Home » Security Information

Security Information

This page is dedicated to security, it includes local security information, as well as a number of syndicated security feeds, alerts, tools and news from major security portals. This page aims to provide a single security information access point, helping you stay current with recent security threats. You can check the SG Security FAQ and visit the SG Security forum with any questions you might have.

SG Security Scan

SG Security Articles

Latest Threats - Symantec

Latest Security Advisories (US-CERT)

The Apache Foundation has released security updates to address vulnerabilities in Apache Tomcat Native. A remote attacker could exploit these vulnerabilities to take control of an affected server.

NCCIC encourages users and administrators to review the Apache Advisory and Tomcat Native Downloads page and apply the necessary updates.

Cisco has released updates to address vulnerabilities affecting Cisco products. A remote attacker could exploit these vulnerabilities to cause a denial-of-servicecondition.

NCCIC encourages users and administrators to review the following Cisco Security Advisories and apply the necessary updates:

• Web Security Appliance Web Proxy Memory Exhaustion Denial-of-Service Vulnerability cisco-sa-20180815-wsa-dos
• Unified Communications Manager IM & Presence Service Denial-of-Service Vulnerability cisco-sa-20180815-ucmimps-dos
• Adaptive Security Appliance Web Services Denial-of-Service Vulnerability cisco-sa-20180606-asaftd

The Federal Bureau of Investigation (FBI) has released an article on building a digital defense against travel scams. FBI explains how scammers trick consumers with "free" vacation ploys. These offers may be fake or involve hidden fees. Legitimate companies will not ask prize winners to pay to claim their reward.

NCCIC encourages consumers to review the FBI Article, the Federal Trade Commission's Travel Tips, and NCCIC's Tip on Avoiding Social Engineering and Phishing Attacks for more information.

VMware has released security updates to address vulnerabilities in vSphere, Workstation, Fusion, and Virtual Appliances. An attacker could exploit these vulnerabilities to obtain sensitive information.

NCCIC encourages users and administrators to review VMware Security Advisories VMSA-2018-0020, VMSA-2018-0021, andVMSA-2018-0022 and apply the necessary updates.

The Samba Team has released security updates to address several vulnerabilities in Samba. An attacker could exploit one of these vulnerabilities to take control of an affected system.

NCCIC encourages users and administrators to review the Samba Security Announcements for CVE-2018-10858, CVE-2018-10918, CVE-2018-10919, CVE-2018-1139, and CVE-2018-1140 and apply the necessary updates.

Adobe has released security updates to address vulnerabilities in Adobe Acrobat and Reader, Adobe Experience Manager, Adobe Flash Player, and Adobe Creative Cloud Desktop Application. An attacker could exploit some of these vulnerabilities to take control of an affected system.

NCCIC encourages users and administrators to review Adobe Security Bulletins APSB18-20, APSB18-25, APSB18-26, and APSB18-29, and apply the necessary updates.

Microsoft has released updates to address multiple vulnerabilities in Microsoft software. A remote attacker could exploit some of these vulnerabilities to take control of an affected system.

NCCIC encourages users and administrators to review Microsofts August 2018 Security Update Summary and Deployment Information and apply the necessary updates.

Intel has released recommendations to address a side-channel vulnerability called L1 Terminal Fault (L1TF) that affects multiple Intel microprocessors. An attacker could exploit this vulnerability to obtain sensitive information.

NCCIC encourages users and administrators to review Intel's Security Advisory INTEL-SA-00161, apply the necessary mitigations, and refer to software vendors for appropriate patches, when available.

Additional resources include:

• Intel Security First
• Intel Resources and Response to Side Channel L1 Terminal Fault
• Vulnerability Note VU#982149
• NCCIC TA18-141A: Side-Channel Vulnerability Variants 3a and 4
• NCCIC TA18-004A: Meltdown and Spectre Side-Channel Vulnerability Guidance