Daily April 2014

daily@lists.cert.at

1 participants
21 discussions

Tageszusammenfassung - Mittwoch 30-04-2014
by Daily end-of-shift report 30 Apr '14

30 Apr '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 29-04-2014 18:00 − Mittwoch 30-04-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** PHP Callback Functions: Another Way to Hide Backdoors *** --------------------------------------------- We often find new techniques employed by malware authors. Some are very interesting, others are pretty funny, and then there are those that really stump us in their creativity and effectiveness. This post is about the latter. Everyone who writes code in PHP knows what the eval() function is .. --------------------------------------------- http://blog.sucuri.net/2014/04/php-callback-functions-another-way-to-hide-b… *** [papers] - Introduction to Android Malware Analysis *** --------------------------------------------- http://www.exploit-db.com/download_pdf/33093 *** Xen HVMOP_set_mem_type Page Transition Flaw Lets Local Users on the Guest System Cause Denial of Service Conditions on the Host System *** --------------------------------------------- http://www.securitytracker.com/id/1030160 *** "Bypassing endpoint protections" @ BSides London *** --------------------------------------------- This week I presented at BSides London. The talk is titled "Layers on layers: bypassing endpoint protection". The purpose of this talk is to reiterate on the (well-known) common weakness of most endpoint protection products - their reliance on kernel integrity. Once the attacker achieves arbitrary code execution in the kernel, there .. --------------------------------------------- http://labs.bromium.com/2014/04/29/bypassing-endpoint-protections-bsides-lo… *** Cisco WebEx Meetings Server Cross-Site Request Forgery Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Be on the Lookout: Odd DNS Traffic, Possible C&C Traffic, (Wed, Apr 30th) *** --------------------------------------------- We got an email from one of our readers, including an interesting port 53 packet. While Wireshark and TCPDump try to decode it as DNS, it is almost certainly not DNS. The payload of the packet is .. --------------------------------------------- http://isc.sans.edu/diary.html?storyid=18047&rss *** Mozilla Thunderbird Multiple Flaws Let Remote Users Execute Arbitrary Code, Deny Service, and Conduct Cross-Site Scripting Attacks and Local Users Gain Elevated Privileges *** --------------------------------------------- http://www.securitytracker.com/id/1030165 *** Mozilla Firefox Multiple Flaws Let Remote Users Execute Arbitrary Code, Deny Service, and Conduct Cross-Site Scripting Attacks and Local Users Gain Elevated Privileges *** --------------------------------------------- http://www.securitytracker.com/id/1030163 *** [2014-04-30] SQL injection and XSS vulnerabilities in Typo3 si_bibtex extension *** --------------------------------------------- By exploiting the SQL injection vulnerability in the Typo3 extension "si_bibtex", an attacker is able to gain full access to the Typo3 database. Depending on the location where the extension is used in the web application, this may be possible by an unauthenticated attacker. Furthermore, it is affected by persistent XSS. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2014… *** Symantec Encryption Desktop (PGP) Memory Access Flaws Let Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1030170 *** Friends dont let friends use Internet Explorer - advice from US, UK, EU *** --------------------------------------------- IE 6 to 11 at risk of hijacking, patch coming - but not for XP Microsoft has warned of a new security flaw in all versions of its Internet Explorer web browser for Windows PCs. A patch has yet to be released for the crocked code. --------------------------------------------- www.theregister.co.uk/2014/04/27/oops_we_did_it_again_microsoft_warns_of_ie… *** Botnetz für Altcoin-Mining nutzt Lücke in Nagiosüberwachung aus *** --------------------------------------------- Eine kürzlich veröffentlichte Sicherheitslücke im Netzwerkmonitor Nagios wird offenbar bereits ausgenutzt. Betroffen sind weit über 1000 weltweit verteilte Server, die für Mining-Zwecke missbraucht werden. --------------------------------------------- http://www.heise.de/newsticker/meldung/Botnetz-fuer-Altcoin-Mining-nutzt-Lu… *** Neuer Erpressungs-Trojaner verschlüsselt mit RSA-2048 *** --------------------------------------------- Es häufen sich Berichte über infizierte Windows-Systeme, auf denen ein Schadprogramm Dateien verschlüsselt und nur gegen Zahlung eines Lösegelds von 500 Euro wieder freigibt. Die sind via Tor in Bitcoins zu entrichten. --------------------------------------------- http://www.heise.de/security/meldung/Neuer-Erpressungs-Trojaner-verschluess… *** Protection strategies for the Security Advisory 2963983 IE 0day *** --------------------------------------------- We've received a number of customer inquiries about the workaround steps documented in Security Advisory 2963983 published on Saturday evening. We hope this blog post answers those questions. Steps you can take to stay safe The security advisory lists several options customers can take to stay safe. Those options are .. --------------------------------------------- http://blogs.technet.com/b/srd/archive/2014/04/30/protection-strategies-for… *** Six infosec tips I learned from Game of Thrones *** --------------------------------------------- In Westeros - the land of dark knights, backstabbing royals, dragons, wildings, wargs, red witches, and White Walkers - even the youngest ones have to learn basic self-defense if they're to have any hope of surviving the cruel fictional world imagined by A Game of Thrones (GOT) author, George R. R. Martin. And so too, must every CISO and security pro learn the latest information security best practices if they're to survive today's Internet threat landscape. --------------------------------------------- http://www.net-security.org/article.php?id=2001&p=1

1 0

Tageszusammenfassung - Dienstag 29-04-2014
by Daily end-of-shift report 29 Apr '14

29 Apr '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 28-04-2014 18:00 − Dienstag 29-04-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Update for Vulnerabilities in Adobe Flash Player in Internet Explorer - Version: 23.0 *** --------------------------------------------- https://technet.microsoft.com/en-us/library/security/2755801 *** Ubuntu 14.04 lockscreen bypass, (Mon, Apr 28th) *** --------------------------------------------- Upgraded to Ubuntu 14.04? Hold down enter to bypass the lockscreen (what is old is new again): https://bugs.launchpad.net/ubuntu/+source/unity/+bug/1308572 …" The reporter indicates that he was running Ubuntu 14.04 with all the packages updated. When the screen is locked with password, if holding ENTER, after some seconds the screen freezes and the lock screen .. --------------------------------------------- http://isc.sans.edu/diary.html?storyid=18039 *** Cisco ASA DHCPv6 Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Researchers warn of resurgent Sefnit malware *** --------------------------------------------- Botnet returns using new tactics A malware infection which drew headlines January has returned and is using new techniques to infect and spread amongst users. --------------------------------------------- www.theregister.co.uk/2014/04/29/researchers_warn_of_resurgent_sefnit_malwa… *** Citrix NetScaler Application Delivery Controller and NetScaler Gateway Multiple Security Updates *** --------------------------------------------- A number of security vulnerabilities have been identified in the management component of the Citrix NetScaler Application Delivery Controller .. --------------------------------------------- http://support.citrix.com/article/CTX140651 *** Massenhack bei AOL: Millionen Nutzer betroffen *** --------------------------------------------- Unbekannte verschaffen sich Zugang zu privaten Informationen - Unternehmen fordert zum ändern des Passworts auf --------------------------------------------- http://derstandard.at/1397521927406 *** The FireEye Advanced Threat Report 2013: European Edition *** --------------------------------------------- We recently published the 2013 FireEye Advanced Threat Report during RSA Conference, providing a global overview of the advanced attacks that FireEye discovered last year. We are now drilling that global analysis down into the European threat .. --------------------------------------------- http://www.fireeye.com/blog/corporate/2014/04/the-fireeye-advanced-threat-r… *** Cybercriminals Take Advantage Of Heartbleed With Spam *** --------------------------------------------- Since news about Heartbleed broke out earlier this month, the Internet has been full of updates, opinions and details about the vulnerability, with personalities ranging from security experts to celebrities talking about it. Being as opportunistic as they are, cybercriminals have taken notice of this and .. --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/RKpGQ6-RSA8/ *** Q1 2014 Mobile Threat Report *** --------------------------------------------- Our Mobile Threat Report for Q1 2014 is out! Heres a couple of the things we cover in it:The vast majority of the new threats found was on Android (no surprise there), which accounted for 275 out of 277 new families we saw in this period, leaving 1 new malware apiece on iOS and Symbian.In Q1, .. --------------------------------------------- http://www.f-secure.com/weblog/archives/00002699.html *** 6 free network vulnerability scanners *** --------------------------------------------- Vulnerability scanners can help you automate security auditing and can play a crucial role in your IT security. They can scan your network and websites for up to thousands of different security risks, produce a prioritized list of those you should patch, describe the vulnerabilities, and give steps on how to remediate them. Some can even automate the patching process. While these tools can .. --------------------------------------------- http://www.csoonline.com/article/2148841/data-protection/6-free-network-vul… *** Hashcat-Utils v1.0 Released *** --------------------------------------------- Hashcat-utils are a set of small utilities that are useful in advanced password cracking. They all are packed into multiple stand-alone binaries. All of these utils are designed to execute only one specific function. Since they all work with STDIN and STDOUT you can group them into chains. The programs are available for Linux and Windows on both 32 bit and 64 bit architectures. The programs are also available as open source. --------------------------------------------- http://www.toolswatch.org/2014/04/hashcat-utils-v1-0-released/

1 0

Tageszusammenfassung - Montag 28-04-2014
by Daily end-of-shift report 28 Apr '14

28 Apr '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 25-04-2014 18:00 − Montag 28-04-2014 18:00 Handler: Robert Waldner Co-Handler: n/a *** Using Facebook Notes to DDoS any website *** --------------------------------------------- Facebook Notes allows users to include tags. Whenever a tag is used, Facebook crawls the image from the external server and caches it. Facebook will only cache the image once however using random get parameters the cache can be by-passed and the feature can be abused to cause a huge HTTP GET flood. --------------------------------------------- http://chr13.com/2014/04/20/using-facebook-notes-to-ddos-any-website/ *** Mozilla entschlackt Zertifkats-Überprüfung *** --------------------------------------------- Statt 81.865 sind jetzt nur noch 4167 Zeilen Code zum überprüfen von SSL-Zertifikaten nötig. Wer Sicherheitslücken in darin findet, erhält einen üppigen Finderlohn. --------------------------------------------- http://www.heise.de/security/meldung/Mozilla-entschlackt-Zertifkats-Ueberpr… *** Examining the Heartbleed-based FUD thats pitched to the public *** --------------------------------------------- The Heartbleed vulnerability has created a massive news cycle, and generated technical risk-based discussions that might actually do some good. But some of these discussions boggle the mind, spreading misinformation in order to generate clicks or sales.When security issues hit the mass media, such as Heartbleed, there is a good deal of Fear, Uncertainty, and Doubt - better known as FUD - that gets promoted on the airwaves and in print. --------------------------------------------- http://www.csoonline.com/article/2148461/application-security/examining-the… *** Sicherheitslücke bei Messaging-App Viber aufgedeckt *** --------------------------------------------- Bilder, Videos und Standortdaten, die man mit der Messaging-App Viber übermittelt, werden unverschlüsselt auf Servern gespeichert. Der Zugang dazu ist äußerst einfach. --------------------------------------------- http://futurezone.at/digital-life/sicherheitsluecke-bei-messaging-app-viber… *** Microsoft Warns of Attacks on IE Zero-Day *** --------------------------------------------- Microsoft is warning Internet Explorer users about active attacks that attempt to exploit a previously unknown security flaw in every supported version of IE. The vulnerability could be used to silently install malicious software without any help from users, save for perhaps merely browsing to a hacked or malicious site. --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/PUm3t0AZZzc/ *** Neue Internet-Explorer-Lücke wird zum Ernstfall für Windows XP *** --------------------------------------------- Wird bereits aktiv ausgenutzt - Kein Update mehr für XP, andere Betriebssystemversion derzeit ebenfalls noch ungeschützt --------------------------------------------- http://derstandard.at/1397521804143 *** Biggest EU cyber security exercise to date: Cyber Europe 2014 taking place today *** --------------------------------------------- Today, 28 April 2014, European countries kick off the Cyber Europe 2014 (CE2014). CE2014 is a highly sophisticated cyber exercise, involving more than 600 security actors across Europe. --------------------------------------------- http://www.enisa.europa.eu/media/press-releases/biggest-eu-cyber-security-e… *** Cisco IOS XE Software Malformed L2TP Packet Vulnerability *** --------------------------------------------- A vulnerability in the Layer 2 Tunneling Protocol (L2TP) module of Cisco IOS XE on Cisco ASR 1000 Series Routers could allow an authenticated, remote attacker to cause a reload of the processing ESP card. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Security updates available for Adobe Flash Player (APSB14-13) *** --------------------------------------------- A Security Bulletin (APSB14-13) has been published regarding security updates for Adobe Flash Player. These updates address a critical vulnerability, and Adobe recommends users update their product installations to the latest versions --------------------------------------------- http://blogs.adobe.com/psirt/?p=1093

1 0

Tageszusammenfassung - Freitag 25-04-2014
by Daily end-of-shift report 25 Apr '14

25 Apr '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 24-04-2014 18:00 − Freitag 25-04-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Number of Sites Vulnerable to Heartbleed Plunges by Two-Thirds *** --------------------------------------------- Two weeks ago, we talked about how many sites in the top 1 million domains (as judged by Alexa) were vulnerable to the Heartbleed SSL vulnerability. How do things stand today? Figure 1. Sites vulnerable to Heartbleed as of April 22 Globally, the percentage of sites that is vulnerable to Heartbleed has fallen by two-thirds,... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/qyKz0tQVjAY/ *** Fareit trojan observed spreading Necurs, Zbot and CryptoLocker *** --------------------------------------------- The Necurs and Zbot trojans, as well as CryptoLocker ransomware, has been observed by researchers as being spread through another trojan, known as Fareit. --------------------------------------------- http://feedproxy.google.com/~r/SCMagazineHome/~3/XrcbQ8kwwQo/ *** It's Insanely Easy to Hack Hospital Equipment *** --------------------------------------------- When Scott Erven was given free reign to roam through all of the medical equipment used at a chain of large midwest health care facilities, he knew he would find security problems with the systems -- but he wasnt prepared for just how bad it would be. --------------------------------------------- http://feeds.wired.com/c/35185/f/661467/s/39be98e1/sc/36/l/0L0Swired0N0C20A… *** Update für Windows 7 außer der Reihe *** --------------------------------------------- Windows-7-Nutzer bekommen von der Update-Funktion derzeit ein Update mit der Nummer 2952664 angeboten. Irritierend daran: Es erscheint außer der Reihe und Microsoft verrät auch nicht, welche Probleme das Update genau behebt. --------------------------------------------- http://www.heise.de/newsticker/meldung/Update-fuer-Windows-7-ausser-der-Rei… *** Acunetix 8 Scanner Buffer overflow *** --------------------------------------------- Topic: Acunetix 8 Scanner Buffer overflow Risk: High Text:#!/usr/bin/python # Title: Acunetix Web Vulnerability Scanner Buffer Overflow Exploit # Version: 8 # Build: 20120704 # Test... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014040162 *** Security Notice-Statement on Patch Bypassing of Apache Struts2 *** --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-notices… *** Hitachi Multiple Products OpenSSL TLS/DTLS Heartbeat Two Information Disclosure Vulnerabilities *** --------------------------------------------- https://secunia.com/advisories/58022 *** Global Technology Associates GB-OS OpenSSL TLS/DTLS Heartbeat Two Information Disclosure Vulnerabilities *** --------------------------------------------- https://secunia.com/advisories/58007 *** Certec atvise scada OpenSSL Heartbleed Vulnerability *** --------------------------------------------- Researcher Bob Radvanovsky of Infracritical has notified NCCIC/ICS-CERT that Certec has released new libraries that mitigate the OpenSSL Heartbleed vulnerability in atvise scada.This vulnerability could be exploited remotely. Exploits that target the OpenSSL Heartbleed vulnerability are known to be publicly available. --------------------------------------------- http://ics-cert.us-cert.gov/advisories/ICSA-14-114-01 *** Siemens SIMATIC S7-1200 CPU Web Vulnerabilities *** --------------------------------------------- Siemens ProductCERT and Ralf Spenneberg, Hendrik Schwartke, and Maik Brüggemann from OpenSource Training have reported two vulnerabilities in the Siemens SIMATIC S7-1200 CPU family. Siemens has produced a new product release that mitigates these vulnerabilities. --------------------------------------------- http://ics-cert.us-cert.gov/advisories/ICSA-14-114-02 *** InduSoft Web Studio Directory Traversal Vulnerability *** --------------------------------------------- This advisory was originally posted to the US-CERT secure Portal library on April 17, 2014, and is now being released to the NCCIC/ICS-CERT web site. --------------------------------------------- http://ics-cert.us-cert.gov/advisories/ICSA-14-107-02 *** Festo CECX-X-(C1/M1) Controller Vulnerabilities *** --------------------------------------------- K. Reid Wightman of IOActive, Inc. has identified vulnerabilities in Festo’s CECX-X-C1 and CECX-X-M1 controllers. Festo has decided not to resolve these vulnerabilities because of compatibility reasons with existing engineering tools. This places critical infrastructure asset owners using this product at risk. This advisory is being published to alert critical infrastructure asset owners of the risk of using this equipment and for them to increase compensating measures if possible. --------------------------------------------- http://ics-cert.us-cert.gov/advisories/ICSA-14-084-01 *** Oracle Solaris ntpd Query Function Lets Remote Users Conduct Amplified Denial of Service Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1030142 *** Synology DiskStation Manager cUrl Connection Re-use and Certificate Verification Security Issues *** --------------------------------------------- https://secunia.com/advisories/58145 *** SSA-635659 (Last Update 2014-04-25): Heartbleed Vulnerability in Siemens Industrial Products *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** Halon Security Router Multiple Vulnerabilities *** --------------------------------------------- https://secunia.com/advisories/57507 *** HP Security Bulletins *** --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_…

1 0

Tageszusammenfassung - Donnerstag 24-04-2014
by Daily end-of-shift report 24 Apr '14

24 Apr '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 23-04-2014 18:00 − Donnerstag 24-04-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** NetSupport Information Leakage Using Nmap Script *** --------------------------------------------- NetSupport allows corporations to remotely manage and connect to PCs and servers from a central location for the purposes of desktop support. In my last post I discussed how I wrote a script using the NetSupport scripting language to find versions of NetSupport running on clients with default installations that didnt require authentication to remotely connect to them. Essentially you could use NetSupport to bypassany Domain or local credentials to remotely connect to the PC and... --------------------------------------------- http://blog.spiderlabs.com/2014/04/netsupport-information-leakage-using-nma… *** DHCPv6 and DUID Confusion, (Wed, Apr 23rd) *** --------------------------------------------- In IPv6, DHCP is taking somewhat a back seat to router advertisements. Many smaller networks are unlikely to use DHCP. However, in particular for Enterprise/larger networks, DHCPv6 still offers a lot of advantages when it comes to managing hosts and accounting for IP addresses in use. One of the big differences when it comes to DHCPv6 is that a host identifies itself with a DUID (DHCP Unique Identifier) which can be different from a MAC address. There are essentially three ways to come up with... --------------------------------------------- http://isc.sans.edu/diary.html?storyid=18015&rss *** Cisco: Hey, IT depts. Youre all malware hosts *** --------------------------------------------- Security report also notes skills shortage Everybody - at least every multinational that Cisco checked out for its 2014 Annual Security Report - is hosting malware of some kind, and there arent enough security professionals to go around. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/04/24/cisco_youre… *** DrDoS attacks to reach 800 Gbps in 2015 *** --------------------------------------------- While the network time protocol (NTP) DrDoS threats that became prevalent in early 2014 have been contained, new distributed reflected denial of service threats will lead to attacks in excess of 800 Gbps during the next 12 to 18 months. --------------------------------------------- http://www.net-security.org/secworld.php?id=16733 *** Zero-Day-Lücke in Apache Struts 2 *** --------------------------------------------- Durch eine kleine Abwandlung einer bereits gepatchten Lücke können Angreifer wieder Code in den Server einschleusen. --------------------------------------------- http://www.heise.de/security/meldung/Zero-Day-Luecke-in-Apache-Struts-2-217… *** Situational Awareness Alert for OpenSSL Vulnerability (Update D) *** --------------------------------------------- This alert update is a follow-up to the updated NCCIC/ICS-CERT Alert titled ICS-ALERT-14-009-01C Situational Awareness Alert for OpenSSL Vulnerability that was published April 17, 2014, on the ICS-CERT web site. --------------------------------------------- http://ics-cert.us-cert.gov/alerts/ICS-ALERT-14-099-01D *** Drupal - Vulnerabilities in Third-Party Modules *** --------------------------------------------- https://drupal.org/node/2248073 https://drupal.org/node/2248077 https://drupal.org/node/2248145 https://drupal.org/node/2248171 *** Attachmate Reflection OpenSSL TLS Heartbeat Buffer Overread Lets Remote Users Obtain Potentially Sensitive Information *** --------------------------------------------- http://www.securitytracker.com/id/1030144 *** Bugtraq: Weak firmware encryption and predictable WPA key on Sitecom routers *** --------------------------------------------- http://www.securityfocus.com/archive/1/531920 *** SSA-892012 (Last Update 2014-04-24): Web Vulnerabilities in SIMATIC S7-1200 CPU *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** Vuln: Check_MK Multiple Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/bid/66389 http://www.securityfocus.com/bid/66391 http://www.securityfocus.com/bid/66394 http://www.securityfocus.com/bid/66396 *** Notice: (Revision) CUSTOMER ATTENTION REQUIRED: HP Integrated Lights-Out and Integrated Lights-Out 2 - Scanning First-Generation iLO or iLO 2 Devices for the Heartbleed Vulnerability Results in iLO Lockup Requiring Power to be PHYSICALLY Removed *** --------------------------------------------- The first-generation iLO and iLO 2 products use the RSA SSL libraries and there is a bug in these libraries that will cause first-generation iLO and iLO 2 devices to enter a live lockup situation when a vulnerability scanner runs to check for the Heartbleed vulnerability. Although the servers operating system will continue to function normally, first-generation iLO and iLO 2 will no longer be responsive over the management network. --------------------------------------------- http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDispl… *** HPSBHF03006 rev.1 - HP Integrated Lights-Out 2 (iLO 2) Denial of Service *** --------------------------------------------- A potential security vulnerability has been identified in HP Integrated Lights-Out 2 (iLO 2) servers that allows for a Denial of Service. The denial of service condition occurs only when the iLO 2 is scanned by vulnerability assessment tools that test for CVE-2014-0160 (Heartbleed vulnerability). --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** HP Security Bulletins for CVE 2014-0160 *** --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** Vuln: EMC Connectrix Manager Converged Network Edition Remote Information Disclosure Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/66308

1 0

Tageszusammenfassung - Mittwoch 23-04-2014
by Daily end-of-shift report 23 Apr '14

23 Apr '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 22-04-2014 18:00 − Mittwoch 23-04-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Wartungsarbeiten Mailing-Listen-Server 24. April 2014 *** --------------------------------------------- Am Nachmittag des 24. April werden wir Wartungsarbeiten an unserem Mailing-Listen-Server (lists.cert.at) durchführen. Auswirkungen: verzögerte Zustellung von Listen-Mails Administrations-Interface (Subscribe/Unsubscribe etc.) der Mailing-Listen nicht verfügbar Mailing-Listen-Archive nicht verfügbar. Wir werden uns bemühen, die Ausfälle so kurz wie möglich zu halten, können jedoch keine genaue... --------------------------------------------- http://www.cert.at/services/blog/20140423085410-1134.html *** DBIR: Poor Patching, Weak Credentials Open Door to Data Breaches *** --------------------------------------------- Weak or default credentials, poor configurations and a lack of patching are common denominators in most data breaches, according to the 2014 Verizon Data Breach Investigations Report. --------------------------------------------- http://threatpost.com/dbir-poor-patching-weak-credentials-open-door-to-data… *** Millions Feedly users vulnerable to Javascript Injection attack *** --------------------------------------------- A security researcher discovered a serious Javascript Injection vulnerability in the popular Feedly Android App impacting Millions Users. --------------------------------------------- http://securityaffairs.co/wordpress/24209/hacking/feedly-javascript-vulnera… *** Apple stopft Sicherheitslücken in iOS, OS X und WLAN-Basisstationen *** --------------------------------------------- Die Updates sollen kritische Schwachstellen in Apples Betriebssystemen beseitigen - darunter eine weitere Lücke, die das Ausspähen von SSL-Verbindungen erlaubt. Für die AirPort-Stationen steht ein Heartbleed-Fix bereit. --------------------------------------------- http://www.heise.de/security/meldung/Apple-stopft-Sicherheitsluecken-in-iOS… *** Operation Francophoned: The Persistence and Evolution of a Dual-Pronged Social Engineering Attack *** --------------------------------------------- Operation Francophoned, first uncovered by Symantec in May 2013, involved organizations receiving direct phone calls and spear phishing emails impersonating a known telecommunication provider in France, all in an effort to install malware and steal information and ultimately money from targets. --------------------------------------------- http://www.symantec.com/connect/blogs/operation-francophoned-persistence-an… *** Blog: An SMS Trojan with global ambitions *** --------------------------------------------- Recently, we’ve seen SMS Trojans starting to appear in more and more countries. One prominent example is Trojan-SMS.AndroidOS.Stealer.a: this Trojan came top in Kaspersky Lab's recent mobile malware ТОР 20. It can currently send short messages to premium-rate numbers in 14 countries around the world. --------------------------------------------- http://www.securelist.com/en/blog/8209/An_SMS_Trojan_with_global_ambitions *** ISC stellt Entwicklung an seinem BIND10-DNS-Server ein *** --------------------------------------------- Das Unternehmen hat die letzte von ihm entwickelte Version veröffentlicht und zieht sich aus der weiteren Entwicklung zurück. Dabei sollte BIND10 ursprünglich BIND9 ablösen, das seinerzeit Hochleistungs-Server nur unzureichend ausschöpfen konnte. --------------------------------------------- http://www.heise.de/newsticker/meldung/ISC-stellt-Entwicklung-an-seinem-BIN… *** Nine patterns make up 92 percent of security incidents *** --------------------------------------------- Verizon security researchers have found that 92 percent of the 100,000 security incidents analyzed over the past ten years can be traced to nine basic attack patterns that vary from industry to industry. --------------------------------------------- http://www.net-security.org/secworld.php?id=16725 *** Dissecting the unpredictable DDoS landscape *** --------------------------------------------- DDoS attacks are now more unpredictable and damaging than ever, crippling websites, shutting down operations, and costing millions of dollars in downtime, customer support and brand damage, according to Neustar. --------------------------------------------- http://www.net-security.org/secworld.php?id=16726 *** Special Edition of OUCH: Heartbleed - Why Do I Care? http://www.securingthehuman.org/newsletters/ouch/issues/OUCH-2014-special_e…, (Wed, Apr 23rd) *** --------------------------------------------- -- Alex Stanford - GIAC GWEB, Research Operations Manager, SANS Internet Storm Center (c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. --------------------------------------------- http://isc.sans.edu/diary.html?storyid=18013&rss *** Apple splats new SSL snooping bug in iOS, OS X - but its no Heartbleed *** --------------------------------------------- Triple-handshake flaw stalks Macs and iThings Apple has squashed a significant security bug in its SSL engine for iOS and OS X as part of a slew of patches for iThings and Macs. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/04/23/apple_ssl_u… *** Joomla Plugin Constructor Backdoor *** --------------------------------------------- We recently wrote about backdoors in pirated commercial WordPress plugins. This time it will be a short post about an interesting backdoor we found in a Joomla plugin. It was so well organized that at first we didn't realize there was a backdoor even though we knew something was wrong. That's how the code of... --------------------------------------------- http://blog.sucuri.net/2014/04/joomla-plugin-constructor-backdoor.html *** Citrix Security Advisory for CVE-2014-0160, aka the Heartbleed vulnerability *** --------------------------------------------- A vulnerability has been recently disclosed in OpenSSL that could result in remote attackers being able to obtain sensitive data from the process address space of a vulnerable OpenSS... --------------------------------------------- http://support.citrix.com/article/CTX140605 *** IBM PSIRT - OpenSSL Heartbleed (CVE-2014-0160) *** --------------------------------------------- We will continue to update this blog to include information about products. The following is a list of products affected by the Heartbleed vulnerability. Please follow the links below to view the security bulletins for the affected products. --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/openssl_heartbleed_cv… *** Information on Norton products and the Heartbleed vulnerability *** --------------------------------------------- This article answers many of the questions that are currently being asked about the Heartbleed bug and the role that Norton products play in defending against this attack. --------------------------------------------- https://support.norton.com/sp/en/us/home/current/solutions/v98431836_EndUse… *** OpenSSL Security Vulnerability - aka. "Heartbleed Bug" - CVE-2014-0160 - Security Incident Response for D-Link Devices and Services *** --------------------------------------------- D-Link is investigating all devices and systems that utilize the OpenSSL software library to determine if our devices and customers are affected by this security vulnerability. You will find current status below and can contact us at security(a)dlink.com about specific questions. --------------------------------------------- http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10022 *** Heartbleed Vulnerability in Various Products *** --------------------------------------------- http://tomcat.apache.org/native-doc/news/2014.html http://tomcat.apache.org/native-doc/miscellaneous/changelog.html http://www.fortiguard.com/advisory/FG-IR-14-011/ http://www.sybase.com/detail?id=1099387 https://secunia.com/advisories/58188 (Symantec Multiple Products) https://secunia.com/advisories/58148 (Xerox WorkCentre 3315/3325) *** VU#350089: IBM Notes and Domino on x86 Linux specify an executable stack *** --------------------------------------------- Vulnerability Note VU#350089 IBM Notes and Domino on x86 Linux specify an executable stack Original Release date: 22 Apr 2014 | Last revised: 22 Apr 2014 Overview IBM Notes and Domino on x86 Linux are incorrectly built requesting an executable stack. This can make it easier for attackers to exploit vulnerabilities in Notes, Domino, and any of the child processes that they may spawn. Description The build environment for the x86 Linux versions of IBM Notes and Domino incorrectly specified the... --------------------------------------------- http://www.kb.cert.org/vuls/id/350089 *** Cisco ASA SIP Inspection Memory Leak Vulnerability *** --------------------------------------------- A vulnerability in the Session Initiation Protocol (SIP) inspection engine code could allow an unauthenticated, remote attacker to cause a slow memory leak, which may cause instability on the affected system. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** AirPort Extreme and AirPort Time Capsule OpenSSL TLS Heartbeat Buffer Overread Lets Remote Users Obtain Potentially Sensitive Information *** --------------------------------------------- http://www.securitytracker.com/id/1030132 *** Apple OS X Multiple Bugs Let Remote Users Execute Arbitrary Code and Deny Service and Local Users Gain Elevated Privileges *** --------------------------------------------- http://www.securitytracker.com/id/1030133 *** Sixnet Sixview 2.4.1 Directory Traversal *** --------------------------------------------- Topic: Sixnet Sixview 2.4.1 Directory Traversal Risk: Medium Text:#Exploit Title: Sixnet sixview web console directory traversal #Date: 2014-04-21 #Exploit Author: daniel svartman #Vendor Ho... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014040150 *** Parallels Plesk Panel 12.x Key Disclosure *** --------------------------------------------- Topic: Parallels Plesk Panel 12.x Key Disclosure Risk: High Text:While auditing the source code for Parallels Plesk Panel 12.x on Linux I noticed the following feature that leads to leakage o... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014040151 *** [2014-04-23] Path Traversal/Remote Code Execution in WD Arkeia Network Backup Appliances *** --------------------------------------------- An unauthenticated remote attacker can exploit the identified Path Traversal vulnerability in order to retrieve arbitrary files from the affected WD Arkeia Network Backup appliances and execute system commands. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2014… *** Security Advisory-Improper Input Validation Vulnerability on Multiple Quidway Switch Products *** --------------------------------------------- Once exploited, the vulnerability might cause a excessive resource (e.g. memory) consumption of the vulnerable system and even cause the system to restart in serious cases. --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** HP Security Bulletins *** --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** Security Advisories Relating to Symantec Products - Symantec Messaging Gateway Management Console Reflected XSS *** --------------------------------------------- Symantec's Messaging Gateway management console is susceptible to a reflected cross-site scripting (XSS) issue found in one of the administrative interface pages. Successful exploitation could result in potential session hijacking or unauthorized actions directed against the console with the privileges of the targeted user's browser. --------------------------------------------- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=se… *** Security Bulletin: IBM Sterling Order Management is affected by Cross Site Scripting (XSS) Vulnerability (CVE-2014-0932) *** --------------------------------------------- IBM Sterling Order Management is vulnerable to a cross-site scripting attack which could lead to unauthorized access through the injected scripts. --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg21670912 *** Django Security Issue and Multiple Vulnerabilities *** --------------------------------------------- A security issue and multiple vulnerabilities have been reported in Django, which can be exploited by malicious people to potentially disclose certain sensitive information, manipulate certain data, and compromise a vulnerable system. --------------------------------------------- https://secunia.com/advisories/58201 *** Hitachi Multiple Cosminexus / uCosminexus Products Java Multiple Vulnerabilities *** --------------------------------------------- https://secunia.com/advisories/58197 *** Hitachi Multiple Cosminexus / uCosminexus Products SSL/TLS Initialization Vector Selection Weakness *** --------------------------------------------- https://secunia.com/advisories/58240

1 0

Tageszusammenfassung - Dienstag 22-04-2014
by Daily end-of-shift report 22 Apr '14

22 Apr '14

======================= = Heartbleed Report = = a.k.a = = End-of-Shift report = ======================= Timeframe: Freitag 18-04-2014 18:00 − Dienstag 22-04-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Amplification, reflection DDoS attacks increase 35 percent in Q1 2014 *** --------------------------------------------- The Q1 2014 Global DDoS Attack Report reveals that amplification and reflection distributed denial-of-service attacks are on the rise. --------------------------------------------- http://feedproxy.google.com/~r/SCMagazineHome/~3/GljZsrx9WMs/ *** Das Router-Desaster: Fritzbox-Update gerät ins Stocken *** --------------------------------------------- Aktuelle Scan-Ergebnisse belegen, dass die Verbreitung des kritischen Sicherheits-Updates kaum voranschreitet. In vielen Fällen werden verwundbare Fritzboxen sogar noch mit aktivem Fernzugriff betrieben - eine gefährliche Mischung. --------------------------------------------- http://www.heise.de/security/meldung/Das-Router-Desaster-Fritzbox-Update-ge… *** Home entertainment implementations are pretty appaling *** --------------------------------------------- I picked up a Panasonic BDT-230 a couple of months ago. Then I discovered that even though it appeared fairly straightforward to make it DVD region free (I have a large pile of PAL region 2 DVDs), the US models refuse to play back PAL content. We live in an era of software-defined functionality. While Panasonic could have designed a separate hardware SKU with a hard block on PAL output, that would seem like unnecessary expense. So, playing with the firmware seemed like a reasonable... --------------------------------------------- http://mjg59.dreamwidth.org/31178.html *** OpenSSL Rampage, (Mon, Apr 21st) *** --------------------------------------------- OpenSSL, in spite of its name, isnt really a part of the OpenBSD project. But as one of the more positive results of the recent Heartbleed fiasco, the OpenBSD developers, who are known for their focus on readable and secure code, have now started a full-scale review and cleanup of the OpenSSL codebase. If you are interested in writing secure code in C (not necessarily a contradiction in terms), I recommend you take a look at http://opensslrampage.org/archive/2014/4, where the OpenBSD-OpenSSL... --------------------------------------------- http://isc.sans.edu/diary.html?storyid=17997&rss *** Mysterious iOS malware campaign has Chinese origins *** --------------------------------------------- The threat, dubbed "Unflod Baby Panda," was discovered by Reddit users and analyzed by researchers at the German-based security firm, SektionEins. --------------------------------------------- http://feedproxy.google.com/~r/SCMagazineHome/~3/_EB9Qixb5Vk/ *** Easter egg: DSL router patch merely hides backdoor instead of closing it *** --------------------------------------------- Researcher finds secret "knock" opens admin for some Linksys, Netgear routers. --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/MBqOOgJa9Ng/ *** Feedly fixes Android JavaScript code injection flaw, deems it "harmless" *** --------------------------------------------- A researcher wrote about a bug in the Android app for news aggregator Feedly that could enable JavaScript code injection, but even though it was fixed, the company did not really consider it a vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/SCMagazineHome/~3/lZyhHF8qR8o/ *** Report: Google looks to integrate PGP with Gmail *** --------------------------------------------- Pretty Good Privacy, or PGP, is an encryption method that was created in the early 90s. --------------------------------------------- http://feedproxy.google.com/~r/SCMagazineHome/~3/pxVEyRndi7A/ *** Weekly Metasploit Update: Heartbleed and Firefox Passwords *** --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2014/04/17/weekly-me… *** Critical update makes P2P Zeus trojan even tougher to remove *** --------------------------------------------- An update to the P2P Zeus banking trojan results in the installation of a rootkit driver that makes deleting the malware even tougher. --------------------------------------------- http://feedproxy.google.com/~r/SCMagazineHome/~3/EIQ5YrV1__8/ *** Sicherheitslücke beim Netzwerkmonitor Nagios *** --------------------------------------------- Der "Nagios Remote Plugin Executor" führt unter Umständen eingeschleuste Befehle aus. Diese Umstände deuten allerdings schon auf eine generell unsichere Konfiguration hin. --------------------------------------------- http://www.heise.de/security/meldung/Sicherheitsluecke-beim-Netzwerkmonitor… *** Ein Viertel der Internetnutzer wechselt nie die Passwörter *** --------------------------------------------- Trotz Heartbleed wechselt weiterhin rund ein Viertel aller deutschen Internetnutzer nie ihr Passwort. Ein Drittel der Befragten verwendet ein Passwort auf mehreren Plattformen. --------------------------------------------- http://futurezone.at/digital-life/ein-viertel-der-internetnutzer-wechselt-n… *** Heartbleed und das Sperrproblem von SSL *** --------------------------------------------- Nach dem Beseitigen des Heartbleed-Problems sperrten viele Admins vorsorglich ihre SSL-Zertifikate und besorgten sich neue. Trotzdem bedeuten geklaute Server-Schlüssel auch weiterhin ein Problem - denn das Sperren funktioniert eigentlich nicht. --------------------------------------------- http://www.heise.de/security/meldung/Heartbleed-und-das-Sperrproblem-von-SS… *** OpenSSL ssl3_read_bytes denial of service *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/92632 *** Alert for CVE-2014-0160 *** --------------------------------------------- This Security Alert addresses CVE-2014-0160 ('Heartbleed'), a publicly disclosed vulnerability which affects multiple OpenSSL versions implemented by various vendors in their products. This vulnerability affects multiple Oracle products. This vulnerability may be remotely exploitable without authentication, i.e. it may be exploited over a network without the need for a username and password. A remote user can exploit this vulnerability to impact the confidentiality of systems that are running affected versions of OpenSSL. According to http://heartbleed.com, the compromised data may contain passwords, private keys, and other sensitive information. In some instances, this information could be used by a malicious attacker to log into systems using a stolen identity or decrypt private information that was sent months or years ago. --------------------------------------------- http://www.oracle.com/technetwork/topics/security/alert-cve-2014-0160-21907… *** Winamp Buffer Overflow and Pointer Dereference Bugs Let Remote Users Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1030107 *** VMSA-2014-0004.6 *** --------------------------------------------- VMware product updates address OpenSSL security vulnerabilities --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2014-0004.html *** F5 - Various Vulnerabilities in Multiple Products *** --------------------------------------------- https://secunia.com/advisories/58157 https://secunia.com/advisories/58159 https://secunia.com/advisories/58154 https://secunia.com/advisories/58160 *** Check Point Mobile VPN for iOS and for Android OpenSSL Heartbeat Two Information Disclosure Vulnerabilities *** --------------------------------------------- https://secunia.com/advisories/57947 *** VU#622950: Toshiba Global Commerce Solutions 4690 Point of Sale operating system contains a password hashing algorithm that can be reversed *** --------------------------------------------- Vulnerability Note VU#622950 Toshiba Global Commerce Solutions 4690 Point of Sale operating system contains a password hashing algorithm that can be reversed Original Release date: 21 Apr 2014 | Last revised: 21 Apr 2014 Overview Toshiba Global Commerce Solutions 4690 Point of Sale operating system contains a password hashing algorithm that can be reversed. (CWE-328) Description Toshiba Global Commerce Solutions 4690 Point of Sale operating system contains a password hashing algorithm that --------------------------------------------- http://www.kb.cert.org/vuls/id/622950 *** Bugzilla Input Validation Flaw Permits Cross-Site Request Forgery Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1030128 *** SonicWALL Multiple Products OpenSSL TLS/DTLS Heartbeat Two Information Disclosure Vulnerabilities *** --------------------------------------------- https://secunia.com/advisories/58146 *** CA Multiple Products OpenSSL TLS/DTLS Heartbeat Information Disclosure Vulnerabilities *** --------------------------------------------- https://secunia.com/advisories/58019 *** Tenable SecurityCenter OpenSSL TLS/DTLS Heartbeat Two Information Disclosure Vulnerabilities *** --------------------------------------------- https://secunia.com/advisories/58182 *** IBM OS/400 Weakness and Multiple Vulnerabilities *** --------------------------------------------- https://secunia.com/advisories/57826 *** ADTRAN Multiple Products OpenSSL TLS/DTLS Heartbeat Two Information Disclosure Vulnerabilities *** --------------------------------------------- https://secunia.com/advisories/58172 *** Vulnerabilities in multiple HP Products *** --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** BlackBerry Enterprise Service OpenSSL TLS/DTLS Heartbeat Two Information Disclosure Vulnerabilities *** --------------------------------------------- https://secunia.com/advisories/58244 *** IBM Security Bulletins *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_ds8… https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_ibm… https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_ope… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/title_ibm_endpoint_ma… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_pow… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entryhttps://www-304.ibm.co… https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_fle… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_ts3… https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_pow… https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_ibm… https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_ibm… https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_san…

1 0

Tageszusammenfassung - Freitag 18-04-2014
by Daily end-of-shift report 18 Apr '14

18 Apr '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 17-04-2014 18:00 − Freitag 18-04-2014 18:00 Handler: Alexander Riepl Co-Handler: Stephan Richter *** Looking for malicious traffic in electrical SCADA networks - part 2 - solving problems with DNP3 Secure Authentication Version 5, (Thu, Apr 17th) *** --------------------------------------------- I received this week a very valuable e-mail from the DNP Technical Committee Chair, Mr. Adrew West, who pointed an excellent observation and its the very slow adoption of DNP3 Secure Authentication Version 5, which is the latest security enhancement for the DNP3 protocol. I want to talk today about this standard and the advantages of adopting it into your DNP3 SCADA system. This standard has two specific objectives: Help DNP3 outstation to determine beyond any reasonable doubt that its... --------------------------------------------- http://isc.sans.edu/diary.html?storyid=17981&rss *** Heartbleed Bug Sends Bandwidth Costs Skyrocketing *** --------------------------------------------- The exposure of the Heartbleed vulnerability last week had a number of repercussions, one of which was to set off a mad scramble by companies to revoke the SSL certificates for their domains and services and obtain new ones. The total costs of Heartbleed are yet to be calculated, but CloudFlare has come up with... --------------------------------------------- http://feeds.wired.com/c/35185/f/661467/s/397cb2f7/sc/5/l/0L0Swired0N0C20A1… *** Heartbleed bereitet Anonymisierungsnetzwerk Tor Schwierigkeiten *** --------------------------------------------- Rund ein Fünftel der Exit Nodes von OpenSSL-Lücke betroffen - Vorschlag diese aus dem Netz zu werfen... --------------------------------------------- http://derstandard.at/1397520979826 *** Mac OS X Trojans display ads *** --------------------------------------------- April 16, 2014 Malicious programs designed to generate a profit for intruders by displaying annoying ads are very common, but until recently they have mostly been a nuisance for Windows users. Thats why a few Trojans that were recently examined by Doctor Webs security researchers stand out among such applications... --------------------------------------------- http://news.drweb.com/show/?i=4352&lng=en&c=9 *** Heartbleed Update *** --------------------------------------------- Adobe has evaluated the Creative Cloud and its related services (including Behance and Digital Publishing Suite), the Marketing Cloud solutions and products (including Analytics, Analytics Premium and Experience Manager), EchoSign, Acrobat.com, the Adobe.com store, and other Adobe services. All Adobe internet-facing services known to have been using a version of OpenSSL containing the Heartbleed vulnerability have been mitigated. We are continuing our analysis of Adobe internet-facing servers to identify and remediate any remaining Heartbleed-related risks. --------------------------------------------- http://blogs.adobe.com/psirt/?p=1085 *** Security Advisory-OpenSSL Heartbeat Extension vulnerability (Heartbleed bug) on Huawei multiple products *** --------------------------------------------- Some OpenSSL software versions used in multiple Huawei products have the following OpenSSL vulnerability. Unauthorized remote attackers can dump 64 Kbytes of memory of the connected server or client in each attack. The leaked memory may contain sensitive information, such as passwords and private keys (Vulnerability ID: HWPSIRT-2014-0414). --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** McAfee Security Bulletin - OpenSSL Heartbleed vulnerability patched in McAfee products *** --------------------------------------------- Several McAfee products are vulnerable to OpenSSL Heartbleed. See the McAfee Product Vulnerability Status lists below for the status of each product. --------------------------------------------- https://kc.mcafee.com/corporate/index?page=content&id=SB10071 *** Nagios Remote Plugin Executor 2.15 Remote Command Execution *** --------------------------------------------- Topic: Nagios Remote Plugin Executor 2.15 Remote Command Execution Risk: High Text: - Release date: 17.04.2014 - Discovered by: Dawid Golunski - Severity: High I. VULNER... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014040126 *** MariaDB Multiple Vulnerabilities *** --------------------------------------------- https://secunia.com/advisories/58106 *** Debian update for qemu and qemu-kvm *** --------------------------------------------- https://secunia.com/advisories/58088 *** OpenVZ update for kernel *** --------------------------------------------- https://secunia.com/advisories/58060

1 0

Tageszusammenfassung - Donnerstag 17-04-2014
by Daily end-of-shift report 17 Apr '14

17 Apr '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 16-04-2014 18:00 − Donnerstag 17-04-2014 18:00 Handler: Alexander Riepl Co-Handler: Robert Waldner *** Entwickler-Modus gefährdet Blackberries *** --------------------------------------------- Bei aktiviertem Entwickler-Modus können Angreifer über das WLAN oder die USB-Verbindung Schadcode mit vollen Root-Rechten ausführen. Wird der Modus wieder abgeschaltet, ist das Gerät immer noch bis zum nächsten Neustart angreifbar. --------------------------------------------- http://www.heise.de/security/meldung/Entwickler-Modus-gefaehrdet-Blackberri… *** Heartbleed: BSI sieht keinen Grund für Entwarnung *** --------------------------------------------- Das Bundesamt für Sicherheit in der Informationstechnik sieht beim "Heartbleed Bug" weiteren Handlungsbedarf. Kleinere Websites sind nach wie vor verwundbar, auch nehmen Angreifer jetzt andere Dienste ins Visier. --------------------------------------------- http://www.heise.de/security/meldung/Heartbleed-BSI-sieht-keinen-Grund-fuer… *** Bugtraq: [SECURITY] [DSA 2907-1] Announcement of long term support for Debian oldstable *** --------------------------------------------- http://www.securityfocus.com/archive/1/531856 *** mAdserve id SQL injection *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/92545 *** SA-CONTRIB-2014-041 - Block Search - SQL Injection *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2014-041 Project: Block Search (third-party module) Version: 6.x Date: 2014-April-16 Security risk: Highly critical Exploitable from: Remote Vulnerability: SQL Injection Description: Block Search module provides an alternative way of managing blocks.The module doesnt properly use Drupals database API resulting in user-provided strings being passed directly to the database allowing SQL Injection.This vulnerability is mitigated by the fact that an attacker must either use a --------------------------------------------- https://drupal.org/node/2242463 *** SA-CORE-2014-002 - Drupal core - Information Disclosure *** --------------------------------------------- Advisory ID: DRUPAL-SA-CORE-2014-002 Project: Drupal core Version: 6.x, 7.x Date: 2014-April-16 Security risk: Moderately critical Exploitable from: Remote Vulnerability: Information Disclosure Description: Drupals form API has built-in support for temporary storage of form state, for example user input. This is often used on multi-step forms, and is required on Ajax-enabled forms in order to allow the Ajax calls to access and update interim user input on the server.When pages are cached for anonymous --------------------------------------------- https://drupal.org/SA-CORE-2014-002 *** Heartbleed CRL Activity Spike Found, (Wed, Apr 16th) *** --------------------------------------------- It looks like, as I had suspected, the CRL activity numbers we have been seeing did not reflect the real volume caused by the OpenSSL Heartbleed bug. This evening I noticed a massive spike in the amount of revocations being reported by this CRL: http://crl.globalsign.com/gs/gsorganizationvalg2.crl The spike is so large that we initially thought it was a mistake, but we have since confirmed that its real! Were talking about over 50,000 unique recovations from a single CRL: This is by an order --------------------------------------------- http://isc.sans.edu/diary.html?storyid=17977&rss *** Confirmed: Nasty Heartbleed bug exposes OpenVPN private keys, too *** --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/cz_Y-Ayd5tw/ *** OpenSSL-Bug Heartbleed: Die meisten Router sind laut Herstellerangaben nicht verwundbar *** --------------------------------------------- Die meisten Router-Hersteller geben an, ältere OpenSSL-Versionen zu nutzen. Etliche liefern aber keine Belege dafür, dass ihre Geräte nicht verwundbar sind. Sicherheitsbewusste Nutzer müssen also die Ärmel hochkrempeln und die Geräte selbst testen. --------------------------------------------- http://www.heise.de/security/meldung/OpenSSL-Bug-Heartbleed-Die-meisten-Rou… *** SAP Router Password Timing Attack *** --------------------------------------------- Topic: SAP Router Password Timing Attack Risk: High Text:Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ SAP Router Password Timing Attack 1. *Advisory Inf... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014040118 *** Whats worse than Heartbleed? Bugs in Heartbleed detection scripts. *** --------------------------------------------- As of the writing of this blog post, Nessus, Metasploit, Nmap, and others have released methods for detecting whether your systems are affected. The problem is, most of them have bugs themselves which lead to false negatives results, that is, a result which says a system is not vulnerable when in reality it is. With many people likely running detection scripts or other scans against hosts to check if they need to be patched, it is important that these bugs be addressed before too many people --------------------------------------------- http://www.hut3.net/blog/cns---networks-security/2014/04/14/bugs-in-heartbl… *** Definitionsupdate für Microsoft-Virenscanner bremst Windows XP aus *** --------------------------------------------- http://derstandard.at/1397520906230 *** Zugriff auf SMS-Nachrichten und Tor-Traffic dank Heartbleed *** --------------------------------------------- Hackern ist es gelungen, die von SMS-Gateways verschickten Nachrichten auszulesen - Tokens zur Zwei-Faktor-Authentisierung inklusive. Und auch Tor-Exitnodes geben beliebige Speicherinhalte preis. --------------------------------------------- http://www.heise.de/security/meldung/Zugriff-auf-SMS-Nachrichten-und-Tor-Tr… *** Bleichenbacher-Angriff: TLS-Probleme in Java *** --------------------------------------------- In der TLS-Bibliothek von Java wurde ein Problem gefunden, welches unter Umständen das Entschlüsseln von Verbindungen erlaubt. Es handelt sich dabei um die Wiederbelebung eines Angriffs, der bereits seit 1998 bekannt ist. (Java, Technologie) --------------------------------------------- http://www.golem.de/news/bleichenbacher-angriff-tls-probleme-in-java-1404-1…

1 0

Tageszusammenfassung - Mittwoch 16-04-2014
by Daily end-of-shift report 16 Apr '14

16 Apr '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 15-04-2014 18:00 − Mittwoch 16-04-2014 18:00 Handler: Alexander Riepl Co-Handler: Robert Waldner *** Phishing-Mail: BSI warnt vor BSI-Warnung *** --------------------------------------------- Die regelmäßigen Warnungen des BSI vor gehackten Online-Konten haben offenbar Kriminelle zu einer Phishing-Attacke animiert. Von "verdachtigen Aktivitäten" und "anwaltlichen Schritten" ist darin die Rede. (Phishing, Internet) --------------------------------------------- http://www.golem.de/news/phishing-mail-bsi-warnt-vor-bsi-warnung-1404-10589… *** RSA BSAFE Micro Edition Suite security bypass *** --------------------------------------------- RSA BSAFE Micro Edition Suite (MES) could allow a remote attacker to bypass security restrictions, caused by an error within the certificate chain processing logic. An attacker could exploit this vulnerability to create an improperly authenticated SSL connection. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/92408 *** Chef Multiple Vulnerabilities *** --------------------------------------------- Chef Software has acknowledged multiple security issues and vulnerabilities in Chef, which can be exploited by malicious people to conduct spoofing and cross-site scripting attacks, bypass certain security restrictions, disclose potentially sensitive information, cause a DoS (Denial of Service), and compromise a vulnerable system. --------------------------------------------- https://secunia.com/advisories/57836 *** WordPress Twitget Plugin Cross-Site Request Forgery Vulnerability *** --------------------------------------------- dxwsecurity has reported a vulnerability in the Twitget plugin for WordPress, which can be exploited by malicious people to conduct cross-site request forgery attacks. The application allows users to perform certain actions via HTTP requests without performing proper validity checks to verify the requests. This can be exploited to e.g. change plugin configuration settings when a logged-in administrative user visits a specially crafted web page. --------------------------------------------- https://secunia.com/advisories/57892 *** Critical Patch Update - April 2014 *** --------------------------------------------- Security vulnerabilities addressed by this Critical Patch Update affect the products listed in the categories below. The product area of the patches for the listed versions is shown in the Patch Availability column corresponding to the specified Products and Versions column. --------------------------------------------- http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html *** Innominate mGuard OpenSSL HeartBleed Vulnerability *** --------------------------------------------- OVERVIEW Researcher Bob Radvanovsky of Infracritical has notified NCCIC/ICS-CERT that Innominate has released a new firmware version that mitigates the OpenSSL HeartBleed vulnerability in the mGuard products.This vulnerability could be exploited remotely. Exploits that target the OpenSSL Heartbleed vulnerability are known to be publicly available.AFFECTED PRODUCTSThe following Innominate mGuard versions are affected: --------------------------------------------- http://ics-cert.us-cert.gov/advisories/ICSA-14-105-02 *** Siemens Industrial Products OpenSSL HeartBleed Vulnerability *** --------------------------------------------- OVERVIEWSiemens reported to NCCIC/ICS-CERT a list of products affected by the OpenSSL vulnerability (known as 'Heartbleed'). Joel Langill of Infrastructure Defense Security Services reported to ICS-CERT and Siemens the OpenSSL vulnerability affecting the S7-1500.Siemens has produced an update and Security Advisory (SSA-635659) that mitigates this vulnerability in eLAN and is currently working on updates for the other affected products. --------------------------------------------- http://ics-cert.us-cert.gov/advisories/ICSA-14-105-03 *** Looking for malicious traffic in electrical SCADA networks - part 1, (Tue, Apr 15th) *** --------------------------------------------- When infosec guys are performing intrusion detection, they usually look for attacks like portscans, buffer overflows and specific exploit signature. For example, remember OpenSSL heartbleed vulnerability? --------------------------------------------- http://isc.sans.edu/diary.html?storyid=17967&rss *** New Feature: Monitoring Certification Revocation Lists https://isc.sans.edu/crls.html, (Wed, Apr 16th) *** --------------------------------------------- Certificate Revocation Lists (“CRLs”) are used to track revoked certificates. Your browser will download these lists to verify if a certificate presented by a web site has been revoked. The graph above shows how many certificates were revoked each day by the different CRLs we are tracking. --------------------------------------------- http://isc.sans.edu/diary.html?storyid=17969&rss *** Adobe Flash ExternalInterface Use-After-Free *** --------------------------------------------- VUPEN Vulnerability Research Team discovered a critical vulnerability in Adobe Flash. The vulnerability is caused by a use-after-free error when interacting with the "ExternalInterface" class from the browser, which could be exploited to achieve code execution via a malicious web page. --------------------------------------------- http://cxsecurity.com/issue/WLB-2014040102 *** Netgear N600 Password Disclosure / Account Reset *** --------------------------------------------- While i was lurking around the Netgear firmware today i came across various tweaking and others i was able to find a password disclosure,File uploading vulnerably which could compromise the entire router.as of now no patch from the vendor. --------------------------------------------- http://cxsecurity.com/issue/WLB-2014040101 *** Apache Syncope 1.0.8 / 1.1.6 Code Execution *** --------------------------------------------- In the various places in which Apache Commons JEXL expressions are allowed (derived schema definition, user / role templates, account links of resource mappings) a malicious administrator can inject Java code that can be executed remotely by the JEE container running the Apache Syncope core. --------------------------------------------- http://cxsecurity.com/issue/WLB-2014040106 *** Bugtraq: CVE-2014-2735 - WinSCP: missing X.509 validation *** --------------------------------------------- A user can not recognize an easy to perform man-in-the-middle attack, because the client does not validate the "Common Name" of the servers X.509 certificate. In networking environment that is not trustworthy, like a wifi network, using FTP AUTH TLS with WinSCP the servers identity can not be trusted. --------------------------------------------- http://www.securityfocus.com/archive/1/531847 *** Qemu: out of bounds buffer access, guest triggerable via IDE SMART *** --------------------------------------------- An out of bounds memory access flaw was found in Qemu's IDE device model. It leads to Qemu's memory corruption via buffer overwrite(4 bytes). It occurs while executing IDE SMART commands. A guest's user could use this flaw to corrupt Qemu process's memory on the host. --------------------------------------------- http://seclists.org/oss-sec/2014/q2/116 *** Hintergrund: Warum wir Forward Secrecy brauchen *** --------------------------------------------- Der SSL-GAU zeigt nachdrücklich, dass Forward Secrecy kein exotisches Feature für Paranoiker ist. Es ist vielmehr das einzige, was uns noch vor einer vollständigen Komplettüberwachung aller Kommunikation durch die Geheimdienste schützt. --------------------------------------------- http://www.heise.de/security/artikel/Warum-wir-Forward-Secrecy-brauchen-217…

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily April 2014