March 15, 2007 - Current Activity

Microsoft Releases Windows Server 2003 Service Pack 2

Microsoft has released Windows Server 2003 Service Pack 2. This update package provides the following security enhancements:

• The ability to simplify the creation and maintenance of the Internet Protocol security (IPsec) policy
• Group Policy support for non-broadcasting networks and Wi-Fi Protected Access 2 (WPA2) settings to allow Windows wireless client configuration
• Windows wireless client support for WPA2 with the following features:
• Non-broadcast network profiles are now marked with a flag to improve the security of the Windows wireless client.
• Windows will not automatically connect to a peer-to-peer network, even if it has been automatically saved in the preferred network list.

More information concerning this update package is located in the following:

• Release Notes for Microsoft Windows Server 2003 Service Pack 2
• Windows Server 2003 Service Pack 2 Technical Library

US-CERT encourages affected administrators to apply this update package as soon as possible.

Apple Releases Security Update to Address Multiple Vulnerabilities in Various Products

Apple has released Security Update 2007-003 to address multiple vulnerabilities in various products. The impacts of these vulnerabilities include arbitrary code execution, privilege escalation, SYSTEM level access, cross-site scripting, sensitive data exposure, file manipulation, and denial of service.

More information about these vulnerabilities is located in the Vulnerability Notes Database and Technical Cyber Security Alert TA07-072A.

US-CERT encourages users to apply the appropriate updates as soon as possible.

No New Microsoft Security Bulletins for March

Microsoft released no new security bulletins today. They have, however, released an updated version of the Microsoft Windows Malicious Software Removal Tool. They have also released six non-security, high-priority updates.

More information can be found in Microsoft Security Bulletin Summary for March 2007.

Mozilla Releases Security Advisory to Address Multiple Vulnerabilities

Mozilla has released Security Advisory 2007-09 to address vulnerabilities in Firefox and SeaMonkey.

More information about this vulnerability is located in the following:

• Mozilla Foundation Security Advisory 2007-09

US-CERT strongly encourages users to upgrade to Firefox 2.0.0.2 and SeaMonkey 1.1.1 as soon as possible.

Apple Releases Security Update to Address Multiple QuickTime Vulnerabilities

Apple has released QuickTime 7.1.5 Update to address multiple vulnerabilities in QuickTime. The impacts of these vulnerabilities include remote code execution and denial of service.

More information about these vulnerabilities is located in the Vulnerability Notes Database and Technical Cyber Security Alert TA07-065A.

US-CERT encourages users to apply the appropriate updates as soon as possible.

US-CERT will continue to investigate these vulnerabilities and provide additional information as it becomes available.

Daylight Saving Time Changes for 2007

The start and end dates for Daylight Saving Time (DST) will change this year in accordance with the Energy Policy Act of 2005. With the new rules, clocks will be set ahead on March 11th instead of April 1st, and will be turned back on November 4th instead of October 28th. The change will have an effect on and require updates to many computing systems that are time reliant. For example, any organization using software to perform scheduling, billing, transaction logging, and other time-related calculations could be at risk if upgrades are not performed.

All organizations should prepare for the DST changeover by analyzing their systems and applying the appropriate updates. While the level of effort will vary widely across systems, platforms, and industries, every computing environment should be assessed for potential impact, as it is likely that most systems will require some pre-changeover action. To find out more about the systems at risk, the scope of impact, and the updates required to avoid complications, visit page 3 and 4 of the most recent Quarterly Trends and Analysis Report.

WordPress Releases New Version to Address Vulnerabilities

WordPress has released a new version to address vulnerabilities introduced into version 2.1.1 by a malicious third party. These vulnerabilities allow remote, unauthenticated users to execute arbitrary system commands or PHP code.

More information about these vulnerabilities can be found in the Vulnerability Notes Database and the WordPress Blog.

US-CERT urges users who are running version 2.1.1 to upgrade to version 2.1.2 as soon as possible.

Vulnerability in Citrix Presentation Server Client

US-CERT is aware of an unspecified vulnerability in Citrix Presentation Server Client for Windows. The vulnerability exists in the way ICA connections are handled through proxy servers. By persuading a user to access a specially crafted HTML document (e.g., a web page or an HTML email message), a remote, unauthenticated attacker may be able to execute arbitrary code with privileges in the context of the client process.

More information about this vulnerability is located in the following:

• Vulnerability Note VU#798364 - Citrix Presentation Server Client vulnerable to arbitrary code execution
• Citrix Advisory CTX112589 - Vulnerability in Citrix Presentation Server Client for Windows could result in arbitrary code

US-CERT recommends that administrators upgrade to version 10.0 and later to mitigate the security risks.

Worm Actively Exploits Vulnerability in Sun Solaris Telnet Daemon

US-CERT is aware of public reports of a worm that is actively exploiting a known vulnerability in the Sun Solaris telnet daemon (in.telnetd). The worm targets Solaris 10 (SunOS 5.10) systems that are not patched to address this vulnerability and have enabled the telnet daemon. When the worm discovers a vulnerable host, it attempts to log into the host using the lp or adm account to invoke one or more of the following malicious actions:

• Modifies the /var/adm and /var/spool/lp directories
• Installs and runs a server on port 32982
• Schedules a crontab entry to run at 1:00 A.M.
• Scans for other vulnerable hosts

More information about this vulnerability is located in the following:

• Vulnerability Note VU#881872 - Sun Solaris telnet authentication bypass vulnerability
• Technical Cyber Security Alert TA07-059A - Sun Solaris Telnet Worm
• Sun Alert 102802 - Security Vulnerability in the in.telnetd (1M) Daemon May Allow Unauthorized Remote Users to Gain Access to a Solaris Host

US-CERT recommends the following actions to help mitigate the security risks:

• Apply the latest patches, as specified in Sun Alert 102802 to address this vulnerability.
• Run the Sun inoculation script if your host is infected.
• Disable Telnet daemon if unable to apply the patch at this time.
• Restrict access to port 23/tcp to trusted hosts only.

Proof-of-Concept Code for Vulnerability in Mozilla Firefox

US-CERT is aware of proof-of-concept code for a memory corruption vulnerability in Mozilla Firefox. The vulnerability exists due to a flaw in the way Firefox handles freed data structures modified in the onUnload event handler, which may cause a memory corruption error. By persuading a user to view a specially crafted HTML document (e.g., a web page or an HTML email message or attachment), an attacker may be able to execute arbitrary code or crash the Firefox browser.

More information about this vulnerability is located in the following:

Until Mozilla issues a security fix for this issue, US-CERT recommends the following workaround to help mitigate the security risk:

• For more information on disabling JavaScript, please refer to the Securing Your Web Browser document.