WEEKEND VULNERABILITY AND PATCH REPORT

March 10, 2013

The following software vulnerabilities and updates were announced by Citadel Information Group.  They strongly recommend that readers update their computers and take other action as indicated.  This is from an e-mail received from Stan Stahl, Ph.D. [www.citadel-information.com] and posted with his approval.

Important Security Updates

Apple OS X Java: Apple has released Mac OS X 10.6 Update 14 for Java version SE 6 to 1.6.0_43. Updates are available from Apple's website.

Google Chrome: Google has released an update to Chrome to fix a highly critical vulnerability. Update to version version 25.0.1364.160 for Windows either through the program or from Chrome's website.

Mozilla Firefox: Mozilla has released version 19.0.2 of Firefox to fix a highly critical vulnerability. Updates are available through the program or Firefox's web site. Updates are also available for Thunderbird and SeaMonkey.

Java 7 Update 17: Oracle released an emergency Java Update to address a critical vulnerability (CVE-2013-1493) in Java that security experts warned last week was being used in targeted attacks against high-profile targets. Oracle also released Update 43 to Java 6 to help Java 6 users address this latest crisis. The update is available through the program or at the Java Download site.

Current Software Versions

Adobe Flash 11.6.602.171 [Windows 7: IE9, Firefox, Mozilla, Netscape, Opera]

Adobe Flash 11.6.602.171 [Windows 8: IE]

Adobe Flash 11.6.602.171 [Macintosh OS X: Firefox, Opera, Safari]

Adobe Reader 11.0.02

Dropbox 1.6.11 [Citadel warns against relying on Dropbox security. We recommend files containing sensitive information be independently encrypted with a program like Axcrypt; encryption keys be at least 15 characters long; and the Dropbox password be at least 15 characters long and different from other passwords.]

Firefox 19.0.2 [Windows]

Google Chrome 25.0.1364.160

Internet Explorer 9.0.8112.16421 [Windows 7: IE]

Internet Explorer 10.0.9200.16484 [Windows 8: IE]

Java SE 7 Update 17 [Citadel recommends removing or disabling Java from your browser. Java is a major source of cyber criminal exploits. It is not needed for most internet browsing. If you have particular web sites that requires Java, Citadel recommends using a two-browser approach to minimize risk. If you normally browse the Web with Firefox, for example, disable the Java plugin in Firefox and use an alternative browser - such as Chrome, IE9, Safari, etc - with Java enabled to browse only the sites that require it.]

QuickTime 7.7.3 (1680.64)

Safari 5.1.7  [Windows]

Safari 6.0.2 [Mac OS X]

Skype 6.2.0.106

Newly Announced Unpatched Vulnerabilities

Kaspersky Internet Security: Secunia reports a moderately critical vulnerability in Kaspersky's Internet Security anti-virus product. The vulnerability is confirmed in version 13.0.1.4190. Other versions may also be affected. Successful exploitation requires the system to be accessible via IPv6. There is no patch available at this time.

Important Unpatched Vulnerabilities has moved! 

For an updated list of previously announced Unpatched Vulnerabilities, please see the resources section of Citadel's website at http://www.citadel-information.com/resources/unpatched-vulnerabilities/

For Your IT Department

Citrix Access Gateway: Citrix has released updates to its Access Gateway to fix a moderately critical vulnerability in versions prior to 5.0.4.223524. Apply patches.

HP Intelligent Management Center: HP has released an update to its Intelligent Management Center (IMC) to fix at least 14 moderately critical vulnerabilities. Update to version 5.2 E401.

Copyright © 2013 Citadel Information Group. All rights reserved.