July 31, 2007 - Current Activity

Mozilla Releases Update to Address URI Sanitization Vulnerability

Mozilla has released an update for the Firefox browser to address two vulnerabilities with URI sanitization.  These vulnerabilities may allow a remote, unauthenticated attacker to execute arbitrary code on an affected system. 

More information regarding these vulnerabilities and the Firefox update can be found in the following:

• Vulnerability Note VU#783400
• Vulnerability Note VU#403150
• Mozilla Foundation Security Advisory 2007-27
• Mozilla Firefox update

Microsoft Windows URI Protocol Handling Vulnerability

US-CERT is aware of a vulnerability in the way Microsoft Windows determines how to handle URIs, which may be be leveraged by a remote attacker to execute arbitrary commands on an affected system.  Public reports demonstrate that Mozilla Firefox can be used to pass malicious URIs to Windows, but other applications may also act as attack vectors for this vulnerability.

More information regarding this vulnerability can be found in Vulnerability Note VU#403150.

Mozilla Firefox URI Sanitization Vulnerability

US-CERT is aware of a vulnerability (VU#783400) in the way Mozilla Firefox passes URIs to registered protocol handlers in Microsoft Windows.  Due to a separate vulnerability (VU#403150) in the way Windows determines how to execute URIs, Firefox could be used as an attack vector to execute arbitrary commands.

More information regarding these vulnerabilities can be found in Vulnerability Notes VU#783400 and VU#403150.

Multiple Vulnerabilities in ISC BIND 9

US-CERT is aware of two vulnerabilities in ISC BIND that may allow an arbitrary, remote user to make recursive queries or perform DNS cache poisoning attacks. More information regarding these vulnerabilities, workarounds, and fixes can be found in the Vulnerability Notes Database or on the ISC BIND Vulnerabilities page.

US-CERT recommends that administrators of this product apply the workarounds and fixes described on the ISC BIND Vulnerabilities page, and will continue to investigate and provide additional information as it becomes available.

Panda Antivirus Buffer Overflow Vulnerability

US-CERT is aware of a buffer overflow vulnerability in Panda Antivirus. This vulnerability may allow an attacker to execute arbitrary code on a vulnerable system by passing a crafted ".EXE" file to the Panda Antivirus file parsing engine.

It has been reported that an update has been issued through the built in update mechanism to mitigate this vulnerability. US-CERT strongly recommends users verify that their systems are updated.

CA Releases Updates to Address Vulnerabilities in Several Products

Computer Associates has released updates to address vulnerabilities in CA Message Queuing, eTrust Intrusion Detection, and several products that implement the "Arclib" library. These vulnerabilities may allow a remote, unauthenticated attacker to execute arbitrary code or cause a denial-of-service condition on a vulnerable system.

More information regarding these vulnerabilities and which applications are affected can be found in the following Computer Associates Security Notices:

• Security Notice for CA products containing Arclib
• Security Notice for CA Message Queuing (CAM / CAFT) vulnerability
• Security Notice for eTrust Intrusion Detection caller.dll vulnerability

Publicly Available Exploit for LinkedIn Internet Explorer Toolbar Code Execution Vulnerability

US-CERT is aware of publicly available exploit code for a buffer overflow vulnerability in the LinkedIn Internet Explorer toolbar. If a user has the LinkedIn toolbar installed and is persuaded to visit a malicious web page, an attacker may be able to execute arbitrary code on a vulnerable system.

Until an update, patch, or more information becomes available, US-CERT strongly recommends that users disable ActiveX as specified in the Securing Your Web Browser document and refrain from following unsolicited links.

US-CERT will continue to investigate and provide additional information as it becomes available.