US-CERT Advises of Critical PDF Vulnerability

This is a technical observation that system administrators would find of particular interest…. if you’re a sysadmin, or, have a system administrator for your small business, they should be aware of this information at the earliest opportunity.

On Wednesday October 24, 2007, US-CERT (the US Computer Emergency Readiness Team) issued a technical advisory for Windows XP, Windows Server 2003, and IE 7.0.

US-CERT advises that a vulnerability has been discovered whereas a *.PDF can be engineered to exploit the vulnerability and execute arbitrary commands on the target machine.

The exploit can be mitigated by upgrading to the latest versions of Adobe Acrobat and Viewer, as outlined in Adobe’s Security Bulletin of Oct 22, 2007.

US-CERT reports known incidents of compromise from engineered *.PDF’s being circulated in email and downloaded as seemingly legimiate content from the web.

It’s recommended that the Adobe products be upgraded at the earliest opportunity.

R

Microsoft Office 2003 SP 3 Released

Microsoft released SP 3 for Office 2003 on September 18; SP 3 has been published to auto-updates from Microsoft and users should begin seeing notifications for update beginning this week. Still have Office 2003? Here’s a run-down on the major benefits:

1. Office Interoperability. SP 3 improves 2003’s interaction with Office 2007 documents and interplay with Windows Vista.

2. Security Tools. MOICE (Microsoft Office Isolated Conversion Environment) is introduced in this service pack as well as File Block; these are features found in Office 2007 that have been retrofitted to 2003. MOICE introduces more security when opening previous versions of Microsoft Office documents and reduce malware threats; File Block allows system administrators to control file conversions for Office through Group Policies.

3. Security Roll-Up. A mass of security patches have been rolled up into this version.

If you use Office 2003 on Windows Vista, or interact frequently with Office 2007 documents, this update is for you. If you’re conscious about security or manage a business network, installation of SP 3 should be a no-brainer.

A couple of ways to install this service pack. The first would be to use Microsoft Update. The second would be to directly download the update. If you’re running Windows Vista, walk through its system update process. More information about the service pack can be found online.

R

GAP Breach Exposes PPI of 800,000