Apple OS X Java Update

Apple have released an update that fixes the Flashback Trojan vulnerability:

Got to Software Updates and install it as soon as possible - 

This Java security update removes the most common variants of the Flashback malware.

This update also configures the Java web plug-in to disable the automatic execution of Java applets. Users may re-enable automatic execution of Java applets using the Java Preferences application. If the Java web plug-in detects that no applets have been run for an extended period of time it will again disable Java applets.

This update is recommended for all Mac users with Java installed.

For details about this update see: http://support.apple.com/kb/HT5242

Mac OSX Java Malware: OSX/Flashfake.c

This Trojan is installed via exploitation of a flaw in Oracle Java (CVE-2012-0507). The Mac OS X - based malware masquerades as an Adobe Flash Player install.

Upon infection the malware will install fake/rogue security software, and allow for the downloading of additional malicious components, sensitive data extrusion, and other malicious control methods.

Infected hosts report back to an external server and can receive further instructions/payloads via that method (C&C / bot-based control). CVE-2012-0507 is an Oracle Java vulnerability, which was patched by Apple (as a 34rd party component) in April 2012.

Therefore....make sure your OSX software is up to date

Microsoft Security Update

Microsoft has just released an out of band update that addresses a vulnerability relating to icon files.

This vulnerability is fairly serious and thus users should update Windows as soon as possible.

Please go to Windows Update from the start menu, if your PC is not set to update automatically or click here for more information: (safe link)

http://www.microsoft.com/technet/security/bulletin/MS10-046.mspx

Apple Safari Vulnerability

A vulnerability affecting Apple Safari has just been discovered.

By tricking the user into opening a malicious web page, an attacker may be able to execute arbitrary code. Exploit code for this vulnerability is publicly available.

The only fix available as of now, until Apple offers a patch, is to disable Javascript under 'Preferences', 'Security'

The other option is to use Firefox 3.6 with the NoScript add-on, or Google Chrome. It is likely that Google Chrome is not affected by this vulnerability.

Worrying Wordpress Blog hacks

A large number of Worpdress users are finding their blog sites hacked by an injection of a web address into their databases.

The Networkads.net hack re-diredcts visitors to a site that tries to install malicious software.

There's a fix on the KrebsOnSecurity Blog

Adobe Reader Issues

There have been so many Adobe Acrobat & Reader vulnerabilities of late that we were considering making an Adobe page.

Put very simply, we (and Adobe) suggest making the following changes to your Reader and Acrobat preferences:

Go to Trust Management and uncheck "Allow opening of non-PDF file attachments with external applications"

Go to Javascript and uncheck "Enable Acrobat Javascript"

Further reading from the Adobe Blog

Apple Quicktime Exploit

There is a known (but already patched) vulnerability the affects the following versions of Apple OSX and Quicktime:

Apple QuickTime Player 7.6.5 
Apple QuickTime Player 7.6.4 
Apple QuickTime Player 7.6.2 
Apple QuickTime Player 7.6.1 
Apple QuickTime Player 7.6
Apple Mac OS X Server 10.6.2 
Apple Mac OS X Server 10.6.1 
Apple Mac OS X Server 10.6
Apple Mac OS X 10.6.2 
Apple Mac OS X 10.6.1 
Apple Mac OS X 10.6

BUT this has already all been patched in the latest Apple 10.6.3 update. Therefore, if you didn't update your Apple OS last week, please go ahead and do so without delay.

Products that are NOT vulnerable are:

Apple QuickTime Player 7.6.6 
Apple Mac OS X Server 10.6.3 
Apple Mac OS X 10.6.3

The news here is to always stay current with all software updates.

Internet Explorer Vulnerability

A vulnerability in some versions of Microsoft Internet Explorer can allow remote code execution. The flaw is currently under analysis. Exploitation can occur via a specially crafted web page or email containing a malicious link. If successful, an attacker could gain control of the system. Microsoft has reported that functional, targeted attacks have been observed.

Microsoft will be issuing a patch update on March 30th, so check for software updates on Tuesday.

Microsoft Patch Tuesday

Microsoft fixed eight vulnerabilities in it's recent patch update but reports on a zero day vulnerability that exists in Internet Explorer.

We would advise updating Windows if you haven't already, and use the latest build of Firefox rather than IE

Adobe Download Manager Exploit

Adobe has announced that a critical vulnerability has been identified in the Adobe Download Manager. This vulnerability (CVE-2010-0189) could potentially allow an attacker to download and install unauthorized software onto a user's system.

Users who have downloaded Adobe Reader for Windows from http://get.adobe.com/reader/ or Adobe Flash Player for Windows from http://get.adobe.com/flashplayer/ prior to the release of this Security Bulletin on February 23, 2010, can verify they are not vulnerable to this Adobe Download Manager issue by following the instructions below.

• Ensure that the C:Program FilesNOS folder and its contents ("NOS files") are not present on your system. (If the folder is present, follow the steps below to remove).
• Click "Start" > "Run" and type "services.msc". Ensure that "getPlus(R) Helper" is not present in the list of services.

If the NOS files are found, the Adobe Download Manager issue can be mitigated by:

• Navigating to Start > Control Panel > Add or Remove Programs > Adobe Download Manager, and selecting Remove to remove the Adobe Download Manager from your system.

OR

• Clicking "Start" > "Run" and typing "services.msc". Then deleting "getPlus(R) Helper" from the list of services.
• Then delete the C:Program FilesNOS folder and its contents.

Mozilla Vulnerabilities - Firefox, Thunderbird & SeaMonkey

The Mozilla Foundation has just released a number of security advisories concerning vulnerabilities in Mozilla Firefox, Thunderbird, and SeaMonkey. These vulnerabilities if exploited might allow a remote, unauthenticated attacker to execute arbitrary code or bypass security restrictions.

We recommend updating your current versions of any of the above products as soon as possible.

We would also recommend you set your software to automatically update. In Firefox for Mac, go to Preferences, Advanced, Updates tab and select the check box to automatically check for updates: Firefox, Add-Ons and Search Engines.

http://www.mozilla.org/security/known-vulnerabilities/

Google Chrome For Windows

If you use Google's Chrome browser, it has been updated to address a vulnerability.

This applies to Chrome for Windows and updates to 4.0.249.89 to address multiple
vulnerabilities.

Please head here: http://googlechromereleases.blogspot.com/2010/02/stable-channel-update.html (safe link as of time of posting) and update Chrome as soon as you are able.