July 09, 2007 - Current Activity

Microsoft Releases Advance Notification for July Security Bulletins

Microsoft has issued a Security Bulletin Advance Notification indicating that their July release cycle will contain six bulletins, three of which have a maximum severity rating of Critical. The notification further states that the three Critical bulletins are for Windows, Office, Excel, and .NET Framework.  There will also be two Important bulletins for Office Publisher and Windows XP Professional as well as one Moderate bulletin for Windows Vista.  Microsoft will also release an updated version of the Microsoft Windows Malicious Software Removal Tool.  The release is scheduled for Tuesday, July 10, 2007. 

US-CERT will provide additional information as it becomes available.

New Storm Worm Variant Spreads through Social Engineering

US-CERT is aware of a new variant of the Trojan Worm known as "Storm Worm" that uses social engineering with mass mailing to spread to unsuspecting victims. This variant of Storm Worm arrives as an email message and contains a link to a malicious website that, when visited, installs malware on the user's system.

Subject lines can change at any time, but the following are some examples that are currently being used:

• You've received a postcard from a family member!
• 4th Of July Celebration
• America's 231 Birthday
• Celebrate Your Independence
• Celebrate Your Nation

• Install anti-virus software, and keep its virus signature files up-to-date.
• Block executable and unknown file types at the email gateway.
• Refer to the Recognizing and Avoiding Email Scams document for more information on avoiding email scams.
• Refer to the Avoiding Social Engineering and Phishing Attacks document for more information on social engineering attacks.
  

Russian Cyber Attacks Reported

US-CERT is aware of reports of cyber attacks occurring in Russian cyber-space. According to reports these attacks may be politically motivated.  It is reported that the attacks are similar to those that affected Estonia in April and May. 

More information can be found in the following:

http://www.washingtonpost.com/wp-dyn/content/article/2007/07/01/AR2007070100009.html

Publicly Available Exploit Code for a Vulnerability in RealNetworks Media Players

US-CERT is aware of publicly available exploit code for a buffer overflow vulnerability in RealNetworks media players. By supplying a user with a crafted media file or stream, a remote unauthenticated attacker could execute arbitrary code or cause a denial-of-service condition on a vulnerable system.

More information regarding this vulnerability can be found in Vulnerability Note VU#770904 and iDefense Labs Public Advisory: 06.26.07.

To help mitigate the security risk, US-CERT recommends users upgrade their media player to the latest version as soon as possible.

Justice Department Warns Public of Fraudulent Spam Email

The United States Department of Justice has released information warning the public of a recent surge in fraudulent spam e-mail messages claiming to be from the DOJ.  The messages contain a malicious attachment that supposedly contains information regarding complaints filed against them with the DOJ and IRS, but instead launches malware on the user's system when opened.

More information regarding these messages can be found in the DOJ  Justice Department Alerts Public about Fraudulent Spam Email Press Release.

To help protect against this type of attack, US-CERT recommends that users never open attachments from unsolicited email messages. More information on how to safely utilize email attachments can be found in the US-CERT Using Caution with Email Attachments Cyber Security Tip.

Multiple Vulnerabilities in Kerberos Administration Daemon

US-CERT is aware of multiple vulnerabilities in the Kerberos administration daemon that may allow a remote user to execute arbitrary code or cause a denial-of-service condition on an affected system.

More information regarding these vulnerabilities may be found in the following:

• Technical Cyber Security Alert TA07-177A
• Vulnerability Notes Database
• MIT krb5 Security Advisory 2007-004
• MIT krb5 Security Advisory 2007-005

Apple Releases Security Update 2007-006 and Safari 3 Beta Update 3.0.2 to Address Multiple Vulnerabilities

Apple has released Security Update 2007-006 and Safari 3 Beta Update 3.0.2 to address multiple vulnerabilities in WebCore, WebKit, and Safari 3 Beta. These vulnerabilities may allow an attacker to execute arbitrary code, cause a denial-of-service condition, conduct cross-site scripting attacks, or alter the contents of the address bar in the Safari web browser.

More information regarding the vulnerabilities and remediation information can be found in the following:

• Vulnerability Notes Database
• Apple Security Update 2007-006
• Safari Beta 3 Download Site