August 09, 2007 - Current Activity

Microsoft Releases Advance Notification for August Security Bulletins

Microsoft has issued a Security Bulletin Advance Notification indicating that their August release cycle will contain nine bulletins, some of which have a maximum rating of Critical. The notification further states that the bulletins affect Windows, Visual Basic, Internet Explorer, Windows Vista, Virtual PC, and Virtual Server. The release is scheduled for August 14, 2007.

US-CERT will provide additional information as it becomes available.

Multiple Symantec Products ActiveX Control Vulnerabilities

Symantec has released an update to mitigate an input validation error in two ActiveX controls used by Norton AntiVirus, Norton Internet Security, and Norton System Works. By enticing a user to view a specially crafted HTML document, an attacker may be able to execute arbitrary code on an affected system.

More information regarding these vulnerabilities can be found in Symantec Advisory SYM07- 021.

US-CERT recommends the following actions to help mitigate the security risk:

• Apply the update as described in Symantec Advisory SYM07-021
• Disable ActiveX as described in the Securing Your Web Browser document
  
  

Cisco Releases Security Advisories for Multiple Vulnerabilities in IOS and Unified Communications Manager

Cisco has issued four Security Advisories to address several vulnerabilities in their Internetwork Operating System (IOS) and Unified Communications Manager. These vulnerabilities may allow an attacker to overwrite or retrieve arbitrary files, cause a denial-of-service condition, or execute arbitrary code on an affected system. US-CERT is aware of publicly available exploit code for one of these vulnerabilities.

More information regarding these vulnerabilities can be found in the following:

• Cisco Security Advisory: Cisco IOS Secure Copy Authorization Bypass Vulnerability
• Cisco Security Advisory: Cisco IOS Next Hop Resolution Protocol Vulnerability
• Cisco Security Advisory: Cisco IOS Information Leakage Using IPv6 Routing Header
• Cisco Security Advisory: Voice Vulnerabilities in Cisco IOS and Cisco Unified Communications Manager

Apple Releases Update for iPhone

Apple has released an update to address several vulnerabilities in the iPhone. These vulnerabilities may allow an attacker to execute arbitrary code or conduct cross-site scripting attacks on an affected device. 

More information about these vulnerabilities and the iPhone v1.0.1 update can be found in the Apple update advisory.

US-CERT strongly encourages users to review the advisory and follow best-practice security policies to determine what updates should be applied.

US-CERT Warns Public of Fraudulent Phishing Email

US-CERT is aware of a recent surge in fraudulent phishing e-mail messages.  The messages, claiming to be from the United States National Medical Association, contain a subject line that reads "The United States National Medical Association" and a link that, when followed, will direct the user to a malicious website.  These messages are not from any United States government agency.

Users are encouraged to take the following measures to protect themselves from phishing attacks:
    * Do not follow unsolicited web links received in email messages.
    * Verify the legitimacy of the email by contacting the company or agency directly through a trusted contact number.
    * Visit the Anti-Phishing Working Group for more information on known phishing attacks.

For additional information regarding phishing, US-CERT recommends reading the following documents:
   1. Technical Trends in Phishing Attacks
   2. Recognizing and Avoiding Email Scams
   3. Avoiding Social Engineering and Phishing Attacks

Mozilla Releases Update to Address URI Sanitization Vulnerability

Mozilla has released an update for the Firefox browser to address two vulnerabilities with URI sanitization.  These vulnerabilities may allow a remote, unauthenticated attacker to execute arbitrary code on an affected system. 

More information regarding these vulnerabilities and the Firefox update can be found in the following:

• Vulnerability Note VU#783400
• Vulnerability Note VU#403150
• Mozilla Foundation Security Advisory 2007-27
• Mozilla Firefox update

Microsoft Windows URI Protocol Handling Vulnerability

US-CERT is aware of a vulnerability in the way Microsoft Windows determines how to handle URIs, which may be be leveraged by a remote attacker to execute arbitrary commands on an affected system.  Public reports demonstrate that Mozilla Firefox can be used to pass malicious URIs to Windows, but other applications may also act as attack vectors for this vulnerability.

More information regarding this vulnerability can be found in Vulnerability Note VU#403150.