November 07, 2007 - Current Activity

Apple Releases Security Update to Address Multiple QuickTime Vulnerabilities

Apple has released QuickTime 7.3 to address multiple vulnerabilities in QuickTime.  The impacts of these vulnerabilities include arbitrary code execution and denial of service.

More information about these vulnerabilities can be found in the following:

• Technical Cyber Security Alert TA-07-310A
• Apple Article 306896

Mac OS X Leopard Firewall Changes

Apple's Mac OS X Leopard includes an application-based firewall feature. US-CERT is aware of ambiguities in the way the firewall components supplied with Leopard report the status of the firewall configuration. Users may be misinformed of the status of their firewall rule set, thus placing listening network services at an increased risk.

Users are urged to exercise caution when relying on the firewall rules for access control.

US-CERT will provide additional information as it becomes available.

Microsoft Releases Security Advisory to Address Macrovision Vulnerability

Microsoft has released Security Advisory 944653 to address a vulnerability found in the Macrovision "secdrv.sys" driver included with Windows Server 2003 and Windows XP.  The "secdrv.sys" driver fails to properly handle configuration parameters and may allow a local attacker to gain escalated privileges on an affected system.

US-CERT strongly encourages users to review both Microsoft Security Advisory 944653 and the Macrovision update and apply the update provided by Macrovision.

US-CERT will provide further information as it becomes available.

Mac DNS Changer Trojan

US-CERT is aware of a Mac DNS changer Trojan. If executed, this Trojan will change the DNS settings of a user's machine and then report back to a command and control server. The Trojan appears as a DMG archive file which, if downloaded and installed, will run the Trojan on a user's system.

More information regarding this Trojan can be found in the SANS Internet Storm Center.

US-CERT urges users and administrators to take the following preventative measures to mitigate the security risks:

• Install anti-virus software, and keep its virus signature files up-to-date.
• Block executable and unknown file types at the email gateway.
• Refer to the Recognizing and Avoiding Email Scams document for more information on avoiding email scams.
• Refer to the Avoiding Social Engineering and Phishing Attacks document for more information on social engineering attacks.

Federal Trade Commission Spoofed Email

US-CERT is aware of fraudulent email messages purporting to be from the Federal Trade Commission's (FTC) "Fraud Department".  These messages refer to a complaint filed against the email's recipient and appear to be from "frauddep@ftc.gov". The email messages contain a link to malicious software and should not be followed. Please see the Federal Trade Commission website for additional information.

More information can also be found in the US-CERT Cyber Security Alert SA07-303A.

US-CERT encourages users to take the following preventative measures to help mitigate this risk:

• Do not follow unsolicited links in email messages.
• Install anti-virus software, and keep its virus signature files up-to-date.
• Review the Reducing Spam Cyber Security Tip.
• Review the Avoiding Social Engineering and Phishing Attacks Cyber Security Tip.

Active Exploitation of Microsoft Windows URI Protocol Handling Vulnerability

Microsoft has released a revision to Microsoft Security Advisory (943521), which was previously reported by US-CERT in the Microsoft Windows URI Protocol Handling Vulnerability Current Activity. This revision states that because of an active exploitation the severity rating has been increased.

More information regarding this vulnerability can be found in the following:

• Vulnerability Note VU#403150
• Microsoft Security Advisory
• MSRC Blog
  

New Storm Worm Variant Disables Security Software

US-CERT is aware of a new Storm Worm variant. Functionality in this variant can cause certain types of programs, including anti-virus and network access control programs, to appear as if they are functioning correctly, though the process(es) have been disabled by the worm.

More information can be found in the eWEEK Security News and Sophos Security Information Blog.

US-CERT urges users and administrators to take the following preventative measures to mitigate the security risks:

• Install anti-virus software, and keep its virus signature files up-to-date.
• Block executable and unknown file types at the email gateway.
• Refer to the Recognizing and Avoiding Email Scams document for more information on avoiding email scams.
• Refer to the Avoiding Social Engineering and Phishing Attacks document for more information on social engineering attacks.