Red Hat Security Advisory 2015-1176-01

Red Hat Security Advisory 2015-1176-01 – Red Hat JBoss Fuse, based on Apache ServiceMix, provides a small-footprint, flexible, open source enterprise service bus and integration platform. The following security fixes are addressed in this release: It was found that async-http-client would disable SSL/TLS certificate verification under certain conditions, for example if HTTPS communication also used client certificates. A man-in-the-middle attacker could use this flaw to spoof a valid certificate. It was found that async-http-client did not verify that the server hostname matched the domain name in the subject’s Common Name or subjectAltName field in X.509 certificates. This could allow a man-in-the-middle attacker to spoof an SSL server if they had a certificate that was valid for any domain name.

Red Hat Security Advisory 2015-1177-01

Red Hat Security Advisory 2015-1177-01 – Red Hat JBoss A-MQ, based on Apache ActiveMQ, is a standards-compliant messaging system that is tailored for use in mission critical applications. Red Hat JBoss A-MQ 6.2.0 is a minor product release that updates Red Hat JBoss A-MQ 6.1.0 and includes several bug fixes and enhancements.

IC3 Issues Alert on CryptoWall Ransomware

Original release date: June 23, 2015

The Internet Crime Complaint Center (IC3) has issued an alert warning that U.S. individuals and businesses are still at risk of CryptoWall ransomware fraud. Scam operators use ransomware—a type of malicious software—to infect a device and restrict access until a ransom fee is paid­­. Individuals and organizations are discouraged from paying the ransom, as this does not guarantee files will be released.

US-CERT encourages users and administrators to review the IC3 Alert for details and refer to the US-CERT Alert TA-295A for information on crypto ransomware.


This product is provided subject to this Notification and this Privacy & Use policy.

Vacation scams can ruin your holiday

Do you dream of lounging with an umbrella drink on a sunny beach, hiking by a pristine lake in the cool mountains, or leisurely strolling through a world class museum? As you begin to make summer vacation plans, much of it planned and reserved via the Internet, here are a few scams to be aware of:

Fake vacation rentals

vacation scamsPrivate vacation rentals are growing in popularity and it’s easy to find one these days through portals like Airbnb, HomeAway, and Craigslist. A typical scam starts with attractive pictures of a property in a desired location. The phony landlord, who is really a scam artist, requires an up-front deposit on the rental that is typically sent by wire transfer. When the happy family arrives at the destination, it either doesn’t exist, it’s not at all like it was described, or it is not available for rental. It may even belong to someone else, who lives there and has no knowledge of the transaction.

How to protect yourself from vacation rental scams

Don’t be fooled by pretty pictures. Photoshop is amazing and an artist can do all kinds of tricks with it. Ask the property owner to send you additional photos. You can even look it up on Google’s Street View to make sure the property and address actually exists.

Use your credit card instead of cash to make any deposits. Cybercrooks prefer cash, so protect yourself by using your credit card. If you get in a jam, Visa, MasterCard, and American Express can help you recover money lost to fraud.

Fake vacation packages

cruise ship

“You’ve won a dream cruise to Bingo-Bongo Island!” A message like this may come to you via email or you may get a phone call from a hard-selling travel operator. Similar to the fake vacation rental, you are required to pay a deposit for your luxurious resort or cruise. When you arrive, you find out that the package was misrepresented and there are additional fees to be paid to get the “great deal.”

How to protect yourself from vacation package scams

Legitimate offers give you their cancellation and refund policy, along with details of the location of the vacation, the name of the cruise line or resort, the length of time you will be there, and contact information.

Get a confirmation or booking number from the cruise line, hotel, or airlines rather than the travel agency confirmation number. If the cruise line is not on your credit card statement, that is a warning flag.

Free airfare scams

Airfare is a big chunk of your vacation costs, so receiving a discount is welcome. But victims of airfare scams often find that after they pay they do not receive a confirmation or that their credit card has been declined. The only way to get the discount is to pay by wire transfer, which leaves the victim without a ticket and no way to claim a refund.

Don't fall for free airline ticket scams

Social media scams, like this Southwest Airlines scam that has been going around Facebook for a few years, lure prospective travelers to malicious websites with sweepstakes offering free airline tickets. Victims are asked to complete online surveys which reveal personal information, and agree to hidden offers in the fine print of the contest. They are encouraged to share the scam which then gets sent to all their Facebook friends. This type of  scam has been known to spread “lifejacking” malware as well. That gives a hacker control of your profile so viral messages are spread to your friend’s accounts.

How to protect yourself from free airfare scams

If it’s too good to be true, it probably is. Don’t open unsolicited emails, take phone calls, or share social posts that offer a once-in-a-lifetime deal without first confirming it’s real.

CVE-2015-2859

Intel McAfee ePolicy Orchestrator (ePO) 4.x through 4.6.9 and 5.x through 5.1.2 does not validate server names and Certification Authority names in X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CVE-2015-3113

Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11.2.202.468 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in June 2015.