Original release date: October 12, 2016

Cisco has released security updates to address vulnerabilities in multiple products. A remote attacker could exploit some of these vulnerabilities to take control of an affected system.

US-CERT encourages users and administrators to review the following Cisco Security Advisories and apply the necessary updates:

• Cisco Meeting Server Client Authentication Bypass Vulnerability [cisco-sa-20161012-msc]
• Cisco Wide Area Application Services Central Manager Denial of Service Vulnerability [cisco-sa-20161012-waas]
• Cisco Unified Communications Manager iFrame Data Clickjacking Vulnerability [cisco-sa-20161012-ucm]
• Cisco Prime Infrastructure and Evolved Programmable Network Manager Database Interface SQL Injection Vulnerability [cisco-sa-20161012-prime]
• Cisco Finesse Cross-Site Request Forgery Vulnerability [cisco-sa-20161012-fin]
• Cisco cBR-8 Converged Broadband Router vty Integrity Vulnerability [cisco-sa-20161012-cbr-8]

This product is provided subject to this Notification and this Privacy & Use policy.

Original release date: October 11, 2016

Microsoft has released 10 updates to address vulnerabilities in Microsoft software. Exploitation of some of these vulnerabilities could allow a remote attacker to take control of an affected system.

Users and administrators are encouraged to review Microsoft Security Bulletins MS16-118 through MS16-127 and apply the necessary updates.

This product is provided subject to this Notification and this Privacy & Use policy.

Original release date: October 11, 2016

Adobe has released security updates to address vulnerabilities in Flash Player and the Creative Cloud Desktop Application. Exploitation of some of these vulnerabilities may allow a remote attacker to take control of an affected system.

US-CERT encourages users and administrators to review Adobe Security Bulletins APSB16-32 and APSB16-34 and apply the necessary updates.

This product is provided subject to this Notification and this Privacy & Use policy.

Original release date: October 11, 2016

October is National Cyber Security Awareness Month, an annual campaign to raise awareness about cybersecurity. In partnership with DHS, the National Cyber Security Alliance has released information on “Cyber from the Break Room to the Board Room” describing how users can protect their businesses and other organizations from cyber threats. Recommendations include avoiding phishing emails, making passwords more complex, and reporting all suspicious activity.

Users and administrators are encouraged to review the Federal Trade Commission publication Start With Security: A Guide for Business and the US-CERT Tip Avoiding Social Engineering and Phishing Attacks for additional information.

This product is provided subject to this Notification and this Privacy & Use policy.

Original release date: October 11, 2016

US-CERT warns users to remain vigilant for malicious cyber activity seeking to capitalize on interest in Hurricane Matthew. Users are advised to exercise caution in handling any email with subject line, attachments, or hyperlinks related to Hurricane Matthew, even if it appears to originate from a trusted source. Fraudulent emails will often contain links or attachments that direct users to phishing or malware-infected websites. Emails requesting donations from deceptive charitable organizations commonly appear after major natural disasters.

US-CERT encourages users and administrators to use caution when encountering these types of email messages and take the following preventative measures to protect themselves from phishing scams and malware campaigns:

• Do not follow unsolicited web links in email messages.
• Use caution when opening email attachments. Refer to the Security Tip Using Caution with Email Attachments for more information on safely handling email attachments.
• Keep antivirus and other computer software up-to-date.
• Refer to the Security Tip Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
• Review the Federal Trade Commission information on Charity Scams.
• Verify the legitimacy of any email solicitation by contacting the organization directly through a trusted contact number. You can find trusted contact information for many charities on the BBB National Charity Report Index.

This product is provided subject to this Notification and this Privacy & Use policy.

Original release date: October 10, 2016

The US-CERT Cyber Security Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. The NVD is sponsored by the Department of Homeland Security (DHS) National Cybersecurity and Communications Integration Center (NCCIC) / United States Computer Emergency Readiness Team (US-CERT). For modified or updated entries, please visit the NVD, which contains historical vulnerability information.

The vulnerabilities are based on the CVE vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores:

• High – Vulnerabilities will be labeled High severity if they have a CVSS base score of 7.0 – 10.0

• Medium – Vulnerabilities will be labeled Medium severity if they have a CVSS base score of 4.0 – 6.9

• Low – Vulnerabilities will be labeled Low severity if they have a CVSS base score of 0.0 – 3.9

Entries may include additional information provided by organizations and efforts sponsored by US-CERT. This information may include identifying information, values, definitions, and related links. Patch information is provided when available. Please note that some of the information in the bulletins is compiled from external, open source reports and is not a direct result of US-CERT analysis.

This product is provided subject to this Notification and this Privacy & Use policy.

Original release date: October 07, 2016

VMware has released security updates to address a vulnerability in Horizon View. Exploitation of this vulnerability could allow a remote attacker to obtain sensitive information.

Users and administrators are encouraged to review VMware Security Advisory VMSA-2016-0015 and apply the necessary updates.

This product is provided subject to this Notification and this Privacy & Use policy.

Original release date: October 05, 2016

Cisco has released security updates to address vulnerabilities in multiple products. A remote attacker could exploit some of these vulnerabilities to take control of an affected system.
 
US-CERT encourages users and administrators to review the following Cisco Security Advisories and apply the necessary updates:

• Cisco NX-OS Software-Based Products Authentication, Authorization, and Accounting Bypass Vulnerability [cisco-sa-20161005-nxaaa]
• Cisco Nexus 7000 and 7700 Series Switches Overlay Transport Virtualization Buffer Overflow Vulnerability [cisco-sa-20161005-otv]
• Cisco NX-OS Border Gateway Protocol Denial of Service Vulnerability [cisco-sa-20161005-bgp]
• Cisco NX-OS Software Crafted DHCPv4 Packet Denial of Service Vulnerability [cisco-sa-20161005-dhcp1]
• Cisco NX-OS Software Malformed DHCPv4 Packet Denial of Service Vulnerability [cisco-sa-20161005-dhcp2]

This product is provided subject to this Notification and this Privacy & Use policy.

Original release date: October 05, 2016

October is National Cyber Security Awareness Month, which is an annual campaign to raise awareness about cybersecurity. In partnership with DHS, the National Cyber Security Alliance (NCSA) has released the first in a series of tips focused on helping people protect their online activities and increasing cybersecurity awareness. This tip describes how users can protect their online accounts using strong authentication techniques, including the use of biometrics or a security key.

Users and administrators are encouraged to review the Stop.Think.Connect. tip Lock Down Your Login and the US-CERT Security Tip Choosing and Protecting Passwords for additional information.

This product is provided subject to this Notification and this Privacy & Use policy.

Original release date: October 03, 2016

The US-CERT Cyber Security Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. The NVD is sponsored by the Department of Homeland Security (DHS) National Cybersecurity and Communications Integration Center (NCCIC) / United States Computer Emergency Readiness Team (US-CERT). For modified or updated entries, please visit the NVD, which contains historical vulnerability information.

The vulnerabilities are based on the CVE vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores:

• High – Vulnerabilities will be labeled High severity if they have a CVSS base score of 7.0 – 10.0

• Medium – Vulnerabilities will be labeled Medium severity if they have a CVSS base score of 4.0 – 6.9

• Low – Vulnerabilities will be labeled Low severity if they have a CVSS base score of 0.0 – 3.9

Entries may include additional information provided by organizations and efforts sponsored by US-CERT. This information may include identifying information, values, definitions, and related links. Patch information is provided when available. Please note that some of the information in the bulletins is compiled from external, open source reports and is not a direct result of US-CERT analysis.

This product is provided subject to this Notification and this Privacy & Use policy.