August 29, 2007 - Current Activity

Quiksoft EasyMail SMTP ActiveX Control Vulnerabilities

US-CERT is aware of publicly available exploit code for vulnerabilities in the Quiksoft EasyMail SMTP ActiveX control. This control is packaged with several applications, including Earthlink internet access software. These stack buffer overflow vulnerabilities may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. 

More information about this vulnerability can be found in the Vulnerability Note VU#281977.

US-CERT recommends the workarounds as described in Vulnerability Note VU#281977 to help mitigate the security risks.

Cisco Releases Security Advisory for Vulnerabilities in Cisco CallManager and Unified Communications Manager

Cisco has issued a Security Advisory to address vulnerabilities in their CallManager and Unified Communications Manager products. These vulnerabilities may allow an attacker to perform cross-site scripting or SQL injection attacks.

More information regarding these vulnerabilities can be found in the Cisco Security Advisory: XSS and SQL Injection in Cisco CallManager/Unified Communications Manager Logon Page.

US-CERT strongly recommends that administrators review the Cisco Security Advisory above and follow best-practice security policies to determine what updates or workarounds should be applied.

Several New Storm Worm Trojan Propagation Techniques

US-CERT is aware of several new propagation techniques being used by the Storm Worm Trojan to spread. The new variants arrive as an email message claiming to contain a link to adult pictures, an erroneous YouTube video link, or as credentials for a membership-based website, asking you to login to change your temporary ID and password. The messages contain links to malicious websites that when visited, install malware on the user's system.

The latest variations may contain some of the following subject lines:

• Dude, what if you wife finds this?
• lol, what are you doing?
• I can't believe you did this
• LOL, that is too cool....
• Sheesh man, what are you thinkin...
• LMAO, your crazy man
  

• Do not follow unsolicited links.
• Configure your web browser as described in the Securing Your Web Browser document.
  
• Install anti-virus software, and keep its virus signature files up-to-date.
• Refer to the Recognizing and Avoiding Email Scams document for more information on avoiding email scams.
• Refer to the Avoiding Social Engineering and Phishing Attacks document for more information on social engineering attacks.
  

MSN Messenger Web Camera Stream Vulnerability

MSN Messenger and Windows Live Messenger contain a heap overflow in the handling of malformed webcam streams. By convincing a user to accept a webcam invitation, a remote attacker may be able to execute arbitrary code with the privileges of the user on an affected system.

US-CERT is aware of publicly available exploit code for this vulnerability.

More information regarding this vulnerability can be found in Vulnerability Note VU#166521.

US-CERT recommends users upgrade to Windows Live Messenger 8.1 to mitigate the security risk.

Multiple Vulnerabilities in Trend Micro Products

Trend Micro has released updates to address several vulnerabilities in their ServerProtect, AntiSpyware, and PC-cillin Internet Security products. By sending a crafted RPC request or creating a file on the local file system with an overly long path, an attacker may be able to cause a denial-of-service condition or execute arbitrary code on an affected system.

US-CERT is aware of reports of activity that may indicate attempts to exploit one or more of these vulnerabilities.

More information regarding the vulnerabilities, affected products, and fixes can be found in the following:

• Technical Cyber Security Alert TA07-235A
• Vulnerability Notes Database
• ServerProtect Security Patch 4 - Build 1185 README
• Trend Micro Solution Detail 1035845
  

Yahoo! Messenger Web Camera Invitation Handling Vulnerability

US-CERT is aware of a publicly reported heap overflow vulnerability in Yahoo! Messenger. By enticing a user to accept a specially crafted web camera invitation, a remote attacker may be able to cause a a denial-of-service condition or execute arbitrary code on an affected system.

More information regarding this vulnerability can be found in Vulnerability Note VU#515968.

Until a fix is available, US-CERT recommends that users reject all web camera invitations and block outgoing network traffic on TCP port 5100.

Cisco Releases Security Advisory for Vulnerabilities in Cisco VPN Client

Cisco has issued a Security Advisory to address two vulnerabilities in their VPN Client for Microsoft Windows. These vulnerabilities may allow an attacker to elevate privileges on an affected system.

More information regarding these vulnerabilities can be found in the Cisco Security Advisory: Local Privilege Escalation Vulnerabilities in Cisco VPN Client.

US-CERT strongly recommends that administrators review the Cisco Security Advisory above and follow best-practice security policies to determine what updates or workarounds should be applied.