May 15, 2008 - Current Activity

United States Tax Court Spear-Phishing Attack

US-CERT is aware of public reports of a spear-phishing attack circulating via email messages that claim to be petitions from the US Tax Court. These messages appear to be legitimate because they may contain very specific information about the message recipient. The message requests that the user follow a link to download additional information about the petition, but if a user clicks on this link, malicious code may be installed on the system.

US-CERT encourages users to do the following to help mitigate the risk:

• Review the alert posted by the United States Tax Court regarding this issue.
• Do not follow unsolicited web links received in email messages.
• Refer to the Recognizing and Avoiding Email Scams (pdf) document for more information on avoiding email scams.
• Refer to the Avoiding Social Engineering and Phishing Attacks document for more information on social engineering attacks.
• Install anti-virus software and keep virus signature files up to date.

Debian and Ubuntu OpenSSL and OpenSSH Vulnerabilities

Debian and Ubuntu have released multiple security advisories to address vulnerabilities in their OpenSSL package and other cryptographic application packages that rely on it. These vulnerabilities are due to weaknesses in the random number generator that is used to create SSL and SSH cryptographic keys. As a result of the vulnerability, the keys generated using the flawed OpenSSL package may be weak. Exploitation of these vulnerabilities may allow a remote, unauthenticated attacker to conduct brute force attacks and obtain sensitive information. These vulnerabilities may affect any Debian-based systems, such as Ubuntu, and may indirectly affect other systems if these weak keys have been imported into them.

US-CERT encourages users to review the following advisories and apply any necessary workarounds or updates:

• Debian Security Advisory DSA-1571-1
• Debian Security Advisory DSA-1576-1
• Ubuntu Security Notice USN-612-1
• Ubuntu Security Notice USN-612-2
• Ubuntu Security Notice USN-612-3
• Ubuntu Security Notice USN-612-4
• Ubuntu Security Notice USN-612-5
• Ubuntu Security Notice USN-612-6

Cisco Releases Security Advisories

Cisco has released three security advisories to address vulnerabilities in Cisco Unified Communications Manager, Unified Presence, and the Content Switching Module. These vulnerabilities may allow an attacker to cause a denial-of-service condition on the affected system.

US-CERT encourages users to review the following Cisco Security Advisories and apply any necessary updates or workarounds:

• Cisco Unified Communications Manager Denial of Service Vulnerabilities - cisco-sa-20080514-cucmdos
• Cisco Unified Presence Denial of Service Vulnerabilities - cisco-sa-20080514-cup
• Cisco Content Switching Module Memory Leak Vulnerability - cisco-sa-20080514-csm

Microsoft Releases May Security Bulletin

Microsoft has released updates to address vulnerabilities in Microsoft Windows, Office, Live OneCare, Antigen, Windows Defender, and Forefront Security as part of the Microsoft Security Bulletin Summary for May 2008. These vulnerabilities may allow an attacker to execute arbitrary code or cause a denial-of-service condition.

US-CERT encourages users to review the bulletins and follow best-practice security policies to determine which updates should be applied.

Mozilla Releases Thunderbird 2.0.0.14

Mozilla has released Thunderbird 2.0.0.14 to address multiple vulnerabilities. These vulnerabilities may allow an attacker to escalate privileges or execute arbitrary code.

US-CERT encourages users to review Mozilla Foundation Security Advisories 2008-14 and 2008-15 and to update to Thunderbird 2.0.0.14.

Microsoft Releases Advance Notification for May Security Bulletin

Microsoft has issued a Security Bulletin Advance Notification indicating that its May release cycle will contain four bulletins, three of which will have a severity rating of Critical. The notification states that these Critical bulletins are for Microsoft Windows and Office. The notification also states that there will be one Important bulletin for Windows Live OneCare, Antigen, Defender, and Forefront Security. Release of these bulletins is scheduled for Tuesday, May 12.

US-CERT will provide additional information as it becomes available.

Microsoft Releases Windows XP Service Pack 3

Microsoft has released Service Pack 3 for Windows XP. Service Pack 3 includes multiple Hotfixes and security updates and is available through Automatic Updates and Windows Update.

Users should note that Windows XP SP3 does not include Internet Explorer 7, however it does include updates to both IE 6 and IE 7, and will update whichever version is currently installed.

US-CERT encourages users to review the release notes for Service Pack 3 for Windows XP and apply any necessary updates.

PHP 5.2.6 Released

PHP has released version 5.2.6 to address multiple vulnerabilities. These vulnerabilities include

• an error in FastCGI SAPI which may result stack-based buffer overflow
• an integer overflow in printf()
• an error in init_request_info(), which may result in a buffer overflow
  
• an error in cURL, which may result in safe_mode bypass
• improper handling of input passed to escapeshellcmd()
• a boundary error in the bundled version of the PCRE library
  

Common Data Format Buffer Overflow Vulnerability

NASA has issued an advisory regarding a vulnerability in Common Data Format (CDF) version 3.2 and earlier. This vulnerability is due to a buffer overflow condition in the handling of specially-crafted CDF files. Exploitation of this vulnerability may allow an attacker to execute arbitrary code.

US-CERT encourages users to review the NASA advisory and update to CDF 3.2.1 to help mitigate the risk.

US-CERT will provide additional information as it becomes available.

WordPress Vulnerabilities

WordPress has released version 2.5.1 to address multiple vulnerabilities. These vulnerabilities may allow an attacker to bypass security restrictions or conduct a cross-site scripting attack.

US-CERT encourages users to review the WordPress 2.5.1 release notes and apply any necessary updates.