Original release date: December 21, 2015

As the winter holiday travel season begins, US-CERT and Stop.Think.Connect would like to remind users to be mindful of the security risks associated with portable devices such as smart phones, tablets, and laptops. These devices offer a range of conveniences such as allowing us to order gifts on-the-go, providing us with directions, and even letting us download our boarding pass to pass through security with just our mobile device. However, with all of these added conveniences often come potential threats and vulnerabilities.

US-CERT would like to encourage users to review the following Cybersecurity Tips. Following the security practices suggested in each tip will help to keep your portable devices secure during the holiday season and throughout the year.

• Stop.Think.Connect. Tip Card: Cybersecurity While Traveling
• Cyber Security Tip ST11-001: Holiday Traveling with Personal Internet-Enabled  Devices
• Cyber Security Tip ST05-017: Cybersecurity for Electronic Devices
• Cyber Security Tip ST04-017: Protecting Portable Devices: Physical Security

This product is provided subject to this Notification and this Privacy & Use policy.

Original release date: December 21, 2015

The US-CERT Cyber Security Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. The NVD is sponsored by the Department of Homeland Security (DHS) National Cybersecurity and Communications Integration Center (NCCIC) / United States Computer Emergency Readiness Team (US-CERT). For modified or updated entries, please visit the NVD, which contains historical vulnerability information.

The vulnerabilities are based on the CVE vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores:

• High – Vulnerabilities will be labeled High severity if they have a CVSS base score of 7.0 – 10.0

• Medium – Vulnerabilities will be labeled Medium severity if they have a CVSS base score of 4.0 – 6.9

• Low – Vulnerabilities will be labeled Low severity if they have a CVSS base score of 0.0 – 3.9

Entries may include additional information provided by organizations and efforts sponsored by US-CERT. This information may include identifying information, values, definitions, and related links. Patch information is provided when available. Please note that some of the information in the bulletins is compiled from external, open source reports and is not a direct result of US-CERT analysis.

This product is provided subject to this Notification and this Privacy & Use policy.

Original release date: December 17, 2015

The Internal Revenue Service (IRS) has released the fourth in a series of tips intended to help the public protect personal and financial data online and at home. This tip focuses on protecting your passwords. Recommendations include creating longer and more complex passwords, not using the same passwords for multiple accounts, and changing your passwords on a regular basis.

US-CERT encourages users and administrators to review the IRS Security Awareness Tax Tip Number 4 and the US-CERT Tip Choosing and Protecting Passwords for additional information.

This product is provided subject to this Notification and this Privacy & Use policy.

Original release date: December 17, 2015

Juniper has discovered unauthorized code in ScreenOS which could allow an attacker to take control of NetScreen devices and to decrypt VPN connections.

US-CERT recommends that users and administrators review Juniper Security Bulletin 2015-12 and update all affected ScreenOS versions.

This product is provided subject to this Notification and this Privacy & Use policy.

Original release date: December 15, 2015

Home and Small Business routers have become the ideal target for attackers seeking to gain control over a user’s gateway to the Internet. Router misconfigurations (e.g., default credentials, interfaces open to the Internet) or the lack of security precautions (e.g., absence of updates) may make users susceptible to exploitation. Once an attacker gains unauthorized access to a vulnerable router, they may be able to obtain sensitive information from a user’s computer or perform other attacks. Users and administrators are encouraged to review Security Tip ST15-002 for guidance on how to secure home and small business routers.

Additionally, the Carnegie Mellon CERT Coordination Center (CERT/CC) continues to test small office and home office (SOHO) routers for vulnerabilities. US-CERT encourages users and administrators to review CERT/CC Router Vulnerability Notes for information on recently found vulnerabilities in some routers.

This product is provided subject to this Notification and this Privacy & Use policy.

Original release date: December 15, 2015

ISC has released security updates to address vulnerabilities in BIND. Exploitation of these vulnerabilities may allow a remote attacker to cause a denial-of-service condition.

Available updates include:

• BIND 9 version 9.9.8-P2
• BIND 9 version 9.10.3-P2
• BIND 9 version 9.9.8-S3

Users and administrators are encouraged to review ISC Knowledge Base Article AA-01317 and apply the necessary updates.

This product is provided subject to this Notification and this Privacy & Use policy.

Original release date: December 15, 2015

The Mozilla Foundation has released security updates to address vulnerabilities in Firefox and Firefox ESR. Exploitation of some of these vulnerabilities may allow a remote attacker to take control of an affected system.

Available updates include:

• Firefox 43
• Firefox ESR 38.5

US-CERT encourages users and administrators to review the Security Advisories for Firefox and Firefox ESR and apply the necessary updates.

This product is provided subject to this Notification and this Privacy & Use policy.

Original release date: December 15, 2015

Google has released Chrome version 47.0.2526.106 to address multiple vulnerabilities for Windows, Mac, and Linux. Exploitation of one of these vulnerabilities may allow a remote attacker to take control of an affected system.

Users and administrators are encouraged to review the Chrome Releases page and apply the necessary update.

This product is provided subject to this Notification and this Privacy & Use policy.

Original release date: December 15, 2015

Symantec has released Symantec Endpoint Encryption 11.1.0 to address a vulnerability that may allow an attacker to take control of an affected system.

US-CERT encourages users and administrators to review the Security Advisory from Symantec and apply the necessary update.

This product is provided subject to this Notification and this Privacy & Use policy.

Original release date: December 15, 2015

Joomla has released version 3.4.6 of its content management system (CMS) software to address multiple vulnerabilities. Exploitation of some of these vulnerabilities may allow a remote attacker to take control of an affected website.

US-CERT encourages users and administrators to review the Joomla Release News and US-CERT’s Alert on Content Management Systems Security and Associated Risks and apply the necessary update

This product is provided subject to this Notification and this Privacy & Use policy.