CERT-FR established; PDF and Java hardening guidance
Free public brief. The indicators, the detections with Splunk and KQL already written, and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
French government CERT-FR replaces CERTA; advisory covers PDF exploitation risks with 153 Adobe Reader CVEs and Java 7 Update 51 security policy changes.
The French government announced the renaming of CERTA to CERT-FR on 21 January 2014, establishing the official Computer Emergency Response Team for France. The bulletin addresses two significant security topics affecting defenders.
The first major topic covers PDF format risks. PDFs are heavily exploited due to their ubiquity (99% of endpoints have a PDF reader) and the complex attack surface offered by Adobe Reader's functionality including AcroForm handling, JavaScript execution, embedded file support, and Flash rendering. The article cites 153 Adobe Reader vulnerabilities over three years and provides two specific examples: CVE-2013-0640 (affecting Reader 9.x, 10.x, 11.x through heap spray attacks on AcroForm objects, actively exploited in targeted campaigns) and CVE-2012-0754 (affecting Reader 10.x, 11.x on Android through malformed MP4 video objects, documented in targeted attacks). CERT-FR recommends disabling non-PDF attachment opening, JavaScript, and enabling enhanced protection mode with logging.
The second topic is Java SE 7 Update 51 released 14 January 2014, which raises the default security policy to "high" level. This mandates that applets be signed by recognized certificate authorities and requires a MANIFEST.MF file with Permissions and Codebase attributes; unsigned or self-signed applets will be blocked. Legacy applets lacking proper manifests may break and require updates before deployment.
Mentioned in this report
Source reporting: https://www.cert.ssi.gouv.fr/actualite/CERTFR-2014-ACT-004
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections with the Splunk SPL and Microsoft KQL already written, the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 9,789 reports from 155 sources, 1,534 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs