US CERT Current Activity
WordPress Releases Security and Maintenance Updates
Dec 13, 2019
Original release date: December 13, 2019WordPress 5.3 and prior versions are affected by multiple vulnerabilities. An attacker could exploit some of these vulnerabilities to take control of an affected website. The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review the WordPress Security and Maintenance Release and upgrade to WordPress 5.3.1. This product is provided subject to this Notification and this Privacy & Use policy.
Microsoft Releases December 2019 Security Updates
Dec 10, 2019
Original release date: December 10, 2019Microsoft has released updates to address multiple vulnerabilities in Microsoft software. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review Microsoft’s December 2019 Security Update Summary and Deployment Information and apply the necessary updates. This product is provided subject to this Notification and this Privacy & Use policy.
Google Releases Security Updates for Chrome
Dec 10, 2019
Original release date: December 10, 2019Google has released security updates for Chrome version 79.0.3945.79 for Windows, Mac, and Linux. This version addresses vulnerabilities that an attacker could exploit to take control of an affected system. The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review the Chrome Release and apply the necessary updates. This product is provided subject to this Notification and this Privacy & Use policy.
Apple Releases Multiple Security Updates
Dec 10, 2019
Original release date: December 10, 2019Apple has released security updates to address vulnerabilities in multiple products. An attacker could exploit some of these vulnerabilities to take control of an affected system. The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review the Apple security pages for the following products and apply the necessary updates: Xcode 11.3 watchOS 5.3.4 watchOS 6.1.1 tvOS 13.3 macOS Catalina 10.15.2, Security Update 2019-002 Mojave, and Security Update 2019-007 High Sierra Safari 13.0.4 iOS 12.4.4 iOS 13.3 and iPadOS 13.3 This product is provided subject to this Notification and this Privacy & Use policy.
Intel Releases Security Updates
Dec 10, 2019
Original release date: December 10, 2019Intel has released security updates to address vulnerabilities in multiple products. An authenticated attacker with local access could exploit some of these vulnerabilities to gain escalation of privileges. The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review the following Intel advisories and apply the necessary updates and recommended mitigations: Linux Administrative Tools for Intel Network Adapters Advisory INTEL-SA-00237 Processors Voltage Settings Modification Advisory INTEL-SA-00289 Control Center-I Advisory INTEL-SA-00299 Quartus Prime Pro Edition Advisory INTEL-SA-00311 SCS Platform Discovery Utility Advisory INTEL-SA-00312 Unexpected Page Fault in Virtualized Environment Advisory INTEL-SA-00317 NUC Firmware Advisory INTEL-SA-00323 For updates addressing low severity vulnerabilities, see the Intel technology blog. This product is provided subject to this Notification and this Privacy & Use policy.
Adobe Releases Security Updates
Dec 10, 2019
Original release date: December 10, 2019Adobe has released security updates to address vulnerabilities in multiple Adobe products. An attacker could exploit some of these vulnerabilities to take control of an affected system. The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review the following Adobe Security Bulletins and apply the necessary updates. ColdFusion APSB19-58 Brackets APSB19-57 Photoshop CC APSB19-56 Acrobat and Reader APSB19-55 This product is provided subject to this Notification and this Privacy & Use policy.
Samba Releases Security Updates
Dec 10, 2019
Original release date: December 10, 2019The Samba Team has released security updates to address vulnerabilities in multiple versions of Samba. An attacker could exploit one of these vulnerabilities to take control of an affected system. The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review the Samba Security Announcements for CVE-2019-14861 and CVE-2019-14870 and apply the necessary updates and workarounds. This product is provided subject to this Notification and this Privacy & Use policy.
VMware Releases Security Updates for ESXi and Horizon DaaS
Dec 6, 2019
Original release date: December 6, 2019VMware has released security updates to address a vulnerability in ESXi and Horizon DaaS. An attacker could exploit this vulnerability to take control of an affected system. The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review VMware Security Advisory VMSA-2019-0022 and apply the necessary updates and workarounds. This product is provided subject to this Notification and this Privacy & Use policy.
ACSC Releases Fundamentals of Cross Domain Solutions
Dec 5, 2019
Original release date: December 5, 2019The Australian Cyber Security Centre (ACSC) has released a cybersecurity guide outlining the fundamentals of cross domain solution (CDS) technologies. This guidance provides cross domain security principles to enable organizations to share information securely across separated networks. The Cybersecurity and Infrastructure Security Agency (CISA) encourages organizations with information sharing requirements to review ACSC’s Fundamentals of Cross Domain Solutions to learn how to plan, analyze, design, and implement CDS systems. This product is provided subject to this Notification and this Privacy & Use policy.
Microsoft Releases Security Advisory for Windows Hello for Business
Dec 5, 2019
Original release date: December 5, 2019Microsoft has released a Security Advisory to address an issue in Windows Hello for Business (WHfB). An attacker could exploit this issue on devices that were affected by CVE-2017-15361, also known as Return of Coppersmith’s Attack (ROCA), to take control of an affected system. The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review Microsoft Security Advisories ADV190026 and ADV170012 and apply the recommended mitigations. This product is provided subject to this Notification and this Privacy & Use policy.
NCSC-NZ Releases Cyber Governance Resource for Leaders
Dec 5, 2019
Original release date: December 5, 2019The New Zealand National Cyber Security Centre (NCSC-NZ) has released an article on a new cybersecurity governance resource to support public and private sector leaders in making decisions about their cybersecurity resilience and risk. NCSC-NZ developed this governance—a series of documents with practical advice and simple steps—following a cybersecurity resilience assessment of New Zealand’s nationally significant organizations. The Cybersecurity and Infrastructure Security Agency (CISA) encourages senior leaders and security practitioners to review NCSC-NZ’s Charting Your Course: Cyber Security Governance and Cyber Security Resilience of New Zealand’s Nationally Significant Organisations 2017-2018 for more information. This product is provided subject to this Notification and this Privacy & Use policy.
Mozilla Releases Security Updates for Firefox and Firefox ESR
Dec 4, 2019
Original release date: December 4, 2019Mozilla has released security updates to address vulnerabilities in Firefox and Firefox ESR. An attacker could exploit some of these vulnerabilities to take control of an affected system. The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review the Mozilla Security Advisories for Firefox 71 and Firefox ESR 68.3. This product is provided subject to this Notification and this Privacy & Use policy.
CISA Releases Draft of Binding Operational Directive on Developing a Vulnerability Disclosure Policy
Dec 2, 2019
Original release date: December 2, 2019The Cybersecurity and Infrastructure Security Agency (CISA) has released a draft of Binding Operational Directive (BOD) 20-01, Develop and Publish a Vulnerability Disclosure Policy. BOD 20-01 will require each federal agency to publish a vulnerability disclosure policy (VDP). CISA has posted the draft directive for public feedback. The deadline for submitting comments is 11:59 PM EST on December 27, 2019. CISA encourages users and administrators to review the CISA blog post, Improving Vulnerability Disclosure Together, and draft BOD 20-01 for more information. CISA encourages feedback on draft BOD 20-01 from individuals with personal or institutional expertise in vulnerability disclosure and from organizations that have a VDP and manage coordinated vulnerability disclosures. This product is provided subject to this Notification and this Privacy & Use policy.
Cyber Monday: Tips for Safeguarding Personal Information
Dec 2, 2019
Original release date: December 2, 2019Cyber Monday draw millions of shoppers online for deals and savings, but this day also provides opportunities for an attacker to steal personal information. The Cybersecurity and Infrastructure Security Agency (CISA) reminds users to remain vigilant when browsing or shopping online. CISA encourages Cyber Monday shoppers to review the following online shopping safety tips: Do business with reputable vendors. Before providing any information, make sure that you are interacting with a reputable, established vendor. Some attackers may try to trick you by creating malicious websites that appear to be legitimate, so you should verify the legitimacy before supplying any information. (See Avoiding Social Engineering and Phishing Attacks.) Use caution with email links and attachments. Take appropriate precautions when using email and web browsers to reduce the risk of an infection. Be wary of unsolicited email attachments and avoid clicking on email links, even if they seem to come from people or businesses you know. (See Using Caution with Email Attachments.) Pay using a credit card. There are laws to limit your liability for fraudulent credit card charges, but debit cards may not have the same level of protection. Ensure your information is encrypted. Check website URLs to ensure they begin with "https:" (instead of "http:") accompanied by a padlock icon to verify that the site is secure. This product is provided subject to this Notification and this Privacy & Use policy.
Caller Spoofs CISA’s Phone Number in Extortion Scam
Nov 29, 2019
Original release date: November 29, 2019The Cybersecurity and Infrastructure Security Agency (CISA) is aware of a phone scam where a caller pretends to be a CISA Service Desk representative. The scammer, whose spoofed call appears to be from CISA’s toll free number, claims to have knowledge of the potential victim’s questionable behavior and attempts to extort money. If you receive a threatening call from someone claiming to be a CISA representative, CISA recommends the following actions: Do not respond or try to contact the caller. Do not pay the caller. Contact your local FBI field office to file a report. This product is provided subject to this Notification and this Privacy & Use policy.
Black Friday Shopping: Protect Your Identity
Nov 27, 2019
Original release date: November 27, 2019Black Friday is one of the most lucrative shopping days of the year for retailers in brick-and-mortar shops and online, but shoppers aren't the only ones looking for deals. Malicious people may be able to obtain personal information (such as credit card numbers, phone numbers, account numbers, and addresses) by stealing your wallet, overhearing a phone conversation, rummaging through your trash (a practice known as dumpster diving), or picking up a receipt at a restaurant that has your account number on it. If a thief has enough information, he or she may be able to impersonate you to purchase items, open new accounts, or apply for loans. The Cybersecurity and Infrastructure Security Agency (CISA) encourages holiday shoppers to take the following identity theft precautions: Take advantage of security features. Passwords and other security features add layers of protection if used appropriately. (See Choosing and Protecting Passwords.) Check privacy policies. Take precautions when providing information, and make sure to check published privacy policies to see how a company will use or distribute your information. (See Protecting Your Privacy.) Check your statements. Keep a record of your purchases and copies of confirmation pages, and compare them to your bank statements. If there is a discrepancy, report it immediately. Be careful what information you publicize. Attackers may be able to piece together information from a variety of sources. Avoid posting personal data in public forums. (See Staying Safe on Social Networking Sites.) This product is provided subject to this Notification and this Privacy & Use policy.
Securing Portable Electronic Devices During Travel
Nov 22, 2019
Original release date: November 22, 2019Holiday travelers often use portable electronic devices (PEDs) because they offer a range of conveniences, for example, enabling the traveler to order gifts on-the-go, access to online banking, or download boarding passes. However, these devices are vulnerable to cyberattack or theft, resulting in exposure of personal information. With the holiday season approaching, the Cybersecurity and Infrastructure Security Agency (CISA) reminds users to be mindful of the security risks associated with traveling with PEDs. CISA encourages travelers to take the following steps to protect their personal information: Avoid using public Wi-Fi networks to conduct personal business. Open Wi-Fi networks at places such as airports present an opportunity for attackers to intercept sensitive information. Turn off Bluetooth when not in use. Cyber criminals have the capability to pair with your device's open Bluetooth connection and steal personal information. Be cautious when charging. Avoid connecting your device to any computer or charging station that you do not control, such as a charging station at an airport terminal. Remember physical security. Do not leave your device unattended in public or easily accessible areas. Check out CISA’s Tips on Holiday Traveling with Personal Internet-Enabled Devices and Cybersecurity for Electronic Devices for more information and tips. This product is provided subject to this Notification and this Privacy & Use policy.
ISC Releases Security Advisory for BIND
Nov 21, 2019
Original release date: November 21, 2019The Internet Systems Consortium (ISC) has released a security advisory that addresses a vulnerability affecting multiple versions of ISC Berkeley Internet Name Domain (BIND). A remote attacker could exploit this vulnerability to cause a denial-of-service condition. The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review the ISC advisory for more information and to apply the necessary updates and workarounds. This product is provided subject to this Notification and this Privacy & Use policy.
Microsoft Releases Outlook for Android Security Update
Nov 21, 2019
Original release date: November 21, 2019Microsoft has released an update to address a vulnerability in Outlook for Android. An attacker could exploit this vulnerability to take control of an affected system. The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review the Microsoft Security Advisory and apply the necessary update. This product is provided subject to this Notification and this Privacy & Use policy.
NSA Releases Cyber Advisory: Managing Risk from Transport Layer Security Inspection
Nov 19, 2019
Original release date: November 19, 2019The National Security Agency (NSA) has released a Cyber Advisory that addresses managing risk from Transport Layer Security Inspection (TLSI). This short, informative document defines TLSI (a security process that allows incoming traffic to be decrypted, inspected, and re-encrypted), explains some risks and associated challenges, and discusses mitigations. The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review the NSA Cyber Advisory and apply the information, as appropriate. See CISA’s Alert on risks associated with HTTPS inspection. This product is provided subject to this Notification and this Privacy & Use policy.
