WEEKEND VULNERABILITY AND PATCH REPORT

April 28, 2013

The following software vulnerabilities and updates were announced by Citadel Information Group.  They strongly recommend that readers update their computers and take other action as indicated.  This is from an e-mail received from Stan Stahl, Ph.D. [www.citadel-information.com] and posted with his approval.

Important Security Updates

RoboForm: Roboform has released version 7.8.8.5. Download the update from Roboform's website.  

Gallery Project: GalleryProject.org has released version 3.0.7 to fix a vulnerability in Gallery report in prior versions. Update to version 3.0.7 which can be found on Gallery's website.  

HP LaserJet Printers: HP has released firmware updates for many of its LaserJet Printers. The firmware fixes a less critical vulnerability. Click here to see a list of the specific models affected and click here to find instructions for updating the firmware.

Current Software Versions

Adobe Flash 11.7.700.169 [Windows 7: IE9, Firefox, Mozilla, Netscape, Opera]

Adobe Flash 11.7.700.169 [Windows 8: IE]

Adobe Flash 11.7.700.169 [Macintosh OS X: Firefox, Opera, Safari]

Adobe Reader 11.0.02

Dropbox 1.6.11 [Citadel warns against relying on Dropbox security. We recommend files containing sensitive information be independently encrypted with a program like Axcrypt; encryption keys be at least 15 characters long; and the Dropbox password be at least 15 characters long and different from other passwords.]

Firefox 20.0.1 [Windows]

Google Chrome 26.0.1410.64

Internet Explorer 10.0.9200.16521 [Windows 7: IE]

Internet Explorer 10.0.9200.16519 [Windows 8: IE]

Java SE 7 Update 21 [Citadel recommends removing or disabling Java from your browser. Java is a major source of cyber criminal exploits. It is not needed for most internet browsing. If you have particular web sites that requires Java, Citadel recommends using a two-browser approach to minimize risk. If you normally browse the Web with Firefox, for example, disable the Java plugin in Firefox and use an alternative browser - such as Chrome, IE9, Safari, etc - with Java enabled to browse only the sites that require it.]

QuickTime 7.7.3 (1680.64)

Safari 5.1.7  [Windows]

Safari 6.0.4 [Mac OS X]

Skype 6.3.0.105

Newly Announced Unpatched Vulnerabilities

Belkin Advance N900 Dual-Band Wireless Router: Secunia reports an unpatched vulnerability in Belkin's Advance N900 Dual-Band Wireless Router in firmware version 1.00.06. Other versions may also be affected. No official solution is currently available. 

Belkin N300 Wi-Fi N Router: Secunia reports an unpatched vulnerability in Belkin's N300 Wi-Fi Router in firmware version 1.00.06. Other versions may also be affected. No official solution is currently available. 

D-Link DIR-300 / DIR-615 Wireless Router: Secunia reports an unpatched vulnerability in D-Link's Wireless Routers; DIR-300 Rev A version 1.05 and DIR-615 Rev D3 version 4.13. Secunia reports a second unpatched vulnerability in D-Link's DIR-615 Rev D3 version 4.13. Other versions may also be affected. No official solution is currently available. 

Linksys WRT310N Wireless Router: Secunia reports an unpatched vulnerability in  Linksys' WRT310N Wireless Router in firmware version 2.0.0.1. Other versions may also be affected. No official solution is currently available. 

NetGear WNDR4700 Wireless Router: Secunia reports an unpatched moderately critical vulnerability in NetGear's WNDR4700 Wireless Router in version 1.0.0.34. Other versions may also be affected. No official solution is currently available. 

TP-LINK TD-8817 Wireless Router: Secunia reports an unpatched vulnerability in TP-LINK's TD-8817 Wireless Router in version 6.0.1 Build 111128 Rel.26763. Other versions may also be affected. No official solution is currently available. 

TP-LINK WR1043N Wireless Router: Secunia reports an unpatched vulnerability in TP-LINK's WR1043N Wireless Router in version TL-WR1043ND_V1_120405. Other versions may also be affected. No official solution is currently available. 

For an updated list of previously announced Unpatched Vulnerabilities, please see the resources section of Citadel's website.

For Your IT Department

Cisco Unpatched Products: Secunia reports unpatched security issues with Cisco's Firewall Services Module reported in version 4.1(5) and ASA Software versions 8.2(5) and 8.4(0.3). No official solutions are currently available. 

Cisco Multiple Products: Cisco has released updates for multiple products, including Cisco's NX-OS-based products, Cisco Device Manager, and Cisco Unified Computing System,  and others. Apply appropriate updates.

Citrix CloudPlatform: Citrix has released an update to fix at least 3 moderately critical vulnerabilities reported in versions 3.0.x through 3.0.6 with patch B. Apply security patch.

Citrix NetScaler / Access Gateway: Citrix has released an update to fix a moderately critical vulnerability. Apply appropriate patch.

Citrix Xen Server: Citrix has released an update to fix a vulnerability reported in versions 6.1 and prior. Apply patches.

Firefox FirePHP: Firefox has released an update to fix a weakness in the FirePHP extension for Firefox. Update to version 0.7.2.

HP Managed Printing Administration: HP has released an update to its Managed Printing Administration to fix a vulnerability reported in previous versions. Update to version 2.7.0.

IBM Security AppScan / Java Vulnerabilities: IBM has released version 8.6.0.1 to fix at least 20 vulnerabilities, some of which are highly critical, in IBM Security AppScan Standard versions 8.0 and 8.5 bundled with Java. Previous versions remain unpatched.

Ipswitch IMail Server: Ipswitch has released an update to fix a vulnerability in its IMail Server reported in previous versions of the bundled version of OpenSSL. Update to version 12.3.

Joomla!: Joomla! has released updates to fix at least 6 moderately critical vulnerabilities in Joomla! reported in versions prior to 2.5.10 and 3.1.0. Update to version 2.5.10 or 3.1.0.

Joomla! ALFContact Component: Secunia reports a vulnerability in Joomla!'s ALFContact Component in version 3.1. Otherversions may also be affected. No official solution is currently available.

McAfee ePolicy Orchestrator: McAfee has released version 8.6.0.1 to fix at least 2 moderately critical vulnerabilities reported in versions 4.5.6 and prior and versions 4.6.5 and prior. Apply patches.

VMware Products / Java Vulnerabilities: VMware has released a partial fix to address at least 30 highly critical vulnerabilities reportedly found in the following products and versions bundled with Java: vCenter Server version 5.0,vCenter Server version 4.1, Update Manager version 5.1, Update Manager version 5.0, ESX version 4.1. Apply patch if available.

VMware vCenter Server: VMware has released an update to its Server Products to fix at least 40 vulnerabilities, some of which are highly critical. Update to version 5.1 Update 1. 

If you are responsible for the security of your computer, Citadel's Weekend Vulnerability and Patch Report is for you. We strongly urge you to take action to keep your workstation patched and updated.

If someone else is responsible for the security of your computer, forward our Weekend Vulnerability and Patch Report to them and follow up to make sure your computer has been patched and updated.

Vulnerability management is a key element of cyber security management. Cyber criminals take over user computers by writing computer programs that "exploit" vulnerabilities in operating systems (Windows, Apple OS, etc) and application programs (Adobe Acrobat, Office, Flash, Java, etc). When software companies find a vulnerability, they usually issue an update patch to fix the code running in their customer's computers.

Citadel publishes our Weekend Vulnerability and Patch Report to alert readers to some of the week's important updates and vulnerabilities. Our focus is on software typically found in the small or home office (SOHO) or that users are likely to have on their home computer. The report is not intended to be a thorough listing of updates and vulnerabilities.

Copyright © 2013 Citadel Information Group. All rights reserved.

Read This Before Tossing Old Tax Records

Now that your taxes have been completed for 2012, you are probably wondering what old records can be discarded. If you are like most taxpayers, you have records from years ago that you are afraid to throw away. It would be helpful to understand why the records must be kept in the first place.

Generally, we keep tax records for two basic reasons: (1) in case the IRS or a state agency decides to question the information reported on our tax returns, and (2) to keep track of the tax basis of our capital assets so that the tax liability can be minimized when we dispose of them.

With certain exceptions, the statute for assessing additional taxes [Statute of Limitations] is three years for the IRS and four years for the state from the return due date or the date the return was filed, whichever is later. In addition the federal three-year Statute of Limitation is extended to six years if a taxpayer omits more than 25 percent of the income reported on a tax return. And, of course, the statutes don't begin running until a return has been filed. There is no limit where a taxpayer files a false or fraudulent return to evade taxes.

If an exception does not apply to you, for federal purposes, most of your tax records that are more than four years old can probably be discarded.

Example - Sue filed her 2009 tax return before the due date of April 15, 2010. She will be able to dispose of most of the 2009 records safely after April 15, 2014. On the other hand, Don files his 2009 return on June 2, 2010. He needs to keep his records at least until June 2, 2014. Note: If a due date falls on a Saturday, Sunday or holiday, the due date becomes the next business day.

The big problem! The problem with the carte blanche discarding records for a particular year because the statute of limitations has expired is that many taxpayers combine their normal tax records and the records needed to substantiate the basis of capital assets. These need to be separated and the basis records should not be discarded before the statute expires for the year in which the asset is disposed. Thus, it makes more sense to keep those records separated by asset. The following are examples of records that fall into that category:

·     Stock acquisition data - If you own stock in a corporation, keep the purchase records for at least four years after the year the stock is sold. This data will be needed to prove the amount of profit (or loss) you had on the sale.

·     Stock and mutual fund statements (If you reinvest dividends) - Many taxpayers use the dividends they receive from stocks or mutual funds to buy more shares of the same stock or fund. The reinvested amounts add to the basis in the property and reduce gain when it is finally sold. Keep statements at least four years after the final sale.

·    Tangible property purchase and improvement records - Keep records of home, investment, rental property, or business property acquisitions AND a related capital improvement for at least four years after the underlying property is sold.

For example, when the large $250,000 and $500,000 home exclusion was passed into law several years back, homeowners became lax in maintaining home improvement records, thinking the large exclusions would cover any potential appreciation in the home's value. Now that the exclusion may not always be enough, records of home improvements are vital. Records can be important, so please use caution when discarding them.

If you have questions about whether or not to retain certain records? Give this office a call first; it is better to make sure, before discarding something that might be needed down the road.

WEEKEND VULNERABILITY AND PATCH REPORT

April 21, 2013

The following software vulnerabilities and updates were announced by Citadel Information Group.  They strongly recommend that readers update their computers and take other action as indicated.  This is from an e-mail received from Stan Stahl, Ph.D. [www.citadel-information.com] and posted with his approval.

Important Security Updates

Apple Java for OS X: Apple has released an update to OS X to fix at least 21 highly critical vulnerabilities in its version of Java. Download the update from Apple's website.

Apple Safari for OS X: Apple has released version 6.0.4. of Safari for OS X to fix a highly critical vulnerability. Download the update from Apple's website. This update is for OS X only and doesn't affect the Windows version.

Foxit 6.02.0413: Foxit has released a security and performance update. The updated program can be obtained from Foxit's web site

NetGear WNR1000: NetGear has released version 1.0.2.60 for its WNR1000 Wireless Router to fix a vulnerability. Download the update from NetGear's website by providing the model number of the router.

Oracle Java: Oracle has released Java  SE 7 Update 21 to fix at least 42 highly critical vulnerabilities in  Java. Download the update from the Java website.

Picasa 3.9, build 136.20: Picasa has released a security and performance update. The updated program can be obtained from Picasa's website.

VLC Media Player: VLC has released version 2.0.6 to its Media Player to fix a highly critical vulnerability reported in version 2.05 and prior. Download the version from VLC's website. We first alerted readers to this vulnerability in Weekend Vulnerability and Patch Report, February 3, 2013. 

Current Software Versions

Adobe Flash 11.7.700.169 [Windows 7: IE9, Firefox, Mozilla, Netscape, Opera]

Adobe Flash 11.7.700.169 [Windows 8: IE]

Adobe Flash 11.7.700.169 [Macintosh OS X: Firefox, Opera, Safari]

Adobe Reader 11.0.02

Dropbox 1.6.11 [Citadel warns against relying on Dropbox security. We recommend files containing sensitive information be independently encrypted with a program like Axcrypt; encryption keys be at least 15 characters long; and the Dropbox password be at least 15 characters long and different from other passwords.]

Firefox 20.0.1 [Windows]

Google Chrome 26.0.1410.64

Internet Explorer 10.0.9200.16521 [Windows 7: IE]

Internet Explorer 10.0.9200.16519 [Windows 8: IE]

Java SE 7 Update 21 [Citadel recommends removing or disabling Java from your browser. Java is a major source of cyber criminal exploits. It is not needed for most internet browsing. If you have particular web sites that requires Java, Citadel recommends using a two-browser approach to minimize risk. If you normally browse the Web with Firefox, for example, disable the Java plugin in Firefox and use an alternative browser - such as Chrome, IE9, Safari, etc - with Java enabled to browse only the sites that require it.]

QuickTime 7.7.3 (1680.64)

Safari 5.1.7  [Windows]

Safari 6.0.4 [Mac OS X]

Skype 6.3.0.105

Newly Announced Unpatched Vulnerabilities

D-Link DIR-865L Wireless Router: Secunia reports an unpatched vulnerability in D-Link's DIR-865-L Wireless Router in version 1.03. There is currently no patch at this time.

Linksys EA2700 Wireless Router: Secunia reports unpatched vulnerabilities in Linksys' EA2700 Wireless Router in firmware version 1.0.12.128947. There is currently no patch at this time. 

Linksys WRT54GL Wireless Router: Secunia reports an unpatched vulnerability in D-Link's DIR-865-L Wireless Router in firmware version 4.30.15. There is currently no patch at this time. 

For an updated list of previously announced Unpatched Vulnerabilities, please see the resources section of Citadel's website.

For Your IT Department

Cisco Multiple Products: Cisco has released updates for multiple products, including its Adaptive Security Appliance, NAC appliance,  and others. Apply appropriate updates.

Novell GroupWise: Novell has released an update for its GroupWise WebAccess to fix a vulnerability. Apply appropriate patches.

Oracle Multiple Products: US-CERT and Secunia reports that Oracle has released updates for at least 31 of its products, including Oracle Database Server, E-Business Suite, Supply Chain Products Suite, PeopleSoft, My SQL and others. Apply appropriate updates.

If you are responsible for the security of your computer, Citadel's Weekend Vulnerability and Patch Report is for you. We strongly urge you to take action to keep your workstation patched and updated.

If someone else is responsible for the security of your computer, forward our Weekend Vulnerability and Patch Report to them and follow up to make sure your computer has been patched and updated.

Vulnerability management is a key element of cyber security management. Cyber criminals take over user computers by writing computer programs that "exploit" vulnerabilities in operating systems (Windows, Apple OS, etc) and application programs (Adobe Acrobat, Office, Flash, Java, etc). When software companies find a vulnerability, they usually issue an update patch to fix the code running in their customer's computers.

Citadel publishes our Weekend Vulnerability and Patch Report to alert readers to some of the week's important updates and vulnerabilities. Our focus is on software typically found in the small or home office (SOHO) or that users are likely to have on their home computer. The report is not intended to be a thorough listing of updates and vulnerabilities.

Copyright © 2013 Citadel Information Group. All rights reserved.

U.S. Senate edges closer to vote on Internet sales tax

WASHINGTON, April 18 (Reuters) - Legislation giving states the power to compel retailers outside their borders to collect online sales taxes, a touchy subject for Internet merchants, is likely to move forward in the Senate next week.

Senate Majority Leader Harry Reid on Thursday filed a motion in support of the measure. Currently, states rely on consumers to self-report, which they rarely do.

If approved, the change would be a win for brick-and-mortar stores like Wal-Mart Stores Inc, the world's biggest retailer, which backs the legislation.

At the moment, states can only require online merchants with physical stores or affiliates within their borders to collect sales tax, giving online-only retailers such as Amazon.com Inc a price advantage in many markets.

As a result of Reid's motion, the Senate was expected to vote on Monday on whether to end debate and move the measure forward. A vote on the legislation could come later in the week. Backers say they have the 60 votes needed to end debate.

Momentum has been building since 75 of 100 senators last month voted for a nonbinding version of the bill. The road ahead for the measure is bumpier in the House of Representatives, where some Republicans view it as a tax hike.

One House sponsor, conservative Representative Steve Womack, has been lobbying fellow Republicans to support the measure, according to an aide.

 

But Republican Bob Goodlatte, chairman of the Judiciary Committee, where the bill would have to go through, said he is skeptical.

"While it attempts to make tax collection simpler, it still has a long way to go," Goodlatte said.

Womack is from Arkansas, home of Walmart. Amazon.com also supports the measure, but others including eBay Inc oppose it. (Reporting by Kim Dixon and Nanette Byrnes; Editing by Kevin Drawbaugh and Xavier Briand)

By Kim Dixon, Correspondent at Reuters

WEEKEND VULNERABILITY AND PATCH REPORT

April 14, 2013

The following software vulnerabilities and updates were announced by Citadel Information Group.  They strongly recommend that readers update their computers and take other action as indicated.  This is from an e-mail received from Stan Stahl, Ph.D. [www.citadel-information.com] and posted with his approval.

Special Security Alert

Microsoft Patch Tuesday: KrebsOnSecurity.com writes that Microsoft is encouraging users to pay strict attention to this weeks patching regarding Microsoft Security Bulletin MS13-036. Those who haven't installed it yet should hold off on MS13-036, a security update that Microsoft released earlier this week to fix a dangerous security bug in its Windows operating system. Microsoft is seeing a spike in complaints from Windows users who found their machines unbootable after applying the update. Instructions to uninstall are available on Microsoft's website.

WordPress Websites: As reported in this week's Cyber Security News of the Week, KrebsOnSecurity.com writes if you have a website developed in WordPress or Joomla!, know your website may be under attack. Citadel strongly recommends you contact your webmaster and 1) set the account lockout threshold to be 5 or less, and 2) make sure the administrative password is complex and at least 15 characters long. See Citadel's blog post "Three Rules for Password Sanity." As a general rule, Citadel also recommends ensuring your webmaster keeps your WordPress and Joomla! installations patched and up to date. Further, ensure your webmaster or IT personnel keep servers patched and up to date.

Important Security Updates

Adobe Coldsion: Adobe has released updates to several versions of ColdFusion to fix highly critical vulnerabilities reported in versions 10, 9.0.2, 9.0.1 and 9.0 for Windows, Mac and UNIX. Specific steps for the updates are available from Adobe's website.

Adobe Flash Player: Adobe has released version 11.7.700.169 to fix highly critical vulnerabilities in its Flash Player. Updates are available from Adobe's website. Updates are also available for Adobe AIR

Adobe Flash Player for the Android: Adobe has released an update to fix highly critical vulnerabilities in its Flash Player for the Android. Updates are available through the device.

Adobe Shockwave Player: Adobe has released version 12.0.2.122 for both Windows and Mac to fix several critical vulnerabilities in earlier versions of its Shockwave Player. Updates are available from Adobe's website.

Google Chrome Flash Player: Google has released an updated version of Chrome to fix several highly critical vulnerabilities due to a bundled vulnerable version of Adobe Flash Player. Update to version 26.0.1410.63 for Mac and Linux or 26.0.1410.64 for Windows. Update through Chrome settings or go to Chrome's website.  

Microsoft Patch Tuesday: Microsoft released several updates addressing at least 13 security vulnerabilities, some of which are highly critical, in Windows, Internet Explorer, Microsoft Office, Microsoft Server Software, Silverlight, Remote Desktop, and Windows Defender Anti-malware program on Windows 8. Updates are available via Windows Update or from Automatic Update. See Special Security Alert above.

Mozilla Firefox: Mozilla has released version 20.0.1 of Firefox to fix at least 10 highly critical vulnerabilities that remain unpatched in previous versions. Updates are available through the program or Firefox's website. Updates are also available for Thunderbird and SeaMonkey.

Current Software Versions

Adobe Flash 11.7.700.169 [Windows 7: IE9, Firefox, Mozilla, Netscape, Opera]

Adobe Flash 11.7.700.169 [Windows 8: IE]

Adobe Flash 11.7.700.169 [Macintosh OS X: Firefox, Opera, Safari]

Adobe Reader 11.0.02

Dropbox 1.6.11 [Citadel warns against relying on Dropbox security. We recommend files containing sensitive information be independently encrypted with a program like Axcrypt; encryption keys be at least 15 characters long; and the Dropbox password be at least 15 characters long and different from other passwords.]

Firefox 20.0.1 [Windows]

Google Chrome 26.0.1410.64

Internet Explorer 10.0.9200.16521 [Windows 7: IE]

Internet Explorer 10.0.9200.16519 [Windows 8: IE]

Java SE 7 Update 17 [Citadel recommends removing or disabling Java from your browser. Java is a major source of cyber criminal exploits. It is not needed for most internet browsing. If you have particular web sites that requires Java, Citadel recommends using a two-browser approach to minimize risk. If you normally browse the Web with Firefox, for example, disable the Java plugin in Firefox and use an alternative browser - such as Chrome, IE9, Safari, etc - with Java enabled to browse only the sites that require it.]

QuickTime 7.7.3 (1680.64)

Safari 5.1.7  [Windows]

Safari 6.0.3 [Mac OS X]

Skype 6.3.0.105

Newly Announced Unpatched Vulnerabilities

Cisco Linksys EA2700 Wireless Router: Threatpost reports several unpatched highly critical vulnerabilities in Cisco's Linksys EA2700 Network Manager N600 Wireless-N router. There is currently no patch at this time.  

For an updated list of previously announced Unpatched Vulnerabilities, please see the resources section of Citadel's website.

For Your IT Department

Cisco Multiple Products: Cisco has released updates for multiple products, including its IOS products, Prime Network Control System, Firewall Services, ASA Software,  and AnyConnect VPN. Apply appropriate updates.

Novell Identity Manager: Novell has released an update for its Identify Manager. Apply appropriate patches. 

 

If you are responsible for the security of your computer, Citadel's Weekend Vulnerability and Patch Report is for you. We strongly urge you to take action to keep your workstation patched and updated.

If someone else is responsible for the security of your computer, forward our Weekend Vulnerability and Patch Report to them and follow up to make sure your computer has been patched and updated.

Vulnerability management is a key element of cyber security management. Cyber criminals take over user computers by writing computer programs that "exploit" vulnerabilities in operating systems (Windows, Apple OS, etc) and application programs (Adobe Acrobat, Office, Flash, Java, etc). When software companies find a vulnerability, they usually issue an update patch to fix the code running in their customer's computers.

Citadel publishes our Weekend Vulnerability and Patch Report to alert readers to some of the week's important updates and vulnerabilities. Our focus is on software typically found in the small or home office (SOHO) or that users are likely to have on their home computer. The report is not intended to be a thorough listing of updates and vulnerabilities.

Copyright © 2013 Citadel Information Group. All rights reserved.

IRS mistake doesn't give non-notice partner right to opt out of partnership proceedings

A district court has held that partner in a tax shelter who was erroneously informed by IRS that he had the right to opt out of the partnership examination wasn't entitled to be dismissed from the case. The court found that IRS had no statutory duty to inform the partner of the partnership proceedings and that its failure to do so didn't give the partner to the right to opt out of the proceedings, regardless of the fact that he was initially told otherwise. Kearney Partners Fund, LLC, (DC FL 3/27/2013) 111 AFTR 2d ¶ 2013-581

WEEKEND VULNERABILITY AND PATCH REPORT

March 31, 2013

The following software vulnerabilities and updates were announced by Citadel Information Group.  They strongly recommend that readers update their computers and take other action as indicated.  This is from an e-mail received from Stan Stahl, Ph.D. [www.citadel-information.com] and posted with his approval.

Important Security Updates

Google Chrome: Google has released version 26.0.1410.43 of Chrome to fix at least 11 highly critical vulnerabilities that remain unpatched in previous versions. Update through Chrome settings or go to Chrome's website.  

Google Picasa: Google has released version 3.9 Build 136.19 of Picasa. Updates are available through the program.

Current Software Versions

Adobe Flash 11.6.602.180 [Windows 7: IE9, Firefox, Mozilla, Netscape, Opera]

Adobe Flash 11.6.602.180 [Windows 8: IE]

Adobe Flash 11.6.602.180 [Macintosh OS X: Firefox, Opera, Safari]

Adobe Reader 11.0.02

Dropbox 1.6.11 [Citadel warns against relying on Dropbox security. We recommend files containing sensitive information be independently encrypted with a program like Axcrypt; encryption keys be at least 15 characters long; and the Dropbox password be at least 15 characters long and different from other passwords.]

Firefox 19.0.2 [Windows]

Google Chrome 26.0.1410.43

Internet Explorer 10.0.9200.16521 [Windows 7: IE]

Internet Explorer 10.0.9200.16519 [Windows 8: IE]

Java SE 7 Update 17 [Citadel recommends removing or disabling Java from your browser. Java is a major source of cyber criminal exploits. It is not needed for most internet browsing. If you have particular web sites that requires Java, Citadel recommends using a two-browser approach to minimize risk. If you normally browse the Web with Firefox, for example, disable the Java plugin in Firefox and use an alternative browser - such as Chrome, IE9, Safari, etc - with Java enabled to browse only the sites that require it.]

QuickTime 7.7.3 (1680.64)

Safari 5.1.7  [Windows]

Safari 6.0.3 [Mac OS X]

Skype 6.2.0.106

Newly Announced Unpatched Vulnerabilities

For an updated list of previously announced Unpatched Vulnerabilities, please see the resources section of Citadel's website.

For Your IT Department

Cisco Multiple Products: Cisco has released updates for multiple products, including its IOS products. Apply appropriate updates.

McAfee Firewall Enterprise: Secunia reports  a moderately critical unpatched vulnerability in McAfee's Firewall. No patches are available at this time. The vendor is currently working on a patch.

Novell ZENworks: Secunia reports a moderately critical vulnerability in Novell ZENworks versions 11.2 and 10.3. Check vendor advisories for patch availability.

VMware ESX / ESXi: Secunia reports a highly critical vulnerability in VMware's ESXi versions 5.1, 5.0, 4.1, and 4.0 and ESX versions 4.1 and 4.0. Check vendor advisories for patch availability.

If you are responsible for the security of your computer, Citadel's Weekend Vulnerability and Patch Report is for you. We strongly urge you to take action to keep your workstation patched and updated.

If someone else is responsible for the security of your computer, forward our Weekend Vulnerability and Patch Report to them and follow up to make sure your computer has been patched and updated.

Vulnerability management is a key element of cyber security management. Cyber criminals take over user computers by writing computer programs that "exploit" vulnerabilities in operating systems (Windows, Apple OS, etc) and application programs (Adobe Acrobat, Office, Flash, Java, etc). When software companies find a vulnerability, they usually issue an update patch to fix the code running in their customer's computers.

Citadel publishes our Weekend Vulnerability and Patch Report to alert readers to some of the week's important updates and vulnerabilities. Our focus is on software typically found in the small or home office (SOHO) or that users are likely to have on their home computer. The report is not intended to be a thorough listing of updates and vulnerabilities.

Copyright © 2013 Citadel Information Group. All rights reserved.