June 25, 2007 - Current Activity

Apple Releases Security Update 2007-006 and Safari 3 Beta Update 3.0.2 to Address Multiple Vulnerabilities

Apple has released Security Update 2007-006 and Safari 3 Beta Update 3.0.2 to address multiple vulnerabilities in WebCore, WebKit, and Safari 3 Beta. These vulnerabilities may allow an attacker to execute arbitrary code, cause a denial-of-service condition, conduct cross-site scripting attacks, or alter the contents of the address bar in the Safari web browser.

More information regarding the vulnerabilities and remediation information can be found in the following:

• Vulnerability Notes Database
• Apple Security Update 2007-006
• Safari Beta 3 Download Site

CA Releases Updates for Multiple Vulnerabilities in Products that Use the Ingres Database

Computer Associates has released updates to address several vulnerabilities in products that use the Ingres database. These vulnerabilities may allow an attacker to execute arbitrary code on an affected system.

More information regarding these vulnerabilities and which applications are affected can be found in the CA Security Advisor "CA Products That Embed Ingres Multiple Vulnerabilities" document.

US-CERT strongly encourages users to review the CA Security Advisor "CA Products That Embed Ingres Multiple Vulnerabilities" document and follow best-practice security policies to determine what updates should be applied.

Cerulean Studios Trillian Instant Messenger Vulnerability

US-CERT is aware of a heap overflow vulnerability in Cerulean Studios Trillian Instant Messenger. The vulnerability may be exploited by viewing a malicious message containing a specially crafted UTF-8 string. Exploitation of this vulnerability may allow a remote attacker to execute arbitrary code with the credentials of the currently logged on user.

More information about this vulnerability can be found in Vulnerability Note VU#187033.

US-CERT encourages users to upgrade to Trillian 3.1.6.0 which has been released to address this vulnerability.

FBI Charges "Bot-Herders"

The FBI's "Operation Bot Roast" has identified over 1 million computers across the country that have been compromised by botnets. For more information on how to identify, report, and prevent attacks, see US-CERT's Cyber Security Tip "Understanding Hidden Threats: Rootkits and Botnets".

Microsoft Releases June Security Bulletins

Microsoft has released updates to address vulnerabilities in Windows, Internet Explorer, Outlook Express, Windows Mail, Visio, and the Windows Schannel Security Package as part of the Microsoft Security Bulletin Summary for June 2007.

More information about these vulnerabilities is located in the Vulnerability Notes Database and Technical Cyber Security Alert TA07-163A.

US-CERT strongly encourages users to review the bulletins and follow best-practice security policies to determine what updates should be applied.

Publicly Available Exploit for Yahoo! Messenger IM Client ActiveX Control Vulnerabilities

US-CERT is aware of publicly available exploit code for vulnerabilities in the Yahoo! Messenger Webcam Upload (ywcupl.dll) and Webcam Viewer (ywcvwr.dll) ActiveX controls that may allow an attacker to execute arbitrary code on a user's machine.

More information about the vulnerabilities can be found in the following:

• Vulnerability Note VU#932217
• Vulnerability Note VU#949817
• Yahoo! Webcam ActiveX Controls Security Update.

• Apply the update as described in the Yahoo! Webcam ActiveX Controls Security Update.
• Disable the ActiveX controls listed in the Yahoo! Webcam ActiveX Controls Security Update.
• Disable ActiveX as described in the Securing Your Web Browser document.
  

Microsoft Releases Advance Notification for June Security Bulletins

Microsoft has issued a Security Bulletin Advance Notification indicating that their June release cycle will contain six bulletins, four of which have a maximum severity rating of Critical. The notification further states that the four Critical bulletins are for Windows, Internet Explorer, and Outlook Express.  There will also be two non-critical bulletins for Visio and Windows as well as an updated version of the Microsoft Windows Malicious Software Removal Tool.  The release is scheduled for Tuesday, June 12, 2007.

US-CERT will provide additional information as it becomes available.