US-CERT | United States Computer Emergency Readiness Team

Published Wednesday, April 23, 2014

Apple has released firmware update 7.7.3 for AirPort Extreme and AirPort Time Capsule base stations with 802.11ac. The update addresses the OpenSSL "Heartbleed" vulnerability where an attacker may obtain memory contents.

US-CERT recommends that users and administrators review Apple Security Update HT6203 and apply the necessary update.

Read Full Entry »

Apple Releases Security Updates for OS X, iOS devices, and Apple TV

Published Wednesday, April 23, 2014

Apple has released security updates for Mac OS X, iOS devices, and Apple TV to address multiple vulnerabilities, some of which could allow an attacker to execute arbitrary code, cause application termination, or expose users to covert eavesdropping.

Updates available include:

Read Full Entry »

Adobe Releases Security Update for Reader Mobile

Published Thursday, April 17, 2014

Adobe has released a security update to address a vulnerability in Adobe Reader Mobile 11.1.3 and earlier versions for Android. Exploitation of this vulnerability could allow a remote attacker to execute arbitrary code via a crafted PDF document.

US-CERT recommends that users and administrators review Adobe Security Bulletin APSB14-12 and apply the necessary update.

Read Full Entry »

Announcements

OpenSSL ‘Heartbleed’ Vulnerability

Certain OpenSSL versions contain a critical vulnerability which may allow a malicious actor to obtain sensitive or private information. See the '"Heartbleed" OpenSSL Vulnerability' Technical Publication, TA14-098A, and VU#720951 for details and recommended actions.
DHS Announces Critical Infrastructure Cyber Community Voluntary Program

The Critical Infrastructure Cyber Community Voluntary Program, or C³ (pronounced "C Cubed") Voluntary Program, is an innovative public-private partnership, to help connect companies, as well as Federal, State, local, tribal, and territorial partners, to DHS and other Federal government programs and resources that will assist their efforts in managing their cyber risks.
Malware Targeting Point-of-Sale (POS) Systems

Cyber criminals are targeting consumer information entered in Point of Sale (POS) systems. This alert, released on January 2, 2014, describes the methods used in POS targeting and provides best practices, as well as consumer remediation suggestions that can assist in preventing unauthorized access to POS systems.
DDoS Quick Guide

NCCIC has recently published a DDoS Quick Guide. This guide contains possible DDoS attack methods per OSI layer, potential impact and the applicable recommended mitigation strategies as well as relevant hardware. This report also provides possible DDoS traffic type descriptions.