The US-CERT Current Activity web page is a regularly updated summary of the most frequent, high-impact types of security incidents currently being reported to the US-CERT.
Last reviewed: April 28, 2008 14:04:28 EDT
| April 28 | WordPress Vulnerabilities |
| April 25 | Compromised Websites Hosting Malicious JavaScript |
| April 25 | HP Software Update Vulnerabilities |
| April 24 | IRS Rebate Phishing Scam |
| April 23 | Apple QuickTime Vulnerability Report |
| April 22 | ICQ Vulnerability |
| April 18 | Microsoft Releases Security Advisory (951306) |
| April 17 | Apple Releases Safari 3.1.1 |
| April 17 | Mozilla Releases Firefox 2.0.0.14 |
| April 16 | Federal Subpoena Spear-Phishing Attack |
WordPress Vulnerabilities
added April 28, 2008 at 01:50 pm WordPress has released version 2.5.1 to address multiple vulnerabilities. These vulnerabilities may allow an attacker to bypass security restrictions or conduct a cross-site scripting attack.
US-CERT encourages users to review the WordPress 2.5.1 release notes and apply any necessary updates.
Compromised Websites Hosting Malicious JavaScript
added April 25, 2008 at 04:45 pm US-CERT is following reports of SQL injection attacks that have compromised a large number of legitimate websites. The compromised websites contain injected JavaScript that attempts to exploit multiple, known vulnerabilities. Users who visit a compromised website may unknowingly execute malicious code.
US-CERT encourages users to do the following to help mitigate the risks of this and similar attacks:
- Regularly apply software updates and patches provided by vendors.
- Disable JavaScript and ActiveX as described in the Securing Your Web Browser document.
US-CERT will provide more information as it becomes available.
HP Software Update Vulnerabilities
added April 25, 2008 at 10:44 am US-CERT is aware of reports of multiple vulnerabilities affecting HP Software Update. These vulnerabilities are due to insecure methods in multiple ActiveX controls. Exploitation of these vulnerabilities may allow a remote attacker to execute arbitrary code or view or modify sensitive information.
US-CERT encourages users to do the following to help mitigate the risks:
- Review the HP Support document and update to HP Software Update v4.000.010.008.
- Set the kill bit for the CLSIDs listed in the HP Support document.
- Disable ActiveX as described in the Securing Your Web Browser document.
IRS Rebate Phishing Scam
added April 24, 2008 at 09:31 am US-CERT is aware of a public report indicating that a phishing scam is circulating. This scam is related to the U.S. Internal Revenue Service economic stimulus rebate and arrives via email messages that appear to be from the IRS. The messages include text that attempts to convince users to follow a link to a website before a deadline to expedite the rebate process. This website requests that the user provide bank account information.
US-CERT encourages users to do the following to help mitigate the risks:
- Do not follow unsolicited web links received in email messages.
- Refer to the Recognizing and Avoiding Email Scams (pdf) document for more information on avoiding email scams.
- Refer to the Avoiding Social Engineering and Phishing Attacks (pdf) document for more information on social engineering attacks.
- Refer to the Internal Revenue Service Service Suspicious e-Mails and Identity Theft website for more information on current scams.
Apple QuickTime Vulnerability Report
added April 23, 2008 at 06:33 pm US-CERT is aware of a public report of a new vulnerability in Apple QuickTime. The report indicates that if a user opens a specially crafted QuickTime file, an attacker may be able to execute arbitrary code. This vulnerability may have several attack vectors, such as visiting a malicious or compromised website. US-CERT is currently investigating this report and will provide additional details as needed.
US-CERT encourages users to use caution when opening QuickTime files, and apply the best security practices described in the Securing Your Web Browser document, to help mitigate the risks.
ICQ Vulnerability
added April 22, 2008 at 01:10 pm US-CERT is aware of public reports of a vulnerability in ICQ 6. This vulnerability is due to a heap buffer overflow condition in the "Personal Status Manager" feature that occurs when processing specially crafted status messages. Exploitation of this vulnerability may allow a remote attacker to execute arbitrary code or cause a denial-of-service condition.
US-CERT encourages users to update to ICQ 6.0.0.6059 to help mitigate the risks.
Microsoft Releases Security Advisory (951306)
added April 18, 2008 at 01:30 pm Microsoft has released a Security Advisory to address a vulnerability in Windows. This vulnerability may allow an authenticated attacker to execute code with LocalSystem privileges.
US-CERT encourages users to review Microsoft Security Advisory 951306 and apply the workarounds.
Apple Releases Safari 3.1.1
added April 17, 2008 at 08:57 am Apple has released Safari 3.1.1 to address multiple vulnerabilities in Safari and WebKit. These vulnerabilities may allow an attacker to execute arbitrary code, cause a denial-of-service condition, conduct cross-site scripting attacks, or spoof the contents of the browser address bar.
US-CERT encourages users to review Apple's About the security content of Safari 3.1.1 document and upgrade to Safari 3.1.1 to help mitigate the risks.
Mozilla Releases Firefox 2.0.0.14
added April 17, 2008 at 08:57 am Mozilla has released Firefox 2.0.0.14 to address a vulnerability in the JavaScript engine. This vulnerability is due to memory corruption errors during JavaScript garbage collection. Exploitation of this vulnerability may allow a remote attacker to execute arbitrary code or cause a denial-of-service condition. Products that use the Mozilla rendering engine, such as Thunderbird and SeaMonkey, may also be affected.
US-CERT encourages users to review Mozilla Foundation Security Advisory 2008-20 and apply any necessary updates or workarounds.
Federal Subpoena Spear-Phishing Attack
added April 15, 2008 at 08:31 am | updated April 16, 2008 at 09:34 am US-CERT is aware of public reports of a spear-phishing attack circulating via email messages that claim to be federal subpoenas. These messages appear to be legitimate because they can contain very specific information about the message recipient. The message requests that the user follow a link to download additional information about the case, but if a user clicks on this link, malicious code may be installed on the system.
US-CERT encourages users to do the following to help mitigate the risk:
- Review the alert posted by the U.S. Courts regarding this issue.
- Do not follow unsolicited web links received in email messages.
- Refer to the Recognizing and Avoiding Email Scams (pdf) document for more information on avoiding email scams.
- Refer to the Avoiding Social Engineering and Phishing Attacks document for more information on social engineering attacks.
- Install anti-virus software and keep virus signature files up to date.
