Mailing Lists & Feeds
Current Activity Calendar
| January 29, 2007 - Current ActivityThis is an archived copy of current activity, if you would like to see the most recent version, please click here.Microsoft Releases Security Advisory to Address Vulnerability in Microsoft Word 2000added January 25, 2007 | updated January 29, 2007Microsoft has released Security Advisory 932114 to address a previously known vulnerability in Word 2000. There is a flaw in the way Word handles a malformed string that could corrupt system memory. By persuading a user to open a specially crafted Word document from an email attachment or web site, a remote attacker may be able to execute arbitrary code with privileges of the user. If the compromised user is an administrator or has administrator-level privileges, then the attacker would be able to execute arbitrary code with SYSTEM-level privileges. According to the Microsoft Security Response Center Blog, there are very limited, targeted attacks attempting to exploit this vulnerability. Note: According to Microsoft, this vulnerability cannot be exploited on Word 2003, Word Viewer 2003, Word 2007, and Word 2004 for Mac, Word v. X for Mac, Word 2002, or Works 2004, 2005, or 2006. According to Symantec, a Trojan horse called Trojan.Mdropper.W is actively exploiting this vulnerability. This Trojan takes advantage of the unpatched flaw in Word 2000 to drop additional malicious files, such as Backdoor.Trojan, that may provide a remote attacker with unauthorized access to a vulnerable system. Backdoor.Trojan is a generic detection for a group of Trojan horse programs that open a back door and allow a remote attacker to have unauthorized access to the compromised computer. More information about this vulnerability is located in the following:
Until more information becomes available, US-CERT recommends the following actions to help mitigate the security risks:
US-CERT will continue to investigate and provide additional information as it becomes available. Cisco Releases Security Advisories for Multiple Vulnerabilities in IOSadded January 24, 2007 | updated January 24, 2007Cisco has released three Security Advisories to address severely rated vulnerabilities in their Internetwork Operating System Software (IOS). Cisco Security Advisory: Crafted IP Option Vulnerability addresses a remotely exploitable denial-of-service vulnerability that may potentially allow for arbitrary code execution. This vulnerability may be exploited when an affected device processes a crafted packet that meets all of the following conditions:
Cisco Security Advisory: Crafted TCP Packet Can Cause Denial of Service addresses a denial-of-service vulnerability in the Transmission Control Protocol listener. Crafted packets may cause the device to leak a small amount of memory. Over time, such a memory leak may lead to memory exhaustion and a denial-of-service condition. Cisco Security Advisory: IPv6 Routing Header Vulnerability addresses a remotely exploitable denial-of-service vulnerability in the IPv6 Type 0 Routing header handling. This vulnerability can be triggered by a packet containing crafted IPv6 Type 0 Routing headers. More information about these vulnerabilities can be found in the Vulnerability Notes Database. US-CERT encourages users to apply the fixes and workarounds described in the Cisco Security Advisories and Vulnerability Notes, and will continue to investigate and provide additional information as it becomes available. Apple Releases Security Update for Vulnerability in QuickTimeadded January 24, 2007Apple has released Security Update 2007-001 to correct a buffer overflow vulnerability in Apple QuickTime. The flaw is in the way that QuickTime handles Real Time Streaming Protocol (RTSP) URL strings. By persuading a user to access a specially crafted QuickTime file, a remote attacker may be able to execute arbitrary code or cause a denial of service on a vulnerable system. US-CERT is also aware of publicly available proof-of-concept code that exploits this vulnerability. Additionally, the Month of Apple Bugs MOAB-01-01-2007 website states that an attacker may also submit a specially crafted HTML document (e.g., a web page or an HTML email message) or Javascript code to cause a buffer overflow and compromise a vulnerable system. More information about this vulnerability is located in the following:
US-CERT encourages users to apply the appropriate updates as specified in Apple Security Update 2007-001 as soon as possible.
Microsoft Re-Releases Security Bulletin MS07-002 for Excel 2000added January 23, 2007Microsoft has released a new version of Security Bulletin MS07-002 to address an issue with security update for Excel 2000. The new version corrects the problem described in Microsoft Knowledge Base Article 931183 and in the Microsoft Security Response Center Blog. According to Microsoft, there was a flaw in the way the previous update processed the phonetic information that is embedded in files that are created by using Excel in the Korean, Chinese, or Japanese executable mode. Users who created Excel documents in one of these modes had difficulty opening some files after installing the update. The Microsoft re-release of MS07-002 resolves this issue. More information about the vulnerabilities addressed in this Security Bulletin is located in the Vulnerability Notes Database. US-CERT strongly encourages Excel 2000 users to apply the updates in the newly released Security Bulletin MS07-002 as soon as possible. Exploit Code Available for Multiple Vulnerabilities in Sun Java Runtime Environmentadded January 10, 2007 | updated January 22, 2007US-CERT is aware of publicly available exploit code for multiple vulnerabilities in Sun Java Runtime Environment (JRE). There are several flaws in the JRE that may allow an untrusted Java Applet to elevate its privileges or execute malicious code. If successfully exploited, a remote, unauthenticated attacker may be able to execute arbitrary code with elevated privileges. More information about these vulnerabilities can be found in the Vulnerability Notes Database and Technical Cyber Security Alert TA07-022A. US-CERT encourages users to take the following actions to help mitigate the effects of these vulnerabilities:
Second Trojan Variant Storm Worm Spreads through Social Engineeringadded January 19, 2007 | updated January 20, 2007US-CERT is aware of a second variant of the Small Trojan that is known as Storm Worm. Similar to the first variant, this one is also a mass-mailer that uses social engineering and network shares to propagate. The Storm Worm variant creates a peer-to-peer network that operates on port 7871/UDP, while the previously reported variant, known as Small.DAM or Trojan.Peacomm, operates on port 4000/UDP. The Small Trojan variants arrive as an email attachment and also propagate through network file shares. These Trojan variants drop two files upon execution, one of which may contain rootkit functionality. These Trojan variants also create a back door that may be used to harvest sensitive data or launch a spam attack. Subject lines can change at any time, but the following are currently being used by these Trojans:
File names can also change at any time, but the following are currently being used:
US-CERT urges users and administrators to take the following preventative measures to mitigate the security risks:
Oracle Releases January Critical Patch Updateadded January 15, 2007 | updated January 17, 2007Oracle has released their January Critical Patch Update (CPU) to address 54 vulnerabilities across all products, some of which have a maximum severity rating of High. This CPU contains twenty-six security fixes for Oracle Database; twelve for Oracle Application Server; seven for Oracle E-Business Suite; six for Oracle Enterprise Manager; and three for Oracle PeopleSoft Enterprise PeopleTools. US-CERT strongly encourages users to review the January CPU and follow best-practice security policies to determine which updates to apply. Additionally, more information about these vulnerabilities is located in the Vulnerability Notes Database and Technical Cyber Security Alert TA07-017A. Proof-of-Concept Code for Integer Overflow Vulnerability in Apple Mac OS Xadded January 16, 2007US-CERT is aware of proof-of-concept code for an unpatched integer overflow vulnerability in Apple Mac OS X Unix File System (UFS) handling. By persuading a user to open a specially crafted Disk Image (DMG) file, a remote attacker may be able to cause a denial-of-service condition or possibly execute arbitrary code on a vulnerable system. NOTE: This is only remotely exploitable via the Safari web browser when the Opening Safe Files After Downloading option is enabled. More information about this vulnerability can be found in the following:
Until Apple releases a security fix or update, US-CERT recommends the following actions to help mitigate the security risks:
Active Exploitation of Vulnerability in CA BrightStor ARCserve Backupadded January 12, 2007US-CERT is aware of active exploitation of a vulnerability in the Computer Associates BrightStor ARCserve Backup software product. There is a flaw in the way the BrightStor ARCserve Backup handles malformed RPC requests. Additionally, US-CERT has received reports of increased port scan activity on port 6502/tcp. An attacker may be able to access a vulnerable version of the BrightStor ARCserve Backup on this port. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code with SYSTEM privileges on a vulnerable system. More information about this vulnerability and related ones can be found in the Vulnerability Notes Database. US-CERT encourages users and administrators to take the following actions to help mitigate the security risks:
|
|||||||||||||||||||||||||||||||||||||||||||||||||||
Information For
Sign Up
Reporting
DHS Threat Advisory
The threat level in the airline sector is High or Orange. Read more
Get Adobe Reader