Mailing Lists & Feeds
Current Activity Calendar
| February 09, 2007 - Current ActivityThis is an archived copy of current activity, if you would like to see the most recent version, please click here.Multiple Vulnerabilities in Trend Micro Antivirus Softwareadded February 8, 2007 | updated February 9, 2007US-CERT is aware of multiple buffer vulnerabilities in Trend Micro AntiVirus software. There are flaws in the way the Trend Micro virus scan engine processes malformed UPX compressed executables, and in the Anti-Rootkit Common Module. The impacts include remote code execution with potential kernel level privileges, denial of service, and local privilege escalation. Both Microsoft and Linux versions of Trend Micro AntiVirus are impacted by this vulnerability. Note: The Trend Micro virus scanning engine may be licensed to other vendors; therefore, other scanning software products may also be affected by these vulnerabilities. More information about this vulnerability is located in the following:
Until a full upgrade becomes available, US-CERT recommends applying the updates for the virus pattern, scanning engine, and Anti-Rootkit Common Module to the latest version to address this vulnerability. US-CERT will continue to investigate and provide additional information as needed. Microsoft Releases Advance Notification for February Security Bulletinadded February 8, 2007Microsoft has issued a Security Bulletin Advance Notification indicating that their February release cycle will contain thirteen bulletins, some of which have a maximum severity rating of Critical. The notification further states that five of the bulletins are for Windows; two for Office; one for Windows and Visual Studio; one for Windows and Office; one for Step-by-Step Interactive Training; one for Data Access Components; and one for Live OneCare, Antigen, Windows Defender, and Forefront. The release is scheduled for Tuesday, February 13, 2007. US-CERT will provide additional information as it becomes available. Anomalous DNS Activityadded February 6, 2007US-CERT was made aware of anomalous Domain Name Server (DNS) traffic that began on 6 Feb 2007. It is not confirmed whether this is a DDOS attempt, or an incidental effect of something else, however it is likely that the traffic is Distributed Denial of Service (DDOS) related. At approximately 0001 GMT on 6 Feb 2007, several root-level DNS servers began receiving a large volume of malformed DNS queries. This initial attack appears to have been a warm-up for a much larger attack that began at 1000 GMT. DNS servers G (U.S. DOD Network Information Center), L (Internet Corporation for Assigned Names and Numbers), and M (WIDE Project) appear to have been the most severely impacted although none were ever unreachable. The servers were operational and reachable even with the high volume of traffic. US-CERT has been in contact with the various groups affected to ensure that appropriate actions are being taken. US-CERT will continue to investigate and provide additional information as needed. Microsoft Releases Security Advisory for Unpatched Vulnerability in Office involving Exceladded February 5, 2007 | updated February 5, 2007Microsoft has released Security Advisory 932553 to address a new vulnerability that affects multiple versions of Microsoft Office. When Office applications improperly process a malformed string, a corruption in system memory occurs. By persuading a user to open a specially crafted Office document from an email attachment or web site, a remote attacker may be able to execute arbitrary code with privileges of the user. The Security Advisory states that the following Office versions are vulnerable: Microsoft Office 2000, Microsoft Office XP, Microsoft Office 2003, and Microsoft Office 2004 for Mac. According to the Microsoft Security Response Center Blog, there are very limited, targeted attacks attempting to use Excel documents as an attack vector to exploit this vulnerability in Microsoft Office. However, the issue can also affect all Office documents. More information about this vulnerability is located in the following:
Until Microsoft provides a security update, or more information becomes available, US-CERT recommends the following actions to help mitigate the security risks:
US-CERT will continue to investigate and provide additional information as it becomes available. Active Exploitation of Unpatched Vulnerability in Microsoft Wordadded January 31, 2007 | updated February 2, 2007US-CERT is aware of active exploitation of an unpatched vulnerability in Microsoft Word. There are reports indicating Microsoft has issued a response that this vulnerability is related to VU#166700, reported in December 2006. According to Symantec, there are different documents that use this same exploit from multiple organizations. Each document has been specifically crafted for the targeted organization in both language and content. Details are limited at this point. More information about this vulnerability is located in the following:
Until Microsoft issues a security fix, or more information becomes available, US-CERT recommends the following actions to help mitigate the security risks:
US-CERT will continue to monitor this issue and provide additional information as it becomes available. Public Exploit Code for Multiple Vulnerabilities in CA BrightStor ARCserve Backupadded February 1, 2007US-CERT is aware of public exploit code for multiple vulnerabilities in the Computer Associates BrightStor ARCserve Backup software product. The vulnerable process (Loginserver.exe) is susceptible to buffer overflows as the size of the data and the data received are improperly validated. By sending specially crafted data packets to ports 2200/tcp and 1900/tcp, a remote, unauthenticated attacker may be able to execute arbitrary code with SYSTEM level privileges or cause a denial of service. More information about these vulnerabilities is located in the Vulnerability Notes database and the Computer Associates Security Notice. US-CERT encourages users and administrators to take the following actions to help mitigate the security risks:
US-CERT will continue to monitor this issue and provide additional information as it becomes available. Vulnerability in PGP Desktop Serviceadded January 31, 2007US-CERT is aware of a memory corruption vulnerability in the PGP Desktop service. The PGP Desktop service fails to validate user-supplied data. By sending a specially crafted object to the PGP Desktop service, a remote, authenticated attacker may be able to execute arbitrary code with potentially elevated privileges on a vulnerable system. More information about this vulnerability is located in the following:
PGP states that upgrading to the latest version of PGP Desktop will address this vulnerability. US-CERT will continue to monitor this issue and provide additional information as it becomes available. SIP-Enabled Cisco IOS Devices are Vulnerable to Denial of Serviceadded January 31, 2007US-CERT is aware of an unspecified vulnerability in SIP-enabled Cisco IOS devices. SIP is a protocol designed for use in IP phone networks, and is widely used for Voice over Internet Protocol (VOIP) communications worldwide. According to Cisco, devices running IOS which support voice traffic and are not properly configured for Session Initiated Protocol (SIP) are vulnerable to a crash isolated to traffic destined to Port 5060. Other conditions affecting this vulnerability are yet to be determined. By sending specially crafted SIP packets to port 5060, a remote, unauthenticated attacker could cause the IOS device to reboot and cause a denial-of-service condition. More information about this vulnerability is located in the following:
US-CERT encourages users and administrators to take the following actions to help mitigate the security risks:
Microsoft Releases Security Advisory to Address Vulnerability in Microsoft Word 2000added January 25, 2007 | updated January 29, 2007Microsoft has released Security Advisory 932114 to address a previously known vulnerability in Word 2000. There is a flaw in the way Word handles a malformed string that could corrupt system memory. By persuading a user to open a specially crafted Word document from an email attachment or web site, a remote attacker may be able to execute arbitrary code with privileges of the user. If the compromised user is an administrator or has administrator-level privileges, then the attacker would be able to execute arbitrary code with SYSTEM-level privileges. According to the Microsoft Security Response Center Blog, there are very limited, targeted attacks attempting to exploit this vulnerability. Note: According to Microsoft, this vulnerability cannot be exploited on Word 2003, Word Viewer 2003, Word 2007, and Word 2004 for Mac, Word v. X for Mac, Word 2002, or Works 2004, 2005, or 2006. According to Symantec, a Trojan horse called Trojan.Mdropper.W is actively exploiting this vulnerability. This Trojan takes advantage of the unpatched flaw in Word 2000 to drop additional malicious files, such as Backdoor.Trojan, that may provide a remote attacker with unauthorized access to a vulnerable system. Backdoor.Trojan is a generic detection for a group of Trojan horse programs that open a back door and allow a remote attacker to have unauthorized access to the compromised computer. More information about this vulnerability is located in the following:
Until more information becomes available, US-CERT recommends the following actions to help mitigate the security risks:
US-CERT will continue to investigate and provide additional information as it becomes available. Cisco Releases Security Advisories for Multiple Vulnerabilities in IOSadded January 24, 2007 | updated January 24, 2007Cisco has released three Security Advisories to address severely rated vulnerabilities in their Internetwork Operating System Software (IOS). Cisco Security Advisory: Crafted IP Option Vulnerability addresses a remotely exploitable denial-of-service vulnerability that may potentially allow for arbitrary code execution. This vulnerability may be exploited when an affected device processes a crafted packet that meets all of the following conditions:
Cisco Security Advisory: Crafted TCP Packet Can Cause Denial of Service addresses a denial-of-service vulnerability in the Transmission Control Protocol listener. Crafted packets may cause the device to leak a small amount of memory. Over time, such a memory leak may lead to memory exhaustion and a denial-of-service condition. Cisco Security Advisory: IPv6 Routing Header Vulnerability addresses a remotely exploitable denial-of-service vulnerability in the IPv6 Type 0 Routing header handling. This vulnerability can be triggered by a packet containing crafted IPv6 Type 0 Routing headers. More information about these vulnerabilities can be found in the Vulnerability Notes Database. US-CERT encourages users to apply the fixes and workarounds described in the Cisco Security Advisories and Vulnerability Notes, and will continue to investigate and provide additional information as it becomes available. Apple Releases Security Update for Vulnerability in QuickTimeadded January 24, 2007Apple has released Security Update 2007-001 to correct a buffer overflow vulnerability in Apple QuickTime. The flaw is in the way that QuickTime handles Real Time Streaming Protocol (RTSP) URL strings. By persuading a user to access a specially crafted QuickTime file, a remote attacker may be able to execute arbitrary code or cause a denial of service on a vulnerable system. US-CERT is also aware of publicly available proof-of-concept code that exploits this vulnerability. Additionally, the Month of Apple Bugs MOAB-01-01-2007 website states that an attacker may also submit a specially crafted HTML document (e.g., a web page or an HTML email message) or Javascript code to cause a buffer overflow and compromise a vulnerable system. More information about this vulnerability is located in the following:
US-CERT encourages users to apply the appropriate updates as specified in Apple Security Update 2007-001 as soon as possible.
Microsoft Re-Releases Security Bulletin MS07-002 for Excel 2000added January 23, 2007Microsoft has released a new version of Security Bulletin MS07-002 to address an issue with security update for Excel 2000. The new version corrects the problem described in Microsoft Knowledge Base Article 931183 and in the Microsoft Security Response Center Blog. According to Microsoft, there was a flaw in the way the previous update processed the phonetic information that is embedded in files that are created by using Excel in the Korean, Chinese, or Japanese executable mode. Users who created Excel documents in one of these modes had difficulty opening some files after installing the update. The Microsoft re-release of MS07-002 resolves this issue. More information about the vulnerabilities addressed in this Security Bulletin is located in the Vulnerability Notes Database. US-CERT strongly encourages Excel 2000 users to apply the updates in the newly released Security Bulletin MS07-002 as soon as possible. Exploit Code Available for Multiple Vulnerabilities in Sun Java Runtime Environmentadded January 10, 2007 | updated January 22, 2007US-CERT is aware of publicly available exploit code for multiple vulnerabilities in Sun Java Runtime Environment (JRE). There are several flaws in the JRE that may allow an untrusted Java Applet to elevate its privileges or execute malicious code. If successfully exploited, a remote, unauthenticated attacker may be able to execute arbitrary code with elevated privileges. More information about these vulnerabilities can be found in the Vulnerability Notes Database and Technical Cyber Security Alert TA07-022A. US-CERT encourages users to take the following actions to help mitigate the effects of these vulnerabilities:
Second Trojan Variant Storm Worm Spreads through Social Engineeringadded January 19, 2007 | updated January 20, 2007US-CERT is aware of a second variant of the Small Trojan that is known as Storm Worm. Similar to the first variant, this one is also a mass-mailer that uses social engineering and network shares to propagate. The Storm Worm variant creates a peer-to-peer network that operates on port 7871/UDP, while the previously reported variant, known as Small.DAM or Trojan.Peacomm, operates on port 4000/UDP. The Small Trojan variants arrive as an email attachment and also propagate through network file shares. These Trojan variants drop two files upon execution, one of which may contain rootkit functionality. These Trojan variants also create a back door that may be used to harvest sensitive data or launch a spam attack. Subject lines can change at any time, but the following are currently being used by these Trojans:
File names can also change at any time, but the following are currently being used:
US-CERT urges users and administrators to take the following preventative measures to mitigate the security risks:
Oracle Releases January Critical Patch Updateadded January 15, 2007 | updated January 17, 2007Oracle has released their January Critical Patch Update (CPU) to address 54 vulnerabilities across all products, some of which have a maximum severity rating of High. This CPU contains twenty-six security fixes for Oracle Database; twelve for Oracle Application Server; seven for Oracle E-Business Suite; six for Oracle Enterprise Manager; and three for Oracle PeopleSoft Enterprise PeopleTools. US-CERT strongly encourages users to review the January CPU and follow best-practice security policies to determine which updates to apply. Additionally, more information about these vulnerabilities is located in the Vulnerability Notes Database and Technical Cyber Security Alert TA07-017A. Proof-of-Concept Code for Integer Overflow Vulnerability in Apple Mac OS Xadded January 16, 2007US-CERT is aware of proof-of-concept code for an unpatched integer overflow vulnerability in Apple Mac OS X Unix File System (UFS) handling. By persuading a user to open a specially crafted Disk Image (DMG) file, a remote attacker may be able to cause a denial-of-service condition or possibly execute arbitrary code on a vulnerable system. NOTE: This is only remotely exploitable via the Safari web browser when the Opening Safe Files After Downloading option is enabled. More information about this vulnerability can be found in the following:
Until Apple releases a security fix or update, US-CERT recommends the following actions to help mitigate the security risks:
Active Exploitation of Vulnerability in CA BrightStor ARCserve Backupadded January 12, 2007US-CERT is aware of active exploitation of a vulnerability in the Computer Associates BrightStor ARCserve Backup software product. There is a flaw in the way the BrightStor ARCserve Backup handles malformed RPC requests. Additionally, US-CERT has received reports of increased port scan activity on port 6502/tcp. An attacker may be able to access a vulnerable version of the BrightStor ARCserve Backup on this port. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code with SYSTEM privileges on a vulnerable system. More information about this vulnerability and related ones can be found in the Vulnerability Notes Database. US-CERT encourages users and administrators to take the following actions to help mitigate the security risks:
|
|||||||||||||||||||||||||||||||||||||||||||||||||||
Information For
Sign Up
Reporting
DHS Threat Advisory
The threat level in the airline sector is High or Orange. Read more
Get Adobe Reader