Hello, welcome to the Tuesday, September 12, 2017 edition of the Sands Internet Storm Center's

Stormcast. My name is Johannes Ulrich, and I'm recording from Las Vegas, Nevada.

Now, one of the fallouts, of course, of last week's Java struts vulnerability announcements

is that there are a lot of other vendors

that include Java struts too as part of their products.

So we are seeing some of these advisories now trickling out.

Most notably last Friday, Cisco released a pretty extensive advisory with a list of all

their products that are using Java struts. Of course, Cisco makes much more than switches

and routers. There are a lot of web apps, like for example, the Cisco WebEx meetings server that would be a part of it a lot of their voice and unified communication devices do include web applications that are relying on Java struts so take a look at this advisory if you're using any of these Cisco products in order to make sure that you are

patching these products. And I've talked in the past about anti-malware applications

that are intercepting TLS. That's often a necessary evil because you do want anti-malware to be able to inspect application traffic

that is TLS encrypted. Typically, this shouldn't really, if properly done, cause any problems

because it is done on the host itself. I'm not talking about proxy servers and the like, but essentially little

local host proxies that these anti-malware applications intercept. Now, the emphasis here is it should

not cause any problems, but often it does. If, for example, certificates aren't properly created, if TLS is downcreated then you may actually

no longer be able to connect with your web browser to certain sites. Google Chrome now went a step

further in order to better inform the user about such applications.

If a connection fails because of an application installed on the host itself that does intercept TLS,

then future versions of Chrome will attempt to identify the particular application

to make it easier for the user to, for example, disable

or maybe even patch that application. The latest beta version of Chrome has this feature installed.

You have to enable it. It's not enabled by default. It will likely show up in version 63 of Chrome, which is scheduled to appear in December.

...