Weekend Vulnerability and Patch Report, February 4, 2011

The following software updates were released last week. Citadel strongly recommends that readers upgrade these programs on their computers.

Google Chrome 9: The same week that multiple highly critical vulnerabilities were reported in Google Chrome 8, Google released version 9. Readers can update here.

VLC Media Player 1.1.7: VLC has updated its popular media player to version 1.1.7. This follows our reports last month of unpatched critical vulnerabilities in version 1.1.5 and the discovery of a highly critical vulnerability in version 1.1.6.1. The update is available here.

Advance Update Notices.

Microsoft: Microsoft has issued a Security Bulletin Advance Notification that its February release will contain 12 bulletins.  Three of these bulletins will have the severity rating of critical and will be for Microsoft Windows and Internet Explorer.  The remaining bulletins will have a severity rating of important and will be for Microsoft Windows and Office. Release of these updates is scheduled for Tuesday, February 8, 2011.

Adobe: Adobe had issued a prenotification advisory indicating that it plans to release updates for Adobe Reader and Acrobat. Updates for Windows and Macintosh will be available on February 8, 2011. An update for UNIX will be available the week of February 28, 2011.

Important Vulnerabilities.

AOL: A zero-day vulnerability has been found in the way AOL handles Rich Text Files. The vulnerability allows a cyber criminal to take control of a user’s computer by inducing the user to open a specially formatted Rich Text File. There is no patch for this vulnerability at this time. AOL users should not open Rich Text Files sent in email or downloaded from the web unless the user has independent verification [such as a phone call with the sender] that the file is OK.

Microsoft Internet Explorer: We still consider Internet Explorer not secure for browsing the web. [See our Reports of Dec 31 and Jan 28.]

If you are responsible for keeping your computer secure, our weekly report is for you. We strongly urge you to take action to keep your workstation secure.

If someone else is responsible for keeping your computer secure, protect it by forwarding our Weekend Vulnerability and Patch Report to them and following up to make sure your computer has been patched.

Vulnerability management is a key element of cyber security management. Cyber criminals take over user computers by writing computer programs that “exploit” vulnerabilities in operating systems (Windows, Apple OS, etc) and application programs (Adobe Acrobat, Office, Flash, Java, etc). When software companies find a vulnerability, they will issue an update patch to fix the code running in their customer’s computers.

The Weekend Vulnerability and Patch Report is intended to raise user awareness to cyber security challenges by alerting them to some of the week’s important updates and newly discovered vulnerabilities. It is not intended to be a thorough listing of these.