Sharpe Security Blog

Since Opera now has over 2% of web browser market share, we are initiating coverage of the Opera web browser platform.Version 10.54 of Opera has been released. It includes 5 security bugfixes.References:http://www.opera.com/docs/changelogs/windows/1054/email: david @ sharpesecurity.com website: www.sharpesecurity.comTwitter: twitter.com/sharpesecurity

Adobe has released Reader/Acrobat versions 9.3.3 and 8.2.3. These updates include 17 security-related fixes including one related to Flash content embedded in PDFs that has been exploited in the wild./Launch actions are also defaulted to off starting with this release. If you enable /Launch, then the warning the user sees is much improved.The GDI object leak and crash problem described here remains unfixed.References:http://www.adobe.com/support/security/bulletins/apsb10-15.htmlhttp://blog.didierstevens.com/2010/06/29/quickpost-no-escape-from-pdf/email: david @ sharpesecurity.com website: www.sharpesecurity.comTwitter: twitter.com/sharpesecurity

Apple has released iOS 4. This new version of Apple iOS contains fixes for over 60 vulnerabilities. References:http://support.apple.com/kb/HT4225email: david @ sharpesecurity.com website: www.sharpesecurity.comTwitter: twitter.com/sharpesecurity

Mozilla has released Firefox 3.6.4 and 3.5.10. 3.6.4 contains 7 security fixes and 3.5.10 contains 9. Please note that Mozilla plans to drop support for 3.5.x in two months.References:http://www.mozilla.com/en-US/firefox/3.6.4/releasenotes/http://www.mozilla.com/en-US/firefox/3.5.10/releasenotes/email: david @ sharpesecurity.com website: www.sharpesecurity.comTwitter: twitter.com/sharpesecurity

Cisco has announced end-of-life for the Cisco Security Agent product line. The relevant timelines and other details related to the drawdown are at the link below. From the article:”There is no replacement available for the Cisco Security Agent at this time.Cisco’s network security product portfolio has complementary security technologies, such as Cisco Intrusion Prevention Systems,Cisco ASA 5500 Series Adaptive Security Appliances, and Cisco IronPort Email and Web gateways. Please contact your Cisco account team for more information on these products. While there is no direct Cisco Security Agent replacement product from Cisco, many … Continue Reading

Versions 3.0.x – 3.3.12 of Samba have a vulnerability that allows remote root level access. Version 3.4.0 and higher isn’t vulnerable. References:http://www.samba.org/samba/security/CVE-2010-2063email: david @ sharpesecurity.com website: www.sharpesecurity.comTwitter: twitter.com/sharpesecurity

Need to find out what is on the other side of that bit.ly or tinyurl shortened link? Try http://longurl.org/ or http://sucuri.net/index.php?page=tools&title=check-url. They’re both free.email: david @ sharpesecurity.com website: www.sharpesecurity.comTwitter: twitter.com/sharpesecurity

There are security updates in Apple’s iTunes 9.2 release affecting Windows XP, Vista, and Windows 7. Details are in the link below.References:http://support.apple.com/kb/HT4220email: david @ sharpesecurity.com website: www.sharpesecurity.comTwitter: twitter.com/sharpesecurity

OpenOffice has released a new version that addresses two vulnerabilities.References:http://www.openoffice.org/security/cves/CVE-2009-3555.htmlhttp://www.openoffice.org/security/cves/CVE-2010-0395.htmlemail: david @ sharpesecurity.com website: www.sharpesecurity.comTwitter: twitter.com/sharpesecurity

Regarding Tavis Ormandy’s recent disclosure of a vulnerability in Windows Help and Support Center, my understanding is that there are five basic paths to take when you have a valid vulnerability to disclose. They are enumerated below. In short, I think Tavis Ormandy went down the RFPv2 path, and thus was within his rights to disclose when he did assuming that Microsoft didn’t in fact reply to him within the 5 days allowed.As a corporate defender, I would prefer that researchers not take such an aggressive stance with disclosure, but my point is that what he … Continue Reading

Microsoft has released updates for Apple Mac Office 2004, Mac Office 2008, and Open XML File Format Converter for Mac software. These updates includes fixes for some security vulnerabilities. References:Description of the Microsoft Office 2004 for Mac 11.5.9 Update: http://support.microsoft.com/kb/2028866Download Microsoft Office 2004 for Mac 11.5.9 Update: http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=16c71ab8-9284-407a-856a-93c67995f125Description of the Microsoft Office 2008 for Mac 12.2.5 Update: http://support.microsoft.com/kb/2028864Download Microsoft Office 2008 for Mac 12.2.5 Update: http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=d46255bd-6470-4106-9fe2-ea67acd3f1bdDownload Open XML File Format Converter for Mac 1.1.4: http://www.microsoft.com/downloads/details.aspx?FamilyID=4c5487d5-c912-4087-8c83-769e3fb78ea9&displaylang=en… Continue Reading

Google Chrome 5.0.375.70 has been released for Windows, Mac, and Linux. The update includes fixes for 11 vulnerabilities, 9 of which are classified as criticalReferences:http://googlechromereleases.blogspot.com/2010/06/stable-channel-update.htmlemail: david @ sharpesecurity.com website: www.sharpesecurity.comTwitter: twitter.com/sharpesecurity

Apple has released security updates and other bugfixes for the Apple Safari 4.1 and 5.0 browser platforms. Some of these security bugs are remotely exploitable according to Apple’s release notes.References:http://support.apple.com/kb/HT4196email: david @ sharpesecurity.com website: www.sharpesecurity.comTwitter: twitter.com/sharpesecurity

Adobe has announced that the next Flash player update is due out on 10 June 2010. This affects Windows and Mac.The Adobe Reader/Acrobat update is due out 29 June 2010. This also affects Windows and Mac. Adobe also said that the normal quarterly update due out 13 July 2010 won’t happen due to this out-of-band release.UPDATE 09 June 2010 – Proof of concept code was made available here: http://www.exploit-db.com/exploits/13787/. Please be aware that the PoC provided at that link is live malicious code, so handle with caution.UPDATE-2 … Continue Reading

This Wired article discusses a U.S. Army intelligence analyst being arrested for leaking classified and other sensitive information to Wikileaks. A quote from the Wired article:“I would come in with music on a CD-RW labeled with something like ‘Lady Gaga’, erase the music then write a compressed split file,” he wrote. “No one suspected a thing and, odds are, they never will.”“[I] listened and lip-synced to Lady Gaga’s ‘Telephone’ while exfiltrating possibly the largest data spillage in American history,” he added later. ”Weak servers, weak logging, weak physical security, weak counter-intelligence, inattentive signal … Continue Reading

Adobe announced a new vulnerability in its Adobe Flash and Adobe Reader/Acrobat products. There is no patch available as of this writing. The scope of the exploitation attempts isn’t known at this time. The CVE number assigned is CVE-2010-1297.For now, we will need to rely upon AV for protection. The major AV vendors started releasing definitions over the weekend. For example, Symantec has released definitions (detected as Trojan.Pidief.J) for the known exploits for the Adobe Flash, Reader, and Acrobat vulnerability.References:http://www.adobe.com/support/security/advisories/apsa10-01.htmlhttp://www.symantec.com/connect/blogs/0-day-attack-wild-adobe-flash-reader-and-acrobatemail: david @ sharpesecurity.com … Continue Reading

Two security holes in OpenSSL were fixed in the 1.0.0.a and 0.9.8o releases. These updates CVE-2010-1633 and CVE-2010-0742. The download tarballs are here.References:http://www.openssl.org/news/secadv_20100601.txtemail: david @ sharpesecurity.com website: www.sharpesecurity.comTwitter: twitter.com/sharpesecurity

This SANS ISC article (http://isc.sans.org/diary.html?storyid=8890) got me thinking again about the reality of Mac malware. What are people using for AV scanning for Mac executables at their web and mail gateways? As Macs increasingly make their way in the enterprise and Apple continues to improve its market share, I assume that eventually we will need to supplement host-based AV scanning on the Macs with gateway-based AV defensive layers – just like we did to protect our Windows endpoints. What should we block at the web and email gateway … Continue Reading