Monthly Archives: May 2016

Apple Releases Xcode Security Update

In early May Apple made available a security update for their Xcode development tool bringing it to version 7.3.1. This updates resolves 1 critical severity issue assigned to 2 CVEs (defined).

This heap based (the concept of a heap is defined here) buffer overflow (defined) issue was addressed by updating Xcode’s built in Git (a convenient version control system used for software development) to version 2.7.4. This issue was caused by the mishandling of filenames. Further technical details are available here.

As always, full details of all of these updates are provided on Apple’s Security Updates page. Further release notes are available here.

If you make use of Apple Xcode, please install the appropriate update as soon as possible. For advice on how to install Apple updates, please see the resources available on the “Protecting Your PC” page of this page (in this context PC is being used in the general sense of a personal computer and does not in this case refer to a computer using a Microsoft operating system).

Thank you.

Google Releases Security Update for Chrome (May 2016)

Today Google released an update for Google Chrome bringing it to version 50.0.2661.102. This updated version resolves 5 security issues assigned to 5x CVE numbers (defined). The severity levels of these issues are detailed below:

  • 3x high severity
  • 2x medium severity

Google Chrome updates automatically and will apply the update the next time Chrome is closed and then re-opened. Chrome can also be updated immediately by clicking the Options button (it looks like 3 stacked small horizontal lines, sometimes called a “hamburger” button) in the upper right corner of the window and choosing “About Google Chrome” from the menu. Follow the prompt to Re-launch Chrome for the update to take effect.

As always full details of the update were made available by Google in a blog post. If you use Google Chrome as your web browser, please consider updating it as soon as possible. Thank you.

May 2016 Security Updates Summary

Earlier today Microsoft and Adobe made their scheduled monthly security updates available.

Microsoft’s updates consist of 17 security bulletins one of which relates to an upcoming Adobe Flash Player update (more details below). These bulletins resolve 36 vulnerabilities more formally known as CVEs (defined).

One point to note that should make deploying these updates easier is that Microsoft’s Security Bulletin Summary doesn’t list any Known Issues at this time. However please double check the IT Pro Patch Tuesday blog to ensure that there are no issues being experienced before you begin installing the new updates.

====================
Update: 25th June 2016:
Microsoft’s Security Bulletin Summary was updated to include known issues with the Microsoft .Net Framework update. Workarounds and resolutions to these issues are available here.
====================

As mentioned above one of Microsoft’s bulletins relates to Adobe’s Flash Player update; however, that update will be made available later this week (scheduled for May 12th according to Adobe). This update will resolve a zero day (defined) vulnerability that is currently being exploited.

In addition, Microsoft made available a security advisory yesterday applicable to Windows 8.1 (and later)(and equivalent Windows Server OSes) for the FalseStart facility of TLS. Please review the advisory and install the applicable update for your systems.

It wasn’t just Flash Player being updated by Adobe today; updates for Adobe Acrobat DC, Acrobat XI, Acrobat Reader DC and Adobe Reader XI address 92 CVEs within those products. These vulnerabilities have been classified as critical but have been assigned Priority 2 by Adobe, meaning that these updates should be installed sometime within the next 30 days. Further details of these updates are available in this security bulletin. An update for Adobe ColdFusion was also made available resolving 3 high severity CVEs.

====================
Update: 11th May 2016:
Microsoft have released their Adobe Flash Player (for Windows 8.1 and later) security bulletin earlier than anticipated. It addresses 24 critical CVEs. Please re-run a check for updates on your Windows PC and install any necessary updates for Flash Player. Further information is available in the relevant security bulletin.

Thank you.
====================

====================
Update: 12th May 2016:
As scheduled Adobe have released an updated version of Flash Player v21.0.0.242 as well as Adobe AIR (its application runtime). It addresses 25 CVEs (the extra CVE is the zero-day vulnerability that Adobe has now resolved). It’s unclear when Microsoft will re-release their update to address this remaining CVE or if the existing update already includes it. However, Google Chrome’s update earlier this week already includes Flash Player v21.0.0.242.

Further information about the Flash Player update is available in this Sophos blog post. Separately, I will continue to update this post as more information becomes available. Thank you.
====================

====================
Update: 15th May 2016:
As expected Microsoft revised their security bulletin for Adobe Flash to include the update that Adobe made available last Thursday. Their update now addresses 25 CVEs rather than the previous 24 CVEs.

Please ensure that you install this update as soon as possible. Thank you.
====================

If you use any of Adobe’s PDF applications mentioned above or Adobe ColdFusion, please follow the above product links to the appropriate security bulletins and apply the necessary updates. This is especially important for the Adobe Reader update since it resolves a very large number of critical severity vulnerabilities among them use-after-free vulnerabilities (defined), heap (defined) overflows and an integer overflow (defined).

As mentioned in January; Adobe no longer supports Acrobat X and Adobe Reader X. They did not receive any updates within that bulletin and will no longer do so. Please upgrade to Adobe Acrobat DC/Acrobat Reader DC or Acrobat XI/Adobe Reader according to your preference.

You can monitor the availability of security updates for the majority of your software from the following websites (among others) or use Secunia PSI:

—————
US Computer Emergency Readiness Team (CERT) (please see the “Information on Security Updates” heading of the “Protecting Your PC” page):

https://www.us-cert.gov/

A further useful source of update related information is the Calendar of Updates. News/announcements of updates in the categories of General Software, Security Software and Utilities are available on their website. The news/announcements are very timely and (almost always) contain useful direct download links as well as the changes/improvements made by those updates (where possible).

If you like and use it, please also consider supporting that entirely volunteer run website by making a donation.

—————
If you use any of the above software, please install the appropriate updates as soon as possible. Steps for installing updates for Windows are provided on the “Protecting Your PC” page.

To assist with making the best use of your time when deploying these updates, I will prioritise the updates for you below:

Please make the Microsoft Internet Explorer update your first priority since CVE-2016-0189 (which it resolves) is currently under attack in the wild (namely being exploited on computing devices used by the general public in their professional and personal lives)). Follow this with Microsoft Edge, Microsoft Office, Microsoft Graphics Component, Windows Shell, Windows Kernel-Mode Drivers (defined), JScript and VBScript, Windows Journal and Windows IIS due to their severities and prevalent use.

Another security pre-caution that you may wish to take if you have Microsoft EMET (please ensure your version of EMET is the most recent version 5.5) installed is to use it to protect you from Adobe Flash being used to exploit vulnerabilities when you open a Microsoft Office document or Adobe PDF file. I provide recommendations of how to do this at the end of the July 2015 Update Summary.

As always as a routine precaution I would recommend backing up the data on any device for which you are installing updates in order to prevent data loss in the rare event that any update causes unexpected issues.

Thank you.

=======================
Aside:
=======================
I wanted to apologise for the lack of recent blog posts being published. The PC that I primarily use to write and publish the content for this blog has suffered a hard disk failure. While I have not lost any data (which is a relief!); the system is non-operational until a suitable replacement can be obtained and installed.

That may be sometime in the next 2 weeks. In the meantime, I will continue to publish using an alternate personal system of mine. This may sound like a perfect substitute, but for a number of reasons I have been finding it far from ideal. But not to worry.

However, posts will be sporadic and will not be as timely as I would like. Some interesting high impact vulnerabilities have been disclosed since my most recent blog post (in April) as well as a large number of security updates. I will endeavour to discuss all of these with you as soon as possible.

Thank you for your understanding and patience as I resolve this issue.

VideoLAN Releases VLC Version 2.2.3

Last week the well-known open source media player VLC created by the VideoLAN non-profit organization was updated to version 2.2.3.

This update is available for Linux, Apple Mac OS X and Windows. It addresses at least 3 security issues (more details are not readily available) mentioned here (3rd party library security issues), here (stack overflow (defined) and here (RealRTSP module). This update is available for download for the above operating systems from this page.

If you use VLC, please update as soon as possible to benefit from the security fixes version 2.2.3 includes as well as the more than 30 general software bugs that were also addressed.

Thank you.