Microsoft Security Advisory (2847140)

Vulnerability in Internet Explorer Could Allow Remote Code Execution

Published: Friday, May 03, 2013 | Updated: Wednesday, May 08, 2013

Version: 1.1

General Information

Executive Summary

Microsoft is investigating public reports of a vulnerability in Internet Explorer 8. Microsoft is aware of attacks that attempt to exploit this vulnerability. Applying the Microsoft Fix it solution, "CVE-2013-1347 MSHTML Shim Workaround," prevents the exploitation of this issue. See the Suggested Actions section of this advisory for more information.
The vulnerability does not affect Internet Explorer 6, Internet Explorer 7, Internet Explorer 9, and Internet Explorer 10.
The vulnerability is a remote code execution vulnerability. The vulnerability exists in the way that Internet Explorer accesses an object in memory that has been deleted or has not been properly allocated. The vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer. An attacker could host a specially crafted website that is designed to exploit this vulnerability through Internet Explorer and then convince a user to view the website.
On completion of this investigation, Microsoft will take the appropriate action to protect our customers, which may include providing a solution through our monthly security update release process, or an out-of-cycle security update, depending on customer needs.
We are actively working with partners in our Microsoft Active Protections Program (MAPP) to provide information that they can use to provide broader protections to customers. In addition, we are actively working with partners to monitor the threat landscape and take action against malicious sites that attempt to exploit this vulnerability.
Microsoft continues to encourage customers to follow the guidance in the Microsoft Safety & Security Center of enabling a firewall, applying all software updates, and installing antimalware software.
Mitigating Factors:

• By default, Internet Explorer on Windows Server 2003, Windows Server 2008, and Windows Server 2008 R2 runs in a restricted mode that is known as Enhanced Security Configuration. This mode mitigates this vulnerability.
• By default, all supported versions of Microsoft Outlook, Microsoft Outlook Express, and Windows Mail open HTML email messages in the Restricted sites zone. The Restricted sites zone, which disables script and ActiveX controls, helps reduce the risk of an attacker being able to use this vulnerability to execute malicious code. If a user clicks a link in an email message, the user could still be vulnerable to exploitation of this vulnerability through the web-based attack scenario.
• An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
• In a web-based attack scenario, an attacker could host a website that contains a webpage that is used to exploit this vulnerability. In addition, compromised websites and websites that accept or host user-provided content or advertisements could contain specially crafted content that could exploit this vulnerability. In all cases, however, an attacker would have no way to force users to visit these websites. Instead, an attacker would have to convince users to visit the website, typically by getting them to click a link in an email message or Instant Messenger message that takes users to the attacker's website.

Recommendation. Please see the Suggested Actions section of this advisory for more information.




- wong chee tat :)

Virgin to launch health club in Singapore

Virgin to launch health club in Singapore

    By Yvonne Chan
    POSTED: 13 May 2013 2:43 PM

The Virgin brand, linked to British billionaire Richard Branson, has made its way to Asia in the form of fitness.

SINGAPORE: The Virgin brand, linked to British billionaire Richard Branson, has made its way to Asia in the form of fitness.

Singapore is the first stop in Asia for the new fitness chain Virgin Active. Mr Branson arrived in Singapore on Monday to announce the fitness chain's first outlet will open in One Raffles Place in about two months' time, with six more clubs in the pipeline in the next few years.

Virgin Active will also be launched in other Asian markets, such as Thailand and South Korea.

To stay ahead, Mr Branson, founder of the Virgin Group, said it is imperative to keep re-inventing the Virgin brand.

This is a motto he applies across the Virgin Group, including the aviation arm, which includes Virgin Atlantic, Virgin America and Virgin Australia.

Having recently sold 10 per cent of Virgin Australia to Singapore Airlines, Mr Branson now has a 13 per cent stake in the company.

Mr Branson said: "The Virgin Brand will be there in Australia for many years to come. We just want to have a great group of partners. At the moment we have no plans to sell our stake but if there was a partner that was interested, and that would enhance our brand, we would certainly consider it. "

- CNA/xq


- wong chee tat :)

Advance Notification Service for the May 2013 Security Bulletin Release

Advance Notification Service for the May 2013 Security Bulletin Release

 

(Click on the link for details)

- wong chee tat :)

Phase 2B of P1 registration non-partisan: Indranee Rajah

Phase 2B of P1 registration non-partisan: Indranee Rajah

    By Saifulbahri Ismail
    POSTED: 13 May 2013 4:19 PM
  
Senior Minister of State for Education Indranee Rajah said the priority system for children going through Primary One registration is non-partisan.

SINGAPORE: Senior Minister of State for Education Indranee Rajah said the priority system for children going through Primary One registration is non-partisan, but based on an "objective view" of community service.

Speaking in Parliament on Monday, Ms Indranee explained Phase 2B of the P1 Registration Framework is open to children whose parents are endorsed as "active community leaders".
bond
She was responding to questions from Non-Constituency MP Lina Chiam, who asked for the scrapping of the priority scheme for community leaders which she claims to be linked with the government.

Ms Indranee said only community leaders who are serving in the four grassroots committees -- the Residents' Committee, Neighbourhood Committee, Citizen's Consultative Committee, Community Club Management Committee and the Community Development Council -- get priority.

She said: "We recognise that there are many different social groups, which serve the community, but when we look at priority, we look at priority for active community leaders. And in defining active community leaders, we define eligibility based on an objective view of community service.

"Grassroots leaders (GRLs) support the People's Association in its mission of community building, in support of the government of the day. That is why at the current time, only active GRLs from the four grassroots organisations and district counsellors from the Community Development Councils are eligible for consideration under Phase 2B and eligibility is based on contribution and not along party lines."

In addition, Phase 2B is also open to the children of parent volunteers and endorsed members of churches or clans that are directly connected with the school.

Ms Indranee added the commitment and support from these various stakeholders help to build stronger bonds between the school and the community.

She further clarified that not all who are involved in grassroots associations get priority.

Those who do not get priority include the People's Association's Youth Executive Committees and Women's Executive Committees.

- CNA/xq/ac


- wong chee tat :)

China pupil has father, sister "killed over study"

China pupil has father, sister "killed over study"

    POSTED: 13 May 2013 7:13 PM
  
A school pupil was arrested in China for hiring hitmen who killed his father and sister because of the pressure they put on him to study.

BEIJING: A school pupil was arrested in China for hiring hitmen who killed his father and sister because of the pressure they put on him to study, reports said Monday, highlighting educational stress in the country.

The teenager was detained in the central province of Henan following the death of his father Gao Tianfeng -- a senior court official -- and his 20-year-old sister, the official Xinhua news agency said, citing local police.

"According to the police interrogation of the boy, the junior hired two men that he got to know via the Internet to kill his father and elder sister, because 'they had given him too much pressure in study'," Xinhua said.

Surveillance cameras showed two men had climbed over a wall and entered the house in Zhoukou at the time of the murder early on Sunday, the report said, adding two of the three suspects allegedly involved, including Gao's son, had been held.

Police could not be reached for comment by AFP Monday.

China has long been known for its highly disciplined approach to education, and parenting methods have drawn criticism for putting too much pressure on children to pass highly-competitive exams.

- AFP/fl


- wong chee tat :)

China "shadow banking" growing fast

China "shadow banking" growing fast

    POSTED: 13 May 2013 7:36 PM
  
China's shadow banking activities have risen nearly 70 per cent over the past two years and now total more than half the size of the world's second-largest economy.

BEIJING: China's shadow banking activities have risen nearly 70 per cent over the past two years and now total more than half the size of the world's second-largest economy, ratings agency Moody's said on Monday.

Shadow banking includes private lending, off-balance-sheet vehicles and trusts, and allows borrowers to circumvent banks' formal underwriting standards, as well as official regulation.

Such lending has surged 67 per cent since the end of 2010, Moody's said in a report, reaching an estimated total of 29 trillion yuan (US$4.7 trillion) at the end of last year, or 55 per cent of China's GDP.

The rapid growth was partly due to some borrowers having difficulties obtaining regular bank loans, according to the report, and threatened the health of the banking system and the overall economy.

"Shadow banking may encourage excessive financial leverage in the broad economy and add to credit bubble concerns," Moody's said.

"Given the substantial scale and growth of shadow banking activities in China, we are doubtful of the banks' ability to isolate themselves from a significant increase in defaults in the shadow banking domain."

China's banking regulator has sought to rein in non-transparent lending activities and in March ordered banks to step up checks on wealth management products as part of a bid to boost risk control and openness.

But Moody's said: "The impact from shadow banking on banks will depend on the amount and timing of losses and how they are allocated, variables that are difficult to assess at this point, given the lack of transparency and fast-evolving nature of shadow banking in China."

- AFP/fl

- wong chee tat :)

New childcare centres in Sengkang, Punggol within next 2 years

New childcare centres in Sengkang, Punggol within next 2 years

    POSTED: 13 May 2013 8:25 PM

SINGAPORE: Sengkang and Punggol will each have 14 new childcare centres within the next two years.

And by 2018, Sengkang will have an additional nine centres, while Punggol will have another 12 centres.

Acting Social and Family Development Minister Chan Chun Sing said the Early Childhood Development Agency (ECDA) is working with the Housing and Development Board to pre-build childcare facilities alongside upcoming Build-To-Order (BTO) projects.

Responding to MP for Punggol East Lee Li Lian, Mr Chan said there will be a childcare centre within Rivervale Arc by early 2015, as part of this effort.

The ECDA is also open to alternative locations, such as workplaces, disused facilities and integrated developments.

Tin Pei Ling, MP for Marine Parade GRC, asked: "How is demand determined? I'm asking because even for mature estates, there are BTO projects coming up and anticipated would-be young families moving in as well. So there would be an increase in demand for childcare, student care and even infant care."

Mr Chan replied: "How we determine demand is based on the cohort size in the respective estates. We also take in feedback from the respective grassroots leaders if they see demand for such things. We also look at the queue at the existing childcare places in the vicinity so we have a sense of where is the demand.

"For example, we also understand that in Sengkang and Punggol generally, the young families there have less grandparent support, so they will need a bit more childcare places, and we have catered for it accordingly."

- CNA/ms

- wong chee tat :)

Shane Todd's laptop showed access to suicide, depression-related websites

Shane Todd's laptop showed access to suicide, depression-related websites

    By Kimberly Spykerman
    POSTED: 13 May 2013 9:58 PM
   
SINGAPORE: Internet history on American researcher Shane Todd's laptop showed that he had run searches on suicide and depression-related websites in the days before he died. This was revealed on the first day of a coroner's inquiry into his death.

Dr Todd's body was found hanging from a black strap in front of a closed toilet door in his bedroom. According to the police, the strap had a plastic buckle attached to it which acted as a stopper -- securing it against the top end of the toilet door.

Internet history on his laptop revealed that he had accessed suicide-related websites 19 times between March and June 2012. The last one was accessed only the day before his body was found hanged in his apartment.

According to patterns of Internet activity, Dr Todd had searched different methods of committing suicide. Depression-related webpages were also accessed -- mostly in May 2012.

Senior State Counsel Tai Wei Shyong gave these details in an opening statement to the court.

Dr Todd's parents, who have flown here for the inquiry, believe their son was murdered over research he had done while working for the Singapore Institute of Microelectronics.

However, there were notes, believed to be written by Dr Todd, found on his laptop. The notes were found after the investigation officer accessed his laptop using a password written on a post-it pad.

They were for his family, girlfriend, and friends. He said he loved them and asked their forgiveness for the pain he caused them.

Dr Todd's girlfriend and friends took the stand on Monday to describe his state of mind in the months before he died. Calling him a perfectionist, they said he was unhappy and stressed about his work. They also said he had lost weight and a twitching in his hands had become more pronounced in the months leading up to his death.

Dr Todd's girlfriend Shirley Sarmiento said he told her he had suffered from depression since October 2011. He also told her he was unhappy after transferring to another department, and working on a project that he felt could get him into trouble with the American government.

The court heard earlier that Dr Todd had seen a psychiatrist while in Singapore and been prescribed anti-depressant pills.

Officers and paramedics who were first at the scene said there were no signs of forced entry or foul play when they entered Dr Todd's apartment.

However, the counsel for the Todd family questioned if it was right for them to cut the rope holding up Dr Todd's body before the forensics team arrived, saying that that could have changed material evidence at the scene.

The court however heard that it was standard procedure to bring down a body found hanging as the priority was to "save lives". The first-responders also said they remembered seeing Dr Todd's feet on the floor when they entered the room, but could not be sure if his legs were bearing his weight.

The Todd family also said they appreciated the help they had received for the inquiry.

Rick Todd, the father of Dr Todd, said: "We really appreciate the process going on here. It's a slow process so we really appreciate the way Singapore conducts its court system."

Earlier, he and his wife thanked the Singapore government for allowing them to be part of the inquest.

The inquiry continues.

- CNA/ac


- wong chee tat :)