US-CERT Current ActivityThe US-CERT Current Activity web page is a regularly updated summary of the most frequent, high-impact types of security incidents currently being reported to the US-CERT.Last reviewed: October 29, 2010 09:08:51 EDT Adobe Releases Security Update for Shockwave Playeradded October 29, 2010 at 08:31 am Adobe has released a security update for Shockwave Player to address multiple vulnerabilities. These vulnerabilities may allow an attacker to execute arbitrary code.US-CERT encourages users and administrators to review Adobe security bulletin APSB10-25 and apply any necessary updates to help mitigate the risks. Additional information regarding the 'rcsL' chunk parsing vulnerability can be found in US-CERT vulnerability note VU#402231. Adobe Releases Security Bulletin for Flash Player, Reader, and Acrobatadded October 28, 2010 at 02:24 pm Adobe has released a security advisory to alert users of a vulnerability affecting the following applications:
US-CERT encourages users and administrators to review Adobe security advisory APSA10-05 and consider implementing the suggested workarounds to help mitigate the risks until the vendor releases a fix. The advisory indicates that updates for Adobe Flash Player will be available by November 9, 2010 and updates for Adobe Reader and Acrobat will be available by November 15, 2010. Additional information regarding this vulnerability can be found in US-CERT vulnerability note VU#298081. US-CERT will provide updates as details become available. Firefox 3.5 and 3.6 Vulnerabilityadded October 27, 2010 at 09:06 am | updated October 28, 2010 at 08:24 am Mozilla has released a blog entry indicating that it is aware of a critical vulnerability affecting Firefox 3.5 and Firefox 3.6. This vulnerability may allow an attacker to execute arbitrary code. The blog entry indicates that active exploitation of this vulnerability has been detected.Update: The Mozilla Foundation has released Firefox 3.6.12 and 3.5.15 to address this vulnerability. Additionally, this vulnerability has been addressed in Thunderbird 3.1.6 and 3.0.10. US-CERT encourages users and administrators to apply any necessary updates to help mitigate the risks. Users should consider disabling JavaScript and using the NoScript Add-on as described in the Securing Your Web Browser (PDF) document as best-practice security measures to help protect against future vulnerabilities. Cisco Releases Security Advisory for CiscoWorks Common Servicesadded October 27, 2010 at 01:59 pm Cisco has released a security advisory to address a vulnerability affecting CiscoWorks Common Services for Oracle Solaris and Microsoft Windows. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary code with administrative privileges or cause a denial-of-service condition.US-CERT encourages users and administrators to review Cisco security advisory cisco-sa-20101027-cs and apply any necessary updates or workarounds to help mitigate the risks. Fraud Advisory for Consumers Released: Involvement in Criminal Activity Through Work from Home Scamsadded October 25, 2010 at 12:35 pm As part of a joint effort, the United States Secret Service, the Federal Bureau of Investigation, the Internet Crime Complaint Center (IC3) and the Financial Services Information Sharing and Analysis Center (FS-ISAC) have released Fraud Advisory for Consumers: Involvement in Criminal Activity through Work from Home Scams (PDF). The document explains that criminal syndicates are using newspaper ads, online employment services, and unsolicited emails to recruit consumers to launder stolen money. Individuals who are knowing or unknowing participants in this type of scheme could be prosecuted and may have their own identities or bank accounts stolen.This advisory provides information that consumers can use to help understand and protect themselves against work from home scams. US-CERT encourages users and administrators to review this document to help protect themselves against work from home scams. Fraud Advisory for Businesses Released: Corporate Account Take Overadded October 25, 2010 at 12:35 pm As part of a joint effort, the United States Secret Service, the Federal Bureau of Investigation, the Internet Crime Complaint Center (IC3) and the Financial Services Information Sharing and Analysis Center (FS-ISAC) have released Fraud Advisory for Businesses: Corporate Account Take Over (PDF). The document explains that cyber criminals are targeting small- and medium- sized businesses and using methods such as malicious code, phishing, and social engineering attacks to compromise business banking accounts. Once these accounts have been compromised, cyber criminals can fraudulently transfer funds out of them and can cause significant business disruption and substantial monetary loss.This advisory provides information that businesses can use to help understand, prevent, detect, and respond to the threats of corporate account take over. US-CERT encourages users and administrators to review this document and to remain vigilant in combating the threats of corporate account takeover. Linux Root Access Vulnerabilitiesadded October 25, 2010 at 10:31 am US-CERT is aware of public reports of multiple vulnerabilities affecting Linux. Exploitation of these vulnerabilities may allow an attacker to access the system with root or "superuser" privileges.The first of these vulnerabilities is due to a flaw in the implementation of the Reliable Datagram Sockets (RDS) protocol in Linux kernel versions 2.6.30 through 2.6.36-rc8. By sending a specially crafted socket function call, an attacker may be able to write arbitrary values into kernel memory and escalate privileges to root. This vulnerability affects Linux installations where the CONFIG_RDS kernel configuration option is set and where there are no restrictions preventing unprivileged users from loading packet family modules. Reports indicate that this may be the default configuration and that a patch for this vulnerability has been committed to the Linux kernel. Users should apply any updates for their Linux distributions to help mitigate the risks. Additionally, reports indicate that preventing the RDS kernel module from loading is an effective workaround. This can be performed by executing the following command as root:
US-CERT will provide additional information as it becomes available. Adobe Releases Security Advisory for Shockwave Playeradded October 25, 2010 at 08:14 am Adobe has released a security advisory to alert users of a vulnerability affecting Adobe Shockwave Player. This vulnerability may allow an attacker to execute arbitrary code or cause a denial-of-service condition.US-CERT encourages users and administrators to review Adobe security advisory APSA10-04 and to consider implementing the workarounds provided in US-CERT Vulnerability Note VU#402231 until a fix is released by the vendor. Additional information will be provided as it becomes available. Apple Releases Java for Mac OS X 10.5 Update 8 and Java for Mac OS X 10.6 Update 3added October 21, 2010 at 11:20 am Apple has released Java for Mac OS X 10.5 update 8 and Java for Mac OS X 10.6 update 3 to address multiple vulnerabilities affecting the Java package. Exploitation of these vulnerabilities may allow an attacker to execute arbitrary code or cause a denial-of-service condition.US-CERT encourages users and administrators to review Apple articles HT4417 and HT4418 and apply any necessary updates to help mitigate the risks. Google Releases Chrome 7.0.517.41added October 20, 2010 at 11:47 am Google has released Chrome 7.0.517.41 for Linux, Mac, and Windows to address multiple vulnerabilities. These vulnerabilities may allow an attacker to execute arbitrary code, cause a denial-of-service condition, conduct URL spoofing, or bypass security restrictions.US-CERT encourages users and administrators to review the Google Chrome Releases blog entry and apply any necessary updates to help mitigate the risks. |
|
Saturday, October 30, 2010
US-CERT Cyber Security Update
