December 20, 2007 - Current Activity

Google Orkut Worm

US-CERT is aware of public reports of a worm propagating via Google's social network, Orkut. It has been reported that this worm spreads by sending messages to Orkut users. When a user visits an infected Orkut profile, the user becomes infected by a "scrap" that references a remote, malicious javascript file (virus.js).

US-CERT urges users to take the following preventative measures to mitigate the security risks:

• Install anti-virus software, and keep its virus signature files up-to-date.
  
• Block executable and unknown file types at the email gateway.
• Refer to the Avoiding Social Engineering and Phishing Attacks document for more information on social engineering attacks. 

MSRC Releases Update to MS07-069

The Microsoft Security Response Center(MSRC) has released an update to MS07-069 to address an installation error on Windows XP Service Pack 2. After installation, Internet Explorer 6 may stop responding when visiting a web site.

More information regarding this issue can be found in:

• MSRC Blog
• Microsoft Knowledge Base article KB942615

Cisco Releases Security Advisory to Address Vulnerability

Cisco has released Security Advisory cisco-sa-20071219-fwsm to address a vulnerability in the Cisco Firewall Services Module (FWSM). The Advisory states that only FWSM System Software Version 3.2(3) is affected. This vulnerability may lead to a denial-of-service condition.

More information regarding this vulnerability and workaround information can be found in Cisco Security Advisory cisco-sa-20071219-fwsm.

Adobe Flash Player Vulnerabilities

Adobe has released updates described in the Adobe Security bulletin to address multiple vulnerabilities in Flash Player. The impacts of these vulnerabilities include arbitrary code execution, privilege escalation, and cross-site scripting. The Adobe Security bulletin states that all platforms running a vulnerable version of Flash Player are affected.

Note that CVE-2007-4324 was addressed by providing additional functionality to ActionScript, which mitigates this vulnerability. See Adobe kb402956 for more information regarding this specific CVE.

More information regarding the vulnerabilities and remediation information can be found in:

• Adobe Security bulletin

Apple Releases Security Updates to Address Multiple Vulnerabilities

Apple has released Security Update 2007-009 to address multiple vulnerabilities. The impacts of these vulnerabilities include arbitrary code execution, denial of service, information disclosure, cross-site scripting, privilege escalation, and authentication bypass.

More information regarding the vulnerabilities and remediation information can be found in:

• Technical Cyber Security Alert TA07-352A
• Vulnerability Notes Database
• Apple Support Article ID: 307179

HP Info Center Software Public Exploit Code

US-CERT is aware of a vulnerability affecting HP Info Center Software, which allows one-touch access to features on HP laptops. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary commands or to view or alter the system registry on affected systems.

These reports also refer to publicly available exploit code for this vulnerability.

HP has published an HP Quick Launch Buttons Critical Security Update  to address this issue.  US-CERT encourages users to apply this update to mitigate this risk.

Apple Releases Security Update to Address Multiple Vulnerabilities in QuickTime

Apple has released a Security Update to address multiple vulnerabilities in QuickTime. The impacts of these vulnerabilities include arbitrary code execution and denial of service.

More information may be found in the Apple Security Update and in Vulnerability Note VU#659761.

US-CERT encourages users to apply the appropriate updates as soon as possible.