Threat Level: green Handler on Duty: Rob VandenBrink

SANS ISC InfoSec Handlers Diary Blog


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Firefox 3.5.6 is available, time to update! find the update here ==> http://en-us.www.mozilla.com/en-US/firefox/3.5.6/releasenotes/

Cisco WebEx WRF Player Vulnerabilities

Published: 2009-12-16
Last Updated: 2009-12-16 20:00:37 UTC
by Rob VandenBrink (Version: 1)
0 comment(s)

Cisco today released details of a set of buffer overflow vulnerabilities and fixes for their WebEx WRF player.  The exploits describe multiple buffer overflows caused by a maliciously crafted WRF file (generally posted on a website), or by attending a WebEx meeting with an attacker attending.  The results of the exploit can result in execution of arbitrary code on the target system. 

The exploits are categorized as: CVE-2009-2875, CVE-2009-2876, CVE-2009-2877, CVE-2009-2878, CVE-2009-2879 and CVE-2009-2880.

The WebEx site itself has the fixed client code.  If you have an inhouse WebEx server, updating the server updates all the clients (as they connect).  You won't find an easier to install fix than this one!

From the Cisco advisory, the "first fixed" releases are listed below, by Major Release and Client OS.  All versions subsequent to these are fixed as well.

Platform

Major Release 26.x

Major Release 27.x

Microsoft Windows

26.49.32; available now except lockdown sites

27.10.x; available now for non-PSO and non-lockdown sites

Mac OS X

26.49.35; available early February 2010

27.11.8; available now for non-PSO and non-lockdown sites

Linux

26.49.35; available early February 2010

27.11.8; available now for non-PSO and non-lockdown sites

 

The full cisco advisory is here ==> 

http://www.cisco.com/warp/public/707/cisco-sa-20091216-webex.shtml


 

Keywords:
0 comment(s)
Seamonkey Update to 2.0.1, find the release notes here ==> http://www.seamonkey-project.org/releases/seamonkey2.0.1

Beware the Attack of the Christmas Greeting Cards !

Published: 2009-12-16
Last Updated: 2009-12-16 17:24:10 UTC
by Rob VandenBrink (Version: 1)
0 comment(s)

With the holiday season upon us, lots of folks (me included) have elected to send online greeting cards instead of using traditional paper cards, "saving" the carbon and emissions footprint involved in traditional mail services (not that email is carbon free or anything, but that's a whole other discussion).

Just a word of warning - as happens every year, fake greeting cards are being circulated via email, with malware payloads attached.  We got our first reader email on this today, Daniel received a greeting card with a ".net" at the tail end of a legitimate domain.  The attackers even went to the trouble of making their site look like the real one!   These attacks use more sophisticated phishing techniques every year, and the malware payloads are of course also more difficult to detect each time. 

So if you get a greeting card, even if it's from someone you know, be sure that the link you click is taking you where you expect to go.  Check that the link is to a reputable greeting card site, and that it doesn't have "extra" characters at the end, that would indicate you are going someplace else entirely.  Even better, "don't click that link!"  - copy and paste it into your browser rather than clicking it directly, that way you have that much more assurance that you know where you are browsing to.

Have a safe, malware-free holiday everyone !

0 comment(s)
Diary Archives