September 24, 2008 - Current Activity

Cisco Releases Security Alerts

Cisco has released multiple security alerts to address vulnerabilities in the Unified Communications Manager and IOS. These vulnerabilities may allow a remote unauthenticated attacker to cause a denial-of-service condition, obtain sensitive information, or operate with escalated privileges.

US-CERT encourages users and administrators to review the following Cisco Alerts and apply any necessary updates to help mitigate the risks.

• Cisco Unified Communications Manager Session Initiation Protocol Message Reload Denial of Service Vulnerability
• Cisco IOS Software L2TP Packet Handling Denial of Service Vulnerability
• Cisco IOS Multiprotocol Label Switching Virtual Private Network Information Disclosure Issue
• Cisco IOS Linecard Redundancy Unauthorized Access Vulnerability
• Cisco IOS Software Session Initiation Message Memory Leak Denial of Service Vulnerability
• Cisco IOS Skinny Call Control Protocol Fragmented Message Denial of Service Vulnerability
• Cisco IOS IPS Feature SERVICE.DNS Signature Engine Network Traffic Handling Denial of Service Vulnerability
• Cisco IOS IPC Message Denial of Service Vulnerability
• Cisco IOS Multi Protocol Label Switching Forwarding Infrastructure Denial of Service Vulnerability

Mozilla Releases Firefox 3.0.2

Mozilla has released Firefox 3.0.2 to address multiple vulnerabilities. The impacts of these vulnerabilities include arbitrary code execution, enabling cross-site scripting, privilege escalation, information disclosure, and denial of service. As described in the Mozilla Foundation Security Advisories, some of these vulnerabilities may also affect Thunderbird and SeaMonkey.

US-CERT encourages users to do the following to help mitigate the risks:

• Review the Mozilla Foundation Security Advisories.
• Update to Firefox 3.0.2.
  

VMware Releases Security Advisory VMSA-0008-0015

VMware has released a Security Advisory indicating it has updated the ESXi and ESX 3.5 packages to address a vulnerability in "openwsman". This vulnerability is due to several buffer overflow conditions in the handling of HTTP basic authentication headers. Exploitation of this vulnerability may allow a remote, unauthenticated attacker to execute arbitrary code on the host running ESXi or ESX.

US-CERT encourages users and administrators to review VMware Security Advisory VMSA-0008-0015 and apply any necessary updates to help mitigate the risks.

Adobe Releases Security Advisory for Mac Illustrator

Adobe has released a Security Advisory to alert users of potential vulnerabilities affecting the Macintosh version of Illustrator CS2. By convincing a user to open a malicious Adobe Illustrator file, an attacker may be able to execute arbitrary code.

In the advisory, Adobe recommends that users exercise caution when receiving unsolicited or suspicious files. Adobe also states that they are currently unaware of any public exploitation of these vulnerabilities.

US-CERT will provide more information as it becomes available.

Fake Antivirus Software Circulating

US-CERT is aware of public reports indicating an increase in the instances of fake antivirus software circulating. These software applications are malicious code, not legitimate antivirus applications. These instances of malicious code are noted as being distributed through spam email messages containing malicious links, instant messages containing malicious links, private messages on social networking sites, infection from other malware, and from visiting compromised websites.

Quite often, this malware attempts to convince users that there is something wrong with their systems. This leads to an attempt persuade the users into purchasing an illegitimate antivirus application. If the user purchases the bogus software, the attacker may be able to obtain personal and credit card information for use in additional scams and fraudulent activity.

US-CERT encourages users to perform the following preventative measures to help mitigate the risks:

• Install legitimate antivirus software from a trusted vendor, and keep its virus signature files up-to-date.
• Do not follow unsolicited web links found in email messages or instant messages.
• Use caution when visiting untrusted websites.
• Do not install untrusted software.

Apple Releases Security Updates for Multiple Vulnerabilities

Apple has released Security Update 2008-006 and Mac OS X v10.5.5 to address multiple vulnerabilities in Mac OS X and related products. The impacts of these vulnerabilities include arbitrary code execution, information disclosure, denial of service, privilege escalation, or DNS cache poisoning.

US-CERT encourages users to review Apple article HT3137 and apply the appropriate updates as soon as possible.

US-CERT will provide additional details as the they become available.

Apple Addresses Issues with iTunes 8.0

Apple has released an article to address issues with their recent iTunes 8.0 release. The article indicates that Windows Vista users who have installed iTunes 8.0 may be seeing a blue screen error message when connecting an iPhone or iPod to their computer.

US-CERT encourages users to review Apple article TS2280 and apply one of the solutions listed in the article to fix the issue.

TWiki Releases Security Alert

TWiki has released a Security Alert to address a vulnerability. This vulnerability is due to the way TWiki processes the "image" variable in URLs. Exploitation of this vulnerability may allow a remote, unauthenticated attacker to execute arbitrary code.

US-CERT encourages users and administrators to review the TWiki Security Alert and apply the workaround listed in the Countermeasures section of the document or upgrade to version 4.2.3 to help mitigate the risks.

Additional information regarding this vulnerability can be found in the Vulnerability Notes Database.

Apple Releases iPhone v2.1

Apple has released iPhone v2.1 to address multiple vulnerabilities in Application Sandbox, CoreGraphics, mDNSResponder, Networking, Passcode Lock, and Webkit. These vulnerabilities may allow an attacker to execute arbitrary code, conduct DNS cache poisoning attacks, spoof or hijack TCP sessions, bypass Passcode Lock, obtain sensitive information, or cause a denial-of-service condition.

US-CERT encourages users to review Apple document HT3129 and upgrade to iPhone v2.1.

DHS Email Scam

US-CERT is aware that spam email messages are being sent that appear to come from high-level DHS officials, some of which attempt to entice the user into an advance fee fraud scam. In some cases, the sender's address has been spoofed so that the email appears to come from a legitimate dhs.gov address.

US-CERT encourages users to do the following to help mitigate the risks:

• Do not open attachments contained in unsolicited email messages.
• Refer to the Recognizing and Avoiding Email Scams (pdf) document for more information on avoiding email scams.
• Refer to the Avoiding Social Engineering and Phishing Attacks document for more information on social engineering attacks.