateway service while allowing external access to internal resources. You can set up an SSL-to-SSL bridging scenario in which ISA Server 2006 receives requests and passes them to the internal TS Gateway service, also using HTTPS. While bridging the request, the ISA firewall decrypts the SSL communications and performs application-layer inspection.

If the HTTP protocol stream passes inspection, then the communication is re-encrypted and forwarded to the Terminal Services proxy. If the protocol stream fails inspection, the connection is dropped.

For Detail Information visit: http://technet.microsoft.com/en-us/magazine/2008.09.tsg.aspx

Source: http://blogs.windowsecurity.com/shinder/2009/01/14/enhance-ts-gateway-security-with-isa-server-2006/

Windows Vista Service Pack 2 beta ISO

Windows Vista Service Pack 2 (SP2) Beta is an update to Windows Vista and Windows Server 2008. It provides customer and partner feedback driven fixes into a single service pack, minimizing deployment and testing complexity. In addition to all previously released updates, SP2 will contain changes focused on addressing reliability and performance issues, supporting new types of hardware, and adding server support for several emerging standards.

Windows Vista SP2 Beta applies to individuals, organizations, and technical enthusiasts who are comfortable evaluating pre-release software. This pre-release software is provided for testing only. We do not recommend installing this software on primary or mission-critical systems. Installation of Service Pack 2 Beta will result in Microsoft collecting information about the installation process, even if the installation is not completed. Wet recommend that you have a backup of your data before you install any pre-release software.

SP2 is an update to Windows Vista and Windows Server 2008 that addresses feedback from our customers and partners. By providing these fixes integrated into a single service pack, Microsoft provides a single high-quality update that minimizes deployment and testing complexity for customers.

In addition to all previously released updates, SP2 will contain changes focused on addressing reliability and performance issues, supporting new kinds of hardware, and adding support for several emerging standards. SP2 will also continue to make it easier for IT administrators to deploy and manage large installations of Windows Vista and Windows Server 2008. Service Pack 1 is a prerequisite for installing Service Pack 2. Please make sure that your system is running Service Pack 1 before you install Service Pack 2.

Via:vnunet.com/vnunet/downloads/2232050/windows-vista-sp2