- Joined
- Jun 27, 2006
- Location
- Chicago, IL
Original release date: April 29, 2015
Systems Affected
Systems running unpatched software from Adobe, Microsoft, Oracle, or OpenSSL.
Overview
Cyber threat actors continue to exploit unpatched software to conduct attacks against critical infrastructure organizations. As many as 85 percent of targeted attacks are preventable [1].
This Alert provides information on the 30 most commonly exploited vulnerabilities used in these attacks, along with prevention and mitigation recommendations.
It is based on analysis completed by the Canadian Cyber Incident Response Centre (CCIRC) and was developed in collaboration with our partners from Canada, New Zealand, the United Kingdom, and the Australian Cyber Security Centre.
Description
Unpatched vulnerabilities allow malicious actors entry points into a network. A set of vulnerabilities are consistently targeted in observed attacks.
Impact
A successful network intrusion can have severe impacts, particularly if the compromise becomes public and sensitive information is exposed. Possible impacts include:
The attack vectors frequently used by malicious actors such as email attachments, compromised “watering hole” websites, and other tools often rely on taking advantage of unpatched vulnerabilities found in widely used software applications. Patching is the process of repairing vulnerabilities found in these software components.
It is necessary for all organizations to establish a strong ongoing patch management process to ensure the proper preventive measures are taken against potential threats. The longer a system remains unpatched, the longer it is vulnerable to being compromised. Once a patch has been publicly released, the underlying vulnerability can be reverse engineered by malicious actors in order to create an exploit. This process has been documented to take anywhere from 24-hours to four days. Timely patching is one of the lowest cost yet most effective steps an organization can take to minimize its exposure to the threats facing its network.
Patch commonly exploited vulnerabilities.
Executives should ensure their organization’s information security professionals have patched the following software vulnerabilities. Please see patching information for version specifics.
As part of a comprehensive security strategy, network administrators should implement the following four mitigation strategies, which can help prevent targeted cyber attacks.
It is recommended that users review US-CERT Security Tip (ST13-003) and CCIRC’s Mitigation Guidelines for Advanced Persistent Threats for additional background information and to assist in the detection of, response to, and recovery from malicious activity linked to advance persistent threats [2, 3].
References
This product is provided subject to this Notification and this Privacy & Use policy.
Continue reading...
Systems Affected
Systems running unpatched software from Adobe, Microsoft, Oracle, or OpenSSL.
Overview
Cyber threat actors continue to exploit unpatched software to conduct attacks against critical infrastructure organizations. As many as 85 percent of targeted attacks are preventable [1].
This Alert provides information on the 30 most commonly exploited vulnerabilities used in these attacks, along with prevention and mitigation recommendations.
It is based on analysis completed by the Canadian Cyber Incident Response Centre (CCIRC) and was developed in collaboration with our partners from Canada, New Zealand, the United Kingdom, and the Australian Cyber Security Centre.
Description
Unpatched vulnerabilities allow malicious actors entry points into a network. A set of vulnerabilities are consistently targeted in observed attacks.
Impact
A successful network intrusion can have severe impacts, particularly if the compromise becomes public and sensitive information is exposed. Possible impacts include:
- Temporary or permanent loss of sensitive or proprietary information,
- Disruption to regular operations,
- Financial losses relating to restoring systems and files, and
- Potential harm to an organization’s reputation.
Maintain up-to-date software.
The attack vectors frequently used by malicious actors such as email attachments, compromised “watering hole” websites, and other tools often rely on taking advantage of unpatched vulnerabilities found in widely used software applications. Patching is the process of repairing vulnerabilities found in these software components.
It is necessary for all organizations to establish a strong ongoing patch management process to ensure the proper preventive measures are taken against potential threats. The longer a system remains unpatched, the longer it is vulnerable to being compromised. Once a patch has been publicly released, the underlying vulnerability can be reverse engineered by malicious actors in order to create an exploit. This process has been documented to take anywhere from 24-hours to four days. Timely patching is one of the lowest cost yet most effective steps an organization can take to minimize its exposure to the threats facing its network.
Patch commonly exploited vulnerabilities.
Executives should ensure their organization’s information security professionals have patched the following software vulnerabilities. Please see patching information for version specifics.
Microsoft
Internet ExplorerMicrosoft Malware Protection Encyclopedia Entry
Office Word
Office
Office for Mac
Open XML File Format Converter for Mac
Office Excel Viewer
Excel
Office Compatibility Pack for Word, Excel, and PowerPoint
Internet ExplorerInternet Explorer
Office
Office for Mac
Open XML File Format Converter for Mac
Excel
Office
SQL Server
BizTalk Server
Commerce Server
Visual FoxPro
Visual Basic
Office
SQL Server
Commerce Server
Host Integration Server
Visual FoxPro Visual Basic
Internet ExplorerMicrosoft Security Bulletin MS13-008
Silverlight and Developer RuntimeMicrosoft Security Bulletin MS13-022
Internet ExplorerMicrosoft Security Bulletin MS13-038
Internet ExplorerMicrosoft Security Bulletin MS14-012
Microsoft Word
Office Word Viewer
Office Compatibility Pack
Office for Mac
Word Automation Services on SharePoint Server
Office Web Apps
Office Web Apps Server
Internet ExplorerWindowsOracle
Affected Products
Java Development Kit, SDK, and JRE
Java Development Kit and JRE
Adobe
Flash Player
AIR
AIR SDK & Compiler
OpenSSL
OpenSSL
Implement the following four mitigation strategies.CVE
Affected Products
Patching Information
Internet ExplorerMicrosoft Malware Protection Encyclopedia Entry
Office Word
Office
Office for Mac
Open XML File Format Converter for Mac
Office Excel Viewer
Excel
Office Compatibility Pack for Word, Excel, and PowerPoint
Internet ExplorerInternet Explorer
Office
Office for Mac
Open XML File Format Converter for Mac
Excel
Office
SQL Server
BizTalk Server
Commerce Server
Visual FoxPro
Visual Basic
Office
SQL Server
Commerce Server
Host Integration Server
Visual FoxPro Visual Basic
Internet ExplorerMicrosoft Security Bulletin MS13-008
Silverlight and Developer RuntimeMicrosoft Security Bulletin MS13-022
Internet ExplorerMicrosoft Security Bulletin MS13-038
Internet ExplorerMicrosoft Security Bulletin MS14-012
Microsoft Word
Office Word Viewer
Office Compatibility Pack
Office for Mac
Word Automation Services on SharePoint Server
Office Web Apps
Office Web Apps Server
Internet ExplorerWindowsOracle
CVE
Affected Products
Patching Information
Java Development Kit, SDK, and JRE
Java Development Kit and JRE
Adobe
CVE
Affected Products
Patching Information
CVE-2009-3953
CVE-2010-0188
CVE-2010-2883
CVE-2011-0611
CVE-2013-0625
CVE-2013-3336
ColdFusionAdobe Security Bulletin APSB13-27CVE-2010-0188
CVE-2010-2883
CVE-2011-0611
Flash Player
AIR
Reader
Acrobat
Adobe Security Bulletin APSB11-07
Adobe Security Bulletin APSB11-08
CVE-2011-2462AIR
Reader
Acrobat
Adobe Security Bulletin APSB11-07
Adobe Security Bulletin APSB11-08
CVE-2013-0625
ColdFusionAdobe Security Bulletin APSB13-03
CVE-2013-0632ColdFusionAdobe Security Bulletin APSB13-03
CVE-2013-2729CVE-2013-3336
ColdFusionAdobe Security Bulletin APSB13-13
CVE-2013-5326 Flash Player
AIR
AIR SDK & Compiler
OpenSSL
CVE
Affected Product
Patching Information
OpenSSL
As part of a comprehensive security strategy, network administrators should implement the following four mitigation strategies, which can help prevent targeted cyber attacks.
Ranking
Mitigation Strategy
Rationale
1
Use application whitelisting to help prevent malicious software and unapproved programs from running.
Application whitelisting is one of the best security strategies as it allows only specified programs to run, while blocking all others, including malicious software.
2
Patch applications such as Java, PDF viewers, Flash, web browsers and Microsoft Office.
Vulnerable applications and operating systems are the target of most attacks. Ensuring these are patched with the latest updates greatly reduces the number of exploitable entry points available to an attacker.
3
Patch operating system vulnerabilities.
4
Restrict administrative privileges to operating systems and applications based on user duties.
Restricting these privileges may prevent malware from running or limit its capability to spread through the network.
It is recommended that users review US-CERT Security Tip (ST13-003) and CCIRC’s Mitigation Guidelines for Advanced Persistent Threats for additional background information and to assist in the detection of, response to, and recovery from malicious activity linked to advance persistent threats [2, 3].
References
- [1] Canadian Cyber Incident Response Centre, Top 4 Strategies to Mitigate Targeted Cyber Intrusions
- [2] Canadian Cyber Incident Response Centre, TR11-002, Mitigation Guidelines for Advanced Persistent Threats
- [3] US-CERT Security Tip (ST13-003): Handling Destructive Malware
- April 29, 2015: Initial release
This product is provided subject to this Notification and this Privacy & Use policy.
Continue reading...