Important Security Updates
Adobe Reader for Android: Adobe has released an update for Reader for Android to fix a highly critical vulnerability reported in prior versions. Update to version 11.2. Updates are available through the device.
Dropbox: Dropbox has released version 2.6.30 for its file hosting program. Updates are available at Dropbox’s website. [See Citadel’s warning below]
Google Chrome: Google has released version 34.0.1847.120 of Chrome for Windows and Mac. Updates are available through the program.
Oracle Java: Oracle has released Java SE 8 Update 5 to fix at least 37 vulnerabilities, some of which are highly critical. The update is available through Windows Control Panel or Java’s website. [See Citadel’s recommendation below]
Current Software Versions
Adobe Flash 184.108.40.206 [Windows 7: IE]
Adobe Flash 220.127.116.11 [Windows 7: Firefox, Mozilla]
Adobe Flash 18.104.22.168 [Windows 8: IE]
Adobe Flash 22.214.171.124 [Macintosh OS X: Firefox, Opera, Safari]
Adobe Reader 11.0.06
Dropbox 2.6.30 [Citadel warns against relying on Dropbox security. We recommend files containing sensitive information be independently encrypted with a program like Axcrypt; encryption keys be at least 15 characters long; and the Dropbox password be at least 15 characters long and different from other passwords.]
Firefox 28.0 [Windows]
Google Chrome 34.0.1847.120
Internet Explorer 11.0.9600.17031 [Windows 7: IE]
Internet Explorer 11.0.9600.16384 [Windows 8: IE]
Java SE 8 Update 5 [Citadel recommends removing or disabling Java from your browser. Java is a major source of cyber criminal exploits. It is not needed for most internet browsing. If you have a particular web site that requires Java, Citadel recommends using a two-browser approach to minimize risk. If you normally browse the Web with Firefox, for example, disable the Java plugin in Firefox and use an alternative browser — such as Chrome, IE9, Safari, etc — with Java enabled to browse only the sites that require it.]
Safari 5.1.7 [Windows]
Safari 7.0.2 [Mac OS X]
Newly Announced Unpatched Vulnerabilities
For Your IT Department
Cisco Network Registrar: Secunia reports that Cisco has released updates for its Network Registrar. Upgrade to version 8.1(3.1) or 8.2(0.2).
Google Search Appliance: Secunia reports that Google has released updates for its Search Appliance to fix two vulnerabilities due to a bundled vulnerable version of Open SSL. Apply patch. Please consult the Google Enterprise Support Portal for further details.
Heartbleed: Most of the attention surrounding the Heartbeat Vulnerability has focused on web servers that utilize OpenSSL. However, many other types of services utilize OpenSSL to encrypt sensitive communication including mail, instant messaging, VPNs and voice-over-IP (VoIP). See, e.g., this analysis from The University of Michigan. The analysis includes a list of popular mail servers that are vulnerable.
McAfee Email Gateway: Secunia reports that McAfee has released updates for its Email Gateway to fix multiple moderately critical vulnerabilities. Apply 7.5h960401 hotfix 2846.114 or MEG 7.6h960405 hotfix 2810.114.
Oracle Multiple Products: Secunia reports that Oracle has acknowledged a weakness, security issues and unpatched vulnerabilities and released updates for its Network Registrar, MySQL Connector/C, Connector/ODBC, Enterprise Backup, Workbench, Secure Global Desktop, Agile Product Lifecycle Management for Process, Agile PLM Framework, WebCenter Portal, Data Integrator, Hyperion Common Admin, Solaris FreeType, GnuTLS, XScreenSaver, Solaris, VM VirtualBox, Containers for J2EE, Endeca Server, Event Processing, Access Manager, WebLogic Server, JavaFX and others. Apply updates where available.
VMware Multiple Products: Secunia reports that VMware has released updates for its ESXi, NSX, vCloud Automation Center (vCAC), Fusion, Horizon Mirage, Horizon View, Horizon Workspace, OVF Tool, Player, vCenter Server and others to fix moderately critical vulnerabilities. Apply update or patch if available. Patches are pending for the some products.
If you are responsible for the security of your computer, Citadel’s Weekend Vulnerability and Patch Report is for you. We strongly urge you to take action to keep your workstation patched and updated.
If someone else is responsible for the security of your computer, forward our Weekend Vulnerability and Patch Report to them and follow up to make sure your computer has been patched and updated.
Vulnerability management is a key element of cyber security management. Cyber criminals take over user computers by writing computer programs that “exploit” vulnerabilities in operating systems (Windows, Apple OS, etc) and application programs (Adobe Acrobat, Office, Flash, Java, etc). When software companies find a vulnerability, they usually issue an update patch to fix the code running in their customer’s computers.
Citadel publishes our Weekend Vulnerability and Patch Report to alert readers to some of the week’s important updates and vulnerabilities. Our focus is on software typically found in the small or home office (SOHO) or that users are likely to have on their home computer. The report is not intended to be a thorough listing of updates and vulnerabilities.
Copyright © 2014 Citadel Information Group. All rights reserved.