February 25, 2008 - Current Activity

VMware Releases Security Alert

VMware has released a security alert in response to a vulnerability in Windows-hosted VMware Workstation, VMware Player, and VMware ACE. This vulnerability exists in the host-to-guest shared folders feature and allows applications running in the guest operating system to access the host operating system's file system. Exploitation of this vulnerability may allow an attacker to circumvent the controls on the guest system and gain read and write access to the host file system.

US-CERT encourages users to review VMware knowledge base article 1004034 and apply the workarounds.

US-CERT will provide additional information as it becomes available.

Novell iPrint Client Vulnerability

Novell has released an update to address a vulnerability in iPrint Client for Windows.  This vulnerability is due to a buffer overflow in the"ExecuteRequest()" method of the "ienipp.ocx" ActiveX control. Exploitation of this vulnerability may allow a remote attacker to execute arbitrary code on an affected system.

US-CERT encourages users to review Novell document 5008420 and apply the appropriate update for their system.

US-CERT will provide more information as it becomes available.

BEA Releases Security Advisories for Vulnerabilities

BEA has released multiple security advisories to address vulnerabilities in WebLogic, AquaLogic and Plumtree.  These vulnerabilities may allow an attacker to execute arbitrary code, bypass security restrictions, elevate privileges, and obtain sensitive information.

US-CERT encourages users to review the BEA security advisories and apply any necessary updates.

US-CERT will provide more information as it becomes available.

EMC RepliStor Vulnerabilities

US-CERT is aware of reports of multiple vulnerabilities affecting EMC RepliStor. Exploitation of these vulnerabilities may allow a remote, unauthenticated attacker to execute arbitrary code on an affected system.

US-CERT encourages users to review the EMC knowledge base article emc179808 (login required) and apply any necessary updates.

US-CERT will provide more information as it becomes available.

Lunar Eclipse Email Attack

US-CERT is aware of an email attack circulating that is related to the recent lunar eclipse.  The email contains a message indicating that there is a video of  the lunar eclipse available and instructs users to follow a link to download the video.  If a user clicks on this link, an executable file will be downloaded that contains a Trojan program. This Trojan program may allow an attacker to take control of an affected system.

US-CERT encourages users to take the following preventative measures to mitigate the security risks:

• Install anti-virus software and keep virus signatures up-to-date.
• Do not follow unsolicited links.
• Refer to the Recognizing and Avoiding Email Scams document for more information on avoiding email scams.
• Refer to the Avoiding Social Engineering and Phishing Attacks document for more information on social engineering attacks.

Symantec Veritas Storage Foundation Update

Symantec has released an update for Veritas Storage Foundation to address a vulnerability.  This vulnerability is caused by packet handling errors in the Symantec VEA administrative service. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary code, cause a denial-of-service condition, escalate privileges.

US-CERT encourages users to review Symantec Security Advisory SYM08-005 and apply any necessary updates.

US-CERT will provide more information as it becomes available.

Mozilla Firefox and Opera Vulnerability

US-CERT is aware of public reports of a vulnerability in Mozilla Firefox and Opera web browsers.  This vulnerability is caused by improper handling of bitmap image files (.bmp). By sending a specially crafted bitmap image file to the browser, an attacker may be able to obtain sensitive information or cause a denial-of-service condition.

US-CERT encourages Mozilla Firefox users to upgrade to Firefox 2.0.0.12 and Opera users to upgrade to Opera 9.25.

US-CERT will provide more information as it becomes available.

Public Exploit Code for Microsoft Works Vulnerabilities

US-CERT is aware of reports of publicly available exploit code for vulnerabilities in Microsoft Works 6 File Converter. By convincing a user to open a specially crafted Works file, an attacker may be able to execute arbitrary code on an affected system. This vulnerability was addressed in Microsoft Security Bulletin MS08-011.

US-CERT reminds users to review Microsoft Security Bulletin MS08-011 and apply any necessary updates or workarounds. 

Email Attacks Circulating

US-CERT is aware of reports of several email attacks circulating.

The first of these attacks is related to the U.S. presidential election. The email contains a message indicating that there is a video of a candidate interview available and instructs users to follow a link to download the video. If a user clicks on this link, an executable file will be downloaded that contains the Trojan "Trojan.Srizbi."

The second attack is a phishing scam related to the U.S. Internal Revenue Service. Messages promising faster or larger refunds may request that users provide personal information or may contain links to phishing websites.

US-CERT encourages users to take the following preventative measures to mitigate the security risks:

• Install anti-virus software and keep virus signature files up-to-date.
• Do not follow unsolicited links.
  
• Block executable and unknown file types at the email gateway.
• Refer to the Recognizing and Avoiding Email Scams document for more information on avoiding email scams.
• Refer to the Avoiding Social Engineering and Phishing Attacks document for more information on social engineering attacks.

Public Exploit for Local Linux Kernel Vulnerability

US-CERT has received information that public exploit information is available for a vulnerability affecting Linux kernels 2.6.17 to 2.6.24.1. These kernel versions contain a buffer overflow vulnerability in the get_user_pages function which may allow an unprivileged local attacker to gain root privileges.

US-CERT encourages users to upgrade to Linux kernel version 2.6.24.2.

US-CERT will provide more information as it becomes available.