News

WatchGuard Security Week in Review: Episode 5

February 17, 2012 in News Comments off

February 17, 2012
by Corey Nachreiner 0 Comments

Lots of Patches, Big Nortel Breach, and More Anonymous Shenanigans

Are you ready for another week of software updates, Enterprise breaches, and hacktivist cyber-riots? If so, this week’s episode of WatchGuard Security Week in Review is hot off the NLE system. Watch it below, and tell us what you think in the comments section.

As usual, if you’d rather read then look at my ugly mug, see the Reference section below for links to all these stories. (Video Runtime: 8:50)

NOTE: Due to a rendering problem, the intro music is missing from this video. We will upload a corrected version shortly.

Episode References:

• Multi-vendor patch days
  • Microsoft IE bulletin  - WatchGuard Security Center
  • Microsoft Windows bulletin  - WatchGuard Security Center
  • Microsoft Sharepoint and Visio bulletin  - WatchGuard Security Center
  • Oracle Java JRE update  - WatchGuard Security Center
  • Adobe Shockwave bulletin  - WatchGuard Security Center
  • Adobe Flash bulletin  - WatchGuard Security Center
  • Chrome update for Flash flaws - LiveHacking
• Public key crypto weakness - The Register
• Nortel breached by Chinese hackers for a decade - The Wall Street Journal
• Mobile apps collect private user data:
  • Twitter app collecting data - The Register
  • Lawmakers ask Apple to explain - CNet
  • Apple bans stealthy data leeching apps – Computer World 
• Latest Anonymous stories:
  • Anonymous DDoSes CIA - Information Week
  • Anonymous breaches weapons maker - The New York Times
  • Anonymous DDoSes NASDAQ site - Information Week
  • Operation Global Blackout – Pastebin
  • Hackers hack Anonymous – International Business Times

— Corey Nachreiner, CISSP (@SecAdept)

Source: WatchGuard Security Alerts

Grab Adobe’s Shockwave Update to Avoid Web-based Attacks

February 15, 2012 in News Comments off

Summary:

• This vulnerability affects: Adobe Shockwave Player 11.6.3.633 and earlier, running on Windows and Macintosh computers
• How an attacker exploits it: By enticing your users into visiting a website containing a malicious Shockwave content
• Impact: An attacker can execute code on your computer, potentially gaining control of it
• What to do: If you allow the use of Shockwave in your network, you should download and deploy the latest version (11.6.4.634) of Adobe Shockwave Player as soon as possible.

Exposure:

Adobe Shockwave Player displays interactive, animated web content and movies called Shockwave. According to Adobe, the Shockwave Player is installed on hundreds of millions of PCs.

In a security bulletin released late Tuesday, Adobe warned of nine critical vulnerabilities that affect Adobe Shockwave Player 11.6.3.633 for Windows and Macintosh (as well as all earlier versions). Adobe’s bulletin doesn’t describe the flaws in much technical detail. For the most part, the flaws consist of memory related vulnerabilities, including heap buffer overflows and other memory corruption flaws. Though the flaws differ technically, they all share the same general scope and impact. If an attacker can entice one of your users into visiting a website containing some sort of malicious Shockwave content, he could exploit any of these vulnerabilities to execute code on that user’s computer, with that user’s privileges. If your Windows users have local administrator privileges, an attacker could exploit this flaw to gain full control of their PC.

If you use Adobe Shockwave in your network, we recommend you download and deploy the latest version as soon as you can.

Solution Path

Adobe has released Shockwave Player version 11.6.4.634 to fix these security flaws. If you use Adobe Shockwave in your network, we recommend you download and deploy the updated player as soon as possible. You can get it from the link below.

For All WatchGuard Users:

If you choose, you can configure the HTTP proxy on your XTM appliance to block Shockwave content. Keep in mind, doing so blocks all Shockwave content, whether legitimate or malicious.

Our proxies offer many ways for you to block files and content, including by file extension,  MIME type, or by using very specific hexidecimal patterns found in the body of a message – a technique sometimes referred to as Magic Byte detection. Below I list the various ways you can identify Shockwave files:

File Extension:

• .swf –  Adobe Shockwave files

MIME types:

• application/x-shockwave-flash
• application/x-shockwave-flash2-preview
• application/futuresplash
• image/vnd.rn-realflash

FILExt.com reported Magic Byte Pattern:

• Hex: 46 57 53

(We believe this pattern is too short, thus prone to false positives. We don’t recommend you use it) 

If you decide you want to block Shockwave files, the links below contain instructions that will help you configure your Firebox proxy’s content blocking features using the file and MIME information listed above.

• XTM Appliance with WSM 11.x
  • How do I block files with the FTP proxy?
  • How do I block files with the HTTP proxy?
  • How do I block files with the POP3 proxy?
  • How do I block files with the SMTP Proxy?

• Firebox X Edge running 10.x
  • How do I block files with the FTP proxy?
  • How do I block files with the HTTP proxy?
  • How do I block files with the POP3 proxy?
  • How do I block files with the SMTP proxy

• Firebox X Core and X Peak running Fireware 10.x
  • How do I block files with the FTP proxy?
  • How do I block files with the HTTP proxy?
  • How do I block files with the POP3 proxy?
  • How do I block files with the SMTP proxy?

Status:

Adobe has released a Shockwave Player update to fix these vulnerabilities.

References:

• Adobe Shockwave Player Security Bulletin

Source: WatchGuard Security Alerts