IDF Task Force

Microsoft has released security advisory 977544 to address a
vulnerability in the Server Message Block (SMB) protocol. This
vulnerability may allow an attacker to cause a denial-of-service
condition. This vulnerability only affects Windows 7 and Server 2008
software.

We encourage users and administrators to review Microsoft
security advisory 977544 and apply the workarounds.

Relevant Url(s):
<http://www.microsoft.com/technet/security/advisory/977544.mspx>

Apple has released Safari 4.0.4 to address multiple vulnerabilities in
a number of components. Exploitation of these vulnerabilities may
allow an attacker to execute arbitrary code, cause a denial-of-service
condition, conduct cross-site request forgery, or obtain sensitive
information. These vulnerabilities affect Safari running on both the
Mac OS X and Windows platforms.

We encourage users and administrators to review Apple article
HT3949 and upgrade to Safari 4.0.4 to help mitigate the risks.

Relevant Url(s):
<http://support.apple.com/kb/HT3949>

Apple has released Mac OS X v10.6.2 and Security Update 2009-006 to
address multiple vulnerabilities in a number of applications. These
vulnerabilities may allow an attacker to execute arbitrary code, cause
a denial-of-service condition, conduct a man-in-the-middle attack,
operate with escalated privileges, or obtain sensitive information.

US-CERT encourages users and administrators to review Apple article
HT3937 and apply any necessary updates to help mitigate the risks.

Relevant Url(s):
<http://support.apple.com/kb/HT3937>

You may have heard of denial-of-service attacks launched against websites,
but you can also be a victim of these attacks. Denial-of-service attacks can
be difficult to distinguish from common network activity, but there are some
indications that an attack is in progress.

What is a denial-of-service (DoS) attack?

In  a  denial-of-service (DoS) attack, an attacker attempts to prevent
legitimate users from accessing information or services. By targeting your
computer and its network connection, or the computers and network of the
sites you are trying to use, an attacker may be able to prevent you from
accessing  email,  websites, online accounts (banking, etc.), or other
services that rely on the affected computer.

The most common and obvious type of DoS attack occurs when an attacker
“floods” a network with information. When you type a URL for a particular
website into your browser, you are sending a request to that site’s computer
server to view the page. The server can only process a certain number of
requests at once, so if an attacker overloads the server with requests, it
can’t process your request. This is a “denial of service” because you can’t
access that site.

An attacker can use spam email messages to launch a similar attack on your
email account. Whether you have an email account supplied by your employer
or one available through a free service such as Yahoo or Hotmail, you are
assigned a specific quota, which limits the amount of data you can have in
your account at any given time. By sending many, or large, email messages to
the  account,  an attacker can consume your quota, preventing you from
receiving legitimate messages.

What is a distributed denial-of-service (DDoS) attack?

In a distributed denial-of-service (DDoS) attack, an attacker may use your
computer  to  attack another computer. By taking advantage of security
vulnerabilities  or weaknesses, an attacker could take control of your
computer. He or she could then force your computer to send huge amounts of
data to a website or send spam to particular email addresses. The attack is
“distributed” because the attacker is using multiple computers, including
yours, to launch the denial-of-service attack.

How do you avoid being part of the problem?

Unfortunately, there are no effective ways to prevent being the victim of a
DoS  or  DDoS  attack,  but there are steps you can take to reduce the
likelihood  that  an  attacker  will use your computer to attack other
computers:
* Install and maintain anti-virus software (see Understanding Anti-Virus
Software for more information).
* Install a firewall, and configure it to restrict traffic coming into and
leaving  your  computer  (see  Understanding  Firewalls  for  more
information).
* Follow good security practices for distributing your email address (see
Reducing Spam for more information). Applying email filters may help you
manage unwanted traffic.

How do you know if an attack is happening?

Not all disruptions to service are the result of a denial-of-service attack.
There  may  be technical problems with a particular network, or system
administrators  may  be performing maintenance. However, the following
symptoms could indicate a DoS or DDoS attack:
* unusually slow network performance (opening files or accessing websites)
* unavailability of a particular website
* inability to access any website
* dramatic increase in the amount of spam you receive in your account

What do you do if you think you are experiencing an attack?

Even if you do correctly identify a DoS or DDoS attack, it is unlikely that
you will be able to determine the actual target or source of the attack.
Contact the appropriate technical professionals for assistance.
* If  you  notice that you cannot access your own files or reach any
external  websites  from  your work computer, contact your network
administrators.  This  may  indicate  that  your  computer or your
organization’s network is being attacked.
* If you are having a similar experience on your home computer, consider
contacting your internet service provider (ISP). If there is a problem,
the ISP might be able to advise you of an appropriate course of action.
_________________________________________________________________

Author: Mindi McDowell

Adobe has released Shockwave Player 11.5.2.602 to address multiple
vulnerabilities. Exploitation of these vulnerabilities may allow an
attacker to run malicious code on the user’s machine.

We encourage users and administrators to review Adobe security
bulletin APSB09-16 and update to Shockwave Player 11.5.2.602 to help
mitigate the risks.

Relevant Url(s):
<http://www.adobe.com/support/security/bulletins/apsb09-16.html>

Sun has released update 17 for Java SE JDK 6 and Java SE JRE 6 to
address multiple vulnerabilities. The impacts of these vulnerabilities
include arbitrary code execution, privilege escalation, denial of
service, and information disclosure.

We encourage users and administrators to review the Java the
Java SE 6 Update 17 release notes and apply any necessary updates to
help mitigate the risks.

Relevant Url(s):
<http://java.sun.com/javase/6/webnotes/6u17.html>

<http://java.sun.com/javase/downloads/index.jsp>

<