Weekend Vulnerability & Patch Report, May 27, 2011

The following software updates were released last week. Citadel Information Group strongly recommends that readers upgrade these programs on their computers.

 

Symantec Backup Exec: A weakness has been reported in Symantec Backup Exec products, which can be exploited by malicious people to bypass certain security restrictions. Update or upgrade to Symantec Backup Exec 2010 R3.

IBM Lotus Notes: Highly critical vulnerabilities have been reported in IBM Lotus Notes. Remote exploitation of a stack buffer overflow vulnerability could allow an attacker to execute arbitrary code in the context of the current user. The vulnerabilities are reported in versions 8.0 and 8.5. IBM has released patches and workarounds to address this vulnerability. For more information, consult their advisory at https://www-304.ibm.com/support/docview.wss?uid=swg21500034.

Google Chrome: Several more highly critical vulnerabilities have been reported in Google Chrome. Update to version 11.0.696.71. You can find a full list of fixes that are in Chrome OS R12 in the chromium-os bug tracker.

 

Newly Announced Unpatched Vulnerabilities (Zero-Days)

None

 

Special Cyber Security Warnings

Apple Users Scareware Scams: Since the beginning of May, security firms have been warning Apple users to be aware of new scareware threats like MacDefender and Mac Security.

 

Important Unpatched Zero-Day Vulnerabilities.

Apple iOS: Our research still fails to determine if iOS 4.3.2 fixes the critical vulnerability identified during the recent “computer hacking” Pwn2Own competition. We first alerted readers to this vulnerability in Weekend Vulnerability and Patch Report, May 13, 2011.

Apple Safari 5.x: The critical zero-day vulnerability in Safari 5.x continues unpatched. We continue to consider Safari unsafe for browsing. We first alerted readers to this vulnerability in Weekend Vulnerability and Patch Report, February 18.

HTC Mobile Devices: The zero-day security vulnerability in the default Twitter application (Peep) in HTC products remain unpatched. We first alerted readers to this vulnerability in Weekend Vulnerability and Patch Report, February 11.

Microsoft Office for Mac: A highly critical zero-day vulnerability has been discovered in Microsoft Office for the Mac which can be exploited by cyber criminals to take control of a user’s computer. Security updates are currently unavailable. We first alerted readers to this vulnerability in Weekend Vulnerability & Patch Report, May 13, 2011.

Microsoft Reader: The highly critical zero-day vulnerability in Microsoft Reader, versions 2.x, remains unpatched.  We first alerted readers to this vulnerability in Weekend Vulnerability and Patch Report, April 15.

PDF-Pro: Several highly critical zero-day vulnerabilities in PDF-Pro, a popular alternative to Adobe Acrobat, remain unpatched. We first alerted readers to this vulnerability in Weekend Vulnerability and Patch Report, March 4.

SlimPDF Reader: A moderately critical zero-day vulnerability has been discovered in this PDF reader. No patch is available at this time. Readers are advised to refrain from opening PDF files in this reader from untrusted sources. We first alerted readers to this vulnerability in Weekend Vulnerability and Patch Report, May 20, 2011.

VLC Media Player: Several highly critical zero-day vulnerabilities in VLC Media Player version 1.1.9 remains unpatched. We first alerted readers to this vulnerability in Weekend Vulnerability and Patch Report, May 6.

 

If you are responsible for keeping your computer secure, our weekly report is for you. We strongly urge you to take action to keep your workstation secure.

If someone else is responsible for keeping your computer secure, protect it by forwarding our Weekend Vulnerability and Patch Report to them and following up to make sure your computer has been patched.

Vulnerability management is a key element of cyber security management. Cyber criminals take over user computers by writing computer programs that “exploit” vulnerabilities in operating systems (Windows, Apple OS, etc) and application programs (Adobe Acrobat, Office, Flash, Java, etc). When software companies find a vulnerability, they will issue an update patch to fix the code running in their customer’s computers.

Citadel publishes our Weekend Vulnerability and Patch Report to alert readers to some of the week’s important updates and vulnerabilities. Our focus is on software typically found in the small or home office (SOHO) or that users are likely to have on their home computer. The report is not intended to be a thorough listing of updates and vulnerabilities.