December 19, 2007 - Current Activity

MSRC Releases Update to MS07-069

The Microsoft Security Response Center(MSRC) has released an update to MS07-069 to address an installation error on Windows XP Service Pack 2. After installation, Internet Explorer 6 may stop responding when visiting a web site.

More information regarding this issue can be found in:

• MSRC Blog
• Microsoft Knowledge Base article KB942615

Cisco Releases Security Advisory to Address Vulnerability

Cisco has released Security Advisory cisco-sa-20071219-fwsm to address a vulnerability in the Cisco Firewall Services Module (FWSM). The Advisory states that only FWSM System Software Version 3.2(3) is affected. This vulnerability may lead to a denial-of-service condition.

More information regarding this vulnerability and workaround information can be found in Cisco Security Advisory cisco-sa-20071219-fwsm.

Adobe Flash Player Vulnerabilities

Adobe has released updates described in the Adobe Security bulletin to address multiple vulnerabilities in Flash Player. The impacts of these vulnerabilities include arbitrary code execution, privilege escalation, and cross-site scripting. The Adobe Security bulletin states that all platforms running a vulnerable version of Flash Player are affected.

Note that CVE-2007-4324 was addressed by providing additional functionality to ActionScript, which mitigates this vulnerability. See Adobe kb402956 for more information regarding this specific CVE.

More information regarding the vulnerabilities and remediation information can be found in:

• Adobe Security bulletin

Apple Releases Security Updates to Address Multiple Vulnerabilities

Apple has released Security Update 2007-009 to address multiple vulnerabilities. The impacts of these vulnerabilities include arbitrary code execution, denial of service, information disclosure, cross-site scripting, privilege escalation, and authentication bypass.

More information regarding the vulnerabilities and remediation information can be found in:

• Technical Cyber Security Alert TA07-352A
• Vulnerability Notes Database
• Apple Support Article ID: 307179

HP Info Center Software Public Exploit Code

US-CERT is aware of a vulnerability affecting HP Info Center Software, which allows one-touch access to features on HP laptops. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary commands or to view or alter the system registry on affected systems.

These reports also refer to publicly available exploit code for this vulnerability.

HP has published an HP Quick Launch Buttons Critical Security Update  to address this issue.  US-CERT encourages users to apply this update to mitigate this risk.

Apple Releases Security Update to Address Multiple Vulnerabilities in QuickTime

Apple has released a Security Update to address multiple vulnerabilities in QuickTime. The impacts of these vulnerabilities include arbitrary code execution and denial of service.

More information may be found in the Apple Security Update and in Vulnerability Note VU#659761.

US-CERT encourages users to apply the appropriate updates as soon as possible.

Microsoft Releases December Security Bulletins

Microsoft has released updates to address vulnerabilities in Windows,  DirectX, DirectShow, Windows Media Format Runtime, and Internet Explorer as part of the Microsoft Security Bulletin Summary for December 2007.

More information about these vulnerabilities can be found in Technical Cyber Security Alert TA07-345A.

US-CERT strongly encourages users to review the bulletins and follow best-practice security policies to determine which updates should be applied.