August 03, 2007 - Current Activity

Apple Releases Update for iPhone

Apple has released an update to address several vulnerabilities in the iPhone. These vulnerabilities may allow an attacker to execute arbitrary code or conduct cross-site scripting attacks on an affected device. 

More information about these vulnerabilities and the iPhone v1.0.1 update can be found in the Apple update advisory.

US-CERT strongly encourages users to review the advisory and follow best-practice security policies to determine what updates should be applied.

US-CERT Warns Public of Fraudulent Phishing Email

US-CERT is aware of a recent surge in fraudulent phishing e-mail messages.  The messages, claiming to be from the United States National Medical Association, contain a subject line that reads "The United States National Medical Association" and a link that, when followed, will direct the user to a malicious website.  These messages are not from any United States government agency.

Users are encouraged to take the following measures to protect themselves from phishing attacks:
    * Do not follow unsolicited web links received in email messages.
    * Verify the legitimacy of the email by contacting the company or agency directly through a trusted contact number.
    * Visit the Anti-Phishing Working Group for more information on known phishing attacks.

For additional information regarding phishing, US-CERT recommends reading the following documents:
   1. Technical Trends in Phishing Attacks
   2. Recognizing and Avoiding Email Scams
   3. Avoiding Social Engineering and Phishing Attacks

Mozilla Releases Update to Address URI Sanitization Vulnerability

Mozilla has released an update for the Firefox browser to address two vulnerabilities with URI sanitization.  These vulnerabilities may allow a remote, unauthenticated attacker to execute arbitrary code on an affected system. 

More information regarding these vulnerabilities and the Firefox update can be found in the following:

• Vulnerability Note VU#783400
• Vulnerability Note VU#403150
• Mozilla Foundation Security Advisory 2007-27
• Mozilla Firefox update

Microsoft Windows URI Protocol Handling Vulnerability

US-CERT is aware of a vulnerability in the way Microsoft Windows determines how to handle URIs, which may be be leveraged by a remote attacker to execute arbitrary commands on an affected system.  Public reports demonstrate that Mozilla Firefox can be used to pass malicious URIs to Windows, but other applications may also act as attack vectors for this vulnerability.

More information regarding this vulnerability can be found in Vulnerability Note VU#403150.

Mozilla Firefox URI Sanitization Vulnerability

US-CERT is aware of a vulnerability (VU#783400) in the way Mozilla Firefox passes URIs to registered protocol handlers in Microsoft Windows.  Due to a separate vulnerability (VU#403150) in the way Windows determines how to execute URIs, Firefox could be used as an attack vector to execute arbitrary commands.

More information regarding these vulnerabilities can be found in Vulnerability Notes VU#783400 and VU#403150.

Panda Antivirus Buffer Overflow Vulnerability

US-CERT is aware of a buffer overflow vulnerability in Panda Antivirus. This vulnerability may allow an attacker to execute arbitrary code on a vulnerable system by passing a crafted ".EXE" file to the Panda Antivirus file parsing engine.

It has been reported that an update has been issued through the built in update mechanism to mitigate this vulnerability. US-CERT strongly recommends users verify that their systems are updated.

CA Releases Updates to Address Vulnerabilities in Several Products

Computer Associates has released updates to address vulnerabilities in CA Message Queuing, eTrust Intrusion Detection, and several products that implement the "Arclib" library. These vulnerabilities may allow a remote, unauthenticated attacker to execute arbitrary code or cause a denial-of-service condition on a vulnerable system.

More information regarding these vulnerabilities and which applications are affected can be found in the following Computer Associates Security Notices:

• Security Notice for CA products containing Arclib
• Security Notice for CA Message Queuing (CAM / CAFT) vulnerability
• Security Notice for eTrust Intrusion Detection caller.dll vulnerability