Weekend Vulnerability and Patch Report, March 18, 2011

The following software updates were released last week. Citadel Information Group strongly recommends that readers upgrade these programs on their computers.

Google Chrome 10.0.648.134: Google has released two upgrades to Chrome this week. The upgrades fix critical security vulnerabilities, including an updated integrated version of the Adobe Flash player. The update is available here.

Internet Explorer 9: Microsoft has released Internet Explorer 9 (IE9). Unfortunately it runs only on Vista and Windows 7.IE 9 is available here.

Special Cyber Security Warnings

Phishing Attacks: US-CERT is warning Internet users of an ongoing phishing attack targeting PayPal, Bank of America, Lloyds and TSB users. The attack arrives via an unsolicited email message containing an HTML attachment. We remind users to be extremely suspicious of email correspondence appearing to come from your bank, brokerage account, PayPal or other financial institution. These organizations typically limit their customer emails to providing information. They NEVER ask for personal information.

Tsunami Scam Warning: US-CERT continues to warn Internet Users to be cautious of potential email scams, fake antivirus and phishing attacks regarding the Japan earthquake and the tsunami disasters. Email scams may contain links or attachments which may direct users to phishing or malware-laden websites. Phishing emails and websites requesting donations for bogus for charitable organizations commonly appear after these types of natural disasters.

Newly Announced Unpatched Vulnerabilities

Adobe: Adobe has released a security advisory to alert users of a critical vulnerability that may allow a cyber criminal to take control of a user’s computer. The vulnerability affects the following products:

• Adobe Flash Player 10.2.152.33 and earlier versions for Windows, Macintosh, Linux, and Solaris
• Adobe Flash Player 10.2.154.18 and earlier versions for Google Chrome users
• Adobe Flash Player 10.1.106.16 and earlier versions for Android
• Adobe Reader and Acrobat X (10.0.1) and earlier 10.x and 9.x versions for Windows and Macintosh.

Adobe has stated that they expect to release a fix for this vulnerability during the coming week.

BlackBerry: Research In Motion has released a security notice (KB26132) to alert users of a vulnerability affecting the browser in BlackBerry Software versions 6.0 and later. A cyber criminal exploiting this vulnerability may gain access to user data stored on the media card and the built-in media storage. Users can do the following to help mitigate the risks:

• Exercise caution when accessing untrusted websites in browsers, email messages, or instant messages.
• Disable the use of JavaScript in the BlackBerry Browser or Disable the BlackBerry Browser as suggested in BlackBerry security notice KB26132.

Important Unpatched Vulnerabilities.

Apple Safari 5.x: A vulnerability in Safari 5.x first identified last June continues unpatched. We continue to consider Safari unsafe for browsing.

AOL: The zero-day vulnerability in the way AOL handles Rich Text Files remains unpatched.

CA Internet Security Suite: Highly critical security vulnerabilities have been found in versions 6.x and 7.x of this popular all-in-one security program. These vulnerabilities can be exploited remotely by malicious people to take remote control of a user’s system. CA has not announced a patch for this program. CA did release an upgrade to version 8.x of its corporate Host-Based Intrusion Prevention System—which suffered from similar vulnerabilities—leading one to suspect that CA will soon have an upgrade to its Internet Security Suite.

HTC Mobile Devices: The security issues in the default Twitter application (Peep) in HTC products remain unpatched.

Internet Explorer 8.x: We continue to consider Internet Explorer 8.x unsafe for browsing. IE8 has been on our vulnerability list since January 28 and has not yet been patched. We advise upgrading to IE9 if you’re running Vista or Windows 7.

PDF-Pro: Several highly critical vulnerabilities have been found in PDF-Pro, a popular alternative to Adobe Acrobat.  These vulnerabilities would allow a cyber criminal to take control of a user’s computer.The vulnerabilities are confirmed in version 4.0.1.758. Most are also confirmed in version 4.5.2.1321 . Other versions may also be affected. We urge readers to refrain from opening untrusted PDF files using PDF-Pro.

If you are responsible for keeping your computer secure, our weekly report is for you. We strongly urge you to take action to keep your workstation secure.

If someone else is responsible for keeping your computer secure, protect it by forwarding our Weekend Vulnerability and Patch Report to them and following up to make sure your computer has been patched.

Vulnerability management is a key element of cyber security management. Cyber criminals take over user computers by writing computer programs that “exploit” vulnerabilities in operating systems (Windows, Apple OS, etc) and application programs (Adobe Acrobat, Office, Flash, Java, etc). When software companies find a vulnerability, they will issue an update patch to fix the code running in their customer’s computers.

Citadel publishes our Weekend Vulnerability and Patch Report to alert readers to some of the week’s important updates and vulnerabilities. Our focus is on software typically found in the small or home office (SOHO) or that users are likely to have on their home computer. The report is not intended to be a thorough listing of updates and vulnerabilities.