July 25, 2007 - Current Activity

Multiple Vulnerabilities in ISC BIND 9

US-CERT is aware of two vulnerabilities in ISC BIND that may allow an arbitrary, remote user to make recursive queries or poison the name server cache contents. More information regarding these vulnerabilities, workarounds, and fixes can be found on the ISC BIND Vulnerabilities page.

US-CERT recommends that administrators of this product apply the workarounds and fixes described on the ISC BIND Vulnerabilities page, and will continue to investigate and provide additional information as it becomes available.

Cisco Releases Security Advisory for Multiple Vulnerabilities in Wireless LAN Controllers

Cisco has released Security Advisory cisco-sa-20070724-arp to address several vulnerabilities in Cisco Wireless LAN Controllers that may allow an attacker to cause a denial-of-service condition on a network that utilizes affected equipment.

US-CERT recommends that administrators of these products apply the updates described in Cisco Security Advisory cisco-sa-20070724-arp, and will continue to investigate and provide additional information as it becomes available.

Oracle Releases July Critical Patch Update

Oracle has released their July Critical Patch Update (CPU) to address vulnerabilities across all products, some of which have a maximum severity rating of High. This CPU contains eighteen security fixes for Oracle Database; one for Oracle Application Express; four for Oracle Application Server; five for Oracle Collaboration Suite; fourteen for Oracle E-Business Suite; and seven for Oracle PeopleSoft Enterprise.

More information about this vulnerability is located in the Technical Cyber Security Alert TA07-200A.

US-CERT strongly encourages users to review the July CPU and follow best-practice security policies to determine which updates to apply.

Multiple Vulnerabilities in Mozilla Firefox

US-CERT is aware of multiple vulnerabilities affecting the Mozilla Firefox web browser.  These vulnerabilities may allow a remote, unauthenticated attacker to execute arbitrary code, inject and execute arbitrary script, or cause memory corruption on an affected system.

More information about this vulnerability is located in the following:

• Technical Cyber Security Alert TA07-199A
• Vulnerability Notes Database
• Mozilla Foundation Secuity Advisories

Internet Explorer Code Execution Vulnerability

US-CERT is aware of publicly available exploit code for a vulnerability that uses Microsoft Internet Explorer to send malicious input to the Trillian instant messenger client. The public exploit code demonstrates the vulnerability using the AIM URI handler. To trigger this vulnerability, an attacker must persuade a user who has an Instant Messaging client installed to access a specially crafted web page with Internet Explorer.  This exploit is similar to the "Web Browser Code Execution Vulnerability" reported by US-CERT on July 10, 2007.

This vulnerability may not be isolated to this specific application.   Any malicious input that Internet Explorer handles may be passed to other applications and executed. 

More information regarding this vulnerability can be found in Vulnerability Note VU#786920.

McAfee Products Contain Multiple Vulnerabilities

McAfee ePolicy Orchestrator, ProtectionPilot, and Common Management Agent products contain several vulnerabilities.  These vulnerabilities could allow a remote, unauthenticated attacker to execute arbitrary code or cause a denial-of-service condition on an affected system. 

More information regarding these vulnerabilities can be found in the following McAfee Security Bulletins:
Stack corruption of Common Management Agent
Stack based buffer overflow of Common Management Agent
Heap based buffer overflow of Common Management Agent
Crash of Framework service of McAfee Common Management Agent

US-CERT recommends that administrators of this product apply the updates described in the McAfee Security Bulletin listed above, and will continue to investigate and provide additional information as it becomes available.

Apple Releases Security Update to Address Multiple Vulnerabilities in QuickTime

Apple has released an update to address multiple vulnerabilities in QuickTime. These vulnerabilities could allow a remote, unauthenticated attacker to execute arbitrary code, execute arbitrary commands, or cause a denial-of-service condition on an affected system.

More information regarding these vulnerabilities can be found in the following:

• Technical Cyber Security Alert TA07-193A
• Vulnerability Notes Database
• Apple Security Update