August 16, 2007 - Current Activity

Yahoo! Messenger Web Camera Invitation Handling Vulnerability

US-CERT is aware of a publicly reported heap overflow vulnerability in Yahoo! Messenger. By enticing a user to accept a specially crafted web camera invitation, a remote attacker may be able to cause a a denial-of-service condition or execute arbitrary code on an affected system.

Until a fix is available, US-CERT recommends that users reject unsolicited web camera invitations and block outgoing network traffic on TCP port 5100.

US-CERT will continue to investigate and will provide additional information as it becomes available.

Cisco Releases Security Advisory for Vulnerabilities in Cisco VPN Client

Cisco has issued a Security Advisory to address two vulnerabilities in their VPN Client for Microsoft Windows. These vulnerabilities may allow an attacker to elevate privileges on an affected system.

More information regarding these vulnerabilities can be found in the Cisco Security Advisory: Local Privilege Escalation Vulnerabilities in Cisco VPN Client.

US-CERT strongly recommends that administrators review the Cisco Security Advisory above and follow best-practice security policies to determine what updates or workarounds should be applied.

Microsoft Releases August Security Bulletins

Microsoft has released updates to address vulnerabilities in Windows, Windows Media Player, Windows Gadgets, Office, Excel, Internet Explorer, Visual Basic, Virtual Sever, and Virtual PC as part of the Microsoft Security Bulletin Summary for August 2007.

More information about these vulnerabilities is located in the Vulnerability Notes Database and Technical Cyber Security Alert TA07-226A.

US-CERT strongly encourages users to review the bulletins and follow best-practice security policies to determine what updates should be applied.

Storm Worm Variant Continues to Spread

US-CERT is aware of public reports that the Storm Worm variant, previously reported in the US-CERT Current Activity on 29-June-2007, is currently on the rise. This variant of the Storm Worm arrives as an email message and contains a link to a malicious website that, when visited, installs malware on the user's system. The subject line of the email message may contain one of the examples listed in these US-CERT Current Activity 16-April-2007 and 20-January-2007 documents.

US-CERT urges users and administrators to take the following preventative measures to mitigate the security risks:

• Install anti-virus software, and keep its virus signature files up-to-date.
• Block executable and unknown file types at the email gateway.
• Refer to the Recognizing and Avoiding Email Scams document for more information on avoiding email scams.
• Refer to the Avoiding Social Engineering and Phishing Attacks document for more information on social engineering attacks.
  
  
  

Publicly Available Exploit for Microsoft FlashPix ActiveX Control

US-CERT is aware of publicly available exploit code for a buffer overflow vulnerability in the Microsoft DirectX Media 6.0 SDK FlashPix ActiveX control. This vulnerability may allow a remote, unauthenticated attacker to cause a denial-of-service condition or execute arbitrary code on an affected system by convincing a user to view a specially crafted HTML document.    

More information can be found in Vulnerability Note VU#466601.

US-CERT encourages users to Disable ActiveX controls as described in the Securing Your Web Browser document.

Microsoft Releases Advance Notification for August Security Bulletins

Microsoft has issued a Security Bulletin Advance Notification indicating that their August release cycle will contain nine bulletins, some of which have a maximum rating of Critical. The notification further states that the bulletins affect Windows, Visual Basic, Internet Explorer, Windows Vista, Virtual PC, and Virtual Server. The release is scheduled for August 14, 2007.

US-CERT will provide additional information as it becomes available.

Multiple Symantec Products ActiveX Control Vulnerabilities

Symantec has released an update to mitigate an input validation error in two ActiveX controls used by Norton AntiVirus, Norton Internet Security, and Norton System Works. By enticing a user to view a specially crafted HTML document, an attacker may be able to execute arbitrary code on an affected system.

More information regarding these vulnerabilities can be found in Symantec Advisory SYM07- 021.

US-CERT recommends the following actions to help mitigate the security risk:

• Apply the update as described in Symantec Advisory SYM07-021
• Disable ActiveX as described in the Securing Your Web Browser document