Click to the Table of Contents

Rating Type Headlines 1 — THREATS, VULNERABILITIES, ADVISORIES & ANALYSIS   1     Vulnerabilities A zero-day bug affecting Adobe Reader, Flash Player and Acrobat   1     Vulnerabilities Critical vulnerabilities in Photoshop CS4 11.01   1     Vulnerabilities IBM DB2 vulnerabilities   2     Mobility Cyber Threats to Mobile Devices   2     Hacking Kobil SmartCard Reader hacked   3     Advisory Monthly Patches for Adobe 2 — METHODOLOGIES, GUIDELINES, BEST PRACTICES, STANDARDS & LEGISLATION   2     Business Continuity CERT Survivability Analysis Framework 3 — REPORTS, STUDIES, SURVEYS & PUBLICATIONS   2     Business Continuity High-Impact, Low-Frequency Risks to the North American Electric Grid 4 — MARKET NEWS, TOOLS & MISCELLANEOUS   3     Tools Botnets run by the 'Good Guys'   3     Forensics Honeynet Forensic Challenge 2010/4 deals with VoIP

«« ‹ › »»

1 — THREATS, VULNERABILITIES, ADVISORIES & ANALYSIS

---

•   1      — A zero-day bug affecting Adobe Reader, Flash Player and Acrobat

  ---

  On June 4th, Adobe Systems released an advisory about a zero-day bug affecting Adobe Reader, Flash Player and Acrobat. The vulnerability is rated as critical and is known to be actively exploited in-the-wild by attackers.
  According to Adobe, the vulnerability exists in Flash Player 10.0.45.2 and earlier versions for Windows, Macintosh, Linux and Solaris, as well as the authplay.dll component that ships with Adobe Reader and Acrobat 9.x for Windows, Mac and Unix operating systems.
  The vulnerability (CVE-2010-1297) could cause systems to crash and potentially allow attackers to execute code and take control of the affected system. The Flash Player 10.1 Release Candidate does not appear to be vulnerable, and Adobe Reader and Acrobat 8.x have been confirmed to be unaffected.
  As of today, there is no patch available: the advisory only suggests mitigation techniques for the various platforms.

  ---

  • [HTML] — Adobe security bulletin
  
  

  ---

•   1      — Critical vulnerabilities in Photoshop CS4 11.01

  ---

  Photoshop CS4 11.01 have known critical vulnerabilities that could allow a cyber criminal to compromise a system.
  A malicious file must be opened by a user to enable the exploit of these vulnerabilities.
  Adobe recommends Photoshop CS4 customers update to Photoshop CS4 11.0.2, which resolves these issues. Adobe also encourages all customers to follow security best practices by being caution when confronted with any unknown file or files from unknown sources, regardless of the application used to open the file.
  

  ---

  • [HTML] — Adobe patch note
  
  

  ---

•   1      — IBM DB2 vulnerabilities

  ---

  Several vulnerabilities affect IBM DB2 and allow a malicious user to perform a remote denial of service or circumvent security policy.
  The following vulnerabilities have been published and corrected:
  - TIVOLI agent installed for DB2 allows remote user to cause a denial of service,
  - Renegotiation of SSL and TLS sessions can bypass the security policy,
  - SYSTEM granted privileges not regenerated on views when AUTO_REVAL is set to IMMEDIATE,
  - Monitor Administrative Views in SYSIBMADM schema are viewable by public.

  ---

  • [HTML] — IBM Flash alert
  
  

  ---

•   2      — Cyber Threats to Mobile Devices

  ---

  A Technical Information Paper (TIP) introducing emerging threats on mobile devices has been published by US-CERT. This 16-page document introduces emerging threats such as malware, social engineering or botnets likely to have a significant impact on mobile devices and their users. It is critical to understand that a mobile device is no longer just a phone and cannot be treated as such, US CERT said, adding that many mitigation techniques for mobile devices are similar to those for PCs.
  US-CERT recommends the following best practices to help protect mobile devices:
  - Maintain up-to-date software, including operating systems and applications,
  - Install anti-virus software as it becomes available and maintain up-to-date signatures and engines,
  - Enable the personal identification number (PIN) or password to access the mobile device, if available,
  - Encrypt personal and sensitive data, when possible,
  - Disable features not currently in use such as Bluetooth, infrared, or Wi-Fi,
  - Set Bluetooth-enabled devices to non-discoverable to render them invisible to unauthenticated devices,
  - Use caution when opening email and text message attachments and clicking links,
  - Avoid opening files, clicking links, or calling numbers contained in unsolicited email or text messages,
  - Avoid joining unknown Wi-Fi networks,
  - Delete all information stored in a device prior to discarding it, and
  - Maintain situational awareness of threats affecting mobile devices.
  

  ---

  • [HTML] [PDF] — CERT Announcement & Paper
  
  

  ---

•   2      — Kobil SmartCard Reader hacked

  ---

  A vulnerability in smartcard readers made by vendor Kobil allows intruders to install specially crafted firmware without opening the sealed housing.
  A hacker known as 'Colibri' has managed to bypass the signature check by replacing the reader's boot loader with a specially crafted boot loader. According to Heise Security, a Windows tool enables unsigned firmware to be installed without any more control. The hacker informed Kobil about the problem and released a fascinating and detailed report about the hack, as well as the Windows tool and firmware updates for reproducing the issue.

  ---

  • [HTML] — More information on Heise Security
  • [HTML] — Detailed report from 'Colibri' (German)
  
  

  ---

•   3      — Monthly Patches for Adobe

  ---

  Adobe is currently considering reducing the interval between security updates for Adobe Reader from 90 to 30 days.
  Switching to a shorter update cycle for Reader and Acrobat would allow the company to be more responsive to security threats. According to Sans Institute, Adobe is likely feeling pressure for more frequent updates because of the growing number of vulnerabilities in its products that are being disclosed and actively exploited. Adobe is also looking at releasing regular security updates for Flash and Shockwave.

  ---

  • [HTML] — More news on Heise Security
  
  

«« ‹ › »»

2 — METHODOLOGIES, GUIDELINES, BEST PRACTICES, STANDARDS & LEGISLATION

---

•   2      — CERT Survivability Analysis Framework

  ---

  CERT SEI published the CMU/SEI-2010-TN-013 technical note which describes the Survivability Analysis Framework (SAF).
  Built by a team of Carnegie Mellon University Software Engineering Institute (SEI) software engineers, the Survivability Analysis Framework (SAF) is an analysis technique for analyzing complexity and integration issues throughout the development life cycle. It can be applied at any level of development where the interaction of multiple independently built elements is critical to operational effectiveness. It is designed primarily for project management and stakeholders to ensure that development is properly going forward an expected operational solution.

  ---

  • [PDF] — CERT's paper
  
  

«« ‹ › »»

3 — REPORTS, STUDIES, SURVEYS & PUBLICATIONS

---

•   2      — High-Impact, Low-Frequency Risks to the North American Electric Grid

  ---

  A report on a new class of risks, called High-Impact, Low-Frequency (HILF) events, has been published by the North American Electric Reliability Corporation aka NERC.
  This 120-page report summarizes actions that could be engaged to mitigate these risks which have the potential to cause catastrophic impacts on the electric power system, but either rarely occur, or, in some cases, have never occurred. Examples of HILF risks include coordinated cyber, physical, and blended attacks, the high-altitude detonation of a nuclear weapon, and major natural disasters like earthquakes, tsunamis, large hurricanes, pandemics, and geomagnetic disturbances caused by solar weather.

  ---

  • [PDF] [PDF] — NERC Press Release & Report
  
  

«« ‹ › »»

4 — MARKET NEWS, TOOLS & MISCELLANEOUS

---

•   3      — Botnets run by the 'Good Guys'

  ---

  The 'Botnets Run by the Good Guys' post on McAfee Labs Blog explains that some botnets may be operated by 'good guys'.
  The author analyzed a malware sample sent by a customer to find out that it could be part of a pen-test tool operated by good guys, or at least people who are only conducting penetration testing and security auditing operations. The use of such tools, even from the 'good guys' raises a legal issue.

  ---

  • [HTML] — 'Botnets Run by the Good Guys' post
  
  

  ---

•   3      — Honeynet Forensic Challenge 2010/4 deals with VoIP

  ---

  Honeynet Project Forensic Challenge #4, entitled 'VoIP' is now live.
  Provided by Ben Reardon and Sjur Eivind Usken - respectively from the Australian and Norwegian Honeynet Chapters - this challenge takes you into the realm of voice communications on the Internet. VoIP with SIP is becoming the de-facto standard. As this technology becomes more common, malicious parties have more opportunities and stronger motives to take control of these systems to conduct nefarious activities. This Challenge is designed to examine and explore some attributes of the SIP and RTP protocols...

  ---

  • [HTML] — Honeynet Forensic Challenge 2010/4
  
  

---

DEVOteam         SOLUTIONS — Security BU WISec Newsletter — 2010-06-08 — Week #23 FOR DEVOTEAM CUSTOMERS ONLY  — Contact us ©opyright: DEVOTEAM Solutions — DEVOTEAM Group

Color Rating Severity Information   red   1         Critical   Must Be Known     orange         2         Important         Should Be Known         yellow         3         Medium     Nice To Know     green         4       Low     Culture

---