April 24, 2007 - Current Activity

Vulnerability Involving Apple QuickTime and Java

US-CERT is aware of a new vulnerability involving Apple QuickTime and Java. Any platform supporting QuickTime and Java may be affected. Details about the vulnerability are currently limited; however, it is reported that disabling Java will protect users.

US-CERT recommends users follow the Securing Your Web Browser document to disable Java.

US-CERT will continue to investigate this vulnerability and provide more information as it becomes available.

New Attack Technique for ARM Architecture

US-CERT is aware of a new attack technique presented at CansecWest and Black Hat Amsterdam. This technique affects devices that use the ARM (including Xscale) architecture, such as routers, wireless access points and mobile phones. The technique demonstrates that a vulnerability that results in a NULL pointer dereference can be used to execute arbitrary code.

US-CERT has been working with vendors to inform them of this attack technique and provide mitigation strategies.

US-CERT will continue to investigate and provide additional information as it becomes available.

Multiple Vulnerabilities in MIT Kerberos 5

US-CERT is aware of multiple vulnerabilities affecting the MIT Kerberos 5 implementation. The most severe of these vulnerabilities may allow a remote attacker to execute arbitrary code on a Kerberos Distribution Center (KDC), which may result in a compromise of the Kerberos key database.

More information about these vulnerabilities can be found in the following:

• US-CERT Technical Cyber Security Alert TA07-093B
• Vulnerability Notes Database
• MIT krb5 Security Advisory 2007-001
• MIT krb5 Security Advisory 2007-002
• MIT krb5 Security Advisory 2007-003

US-CERT recommends users apply the patches as described in MIT krb5 Security Advisories 2007-001, 2007-002, and 2007-003.

Apple Releases Security Update to Address Multiple Vulnerabilities in Various Products

Apple has released Security Update 2007-004 to address multiple vulnerabilities in various products. The impacts of these vulnerabilities include arbitrary code execution, privilege escalation, SYSTEM level access, information disclosure, and denial of service.

US-CERT encourages users to apply the appropriate updates as soon as possible.

Oracle Releases Critical Patch Update for April 2007

Oracle has released the Oracle Critical Patch Update (CPU) for April 2007. This update contains 36 new security fixes for multiple vulnerabilities in various Oracle products and components. The impacts of these vulnerabilities vary depending on the product, component, and configuration of the system. Potential consequences include the execution of arbitrary code or commands, disclosure of sensitive information, and denial of service.

More information is available in the Critical Patch Update for April 2007.

We strongly encourage Oracle administrators to review, test, and install the patches within the April 2007 CPU.

Virginia Tech Tragedy May Spawn Phishing Sites

In recent years, US-CERT has received reports of an increased number of phishing sites set up in the wake of tragedies and natural disasters. US-CERT reminds users to remain cautious when receiving unsolicited email that could be a potential phishing attempt. 

Phishing emails may appear as requests for donations from a charitable organization asking the users to click on a link that will then take them to a fraudulent web site that appears to be a legitimate charity. The users are then asked to provide personal information that can further expose them to future compromises. 

Users are encouraged to take the following measures to protect themselves from this type of phishing attack:

• Do not follow unsolicited web links received in email messages.
• Contact your financial institution immediately if you believe your account and/or financial information has been compromised.
• Verify the legitimacy of the email by contacting the company directly through a trusted contact number.
• Visit the Anti-Phishing Working Group for more information on known phishing attacks.

For additional information regarding phishing, US-CERT recommends reading the following documents:

1. Technical Trends in Phishing Attacks
2. Recognizing and Avoiding Email Scams
3. Avoiding Social Engineering and Phishing Attacks

New Rinbot Variant Attempting to Exploit Microsoft Windows DNS RPC Vulnerability

US-CERT is aware of a new variant of the Rinbot worm that is currently scanning for port 1025/tcp and attempting to exploit the recent buffer overflow vulnerability in the Microsoft Windows DNS service RPC management interface. Like other variants of Rinbot, this variant is an Internet Relay Chat controlled backdoor that may provide an attacker unauthorized remote access to a compromised machine.

US-CERT recommends the following actions to help mitigate the security risks:

• Install anti-virus software, and keep its virus signature files up-to-date.
• Review Microsoft Security Advisory 935964 for additional information and workarounds.