DarkFiber Consulting - IT Managed Services » Workarounds

Microsoft Windows Help and Support Center Vulnerability

DarkFiber Consulting — Wed, 23 Jun 2010 18:43:55 +0000

DarkFiber Consulting is aware of a vulnerability affecting the Mircosoft Windows Help and Support Center. This vulnerability is due to improper sanitization of hcp:// URIs. Exploitation of this vulnerability may allow a remote, unauthenticated attacker to execute arbitrary commands.

DarkFiber Consulting encourages users and administrators to review Vulnerability Note VU#578319 and implement the workarounds to help mitigate the risks and reduce attack vectors.

DarkFiber Consulting will provide additional information as it becomes available.

Tags: Arbitrary Commands, Attacker, Microsoft, Microsoft Help, Microsoft Support, Microsoft Windows Help And Support, Sanitization, Vectors, Vulnerability Note, Windows Help, Windows Support, Workarounds

Adobe Releases Security Advisory for Flash Player, Reader, and Acrobat

DarkFiber Consulting — Wed, 23 Jun 2010 18:43:52 +0000

Adobe has released a security advisory to notify users of a vulnerability in Adobe Flash Player, Reader, and Acrobat. Exploitation of this vulnerability may allow an attacker to execute arbitrary code and take control of the affected system. The advisory indicates that Adobe is aware of active exploitation of this vulnerability.

DarkFiber Consulting encourages users and administrators to review Adobe security advisory APSA10-01 and apply any necessary workarounds until a fix is released by the vendor.

DarkFiber Consulting will provide additional information as it becomes available.

Tags: Acrobat Adobe, Adobe Acrobat, Adobe Flash Player, Adobe Reader, Arbitrary Code, Attacker, Control, Flash Reader, Reader Acrobat, Security Advisory, Vulnerability, Workarounds

Cisco Releases Advisory for IronPort Encryption Appliance

DarkFiber Consulting — Mon, 01 Mar 2010 21:14:00 +0000

Cisco has released an advisory to address multiple vulnerabilities in IronPort Encryption Appliance. Exploitation of these vulnerabilities may allow a remote, unauthenticated attacker to execute arbitrary code or obtain sensitive information.

DarkFiber Consulting encourages users and administrators to review Cisco Security Advisory cisco-sa-20100210-ironport and apply any necessary workarounds to help mitigate the risks. Additional information regarding these vulnerabilities can be found in Cisco Applied Mitigation Bulletin 111668.

Tags: Address, Arbitrary Code, Attacker, Cisco, Cisco Security Advisory, Encryption, Ironport, Mitigation, Vulnerabilities, Workarounds

Microsoft Releases Security Advisory 977981

DarkFiber Consulting — Thu, 10 Dec 2009 18:49:45 +0000

Microsoft has released security advisory 977981 to address a vulnerability in Microsoft Internet Explorer. This vulnerability may allow an attacker to execute arbitrary code.

DarkFiber Consulting encourages users and administrators to review Microsoft Security Advisory 977981 and implement the suggested workarounds listed in the advisory to help mitigate the risks.

Tags: Address, Amp Nbsp, Arbitrary Code, Attacker, Internet Explorer, Microsoft, Microsoft Explorer, Microsoft Internet, Microsoft Releases Security Advisory, Microsoft Security Advisory, Vulnerability, Workarounds

Microsoft Releases Security Advisory 977544

DarkFiber Consulting — Thu, 10 Dec 2009 18:49:44 +0000

Microsoft has released security advisory 977544 to address a vulnerability in the Server Message Block (SMB) protocol. This vulnerability may allow an attacker to cause a denial-of-service condition. This vulnerability only affects Windows 7 and Server 2008 software.

DarkFiber Consulting encourages users and administrators to review Microsoft security advisory 977544 and apply the workarounds.

Tags: Address, Attacker, Denial Of Service, Microsoft, Microsoft Releases Security Advisory, Microsoft Security Advisory, Protocol, Server Message Block, Vulnerability, Workarounds

Microsoft Releases Two Out-of-Band Security Bulletins and a Security Advisory

DarkFiber Consulting — Fri, 31 Jul 2009 04:06:08 +0000

Microsoft has released two out-of-band security bulletins. The first bulletin, MS09-034, is a cumulative security update for Internet Explorer that addresses several vulnerabilities. These vulnerabilities may allow a remote attacker to execute arbitrary code. The second bulletin, MS09-035, addresses vulnerabilities in the Visual Studio Active Template Library (ATL). Exploitation of these vulnerabilities may allow an attacker to execute arbitrary code.

Additionally, Microsoft has released security advisory 973882 to provide specific guidance for developers, IT professionals, consumers, and home users regarding the vulnerabilities in Active Template Library (ATL).

DarkFiber Consulting encourages users and administrators to review Microsoft Security Bulletins MS09-034 and MS09-035 and Microsoft Security Advisory 973882 and apply any necessary updates or workarounds to help mitigate the risks. Additional information can be found in Technical Cyber Security Alert TA09-209A.

Tags: Active Template Library, Arbitrary Code, Atl, Attacker, Consumers, Cumulative Security Update, Cyber Security, Developers, Guidance, Home Users, Internet Explorer, Microsoft, Microsoft Security Advisory, Microsoft Security Bulletins, Necessary Updates, Visual Studio, Workarounds

Cisco Releases Security Advisory for Vulnerabilities in Cisco Wireless LAN Controllers

DarkFiber Consulting — Fri, 31 Jul 2009 04:06:07 +0000

Cisco has released a security advisory to address multiple vulnerabilities in Wireless LAN Controllers. The advisory addresses the following:

Malformed HTTP or HTTPS authentication response denial-of-service vulnerability.
SSH connections denial-of-service vulnerability.
Crafted HTTP or HTTPS request denial-of-service vulnerability.
Crafted HTTP or HTTPS request unauthorized configuration modification vulnerability.

Exploitation of these vulnerabilities may allow an attacker to cause a denial-of-service condition or gain full control over the Wireless LAN Controller.

DarkFiber Consulting encourages users and administrators to review Cisco Security Advisory cisco-sa-20090727-wlc and apply any necessary updates or workarounds to help mitigate the risks.

Tags: Address, Addresses, Attacker, Authentication, Cisco, Cisco Security Advisory, Cisco Wireless, Control, Denial Of Service, Full Control, Lan Controller, Lan Controllers, Necessary Updates, Service Vulnerability, Vulnerabilities, Vulnerability Exploitation, Wireless Lan, Wlc, Workarounds

Adobe Reader, Acrobat and Flash Player Vulnerability

DarkFiber Consulting — Fri, 31 Jul 2009 04:06:06 +0000

Adobe has released a security advisory to address a vulnerability in Adobe Reader and Acrobat 9.1.2 and Flash Player 9 and 10. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary code or cause a denial-of-service condition.

DarkFiber Consulting encourages users and administrators to review the security advisory and implement the following workarounds until a fix is available:

Disable Flash in Adobe Reader 9 on Windows platforms by renaming the following files: “%ProgramFiles%\Adobe\Reader 9.0\Reader\authplay.dll” and “%ProgramFiles%\Adobe\Reader 9.0\Reader\rt3d.dll”.

Disable Flash Player or selectively enable Flash content as described in the Securing Your Web Browser Document.

Additional information regarding this vulnerability can be found in Technical Cyber Security Alert TA09-204A.

DarkFiber Consulting will provide additional information as it becomes available.

Tags: Acrobat Adobe, Address, Adobe Acrobat, Adobe Reader, Arbitrary Code, Attacker, Cyber Security, Denial Of Service, Dll Reader, Flash Content, Flash Player 9, Flash Reader, Programfiles, Reader Acrobat, Vulnerability, Windows Platforms, Workarounds

Mozilla Foundation Releases Firefox 3.0.11

DarkFiber Consulting — Thu, 02 Jul 2009 21:50:53 +0000

Mozilla Foundation has released Firefox 3.0.11 to address multiple vulnerabilities. Exploitation of these vulnerabilities may allow an attacker to execute arbitrary code, mislead users, or obtain sensitive information. The Mozilla Foundation Security Advisories also indicate that many of these vulnerabilities also affect Thunderbird and SeaMonkey; however, updated versions of those packages are not currently available.

DarkFiber Consulting encourages users to review the Mozilla Foundation Security Advisories released on June 11, 2009 and apply any necessary updates or workarounds to help mitigate the risks.

Tags: Address, Arbitrary Code, Attacker, Information Security, Mozilla Foundation Security Advisories, Necessary Updates, Thunderbird, Workarounds

Symantec Releases Security Advisories

DarkFiber Consulting — Sun, 10 May 2009 06:23:30 +0000

Symantec has released three security advisories to address multiple vulnerabilities in Symantec Alert Management System, Log Viewer, and Reporting Server. These vulnerabilities may allow an attacker to execute arbitrary code, bypass security mechanisms, or leverage phishing attacks.

DarkFiber Consulting encourages users and administrators to review the following Symantec Security Advisories and apply any necessary updates or workarounds to help mitigate the risks:

DarkFiber Consulting also encourages users to continue following the best practices provided in the advisories to minimize future risks.

Tags: Address, Alert Management, Arbitrary Code, Attacker, Best Practices, Javascript, Leverage, Log Viewer, Management System, Necessary Updates, Security Advisories, Security Mechanisms, Symantec, Symantec Security, Vulnerabilities, Workarounds