-
See the Archives
- May 2012
- April 2012
- March 2012
- February 2012
- January 2012
- December 2011
- November 2011
- October 2011
- September 2011
- August 2011
- July 2011
- June 2011
- May 2011
- April 2011
- March 2011
- February 2011
- January 2011
- December 2010
- November 2010
- October 2010
- September 2010
- August 2010
- July 2010
- June 2010
- May 2010
- April 2010
- March 2010
- February 2010
- January 2010
- December 2009
- November 2009
- October 2009
- September 2009
- August 2009
- July 2009
- June 2009
- May 2009
- February 2009
-
Filter by Category
- Business at risk
- Citadel in the news
- Citadel Information Security Guides
- Citadel: Guide to Blog
- Citadel: Thinking about Security
- Cloud Security
- Combatting Cybercrime
- Consumers at risk
- Cost of Cybercrime
- Cost of Piracy
- Credit card fraud
- Culture Change
- cyber security learning community
- Cyber Security Management
- Cyber War
- events
- Financial systems security
- Future of Cyberspace
- Healthcare
- Identity theft
- Information at Risk
- Insurance
- Internet badlands
- ISSA-LA
- Law Firms
- Legal
- Miscellany
- mobile banking
- mobile internet
- Mobile Security
- national security
- Not-for-Profit
- Online Privacy
- OWASP
- Privacy Matters
- Ray of Sunshine
- School security
- Security Alert: Vulnerability Management
- Security management
- Security Research
- Security Surveys
- Social Engineering
- Social networks
- Virtual Currency
Weekend Vulnerability & Patch Report, May 6, 2011
The following software updates were released last week. Citadel Information Group strongly recommends that readers upgrade these programs on their computers.
Adobe Photoshop: Adobe has released CS5 12.0.4 to address multiple vulnerabilities. No further information is available.
Apple Mac OS X 10.6.7: Apple has released OS 10.6.7 for the iMac, available here.
Apple MacBook Pro Update 1.4: Apple has released an update for the MacBook Pro, available here.
Apple iOS 4.28. and iOS 4.3.3: Apple has released updates to iOS, available here. These updates contain changes to the iOS crowd-sourced location data for which Apple was roundly criticized. (See our Cyber Security News of the Week, April 22, 2011)
Newly Announced Unpatched Vulnerabilities (Zero-Days)
VLC Media Player: Several highly critical zero-day vulnerabilities have been discovered in VLC Media Player version 1.1.9. These vulnerabilities can be exploited by cyber criminals to compromise a user’s system. No patch is available at this time.
Important Unpatched Zero-Day Vulnerabilities.
Apple iOS: Our research fails to determine if iOS 4.3.2 fixes the critical vulnerability identified during the recent “computer hacking” Pwn2Own competition.
Apple Safari 5.x: The critical zero-day vulnerability in Safari 5.x continues unpatched. We continue to consider Safari unsafe for browsing. We first alerted readers to this vulnerability in Weekend Vulnerability and Patch Report, February 18.
AOL: The zero-day vulnerability in the way AOL handles Rich Text Files remains unpatched. We first alerted readers to this vulnerability in Weekend Vulnerability and Patch Report, February 4.
BlackBerry: The zero-day vulnerability affecting the browser in BlackBerry Software versions 6.0 and later remains unpatched. We first alerted readers to this vulnerability in Weekend Vulnerability and Patch Report, March 18.
CA Internet Security Suite: The highly critical zero-day vulnerabilities in versions 6.x and 7.x of this popular all-in-one security program remain unpatched. We first alerted readers to this vulnerability in Weekend Vulnerability and Patch Report, December 3.
Easy File Sharing Web Server 5.8: The moderately critical zero-day vulnerability remains unpatched. We highly recommend users refrain from using this software — or any other similar Peer-to-Peer file sharing software. We alerted readers more than a year ago that the FTC had warned businesses and users about the dangers of Peer-to-Peer (P2P) file-sharing networks. These products are known sources of security leaks, both from misconfigurations and from unpatched vulnerabilities.
HTC Mobile Devices: The zero-day security vulnerability in the default Twitter application (Peep) in HTC products remain unpatched. We first alerted readers to this vulnerability in Weekend Vulnerability and Patch Report, February 11.
Microsoft Reader: The highly critical zero-day vulnerability in Microsoft Reader, versions 2.x, remains unpatched. We first alerted readers to this vulnerability in Weekend Vulnerability and Patch Report, April 15.
PDF-Pro: Several highly critical zero-day vulnerabilities in PDF-Pro, a popular alternative to Adobe Acrobat, remain unpatched. We first alerted readers to this vulnerability in Weekend Vulnerability and Patch Report, March 4.
If you are responsible for keeping your computer secure, our weekly report is for you. We strongly urge you to take action to keep your workstation secure.
If someone else is responsible for keeping your computer secure, protect it by forwarding our Weekend Vulnerability and Patch Report to them and following up to make sure your computer has been patched.
Vulnerability management is a key element of cyber security management. Cyber criminals take over user computers by writing computer programs that “exploit” vulnerabilities in operating systems (Windows, Apple OS, etc) and application programs (Adobe Acrobat, Office, Flash, Java, etc). When software companies find a vulnerability, they will issue an update patch to fix the code running in their customer’s computers.
Citadel publishes our Weekend Vulnerability and Patch Report to alert readers to some of the week’s important updates and vulnerabilities. Our focus is on software typically found in the small or home office (SOHO) or that users are likely to have on their home computer. The report is not intended to be a thorough listing of updates and vulnerabilities.
