Shellshock exploit targeting email gateways (ESAs)

Could you please review the attack vector described in the below article:
https://www.binarydefense.com/bds/active-shellshock-smtp-botnet-campaign/
An active botnet is targeting email gateways by adding scripts in email fields like to, from, body etc.
A vulnerable gateway will execute these scripts and download malware and make the gateway part of another botnet.
Can you please let us know if our ESAs are good enough on these attacks?

Cisco has issued an official PSIRT notice for the GNU Bash Environmental Variable Command Injection Vulnerability (CVE-2014-6271), please refer all inquiries to:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140926-bash
Please refer to the expanded "Affected Products" for details on our products.
Products Confirmed Not Vulnerable
The following Cisco products have been analyzed and are not affected by this vulnerability:
Cisco IOS
Cisco IronPort ESA/SMA
Cisco Private Internet eXchange (PIX)
Cisco Sourcefire Defense Center and Sensor products
Complete information about reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco is available on Cisco.com at:
http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html
This web page includes instructions for press inquiries regarding Cisco Security Advisories. All Cisco Security Advisories are available at:
http://www.cisco.com/go/psirt

Similar Messages

3rd Party email gateway

Does anyone know of any 3rd party email gateway that can connect GroupWise to Exchange?

Mike,
It appears that in the past few days you have not received a response to your posting. That concerns us, and has triggered this automated reply.
Has your problem been resolved? If not, you might try one of the following options:
- Do a search of our knowledgebase at http://support.novell.com/search/kb_index.jsp
- Check all of the other support tools and options available at http://support.novell.com in both the "free product support" and "paid product support" drop down boxes.
- You could also try posting your message again. Make sure it is posted in the correct newsgroup. (http://support.novell.com/forums)
If this is a reply to a duplicate posting, please ignore and accept our apologies and rest assured we will issue a stern reprimand to our posting bot.
Good luck!
Your Novell Product Support Forums Team
http://support.novell.com/forums/

Email gateway rejected job

I have a printer that had to be reset as we lost the admin password. We are now trying to configure the Digital Sending--> Send email part. When I try and send a scan from the printer it comes up with a Message" Email gateway rejected the job because of the addressing information.
The printer is a Laserjet 4345 on a simple peer to peer network. I tested the SMTP settings and they passed the test (used the test button).

If the same email send settings were working earlier, the email send settings may be correct, might not need any changes.
To reset the admin password, you may need to contact your regional HP support, as this may result in resetting other product data/settings.
Please mark the post that solves your problem as Accepted Solution
Click the 'Kudos Thumbs Up' if this was helpful. Thank You!
(Although I am an HP employee, I am speaking for myself and not for HP)

Two target email addresses for completed form?

I’ve created a fillable PDF form for a client in Acrobat 9 pro, (I also tried it in Livecycle without much success). The original form was produced in ID CS4.
The form is to be completed by customers and emailed to the client, but to get the target email correct I had to edit MY identity in Acrobat to embed the clients email for auto return. This seemed to work OK.
But what I’ve been unable to solve is how to get the completed response to automatically go to 2 different email addresses - i.e. the remote sales rep and head office.
Is this possible and if so, how?
TIA Alastair

Yes - that's the one I'm using. I created the form in Indy, exported to PDF, added the fields and submit and print buttons in acro and haven't yet distributed it, so the purple submit button isn't visible yet. No response right clicking the submit button, left click produces the choice of desktop or internet mail. I can find no relevant tool under the forms tab (or any other) in Acro. It might be I'm getting short sighted and/or stupid in my old age, but if you could point me in the right direction I'll be eternally grateful . . .
Thanks for your patience (with someone who learned how to set metal type on a stick in 1970)
A

Microsoft Exchange Server 2003 and McAfee Email Gateway appliance

I have been connecting to my company's exchange server without incident until the IT department installed a McAfee Email Gateway. Now I cannot connect and the IT department tells me there is nothing they can do. Has anyone encountered this issue?

If server has enabled ActiveSync you can use Windows 8 Mail Client - works almost like Outlook.
AFAIR Outlook 2013 can't work with Exchange 2003.
Regards, Konrad Sagala, MCT, MCSE+M, MCITP: Exchange 2007/2010, Lync 2010, Office365, Windows 2008, Virtualization

Email becomes unreadible after going through Cisco email gateway

Hi all,
I have an issue with one sender who is trying to email password protected attachments to other staff in our organization.
The issue seems to only occur when the email goes through our C370, if he sends to an externally hosted email account the email and attachment can be opened, and when that email is then sent as an attachment back into our organization it is also openable, which seems to rule out our clients.
Sanitized header from the C370 below is part of the message header which I think might contain the problem, I have removed the first part with to & from as I didn't know if it was relevant..
Subject: Daily Subject
Thread-Topic: Subject
thread-index: Ac+JToaXaax6VYP2Qlaj21mbCsrr5w==
Date: Mon, 16 Jun 2014 10:36:28 +0000
Message-ID: <Message ID>
Accept-Language: en-GB, en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
X-Originating-IP: [192.168.30.71]
Content-Type: multipart/mixed;
        boundary="_005_B078E7CA8779484CB2961CF42F9F12481EE3C285RALXMBX01WHITSL_"
MIME-Version: 1.0
Return-Path: <[email protected]>
X-OriginalArrivalTime: 16 Jun 2014 10:36:31.0542 (UTC) FILETIME=[D6741560:01CF894E]
This is a multi-part message in MIME format.
--_005_B078E7CA8779484CB2961CF42F9F12481EE3C285RALXMBX01WHITSL_
Content-Type: multipart/alternative;
        boundary="_000_B078E7CA8779484CB2961CF42F9F12481EE3C285RALXMBX01WHITSL_"
--_000_B078E7CA8779484CB2961CF42F9F12481EE3C285RALXMBX01WHITSL_
Content-Type: text/plain;
        charset="utf-8"
Content-Transfer-Encoding: base64
UGxlYXNlIHNlZSBhdGFjaGVkDQoNClJlZ2FyZHMNCg0KQWtlZW0gTGluc2V5DQoNCkFrZWVtIExp
bnNleQ0KV0hBQ1QgQ2FwYWNpdHkgVGVhbSBBZG1pbmlzdHJhdG9yDQpBY29uYnVyeSBFYXN0DQpX
b3JjZXN0ZXIgUm95YWwgSG9zcGl0YWwNClRlbDogMDE5MDUgNzYwMDY3DQpFbWFpbDogYWtlZW0u
bGluc2V5QGhhY3cubmhzLnVrPG1haWx0bzpha2VlbS5saW5zZXlAaGFjdy5uaHMudWs+DQoNClRo
ZSBpbmZvcm1hdGlvbiBjb250YWluZWQgaW4gdGhpcyBlbWFpbCBtYXkgYmUgc3ViamVjdCB0byBw
This string continues for 10's of lines
--_000_B078E7CA8779484CB2961CF42F9F12481EE3C285RALXMBX01WHITSL_
Content-Type: text/html;
        charset="utf-8"
Content-Transfer-Encoding: base64
PGh0bWw+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIgY29udGVudD0i
dGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxzdHlsZT4NCjwhLS0NCkBmb250LWZhY2UNCgl7
Zm9udC1mYW1pbHk6Q2FsaWJyaX0NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29O
b3JtYWwNCgl7bWFyZ2luOjBjbTsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXpl
OjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsInNhbnMtc2VyaWYifQ0KYTpsaW5rLCBz
cGFuLk1zb0h5cGVybGluaw0KCXtjb2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxp
bmV9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7Y29sb3I6cHVycGxl
This string continues for 10's of lines
--_000_B078E7CA8779484CB2961CF42F9F12481EE3C285RALXMBX01WHITSL_--
--_005_B078E7CA8779484CB2961CF42F9F12481EE3C285RALXMBX01WHITSL_
Content-Type: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet;
        name="16.06.14 test data.xlsx"
Content-Description: 16.06.14 test data.xlsx
Content-Disposition: attachment;
        size=21504;
        creation-date=Mon, 16 Jun 2014 10:35:56 GMT;
        modification-date=Mon, 16 Jun 2014 10:34:01 GMT;
        filename="16.06.14 test data.xlsx"
Content-Transfer-Encoding: base64
0M8R4KGxGuEAAAAAAAAAAAAAAAAAAAAAPgADAP7/CQAGAAAAAAAAAAAAAAADAAAAAQAAAAAAAAAA
EAAAAgAAAAEAAAD+////AAAAAAAAAAAHAAAACAAAAP//////////////////////////////////
YhaetsvzHMi3ipkrNJSzrFVRN7+bX4l0BumhMZTII2xrE6oeB8hEqY8k2VbXv8U3HBd8J9RGVWDJ
SqZakOR/sQpgHLGkP6PAdRCn1DnGilooj9RrP4T0NjAipUVFMh82LbWeSHkYeF2odZvS9FDy4hCP
jz0oU3IWExxK67VOvELynIIGDs4OywbgzO1/umDQ5rzKg134XJcOCjZogzLN0aRirTBioH9/1JCq
CDi7xvoEUpPFjuNQt0xfVUV8fqr3fCzrKhhIAh7fo4FYVKHzS2lZkCXP+qLINNsBWDkb2WexmN6U
UrwbjQBNCKLKf2n46v1C
This string continues for 100's of lines
--_005_B078E7CA8779484CB2961CF42F9F12481EE3C285RALXMBX01WHITSL_
Content-Type: application/vnd.openxmlformats-officedocument.wordprocessingml.document;
        name="16.06.14 test document.docx"
Content-Description: 16.06.14 test document.docx
Content-Disposition: attachment;
        size=32566;
        creation-date=Mon, 16 Jun 2014 10:36:01 GMT;
        modification-date=Mon, 16 Jun 2014 10:33:24 GMT;
        filename="16.06.14 test document.docx"
Content-Transfer-Encoding: base64
UEsDBBQABgAIAAAAIQDwIex9jgEAABMGAAATAAgCW0NvbnRlbnRfVHlwZXNdLnhtbCCiBAIooAAC
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC0
lE1PwkAQhu8m/odmr6Zd8GCMoXBQPCqJGM/Ldgobux/ZWb7+vdMWGjRAUfDSpN193/fZ2c70Bitd
RAvwqKxJWTfpsAiMtJky05S9j5/jexZhECYThTWQsjUgG/Svr3rjtQOMSG0wZbMQ3APnKGegBSbW
gaGV3HotAr36KXdCfoop8NtO545LawKYEIfSg/V7T5CLeRGi4Yo+1yQeCmTRY72xzEqZcK5QUgQi
5QuT/UiJNwkJKas9OFMObwiD8b0J5crhgI3ulUrjVQbRSPjwIjRh8KX1Gc+snGs6Q3LcZg+nzXMl
This string continues for 100's of lines
--_005_B078E7CA8779484CB2961CF42F9F12481EE3C285RALXMBX01WHITSL_--
Below is the header when a copy is sent to Hotmail:
x-store-info: J++/JTCzmObr++wNraA4Pa4f5Xd6uensydyekesGC2M=
Authentication-Results: domain.com; spf=none (sender IP is IP Address) [email protected]; dkim=none header.d=domain.uk; x-hmca=none [email protected]
X-SID-PRA: [email protected]
X-AUTH-Result: NONE
X-SID-Result: NONE
X-Message-Status: n:n
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTE7YT0xO0Q9MTtHRD0xO1NDTD0w
X-Message-Info: NhFq/7gR1vQRHV6jbdvQfj78RRbHIsgK1hLH/9kB6NkUdTKzM/S60sw6uhmZk31ye2Ut7SsNRG194mNbBlVxpVFTOFvWOorYIP5ew8iIWHabwOUS2au4siXFpV/hL6TnYc2aLcBqOdiwZaz+fO5BeYoeCs9RYcubk1Jzn4Ff1TWTeX5PBOwirh+7vaICe5u9/LltrbQ5ODA+UL1EVPECVAszVGdCkiJ5
Received: from relayserver.uk ([62.208.144.128]) by SNT004-MC3F25.hotmail.com
over TLS secured channel with Microsoft SMTPSVC(7.5.7601.22678); Tue, 17 Jun
2014 02:22:01 -0700
Received: from blah.net (blah.net
[IP Address]) by IMSVA80 (Postfix) with ESMTP id D712D448A3A for
<[email protected]>; Tue, 17 Jun 2014 10:21:59 +0100 (BST)
Received: from Blah.local (smtp.server [IP Address]) by
blah.net (Postfix) with ESMTP id 5F6B6448F33 for
<[email protected]>; Tue, 17 Jun 2014 10:21:57 +0100 (BST)
X-PMWin-Version: 3.0.2.0
X-MimeOLE: Produced By Microsoft MimeOLE V16.4.3528.331
Received: from blah.local ([192.168.46.221]) by
Blah.blah.local with Microsoft SMTPSVC(IP address); Tue, 17 Jun 2014
10:21:36 +0100
Received: from Server name ([fe80:::::822d]) by
Exchange server name ([192.168.46.221]) with mapi id 14.02.0342.003;
Tue, 17 Jun 2014 10:21:36 +0100
From: "Surname, Firstname" <[email protected]>
To: <[email protected]>
Subject: Subject
Thread-Topic: Subject
thread-index: Ac+JToaXaax6VYP2Qlaj21mbCsrr5wAvrAhgAAASClA=
Date: Tue, 17 Jun 2014 09:21:35 +0000
OLD-MSG-ID: <Old Message ID>
Accept-Language: en-GB, en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
X-Originating-IP: [192.168.30.85]
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0002_01CF8FA3.87849CD0"
MIME-Version: 1.0
X-OriginalArrivalTime: 17 Jun 2014 09:21:36.0838 (UTC) FILETIME=[89D06E60:01CF8A0D]
Message-ID: <Message ID>
X-TM-AS-Product-Ver: IMSVA-8.0.0.1495-7.5.0.1017-20762.006
X-TM-AS-Result: No--42.282-60-31-10
X-imss-scan-details: No--42.282-60-31-10;No--42.282-3-31-10;No--42.282-4-31-10
X-TMASE-MatchedRID: JcGkxUY+Fi9XTuUjTP3HupObxJgN/hOxOhJ9m53n4aDIGC/aFIx4/sEhNzkwL19YZrHSGmcb0tPNR6N8PNUm3hQ3/xoDO/IlaK+MsTwM+1nP60q/FX5hsL40mI6UpXzvoYk2ByBT6IRl+EcAbF0M2///m9pcIDdz1kpuPUtox1KS2fL5IypDsYEcpMn6x9cZ67hywNgiYt0GLHHeUCuj17PllCNDDbY+2BJ2fZa5f2xqeX9tIrexd/jQkA7rdCuFfMhjt3b5PP1K0WT/zXAgkpjaylIY/e3Y9hU4NdzeECk8LuP+bOkMWt3jF2fVcPdzDB+ErBr0bANar2Wff4KSIaUXswX/xrISOe5BYzkyOSWATHNX4n1dGGZBslDPcF5vyAzYZQWW+9rbH8WaUL9qjLTxnpbCjruIowtRP8whCK8PmNN74zkTtDMO4HIvV/eCHcN4x+ltYL371rCnW2Nmh+V1K1TQIEH5D+WFNKXSJkRkYpwdTJ43fZUdXE/WGn0FVmA9rBozNAcLEpo317bQY8H9mYPMZJ+SW8KeTXPQ6zqOhzOa6g8KrXacDQD1LjGG8gyxx3MD7IZOuMJDRGZYWM2dM+bCCs0tT+iWcZL4Ksw=
X-Hotmail-VirusCheck: Clean
Return-Path: <[email protected]>
The sender has advised they are using Outlook 2010.
Thanks in advance for any help working out why the email cant be read when coming in through our C370 gateway & sorry if posted in wrong community
Katie

Hi,
Could you please try to put another DNS server on the ESA? Like ISP's DNS or a public one.
Luis Silva

C170 management gateway vs email gateway?

We plan to set up a new C170 (single appliance for entire domain) with email on port 2 and management on port 1.
I noticed that the setup wizard only allows you to enter a single gateway, but management traffic and email traffic are not in the same IP range.
I don't see how the web administration and quarantine interface will be remotely accessible with this setup.
How do you set up different gateways for each port or is there a different workaround?

I opened a TAC case about this issue and the representative advised us to NAT the email port's IP address so they both could use the same gateway. When this was done, the ESA interface would not allow us to use both data ports with addresses on the same subnet. So, now we have both management and email on the same data data port and the other data port is unused.
This setup allowed us to save this configuration, but I don't think this makes sense because it seems odd to use the same physical data port to access management and quarantine as the email is flowing through. I didn't think of this while I was on the phone with TAC so I didn't ask at the time, but now I have second thoughts about this design.
I'm not sure if the volume of traffic going through would be an issue that would affect quarantine page and remote management access or not, but if this data port fails either on the device or the switch it's plugged into, both email and remote management access will go down at the same time while we have another data port sitting unused.
Did TAC give the wrong solution?

Populate submit button target email with field?

Hi, this may have already been asked. Is it possible to populate a submit button email target using the contents of another field / text box?
Say I have emailfield1 and submitbutton1. Is it possible to have submitbutton1 target = emailfield1? I'd like a way of generating a reply to whichever email address is keyed in emailfield1.
Thanks

Acrobat can't send its own emails so it has to call an email client.
Unfortunately this is quite flaky and doesn't always work. It seems to work most well with Outlook but I've found it can depend on the operating system - on my Win7 64bit system it doesn't work. And I could never get it to work with Thunderbird.
Also, it doesn't work if someone is using web-based email.

Corporate email - gateway for ISA Server or PPTP or equivalent needed.

My IT guy told me that our companys VPN uses ISA Server and/or PPTP for the gateway. I haven't been able to set up my corporate email because none of the gateways on my 8520 seem to work. All I do on my PC is provide an IP address, domainname, user and password and I'm in. How can I configure this on my Curve 8520? Is there a "generic" gateway available to download?
TIA

Thanks, now I understand why the wifi keeps dropping. On my personal wireless network, it also seems the distance from the access point is not good compared to my laptop. At work our network & exchange teams don't seem to have the desire to struggle with this "toy" until customers start forcing its adoption. I am using OWA and it works fine over EDGE. I will share your posting with them.
Thank you again.
Dell Windows XP Pro

Edge Transport Role as Email Gateway

Hi Experts,
We are planing to deploy exchange email server (Exchange Server-2013 Multi-Role servers) in our HQ (contoso.com) and 4 Edge Transport in other 4 client development sites(client1.com, clinet2.com, client3.com and Client4.com) so that applications running
in HQ can send emails to respective client development sites domain using edge transport. Development sites are using external email address (mail.clinet1.com and so on). There is no requirement of incoming mail on Edge in Client site because they have compete
hosted email solution. Just our Edge transport in client will process the mail received from HQ and will forward to Client's External email address.
I would appreciate if you can help me to get answer for these queries.
Do you think this conceptual design is possible? Exchange solution in HQ and Edge transport in Client site and that Edge will forward emails to External Domain using send connector for restive client's domain?
What secure (Only secure) port we need to open on Edge so that It can talk to External Email servers to deliver emails?
If we don't want to expose our Multi-Role exchange severs in HQ to Internet , do you think Exchange server in HQ should be capable for incoming emails using one additional EDGE or still need to expose CAS services in HQ. We need Outlook, OWA and
Active Sync as well for HQ (contoso.com).
What secure port we need to open in case of CAS server?

Hi Lynx
Thank you for your question.
I think you have a CAS and mailbox in your site. In order to receive HQ’s email, you can create accept domain, you can refer to the following link:
http://technet.microsoft.com/en-us/library/bb124423(v=exchg.150).aspx
in your HQ, I suggest you can separate multi-role servers into two parts, you can do NLB and DAG, because NLB cannot co-existed with DAG. I also suggest you have an edge server in your HQ.
If client site want to talk to external email, you need to register domain name in your ISP, for example mail.domain.com,autodiscovery.domain.com……
Secure ports were opened that is determined the connect way of your outlook; the more details you can refer to the following link:
http://blogs.technet.com/b/exchange/archive/2013/02/18/exchange-firewalls-and-support-oh-my.aspx
If there are any questions, please let me know.
Best Regard,
Jim

Email gateway FOOBAR again ?

Anyone else come back to a bunch of these from the weekend ?
From:
Postmaster <[email protected]>
To:
me
Date:
Sunday 07:15:55
This is a delivery failure notification message indicating that
an email you addressed to email address :
-- [email protected]
could not be delivered. The problem appears to be :
-- Recipient server unavailable or busy
Additional information follows :
-- All hosts are unavailable
This condition occurred after 30 attempt(s) to deliver over
a period of 93.00 hour(s).
If you sent the email to multiple recipients, you will receive one
of these messages for each one which failed delivery, otherwise
they have been sent.

Received: from ukexbhman01.uk.hllp.local ([10.40.0.159]) by UKEXMBMANV01.uk.hllp.local with Microsoft SMTPSVC(6.0.3790.3959);
     Wed, 26 Aug 2009 02:19:12 +0100
Received: from service48.mimecast.com ([212.2.3.170]) by ukexbhman01.uk.hllp.local with Microsoft SMTPSVC(6.0.3790.3959);
     Wed, 26 Aug 2009 02:19:11 +0100
Received: from mail.sgaur.hosted.jivesoftware.com (mail.sgaur.hosted.jivesoftware.com [209.46.39.252])
    by service48.mimecast.com;
    Wed, 26 Aug 2009 02:19:10 +0100
Received: from sgaurwa41p (unknown [10.137.24.42])
    by mail.sgaur.hosted.jivesoftware.com (Postfix) with ESMTP id 612902408830
    for <[email protected]>; Tue, 25 Aug 2009 19:18:57 -0600 (MDT)
Date: Tue, 25 Aug 2009 19:18:57 -0600
From: viatropos <[email protected]>
Reply-To: [email protected]
To: tom chiverton <[email protected]>
Message-ID: <1054632094.1289841251249537397.JavaMail.jive@sgaurwa41p>
Subject: [Developers] Re: Degrafa vs. FXG (and Spark) [Bindable]
MIME-Version: 1.0
X-MC-Unique: 109082602191001502
Content-Type: multipart/mixed;
boundary="----=_Part_131847_1676143209.1251249537046"
Content-Disposition: inline
Return-Path: [email protected]
X-OriginalArrivalTime: 26 Aug 2009 01:19:11.0605 (UTC) FILETIME=[37BB6250:01CA25EB]
X-Length: 5069
Status: R
X-Status: NC
X-KMail-EncryptionState:
X-KMail-SignatureState:
X-KMail-MDN-Sent:
X-UID: 6115
------=_Part_131847_1676143209.1251249537046
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

Monitoring End to End Mailflow through Microsoft Cloud based Email Gateway.

Can anyone recommend how this is can be done?
Thanks in advance.

Hi,
According to your description , I suppose you are using office 365.
I recommend you ask this in
Office 365 forum and
you may get effective solution timely.
Best regards,
Niko
Niko Cheng
TechNet Community Support

Warning: Zero Day exploit in the wild targeting Adobe Reader 9.4.6

Adobe has just released details of a Zero Day exploit targeting Reader version 9.4.6, details here: http://blogs.adobe.com/asset/2011/12/background-on-cve-2011-2462.html
An independent site called H Security also has some background info on the subject which, to a lesser degree, also affects 10.1.1: http://www.h-online.com/security/news/item/New-Adobe-Reader-zero-day-in-the-wild-1391441.h tml

So here we are now sitting pretty with Reader updated to 9.4.7
However, once again, this update has FAILED to address the issue with the Firefox plugin which remains as 9.4.5.236
So anybody who unwittingly updates Reader to 9.4.7 but doesn't notice that the Firefox plugin remains as 9.4.5.236 is going to have a nasty surprise if they happen to land on a malware infested site!
The only workaround here is to disable the plugin in the Firefox Add-ons manager which you can access by hitting CTRL+SHIFT+A. Go to the Plugins menu and click the "Disable" button to the right on the Reader installation. This means you will be unable to read PDF files in the Firefox browser and will instead be presented with the option to download them to your own machine. If however you choose to open them with the disabled plugin, it will once again remain enabled until you manually disable it again, so be careful.

Unpatched Java Vulnerability Exploited In Targeted Attacks, Aug. 2012-Jan.2013

A Java vulnerability that has yet to be patched is being actively exploited by cybercriminals.
August 27, 2012, 12:41 PM — Attackers are exploiting a new and unpatched vulnerability that affects the latest version of Java -- Java 7 Update 6 -- in order to infect computers with malware, according to researchers from security vendor FireEye.
So far, the vulnerability has been exploited in limited targeted attacks, FireEye's senior staff scientist Atif Mushtaq said Sunday in a blog post. "Most of the recent Java run-time environments i.e., JRE 1.7x are vulnerable."
Article continued:
http://www.itworld.com/security/291781/unpatched-java-vulnerability-exploited-targeted-attacks-resea...
ThinkPad: T530 / X1 Gen 2 / Helix - Yoga: Tablet 2 Pro (Win) / Yoga 3 Pro
If you find a post helpful and it answers your question, please click the "Accept As Solution" button.
Lenovo Advocate ~ I am not employed by Lenovo or Microsoft. I am a volunteer.
Microsoft MVP - Consumer Security
SpywareHammer

Fortunately, my new ThinkPad did not have Java installed on it when it arrived (kudos to Lenovo!).
For the rest of you, this info comes via Brian Krebs:
Is your Java exploitable? Go here and find out: http://www.isjavaexploitable.com/
If yes, go here to disable it: http://krebsonsecurity.com/how-to-unplug-java-from-the-browser/
ThinkPad: T530 / X1 Gen 2 / Helix - Yoga: Tablet 2 Pro (Win) / Yoga 3 Pro
If you find a post helpful and it answers your question, please click the "Accept As Solution" button.
Lenovo Advocate ~ I am not employed by Lenovo or Microsoft. I am a volunteer.
Microsoft MVP - Consumer Security
SpywareHammer

Cisco Iron port ESA licensing

Hi Team,
We are using 20,000 mailbox/user Antispam/Antivirus license for cisco ironport email security appliance. Customer want to know the impact on email scanning if they rduced their user count to 10,000.
will this affect the volume of traffic being scanned and processed by the appliance concurrently or not ?
As we are not configuring mailboxes on the ironport devices ,how come the ironport device calculate usercount/mailbox ?
does the user count means simultanious connection per second?
please help me to find a solution
Regards
Muhammad

Ironport ESA and WSA licensing is trust-based: you should purchase the amount of licenes that reflects the amount of users behind an Ironport device (email gateway or web proxy), but the actual users aren't counted.
Sent from Cisco Technical Support iPad App

Shellshock exploit targeting email gateways (ESAs)

Similar Messages

Maybe you are looking for