Weekend Vulnerability and Patch Report, March 4, 2011

The following software updates were released last week. Citadel Information Group strongly recommends that readers upgrade these programs on their computers.

Mozilla Firefox 3.6.15: Mozilla has updated Firefox to address multiple highly critical vulnerabilities. These vulnerabilities would allow a cyber criminal to take control of a user’s computer. The update can be installed from the Firefox Help menu.

Mozilla Thunderbird 3.1.9: Mozilla has updated Thunderbird to address multiple highly critical vulnerabilities. These vulnerabilities would allow a cyber criminal to take control of a user’s computer.

Google Chrome 9.0.597.107: Google has updated Chrome to address multiple highly critical vulnerabilities. These vulnerabilities would allow a cyber criminal to take control of a user’s computer. Information on installing or updating Chrome is available here.

Apple iTunes 10.2: Apple has released version 10.2 which patches at least 14 vulnerabilities in iTunes. Many of these vulnerabilities are highly critical, allowing a cyber criminal to take control of a user’s computer. More information and downloads are available here.

WordPress Plugins: Several WordPress plugins have been updated this week. Readers with websites developed using this popular content management system will want to alert their web developers to upgrade WordPress to version 3.1 and make sure they are running the most recent plugins.

Cisco: Cisco has released 6 security advisories to address several vulnerabilities in multiple Cisco products. Readers will want to alert their IT Departments. More information can be found on the US Government CERT web site.

Critical Security Alert.

Android Applications: Google has removed more than 50 malicious applications from its Android Market. All of these malicious apps are highly critical and can steal data from your phone. Many of the apps have benign names like “Chess” and “Photo Editor.” Others are more obvious come-ons with names like “Super Sex Positions.” A list of currently known malicious applications is available from Business Insider. If you have any of these apps on your phone, it’s best to do a full restore. Readers should check user reviews and ratings before downloading apps. If you have any doubt, it’s best to skip the download. Citadel will continue to cover this story as more information becomes available.

Important Unpatched Vulnerabilities.

PDF-Pro: Several highly critical vulnerabilities have been found in PDF-Pro, a popular alternative to Adobe Acrobat.  These vulnerabilities would allow a cyber criminal to take control of a user’s computer.The vulnerabilities are confirmed in version 4.0.1.758. Most are also confirmed in version 4.5.2.1321 . Other versions may also be affected. We urge readers to refrain from opening untrusted PDF files using PDF-Pro.

CA Internet Security Suite: Highly critical security vulnerabilities have been found in versions 6.x and 7.x of this popular all-in-one security program. These vulnerabilities can be exploited remotely by malicious people to take remote control of a user’s system. CA has not announced a patch for this program. CA did release an upgrade to version 8.x of its corporate Host-Based Intrusion Prevention System—which suffered from similar vulnerabilities—leading one to suspect that CA will soon have an upgrade to its Internet Security Suite.

Internet Explorer 8.x: We continue to consider Internet Explorer 8.x unsafe for browsing. IE8 has been on our vulnerability list since January 28 and is likely to remain there until Patch Tuesday, March 8.

Apple Safari 5.x: A vulnerability in Safari 5.x first identified last June continues unpatched. We continue to consider Safari unsafe for browsing.

Microsoft Office: The critical vulnerabilities in Microsoft products including Office, Excel, and PowerPoint remain unpatched.

AOL: The zero-day vulnerability in the way AOL handles Rich Text Files remains unpatched.

HTC Mobile Devices: The security issues in the default Twitter application (Peep) in HTC products remain unpatched.

If you are responsible for keeping your computer secure, our weekly report is for you. We strongly urge you to take action to keep your workstation secure.

If someone else is responsible for keeping your computer secure, protect it by forwarding our Weekend Vulnerability and Patch Report to them and following up to make sure your computer has been patched.

Vulnerability management is a key element of cyber security management. Cyber criminals take over user computers by writing computer programs that “exploit” vulnerabilities in operating systems (Windows, Apple OS, etc) and application programs (Adobe Acrobat, Office, Flash, Java, etc). When software companies find a vulnerability, they will issue an update patch to fix the code running in their customer’s computers.

Citadel publishes our Weekend Vulnerability and Patch Report to alert readers to some of the week’s important updates and vulnerabilities. Our focus is on software typically found in the small or home office (SOHO) or that users are likely to have on their home computer. The report is not intended to be a thorough listing of updates and vulnerabilities.