March 24–March 30, 2008The Cyber Risk Report is a strategic intelligence product that highlights current security activity and mid- to long-range perspectives. The report addresses seven major risk management categories: vulnerability, physical, legal, trust, identity, human, and geopolitical. Cyber Risk Reports are powered by Cisco Security Intelligence Operations, an advanced security infrastructure that identifies, analyzes, and defends against threats to keep organizations informed and protected. Cyber Risk Reports are the collaborative efforts of Cisco security analysts from the following teams: IntelliShield, Applied Intelligence, Remote Management Services, Intrusion Prevention System Signature Development, Cisco Product Security Incident Response, Cisco Malware Research, Strategic Technology Assessment Team, Infrastructure Security Research & Development, IronPort Email and Web Threat Research, Critical Infrastructure Assurance Group, Advanced Services, Security Sales and Engineering, Corporate Security Programs, Government Affairs, and Legal Support. VulnerabilityVulnerability and threat activity this week was highlighted by the Cisco IOS Security Advisory Bundle release. The Cisco Product Security Incident Response Team (PSIRT) released the first of its regularly scheduled IOS Security Advisory bundles on March 26, 2008. Future bundles are scheduled for release on the fourth Wednesday of March and September each calendar year. This bundle included five Security Advisories and was accompanied by three Cisco Applied Mitigation Bulletins. IntelliShield analysts identified six individual vulnerabilities from these advisories. Of particular interest is the Multicast Virtual Private Networking architecture information disclosure vulnerability detailed in IntelliShield alert 15446. A remote attacker could exploit this vulnerability to create a denial of service (DoS) condition or disclose potentially sensitive data transmitted via multicast. Because the affected devices will likely reside at the service provider edge, attackers would not likely require special access to submit malicious messages to an affected device. However, attackers would likely require access to a valid MVPN network to gain access to the disclosed data. Mozilla released seven security advisories and updated versions to address vulnerabilities in its Firebox, SeaMonkey and Thunderbird products. IntelliShield analysts identified one previously disclosed vulnerability and nine new vulnerabilities from these advisories. Additionally, numerous third-party operating system vendors have begun releasing updates for these products. Web browsers such as Firefox and e-mail clients such as Thunderbird often represent the first types of applications on a target system that could be exposed to a remote attacker. Attackers are increasingly exploiting these types of common user applications. Maintaining patch levels of such applications is critical to prevent compromised systems in the environment. Multiple third-party operating system vendors released patches to address two previously undisclosed vulnerabilities in MIT Kerberos. These vulnerabilities could allow a remote attacker to cause a DoS condition if certain conditions are present. Because Kerberos implementations are used to provide authentication services for a wide variety of applications, such a DoS condition could have widespread impact. In malicious code activity, Backdoor:W32/PoisonIvy, as documented in IntelliShield Alert 15485, is being marketed as a highly configurable and legitimate remote administration tool. However, the tool is often used in a malicious manner and the author states that users can purchase a customized version that is undetectable to all antivirus products. The author also offers free updates to users who pay for the customized version. The updates give the users the most recent version of the tool that is supposedly undetectable if the older version has become detected by antivirus software. The trojan can easily be configured using its built-in graphical user interface. Additional functionality can also be added to the trojan via third-party plugins. Several variants are known to exist; however, few details are available. IntelliShield published 173 events last week: 67 new events and 106 updated events. Of the 173 events, 153 were Vulnerability Alerts, 14 were Security Issue Alerts, three were Daily Malicious Code Summaries, one was a Malicious Code Alert, one was an Applied Mitigation Bulletin, and one was the Cyber Risk Report. The alert publication totals are as follows: Weekly Alert Totals
Significant Alerts for March 24-30, 2008 Microsoft Jet Database Engine contains a vulnerability that could allow a remote attacker to execute arbitrary code on the affected system. This vulnerability is currently being exploited by malicious software. The vulnerability has been identified as being used by TROJ_MSJET.C, which is documented in IntelliShield Alert 15486, and Trojan.Acdropper.C, as described in IntelliShield Alert 10679. Microsoft has confirmed the vulnerability but software updates are unavailable. Previous Alerts That Still Represent Significant Risk Microsoft Office Excel and Office Excel Viewer contain a vulnerability that could allow an attacker to execute arbitrary code. Exploit code demonstrating code execution is publicly available. Reports indicate that attackers are leveraging this vulnerability in ongoing, targeted attacks. The exploit code could be leveraged to conduct larger scale attacks. Microsoft has confirmed the vulnerability in a security bulletin and released software updates. Apple Security Update 2008-002 Multiple Mac OS X and OS X Server Vulnerabilities Apple has released Security Update 2008-002 to address multiple vulnerabilities in Mac OS X and Mac OS X Server. This update addresses vulnerabilities that could allow an attacker to cause a DoS condition or execute arbitrary code with elevated privileges. The update corrects flaws within core operating system components as well as third-party packages that are bundled with the operating system. Microsoft Windows Vista DHCP Request Processing Denial of Service Vulnerability Microsoft Windows Vista and Microsoft Windows Vista x64 Edition contain a vulnerability that could allow a remote attacker to cause a DoS condition. Event data from Cisco Remote Management Services has detected intrusion prevention system signature activity related to this vulnerability. The data, which was captured on March 13, 2008, could indicate exploit attempts. Microsoft confirmed this vulnerability in a security bulletin and released software updates. Microsoft Works File Converter Section Length Header Code Execution Vulnerability Microsoft Works File Converter contains a vulnerability when handling legacy-formatted Microsoft Works files that could allow a remote attacker to execute arbitrary code. To exploit this vulnerability, the attacker must convince a user to open a malicious .wps document with a vulnerable product. Exploit code that demonstrates the remote execution of arbitrary code is available. Microsoft has confirmed the vulnerability in a security bulletin and released software updates. F5 Networks BIG-IP Web Management Interface Cross-Site Request Forgery Vulnerability F5 Networks BIG-IP contains a vulnerability in the management interface that could allow a remote attacker to conduct cross-site request forgery attacks and make configuration changes to affected devices. Proof-of-concept exploit code is available that demonstrates the creation of additional administrative accounts. Sources indicate that this vulnerability is being actively exploited. F5 Networks has not confirmed this vulnerability and updates are unavailable. Linux Kernel vmsplice Invalid Memory Pointer Dereference Vulnerability The Linux Kernel contains a vulnerability that could allow a local attacker to gain superuser privileges. The attacker could leverage these privileges to take complete control of the vulnerable system. Exploit code demonstrating the privilege escalation vulnerability is publicly available. Reports indicate that this vulnerability is being actively exploited. Linux Kernel get_iovec_page_array() Privilege Escalation Vulnerability The Linux Kernel contains a vulnerability that could allow a local attacker to gain privileges equal to the superuser account. The attacker could leverage these privileges to take complete control of the vulnerable system. Exploit code is available. Reports indicate that attackers are actively exploiting this vulnerability to compromise affected systems. Adobe Acrobat and Reader Multiple JavaScript Methods Buffer Overflow Vulnerability Adobe Acrobat and Reader contain a vulnerability that could allow a remote attacker to cause the application to crash or execute arbitrary code. The attacker may be able to gain elevated privileges depending on the configuration of the affected system. This vulnerability is currently being exploited in the wild. The vulnerability has been identified as being used by Trojan.Pidief.C, which is documented in IntelliShield Alert 14388. Adobe confirmed the vulnerability in a security bulletin and released updated software. Adobe Reader and Acrobat Security Update 8.1.2 Adobe has released updates for Adobe Reader and Acrobat on the Mac OS X, Linux, Solaris, UNIX, and Windows platforms. The update corrects several unspecified vulnerabilities in versions of the affected applications prior to 8.1.2. Independent security researchers have released the technical details of several vulnerabilities corrected by this update. At least one has been used to distribute malicious code. Oracle Critical Patch Update January 2008 Oracle has released the Critical Patch Update Advisory for January 2008. The update provides patches for a total of 26 vulnerabilities affecting Oracle Database products, the Oracle Application Server, the Oracle Collaboration Suite, the Oracle E-Business Suite, and Oracle PeopleSoft Enterprise. Additional IntelliShield alerts that detail individual vulnerabilities will be released in the near future as technical details become available. PhysicalMitsubishi Electric HVAC Access Control VulnerabilityMitsubishi Electric GB-50 and GB-50A Centralized Controllers contain a vulnerability that could allow an unauthenticated, remote attacker to gain control over associated heating, ventilating, and air conditioning (HVAC) systems units. The vulnerability exists because of a lack of proper access controls on network-accessible resources supplied by the affected controller units. An attacker could exploit this vulnerability by establishing an unauthenticated connection to the target device's web server via port TCP port 80. Because the affected device does not require authentication, the attacker could issue arbitrary commands to control associated HVAC units. Read more IntelliShield Analysis: This vulnerability highlights an area of cyber security that continues to grow but is also often overlooked. Embedded control systems such as the GB-50 are commonly deployed within multi-office buildings to provide central management to building administrators and maintenance staff. These systems are often installed and new features such as the GB-50's remote access functions are enabled by technicians who are highly trained in HVAC and building control systems but who are not trained in the network and security domains. Significant opportunities exist for misconfigurations that may affect the operation of a network as a whole or open such systems to attack . This situation is a particular concern because these systems are often outfitted with firmware that is not easy to upgrade by end users or technicians, making it difficult to remedy bugs or security vulnerabilities. If a technician integrates the GB-50 into an office or building network without the proper considerations, the vulnerability could open affected buildings to attackers who are geographically distant from the target location. Most buildings' emergency management plans do not take this type of attack into consideration and administrators may be unable to respond in an appropriate manner. LegalPrivacy Concerns Over Fusion CentersThe Electronic Privacy Information Center (EPIC) has filed a Freedom of Information Act (FOIA) request in Virginia regarding the federal government's involvement in the state's open government legislation. The suit is focused on a house bill in Virginia that would exempt the Virginia State Fusion Center's databases and records from FOIA requests, its employees from subpoena in civil actions, and immunity for tipsters to defamation and invasion of privacy claims. EPIC intends to determine from the FOIA request if the federal government is involved in lobbying for the passage of the Virginia house bill. EPIC and other opponents of domestic surveillance and privacy rights violations are concerned that the scope of the fusion centers will expand beyond the original intelligence reform act and 9/11 Commission Report recommendations. Read more TrustApple Safari Installation on Windows Brings CriticismApple has endured criticism in the past week for its release of Safari 3.1, the first stable version of the Safari browser for Windows. The release can be downloaded from Apple's web site, but is also being distributed to Windows users through Apple's software update component. The software update component prompts users to download version 3.1, even if previous versions of the browser have not been installed on the user's computer. Critics have complained that Apple is pushing unwanted software on users and that by using the software update mechanism the vendor is implying that the updates are necessary instead of optional. Steve Jobs announced that Apple would use iTunes to distribute Safari when plans to distribute the software on Windows were announced in 2007. Read more IdentitySecurity Concerns Over Passport OutsourcingA three-part article posted on The Washington Times website has many concerned that the Government Printing Office (GPO) has elevated the risk to national security by outsourcing part of the electronic passport production to Europe and Thailand before passports are sent to the United States for assembly. GPO Inspector General J. Anthony Ogden, who was quoted in the article, claims that many of the security issues cited had been discovered in 2005 and were already being addressed. He added that vendors were inspected, background checks were conducted on employees, and passport components were transported using secure means. Read more HumanFraudulent Craigslist Ad Results in Loss of PropertyRobert Salisbury of Jackson County, Oregon was the victim of a false advertisement that claimed that his house had been declared abandon by the sheriff's department and that his possessions were available for anyone who wanted them. As Salisbury returned home, he noticed vehicles carrying his property; as he tried to talk to the drivers, he was rebuffed. Several people produced a printout of the Craigslist advertisement and believed that it gave them the authority to take possession from his property. Salisbury gave the sheriff a list of license plate numbers, but much of his belongings is still missing. Read more IntelliShield Analysis: With the adoption of certain online services into the mainstream culture, many may take for granted the fact that some services do not investigate the validity of user-posted offerings. The cost of creating an advertisement is inexpensive or even free, and using an online venue may reach a greater portion of a local population than traditional means. Shopping and auction websites are commonly used for fraudulent activities or for selling stolen goods, but this example demonstrates other destructive uses. Craigslist CEO Jim Buckmaster has commented that using the Internet to commit fraud is foolish because a thief's activities could be tracked. Unfortunately, in many cases it is too late to protect the victim. Businesses that opt to use these services should be wary of what they are purchasing and take secondary steps to confirm the legitimacy of their transactions. Organizations utilizing brand names, logos, or other identifying language should conduct regular searches online to identify any fraud being conducted against them or involving their trademarks or property. GeopoliticalTaiwan Votes For BusinessWith a resounding 58 percent of the popular vote, conservative Kuomintang (KMT) party candidate Ma Ying-Jeou has been elected Taiwan's new president. Ma has promised to pursue a non-confrontational approach toward Beijing, putting aside sovereignty issues and pledging to focus on relaxation of laws restricting bilateral business. Long-awaited direct flights and direct shipping between Taiwan and mainland China are among Ma's most eagerly-awaited initiatives. The election is being welcomed by world leaders, most notably the administration in Beijing, which has been antagonized by the previous President Chen Shui-Bian's talk of independence. Read more IntelliShield Analysis: While improved ties between China and Taiwan could mean harsher competition for Western firms, Ma's win is probably good news overall. Together with legislative gains for the KMT in January, the election outcome is being seen as a boost for Taiwan's economy. Change is not likely to be quick, in part because cross-strait economic ties are already robust. Given geographical proximity and cultural ties, however, cross-strait economic cooperation could be poised for an rise. In addition to decreasing the chances of conflict in the Taiwan straits, the pro-business vote may provide Taiwan's economy a psychological boost when exposure to the sluggish U.S. economy might otherwise have done more damage. Upcoming Security Activity
Because of the potential for increased risk on multiple vectors, organizations' security teams should be aware of and consider making special preparations for the following events: April Fools' Day: April 1, 2008
Additional InformationFor more information about the vulnerabilities contained in this report or the Cisco Security IntelliShield Alert Manager Service, please visit For information on obtaining a free trial of the Cisco Security IntelliShield Alert Manager Service, please visit This document is provided on an "as is" basis and does not imply any kind of guarantee or warranty, including the warranties of merchantability or fitness for a particular use. Your use of the information on the document or materials linked from the document is at your own risk. Cisco reserves the right to change or update this document at any time.
|
|||||||||||||||||||||||||||||||||||||
