April 16, 2008 - Current Activity

Federal Subpoena Spear-Phishing Attack

US-CERT is aware of public reports of a spear-phishing attack circulating via email messages that claim to be federal subpoenas. These messages appear to be legitimate because they can contain very specific information about the message recipient. The message requests that the user follow a link to download additional information about the case, but if a user clicks on this link, malicious code may be installed on the system.

US-CERT encourages users to do the following to help mitigate the risk:

• Review the alert posted by the U.S. Courts regarding this issue.
  
• Do not follow unsolicited web links received in email messages.
• Refer to the Recognizing and Avoiding Email Scams (pdf) document for more information on avoiding email scams.
• Refer to the Avoiding Social Engineering and Phishing Attacks document for more information on social engineering attacks.
• Install anti-virus software and keep virus signature files up to date.

Oracle Releases Critical Patch Update for April 2008

Oracle has released their Critical Patch Update for April 2008 to address 41 vulnerabilities across several products. This update contains the following security fixes:

• 17 updates for Oracle Database
• 3 updates for Oracle Enterprise Manager
• 11 updates for Oracle E-Business Suite
• 1 update for the Oracle Enterprise Manager
• 3 updates for Oracle PeopleSoft Enterprise products
• 6 updates for Oracle Siebel SimBuilder products

Multiple ClamAV Vulnerabilities

Clam AntiVirus has released ClamAV 0.93 to address multiple vulnerabilities. Two of these vulnerabilities are due to buffer overflow conditions in the handling of Upack executables in libclamav/pe.c and PeSpin packed executables in libclamav/spin.c. There are two additional vulnerabilities due to improper handling of ARJ and RAR archives. Exploitation of these vulnerabilities may allow a remote, unauthenticated attacker to execute arbitrary code or cause a denial-of-service condition.

US-CERT encourages users to review the changelog and update to ClamAV 0.93 to help mitigate the risks.

Oracle Issues Pre-Release Announcement for April Critical Patch Update

Oracle has issued a Pre-Release Announcement indicating that its April Critical Patch Update (CPU) will contain 41 new security fixes across hundreds of products.  

The announcement further states that there are:

• 17 updates for Oracle Database
• 3 updates for Oracle Enterprise Manager
• 11 updates for Oracle E-Business Suite
• 1 update for the Oracle Enterprise Manager
• 3 updates for Oracle PeopleSoft Enterprise products
• 6 updates for Oracle Siebel SimBuilder products

EMC DiskXtender Vulnerabilities

US-CERT is aware of reports of vulnerabilities in EMC DiskXtender. These vulnerabilities may allow a remote, unauthenticated attacker to execute arbitrary code or bypass security restrictions on an affected system.

US-CERT encourages registered EMC Powerlink users to visit EMC's website for additional information regarding these vulnerabilities.  

Active Exploitation of GDI Vulnerabilities

US-CERT is following public reports indicating that attackers are attempting to exploit vulnerabilities in GDI. These vulnerabilities are due to buffer overflow conditions that exist in the processing of EMF and WMF image files. By convincing a user to open a specially crafted EMF or WMF file, a remote attacker may be able to execute arbitrary code. These vulnerabilities were addressed in Microsoft Security Bulletin MS08-021. Users who have not applied this patch are vulnerable.

Additional information about these vulnerabilities is available in the Vulnerability Notes Database. More information about the exploit attempts is available from Symantec.

US-CERT encourages users to review MS08-021 and apply the patch or workarounds to help mitigate the risks.

Email Attack Circulating

US-CERT has seen reports of an email attack that is circulating. This attack is in the form of an email message with the subject line "Evacuation process has been started due to radiation leaks at San Clemente Nucklear Power Station." The message body states that the information is from a trusted news source and encourages users to follow a link to view a video. This link may direct users to a website hosting malicious code.

US-CERT encourages users to do the following to help mitigate the risk:

• Install anti-virus software and keep its virus signature files up to date.
• Do not follow unsolicited web links received in email messages.
• Refer to the Recognizing and Avoiding Email Scams document for more information on avoiding email scams.
• Refer to the Avoiding Social Engineering and Phishing Attacks document for more information on social engineering attacks.

Adobe Flash Player Vulnerabilities

Adobe has released Flash Player 9.0.124.0 to address multiple vulnerabilities. These vulnerabilities may allow a remote attacker to execute arbitrary code or conduct cross-site scripting attacks.

More information about these vulnerabilities can be found in Technical Cyber Security Alert TA08-100A.

US-CERT encourages users to review Adobe Security Bulletin APSB08-11 and upgrade to Flash Player 9.0.124.0 to help mitigate the risks.

IBM Lotus Notes Vulnerabilities

IBM has released Technote 1298453 to address multiple vulnerabilities in Lotus Notes. These vulnerabilities are due to improper handling of the following file types:

• Applix Presents (.ag)
• Folio Flat File (.fff)
• HTML speed reader (.htm)
• KeyView document viewing engine
• Text mail (MIME)

Microsoft Releases April Security Bulletin

Microsoft has released updates to address vulnerabilities in Microsoft Windows, Office, and Internet Explorer as part of the Microsoft Security Bulletin Summary for April 2008. These vulnerabilities could allow an attacker to execute arbitrary code, access the system with elevated privileges, or redirect internet traffic.

More information about these vulnerabilities can be found in Technical Cyber Security Alert TA08-099.

US-CERT encourages user to review the bulletins and follow best-practice security policies to determine which updates should be applied.