[CERT-daily] Tageszusammenfassung - 07.02.2019

Daily end-of-shift report team at cert.at
Thu Feb 7 18:32:55 CET 2019 

=====================
= End-of-Day report =
=====================

Timeframe:   Mittwoch 06-02-2019 18:00 − Donnerstag 07-02-2019 18:00
Handler:     Dimitri Robl
Co-Handler:  Stephan Richter

=====================
=       News        =
=====================

∗∗∗ Researcher reveals huge Mac password flaw to protest Apple bug bounty ∗∗∗
---------------------------------------------
Apples operating systems have recently had more than their fair share of serious security issues, and the latest problem will be enough to rattle millions of Mac users. Previously credible researcher Linuz Henze has revealed an exploit that in one button press can reveal the passwords in a Mac’s keychain.
---------------------------------------------
https://venturebeat.com/2019/02/06/researcher-reveals-huge-mac-password-flaw-to-protest-apple-bug-bounty/


∗∗∗ Weiterer Workaround von Microsoft für verwundbare Exchange-Server ∗∗∗
---------------------------------------------
Bis ein Patch für Microsoft Exchange verfügbar ist, soll ein Notbehelf die Ausnutzung der in allen Versionen bestehenden Sicherheitslücke verhindern.
---------------------------------------------
http://heise.de/-4300374


∗∗∗ Gefälschte autoscout24.at-SMS stiehlt Daten ∗∗∗
---------------------------------------------
Kriminelle senden eine gefälschte autoscout24.at-SMS an Nutzer/innen der Plattform. Darin behaupten sie fälschlicherweise, dass Inserent/innen ihr Verkaufsangebot zweimal mit unterschiedlichen Preisen veröffentlicht haben. Aus diesem Grund sollen sie ihre Angaben auf einer fremden Website überprüfen. Das führt zu einem Datendiebstahl durch die Verbrecher/innen.
---------------------------------------------
https://www.watchlist-internet.at/news/gefaelschte-autoscout24at-sms-stiehlt-daten/


∗∗∗ Identitätsdiebstahl durch Umfrage auf prophylactus.com ∗∗∗
---------------------------------------------
prophylactus.com gibt vor, ein Marktforschungsinstitut zu sein. Konsument/innen sollen sich registrieren, um von zu Hause aus bis zu 50 Euro pro Stunde verdienen zu können. Achtung: Internetnutzer/innen dürfen sich nicht anmelden und an keinen Umfragen teilnehmen. Es handelt sich um versuchten Identitätsdiebstahl, der schwere Folgen für Betroffene haben kann.
---------------------------------------------
https://www.watchlist-internet.at/news/identitaetsdiebstahl-durch-umfrage-auf-prophylactuscom/


∗∗∗ Bitcoin-Erpressungsmail mit Nacktbildern ∗∗∗
---------------------------------------------
Aktuell häufen sich betrügerische E-Mails von einem "anonymen Hacker". Der Sender hat angeblich intimes Videomaterial von Ihnen, das er an Freund/innen, Bekannte und Familie weiterleitet, sollte kein Schweigegeld in Form von Bitcoins überweisen werden. Im Anhang finden Sie veröffentlichte Nacktbilder von bisherigen Opfern, die der Forderung nicht nachgekommen sind. Ignorieren Sie E-Mails dieser Art! Das besagte Video existiert nicht.
---------------------------------------------
https://www.watchlist-internet.at/news/bitcoin-erpressungsmail-mit-nacktbildern/


∗∗∗ Hacker group uses Google Translate to hide phishing sites ∗∗∗
---------------------------------------------
New phishing technique looks silly on desktops but may have a fighting chance on mobile devices.
---------------------------------------------
https://www.zdnet.com/article/hacker-group-uses-google-translate-to-hide-phishing-sites/#ftag=RSSbaffb68



=====================
=  Vulnerabilities  =
=====================

∗∗∗ Security updates for Thursday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (curl, golang, libthrift-java, mumble, netmask, python3.4, and rssh), openSUSE (python-python-gnupg), Oracle (kernel), Scientific Linux (thunderbird), Slackware (curl), SUSE (firefox, python, and rmt-server), and Ubuntu (curl, libarchive, and libreoffice).
---------------------------------------------
https://lwn.net/Articles/779192/


∗∗∗ BlackBerry powered by Android Security Bulletin – February 2019 ∗∗∗
---------------------------------------------
http://support.blackberry.com/kb/articleDetail?language=en_US&articleNumber=000055019


∗∗∗ HPESBUX03908 rev.1 - HP-UX Web Server Suite running Apache on HP-UX 11iv3, Multiple Remote Vulnerabilities. ∗∗∗
---------------------------------------------
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us


∗∗∗ HPESBUX03909 rev.1 - HP-UX Web Server Suite running Apache on HP-UX 11iv3, Multiple Remote Vulnerabilities ∗∗∗
---------------------------------------------
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us


∗∗∗ IBM Security Bulletin: IBM i2 Enterprise Insight Analysis. CVE-2018-12539 ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/ibm-security-bulletin-ibm-i2-enterprise-insight-analysis-cve-2018-12539/


∗∗∗ IBM Security Bulletin: Apache Tomcat as used in IBM QRadar SIEM is vulnerable to security constraint bypass. (CVE-2018-1304, CVE-2018-1305) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/ibm-security-bulletin-apache-tomcat-as-used-in-ibm-qradar-siem-is-vulnerable-to-security-constraint-bypass-cve-2018-1304-cve-2018-1305/


∗∗∗ IBM Security Bulletin: MaaS360 has identified a vulnerability in the MaaS360 iOS Application. (CVE-2018-1960) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/ibm-security-bulletin-maas360-has-identified-a-vulnerability-in-the-maas360-ios-application-cve-2018-1960/


∗∗∗ IBM Security Bulletin: OpenJPA as used in IBM QRadar SIEM is vulnerable to remote code execution. (CVE-2013-1768) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/ibm-security-bulletin-openjpa-as-used-in-ibm-qradar-siem-is-vulnerable-to-remote-code-execution-cve-2013-1768/


∗∗∗ IBM Security Bulletin: IBM OpenPages GRC Platform is affected by a vulnerability in Apache Commons FileUpload (CVE-2016-1000031) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/ibm-security-bulletin-ibm-openpages-grc-platform-is-affected-by-a-vulnerability-in-apache-commons-fileupload-cve-2016-1000031/


∗∗∗ IBM Security Bulletin: IBM QRadar SIEM uses outdated hash algorithms. (CVE-2017-1695) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/ibm-security-bulletin-ibm-qradar-siem-uses-outdated-hash-algorithms-cve-2017-1695/


∗∗∗ IBM Security Bulletin: BigFix Platform 9.5.x affected by vulnerability CVE-2017-1231 ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/ibm-security-bulletin-bigfix-platform-9-5-x-affected-by-vulnerability-cve-2017-1231/


∗∗∗ IBM Security Bulletin: BigFix Compliance (TEMA SUAv1 SCA SCM) affected by multiple vulnerabilities ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/ibm-security-bulletin-bigfix-compliance-tema-suav1-sca-scm-affected-by-multiple-vulnerabilities/


∗∗∗ Java SE vulnerability CVE-2018-3139 ∗∗∗
---------------------------------------------
https://support.f5.com/csp/article/K65481741


∗∗∗ Java SE vulnerability CVE-2018-3136 ∗∗∗
---------------------------------------------
https://support.f5.com/csp/article/K16940442


∗∗∗ Java SE vulnerability CVE-2018-3211 ∗∗∗
---------------------------------------------
https://support.f5.com/csp/article/K04224795


∗∗∗ Java SE vulnerability CVE-2018-3214 ∗∗∗
---------------------------------------------
https://support.f5.com/csp/article/K86075480


∗∗∗ TLS in Mozilla NSS vulnerability CVE-2018-12404 ∗∗∗
---------------------------------------------
https://support.f5.com/csp/article/K10281096


∗∗∗ Java SE vulnerabilities CVE-2018-3149, CVE-2018-3169, and CVE-2018-3209 ∗∗∗
---------------------------------------------
https://support.f5.com/csp/article/K50394032


∗∗∗ Java SE vulnerability CVE-2018-3180 ∗∗∗
---------------------------------------------
https://support.f5.com/csp/article/K30503705


∗∗∗ Oracle Java SE vulnerability CVE-2018-11212 ∗∗∗
---------------------------------------------
https://support.f5.com/csp/article/K63404203


∗∗∗ BIG-IP SNMP vulnerability CVE-2018-15328 ∗∗∗
---------------------------------------------
https://support.f5.com/csp/article/K42027747

-- 
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

More information about the Daily mailing list