Mailing Lists & Feeds
Current Activity Calendar
| October 03, 2006 - Current ActivityThis is an archived copy of current activity, if you would like to see the most recent version, please click here.Mozilla Firefox JavaScript Vulnerabilityadded October 1, 2006 | updated October 1, 2006We are aware of reports of a new vulnerability in the Mozilla Firefox JavaScript engine. Details are limited at this point. We will continue to monitor this issue and provide additional information as it becomes available. Updates for Multiple Apple OS X Vulnerabilitiesadded September 29, 2006Apple has released Security Update 2006-006 to address multiple vulnerabilities in Apple products. The impacts of these vulnerabilities include execution of arbitrary code, bypassing security restrictions, and denial of service. More information about specific vulnerabilities can be found in Apple Security Update 2006-006. Apple has also released Mac OS X 10.4.8 Update (Intel). This update includes security fixes for Intel-based Apple systems. We recommend the following actions to help mitigate the security risks:
We will continue to monitor this issue and provide additional information as it becomes available. Microsoft Releases Workaround for WebViewFolderIcon ActiveX Control Vulnerabilityadded September 27, 2006 | updated September 29, 2006Microsoft has released Security Advisory 926043 to address the new, unpatched vulnerability in Microsoft Internet Explorer. Public exploit code is available. The exploit code targets a vulnerability in the Microsoft WebViewFolderIcon ActiveX control. More information about this vulnerability can be found in the following:
Until an update, patch, or more information becomes available, we strongly recommend the following:
We will continue to monitor this issue and provide additional information as it becomes available. Update for Multiple OpenSSL Vulnerabilitiesadded September 29, 2006A recent update to the OpenSSL software distribution includes fixes for several vulnerabilities. The impacts of these vulnerabilities for applications using OpenSSL range from denial of service to potential remote code execution. More information about the vulnerabilities can be found in these Vulnerability Notes and in the OpenSSL Security Advisory. We recommend that users apply the vendor-supplied patches or upgrades referred to in the individual Vulnerability Notes for these issues. We will continue to monitor this issue and provide additional information as it becomes available. Active Exploitation of a Vulnerability in Microsoft PowerPointadded September 27, 2006We are aware of active exploitation of a remote code execution vulnerability in Microsoft PowerPoint. Successful exploitation may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. More information about this vulnerability can be found in the following:
We recommend the following actions to help mitigate the security risks:
We strongly encourage users not to open unfamiliar or unexpected email attachments, even if sent by a known and trusted source. Users may wish to read Cyber Security Tip ST04-010 for more information on working with email attachments. We will continue to monitor this issue and provide additional information as it becomes available. Microsoft Releases Update for Internet Explorer VML Vulnerabilityadded September 19, 2006 | updated September 27, 2006Microsoft has released Security Bulletin MS06-055 to address a vulnerability in the way Internet Explorer handles Vector Markup Language (VML). This vulnerability is being actively exploited. By persuading a user to access a specially crafted HTML document, a remote, unauthenticated attacker may be able to execute arbitrary code with the privileges of the user or cause a denial of service condition in Internet Explorer. More information about this vulnerability can be found in the following:
We recommend the following actions to help mitigate the security risks:
We will continue to monitor this issue and provide additional information as it becomes available. Apple AirPort Wireless Drivers Vulnerabilitiesadded September 22, 2006Apple has released Security Update 2006-005 to correct multiple vulnerabilities affecting Apple AirPort wireless drivers. Exploitation of these vulnerabilities could allow a remote, unauthenticated attacker to execute arbitrary code or cause a denial-of-service condition. Note that because device drivers execute with kernel (ring 0) privileges, exploitation of device drivers can lead to full, unrestricted access to the vulnerable system. More information about the vulnerabilities can be found in these Vulnerability Notes and Apple Security Update 2006-005. We recommend applying the updates in Apple Security Update 2006-005. We will continue to monitor this issue and provide additional information as it becomes available. Adobe Releases Security Bulletin for Flash Playeradded September 13, 2006 | updated September 18, 2006Adobe has released Security Bulletin APSB06-11 to address multiple vulnerabilities in Flash Player. Additionally, Microsoft has released Microsoft Security Advisory 925143 to alert users that affected versions of Flash Player were distributed with Microsoft Windows XP Service Pack 1, Windows XP Service Pack 2, and Windows XP Professional x64 Edition. More information about the vulnerabilities can be found in these Vulnerability Notes. US-CERT recommends the following actions to help mitigate the security risks:
Note: Users who are unable to upgrade to a more recent version of Flash Player, should refer to Adobe's Flash Player TechNote. US-CERT will continue to investigate these vulnerabilities and provide additional information as it becomes available. Public Exploit Code for Microsoft DirectAnimation Path ActiveX Control Vulnerabilityadded September 14, 2006 | updated September 15, 2006US-CERT is aware of a public exploit for a vulnerability in Microsoft Internet Explorer. The exploit code targets a vulnerability in the Microsoft DirectAnimation Path ActiveX control. By persuading a user to access a specially crafted HTML document, a remote, unauthenticated attacker may be able to execute arbitrary code with the privileges of the user or cause a denial of service condition in Internet Explorer. More information about this vulnerability can be found in the following:
Until an update, patch, or more information becomes available, US-CERT strongly recommends the following:
US-CERT will continue to monitor this issue and provide additional information as it becomes available. Apple Releases Security Update for QuickTimeadded September 13, 2006Apple has released Apple QuickTime 7.1.3 to address several vulnerabilities in the way different types of image and media files are handled. More information about the vulnerabilities can be found in these Vulnerability Notes and Technical Cyber Security Alert TA06-256A. US-CERT encourages Quicktime users to upgrade to Quicktime 7.1.3. US-CERT will continue to investigate these vulnerabilities and provide additional information as it becomes available. Microsoft Re-Releases Windows Server Service Security Bulletin MS06-040added September 12, 2006Microsoft has released a new version of Security Bulletin MS06-040 and the associated security updates. The new version corrects the problem described in Microsoft Knowledge Base Article 921883. Programs that request large amounts of contiguous memory running on Windows Server 2003 SP1 and Windows XP Professional x64 Edition systems with the previous version of the MS06-040 update installed could crash. US-CERT strongly encourages affected users to apply the updates in the newly released Security Bulletin MS06-040 as soon as possible. Microsoft Releases September Security Bulletinadded September 8, 2006 | updated September 12, 2006Microsoft has released updates to address vulnerabilities in Microsoft Windows and Office as part of the Microsoft Security Bulletin Summary for September 2006. US-CERT strongly encourages users to review and apply these updates as soon as possible. Additionally, more information about these vulnerabilities can be found in these Vulnerability Notes and Technical Cyber Security Alert TA06-255A. US-CERT will provide additional information as it becomes available. Active Exploitation of a Vulnerability in Microsoft Word 2000added September 5, 2006 | updated September 12, 2006US-CERT is aware of active exploitation of a memory corruption vulnerability in Microsoft Word 2000. Successful exploitation could allow a remote, unauthenticated attacker to execute arbitrary code with the privileges of the user running Word 2000. More information about this vulnerability can be found in the following:
Additionally, US-CERT recommends the following actions to help mitigate the security risks:
US-CERT strongly encourages users not to open unfamiliar or unexpected email attachments, even if sent by a known and trusted source. Users may wish to read Cyber Security Tip ST04-010 for more information on working with email attachments. US-CERT will continue to monitor this issue and provide additional information as it becomes available. |
|||||||||||||||||||||||||||||||||||||||||||||||||||
Information For
Sign Up
Reporting
