Weekend Vulnerability and Patch Report, January 28, 2011

The following software updates were released last week. Citadel strongly recommends that readers upgrade these programs on their computers.

Opera 11.01. Opera has updated its browser after several vulnerabilities were reported that allow a cyber criminal to steal sensitive information and take control of a user’s workstation. The update is available at this link.

iTunes 10.1.2: Apple has updated iTunes. The update includes several important stability and performance improvements.

RealPlayer 14.0.2: A vulnerability has been reported in RealPlayer, which can be exploited by cyber criminal’s to take control of a user’s computer. The vulnerability is reported in versions 14.0.1 and prior, SP 1.1.5 and prior, and 11.1 and prior. More information is available on the RealPlayer Knowledge Base.

Symantec Products: Numerous critical vulnerabilities have been reported in Symantec AntiVirus Corporate Edition Server 10.x and Symantec System Center 10.x. Readers whose organizations use Symantec corporate products should notify IT staff of the availability of version 10.1 MR10.

Citrix Update: CERT is reporting vulnerabilities in various editions of the Citrix Access Gateway. If your organization uses Citrix, advise your IT staff to upgrade. IT staff can get more information on the National Vulnerability Database.

WordPress Vulnerabilities: Several vulnerabilities in WordPress Plugin have been announced this week. If your web site is developed in WordPress, advise your web master to apply needed updates.

Important Vulnerabilities.

Microsoft Internet Explorer: Microsoft has warned in an Advisory that cyber criminals have published instructions for exploiting a previously unknown security vulnerability in all versions of Windows. The exploit can be used to steal user data or take control of a user’s workstation. While the flaw resides in Windows, it manifests in Internet Explorer. According to KrebsOnSecurity, the vulnerability does not impact other browsers such as Firefox and Chrome. Microsoft has said that they may issue a patch for this vulnerability. In the meantime, Microsoft has made available a “FixIT” tool to help strengthen the way Windows handles MHTML documents. To enable that fix, visit this link and click the FixIT icon.

If you are responsible for keeping your computer secure, our weekly report is for you. We strongly urge you to take action to keep your workstation secure.

If someone else is responsible for keeping your computer secure, protect it by forwarding our Weekend Vulnerability and Patch Report to them and following up to make sure your computer has been patched.

Vulnerability management is a key element of cyber security management. Cyber criminals take over user computers by writing computer programs that “exploit” vulnerabilities in operating systems (Windows, Apple OS, etc) and application programs (Adobe Acrobat, Office, Flash, Java, etc). When software companies find a vulnerability, they will issue an update patch to fix the code running in their customer’s computers.

The Weekend Vulnerability and Patch Report is intended to raise user awareness to cyber security challenges by alerting them to some of the week’s important updates and newly discovered vulnerabilities. It is not intended to be a thorough listing of these.