CDSA News

Weekend Vulnerability and Patch Report, April 27, 2014 (Citadel Information Group)

Important Security Updates

Adobe Shockwave Player: Adobe has released version 12.1.1.151 to fix a highly critical vulnerability reported in previous versions of Shockwave Player running on Windows and Macintosh. Updates are available through the program or from Adobe’s Shockwave Web Site.

Apple AirPort Extreme: Apple has released updates to fix two vulnerabilities in previous firmware versions running on Apple AirPort Extreme and AirPort Time Capsule base stations with 802.11ac. Update the firmware to version 7.7.3. Additional information is available through Apple’s Web site.

Apple iOS: Apple has released version 7.1.1 of its iOS for iPhone 4 and later, iPad and iPod touch to fix at least 17 vulnerabilities, some of which are highly critical. The update is available through the devices or through Apple’s website.

Apple OS X: Apple has released updates to its OS X to fix at least 9 highly critical vulnerabilities. Apply updates and Security Update 2014-002 which are available through Apple’s Web site.

Apple TV: Apple has released version 6.1.1 for Apple TV to fix at least 17 highly critical vulnerabilities. Updates are available through the device or Apple’s Web site.

AVG Antivirus Free Edition: AVG has released version 2014.0.4570 (32-bit) of its Free Edition Antivirus. Updates are available through the program or from AVG’s Web site.

D-Link DNS-327L: D-Link has released a partial fix to address two vulnerabilities in a bundled vulnerable version of OpenSSL, reported in DNS-327L firmware version 1.10. Apply fix when available through for D-Link’s Web site.

Google Chrome: Google has released version 34.0.1847.131 of Chrome for Windows and Mac. Updates are available through the program.

Piriform CCleaner: Piriform has released version 4.13.4693 for CCleaner. Download is available from Piriform’s Web site.

Current Software Versions

Adobe Flash 13.0.0.182 [Windows 7: IE]

Adobe Flash 13.0.0.182 [Windows 7: Firefox, Mozilla]

Adobe Flash 13.0.0.182 [Windows 8: IE]

Adobe Flash 13.0.0.182 [Macintosh OS X: Firefox, Opera, Safari]

Adobe Reader 11.0.06

Dropbox 2.6.30

Firefox 28.0

Google Chrome 34.0.1847.131

Internet Explorer 11.0.9600.17031 [Windows 7: IE]

Internet Explorer 11.0.9600.16384 [Windows 8: IE]

Java SE 8 Update 5

QuickTime 7.7.5

Safari 5.1.7

Safari 7.0.2 [Mac OS X]

Skype 6.14.0.104

Newly Announced Unpatched Vulnerabilities

Microsoft Internet Explorer: Secunia reports an extremely critical unpatched vulnerability in all versions of Microsoft’s Internet Explorer. No official solution is currently available.

For an updated list of previously announced Unpatched Vulnerabilities, please see the resources section of Citadel’s Web site.

For Your IT Department

McAfee Virus Scan Enterprise: Secunia reports that McAfee has released an update to its Virus Scan Enterprise for Linux to fix two vulnerabilities caused by a bundled vulnerable version of Open SSL versions 1.7.1 through 1.8 and 2.0. Update to version 1.7.1 Hotfix 961964 or later, 1.9 Hotfix 960962 or later, or 2.0 Hotfix 960961 or later.

Oracle Multiple Products: Secunia reports that Oracle has released updates for its Big Data Appliance, Communications Application Session Controller, Virtual Compute Appliance, Communications Interactive Session Recorder, Communications Network Charging and Control to fix two moderately critical vulnerabilities. Apply patch.

SonicWALL Multiple Products: Secunia reports that SonicWALL has released updates for its SSL-VPN Class EX Series, SSL-VPN SRA Series and Global Management System to fix two moderately critical vulnerabilities. Apply updates.

Symantec Messaging Gateway: Secunia reports that Symantec has released an update for its Messaging Gateway to fix a vulnerability in previous versions. Update to version 10.5.2.

Symantec Multiple Products: Secunia reports that Symantec has released a partial fix for its NetBackup Appliance, Cluster Server (VCS), Endpoint Protection, Endpoint Protection Manager, NetBackup to address two vulnerabilities caused by a vulnerable version of OpenSSL. No official solution is currently available. Fixes are planned.