Daily October 2014

daily@lists.cert.at

1 participants
23 discussions

Tageszusammenfassung - Freitag 31-10-2014
by Daily end-of-shift report 31 Oct '14

31 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 30-10-2014 18:00 − Freitag 31-10-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Multiple vulnerabilities in Cisco products *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/: CVE-2014-3371 http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Security Advisory - Medium Severity - WP eCommerce WordPress Plugin *** --------------------------------------------- If you're using the popular WP eCommerce WordPress plugin (2,900,000 downloads), you should update it right away. During a routine audit for our Website Firewall (WAF), we .. --------------------------------------------- http://blog.sucuri.net/2014/10/security-advisory-medium-severity-wp-ecommer… *** Nordex NC2 XSS Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a cross-site scripting vulnerability in the Nordex Control 2 (NC2) application. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-303-01 *** Meinberg Radio Clocks LANTIME M-Series XSS *** --------------------------------------------- This advisory provides mitigation details for vulnerabilities in the Meinberg Radio Clocks LANTIME M-Series XSS. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-275-01 *** Accuenergy Acuvim II Authentication Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for two authentication vulnerabilities within the Accuenergy AXM-NET Ethernet module's web server. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-275-02 *** [2014-10-31] XXE and XSS vulnerabilities in Scalix Web Access *** --------------------------------------------- Scalix Web Access is vulnerable to XML external entity injection (XXE) and reflected cross site scripting (XSS) attacks. An unauthenticated attacker can get read access to the filesystem of the Scalix Web Access host and thus obtain sensitive information. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2014… *** Spotting Malicious Injections in Otherwise Benign Code *** --------------------------------------------- Being able to spot suspicious code, and then determine whether it is benign or malicious is a very important skill for a security researcher. Every day we scan through megabytes of HTML, JS and PHP. It's quite easy to miss something bad, especially .. --------------------------------------------- http://blog.sucuri.net/2014/10/spotting-malicious-injections-in-otherwise-b… *** Setting HoneyTraps with ModSecurity: Adding Fake Cookies *** --------------------------------------------- This blog post continues with the topic of setting "HoneyTraps" within your web applications to catch attackers. Please review the previous posts for more .. --------------------------------------------- http://blog.spiderlabs.com/2014/10/setting-honeytraps-with-modsecurity-addi… *** Facebook geht ins Tor-Netz *** --------------------------------------------- Das soziale Netz will zukünftig eine Nutzung der Dienste auch über das Anonymisierungsnetz Tor möglich machen. Dafür setzt der Konzern einen eigenen Onion-Dienst im Tor-Netz auf. --------------------------------------------- http://www.heise.de/security/meldung/Facebook-geht-ins-Tor-Netz-2440221.html *** Schwachstellen in Samsung Knox *** --------------------------------------------- Bei einer Analyse von der auf vielen Geräten vorinstallierten Security-App Samsung Knox Personal kamen Mängel ans Licht. Der Hersteller erklärte die App für überholt, Ersatz gibt es allerdings nur für zwei aktuelle Spitzengeräte. --------------------------------------------- http://www.heise.de/security/meldung/Schwachstellen-in-Samsung-Knox-2440119… *** Google to kill off SSL 3.0 in Chrome 40 *** --------------------------------------------- Google plans to remove support for the aging Secure Sockets Layer (SSL) version 3.0 protocol in Google Chrome 40, which is expected to ship in about two months.The decision comes after Google security researchers recently discovered a dangerous design flaw in SSL 3.0. Dubbed "POODLE," the vulnerability .. --------------------------------------------- http://www.csoonline.com/article/2841837/application-security/google-to-kil…

1 0

Tageszusammenfassung - Donnerstag 30-10-2014
by Daily end-of-shift report 30 Oct '14

30 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 29-10-2014 18:00 − Donnerstag 30-10-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** An In-Depth Look Into Malicious Browser Extensions *** --------------------------------------------- Malicious browser extensions bring about security risks as these often lead to system infection and unwanted spamming on Facebook. Based on our data, these attacks have notably affected users in Brazil. We have previously reported that cybercriminals are putting malicious browsers in the official Chrome .. --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/mNBK1Z4Uhdo/ *** Cyberangriffe: Neue Spyware kommuniziert über Gmail-Entwürfe *** --------------------------------------------- Eine neue Malware nutzt die Entwurfsfunktion von Googles E-Mail-Dienst, um Befehle zu empfangen und Daten auszulesen. Wer betroffen ist, lässt sich nur schwer feststellen. --------------------------------------------- http://www.golem.de/news/cyberangriffe-neue-spyware-kommuniziert-ueber-gmai… *** SQL-Injection: Sicherheitslücke erlaubt Zugriff auf Sony-Kundendaten *** --------------------------------------------- Eine SQL-Injection-Lücke erlaubt den Zugriff auf Kundendaten des Playstation Networks. Sony wurde bereits vor zwei Wochen über die Sicherheitslücke informiert, sie wurde jedoch bisher nicht geschlossen. Es ist nicht der erste Vorfall im Playstation-Network. --------------------------------------------- http://www.golem.de/news/sql-injection-sicherheitsluecke-erlaubt-zugriff-au… *** Popular Science Website Infected, Serving Malware *** --------------------------------------------- The website of Popular Science magazine was found infecting users with malware via the RIG exploit kit. --------------------------------------------- http://threatpost.com/popular-science-website-infected-serving-malware/1090… *** Poodle: Microsoft "fixt" SSLv3-Verschlüsselung *** --------------------------------------------- Mit einem von Microsoft bereit gestellten "Fix it" kann man den kaputten Verschlüsselungsstandard SSLv3 im Internet Explorer einfach abschalten. Doch die Schnellhilfe hat ihre Tücken. --------------------------------------------- http://www.heise.de/security/meldung/Poodle-Microsoft-fixt-SSLv3-Verschlues… *** Assume 'Every Drupal 7 Site Was Compromised' Unless Patched By Oct. 15 *** --------------------------------------------- The maintainers of the Drupal content management system are warning users that any site owners who haven't patched a critical vulnerability in Drupal Core disclosed earlier this month should consider their sites to be .. --------------------------------------------- http://threatpost.com/assume-every-drupal-7-site-was-compromised-unless-pat… *** Cyber Europe 2014: 29 europäische Länder testen Handlungsfähigkeit gegen Cyberattacken *** --------------------------------------------- Gegen grenzüberschreitende Cyber-Bedrohungen arbeiten die Europäische Sicherheitsbehörde ENISA, die EU-Mitgliedsstaaten und die Industrie Hand in Hand. Heute läuten sie Phase 2 des bislang grössten europäischen Cyber-Security-Tests ein. --------------------------------------------- http://www.heise.de/security/meldung/Cyber-Europe-2014-29-europaeische-Laen… *** Grafikkarte funkt Passwörter durch die Gegend *** --------------------------------------------- Forscher haben eine Grafikkarte zum UKW-Sender umfunktioniert, das Monitorkabel dient als Antenne. So können sie Air Gap überwinden und Daten an Geräte senden, die eigentlich gar nicht untereinander vernetzt sind. --------------------------------------------- http://www.heise.de/security/meldung/Grafikkarte-funkt-Passwoerter-durch-di… *** Reflected File Download - A New Web Attack Vector *** --------------------------------------------- On October 2014 as part of my talk at the Black Hat Europe 2014 event, I presented a new web attack vector that enables attackers to gain complete control over a victim's machine by virtually downloading a file from trusted .. --------------------------------------------- http://blog.spiderlabs.com/2014/10/reflected-file-download-the-white-paper.… *** APT28 - State Sponsored Russian Hacker Group *** --------------------------------------------- Nearly a decade-long cyber espionage group that targeted a variety of Eastern European governments and security-related organizations including the North Atlantic Treaty Organization (NATO) has been exposed by a security research firm. The US intelligence firm FireEye released its latest Advanced Persistent .. --------------------------------------------- http://thehackernews.com/2014/10/APT28-Russian-hacker-cyber-espionage.html *** Ausnutzung der Windows-Sandworm-Lücke eskaliert *** --------------------------------------------- Kriminelle nutzen die zunächst im Rahmen gezielter Attacken auf NATO-Einrichtungen und Regierungen eingesetzte Sicherheitslücke in Windows nun, um grossflächig Online-Banking-Trojaner zu verteilen. --------------------------------------------- http://www.heise.de/security/meldung/Ausnutzung-der-Windows-Sandworm-Luecke…

1 0

Tageszusammenfassung - Mittwoch 29-10-2014
by Daily end-of-shift report 29 Oct '14

29 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 28-10-2014 18:00 − Mittwoch 29-10-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** The dangers of opening suspicious emails: Crowti ransomware *** --------------------------------------------- The Microsoft Malware Protection Center (MMPC) has seen a spike in number of detections for threats in the Win32/Crowti ransomware this month as the result of new malware campaigns. Crowti is a family of ransomware that when encountered will attempt to encrypt the files on your PC, and then ask for payment .. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2014/10/28/the-dangers-of-opening-s… *** Ongoing Sophisticated Malware Campaign Compromising ICS *** --------------------------------------------- NCCIC/ICS-CERT has identified a sophisticated malware campaign that has compromised numerous industrial control systems (ICSs) environments using a variant of the BlackEnergy malware. Analysis indicates that this campaign has .. --------------------------------------------- https://ics-cert.us-cert.gov//alerts/ICS-ALERT-14-281-01 *** Multiple vulnerabilities in Tuleap *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2014100177 http://cxsecurity.com/issue/WLB-2014100176 http://cxsecurity.com/issue/WLB-2014100175 *** Weisses Haus: Russische Hacker angeblich in US-Regierungsnetz eingedrungen *** --------------------------------------------- Angriffe auf die Computernetze von Regierungen kommen weltweit tagtäglich vor. Hackern ist es nun offenbar gelungen, in das nicht abgeschirmte Netz des Weissen Hauses einzudringen. --------------------------------------------- http://www.golem.de/news/weisses-haus-russische-hacker-angeblich-in-us-regi… *** Microsoft integriert Data Loss Prevention in Cloud- und Office-Produkte *** --------------------------------------------- Mit der Ausweitung seiner Sicherheits-Features auf weitere Produkte und Dienste will der Redmonder Konzern für Unternehmen den Verlust vertraulicher Daten weitestmöglich einschränken. --------------------------------------------- http://www.heise.de/security/meldung/Microsoft-integriert-Data-Loss-Prevent… *** [2014-10-29] Multiple critical vulnerabilities in Vizensoft Admin Panel *** --------------------------------------------- Attackers are able to completely compromise the web application built upon Vizensoft CMS as they can gain access to the system and database level and manage the website as an admin without prior authentication. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2014… *** [2014-10-29] Persistent cross site scripting in Confluence RefinedWiki Original Theme *** --------------------------------------------- By exploiting this vulnerability, users that are able to create or edit content, can attack other users of confluence. An attacker might be able to gain access to otherwise protected information in confluence. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2014… *** Codeausführung: FTP-Client-Lücke in BSDs, Mac OS X und Linux-Distributionen *** --------------------------------------------- Eine Sicherheitslücke in dem FTP-Client von NetBSD erlaubt mit einem angepassten Server das Ausführen von Code auf dem Rechner. Betroffen davon sind wohl verschiedene BSD-Derivate, Mac OS X sowie Linux-Distributionen. Ein Patch steht bereit. --------------------------------------------- http://www.golem.de/news/codeausfuehrung-ftp-client-luecke-in-bsds-mac-os-x… *** Threat Introduced via Browser Extensions *** --------------------------------------------- We love investigating unusual hacks. There are so many ways to compromise a website, but often it's the same thing. When we see malicious code on web pages, our usual suspects are: Vulnerabilities in website software Trojanized software .. --------------------------------------------- http://blog.sucuri.net/2014/10/threat-introduced-via-browser-extensions.html *** AirHopper: Offline-PC schickt Passwort per UKW an Offline-Handy *** --------------------------------------------- Israelische Security-Forscher haben einen neuen Weg für eine Seitenkanalattacke auf PCs gefunden. Mit einem Smartphone und einem Desktoprechner, die beide keine Onlineverbindung haben, können sie ein eingetipptes Passwort mitlesen. --------------------------------------------- http://www.golem.de/news/airhopper-offline-pc-schickt-passwort-per-ukw-an-o…

1 0

Tageszusammenfassung - Dienstag 28-10-2014
by Daily end-of-shift report 28 Oct '14

28 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 27-10-2014 18:00 − Dienstag 28-10-2014 18:00 Handler: Alexander Riepl Co-Handler: Stephan Richter *** ddosfrei.de: neue Providerinitiative für sichere Server *** --------------------------------------------- Mit über 3.500 Angriffen pro Jahr zählen DDoS-Attacken (Distributed Denial of Service-Attacken) laut dem Bundesamt für Sicherheit in der Informationstechnik (BSI) zu den grössten Gefahren für die IT-Sicherheit in Deutschland, Tendenz steigend. Dabei handelt es sich um von vielen Rechnern gleichzeitig erfolgende .. --------------------------------------------- http://www.eco.de/2014/news/ddosfrei-de-neue-initiative-fuer-sichere-server… *** TA14-300A: Phishing Campaign Linked with "Dyre" Banking Malware *** --------------------------------------------- Since mid-October 2014, a phishing campaign has targeted a wide variety of recipients while employing the Dyre/Dyreza banking malware. Elements of this phishing campaign vary from target to target including senders, attachments, exploits, themes, and payload(s) .. --------------------------------------------- https://www.us-cert.gov/ncas/alerts/TA14-300A *** wget Default FTP Retrieval Method Lets Remote Users Create Arbitrary Files and Directories *** --------------------------------------------- http://www.securitytracker.com/id/1031121 *** TSX improves timing attacks against KASLR *** --------------------------------------------- Mega biblion mega kakon .. and similarly a long blog is a nuisance, so I managed to squeeze the essence of it into a single sentence, the title. If it is not entirely clear, read on. SMEP A typical privilege escalation exploit based on a kernel vulnerability works by corrupting the kernel .. --------------------------------------------- http://labs.bromium.com/2014/10/27/tsx-improves-timing-attacks-against-kasl… *** Immer Ärger mit Samsung-Dienst "Find My Mobile" *** --------------------------------------------- Erneut wurde ein Sicherheitsproblem in dem Dienst bekannt. Durch die Schwachstelle können Angreifer die Android-Geräte von Samsung unter Umständen aus der Ferne mit einem beliebigen Code sperren. --------------------------------------------- http://www.heise.de/security/meldung/Immer-Aerger-mit-Samsung-Dienst-Find-M… *** Verizon: Permaä-Cookie in manipulierten Datenpaketen *** --------------------------------------------- Die Datenpakete der Kunden des US-Mobilfunkanbieters Verizon enthalten eine eindeutige Identifikationsnummer. Damit sollen einzelne Personen von Verizons Werbekunden identifiziert werden können. Die Aktion läuft bereits seit zwei Jahren, wurde jedoch erst jetzt aufgedeckt. --------------------------------------------- http://www.golem.de/news/verizon-perma-cookie-in-manipulierten-datenpaketen… *** Untersuchung: Deutlich mehr Phishing-Attacken auf Apple-Nutzer *** --------------------------------------------- Laut einem Sicherheitsunternehmen nahmen die Angriffe auf iCloud- und iTunes-Konten im letzten Quartal um fast 250 Prozent zu. --------------------------------------------- http://www.heise.de/security/meldung/Untersuchung-Deutlich-mehr-Phishing-At… *** VB2014 paper: Hiding the network behind the network. Botnet proxy business model *** --------------------------------------------- Cristina Vatamanu and her colleagues describe how botherders keep their C&C servers hidden.Over the next few months, we will be sharing VB2014 conference papers as well as video recordings of the presentations. Today, we have added Hiding the network behind the network. Botnet proxy business model .. --------------------------------------------- http://www.virusbtn.com/blog/2014/10_28.xml

1 0

Tageszusammenfassung - Montag 27-10-2014
by Daily end-of-shift report 27 Oct '14

27 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 24-10-2014 18:00 − Montag 27-10-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** OpenBSD ELF denial of service *** --------------------------------------------- OpenBSD is vulnerable to a denial of service. A local attacker could exploit this vulnerability using a malicious ELF executable to cause a kernel panic. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/97747 *** A Tale of Two Powerpoint Vulnerabilities *** --------------------------------------------- It's been already a week after the announcement of the CVE-2014-4114 vulnerability, and the tally of the exploiters have only increased. There are even .. --------------------------------------------- http://www.f-secure.com/weblog/archives/00002756.html *** Amplification DDoS attacks most popular, according to Symantec *** --------------------------------------------- The company noted in a whitepaper released on Tuesday that Domain Name Server amplification attacks have increased 183 percent between January and August. --------------------------------------------- http://www.scmagazine.com/distributed-denial-of-service-attacks-are-increas… *** OwnCloud Dev Requests Removal From Ubuntu Repos Over Security Holes *** --------------------------------------------- ownCloud developer Lukas Reschke has sent an email to the Ubuntu Devel mailing list, requesting that ownCloud (server) is removed from the Ubuntu repositories because the package is old and there are multiple critical security bugs for .. --------------------------------------------- http://linux.slashdot.org/story/14/10/25/0046256/owncloud-dev-requests-remo… *** iTunes 12.0.1 for Windows DLL Hijacking *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2014100154 *** Shellshock-Angriffe auf Mailserver *** --------------------------------------------- Nach Informationen von heise Security versuchen Cyber-Kriminelle derzeit vermehrt, durch die Shellshock-Lücken in Mailserver einzudringen. Server-Betreiber sollten umgehend handeln. --------------------------------------------- http://www.heise.de/security/meldung/Shellshock-Angriffe-auf-Mailserver-243… *** WordPress Count-per-Day Plugin (notes.php) Remote Code Upload *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2014100161 *** WordPress Download Manager Plugin Arbitrary File Download *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2014100160 *** Sipgate und Fidor Bank: DDoS-Angriffe waren Erpressungsversuch *** --------------------------------------------- Mit dem gross angelegten DDoS-Angriff gegen Sipgate sollte Geld erpresst werden. Auch die Fidor Bank aus München war betroffen. --------------------------------------------- http://www.golem.de/news/sipgate-und-fidor-bank-ddos-angriffe-waren-erpress… *** ASP Backdoors? Sure! It's not just about PHP *** --------------------------------------------- I recently came to the realization that it might appear that we're partial to PHP and WordPress. This realization has brought about an overwhelming need to correct that perception. While they do make up an interesting percentage, there are various .. --------------------------------------------- http://blog.sucuri.net/2014/10/asp-backdoors-its-not-all-about-php.html

1 0

Tageszusammenfassung - Freitag 24-10-2014
by Daily end-of-shift report 24 Oct '14

24 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 23-10-2014 18:00 − Freitag 24-10-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Operation Pawn Storm: Putting Outlook Web Access Users at Risk *** --------------------------------------------- In our recently released report, Operation Pawn Storm, we talked about an operation that involved three attack scenarios. For this post, we will talk about the third scenario: phishing emails that redirect victims to fake Outlook Web Access login pages. What's most notable about this is that it is simple, effective, and can be easily replicated. Through one... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/CrAgUjYrv14/ *** Has the "Sandworm" zero-day exploit burrowed back to the surface? *** --------------------------------------------- You may have noticed that Microsoft recently published a Security Advisory that sounds a lot like the "Sandworm" vulnerability all over again. Paul Ducklin explains... --------------------------------------------- http://nakedsecurity.sophos.com/2014/10/24/has-the-sandworm-exploit-burrowe… *** The Insecurity of Things : Part One *** --------------------------------------------- Everyday we read about some newfangled internet connected device being released. Things we use everyday are being made "smart" with some rushed-to-production software embedded in a cheap micro-controller. Fitness trackers, smoke alarms, televisions, cars, wall-outlets, even water-bottles. Internet connected-water bottles? What a time to be alive! --------------------------------------------- http://www.xipiter.com/musings/the-insecurity-of-things-part-one *** The Insecurity of Things: Part Two *** --------------------------------------------- When we last left off, we were setting the stage for sharing what the Interns found in a handful of "IOT" or internet connected devices they purchased. So well be starting with a simple one. One that only required simple techniques to compromise it. This first device is a "Smart"-Home Controller. For a bit of background on whats going on here, please see "Part One" of this series otherwise were going to jump right in but first a disclaimer:... --------------------------------------------- http://www.xipiter.com/musings/the-insecurity-of-things-part-two *** The Case of the Modified Binaries *** --------------------------------------------- After creating and using a new exitmap module, I found downloaded binaries being patched through a Tor exit node in Russia. Tor is a wonderful tool for protecting the identity of journalists, their sources, and even regular users around the world; however, anonymity does not guarantee security. --------------------------------------------- http://www.leviathansecurity.com/blog/the-case-of-the-modified-binaries/ *** Sipgate: Dienste nach DDoS-Angriff wiederhergestellt *** --------------------------------------------- Nachdem Sipgate über Nacht seine Dienste teilweise wiederhergestellt hatte, ist das Unternehmen am Freitagmorgen erneut einem DDoS-Angriff ausgesetzt worden. Jetzt sollen die Dienste wieder funktionieren. --------------------------------------------- http://www.golem.de/news/sipgate-dienste-nach-ddos-angriff-wiederhergestell… *** QuickTime-Update für Windows schließt Bündel an Sicherheitslücken *** --------------------------------------------- Insgesamt vier Fehler steckten in der Windows-Version von Apples Multimedia-Unterstützung, die sich von Angreifern über manipulierte Dateien ausnützen lassen sollen. --------------------------------------------- http://www.heise.de/security/meldung/QuickTime-Update-fuer-Windows-schliess… *** Manipulating WordPress Plugin Functions to Inject Malware *** --------------------------------------------- Most authors of website malware usually rely on the same tricks, making it easy for malware researchers to spot obfuscated code, random files that don't belong, and malicious lines injected at the top of a file. However, it can become difficult when the malware is buried deep within the lines of code on normal files. --------------------------------------------- http://blog.sucuri.net/2014/10/manipulating-wordpress-plugin-functions-to-i… *** Filr 1.1 - Security Update 1 *** --------------------------------------------- Abstract: This patch addresses the POODLE (Padding Oracle On Downgraded Legacy Encryption) vulnerability on the Filr 1.1.0 appliance.Document ID: 5194317Security Alert: YesDistribution Type: PublicEntitlement Required: NoFiles:readme-Filr-1.1.0.654.HP.txt (1.26 kB)Filr-1.1.0.654.HP.zip (5.64 MB)Products:Filr 1.1Superceded Patches: None --------------------------------------------- https://download.novell.com/Download?buildid=3wpN2nVj2D8~ *** Filr - Security Update 3 *** --------------------------------------------- Abstract: This patch addresses the POODLE (Padding Oracle On Downgraded Legacy Encryption) vulnerability on the Filr 1.0.0 and 1.0.1 appliances.Document ID: 5194316Security Alert: YesDistribution Type: PublicEntitlement Required: NoFiles:readme-Filr-1.0.0-SU3.txt (2.49 kB)readme-Filr-1.0.1-SU3.txt (2.49 kB)Filr-1.0.0-SU3.zip (5.64 MB)Filr-1.0.1-SU3.zip (5.64 MB)Products:Filr 1.0Filr 1.0.1Superceded Patches: None --------------------------------------------- https://download.novell.com/Download?buildid=_N6A9M3Jvig~ *** Cisco IOS and IOS XE Software Ethernet Connectivity Fault Management Vulnerability *** --------------------------------------------- CVE-2014-3409 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Bugtraq: [SECURITY] [DSA 3055-1] pidgin security update *** --------------------------------------------- http://www.securityfocus.com/archive/1/533797 *** ZDI-14-368: Apple OS X GateKeeper Bypass Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple OS X. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-14-368/

1 0

Tageszusammenfassung - Donnerstag 23-10-2014
by Daily end-of-shift report 23 Oct '14

23 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 22-10-2014 18:00 − Donnerstag 23-10-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** New CVE-2014-4114 Attacks Seen One Week After Fix *** --------------------------------------------- Despite the availability of fixes related to the Sandworm vulnerability (CVE-2014-4114), we are still seeing new attacks related to this flaw. These attacks contain a new routine that could prevent detection. A New Evasion Technique In our analysis of the vulnerability, we noted this detail:... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/BYhEqtnNGxs/ *** NIST to hypervisor admins: secure your systems *** --------------------------------------------- Hypervisor security draft open for comment US standards body the National Institute of Standards and Technology (NIST) has laid out the basics of hypervisor security in a draft publication released for comment on 20 October. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/10/23/nist_to_hyp… *** Kommentar zur UEFI-Lücke: Sie lernen es einfach nicht *** --------------------------------------------- Sicherheitsexperten haben eine kritische Lücke entdeckt, die in vielen UEFI-Firmware-Versionen klafft - vor fast einem Jahr. Doch viele PC- und Mainboard-Hersteller wissen bisher nichts davon. Das ist untragbar. --------------------------------------------- http://www.heise.de/newsticker/meldung/Kommentar-zur-UEFI-Luecke-Sie-lernen… *** Linux Container Security *** --------------------------------------------- First, read these slides. Done? Good.Hypervisors present a smaller attack surface than containers. This is somewhat mitigated in containers by using seccomp, selinux and restricting capabilities in order to reduce the number of kernel entry points that untrusted code can touch, but even so there is simply a greater quantity of privileged code available to untrusted apps in a container environment when compared to a hypervisor environment[1].Does this mean containers provide reduced security? --------------------------------------------- http://mjg59.dreamwidth.org/33170.html *** Xen says its security policies might be buggier than its software *** --------------------------------------------- Users didnt know if they were allowed to patch bug behind world cloud reboot The Xen project has asked for help to ensure future bugs arent as disruptive as the XSA-108 flaw that saw major cloud operators reboot an awful lot of servers. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/10/23/xen_says_it… *** A look at a phishing website *** --------------------------------------------- Yesterday we came across a phishing website under .ch where we were able to download the phishing kit. A phishing kit is an archive file which contains all the relevant files for hosting a phishing website. In this case, the... --------------------------------------------- http://securityblog.switch.ch/2014/10/23/a-look-at-a-phishing-website/ *** Cisco Patches Three-Year-Old Telnet Remote Code Execution Bug in Security Appliances *** --------------------------------------------- There is a severe remote code execution vulnerability in a number of Cisco's security appliances, a bug that was first disclosed nearly three years ago. The vulnerability is in Telnet and there has been a Metasploit module available to exploit it for years. The FreeBSD Project first disclosed the vulnerability in telnet in December 2011... --------------------------------------------- http://threatpost.com/cisco-patches-three-year-old-telnet-remote-code-execu… *** Sicherheit: Apple verbietet SSLv3 für Push-Server *** --------------------------------------------- Entwickler, die den Apple-Push-Notification-Dienst nutzen, dürfen ab Ende des Monats nur noch TLS einsetzen. Grund ist die problematische "Poodle"-Lücke. --------------------------------------------- http://www.heise.de/security/meldung/Sicherheit-Apple-verbietet-SSLv3-fuer-… *** APPLE-SA-2014-10-22-1 QuickTime 7.7.6 *** --------------------------------------------- https://support.apple.com/kb/HT6493 *** VMSA-2014-0011 *** --------------------------------------------- VMware vSphere Data Protection product update addresses a critical information disclosure vulnerability. --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2014-0011.html *** TCP Vulnerabilities in Multiple Non-IOS Cisco Products *** --------------------------------------------- cisco-sa-20040420-tcp-nonios --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Wireshark Multiple Dissector Bugs Let Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1031111 *** [R2] SSLv3 Protocol Vulnerability Affects Tenable Products (POODLE) *** --------------------------------------------- October 19, 2014 --------------------------------------------- http://www.tenable.com/security/tns-2014-09 *** SA-CONTRIB-2014-102 - Document - Cross Site Scripting *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2014-102Project: Document (third-party module)Version: 6.x, 7.xDate: 2014-October-08Security risk: 8/25 ( Less Critical) AC:Basic/A:User/CI:None/II:None/E:Theoretical/TD:AllVulnerability: Cross Site ScriptingDescriptionDocument module is a basic Document Management System for Drupal. Cross Site Scripting (XSS)The module wasnt sanitizing user input sufficiently in a few use cases. This vulnerability is mitigated by the the fact that a user must have permissions to --------------------------------------------- https://www.drupal.org/node/2361617 *** SA-CONTRIB-2014-101 - Ubercart - Cross Site Request Forgery *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2014-101Project: Ubercart (third-party module)Version: 6.x, 7.xDate: 2014-October-22Security risk: 13/25 ( Moderately Critical) AC:None/A:Admin/CI:None/II:Some/E:Proof/TD:AllVulnerability: Cross Site Request ForgeryDescriptionThe Ubercart module provides a shopping cart and e-commerce features for Drupal.Cross Site Request Forgery (CSRF)The country administration links are not properly protected. A malicious user could trick a store administrator into enabling or --------------------------------------------- https://www.drupal.org/node/2361613 *** SA-CONTRIB-2014-100 - Bad Behavior - Information Disclosure *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2014-100Project: Bad Behavior (third-party module)Version: 6.x, 7.xDate: 2014-October-22Security risk: 15/25 ( Critical) AC:Basic/A:Admin/CI:Some/II:All/E:Theoretical/TD:AllVulnerability: Information DisclosureDescriptionThis module enables you to to target any malicious software directed at a Web site, whether it be a spambot, ill-designed search engine bot, or system crackers. It blocks such access and then logs their attempts.Information DisclosureThe module --------------------------------------------- https://www.drupal.org/node/2361611 *** IBM Security Bulletins for SSLv3 Vulnerability (POODLE) *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** Other IBM Security Bulletins *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin…

1 0

Tageszusammenfassung - Mittwoch 22-10-2014
by Daily end-of-shift report 22 Oct '14

22 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 21-10-2014 18:00 − Mittwoch 22-10-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Security Advisory 3010060 released *** --------------------------------------------- Today, we released Security Advisory 3010060 to provide additional protections regarding limited, targeted attacks directed at Microsoft Windows customers. A cyberattacker could cause remote code execution if someone is tricked into opening a maliciously-crafted PowerPoint document that contains an infected Object Linking and Embedding (OLE) file. As part of this Security Advisory, we have included an easy, one-click Fix it solution to address the known cyberattack. Please review the... --------------------------------------------- http://blogs.technet.com/b/msrc/archive/2014/10/21/security-advisory-301006… *** Android NFC hack allow users to have free rides in public transportation *** --------------------------------------------- More and more people keep talking about the feature of payments via NFC. The problem in this particular case is that somebody reversed the "Tarjeta BIP!" cards and found a means to re-charge them for free. --------------------------------------------- http://securelist.com/blog/virus-watch/67283/android-nfc-hack-allow-users-t… *** SSL-Verschlüsselung: Noch viel Arbeit für Mail-Provider und Banken *** --------------------------------------------- heise Security hat getestet und festgestellt, dass einige Mail-Provider bereits auf die jüngsten Angriffe auf Verschlüsselung reagiert haben - aber längst nicht alle. Schlimmer noch sieht es bei den Servern für das Online-Banking via HBCI aus. --------------------------------------------- http://www.heise.de/security/meldung/SSL-Verschluesselung-Noch-viel-Arbeit-… *** Malvertising Payload Targets Home Routers *** --------------------------------------------- A few weeks ago we wrote about compromised websites being used to attack your web routers at home by changing DNS settings. In that scenario the attackers embedded iFrames to do the heavy lifting, the short fall with this method is they require a website to inject the iFrame. As is often the case, tacticsRead More --------------------------------------------- http://blog.sucuri.net/2014/10/malvertising-payload-targets-home-routers.ht… *** Gezielte Angriffe über Onlinewerbung *** --------------------------------------------- Datendiebe haben offenbar mit manipulierter Onlinewerbung Rüstungs- und Luftfahrtkonzerne angegriffen. Die Werbung konnte über das so genannte Real Time Bidding gezielt platziert werden. --------------------------------------------- http://www.golem.de/news/phishing-gezielte-angriffe-ueber-onlinewerbung-141… *** Netzangriffe: DDoS-Botnetz weitet sich ungebremst aus *** --------------------------------------------- Ein kürzlich entdecktes Botnetz für DDoS-Angriffe breitet sich nach Angaben von Experten ungehemmt aus. Inzwischen seien auch Windows-Server gefährdet. Der Zweck der darüber gefahrenen Angriffe bleibt aber unklar. --------------------------------------------- http://www.golem.de/news/netzangriffe-ddos-botnetz-weitet-sich-ungebremst-a… *** Hostile Subdomain Takeover using Heroku/Github/Desk + more *** --------------------------------------------- Hackers can claim subdomains with the help of external services. This attack is practically non-traceable, and affects at least 17 large service providers and multiple domains are affected. Find out if you are one of them by using our quick tool, or go through your DNS-entries and remove all which are active and unused OR pointing to External Services which you do not use anymore. --------------------------------------------- http://blog.detectify.com/post/100600514143/hostile-subdomain-takeover-usin… *** TYPO3 CMS 4.5.37, 4.7.20, 6.1.12 and 6.2.6 released *** --------------------------------------------- IMPORTANT: These versions include important security fixes to the TYPO3 core. A security announcement has just been released: http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa… --------------------------------------------- https://typo3.org/news/article/typo3-cms-4537-4720-6112-and-626-released/ *** Security_Advisory-DLL Hijacking Vulnerability on Huawei USB Modem products *** --------------------------------------------- Oct 21, 2014 20:23 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** IBM Security Bulletin: Vulnerability in SSLv3 affects IBM WebSphere MQ, IBM WebSphere MQ Internet Pass-Thru and IBM Mobile Messaging and M2M Client Pack (CVE-2014-3566) *** --------------------------------------------- SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption (POODLE) attack. SSLv3 is enabled by default in IBM WebSphere MQ. CVE(s): CVE-2014-3566 Affected product(s) and affected version(s): The vulnerability affects all versions and releases of IBM WebSphere MQ, IBM WebSphere MQ Internet Pass-Thru and IBM Mobile Messaging and M2M Client Pack. --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** Bugtraq: FreeBSD Security Advisories *** --------------------------------------------- http://www.securityfocus.com/archive/1/533773 http://www.securityfocus.com/archive/1/533772 http://www.securityfocus.com/archive/1/533771 http://www.securityfocus.com/archive/1/533770 *** Bugtraq: File Manager v4.2.10 iOS - Code Execution Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/533778 *** Files Document & PDF Reader for iOS Ordner Erstellen code execution *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/97698

1 0

Tageszusammenfassung - Dienstag 21-10-2014
by Daily end-of-shift report 21 Oct '14

21 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 20-10-2014 18:00 − Dienstag 21-10-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Apple Multiple Security Updates, (Mon, Oct 20th) *** --------------------------------------------- Apple released security update today for iOS 8 and Apple TV 7. iOS 8.1 (APPLE-SA-2014-10-20-1 iOS 8.1) is now available for iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later, to addresses the following: Bluetooth CVE-2014-4448 House Arrest CVE-2014-4448 iCloud Data Access CVE-2014-4449 Keyboards CVE-2014-4450 Secure Transport CVE-2014-3566 Apple TV 7.0.1 (APPLE-SA-2014-10-20-2 Apple TV 7.0.1) is now available for Apple TV 3rd generation and later, to address the... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18857&rss *** Palo Alto Networks boxes spray firewall creds across the net *** --------------------------------------------- Crummy configurations to blame, Moore hardening offered as remedy Misconfigured user identities for Palo Alto Networks firewalls are leaking onto the public web potentially exposing customer services including VPN and webmail, says security luminary HD Moore. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/10/21/palo_alto_c… *** Download-Sicherheit: Blackberry muss App-Store nachbessern *** --------------------------------------------- Wegen fehlender Sicherung der Downloads aus Blackberry World, dem offiziellen App Store für alle Blackberry-10-Modelle, hätte ein Angreifer ganz leicht Schadsoftware auf die Geräte schmuggeln können. --------------------------------------------- http://www.heise.de/security/meldung/Download-Sicherheit-Blackberry-muss-Ap… *** CSAM Month of False Positives: Ghosts in the Pentest Report, (Tue, Oct 21st) *** --------------------------------------------- As part of most vulnerability assessments and penetration tests against a website, we almost always run some kind of scanner. Burp (commercial) and ZAP (free from OWASP) are two commonly used scanners. Once youve done a few website assessments, you start to get a feel for what pages and fields are likely candidates for exploit. But especially if its a vulnerability assessment, where youre trying to cover as many issues as possible (and exploits might even be out of scope), its always a safe bet --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18861&rss *** Delivering Malicious Android Apps Hidden In Image Files *** --------------------------------------------- An anonymous reader writes "Researchers have found a way to deliver a malicious app to Android users by hiding it into what seems to be an encrypted image file, which is then delivered via a legitimate, seemingly innocuous wrapper app. Fortinet malware researcher Axelle Apvrille and reverse engineer Ange Albertini created a custom tool they dubbed AngeCryption, which allows them to encrypt the payload Android application package (APK) and make it look like an image (PNG, JPG) file. --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/mKMqgWAvhIM/story01.htm *** Google Adds Hardware Security Key For Account Protection *** --------------------------------------------- Google is introducing an improved two-factor authentication system for Gmail and its other services that uses a tiny hardware token that will only work on legitimate Google sites. The new Security Key system is meant to help defeat attacks that rely on highly plausible fake sites that are designed to capture users' credentials. Attackers often go... --------------------------------------------- http://threatpost.com/google-adds-hardware-security-key-for-account-protect… *** R7-2014-17: NAT-PMP Implementation and Configuration Vulnerabilities *** --------------------------------------------- In the summer of 2014, Rapid7 Labs started scanning the public Internet for NAT-PMP as part of Project Sonar. NAT-PMP is a protocol implemented by many SOHO-class routers and networking devices that allows firewall and routing rules to be manipulated to enable internal, assumed trusted users behind a NAT device to allow external users to access internal TCP and UDP services for things like Apple's Back to My Mac and file/media sharing services. --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2014/10/21/r7-2014-1… *** Denial-of-service attacks - short but strong *** --------------------------------------------- DDoS amplification attacks continue to increase as attackers experiment with new protocols. Summary: DDoS amplification attacks continue to increase as attackers experiment with new protocols. read more --------------------------------------------- http://www.symantec.com/connect/blogs/denial-service-attacks-short-strong *** [R1] SSLv3 Protocol Vulnerability Affects Tenable Products (POODLE) *** --------------------------------------------- October 19, 2014 --------------------------------------------- http://www.tenable.com/security/tns-2014-09 *** Vuln: Zend Framework CVE-2014-8088 Authentication Bypass Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/70378 *** DSA-3054 mysql-5.5 *** --------------------------------------------- security update --------------------------------------------- http://www.debian.org/security/2014/dsa-3054 *** Asterisk SSL 3.0 Protocol Downgrade Flaw Lets Remote Users Decrypt SSL Traffic *** --------------------------------------------- http://www.securitytracker.com/id/1031078 *** HP Security Bulletins *** --------------------------------------------- http://www.securityfocus.com/archive/1/533732 http://www.securityfocus.com/archive/1/533733 http://www.securityfocus.com/archive/1/533736 http://www.securityfocus.com/archive/1/533737 http://www.securityfocus.com/archive/1/533738 http://www.securityfocus.com/archive/1/533739 http://www.securityfocus.com/archive/1/533740 http://www.securityfocus.com/archive/1/533742 http://www.securityfocus.com/archive/1/533754

1 0

Tageszusammenfassung - Montag 20-10-2014
by Daily end-of-shift report 20 Oct '14

20 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 17-10-2014 18:00 − Montag 20-10-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Erneut Sicherheitsupdates für PHP *** --------------------------------------------- Zum zweiten Mal im laufenden Monat veröffentlichten die PHP-Entwickler sicherheitsrelevante Patches für ihr Projekt. Allein im Versionszweig 5.6 haben sie vier Schwachstellen beseitigt. --------------------------------------------- http://www.heise.de/security/meldung/Erneut-Sicherheitsupdates-fuer-PHP-242… *** Spike in Malware Attacks on Aging ATMs *** --------------------------------------------- This author has long been fascinated with ATM skimmers, custom-made fraud devices designed to steal card data and PINs from unsuspecting users of compromised cash machines. But a recent spike in malicious software capable of infecting and jackpotting ATMs is shifting the focus away from innovative, high-tech skimming devices toward the rapidly aging ATM infrastructure in the United States and abroad. --------------------------------------------- http://krebsonsecurity.com/2014/10/spike-in-malware-attacks-on-aging-atms/ *** Breaking International Voicemail Security via VVM Exploitation *** --------------------------------------------- A few days ago, I gave a presentation at Ruxcon about breaking international voicemail security. Whilst the crowd and conference were absolutely amazing - my overall research, I think has a much wider scope in the terms of whom it could affect. This blog post acts as a technical writeup and companion to my slides presented at Ruxcon. TL;DR Briefly put, through researching the visual voicemail protocol, we were able to document a number of different vulnerabilities, including some which affected... --------------------------------------------- https://shubh.am/breaking-international-voicemail-security-via-vvm-exploita… *** Availability of SHA-2 Hashing Algorithm for Windows 7 and Windows Server 2008 R2 *** --------------------------------------------- V1.0 (October 14, 2014): Advisory published. V2.0 (October 17, 2014): Removed Download Center links for Microsoft security update 2949927. Microsoft recommends that customers experiencing issues uninstall this update. Microsoft is investigating behavior associated with this update, and will update the advisory when more information becomes available. --------------------------------------------- https://technet.microsoft.com/en-us/library/security/2949927 *** An Analysis of A Windows Kernel-Mode Vulnerability (CVE-2014-4113) *** --------------------------------------------- Three zero-day vulnerabilities - CVE-2014-4114, CVE-2014-4148, and CVE-2014-4113 - were reported last week and patched by Microsoft in their October 2014 Patch Tuesday. CVE-2014-4114, also known as the Sandworm vulnerability, can enable attackers to easily craft malware payloads when exploited. This particular vulnerability has been linked to targeted attacks against European sectors and industries. In addition, our researchers found that... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/vwOtSBJrH3I/ *** Smart Lock Devices: Security Risks and Opportunities *** --------------------------------------------- Security is one of the top concerns when consumers consider buying smart devices. With cybercrime making the headlines every day, one has to think: is this smart device vulnerable to cyber attacks? Are these technologies secure enough for us to rely on them in our everyday lives? A good example of a technology that we need... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/gtATHkHYNv4/ *** Black Hat Europe - day 2 *** --------------------------------------------- IPv6 versus IDPS, XSS in WYSIWYG editors, and reflected file downloads.After a busy first day, I was somewhat glad that the talks on the second day of Black Hat Europe appealed slightly less to my personal tastes and interests, as this gave me a chance to meet some old and new friends, and to have those conversations that perhaps form the heart of a security conference.I did attend three talks though, each of which was very interesting.Early in the morning, Antonios Atlasis, Enno Rey and Rafael... --------------------------------------------- http://www.virusbtn.com/blog/2014/10_20.xml?rss *** Dropbox-Server als Phishing-Helfer *** --------------------------------------------- Phishing-Mails verweisen meist auf dubiose Domains - nicht so in diesem Fall: Datensammler nutzen eine offizielle Dropbox-Domain, um Zugangsdaten aller Art abzugreifen. --------------------------------------------- http://www.heise.de/security/meldung/Dropbox-Server-als-Phishing-Helfer-242… *** Soundsquatting Unraveled: Homophone-based Domain Squatting *** --------------------------------------------- The Domain Name System (DNS) plays a vital role in the operation of the Internet. Over the years, it has been a primary target for malicious users looking for vulnerabilities in its protocol and infrastructure. Some examples include cache poisoning attacks, vulnerable DNS server implementations, and bogus user interactions. Taking advantage of users' spelling mistakes... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/Jv_ckUgwnAs/ *** Targeted Attack Protection via Network Topology Alteration *** --------------------------------------------- When it comes to targeted attacks, attackers are not omniscient. They need to gather information in the early stages to know the target they may gather information from various sources of intelligence, like Google, Whois, Twitter, and Facebook. They may gather data such as email addresses, IP ranges, and contact lists. These will then be used as... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/75OKb_Lt8XA/ *** Microsoft MSRT October Update, (Sun, Oct 19th) *** --------------------------------------------- This past week Microsoft MSRT push contains detections/removals for several widely used APT tools. The coalition (led by Novetta) that brought about the inclusions of these tools in this month MSRT, are encouraging enterprises to push/execute this month MSRT update. Some of malware included in this month MSRT update have a preliminary report posted here. If you are using either Snort or Sourcefire, the ruleIDs to detect some of the threat/family in this month MSRT release are listed below and... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18853&rss *** Staying in control of your browser: New detection changes *** --------------------------------------------- This week we made some important changes to how we detect browser modifiers and adware. These changes are designed to better protect your browsing experience. We have already blogged about the changes to the behaviors we detect as adware. I will explain the changes to our browser modifier detections below. Our objective criteria has all the details about how and why we detect unwanted software. Unacceptable behaviors There are two new browser modifier behaviors that we detect: Bypassing --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2014/10/17/staying-in-control-of-yo… *** Drupal SQL Injection Attempts in the Wild *** --------------------------------------------- Less than 48 hours ago, the Drupal team released an update (version 7.32) for a serious security vulnerability (SQL injection) that affected all versions of Drupal 7.x. In our last post, we talked about the vulnerability and that we expected to see attacks starting very soon due to how severe and easy it was to... --------------------------------------------- http://blog.sucuri.net/2014/10/drupal-sql-injection-attempts-in-the-wild.ht… *** Metasploit Weekly Wrapup: POODLE Mitigations *** --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2014/10/17/metasploi… *** OpenX multiple open redirect *** --------------------------------------------- OpenX could allow a remote attacker to conduct phishing attacks, caused by an open redirect vulnerability in the adclick.php and the ck.php scripts. By sending a specially-crafted URL, an attacker could exploit this vulnerability using the dest and _maxdest parameters to redirect a victim to arbitrary Web sites. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/97621 *** VMSA-2014-0010.13 *** --------------------------------------------- VMware product updates address critical Bash security vulnerabilities --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2014-0010.html *** Rich Counter 1.1.5 - Cross Site Scripting (XSS) *** --------------------------------------------- 2014-10-18T19:45:31 --------------------------------------------- https://wpvulndb.com/vulnerabilities/7648 *** Information Disclosure vulnerability in Dynamic Content Elements (dce) *** --------------------------------------------- It has been discovered that the extension "Dynamic Content Elements" (dce) is susceptible to Information Disclosure. --------------------------------------------- http://www.typo3.org/news/article/information-disclosure-vulnerability-in-d… *** DSA-3050 iceweasel *** --------------------------------------------- security update --------------------------------------------- http://www.debian.org/security/2014/dsa-3050 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Rational Service Tester (CVE-2014-4244, CVE-2014-4263) *** --------------------------------------------- There are multiple vulnerabilities in IBM SDK Java Technology Edition, Version 7 that is used by Rational Service Tester and were disclosed as part of the IBM Java SDK updates in July 2014. CVE(s): CVE-2014-4263 and CVE-2014-4244 Affected product(s) and affected version(s): Rational Service Tester versions 8.1 - 8.6 Refer to the following reference URLs for remediation and additional vulnerability details: Source Bulletin: http://www.ibm.com/support/docview.wss?uid=swg21685122 X-Force --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Rational Performance Tester (CVE-2014-4244, CVE-2014-4263) *** --------------------------------------------- There are multiple vulnerabilities in IBM SDK Java Technology Edition, Version 7 that is used by Rational Performance Tester and were disclosed as part of the IBM Java SDK updates in July 2014. CVE(s): CVE-2014-4263 and CVE-2014-4244 Affected product(s) and affected version(s): Rational Performance Tester versions 8.1 - 8.6 Refer to the following reference URLs for remediation and additional vulnerability details: Source Bulletin: http://www.ibm.com/support/docview.wss?uid=swg21685121 --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletin: Sametime Classic Meeting Record and Playback File Vulnerability (CVE-2014-4766) *** --------------------------------------------- A vulnerability in the Record and Playback (RAP) file that is exported by Classic Meeting (CVE-2014-4766). CVE(s): CVE-2014-4766 Affected product(s) and affected version(s): IBM Sametime Classic Meeting Server versions 8.0.x and 8.5.x Refer to the following reference URLs for remediation and additional vulnerability details: Source Bulletin: http://www-01.ibm.com/support/docview.wss?uid=swg21687361 X-Force Database: http://xforce.iss.net/xforce/xfdb/94793 --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin…

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily October 2014