February 06, 2008 - Current Activity

Fraudulent Microsoft Update Web Site

US-CERT is aware of a fraudulent Microsoft Update web site. This web site contains an "Urgent Install" button that, when clicked, attempts to download and install malicious software on a user's system. The file that attempts to download is not signed by Microsoft and is called "WindowsUpdateAgent30-x86-x64.exe". Of further interest, this web site is using fast flux DNS for its web hosting.

US-CERT urges users and administrators to take the following preventative measures to mitigate the security risks:

• Install anti-virus software, and keep its virus signature files up-to-date.
• Do not follow unsolicited web links received in email messages.
• Verify the web site by manually typing the URL when attempting to connect to web sites recommended in an email.
• Refer to the Avoiding Social Engineering and Phishing Attacks document for more information on social engineering attacks.
• Follow the guidance provided in the Recognize and avoid fraudulent e-mail to Microsoft customers document from Microsoft.
  

Apple Releases Security Update to Address iPhoto Vulnerability

Apple has released iPhoto 7.1.2 to address a vulnerability in this product. This vulnerability may allow a remote attacker to execute arbitrary code on a vulnerable system.

US-CERT encourages users to review Apple Article 307398 and apply the update as soon as possible.

Yahoo! Music Jukebox ActiveX Buffer Overflow Vulnerabilities

US-CERT is aware of publicly available exploit code for vulnerabilities affecting Yahoo! Music Jukebox. These vulnerabilities are caused by buffer overflows in the Yahoo! MediaGrid ActiveX control and the YMP Datagrid ActiveX control. Successful exploitation of these vulnerabilities may allow a remote attacker to execute arbitrary code on a vulnerable system.

More information regarding these vulnerabilities can be found in Vulnerability Notes VU#101676 and VU#340860.

US-CERT encourages users to Disable ActiveX controls as described in the Securing Your Web Browser document.

Publicly Available Exploit for Facebook and MySpace Image Uploader Vulnerability

US-CERT is aware of publicly available exploit code for an unpatched vulnerability affecting an image uploader used by Facebook and MySpace. This vulnerability is caused by a buffer overflow in Aurigma's ImageUploader ActiveX control. Successful exploitation of this vulnerability may allow an attacker to execute arbitrary code on an affected system.

More information regarding this vulnerability can be found in Vulnerability Note VU#776931.

US-CERT encourages users to Disable ActiveX controls as described in the Securing Your Web Browser document.

US-CERT will continue to investigate and provide additional information as it becomes available.

Department of Justice Phishing Campaign

US-CERT has received reports of a phishing campaign that involves targeted email messages claiming to be from the Department of Justice. The emails include messaging that is designed to convince recipients that they are the subject of a business complaint filed through the Department of Justice. Initial reports indicate that as many as 20,000 users, representing a wide range of companies in the US, Canada, and Australia, have been targeted.

The reports also indicate that a Department of Justice template is being used in these attacks.  The Department of Justice released a statement on its website indicating that it does not, and would not send that type of information to the public via email.  The statement includes an example of the template being used.

To help protect against this type of attack, US-CERT recommends that users never open attachments or click links contained in unsolicited email messages. More information on how to avoid becoming a victim of such an attack can be found in the US-CERT Cyber Security Tips Using Caution with Email Attachments and Avoiding Social Engineering and Phishing Attacks.  

Possible Department of Justice Phishing Campaign

US-CERT has received information indicating that a phishing campaign involving targeted malicious email messages may be imminent. The messages may attempt to convince users that they are the subject of a business complaint filed through the Department of Justice, and could include a malicious attachment or a link to a malicious website.

To help protect against this type of attack, US-CERT recommends that users never open attachments or click links contained in unsolicited email messages. More information on how to avoid becoming a victim of such an attack can be found in the US-CERT Cyber Security Tips Using Caution with Email Attachments and Avoiding Social Engineering and Phishing Attacks .

Communication Interruption Due to Mediterranean Cable Break

Internet and voice communications in many countries have been interrupted by a break in the Mediterranean cable that provides those services.  Reports are stating that repairs may take considerable time to complete and that other methods of connectivity are being implemented.

This event may affect communications for the following countries:

• Pakistan
• Egypt
• Maldives
• Kuwait
• Lebanon
• Algeria
• Sudan
• UAE
• Syria
• Saudi Arabia
• Bahrain
• India

• CNN.com Feature Article
• Renesys Blog

Storm Worm Directing Users to Medical Spam Web Sites

US-CERT is aware of a variant of the Storm Worm that sends unsolicited email messages to users and attempts to evade spam filtering. When a user receives this email message, it will contain a link in the format of:

http://<IP Address>/<random directory name>

The link directs the user to a website containing spam about medical information.

US-CERT urges users and administrators to take the following preventative measures to mitigate the security risks:

• Install anti-virus software, and keep its virus signature files up-to-date.
• Block executable and unknown file types at the email gateway.
• Refer to the Recognizing and Avoiding Email Scams document for more information on avoiding email scams.
• Refer to the Avoiding Social Engineering and Phishing Attacks document for more information on social engineering attacks.

Cisco Releases Security Advisories to Address a Vulnerability in the Cisco Wireless Control System

Cisco has released Security Advisory cisco-sa-20080130-wcs to address a vulnerability in the Wireless Control System. The vulnerability exists in the Apache Tomcat URI handler and may allow a remote, unauthenticated attacker to execute arbitrary code on an affected system.

More information and workarounds regarding this vulnerability can be found in the Cisco Security Advisory cisco-sa-20080130-wcs.

GE Fanuc Product Vulnerabilities

Vulnerabilities in GE Fanuc CIMPLICITY and Proficy Real-Time Information Portal could allow an attacker to execute arbitrary code, obtain user credentials, upload and execute arbitrary files, or cause a denial-of-service condition.

US-CERT encourages users to review the following:

• Vulnerability Notes Database
• GE Fanuc Proficy Real-Time Information Portal allows arbitrary file upload and execution (KB12460)
• GE Fanuc Proficy Real-Time Information Portal transmits authentication credentials in plain text (KB12459)
• Buffer Overflow Allows Remote Code Execution (KB12458)