June 04, 2008 - Current Activity

HP Instant Support ActiveX Control Vulnerabilities

HP has released a support document to address multiple vulnerabilities in the Instant Support ActiveX control (HPISDataManager.dll). These vulnerabilities may allow a remote attacker to execute arbitrary code.

US-CERT encourages users to review the HP Support Document and upgrade to Instant Support v1.0.0.24 or apply the workarounds listed in the Support Document.

Sun Releases Java ASP Server 4.0.3

Sun has released Java ASP Server 4.0.3 to address multiple vulnerabilities. These vulnerabilities may allow a remote, unauthenticated attacker to execute arbitrary code with the privileges of the root user or the user running the Sun Java ASP server, obtain sensitive information, or bypass security restrictions.

US-CERT encourages users to review Sun Alert 238184 and upgrade to Java ASP Server 4.0.3 or apply the workarounds listed in the Sun Alert.

United States Tax Court Phishing Attack

US-CERT is aware of public reports of a phishing attack circulating via email messages that claim to be petitions from the US Tax Court. These messages appear to be legitimate because they may contain very specific information about the message recipient. The message requests that the user follow a link to download additional information or documents. If a user clicks on this link, the website attempts to use JavaScript to install a bogus root certificate that is supposedly issued by "VeriSign Trust Network." The user will normally receive several warnings when the JavaScript code attempts to install the certificate.

If the certificate installs successfully, the browser is redirected to another page that attempts to install an ActiveX control. The user may be prompted to allow the installation, and because the control is signed, it will appear to be legitimate. However, it is signed by a fake certificate for "Adobe Systems Incorporated," which is trusted by the bogus root certificate previously installed. The ActiveX control is a Browser Helper Object (BHO) that functions as an information stealer. Upon execution, it will attempt to download an update to itself and will then begin reading client certificates, stored passwords, cookies, browsing history, posted form data, and other information.

Public reports indicate that the attack messages have the following attributes:

• Messages appear to come from the "United State Tax Court." (Note the missing "s" on "State.")
  
• The URL within the message appears to link to the "ustax-courts.com" domain.

• Review the alert posted by the United States Tax Court regarding this issue.
• Do not follow unsolicited web links received in email messages.
• Refer to the Recognizing and Avoiding Email Scams (pdf) document for more information on avoiding email scams.
• Refer to the Avoiding Social Engineering and Phishing Attacks document for more information on social engineering attacks.
• Install anti-virus software and keep virus signature files up to date.
• Pay close attention to warning messages and prompts.
  

Microsoft Releases Security Advisory

Microsoft has released Security Advisory 953818 to address reports of a blended threat that affects Windows users who have installed Apple's Safari web browser. According to the advisory, by convincing a user to visit a specially crafted website, an attacker may be able to execute arbitrary code on an affected system due to Safari's default file downloading behavior and the way that Windows Internet Explorer handles the downloaded files.

US-CERT encourages users to review Microsoft Security Advisory 953818. Please note that the advisory indicates that the workaround does not correct the vulnerability, but it may help mitigate risk against known attack vectors.

US-CERT will provide additional information as it becomes available.

VMware Releases Security Advisory

VMware has released a security advisory indicating that updates are available for VMware Workstation, VMware Player, VMware ACE, and VMware Fusion. These updates address multiple vulnerabilities that may allow an attacker to execute arbitrary code in the context of the "vmx" process on the host system or to bypass security restrictions.

US-CERT encourages users to review VMware Security Advisory VMSA-2008-0008 and apply any necessary updates.

Samba Releases Version 3.0.30

Samba has released version 3.0.30 to address a vulnerability. This vulnerability is due to a heap-based buffer overflow condition in the receive_smb_raw() routine. By sending a specially crafted SMB response, an attacker may be able to execute arbitrary code on the affected system.

US-CERT encourages users to review the Samba Security Announcement and apply appropriate patches from their vendor, upgrade to Samba 3.0.30, or apply the patch supplied by the Samba development team.

Apple Releases Security Updates

Apple has released Mac OS X v10.5.3 and Security Update 2008-003 to address multiple vulnerabilities. These vulnerabilities affect a number of applications, libraries and the kernel. Exploitation of these vulnerabilities may allow an attacker to execute arbitrary code, access the system with escalated privileges, obtain sensitive information, conduct cross-site scripting attacks or cause a denial-of-service condition.

US-CERT encourages users to review Apple Article HT1897 and apply any necessary updates.

Adobe Flash Player Vulnerability

US-CERT is aware of public reports of active exploitation of a vulnerability in Adobe Flash Player. By convincing a user to open a specially crafted Flash file, which may be embedded in a compromised website, a remote, unauthenticated attacker may be able to execute arbitrary code.

US-CERT encourages users to review the following and apply any necessary workarounds to help mitigate the risks:

• Technical Cyber Security Alert TA08-149A
• Vulnerability Notes Database VU#395473
• Adobe Product Security Incident Response Team Blog

Cisco Releases Security Advisory

Cisco has released a Security Advisory to address a vulnerability in CiscoWorks Common Services. This vulnerability may allow a remote attacker to execute arbitrary code.

US-CERT encourages users to review Cisco Security Advisory cisco-sa-20080528-cw and apply any necessary updates or workarounds.

IBM Lotus Sametime Vulnerability

IBM has released a Technote to address a vulnerability in Lotus Sametime. This vulnerability is due to an error in the way long URLs are processed within the Community Services Multiplexer (StMux.exe). By sending a specially crafted URL, an attacker may be able to cause a stack-based buffer overflow and execute arbitrary code.

US-CERT encourages users to review the IBM Technote "Potential stack overflow vulnerability with IBM Lotus Sametime Community Services multiplexer (MUX)" and apply any necessary updates or workarounds.