June 01, 2007 - Current Activity

Apple Releases Update for Xserve Lights-Out Management Firmware

Apple releases Firmware Update 1.0 to address a vulnerability in Xserve Lights-Out Management Firmware.  The vulnerability lies in Apple's implementation of IPMI and may allow a remote, unprivileged ipmitool user to gain administrative privileges on a Xserve system.

US-CERT encourages users to apply Firmware Update 1.0 as soon as possible.

US-CERT will continue to investigate this vulnerability and provide additional details as they become available.

Mozilla Releases Security Advisories to Address Multiple Vulnerabilities

The Mozilla Foundation has released Security Advisories to address multiple vulnerabilities in Firefox, Thunderbird, and SeaMonkey.  The impacts of these vulnerabilities include arbitrary code execution, denial of service, memory corruption and cross-site scripting.

More information can be found in Technical Cyber Security Alert TA07-151A and the Vulnerability Notes Database.

US-CERT encourages users to apply the updates as described in the Security Advisories.

Apple Releases a Security Update for QuickTime 7.1.6 to Address Multiple Vulnerabilities

Apple has released a Security Update for QuickTime 7.1.6 to address multiple vulnerabilities in Apple QuickTime for Java. The impacts of these vulnerabilities include arbitrary code execution and information disclosure.

More information can be found in the following:

• Vulnerability Note VU#995836
• Vulnerability Note VU#434748

Apple Releases Security Update to Address Multiple Vulnerabilities in Various Products

Apple has released Security Update 2007-005 to address multiple vulnerabilities in various products.  The impacts of these vulnerabilities include denial of service, arbitrary code execution, information disclosure, and privilege escalation.

US-CERT encourages users to apply the appropriate updates as soon as possible.

More information about this vulnerability can be found in the following:

• Vulnerability Note VU#221876
• Vulnerability Note VU#116100

Microsoft Office ActiveX Control Vulnerability

US-CERT is aware of reports of a vulnerability in a Microsoft Office 2000 ActiveX control.  Excessive data passed to the OUACTRL ActiveX control may result in a buffer overflow allowing arbitrary code execution or causing a denial-of-service condition.

Cisco Releases Security Advisory to Address Multiple Vulnerabilities in Cisco IOS

Cisco has released Security Advisory cisco-sa-20070522-SSL to address multiple vulnerabilities in Cisco IOS.  These vulnerabilities may lead to a sustained denial-of-service condition when processing malformed SSL messages.  

US-CERT recommends administrators apply the workarounds as described in Cisco Security Advisory cisco-sa-20070522-SSL.

US-CERT will provide additional information as it becomes available.

Microsoft Releases Security Advisory to Announce Microsoft Office Enhancements

Microsoft has released the Microsoft Office Isolated Conversion Environment (MOICE) feature and File Block Functionality for Microsoft Office 2003 and 2007 Office system. 

Microsoft states that MOICE converts Office 2003 binary documents to the newer Office open XML format in an isolated environment providing an additional layer of security.

The File Block Functionality allows restrictions to be placed on specific Office file types by administrators to deny opening potentially unsafe documents.    

More information regarding these enhancements can be found in Microsoft Security Advisory 937696.

US-CERT strongly encourages users to review the Security Advisory and take the appropriate actions and implement these enhancements where pertinent.