October 08, 2008 - Current Activity

Cisco Releases Advisory for Cisco Unity

Cisco Security Advisory cisco-sa-20081008-unity was released to address a vulnerability in Cisco Unity, a voice and unified messaging platform. This vulnerability may allow an attacker to view and alter configuration parameters of the Cisco Unity server.

US-CERT encourages users to do the following:

• Review Cisco Security Advisory cisco-sa-20081008-unity
• Apply software updates and workaround provided by Cisco
  

Opera Software Releases Opera Version 9.60

Opera Software has released Opera version 9.60 to address two vulnerabilities. The first vulnerability is due to improper validation of URLs. Exploitation of this vulnerability may allow an attacker to execute arbitrary code or cause a denial-of-service condition. The second vulnerability is due to unsafe storage of cached Java applets. Exploitation of this vulnerability may allow an attacker to obtain sensitive information or escape other normal restrictions.

US-CERT encourages users and administrators to review Opera Advisory 901 and 902 and upgrade to version 9.60 to help mitigate the risks.

Multiple Web Browsers Affected by Clickjacking

US-CERT is aware of public reports of a new cross-browser exploit technique called "clickjacking." According to one of the reports, clickjacking gives an attacker the ability to trick a user into clicking on something only barely or momentarily noticeable. Therefore, if a user clicks on a web page, they may actually be clicking on content from another page. A separate report indicates that this flaw affects most web browsers and that no fix is available, but that disabling browser scripting and plug-ins may help mitigate some of the risks.

An additional report suggests that Firefox users consider using the NoScript plug-in as an added preventative measure. Disabling IFRAMEs, active content, and plug-ins by default, as outlined in the Securing Your Web Browser document, may protect against the vulnerability. Note, disabling IFRAMES, active content, and plug-ins may reduce the functionality of some websites.

US-CERT encourages users to review the report and follow the security recommendations as described in the Securing Your Web Browser document to help mitigate some of the risks. Website developers may want to incorporate additional authentication techniques, such as capchas, out-of-band email verification, or other methods to verify sensitive web transactions.

US-CERT will provide additional information as it becomes available.

Bank Acquisitions and Phishing Scams

US-CERT is aware of an increase in public reports of phishing scams related to recent bank acquisitions. Due to an increase in this activity, US-CERT would like to remind users to remain cautious when receiving unsolicited email that could be a potential phishing scam.

Phishing scams may appear as requests for users to verify personal and bank account information, enroll in additional bank services, or activate new security features. The email messages may contain a link that, when clicked, will take the user to a fraudulent web site that appears to be a legitimate bank web site. The users may be asked to provide personal information or that can further expose them to future compromises. Additionally, these fraudulent web sites may contain malicious code.

Users are encouraged to take the following measures to protect themselves from phishing scams:

• Do not follow unsolicited web links received in email messages..
• Install anti-virus software, and keep its virus signature files up-to-date.
• Review the Recognizing and Avoiding Email Scams (pdf) document.
• Review the Avoiding Social Engineering and Phishing Attacks document.

VMware Security Advisory VMSA-2008-0016

VMware has released Security Advisory VMSA-2008-0016 to address multiple vulnerabilities. These vulnerabilities affect VMware hosted products, VirtualCenter, ESX, and ESXi. Exploitation of these vulnerabilities may allow an attacker to operate with escalated privileges in a guest operating system, obtain sensitive information, bypass security restrictions, or cause a denial-of-service condition.

US-CERT encourages users to review VMware Security Advisory VMSA-2008-0016 and apply any necessary updates to help mitigate the risks.

Novell Releases eDirectory Version 8.7.3 SP10 FTF1

Novell has released eDirectory 8.7.3 SP10 FTF1 to address multiple vulnerabilities. These vulnerabilities may allow an attacker to execute arbitrary code or cause a denial-of-service condition on the affected system.

US-CERT encourages users to review Novell document 3477912 and apply any necessary patches to help mitigate the risks.

Mozilla Releases Firefox and Thunderbird Updates

Mozilla has released Firefox and Thunderbird v2.0.0.17 and Firefox v3.0.3 to address multiple vulnerabilities. These may allow an attacker to execute arbitrary code, obtain sensitive information, conduct cross-site scripting attacks, cause a denial-of-service condition, operate with escalated privileges, or conduct Clickjacking attacks. Note that Firefox v3.0.2 was initially released to address these vulnerabilities. Version 3.0.3 was released to correct a flaw that was unrelated to the vulnerabilities.

US-CERT encourages users and administrators to do the following to help mitigate the risks:

• Review the Security Advisories for Firefox 2.0.0.17 and for Thunderbird 2.0.0.17.
  
• Review the Release Notes for Firefox 3.0.3.
• Upgrade to Firefox 2.0.0.17  and Thunderbird 2.0.0.17 or Firefox 3.0.3 as necessary.

WinZip Releases Version 11.2 SR-1

WinZip has released version 11.2 SR-1 to address a vulnerability. This vulnerability is due to flaws in the "gdiplus.dll" library included with the affected versions of the software. Exploitation of this vulnerability may allow an attacker to execute arbitrary code.

US-CERT encourages users and administrators to review the WinZip 11.2 SR-1 release notes and apply any necessary updates to help mitigate the risks.

Adobe PDF Exploit Toolkits Circulating

US-CERT is aware of public reports of improved attack toolkits for exploiting vulnerabilities in PDF reader software.

Another report offering additional information is publicly available.

US-CERT encourages users to do the following to help mitigate the risks:

• Do not open untrusted files or files of unknown origin.
• Install antivirus software, and keep its virus signature files up to date.
• Regularly apply software patches and updates as supplied by the vendor.

Apple Releases Java Updates for Mac OS X 10.4 and 10.5

Apple has released updates for Java for Mac OS X 10.4 and 10.5 to address multiple vulnerabilities. These vulnerabilities may allow an attacker to execute arbitrary code.

US-CERT encourages users to review Apple Article HT3178 and HT3179 and apply any necessary updates to help mitigate the risks.