June 06, 2008 - Current Activity

Microsoft Releases Advance Notification for June Security Bulletin

Microsoft has issued a Security Bulletin Advance Notification indicating that its June release cycle will contain seven bulletins, three of which will have the severity rating of Critical. The notification states that these Critical bulletins are for Microsoft Windows and Internet Explorer. The notification also states that there will be three Important bulletins for Microsoft Windows. The last of these bulletins has the severity rating of Moderate and is for Microsoft Windows. Release of these bulletins is scheduled for Tuesday, June 10.

US-CERT will provide additional information as it becomes available.

Skype Releases Security Bulletin

Skype has released a security bulletin to address a vulnerability. This vulnerability is due to an error in the handling of "file:" URIs. By convincing a user to click on a specially crafted "file:" URI, a remote, unauthenticated attacker may be able to execute arbitrary code.

US-CERT encourages users to review Skype security bulletin SKYPE-SB/2008-003 and upgrade to Skype version 3.8.0.139.

Cisco Releases Security Advisory

Cisco has released a Security Advisory to address multiple vulnerabilities in the PIX and ASA security appliances. These vulnerabilities include the following:

• An unspecified error in the processing of TCP ACK packets that may allow an attacker to cause a denial-of-service condition.
• An unspecified error in the handling of the TLS protocol that may allow an attacker to cause a denial-of-service condition.
• An unspecified error in the Instant Messaging Inspection that may allow an attacker to cause a denial-of-service condition.
• An unspecified error that occurs during vulnerability scanning against  TCP port 443 may allow an attacker to cause a denial-of-service condition.
• An unspecified error in the Control-plane Access List may allow an attacker to bypass security restrictions.

HP Instant Support ActiveX Control Vulnerabilities

HP has released a support document to address multiple vulnerabilities in the Instant Support ActiveX control (HPISDataManager.dll). These vulnerabilities may allow a remote attacker to execute arbitrary code.

US-CERT encourages users to review the HP Support Document and upgrade to Instant Support v1.0.0.24 or apply the workarounds listed in the Support Document.

Sun Releases Java ASP Server 4.0.3

Sun has released Java ASP Server 4.0.3 to address multiple vulnerabilities. These vulnerabilities may allow a remote, unauthenticated attacker to execute arbitrary code with the privileges of the root user or the user running the Sun Java ASP server, obtain sensitive information, or bypass security restrictions.

US-CERT encourages users to review Sun Alert 238184 and upgrade to Java ASP Server 4.0.3 or apply the workarounds listed in the Sun Alert.

United States Tax Court Phishing Attack

US-CERT is aware of public reports of a phishing attack circulating via email messages that claim to be petitions from the US Tax Court. These messages appear to be legitimate because they may contain very specific information about the message recipient. The message requests that the user follow a link to download additional information or documents. If a user clicks on this link, the website attempts to use JavaScript to install a bogus root certificate that is supposedly issued by "VeriSign Trust Network." The user will normally receive several warnings when the JavaScript code attempts to install the certificate.

If the certificate installs successfully, the browser is redirected to another page that attempts to install an ActiveX control. The user may be prompted to allow the installation, and because the control is signed, it will appear to be legitimate. However, it is signed by a fake certificate for "Adobe Systems Incorporated," which is trusted by the bogus root certificate previously installed. The ActiveX control is a Browser Helper Object (BHO) that functions as an information stealer. Upon execution, it will attempt to download an update to itself and will then begin reading client certificates, stored passwords, cookies, browsing history, posted form data, and other information.

Public reports indicate that the attack messages have the following attributes:

• Messages appear to come from the "United State Tax Court." (Note the missing "s" on "State.")
  
• The URL within the message appears to link to the "ustax-courts.com" domain.

• Review the alert posted by the United States Tax Court regarding this issue.
• Do not follow unsolicited web links received in email messages.
• Refer to the Recognizing and Avoiding Email Scams (pdf) document for more information on avoiding email scams.
• Refer to the Avoiding Social Engineering and Phishing Attacks document for more information on social engineering attacks.
• Install anti-virus software and keep virus signature files up to date.
• Pay close attention to warning messages and prompts.
  

Microsoft Releases Security Advisory

Microsoft has released Security Advisory 953818 to address reports of a blended threat that affects Windows users who have installed Apple's Safari web browser. According to the advisory, by convincing a user to visit a specially crafted website, an attacker may be able to execute arbitrary code on an affected system due to Safari's default file downloading behavior and the way that Windows Internet Explorer handles the downloaded files.

US-CERT encourages users to review Microsoft Security Advisory 953818. Please note that the advisory indicates that the workaround does not correct the vulnerability, but it may help mitigate risk against known attack vectors.

US-CERT will provide additional information as it becomes available.

VMware Releases Security Advisory

VMware has released a security advisory indicating that updates are available for VMware Workstation, VMware Player, VMware ACE, and VMware Fusion. These updates address multiple vulnerabilities that may allow an attacker to execute arbitrary code in the context of the "vmx" process on the host system or to bypass security restrictions.

US-CERT encourages users to review VMware Security Advisory VMSA-2008-0008 and apply any necessary updates.

Samba Releases Version 3.0.30

Samba has released version 3.0.30 to address a vulnerability. This vulnerability is due to a heap-based buffer overflow condition in the receive_smb_raw() routine. By sending a specially crafted SMB response, an attacker may be able to execute arbitrary code on the affected system.

US-CERT encourages users to review the Samba Security Announcement and apply appropriate patches from their vendor, upgrade to Samba 3.0.30, or apply the patch supplied by the Samba development team.

Apple Releases Security Updates

Apple has released Mac OS X v10.5.3 and Security Update 2008-003 to address multiple vulnerabilities. These vulnerabilities affect a number of applications, libraries and the kernel. Exploitation of these vulnerabilities may allow an attacker to execute arbitrary code, access the system with escalated privileges, obtain sensitive information, conduct cross-site scripting attacks or cause a denial-of-service condition.

US-CERT encourages users to review Apple Article HT1897 and apply any necessary updates.