Gladiator Research and Security

Microsoft has announced six new patches for its monthly patch release cycle.  These patches are for Microsoft Windows and Microsoft Office.  Three patches are rated Critical and affect Microsoft Windows and Microsoft Office, allowing for remote code execution on vulnerable systems.  Gladiator recommends that users immediately apply all Critical patches to their systems. Detailed information for the patches can be found in Microsoft’s December Security Bulletin.  Summary information is included below:

GSA Reference Number: AD091203-01

Simply Put: A fraudulent email is currently circulating that appears to be from the Center for Disease Control (CDC).  The email scam informs recipients that they need to register with the CDC due to the launch of a ficticious “State Vaccination H1N1 Program.”  There is a link in the email that will forward users to a fake website that will actually install the ZeuS Trojan.

GSA Reference Number: AD091124-01

Simply Put: Microsoft Internet Explorer (IE) 6 and 7 are vulnerable to a remote code execution vulnerability.  This vulnerability was released to the public earlier this week.  Currently, this exploit is not deemed reliable, meaning that it is difficult to exploit consistently.  However, there will most likely be a reliable version released in the near future.  This exploit also could be triggered by an HTML email message if using Microsoft Outlook, Outlook Express, or Microsoft Mail, as these products use IE to display these messages.

GSA Reference Number: AD091112-01

Simply Put: A fraudulent email is currently circulating that appears to be from NACHA, the Electronics Payment Association.  The email includes a link that will forward users to a fake website that instructs the user to download a report about a failed ACH transaction.  This report is actually malicious software (Zeus/Jabber).  We have already detected infections at several financial institutions as a result of this scam.

Microsoft has announced six new patches for its monthly patch release cycle.  These patches are for Microsoft Windows and Microsoft Office.  Three patches are rated Critical and affect Microsoft Windows, allowing for remote code execution on vulnerable systems.  Gladiator recommends that users immediately apply all Critical patches to their systems. Detailed information for the patches can be found in Microsoft’s November Security Bulletin. 

GSA Reference Number: AD091026-01

Simply Put: A phishing email is currently circulating that appears to be from the Federal Deposit Insurance Corporation (FDIC).  The email includes a link that will forward users to a fraudulent website that will request personal information and attempt to infect the user’s machine with viruses.  We have already detected infections at several financial institutions as a result of this email.

GSA Reference Number: AD091014-01

Simply Put: Adobe has released a critical patch to address 29 security vulnerabilities in its Acrobat and Reader products. These vulnerabilities have been rated Critical and could lead to remote code execution or denial of service.  All versions of Acrobat and Reader earlier than 9.2 are affected, including Windows, Macintosh and Unix versions.  Gladiator recommends that this patch is applied to all workstations as soon as possible.