Tech Alert Briefing for 4/7/2003

New Report Details Efforts to Address Cyber Threats

The General Accounting Office has issued a 59 page report on the efforts of thefinancial services sector to address cyber threats.

Among other things, it details the progressmadeby the Financial Services ISAC (FS-ISAC), a private sector initiative by the banking and finance industry,composed of 61 members who maintain over 90 percent of the assets under control by the industry.

The mission of FS-ISAC is to use information sharing and analysis to provide its members with a comprehensive set of knowledge resources. Theseresources include early notification of computer vulnerabilities and attacksand access to subject-matter expertise and other relevant information,such as trending analysis for all levels of management and for firstresponders to cyber incidents.

FS-ISAC is currentlydeveloping a ?next-generation? model in which it would offer certaininformation dissemination services to the entire industry.Read the report:http://www.gao.gov/new.items/d03173.pdf

DoS Vulnerability in APACHE Servers - Upgrade Necessary

Although specific details of the denial-of-service (DoS) vulnerability will not be released until April 8th, theApache Software Foundation is recommending Apache HTTP Server users immediately upgrade to version 2.0.45.

The Apache group has chosen to provide the fix prior to the explanation of the vulnerability to eliminate the chances of successful exploitation before the upgrade is available to system administrators.

Details of the vulnerability will be forecoming in the next day or so but according to several technology sources the vulnerability is serious and system administrators will need to rapidly upgrade to the new version.

The new release (httpd.apache.org/download.cgi) addresses the undisclosed flaw in HTTP Server versions 2.0 through 2.0.44, as well as correcting a file descriptors leak that represents a threat to servers running untrusted CGI scripts.

Financial institutions running Apache should stay tuned to the upcoming release and make plans to quickly deploy the new version.

Previous Tech Alerts:
04/02/03Time to Step Up IT Security and Sendmail Vulnerability
03/18/03Windows 2000 WebDAV Buffer Overflow Exploit Against IIS 5.0 - CRITICAL
03/03/03Critical Vulnerability Discovered in Sendmail
02/06/03Microsoft Releases Cummulative Patch for Internet Explorer Flaws It Lists as Critical
01/26/03The Importance of Applying Patches
01/23/03Microsoft and SUN release slew of Patches
01/14/03New Worms Spreading through Email
12/09/02Microsoft Issues Updated Cumulative Patch for IE
11/13/02New e-greeting tactics pose serious threat
11/01/02Critical patch released for Windows 2000, Windows XP
10/21/02Microsoft Fixes Vulnerabilities: Releases Patches for SQL, Word and Excel
10/03/02Bugbear Worm Gains Strength
10/02/02Top 20 List of Internet Security Vulnerabilities Released
09/02/02Microsoft Warns SysAdmins To Immediately Patch Identity Spoofing Flaw
08/21/02Microsoft releases patch to fix "critical" vulnerability inWindows 2000 systems that allow unprivileged users to logonto them interactively
08/09/02 Is Confidential Bank Information Walking Out Your Door?
07/30/02 Microsoft Continues to Patch Flawed Software
07/23/02 CERT advisory on PHP
07/15/02 Outlook Users Employing PGP Encryption Program Vulnerable to Hacking
07/11/02 Researchers Report Serious Flaw in IE
06/27/02 Microsoft Releases Critical Patch for Windows Media Player
06/18/02 CERT Warns of Critical Vulnerabilty in Apache Web Server
06/12/02 Sports Fans Beware: World Cup Virus Bounces Around the Net
06/07/02 Dead Man Tell No Passwords
05/31/02 Microsoft Issues Critical Warning Regarding Exchange Server
05/22/02 Microsoft SQL Spida Worm Slows Network Traffic
05/15/02 Virus Hoax 'JDBGMGR.EXE' Spreading Rapidly Thoughout Net
04/25/02 Klez Worm Reels in Banks with its Bait
04/11/02 Ten New Vulnerabilities Discovered in Microsoft IIS Server
04/09/02 New Virus Hoax Circulating Around Net
03/22/02 MyLife.B Virus Makes Its Way Around the Net
03/21/02 Microsoft Updates Its Warning on Critical Windows Vulnerability
03/14/02 New Virus (W32/Fbound-C) Spreading Rapidly in the Wild
03/08/02 Unauthorized E-Mail Scam Attempts to Steer Unwitting Customers to Fraudulent Bank Web Site
03/06/02 Klez-E Worm and W32.Gibe Virus Warnings
03/01/02 CERT Issues Warning on PHP Scripting Language Flaw
02/27/02 CERT Issues Warning on Internet Explorer and Outlook Flaw
02/22/02 SNMP Patches and Detection Tools Available
02/20/02 Email Address Belonging to Legitimate Security Site Hijacked to Deliver Dangerous Yarner Worm
02/15/02 Mass Mailing Email Worm Compromises Word 2000 Security Settings
02/13/02 SNMP VULNERABILITY
02/07/02 Bloodhound Mass Mailing Worm and Managing Risks in Wireless Networks
02/04/02 Microsoft Issues Collection of Security Fixes for Windows 2000
01/31/02 Copycat Virus Unleashed
01/30/02 Netscape Browser Vulnerable to Cookie Theft
01/28/02 "My Party" Mass Mailing Worm
01/18/02 IT Contingency Planning Guide, Information Security Checklist and Solaris Vulnerability
01/15/02 Trojan.StartPage Alters Web Browsers
01/12/02 New Internet Worm Gigger Masquerades as Microsoft Outlook Upgrade
01/08/02 Microsoft Universal Plug and Play Vulnerability
12/20/01 Holiday Themed Computer Virus Unleashed