February 14, 2008 - Current Activity

Email Attacks Circulating

US-CERT is aware of reports of several email attacks circulating.

The first of these attacks is related to the U.S. presidential election. The email contains a message indicating that there is a video of a candidate interview available and instructs users to follow a link to download the video. If a user clicks on this link, an executable file will be downloaded that contains the Trojan "Trojan.Srizbi."

The second attack is a phishing scam related to the U.S. Internal Revenue Service. Messages promising faster or larger refunds may request that users provide personal information or may contain links to phishing websites.

US-CERT encourages users to take the following preventative measures to mitigate the security risks:

• Install anti-virus software and keep virus signature files up-to-date.
• Do not follow unsolicited links.
  
• Block executable and unknown file types at the email gateway.
• Refer to the Recognizing and Avoiding Email Scams document for more information on avoiding email scams.
• Refer to the Avoiding Social Engineering and Phishing Attacks document for more information on social engineering attacks.

Public Exploit for Local Linux Kernel Vulnerability

US-CERT has received information that public exploit information is available for a vulnerability affecting Linux kernels 2.6.17 to 2.6.24.1. These kernel versions contain a buffer overflow vulnerability in the get_user_pages function which may allow an unprivileged local attacker to gain root privileges.

US-CERT encourages users to upgrade to Linux kernel version 2.6.24.2.

US-CERT will provide more information as it becomes available.

Adobe Flash Media Server Vulnerabilities

Adobe has released Flash Media Server 2.0.5 to address multiple vulnerabilities. These vulnerabilities may allow a remote attacker to execute arbitrary code or cause a denial-of-service condition.

US-CERT encourages users to review the Flash Media Server 2.0.5 release notes and update to Flash Media Server 2.0.5 to help mitigate the risks.

US-CERT will provide more information as it becomes available.

Cisco Releases Security Advisories for Vulnerabilities

Cisco has released security advisories in response to multiple vulnerabilities.

Cisco Security Advisory cisco-sa-20080213-phone was released in response to vulnerabilities in Cisco Unified IP Phone. These vulnerabilities may allow an attacker to execute arbitrary code or cause a denial-of-service condition.

Cisco Security Advisory cisco-sa-20080213-cucmsql was released in response to a vulnerability in Cisco Unified Communications Manager. This vulnerability may allow an attacker to obtain sensitive information.

US-CERT encourages users to do the following:

• Review Cisco Security Advisory cisco-sa-20080213-phone
• Review Cisco Security Advisory cisco-sa-20080213-cucmsql
• Apply software updates and workarounds provided by Cisco

Microsoft Releases February Security Bulletin

Microsoft has released updates to address vulnerabilities in Microsoft Windows, Office, Visual Basic, VBScript, JScript, Internet Explorer, IIS, Active Directory, ADAM, Office, Works, and Works Suite as part of the Microsoft Security Bulletin Summary for February 2008.

More information about these vulnerabilities can be found in Technical Cyber Security Alert TA08-043C and in the Vulnerability Notes Database.

US-CERT strongly encourages users to review the bulletins and follow best-practice security policies to determine which updates should be applied.

Apple Releases Security Updates for Multiple Vulnerabilities

Apple has released Security Update 2008-001 and Mac OS X 10.5.2  to address multiple vulnerabilities in Mac OS X and related products.  The impacts of these vulnerabilities include remote code execution, denial of service, and information disclosure.

US-CERT encourages users to apply the appropriate updates as soon as possible.

More information about these vulnerabilities is located in the Vulnerability Notes Database and in Technical Cyber Security Alert TA08-043B.

Active Exploitation of Adobe Reader Vulnerabilities

US-CERT has received information that vulnerabilities affecting Adobe Reader are actively being exploited.  These vulnerabilities are exploited through a maliciously crafted PDF file containing a variant of the Zonebac Trojan. 

US-CERT strongly urges users to take the following steps:

• Update to Adobe Reader 8.1.2.
• Review Adobe Knowledgebase Article kb403079.
• Disable the displaying of PDF documents in the web browser by performing the following steps:
  
  1. Open Adobe Reader.
  2. Open the Edit menu.
  3. Choose the preferences option.
  4. Choose the Internet section.
  5. Un-check the "Display PDF in browser" check box.

Mozilla Firefox view-source Information Disclosure Vulnerability

US-CERT is aware of public reports of a vulnerability in Mozilla Firefox 2.0.0.12.  This vulnerability may allow an attacker to read files from the Firefox installation directory, which may include some add-ons.

US-CERT encourages users to install the NoScript add-on to help mitigate the risks and will provide more information as it becomes available.

Trojan Spreading via MSN Messenger

There are reports of a Trojan spreading via MSN Messenger.  The Trojan arrives as a chat message with a link to a web site. This website links to an executable file. These messages may appear to come from a known contact.

US-CERT urges users and administrators to take the following preventative measures to help mitigate the security risks:

• Install anti-virus software, and keep virus signature files up-to-date.
• Refer to the Avoiding Social Engineering and Phishing Attacks document for more information on social engineering attacks.

Mozilla Releases Updates to Address Vulnerabilities in Multiple Products

Mozilla has released Firefox 2.0.0.12, Thunderbird 2.0.0.12, and SeaMonkey 1.1.8 to address multiple vulnerabilities. The impacts of these vulnerabilities include arbitrary code execution, denial of service, cross-site scripting, directory traversal, and information disclosure.

More information regarding these vulnerabilities and updated products can be found at the Mozilla Foundation Security Advisory web site and in the Vulnerability Notes Database.

US-CERT will continue to investigate and provide additional information as it becomes available.