Lenovo Accelerator Application Insecure Update Mechanism

Don't believe the rumor, this does not apply to ThinkPad or ThinkStation laptops.

Source: https://support.lenovo.com/us/en/product_security/len_6718

A vulnerability was identified in the Lenovo Accelerator Application software which could lead to exploitation by an attacker with man-in-the-middle capabilities. The vulnerability resides within the update mechanism where a Lenovo server is queried to identify if application updates are available.
The Lenovo Accelerator Application is used to speed up the launch of Lenovo applications and was installed in some notebook and desktop systems preloaded with the Windows 10 operating system.




Lenovo Security Advisory: LEN-6718



Potential Impact: Remote code execution by an attacker with local network access


Severity: High


Scope of Impact: Lenovo products described below


Mitigation Strategy for Customers (what you should do to protect yourself):
Lenovo recommends customers uninstall Lenovo Accelerator Application by going to the “Apps and Features” application in Windows 10, selecting Lenovo Accelerator Application and clicking on “Uninstall”.


Product Impact:
The Lenovo Accelerator Application was installed on some consumer notebook and desktop systems preloaded with the Windows 10 operating system.

Mitratech - Lawtrac Video

Mitratech - Lawtrac Whiteboard Video

MySQL Users - Update Your Servers Now

Source: Oracle


Oracle kind-a 'hid' the fact that some major security vulnerabilities were found in their MySQL product by listing the effected versions way at the bottom of their Critical Patch Advisory for April 2016.

From Oracle:

Description

A Critical Patch Update (CPU) is a collection of patches for multiple security vulnerabilities. Critical Patch Update patches are usually cumulative, but each advisory describes only the security fixes added since the previous Critical Patch Update advisory. Thus, prior Critical Patch Update advisories should be reviewed for information regarding earlier published security fixes. Please refer to:

Critical Patch Updates and Security Alerts for information about Oracle Security Advisories.

Oracle continues to periodically receive reports of attempts to maliciously exploit vulnerabilities for which Oracle has already released fixes. In some instances, it has been reported that attackers have been successful because targeted customers had failed to apply available Oracle patches. Oracle therefore strongly recommends that customers remain on actively-supported versions and apply Critical Patch Update fixes without delay.

This Critical Patch Update contains 136 new security fixes across the product families listed below. Please note that a blog entry summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at https://blogs.oracle.com/security.

Please note that on March 23, 2016, Oracle released Security Alert for Java SE for CVE-2016-0636. Customers of affected Oracle product(s) are strongly advised to apply the fixes that were announced for CVE-2016-0636.

Please also note that the vulnerabilities in this Critical Patch Update are scored using versions 3.0 and 2.0 of Common Vulnerability Scoring Standard (CVSS). Future Critical Patch Updates and Security Alerts will be scored using CVSS version 3.0 only.

This Critical Patch Update advisory is also available in an XML format that conforms to the Common Vulnerability Reporting Format (CVRF) version 1.1. More information about Oracle's use of CVRF is available here.

Urgent - Uninstall Quick Time

REF: US-CERT

Apple Ends Support for QuickTime for Windows; New Vulnerabilities Announced

   

Systems Affected

Microsoft Windows with Apple QuickTime installed

Overview

According to Trend Micro, Apple will no longer be providing security updates for QuickTime for Windows, leaving this software vulnerable to exploitation. [1] (link is external)

Description

All software products have a lifecycle. Apple will no longer be providing security updates for QuickTime for Windows. [1] (link is external)
The Zero Day Initiative has issued advisories for two vulnerabilities found in QuickTime for Windows. [2] (link is external) [3] (link is external)

Impact

Computer systems running unsupported software are exposed to elevated cybersecurity dangers, such as increased risks of malicious attacks or electronic data loss. Exploitation of QuickTime for Windows vulnerabilities could allow remote attackers to take control of affected systems.

Solution

Computers running QuickTime for Windows will continue to work after support ends. However, using unsupported software may increase the risks from viruses and other security threats. Potential negative consequences include loss of confidentiality, integrity, or availability of data, as well as damage to system resources or business assets. The only mitigation available is to uninstall QuickTime for Windows. Users can find instructions for uninstalling QuickTime for Windows on the Apple Uninstall QuickTime (link is external) page. [4]

References

• [1] Trend Micro - Urgent Call to Action: Uninstall QuickTime for Windows Today (link is external)
• [2] Zero Day Initiative Advisory ZDI 16-241: (0Day) Apple QuickTime moov Atom Heap Corruption Remote Code Execution Vulnerabilit (link is external)
• [3] Zero Day Initiative Advisory ZDI 16-242: (0Day) Apple QuickTime Atom Processing Heap Corruption Remote Code Execution Vulner (link is external)
• [4] Apple - Uninstall QuickTime 7 for Windows

Old Mill Pens Intro

FTC Alert: Tech-Support Scams

Source: US-CERT

The Federal Trade Commission (FTC) has released an alert on tech-support themed telephone scams. In these schemes, fraudulent callers claim to be from legitimate technical support organizations and offer to fix computer problems that don't exist. Users should not give control of their computers to anyone who calls offering to "fix" a problem.

By: Andrew Johnson 
Division of Consumer and Business Education, FTC

There’s a new twist on tech-support scams — you know, the one where crooks try to get access to your computer or sensitive information by offering to “fix” a computer problem that doesn’t actually exist. Lately, we’ve heard reports that people are getting calls from someone claiming to be from the Global Privacy Enforcement Network. Their claim? That your email account has been hacked and is sending fraudulent messages. They say they’ll have to take legal action against you, unless you let them fix the problem right away.

If you raise questions, the scammers turn up the pressure – but they’ve also given out phone numbers of actual Federal Trade Commission staff (who have been surprised to get calls). The scammers also have sent people to the actual website for the Global Privacy Enforcement Network. (It’s a real thing: it’s an organization that helps governments work together on cross-border privacy cooperation.)

Here are few things to remember if you get any kind of tech-support call, no matter who they say they are:

• Don’t give control of your computer to anyone who calls you offering to “fix” your computer.
• Never give out or confirm your financial or sensitive information to anyone who contacts you.
• Getting pressure to act immediately? That’s a sure sign of a scam. Hang up.
• If you have concerns, contact your security software company directly. Use contact information you know is right, not what the caller gives you.