August 22, 2008 - Current Activity

Malware Circulating via Russia/Georgia Conflict Spam Messages

US-CERT is aware of public reports of malware circulating via spam email messages related to the Russia/Georgia conflict. These messages contain factual information about the conflict. The messages also contain download instructions for the user to watch a video that is attached to the message. If a user opens the attachment, malware may be downloaded and installed onto their system.

US-CERT encourages users and administrators to take the following preventative measures to help mitigate the security risks:

• Install anti-virus software, and keep its virus signature files up-to-date.
• Do not follow unsolicited web links received in email messages.
• Refer to the Recognizing and Avoiding Email Scams (pdf) document for more information on avoiding email scams.
• Refer to the Avoiding Social Engineering and Phishing Attacks document for more information on social engineering attacks.

Opera Releases Version 9.52

Opera Software has released version 9.52 of the Opera web browser to address multiple vulnerabilities. These vulnerabilities may allow an attacker to execute arbitrary code, inject malicious content into a page on a trusted website, obtain sensitive information, or cause a denial-of-service condition.

US-CERT encourages users to review the latest Opera Security Advisories and upgrade to Opera 9.52 to help mitigate the risks.

Webex Meeting Manager ActiveX Control Vulnerability

Cisco has released a Security Advisory to address a vulnerability that affects Cisco Webex Meeting Manager. This vulnerability is due to a buffer overflow condition in the "NewObject()" method within the WebexUCFObject ActiveX control (atucfobj.dll). By convincing a user to visit a specially crafted web page, open an e-mail message that contains embedded malicious HTML code, or by sending malicious HTML code via instant messaging applications, a remote attacker may be able to execute arbitrary code.

US-CERT encourages users to review Cisco Security Advisory 107751 and apply any necessary updates or workarounds listed in the document. Additional information about this vulnerability can be found in the Vulnerability Notes Database.

Joomla! Password Reset Vulnerability

The Joomla! Project has released an advisory to address a password reset vulnerability in the Joomla! content management system. This vulnerability, which may allow non-validating tokens to be forged, is due to a flaw in the reset token validation mechanism. Exploitation of this vulnerability may allow an unauthenticated attacker to reset the password of the first enabled user, which is typically an administrator user.

US-CERT encourages users to review the Joomla! advisory and upgrade to version 1.5.6 (or newer) or apply the patch listed in the advisory.

Apple MobileMe Phishing Scam

US-CERT is aware of public reports of a phishing attack circulating via email messages that appear to be targeting Apple MobileMe users. These messages claim that there is a problem with the user's billing information and instruct the user to follow a web link to update personal information. Clicking on this link directs the user to a web page that contains a seemingly legetimate web form requesting personal and financial information. Any information entered in this form is not sent to Apple but rather, to a malicious attacker.

US-CERT encourages users to do the following to help mitigate the risks:

• Do not follow unsolicited web links in email messages.
• Use caution when entering sensitive information online.
  
• Refer to the Recognizing and Avoiding Email Scams (pdf) document for more information on avoiding email scams.
• Refer to the Avoiding Social Engineering and Phishing Attacks document for more information on social engineering attacks.

Microsoft Releases August Security Bulletin

Microsoft has released updates to address vulnerabilities in Microsoft Windows, Office, Internet Explorer, Outlook Express, Windows Mail, and Windows Messenger as part of the Microsoft Security Bulletin Summary for August 2008. These vulnerabilities may allow an attacker to execute arbitrary code or obtain sensitive information.

US-CERT encourages users to review the bulletins and follow best-practice security policies to determine which updates should be applied.

Microsoft Releases Advanced Notification for August Security Bulletin

Microsoft has issued a Security Bulletin Advance Notification indicating that the August release cycle will contain 12 bulletins, seven of which will have a severity rating of Critical. The notification states that these Critical bulletins are for Microsoft Windows, Office, and Internet Explorer. There will also be five important bulletins for Microsoft Windows, Office, Outlook Express, Windows Mail, and Windows Messenger. Release of these bulletins is scheduled for Tuesday, August 12.

US-CERT will provide additional information as it becomes available.

Malware Circulating via Spam Messages

US-CERT is aware of public reports of malware spreading via spam. It has been reported that malware is spreading in spam messages related to the upcoming Olympics and to fake CNN news reports. If a user clicks the link to one of these fake news reports they are prompted to install a Flash Player update. If users attempt to install the update, malware may be downloaded and installed onto their system.

US-CERT encourages users and administrators to take the following preventative measures to help mitigate the security risks:

• Install anti-virus software, and keep its virus signature files up-to-date.
• Do not follow unsolicited web links received in email messages.
• Refer to the Recognizing and Avoiding Email Scams (pdf) document for more information on avoiding email scams.
• Refer to the Avoiding Social Engineering and Phishing Attacks document for more information on social engineering attacks.

Oracle Releases Patch for WebLogic Plug-in Vulnerability

Oracle has released a patch to address a previously disclosed vulnerability in the WebLogic plug-in for Apache. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary code or cause a denial-of-service condition.

US-CERT encourages users to consider applying the patch and workarounds referenced in the Oracle Security Advisory and in Vulnerability Note VU#716387.

Malware Targeting Adobe Flash Player

Adobe has issued a Security Bulletin warning of malware spreading via a fraudulent Flash Player installer. Adobe warns that a worm is making fraudulent posts on social networking sites. These posts include links that lead to fake sites that prompt users to update their versions of Flash Player. If users attempt to use the installer to make the update, malware may be downloaded and installed onto their systems.

US-CERT urges users and administrators to take the following preventative measures to help mitigate the security risks:

• Do not follow unsolicited web links.
• Configure your web browser as described in the Securing Your Web Browser document.
• Install anti-virus software, and keep its virus signature files up-to-date.
• Refer to the Avoiding Social Engineering and Phishing Attacks document for more information on social engineering attacks.