Daily October 2013

daily@lists.cert.at

1 participants
23 discussions

Tageszusammenfassung - Donnerstag 31-10-2013
by Daily end-of-shift report 31 Oct '13

31 Oct '13

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 30-10-2013 18:00 − Donnerstag 31-10-2013 18:00 Handler: Matthias Fraidl Co-Handler: n/a *** VU#326830: NAS4Free version 9.1.0.1 contains a remote command execution vulnerability *** --------------------------------------------- NAS4Free version 9.1.0.1.804 and possibly earlier versions contain a remote code execution vulnerability. NAS4Free allows an authenticated user to post PHP code to an HTTP script and have the code executed remotely. By default, NAS4Free runs with root privileges. A remotely authenticated attacker can send an HTTP POST request that contains a malicious PHP file which can cause the script to run directly on the machine. --------------------------------------------- http://www.kb.cert.org/vuls/id/326830 *** Mozilla Fixes 10 Vulnerabilities with Firefox 25 *** --------------------------------------------- Mozilla released Firefox 25 yesterday, fixing 10 vulnerabilities, five of them critical. --------------------------------------------- http://threatpost.com/mozilla-fixes-10-vulnerabilities-with-firefox-25/1027… *** A New Wave of WIN32/CAPHAW Attacks - A ThreatLabZ Analysis *** --------------------------------------------- Introduction and setting the context Over the last month, the ThreatLabZ researchers have been actively monitoring a recent uptick in the numbers of Win32/Caphaw (henceforward known as Caphaw) infections that have been actively targeting users bank accounts since 2011. --------------------------------------------- http://research.zscaler.com/2013/09/a-new-wave-of-win32caphaw-attacks.html *** Silent Circle and Lavabit launch 'DarkMail Alliance' to thwart e-mail spying *** --------------------------------------------- Silent Circle CTO: "What we're getting rid of is SMTP." --------------------------------------------- http://arstechnica.com/business/2013/10/silent-circle-and-lavabit-launch-da… *** MS Security Intelligence Report Volume 15: January 2013 to June 2013 *** --------------------------------------------- The Microsoft Security Intelligence Report (SIR) analyzes the threat landscape of exploits, vulnerabilities, and malware using data from Internet services and over 600 million computers worldwide. Threat awareness can help you protect your organization, software, and people. --------------------------------------------- http://download.microsoft.com/download/5/0/3/50310CCE-8AF5-4FB4-83E2-03F1DA… *** Meet 'badBIOS', the mysterious Mac and PC malware that jumps airgaps *** --------------------------------------------- Like a super strain of bacteria, the rookkit plaguing Dragos Ruiu is omnipotent. --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/jeFXBU0x_Vc/story01… *** Compliance Checklist: Cloud Encryption Best Practices for Banks and Insurance Companies *** --------------------------------------------- For industries whose handling of sensitive consumer data renders them subject to strict regulations, the cloud is anything but a simple choice. Before you can commit to the cloud, you'll have to understand exactly what cloud information protection measures you must take to remain in regulatory compliance. --------------------------------------------- http://blog.ciphercloud.com/compliance-checklist-cloud-encryption-practices… *** Weekly Update: Exploiting (Kind of) Popular FOSS Apps *** --------------------------------------------- - Moodle Remote Command Execution - vTigerCRM v5.4.0/v5.3.0 Authenticated Remote Code Execution - Zabbix Authenticated Remote Command Execution - Mac OS X Persistent Payload Installer - Persistent Payload in Windows Volume Shadow Copy - and many more --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2013/10/30/weekly-up… *** Cisco IOS XE Multiple Bugs Let Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1029277 *** Moodle Remote Command Execution *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2013100211 *** D-Link Backdoor Czechr Exploit *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2013100219 *** ISPConfig Authenticated Arbitrary PHP Code Execution *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2013100215

1 0

Tageszusammenfassung - Mittwoch 30-10-2013
by Daily end-of-shift report 30 Oct '13

30 Oct '13

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 29-10-2013 18:00 − Mittwoch 30-10-2013 18:00 Handler: Matthias Fraidl Co-Handler: n/a *** Nuclear Exploit Pack Getting More Aggresive *** --------------------------------------------- Churning through our logs, we recently observed a significant rise in the number of transactions involving the Nuclear Exploit Pack, which has been in the news for quite some time now. In the past week, we stumbled upon thousands of transactions involving the Nuclear Exploit Pack infestation. --------------------------------------------- http://research.zscaler.com/2013/10/nuclear-exploit-pack-getting-more.html *** A Tour Through The Chinese Underground *** --------------------------------------------- The Chinese underground has played host to many cybercriminals over the years. In the research brief titled Beyond Online Gaming Cybercrime: Revisiting the Chinese Underground Market, we provide some details of the current state of the Chinese underground economy. Last year, we looked into this underground sector, and this brief is a continuation of those efforts. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/a-tour-through-t… *** Major Corporations Fail to Defend Against Social Engineering *** --------------------------------------------- Companies such as Apple and General Motors gave up crucial company information to social engineers during the annual Capture the Flag contest at Def Con. --------------------------------------------- http://threatpost.com/major-corporations-fail-to-defend-against-social-engi… *** iOS apps can be hijacked to show fraudulent content and intercept data *** --------------------------------------------- A large number of apps for iPhones and iPads are susceptible to hacks that cause them to surreptitiously send and receive data to and from malicious servers instead of the legitimate ones they were designed to connect to, security researchers said on Tuesday. --------------------------------------------- http://arstechnica.com/security/2013/10/ios-apps-can-be-hijacked-to-show-fr… *** New Injection Campaign Peddling Rogue Software Downloads *** --------------------------------------------- A mass injection campaign surfaced over the last two weeks that´s already compromised at least 40,000 web pages worldwide and is tricking victims into downloading rogue, unwanted software to their computer. --------------------------------------------- http://threatpost.com/new-injection-campaign-peddling-rogue-software-downlo… *** Defending Against CryptoLocker *** --------------------------------------------- CryptoLocker infections were found across different regions, including North America, Europe Middle East and the Asia Pacific. Almost two-thirds of the affected victims - 64% - were from the US. Other affected countries include the UK and Canada, with 11% and 6% of global victims, respectively. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/defending-agains… *** Analysis: Kaspersky Lab Report: Java under attack - the evolution of exploits in 2012-2013 *** --------------------------------------------- One of the biggest problems facing the IT security industry is the use of vulnerabilities in legitimate software to launch malware attacks. Malicious programs can use these vulnerabilities to infect a computer without attracting the attention of the user and, in some cases, without triggering an alert from security software. --------------------------------------------- http://www.securelist.com/en/analysis/204792310/Kaspersky_Lab_Report_Java_u… *** Microsoft sieht Rückgang der Virengefahr, aber steigende Infektionen *** --------------------------------------------- In fast allen großen Ländern habe die Zahl der 'Begegnungen mit Schad-Software' deutlich abgenommen, konstatiert der aktuelle Microsoft Security Intelligence Report. Für Entwarnung ist es jedoch zu früh - denn die Zahl der Infektionen nimmt trotzdem zu. --------------------------------------------- http://www.heise.de/security/meldung/Microsoft-sieht-Rueckgang-der-Virengef… *** Joomla! Media Manager allows arbitrary file upload and execution *** --------------------------------------------- A vulnerability has been discovered in older versions of the Joomla! content management software that allow an authenticated attacker to upload active content through the media manager form ('administrator/components/com_media/helpers/media.php'). Joomla! allows files with a trailing '.' to pass the upload checks. --------------------------------------------- http://www.kb.cert.org/vuls/id/639620 *** Apples Siri is helping users bypass iOS security *** --------------------------------------------- Siri was designed to be an effective personal assistant, but since the release of iOS 7, the artificial intelligence is bringing the bad with the good. --------------------------------------------- http://www.scmagazine.com/apples-siri-is-helping-users-bypass-ios-security/… *** [remote] - Apache / PHP 5.x Remote Code Execution Exploit *** --------------------------------------------- +++ Betrifft veraltete Versionen +++ Unaffected versions are patched by CVE-2012-1823. --------------------------------------------- http://www.exploit-db.com/exploits/29290 *** Vuln: Mozilla Firefox/Thunderbird/SeaMonkey CVE-2013-5599 Remote Memory Corruption Vulnerability *** --------------------------------------------- +++ Betrifft veraltete Versionen +++ --------------------------------------------- http://www.securityfocus.com/bid/63423 *** ASUS RT-N13U Backdoor Account *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2013100206 *** Vuln: XAMPP for Windows Multiple Cross Site Scripting and SQL Injection Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/bid/53979 *** Citrix XenDesktop Upgrade Feature Bug Lets Remote Authenticated Users Bypass Policy Controls *** --------------------------------------------- http://www.securitytracker.com/id/1029263 *** WordPress MoneyTheme Cross Site Scripting / Shell Upload *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2013100199 *** WordPress Curvo Shell Upload *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2013100197 *** Google Play Billing Bypass *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2013100203 *** sup Remote Command Execution *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2013100202

1 0

Tageszusammenfassung - Dienstag 29-10-2013
by Daily end-of-shift report 29 Oct '13

29 Oct '13

======================= = End-of-Shift report = ======================= Timeframe: Montag 28-10-2013 18:00 − Dienstag 29-10-2013 18:00 Handler: Matthias Fraidl Co-Handler: n/a *** Hintergrund: iOS-Virenscanner mit zweifelhaftem Nutzen *** --------------------------------------------- Avira hat eine Virenschutz-App für iOS herausgegeben, die vor schadhaften Prozessen schützen soll. Welche das sind und wie diese erkannt werden, verrät das Unternehmen nicht. --------------------------------------------- http://www.heise.de/security/artikel/iOS-Virenscanner-mit-zweifelhaftem-Nut… *** Exploit cocktail (Struts, Java, Windows) going after 3-month old vulnerabilities *** --------------------------------------------- When ISC reader Yin reported earlier today that one of their servers had been hacked via the Apache Struts remote command execution vulnerability (CVE-2013-2251), at first this was flagged as "business as usual". Said vulnerability, after all, is known since July, and weve been seeing exploit attempts since early August (diary here). --------------------------------------------- http://isc.sans.edu/diary.html?storyid=16913 *** ATM malware Ploutus updated with English-language version *** --------------------------------------------- The Spanish-language ATM malware, which allowed attackers in Mexico to force ATMs to spit out cash, now has an updated English-language version. --------------------------------------------- http://www.scmagazine.com//atm-malware-ploutus-updated-with-english-languag… *** Adobe Breach Impacted At Least 38 Million Users *** --------------------------------------------- The recent data breach at Adobe that exposed user account information and prompted a flurry of password reset emails impacted at least 38 million users, the company now says. It also appears that the already massive source code leak at Adobe is broadening to include the companys Photoshop family of graphical design products. --------------------------------------------- http://krebsonsecurity.com/2013/10/adobe-breach-impacted-at-least-38-millio… *** Analysis: Spam in September 2013 *** --------------------------------------------- In September, the proportion of world spam in mail traffic continued to decline and reached 66%. As always the spammers focused on advertising seasonal goods and services. For example, the number of offers related to energy saving and insulating buildings increased significantly. --------------------------------------------- http://www.securelist.com/en/analysis/204792309/Spam_in_September_2013 *** Routerpwn *** --------------------------------------------- Routerpwn is a web application that helps you in the exploitation of vulnerabilities in residential routers. It is a compilation of ready to run local and remote web exploits. --------------------------------------------- http://www.routerpwn.com/ *** Windows XP ist und bleibt ein hochriskantes System *** --------------------------------------------- Im aktuellen Security Intelligence Report (SIR) warnt Microsoft erneut vor Windows XP. Sicherheits-Chef Tim Rains verteidigt die Entscheidung, den Support einzustellen. --------------------------------------------- http://futurezone.at/digital-life/windows-xp-ist-und-bleibt-ein-hochriskant… *** Internet Safety - Tips for Parents *** --------------------------------------------- Internet basics can be as straightforward as pushing buttons or clicking a mouse. Understanding how youth use the Internet, however, can be an overwhelming task, especially for adults who don't spend much time online. --------------------------------------------- http://bc.rcmp-grc.gc.ca/ViewPage.action?siteNodeId=87&languageId=1&content… *** Cyber Security Assesment Netherlands *** --------------------------------------------- Cybercrime and digital espionage remain the biggest threats to both governments and the business community. The threat of disruption of online services has increased. Clearly visible in the past year has been the rise of the criminal cyber services sector. Cyber-attack tools are made commercially available through `cybercrime as a service´. --------------------------------------------- https://www.ncsc.nl/english/current-topics/news/cyber-security-assesment-ne… *** Social media and digital identity. Prevention and incident response *** --------------------------------------------- The hack of a social media account is a common incident that could have a serious impact of our digital identity. How to prevent it? What to do in case of hack? --------------------------------------------- http://securityaffairs.co/wordpress/19143/cyber-crime/social-media-security… *** Angebliches Fritzbox-Fax entpuppt sich als Trojaner *** --------------------------------------------- Schadhafte E-Mails, die sich als Fax-Benachrichtigungen einer Fritzbox tarnen, verbreiten sich momentan rapide. In dem beigefügten Zip-Archiv befindet sich nicht etwa ein Fax, sondern ein Trojaner. --------------------------------------------- http://www.heise.de/security/meldung/Angebliches-Fritzbox-Fax-entpuppt-sich… *** Facebook Android Flaws Enable Any App to Get User's Access Tokens *** --------------------------------------------- A researcher has discovered serious vulnerabilities in the main Facebook and Facebook Messenger apps for Android that enable any other app on a device to access the user's Facebook access token and take over her account. --------------------------------------------- http://threatpost.com/facebook-android-flaws-enable-any-app-to-get-users-ac… *** [webapps] - Pirelli Discus DRG A125g - Password Disclosure Vulnerability. *** --------------------------------------------- http://www.exploit-db.com/exploits/29262 *** DSA-2786 icu *** --------------------------------------------- http://www.debian.org/security/2013/dsa-2786 *** vBulletin 4.1.x / 5.x.x Administrative User Injection *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2013100192 *** MobileIron 4.5.4 Cross Site Scripting *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2013100190 *** SAP Financial Services Statutory Reporting for Insurance (FS-SR) Unspecified Flaw Lets Remote Users Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1029256

1 0

Tageszusammenfassung - Montag 28-10-2013
by Daily end-of-shift report 28 Oct '13

28 Oct '13

======================= = End-of-Shift report = ======================= Timeframe: Freitag 25-10-2013 18:00 − Montag 28-10-2013 18:00 Handler: Matthias Fraidl Co-Handler: n/a *** Email contains phishing scam, not iPhone 5S *** --------------------------------------------- A new phishing email circulating the globe is preying on Apple fans who cant wait to get their hands on the coming iPhone 5S and iPhone 5c devices. --------------------------------------------- http://www.scmagazine.com/email-contains-phishing-scam-not-iphone-5s/articl… *** Blog: Cryptolocker Wants Your Money! *** --------------------------------------------- A new ransomware Trojan is on the loose. The attackers give you roughly three days to pay them, otherwise your data is gone forever. --------------------------------------------- http://www.securelist.com/en/blog/208214109/Cryptolocker_Wants_Your_Money *** Blog-Software Wordpress 3.7 aktualisiert sich selbst *** --------------------------------------------- In der neuen Version 3.7 hält sich die Blog-Software Wordpress selbst aktuell: Sicherheitsupdates werden künftig im Hintergrund automatisch eingespielt, wenn die Konfiguration das zulässt. Weitere Neuerungen dienen ebenfalls vorrangig der Sicherheit. --------------------------------------------- http://www.heise.de/security/meldung/Blog-Software-Wordpress-3-7-aktualisie… *** Periodic Connections to Control Server Offer New Way to Detect Botnets *** --------------------------------------------- A number of recent botnets and advanced threats use HTTP as their primary communications channel with their control servers. McAfee Labs research during the last couple of years reveals that more than 60 percent of the top botnet families depend on HTTP. These numbers have increased significantly over the last few quarters. --------------------------------------------- http://blogs.mcafee.com/mcafee-labs/periodic-links-to-control-server-offer-… *** Improving Hadoop Security with Host Intrusion Detection (Part 2) *** --------------------------------------------- This is a continuation of our previous post on Hadoop security. As we mentioned in our earlier post, we can use OSSEC to monitor for the file integrity of these existing Hadoop and HBase systems. OSSEC creates logs which a system administrator can use to check for various system events. It´s worth noting that big data systems ... --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/improving-hadoop… *** Active Perl/Shellbot Trojan *** --------------------------------------------- ISC received a submission from Zach of a Perl/Shellbot.B trojan served by fallencrafts[.]info/download/himad.png. The trojan has limited detection on Virustotal and the script contains a 'hostauth' of sosick[.]net[3] and the IRC server where the compromised systems are connecting to is located at 89.248.172.144. What we have so far, it appears it is exploiting older version of Plesk. --------------------------------------------- http://isc.sans.edu/diary.html?storyid=16907&rss *** LinkedIn kann Mails mitlesen *** --------------------------------------------- Die kürzlich eingeführte Intro-Technik für iOS bringt dem Berufsnetzwerk Kritik ein: Sie sei ein Traum für Angreifer und Sicherheitsdienste. Die Firma verteidigt sich: Alles sei sicher und man respektiere die Privatsphäre der Nutzer. --------------------------------------------- http://www.heise.de/security/meldung/LinkedIn-kann-Mails-mitlesen-2034490.h… *** Einbruch bei Buffer *** --------------------------------------------- Der Social-Media-Dienst wurde gestern gehackt. Laut Unternehmensblog sollen weder Passwörter noch Kreditkarteninformationen abhanden gekommen sein. --------------------------------------------- http://www.heise.de/security/meldung/Einbruch-bei-Buffer-2034519.html *** Storewize: IBM warnt vor Sicherheitslücke in Storage-Systemen *** --------------------------------------------- In den SAN-Controllern der Serie Storewize von IBM steckt eine Lücke, mit der ein Angreifer die Konfiguration ändern und auch Daten löschen kann. Abhilfe schafft ein Firmware-Update, das schon bereitsteht. (IBM, Netzwerk) --------------------------------------------- http://www.golem.de/news/storewize-ibm-warnt-vor-sicherheitsluecke-in-stora… *** End User Devices Security and Configuration Guidance *** --------------------------------------------- UK Gov Configuration guidance for the following platforms: End User Devices Security Guidance: Windows Phone 8 End User Devices Security Guidance: Android 4.2 End User Devices Security Guidance: Windows 7 and Windows 8 End User Devices Security Guidance: Ubuntu 12.04 End User Devices Security Guidance: Windows 8 RT ... --------------------------------------------- https://www.gov.uk/government/collections/end-user-devices-security-guidanc… *** Bypassing security scanners by changing the system language *** --------------------------------------------- Luiz Eduardo and Joaquim Espinhara´s found that the majority of pentesting tools analyze specific problems in web applications - such as SQL injection - via the return messages that are provided by the application, and not by the error code that is reported by the database management system. So, what would happen if the setup language was not English, but Chinese or Portuguese? As their research showed, if the target SQL server doesnt use English by default, the scanners wont be able to --------------------------------------------- http://www.net-security.org/secworld.php?id=15832 *** Cisco Identity Services Engine contains an input validation vulnerability *** --------------------------------------------- Vulnerability Note VU#952422 Cisco Identity Services Engine contains an input validation vulnerability Original Release date: 28 Oct 2013 | Last revised: 28 Oct 2013 Overview Cisco Identity Services Engine contains an input validation vulnerability (CWE-20). Description CWE-20: Improper Input ValidationCisco Identity Services Engine (ISE) contains an input validation vulnerability. --------------------------------------------- http://www.kb.cert.org/vuls/id/952422 *** I challenged hackers to investigate me and what they found out is chilling *** --------------------------------------------- It´s my first class of the semester at New York University. I´m discussing the evils of plagiarism and falsifying sources with 11 graduate journalism students when, without warning, my computer freezes. I fruitlessly tap on the keyboard as my laptop takes on a life of its own and reboots. Seconds later the screen flashes a message. --------------------------------------------- http://pandodaily.com/2013/10/26/i-challenged-hackers-to-investigate-me-and… *** Spam-Versender. Schauen Sie doch mal bitte in Ihren Junk-Ordner *** --------------------------------------------- Werbefilter funktionieren inzwischen ziemlich zuverlässig. Das wissen auch die Spam-Versender. Deshalb schicken sie noch eine zweite Nachricht hinterher. --------------------------------------------- http://www.heise.de/security/meldung/Spam-Versender-Schauen-Sie-doch-mal-bi… *** Scan Shows 65% of ReadyNAS Boxes on Web Vulnerable to Critical Bug *** --------------------------------------------- It´s been known for some time now several months, in fact that there is a critical, remotely exploitable vulnerability in some of Netgear´s ReadyNAS storage boxes, and a patch has been available since July. However, many of the boxes exposed to the Web are still vulnerable, and a recent scan by HD Moore of Rapid7 found that ... --------------------------------------------- http://threatpost.com/scan-shows-65-of-readynas-boxes-on-web-vulnerable-to-… *** Vuln: Cisco Catalyst 3750 Series Switches Default Credentials Security Bypass Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/bid/63342 *** Bugtraq: Multiple CSRF Horde Groupware Web mail Edition 5.1.2 *** --------------------------------------------- http://www.securityfocus.com/archive/1/529466 *** Bugtraq: DD-WRT v24-sp2 Command Injection *** --------------------------------------------- http://www.securityfocus.com/archive/1/529463 *** Apache Struts2 showcase multiple XSS *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2013100185 *** DSA-2787 roundcube *** --------------------------------------------- http://www.debian.org/security/2013/dsa-2787 *** Woltlab Burning Board Regenbogenwiese 2007 Addon SQL Injection Exploit. *** --------------------------------------------- http://www.exploit-db.com/exploits/29023 *** GnuPG Side-Channel Attack Lets Local Users Recover RSA Secret Keys *** --------------------------------------------- http://www.securitytracker.com/id/1029242 *** DSA-2785 chromium-browser *** --------------------------------------------- http://www.debian.org/security/2013/dsa-2785

1 0

Tageszusammenfassung - Freitag 25-10-2013
by Daily end-of-shift report 25 Oct '13

25 Oct '13

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 24-10-2013 18:00 − Freitag 25-10-2013 18:00 Handler: Stephan Richter Co-Handler: n/a *** Periodic Links to Control Server Offer New Way to Detect Botnets *** --------------------------------------------- A number of recent botnets and advanced threats use HTTP as their primary communications channel with their control servers. McAfee Labs research during the last couple of years reveals that more than 60 percent of the top botnet families depend on HTTP. These numbers have increased significantly over the last few quarters. The following pie […] --------------------------------------------- http://blogs.mcafee.com/mcafee-labs/periodic-links-to-control-server-offer-… *** DDoS mitigation firm notes dramatic increase in reflection attack style *** --------------------------------------------- Between Q3 2012 and Q3 2013, distributed reflection denial-of-service (DrDoS) attacks increased 265 percent, a global attack report found. --------------------------------------------- http://www.scmagazine.com/ddos-mitigation-firm-notes-dramatic-increase-in-r… *** LinkedIn Intro App Equivalent to Man in the Middle Attack, Experts Say *** --------------------------------------------- LinkedIn’s release of its Intro app yesterday for Apple iOS mobile devices raised more than a few eyebrows for behaviors that are tantamount to a man-in-the-middle attack, experts said. --------------------------------------------- http://threatpost.com/linkedin-intro-app-equivalent-to-man-in-the-middle-at… *** Evasive Tactics: Terminator RAT *** --------------------------------------------- FireEye Labs has been tracking a variety of APT threat actors that have been slightly changing their tools, techniques and procedures (TTPs) in order to evade network defenses. Earlier, we documented changes to Aumlib, the malware used in the attack... --------------------------------------------- http://www.fireeye.com/blog/technical/malware-research/2013/10/evasive-tact… *** Cybercriminals release new commercially available Android/BlackBerry supporting mobile malware bot *** --------------------------------------------- Thanks to the growing adoption of mobile banking, in combination with the utilization of mobile devices to conduct financial transactions, opportunistic cybercriminals are quickly capitalizing on this emerging market segment. Made evident by the release of Android/BlackBerry compatible mobile malware bots. This site is empowering potential cybercriminals with the necessary ‘know-how’ when it comes to ‘cashing out’ compromised accounts of E-banking victims who have... --------------------------------------------- http://www.webroot.com/blog/2013/10/25/cybercriminals-release-new-commercia… *** OSX/Leverage.a Analysis *** --------------------------------------------- A few days ago, a new OSX malware was detected in the wild. It looks like a picture and behaves like it when you click on it. Everything looks fine when the clicked picture is opened on the screen, but the malware also performs some other actions. After the first look, we saw that the malware copies itself to /Users/Shared/UserEvent.app with the ditto command, and creates a LaunchAgent to load itself when the computer starts with these shell commands: mkdir ~/Library/LaunchAgents echo --------------------------------------------- http://www.alienvault.com/open-threat-exchange/blog/osx-leveragea-analysis *** PHP.net zur Verbreitung von Malware missbraucht *** --------------------------------------------- Entgegen früherer Aussagen der Administratoren wurde die Projektseite von PHP doch Opfer eines Hackerangriffs. Zwei Server wurden gekapert und zur Verteilung von Schadcode eingesetzt. --------------------------------------------- http://www.heise.de/security/meldung/PHP-net-zur-Verbreitung-von-Malware-mi… *** ProSoft Technology RadioLinx ControlScape PRNG Vulnerability *** --------------------------------------------- RadioLinx ControlScape is prone to a predictable random number generator weakness. Attackers can leverage this weakness to aid in brute-force attacks. Other attacks are also possible. --------------------------------------------- http://www.securityfocus.com/bid/62238/ http://ics-cert.us-cert.gov/advisories/ICSA-13-248-01 *** Vuln: OpenStack Keystone Tokens Validation CVE-2013-4222 Security Bypass Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/61725 *** Vuln: OpenStack Nova CVE-2013-4261 Denial of Service Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/62200 *** Vuln: OpenStack Nova CVE-2013-4278 Security Bypass Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/62016 *** CA SiteMinder Input Validation Flaw Permits Cross-Site Scripting Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1029237 *** libvirt API Access Control Flaw Lets Remote Authenticated Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1029241 *** Vuln: GnuTLS CVE-2013-4466 libdane/dane.c Remote Buffer Overflow Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/63326 *** Vuln: VICIDIAL manager_send.php CVE-2013-4468 Command Injection Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/63288 *** Security Bulletin: Tivoli Netcool/OMNIbus Web GUI - IBM WebSphere Application Server PM44303 security bypass (CVE-2012-3325) and Hash denial of service (CVE-2011-4858) *** --------------------------------------------- CVE-2012-3325: After installing an Interim Fix for PM44303 or a Fix Pack containing PM44303, there is a potential security exposure with IBM WebSphere Application Server. CVE-2011-4858: Potential Denial of Service (DoS) security exposure when using web-based applications due to Java HashTable implementation vulnerability. --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_tiv…

1 0

Tageszusammenfassung - Donnerstag 24-10-2013
by Daily end-of-shift report 24 Oct '13

24 Oct '13

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 23-10-2013 18:00 − Donnerstag 24-10-2013 18:00 Handler: Stephan Richter Co-Handler: n/a *** Neutrino: Caught in the Act *** --------------------------------------------- Last week, we got a tip from Kafeine about hacked sites serving injected iframes leading to an exploit kit. We thought it was quite interesting so we looked at one of the infected websites and found this sneaky piece of code: The deobfuscated code shows the location from where the... --------------------------------------------- http://www.f-secure.com/weblog/archives/00002626.html *** Neue und alte Router-Lücken bei Netgear, Tenda und DrayTek *** --------------------------------------------- Sicherheitsexperten haben eine Hintertür in Routern der WNDR-Reihe von Netgear gefunden, die ohne Passwort-Abfrage vollen Zugrif auf das Gerät erlaubt. Bei Modellen der Firmen Tenda und DrayTek kann man Schadcode ausführen, ohne sich einloggen zu müssen. --------------------------------------------- http://www.heise.de/security/meldung/Neue-und-alte-Router-Luecken-bei-Netge… *** Industrial software flaw could allow manipulation of energy processes *** --------------------------------------------- The vulnerability lies in industrial automation software that uses a weak encryption algorithm for user authentication, researchers at IOActive found. --------------------------------------------- http://www.scmagazine.com/industrial-software-flaw-could-allow-manipulation… *** Bugtraq: ESA-2013-067: RSA® Authentication Agent for Web for Internet Information Services (IIS) Security Controls Bypass Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/529394 *** Bugtraq: RPS/APS vulnerability in snom/yealink and others *** --------------------------------------------- http://www.securityfocus.com/archive/1/529397 *** Security Bulletin: IBM Flex System Manger expired USERID password vulnerability (CVE-2013-5424) *** --------------------------------------------- Security Bulletin: IBM Flex System Manger expired USERID password vulnerability (CVE-2013-5424) Affected product(s) and affected version(s): IBM Flex System Manager Node, Types 7955, 8731, 8734 all models, Version 1.3.0 --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_ibm… *** Cisco IOS XR Software Route Processor Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Apache Struts 2 Command Execution Vulnerability in Multiple Cisco Products *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Multiple Vulnerabilities in Cisco Identity Services Engine *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco Secure ACS Distributed Deployment Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013… *** Vuln: Multiple Cisco Appliances CVE-2013-5537 Denial of Service Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/63280 *** Vuln: Joomla! Maian15 Component name Parameter Arbitrary Shell Upload Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/63287 *** Vuln: Drupal Spaces Module Access Bypass Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/63305 *** WordPress Blue Wrench Video Widget Plugin Cross-Site Request Forgery Vulnerability *** --------------------------------------------- https://secunia.com/advisories/55456

1 0

Tageszusammenfassung - Mittwoch 23-10-2013
by Daily end-of-shift report 23 Oct '13

23 Oct '13

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 22-10-2013 18:00 − Mittwoch 23-10-2013 18:00 Handler: Stephan Richter Co-Handler: n/a *** WellinTech KingView ActiveX Vulnerabilities *** --------------------------------------------- OVERVIEW: This advisory is a follow-up to the alert titled ICS-ALERT-13-256-01 WellinTech KingView ActiveX Vulnerabilitiesa that was published September 13, 2013, on the NCCIC/ICS-CERT Web site. --------------------------------------------- http://ics-cert.us-cert.gov/advisories/ICSA-13-295-01 *** Apache Fixes Information Disclosure Vulnerability in Shindig *** --------------------------------------------- The Apache Software Foundation released a new version of Shindig, a framework for web applications, yesterday, fixing what the collective has deemed an important information disclosure vulnerability. --------------------------------------------- http://threatpost.com/apache-fixes-information-disclosure-vulnerability-in-… *** Xerox WorkCentre and ColorQube Let Remote Users Gain Unauthorized Access *** --------------------------------------------- A vulnerability was reported in Xerox WorkCentre and ColorQube. A remote user can gain unauthorized access. --------------------------------------------- http://www.securitytracker.com/id/1029224 *** Security Bulletins: Vulnerability in XenDesktop 7.0 upgrade could result in policy bypass *** --------------------------------------------- A vulnerability has been identified in Citrix XenDesktop 7.0 that could prevent policy rules from being correctly applied following an upgrade from earlier versions of Citrix XenDesktop. --------------------------------------------- http://support.citrix.com/article/CTX138627 *** MantisBT 1.2.15 XSS vulnerability *** --------------------------------------------- Topic: MantisBT 1.2.15 XSS vulnerability Risk: Low Text:Greetings Roland Becker (MantisBT developer) discovered and fixed [1] an XSS vulnerability issue affecting MantisBT releases... --------------------------------------------- http://cxsecurity.com/issue/WLB-2013100159 *** Fixes from Apple (iOS 7.0.3, OS X Mavericks v10.9, Safari 6.1, Keynote 6.0, OS X Server 3.0, Remote Desktop, iTunes 11.1.2) *** --------------------------------------------- http://prod.lists.apple.com/archives/security-announce/2013/Oct/msg00002.ht… http://prod.lists.apple.com/archives/security-announce/2013/Oct/msg00003.ht… http://prod.lists.apple.com/archives/security-announce/2013/Oct/msg00004.ht… http://prod.lists.apple.com/archives/security-announce/2013/Oct/msg00005.ht… http://prod.lists.apple.com/archives/security-announce/2013/Oct/msg00006.ht… http://prod.lists.apple.com/archives/security-announce/2013/Oct/msg00007.ht… http://prod.lists.apple.com/archives/security-announce/2013/Oct/msg00008.ht… http://prod.lists.apple.com/archives/security-announce/2013/Oct/msg00009.ht…

1 0

Tageszusammenfassung - Dienstag 22-10-2013
by Daily end-of-shift report 22 Oct '13

22 Oct '13

======================= = End-of-Shift report = ======================= Timeframe: Montag 21-10-2013 18:00 − Dienstag 22-10-2013 18:00 Handler: Stephan Richter Co-Handler: n/a *** Fake Dropbox Password Reset Spam Leads to Malware *** --------------------------------------------- A new spam campaign has been circulating over the last few weeks in hopes of duping users of the popular cloud storage service Dropbox. The e-mails purport to come from the service but instead lead those who click through to a malware landing page. --------------------------------------------- http://threatpost.com/fake-dropbox-password-reset-spam-leads-to-malware/102… *** New DIY compromised hosts/proxies syndicating tool spotted in the wild *** --------------------------------------------- Compromised, hacked hosts and PCs are a commodity in underground markets today. More cybercriminals are populating the market segment with services tailored to fellow cybercriminals looking for access to freshly compromised PCs to be later abused in a variety of fraudulent/malicious ways, all the while taking advantage of their clean IP reputation. Naturally, once the commoditization took place, cybercriminals quickly realized that the supply of such hosts also shaped several different market... --------------------------------------------- http://www.webroot.com/blog/2013/10/21/new-diy-compromised-hostsproxies-syn… *** Cryptolocker Update, Request for Info, (Tue, Oct 22nd) *** --------------------------------------------- It was briefly mentioned in a previous posting, but the Cryptolocker ransomware is still going strong. In essence, post infection is encrypts all of your "document" files based on file extension and then gives the user 72 hours to pay the ransom ($300 USD or 2 BTC). It is one f the few pieces of ransomware that does encryption right so at present, short of paying the ransom, there is no other means to decrypt. Bleeping Computer has a good write up, but below are the TL;DR highlights. --------------------------------------------- http://isc.sans.edu/diary.html?storyid=16871&rss *** Touch ID: Biometrics Dont Make For Good Passwords *** --------------------------------------------- Theres an Apple event scheduled for tomorrow which will showcase this years iPad lineup. Among the more credible rumors is that at least one version of the iPad will include Apples Touch ID, its fingerprint identity sensor.And so it seems somewhat inevitable that all of our "smart" devices will soon include fingerprint readers.That being the case, we strongly recommend the following by @dustinkirkland: • Fingerprints are Usernames, not PasswordsWe welcome intelligent use of --------------------------------------------- http://www.f-secure.com/weblog/archives/00002624.html *** Defending Against Crypto Backdoors *** --------------------------------------------- We already know the NSA wants to eavesdrop on the Internet. It has secret agreements with telcos to get direct access to bulk Internet traffic. It has massive systems like TUMULT, TURMOIL, and TURBULENCE to sift through it all. And it can identify ciphertext -- encrypted information -- and figure out which programs could have created it. But what the... --------------------------------------------- https://www.schneier.com/blog/archives/2013/10/defending_again_1.html *** Security Bulletins: Citrix XenServer Multiple Security Updates *** --------------------------------------------- A number of security vulnerabilities have been identified in Citrix XenServer. These vulnerabilities affect all currently supported versions of Citrix XenServer up to and including version 6.2. --------------------------------------------- http://support.citrix.com/article/CTX139295 *** Vuln: 7T Interactive Graphical SCADA System Multiple Security Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/bid/46936 *** WordPress Portable phpMyAdmin Plugin Security Bypass Security Issue *** --------------------------------------------- https://secunia.com/advisories/55270 *** WatchGuard Extensible Threat Management and System Manager Multiple Vulnerabilities *** --------------------------------------------- https://secunia.com/advisories/55388 *** Vuln: D-Link DIR-605L CAPTCHA Data Stack Based Buffer Overflow Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/56330 *** Bugtraq: [CVE-2013-2751, CVE-2013-2752] NETGEAR ReadyNAS Remote Root *** --------------------------------------------- http://www.securityfocus.com/archive/1/529364 *** Cisco ASA VPN Denial of Service Vulnerability *** --------------------------------------------- A vulnerability in the VPN authentication code that handles parsing of the username from the certificate on the Cisco ASA firewall could allow an unauthenticated, remote attacker to cause a reload of the affected device. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013… *** Security Bulletin: IBM SONAS fix available for Cross Frame Scripting vulnerability via Graphical User Interface (CVE-2013-5376) *** --------------------------------------------- An issue in IBM SONAS allows remote attackers to access the system as an authorized administrative user. --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_ibm… *** Security Bulletin: IBM SONAS Fix Available for SONAS Cross Protocol Vulnerability (CVE-2013-0500) *** --------------------------------------------- IBM SONAS includes a flaw in the handling of special files created by an NFS client resulting in a vulnerability reported against IBM SONAS. --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_ibm… *** IBM WebSphere Message Broker and IBM Integration Bus Security Vulnerability: XML4J denial of service attack (CVE-2013-5372) *** --------------------------------------------- XML4J is vulnerable to a denial of service attack triggered by a specially crafted XML document --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg21653087 *** IBM Domino / iNotes Multiple Vulnerabilities *** --------------------------------------------- https://secunia.com/advisories/55405 https://secunia.com/advisories/55409 *** IBM WebSphere DataPower XC10 Two Vulnerabilities *** --------------------------------------------- https://secunia.com/advisories/55402 *** F5 BIG-IP Traffic Management Microkernel Component Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1029220

1 0

Tageszusammenfassung - Montag 21-10-2013
by Daily end-of-shift report 21 Oct '13

21 Oct '13

======================= = End-of-Shift report = ======================= Timeframe: Freitag 18-10-2013 18:00 − Montag 21-10-2013 18:00 Handler: Stephan Richter Co-Handler: n/a *** Card Data Siphon with Google Analytics *** --------------------------------------------- The introduction of EMV (Chip & Pin) payment devices in 2003 resulted in a rapid decline in physical credit card cloning in Europe. EMV technology has also led to an increase in attacks on e-commerce systems targeting cardholder data. Each year, Trustwave SpiderLabs investigates hundreds of incidents of data compromise. I work on some of these investigations and occasionally get to evaluate some rather unusual attack vectors. This blog post details a novel data extraction technique using... --------------------------------------------- http://blog.spiderlabs.com/2013/10/card-data-siphon-with-google-analytics.h… *** New tricks that may bring DNS spoofing back or: "Why you should enable DNSSEC even if it is a pain to do", (Mon, Oct 21st) *** --------------------------------------------- Recently, two papers independently outlined new attacks against DNS, undermining some of the security features protecting us from DNS spoofing. As Dan Kaminsky showed [1], 16 bit query IDs are an insufficient protection against DNS spoofing. As a result, DNS servers started to randomize the source port of DNS queries in order to make DNS spoofing harder. This was never meant to "fix" DNS spoofing, but worked well enough for DNSSEC to be pushed back yet again. Overall, to --------------------------------------------- http://isc.sans.edu/diary.html?storyid=16859&rss *** Darkleech in Europe, Middle East and Africa *** --------------------------------------------- In a previous blog post, we discussed how Darkleech-related malware wound up on a FireEye partner’s website. We followed up with a post detailing a major wave of Darkleech activity linked to a major global malvertising campaign. In this post,... --------------------------------------------- http://www.fireeye.com/blog/corporate/2013/10/darkleech-in-europe-middle-ea… *** Threatpost News Wrap, October 18, 2013 *** --------------------------------------------- Dennis Fisher and Mike Mimoso discuss the big stories of the last couple of weeks, including the grassroots effort to audit the TrueCrypt source code, the Apple iMessage security model and Yahoo enabling SSL by default. --------------------------------------------- http://threatpost.com/threatpost-news-wrap-october-18-2013/102624 *** Bugtraq: OWASP Vulnerable Web Applications Directory Project *** --------------------------------------------- The OWASP Vulnerable Web Applications Directory (VWAD) Project is a comprehensive and well maintained registry of all known vulnerable web applications currently available. These vulnerable web applications can be used by web developers, security auditors and penetration testers to put in practice their knowledge and skills during training... --------------------------------------------- http://www.securityfocus.com/archive/1/529293 *** DNP3 Implementation Vulnerability *** --------------------------------------------- OVERVIEW: Adam Crain of Automatak and independent researcher Chris Sistrunk reported an improper input validation vulnerability to NCCIC/ICS-CERT that was evident in numerous slave and/or master station software products. The researchers emphasize that the vulnerability is not with the DNP3 stack but with the implementation. --------------------------------------------- http://ics-cert.us-cert.gov/advisories/ICSA-13-291-01 *** Yet Another WHMCS SQL Injection Exploit, (Sat, Oct 19th) *** --------------------------------------------- WHMCS, a popular billing/support/customer management system, is still suffering from critical SQL injection issues. Today, yet another vulnerability, including exploit was released... --------------------------------------------- http://isc.sans.edu/diary.html?storyid=16853&rss *** Vuln: WordPress Quick Paypal Payments Plugin Multiple HTML Injection Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/bid/63213 *** Wordpress WooCommerce Plugin 2.0.17 Cross-Site Scripting Vulnerability *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2013100127 *** Wordpress spreadsheet Plugin Cross site scripting *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2013100130 *** Cisco Unified Computing System Bugs Let Remote Users Conduct Man-in-the-Middle Attacks and Obtain Information and Let Local Users View Files *** --------------------------------------------- http://www.securitytracker.com/id/1029209 *** Vuln: OpenLDAP rwm_conn_destroy Denial of Service Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/63190 *** IBM WebSphere Partner Gateway Java Spoofing and Denial of Service Vulnerabilities *** --------------------------------------------- https://secunia.com/advisories/55406 *** Vulnerability Note VU#303900 - SAP Sybase Adaptive Server Enterprise vulnerable to XML injection *** --------------------------------------------- SAP Sybase Adaptive Server Enterprise Version 15.7 ESD 2 and possibly earlier versions contains an XML injection vulnerability (CWE-91). --------------------------------------------- http://www.kb.cert.org/vuls/id/303900

1 0

Tageszusammenfassung - Freitag 18-10-2013
by Daily end-of-shift report 18 Oct '13

18 Oct '13

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 17-10-2013 18:00 − Freitag 18-10-2013 18:00 Handler: Matthias Fraidl Co-Handler: n/a *** You´re infected - if you want to see your data again, pay us $300 in Bitcoins *** --------------------------------------------- Ransomware comes of age with unbreakable crypto, anonymous payments. --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/VLDxuwIP36Q/story01… *** DNS-Experten diskutieren Risiken neuer Angriffsszenarien *** --------------------------------------------- Forscher beschreiben Angriffsszenarien auf das Domain Name System, bei dem die Fragmentierung von IP-Paketen ausgenutzt wird. --------------------------------------------- http://www.heise.de/security/meldung/DNS-Experten-diskutieren-Risiken-neuer… *** Kankan - eine chinesische Trojaner-Geschichte *** --------------------------------------------- Die Analysten von Eset haben eine mysteriöse Geschichte über einen Trojaner zusammengetragen, der vor allem in China Verbreitung fand. Die Bestandteile: infizierte PCs und Smartphones, ein reumütiger Software-Hersteller und mehrere offene Rätsel. --------------------------------------------- http://www.heise.de/security/meldung/Kankan-eine-chinesische-Trojaner-Gesch… *** Got a mobile phone? Then youve got a Trojan problem too *** --------------------------------------------- This time it´s personal Something wonderful has happened: phones have got smart, but the bad news is they may open the door to those you don´t want to let in. --------------------------------------------- http://www.theregister.co.uk/2013/10/18/feature_mobile_security_malware/ *** VMware Release Multiple Security Updates *** --------------------------------------------- VMware released the following security updates. The first one is VMSA-2013-0012 which address multiple vulnerabilities in vCenter Server, vSphere Update Manager, ESXi and ESX. The second is VMSA-2013-0006.1 which address multiple vulnerabilities in vCenter Server Appliances and vCenter Server running on Windows. The last is VMSA-2013-0009.1 which address multiple vulnerabilities in vCenter Server, ESX and ESXi that updates third party libraries. --------------------------------------------- http://isc.sans.edu/diary.html?storyid=16847&rss *** Fiendish CryptoLocker ransomware: Whatever you do, dont PAY *** --------------------------------------------- Create remote backups before infection, advise infosec bods Vid A fiendishly nasty strain of Windows malware that uses advanced encryption to lock up user files before demanding a ransom is doing the rounds. --------------------------------------------- http://www.theregister.co.uk/2013/10/18/cryptolocker_ransmware/ *** Sybase Adaptive Server Enterprise XML injection *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/88105 *** cPanel CloudFlare Plugin Unspecified Privilege Escalation Vulnerability *** --------------------------------------------- https://secunia.com/advisories/55273 *** osCommerce Flaws Permit Cross-Site Scripting and Cross-Site Request Forgery Attacks to Create New Admin Accounts *** --------------------------------------------- http://www.securitytracker.com/id/1029189 *** Level One Enterprise Access Points Password Disclosure *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2013100123 *** Bugtraq: CSRF vulnerability in LinkedIn *** --------------------------------------------- http://www.securityfocus.com/archive/1/529270 *** Summary for October 2013 - Version: 1.1 *** --------------------------------------------- http://technet.microsoft.com/en-za/security/bulletin/ms13-oct

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily October 2013