July 20, 2007 - Current Activity

Oracle Releases July Critical Patch Update

Oracle has released their July Critical Patch Update (CPU) to address vulnerabilities across all products, some of which have a maximum severity rating of High. This CPU contains eighteen security fixes for Oracle Database; one for Oracle Application Express; four for Oracle Application Server; five for Oracle Collaboration Suite; fourteen for Oracle E-Business Suite; and seven for Oracle PeopleSoft Enterprise.

More information about this vulnerability is located in the Technical Cyber Security Alert TA07-200A.

US-CERT strongly encourages users to review the July CPU and follow best-practice security policies to determine which updates to apply.

Multiple Vulnerabilities in Mozilla Firefox

US-CERT is aware of multiple vulnerabilities affecting the Mozilla Firefox web browser.  These vulnerabilities may allow a remote, unauthenticated attacker to execute arbitrary code, inject and execute arbitrary script, or cause memory corruption on an affected system.

More information about this vulnerability is located in the following:

• Technical Cyber Security Alert TA07-199A
• Vulnerability Notes Database
• Mozilla Foundation Secuity Advisories

Internet Explorer Code Execution Vulnerability

US-CERT is aware of publicly available exploit code for a vulnerability that uses Microsoft Internet Explorer to send malicious input to the Trillian instant messenger client. The public exploit code demonstrates the vulnerability using the AIM URI handler. To trigger this vulnerability, an attacker must persuade a user who has an Instant Messaging client installed to access a specially crafted web page with Internet Explorer.  This exploit is similar to the "Web Browser Code Execution Vulnerability" reported by US-CERT on July 10, 2007.

This vulnerability may not be isolated to this specific application.   Any malicious input that Internet Explorer handles may be passed to other applications and executed. 

More information regarding this vulnerability can be found in Vulnerability Note VU#786920.

McAfee Products Contain Multiple Vulnerabilities

McAfee ePolicy Orchestrator, ProtectionPilot, and Common Management Agent products contain several vulnerabilities.  These vulnerabilities could allow a remote, unauthenticated attacker to execute arbitrary code or cause a denial-of-service condition on an affected system. 

More information regarding these vulnerabilities can be found in the following McAfee Security Bulletins:
Stack corruption of Common Management Agent
Stack based buffer overflow of Common Management Agent
Heap based buffer overflow of Common Management Agent
Crash of Framework service of McAfee Common Management Agent

US-CERT recommends that administrators of this product apply the updates described in the McAfee Security Bulletin listed above, and will continue to investigate and provide additional information as it becomes available.

Apple Releases Security Update to Address Multiple Vulnerabilities in QuickTime

Apple has released an update to address multiple vulnerabilities in QuickTime. These vulnerabilities could allow a remote, unauthenticated attacker to execute arbitrary code, execute arbitrary commands, or cause a denial-of-service condition on an affected system.

More information regarding these vulnerabilities can be found in the following:

• Technical Cyber Security Alert TA07-193A
• Vulnerability Notes Database
• Apple Security Update

Adobe Flash Player Multiple Vulnerabilities

Adobe Systems has released a Security bulletin to address multiple vulnerabilities in their Flash Player, some of which may allow an unauthenticated attacker to execute arbitrary code on an affected system.  The Adobe Security bulletin further states that all operating systems with a vulnerable version of Flash Player are affected.

• Technical Cyber Security Alert TA07-192A
• Vulnerability Notes Database
• Adobe Security Bulletin APSB07-12

Cisco Releases Security Advisories for Multiple Vulnerabilities in Unified Communications Manager

Cisco has published two separate advisories, cisco-sa-20070711-cucm and cisco-sa-20070711-voip, describing several vulnerabilities affecting Cisco Unified Communications Manager. The impacts of these vulnerabilities vary, the most severe of which may allow a remote attacker to execute arbitrary code on an affected system.

US-CERT recommends that administrators of this product apply the updates described in the Cisco Security Advisories listed above, and will continue to investigate and provide additional information as it becomes available.