Weekend Vulnerability and Patch Report, August 7, 2011

The following software vulnerabilities and updates were announced last week. Citadel Information Group strongly recommends that readers update their computers and take other action as indicated.

Important Security Updates

Apple QuickTime 7.7: Apple has released QuickTime 7.7 to correct 14 highly critical vulnerabilities in QuickTime. Readers can update directly from QuickTime or from Apple’s Download site.

Google Chrome 13.0.782.107: Google has released Chrome 13.0.782.107 for Windows, Mac, Linux, and Chrome Frame address 29 highly critical vulnerabilities. Updates are available from within Chrome via “Customize > About Google Chrome.” (“Customize” is the wrench-shaped icon in the upper right hand corner.)

For Your IT Department

osCommerce: As we reported in this week’s Cyber Security News of the Week, KrebsOnSecurity.com has reported that six million Web Pages running outdated and insecure versions of osCommerce have been booby-trapped. A visitor to any of these sites is at risk of having malware installed on their  computer. This malware gives a cyber criminal complete control of the victim’s computer. Readers whose organizations might use osCommerce to provide e-Commerce solutions should refer their IT Department or web developer to (i) a blog post from the Armorize, the company discovering the problem and (ii) an osCommerce tutorial on securing their applications.

WordPress WP e-Commerce Plugin 3.x: A serious vulnerability to this plugin has been discovered that allows attackers to conduct cross-site scripting attacks. Readers whose organizations have e-Commerce websites built in WordPress should refer their their IT Department or web developer to the vulnerability announcement.

WordPress Themes Vulnerabilities: US CERT has announced that TimThumb, a PHP script that is reused in many popular themes for the WordPress blog software, contains a highly critical vulnerability that allows a remote attacker to upload arbitrary PHP code to an affected site. Readers whose organizations have websites built in WordPress should refer their IT Department or web developer to the blog entry on the issue.

Newly Announced Unpatched Vulnerabilities

Microsoft Windows XP: A less-critical security vulnerability has been found in Windows XP which can be exploited by malicious, local users to disclose potentially sensitive information or cause a DoS (Denial of Service). No patch is available at this time.

Important Unpatched Vulnerabilities

ACDSee Photo: Several highly critical vulnerabilities have been identified in various ACDSee photo products. Vulnerabilities have been identified in FotoSlate, Photo Editor 2008, and Picture Frame Manager. No patches are available at this time. Readers should refrain from using ACDSee to open untrusted files. We first alerted readers to this vulnerability in Weekend Vulnerability and Patch Report, June 12.

ACD Systems Canvas CorelDRAW: A highly critical vulnerability has been found in ACD Systems Canvas which can be exploited by malicious people to compromise a user’s system. Users should not view untrusted CDR files. Readers should refrain from opening untrusted files in ACD Systems Canvas. We first alerted readers to this vulnerability in Weekend Vulnerability and Patch Report, July 31.

HTC Mobile Devices: The security vulnerability in the default Twitter application (Peep) in HTC products remain unpatched. Readers should refrain from using the default Twitter application (Peep). We first alerted readers to this vulnerability in Weekend Vulnerability and Patch Report, February 11.

Internet Explorer: A security vulnerability has been found in Internet Explorer versions 6 and 7. Users should make sure they are running version 8 or later. We first alerted readers to this vulnerability in Weekend Vulnerability and Patch Report, July 31.

Microsoft Word: A highly critical vulnerability has been found in Microsoft Word XP and 2002. No patch is available at this time. Readers should refrain from opening untrusted files in these earlier versions of Word. We first alerted readers to this vulnerability in Weekend Vulnerability and Patch Report, June 19.

Microsoft Office for Mac: A highly critical vulnerability has been discovered in Microsoft Office for the Mac which can be exploited by cyber criminals to take control of a user’s computer. Security updates are currently unavailable. Readers should refrain from opening untrusted files in Office. We first alerted readers to this vulnerability in Weekend Vulnerability & Patch Report, May 13, 2011.

Microsoft Reader: The highly critical vulnerability in Microsoft Reader, versions 2.x, remains unpatched.  Readers should refrain from opening untrusted files in Reader. We first alerted readers to this vulnerability in Weekend Vulnerability and Patch Report, April 15.

PDF-Pro: Several highly critical vulnerabilities in PDF-Pro, a popular alternative to Adobe Acrobat, remain unpatched. Readers should refrain from opening untrusted files in PDF-Pro. We first alerted readers to this vulnerability in Weekend Vulnerability and Patch Report, March 4.

Quick View Plus CorelDRAW: A highly critical vulnerability has been found in Quick View Plus which can be exploited by malicious people to compromise a user’s system. Users should not view untrusted CDR files in Quick View Plus. We first alerted readers to this vulnerability in Weekend Vulnerability and Patch Report, July 31.

If you are responsible for keeping your computer secure, our weekly report is for you. We strongly urge you to take action to keep your workstation secure.

If someone else is responsible for keeping your computer secure, protect it by forwarding our Weekend Vulnerability and Patch Report to them and following up to make sure your computer has been patched.

Vulnerability management is a key element of cyber security management. Cyber criminals take over user computers by writing computer programs that “exploit” vulnerabilities in operating systems (Windows, Apple OS, etc) and application programs (Adobe Acrobat, Office, Flash, Java, etc). When software companies find a vulnerability, they will issue an update patch to fix the code running in their customer’s computers.

Citadel publishes our Weekend Vulnerability and Patch Report to alert readers to some of the week’s important updates and vulnerabilities. Our focus is on software typically found in the small or home office (SOHO) or that users are likely to have on their home computer. The report is not intended to be a thorough listing of updates and vulnerabilities.