Google Chrome 5.0.375.86 Released

Google has released an update to Chrome which enables the intergrated Flash Player by default. It is difficult sometimes for users and administrators to balance security and Flash content. First up, make sure that you review and your Flash Player Settings. In Chrome you can open the Flash Settings Manager by selecting Clear Browser Data. 

Issuess adressed include the following:

1. [38105] Medium XSS via application/json response (regression). Credit to Ben Davis for original discovery and Emanuele Gentili for regression discovery.
2. [43322] Medium Memory error in video handling. Credit to Mark Dowd under contract to Google Chrome Security Team.
3. [43967] High Subresource displayed in omnibox loading. Credit to Michal Zalewski of Google Security Team.
4. [45267] High Memory error in video handling. Credit to Google Chrome Security Team (Cris Neckar).
5. [$500] [46126] High Stale pointer in x509-user-cert response. Credit to Rodrigo Marcos of SECFORCE.

Users then should consider reading the following post releated to Flash settings. 

Another way to manage the risk related to Flash content is to install the Chrome extension Flash Block, available here.

This is a short description from the download/installer page.

Short Description:
=============
The extension automatically blocks flash content on webpages.
Each flash element is being replaced with a placeholder that allows you to load only selected elements on a given page.
You can also manage a whitelist of allowed websites via a configuration panel.

In general, FlashBlock helps with lowering memory usage, reducing cpu cycles,
and can be used as an alternative to AdBlock. 

Security Advisory for Adobe Reader and Acrobat: APSB10-15

Adobe has released a security advisory related to upcoming release of Acrobat Reader 9.3.2  and Acrobat 9.3.2  to address various vulnerabilities including CVE-2010-1297 (AuthPlayLib.bundle related vulnerability). The update is scheduled for release on June 29,2010 which is accelerated release date due to the critical nature of the exploit. 

It has been reported that Acrobat Reader is being exploited in the wild using several vulnerabilities including CVE-2010-1297 (AuthPlayLib.bundle related vulnerability). As always users should use Preview.app, in a sandbox to view any content from the Web or an untrusted source. This update is tagged as CRITICAL

Update on Tuesday, June 29, 2010 at 07:05PM by drStrangeP0rk

Adobe has released an update for Acrobat Reader and Acrobat to address these issues.  Visit http://blogs.adobe.com/adobereader/2010/06/adobe_reader_and_acrobat_933_a.html for more information. Users should select Check for updates in Acrobat and Reader.

Update on Wednesday, July 7, 2010 at 08:18AM by drStrangeP0rk

There will be another update to apply to Acrobat and Reader. The update did fully address issues related to .exe files and autorun. Since these are Windows executable this does not affect MacOS. Visit the Reader Security blog for more information.

Firefox 3.6.4 Released

Firefox 3.6.4 has been released which addresses serveral security issues. Users should install this update by installing selecting Software Update under the Help Menu. 

MFSA 2010-33 User tracking across sites using Math.random()
MFSA 2010-32 Content-Disposition: attachment ignored if Content-Type: multipart also present
MFSA 2010-31 focus() behavior can be used to inject or steal keystrokes
MFSA 2010-30 Integer Overflow in XSLT Node Sorting
MFSA 2010-29 Heap buffer overflow in nsGenericDOMDataNode::SetTextInternal
MFSA 2010-28 Freed object reuse across plugin instances
MFSA 2010-26 Crashes with evidence of memory corruption (rv:1.9.2.4/ 1.9.1.10)

Opera 10.54 Update Released

Opera has released an update to the Opera Browser but has provided little detail about what security fixes have been included. It does appear that several recent CVE have been addressed but Opera has posted that it will provide details at a latter time. User should select check for update in Opera and install the update.

APPLE-SA-2010-06-21-1 iOS 4

Apple has released an update for iOS4 and fixes for WebKit vulnerabilities. Uses and administrators should read the important information below from Apple.

 Installation note:

These updates are only available through iTunes, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from www.apple.com/itunes/ iTunes will automatically check Apple's update server on its weekly schedule. When an update is detected, it will download it. When the iPhone or iPod touch is docked, iTunes will present the user with the option to install the update. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iPhone or iPod touch. The automatic update process may take up to a week depending on the day that iTunes checks for updates. You may manually obtain the update via the Check for Updates button within iTunes. After doing this, the update can be applied when your iPhone or iPod touch is docked to your computer. To check that the iPhone or iPod touch has been updated:

* Navigate to Settings

* Select General

* Select About. The version after applying this update will be

"4.0 (8A293)" or later.

Update on Monday, June 21, 2010 at 09:12PM by drStrangeP0rk

Seems like Apple listed CVE-2010-1761 which should have been addressed in the update for Safari and iTunes. Users should have this update already if they updated iTunes and Safari.