Date: 11 June 2009
Click here for printable version
AusCERT sends out two forms of bulletin - AusCERT Security Bulletins (or 'ASB's) and External
Security Bulletins (or 'ESB's). Previously, there were four types of bulletin - External Security
Bulletins (ESB), AusCERT Advisories (AA), AusCERT Alerts (AL) and AusCERT Updates (AU). The new
two-type system allows a simpler differentiation between bulletin types - ASB's are written in-house,
referencing information available that may not have a current coherent source, while ESB's are
bulletins written by other vendors that we have summarised and re-released.
Both ASBs and ESBs contain 'header information' that quickly summarise the contents and
allow readers to determine important information at a glance.
Document Titles and Subject Lines
Bulletin titles (which is also used as the subject line of mailouts) are formatted to indicate
basic information in as short a format as possible. The titles include the AusCERT bulletin ID (for
instance ASB-2009.0001 or ESB-2009.0123), revision number if applicable (eg. ESB-2009.0123.2) and an 'ALERT' flag if the
contents of the bulletin are time critical or reference an actively exploited vulnerability.
Titles also include a list of 'environment' tags that list operating systems or hardware types the
vulnerability affects. Unless the vulnerability is very specific this will usually only contain operating
system families such as Windows ([Win]) and Linux ([Linux]). The rest of the title is either the
product or publisher along with the most severe impact of the vulnerability. In the case of a bulletin
regarding multiple vulnerabilities this will be replaced with 'Multiple Vulnerabilities'.
For instance, previously what might have been sent out with a subject line of:
(AUSCERT AL-2009.0000) [Win] Critical vulnerabilities in ImportantProgram may result in data loss
would now have a subject line like:
ESB-2009.0000 - ALERT [Win] ImportantProgram: Delete arbitrary files - Remote/unauthenticated
ESB-2009.0000 - ALERT [Win] ImportantProgram: Multiple vulnerabilities
Since more information is now included in the bulletin title the header will only include the
bulletin ID, date and a short descriptive sentence. In the case of ESBs, this is often the subject of
the original bulletin.
The bulletin summary is an index of the important information in the bulletin. Both ESBs and
ASBs contain a summary, although some fields may only be found in one type. A description of each
field is below.
The product field gives the names and version numbers of products affected by the bulletin.
The product may be an operating system, in which case no Operating System field will be given. Both
ESBs and ASBs will have a Product field.
Only present in an ESB, the Publisher field gives the name of the original source of the bulletin.
Often this is an operating system vendor (like Microsoft or Red Hat), but it may be another security
team or research group.
This field gives a list of operating systems or operating system families that are affected by the
vulnerability. The operating systems themselves are not affected by the vulnerability, but the program
that is affected will run on those operating systems.
A rarely used field, platform will specify particular architectures (eg i386, SPARC) that are
affected by this vulnerability in a similar fashion to the Operating System field. In order to be brief, the
Platform field will only be used if the architectures affected is a subset of the architectures that the
operating systems affected run on.
Impact and Access
Previously separate as two fields, the Impact and Access matrix list the impacts of the
vulnerabilities along with the associated access required to exploit them.
There are several predefined values for the Impact. The values and their meanings are below.
- Root Compromise
- The root account in a Unix or Linux based system can be accessed. This is a serious issue and
may result in an attacker taking complete control of the affected machine.
- Administrator Compromise
- An administrator account (for instance within Windows or within an administration application)
can be accessed. This is a serious issue and may result in an attacker taking over the affected
machine. Note that in Windows this may also be a compromise of the SYSTEM account.
- Execute Arbitrary Code/Commands
- An attacker can execute commands beyond what is usually possible. This can include machine
- Increased Privileges
- An attacker can increase their privilege level on the affected system. This may allow them to
gain normal user access to a machine they should have no access to, or allow them to access
the data or privileges of another user on the system.
- Access Privileged Data
- An attacker can read (and possibly write) data on the system that would otherwise be
protected by a security measure. The attacker may not be able to perform any other action or gain
the use of the priveleges they would otherwise require to view this content.
- Modify Permissions
- An attacker can add or remove permissions from an object. This may allow them to deny access
to a valid user, or allow them to access something they would otherwise be blocked from.
- Modify Arbitrary Files
- An attacker can read, write or delete arbitrary files. The files they can access may be limited.
- Overwrite Arbitrary Files
- An attacker can replace the contents of arbitrary files. This may lead to a denial of service if
important system files are replaced, or allow further access.
- Create Arbitrary Files
- An attacker can create files that they would otherwise not be allowed to. This may be leveraged
to perform other attacks or gain access.
- Delete Arbitrary Files
- An attacker can delete files. This may allow a denial of service, or weaken existing defenses and
allow further attacks.
- Cross-site Scripting
- A specific form of code execution, cross-site scripting may allow an attacker to inject their own
HTML into an affected site's code. This is not restricted to public facing websites - an attacker may be
able to insert code that is activated when an administrator examines logs or uses some other
- Denial of Service
- An attacker can block access to resources from legitimate users. This may include causing
a program to crash or freeze and not recover, causing an entire system to crash or simply using
up all of the resource (for instance network bandwidth).
- Website Defacement
- A specific form of Modify Arbitrary Files, this impact allows an attacker to change a website. The
change may not be obvious - an attacker might use such a vulnerability to spread malware to visitors
of the affected site.
- Provide Misleading Information
- An attacker may be able to force a program or protocol to produce incorrect information. This
may be to hide an attacker's activity or trick a user into performing an unsafe action.
- Read-only Data Access
- An attacker may be able to read data they would otherwise not have access to. This may
include files, segments of memory or network traffic.
- Access Confidential Data
- An attacker may be able to access data that would otherwise be hidden or inaccessible.
This differs from Access Privileged Data in that the data may not be directly protected by access
restrictions, but is still important. For instance, if a vulnerability allowed access to credit card details
before those details were protected or deleted that would be Access Confidential Data.
- Unauthorised Access
- An attacker is able to access data in a way that is otherwise disallowed. This is a more generic
version of other access-based impacts.
- Reduced Security
- A catch-all impact - the security level of the systems involved is weakened. This is used when
an exact impact is unknown, or if the impact doesn't match any of the others.
There are several possible values for the access required to exploit a vulnerability. Generally the
less access required the worse the vulnerability.
- The only access required is that a connection can be made to the affected system.
- Remote with User Interaction
- The attacker requires no access themselves, but they need to trick a legitimate user into
initiating the exploit (for instance by visiting a website or opening a file).
- Existing Account
- The attacker must have an existing user account on the system and must authenticate
to exploit the vulnerability.
- The attacker must have direct physical access to the system. This is usually related to a
vulnerability in a screen saver or other physical locking system.
- No access information is currently known.
The Resolution field gives a quick indication on how to protect against the vulnerability. The
possible values are:
- No resolution is currently available.
- A patch or new, unaffected version of the product is available. Note that only official vendor patches are acceptable as a patch - third
party patches would be considered a mitigation.
- There are mitigation steps available that may be used, however there is no specific fix to the
- Alternate Program
- Another program with similar functionality is available that is not vulnerable.
This field lists any CVE identifiers that relate to this vulnerability. CVE's are an excellent way of
tracking vulnerabilities that affect multiple products.
This fields lists other AusCERT bulletin ID's that are related to this vulnerability. These ID's
should also appear as links at the top of the page so that related bulletins can be navigated to
Only available in ESB's, this field lists URLs of the original bulletin source. Often the original
bulletin will have further links and information that might be of use.
If new information becomes available regarding a bulletin we have already released we will
update information on our website and may resend the bulletin if the information is important.
Previously only the most recent version of the bulletin was available on our website, however now
previous versions will be available as attachments to the current version. Updates will have a
version number appended to the bulletin ID. For instance, the second version of ESB-2009.0000
is ESB-2009.0000.2. After an update is done the original version will be renamed to
If a new version is considered to contain important information, the bulletin will be resent with
an extra tag of 'UPDATE' in the subject line. For bulletins that were already tagged with 'ALERT', this
will become 'UPDATED ALERT'.
An example bulletin under the new system is below.
AUSCERT External Security Bulletin Redistribution
A critical vulnerability in ImportantProgram may allow code execution
16 April 2009
AusCERT Security Bulletin Summary
Operating System: Windows
Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Denial of Service -- Remote/Unauthenticated
Patches Available: Yes
CVE Names: CVE-2009-0000
--------------------------BEGIN INCLUDED TEXT--------------------
This is an example bulletin.
Normally the details of the vulnerability and how to fix it would be here.
--------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to firstname.lastname@example.org
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your
site policies and procedures. AusCERT takes no responsibility for
which may arise from following or acting on information or advice contained
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
If you believe that your computer system has been compromised or attacked in
any way, we encourage you to let us know by completing the secure National
Incident Reporting Form at:
Australian Computer Emergency Response Team
The University of Queensland
Internet Email: email@example.com
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.