Daily September 2014

daily@lists.cert.at

1 participants
22 discussions

Tageszusammenfassung - Dienstag 16-09-2014
by Daily end-of-shift report 16 Sep '14

16 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 15-09-2014 18:00 − Dienstag 16-09-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Security updates available for Adobe Reader and Acrobat (APSB14-20) *** --------------------------------------------- http://blogs.adobe.com/psirt/?p=1130 *** THREE QUARTERS of droid phones open to web page spy bug *** --------------------------------------------- Metasploit module gobbles KitKat SOP slop A Metasploit module has been developed to easily exploit a dangerous flaw in 75 percent of Android devices that allows attackers to hijack a users open websites. --------------------------------------------- http://www.theregister.co.uk/2014/09/16/three_quarters_of_droid_phones_open… *** Attackers tapping on SNMP door to see if its open *** --------------------------------------------- SANS spots new, dumb attack Googles DNS IP address is being spoofed by an attacker, apparently in an attempt to DDoS hosts vulnerable to a flaw in the SNMP protocol. --------------------------------------------- http://www.theregister.co.uk/2014/09/16/attackers_tapping_on_snmp_door_to_s… *** Kindle durch versteckte Codes in E-Books gefährdet *** --------------------------------------------- Durch eine Sicherheitslücke im E-Reader Kindle können Angreifer an die Daten von Amazon-Kunden gelangen. Die Lücke tritt zum zweiten Mal auf. --------------------------------------------- http://futurezone.at/digital-life/kindle-durch-versteckte-codes-in-e-books-… *** Encrypt-then-MAC für TLS standardisiert *** --------------------------------------------- Eine neue TLS-Erweiterung ermöglicht es, die Reihenfolge zwischen Authentifizierung und Verschlüsselung zu ändern. Die bisherige Methode führte zu Sicherheitsproblemen wie der Lucky-Thirteen-Attacke. ... Gegen die Lucky-Thirteen-Attacke wurden Workarounds in die gängigen Browser und TLS-Bibliotheken eingebaut, aber trotzdem gab es den Wunsch, das Problem generell zu beheben. --------------------------------------------- http://www.golem.de/news/verschluesselung-encrypt-then-mac-fuer-tls-standar… *** Ungestopftes Datenleck in Androids Open-Source-Browser *** --------------------------------------------- Eine Lücke im AOSP-Browser von Android erlaubt es Webseiten die Daten anderer Seiten auszulesen. Die App wird in fast allen Android-Versionen vor Kit Kat mitgeliefert und dient vielen Custom-ROMs ebenfalls als Standard-Browser. --------------------------------------------- http://www.heise.de/security/meldung/Ungestopftes-Datenleck-in-Androids-Ope… *** AppLock Vulnerability Leaves Configuration Files Open for Exploit *** --------------------------------------------- We have previously discussed about certain file locker apps that fail to do hide files properly. We recently came across yet another file locker app, AppLock, which has the same issue. However, the vulnerability concerning this app goes beyond improperly hiding files - the vulnerability can .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/applock-vulnerab… *** Twitter Vulnerability Allows Hacker to Delete Credit Cards from Any Twitter Account *** --------------------------------------------- At the beginning of this month, just like other social networks, Twitter also started paying individuals for any flaws they uncover on its service with a fee of $140 or more offered per flaw under its new Bug Bounty program, and here comes the .. --------------------------------------------- http://thehackernews.com/2014/09/twitter-vulnerability-allows-hacker-to_16.… *** Metasploit gems from scratch *** --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2014/09/16/metasploi…

1 0

Tageszusammenfassung - Montag 15-09-2014
by Daily end-of-shift report 15 Sep '14

15 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 12-09-2014 18:00 − Montag 15-09-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Squid Off-by-One in snmpHandleUdp() Lets Remote Users Execute Arbitrary Code *** --------------------------------------------- A remote user can send a specially crafted UDP SNMP packet to trigger an off-by-one memory error in snmpHandleUdp() and potentially execute arbitrary code on the target system. --------------------------------------------- http://www.securitytracker.com/id/1030838 *** Rooted SSH/SFTP Daemon Default Login Credentials *** --------------------------------------------- The software comes pre-configured with a default login of User: root Password: abc123. This weak password would easily be guessed leading to root compromise of the android system. --------------------------------------------- http://cxsecurity.com/issue/WLB-2014090066 *** WordPress Photo Album Plus 5.4.4 Cross Site Scripting *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2014090061 *** Malware 'Eskimo' hat es auf Steam-Konten abgesehen *** --------------------------------------------- Die Schadsoftware wird hauptsächlich im Twitch-Chat verbreitet - Guthaben sowie Items werden nach Hack übertragen --------------------------------------------- http://derstandard.at/2000005543386 *** IRC: Chatnetzwerk Freenode gehackt *** --------------------------------------------- Die Betreiber des IRC-Netzwerks Freenode haben eine Kompromittierung ihrer Server festgestellt. Alle Nutzer sollten vorsorglich ihr Passwort ändern. --------------------------------------------- http://www.golem.de/news/irc-chatnetzwerk-freenode-wurde-gehackt-1409-10923… *** Multiple vulnerabilities in IBM products *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_pureapplication_s… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** Trustwave.com: 2014 Business Password Analysis *** --------------------------------------------- We set out to determine how easily we could crack a sample of 626,718 hashed passwords we collected during thousands of network penetration tests performed in 2013 and some performed in 2014. ... We recovered more than half of the passwords within just the first .. --------------------------------------------- https://gsr.trustwave.com/topics/business-password-analysis/2014-business-p… *** Moodle Bugs Let Remote Users Obtain Potentially Sensitive Information and Bypass Security Controls *** --------------------------------------------- Moodle Bugs Let Remote Users Obtain Potentially Sensitive Information and Bypass Security Controls --------------------------------------------- http://www.securitytracker.com/id/1030839 *** Hacking Canon Pixma Printers - Doomed Encryption *** --------------------------------------------- This blog post is another in the series demonstrating current insecurities in devices categorised as the 'Internet of Things'. This instalment will reveal how the firmware on Canon Pixma printers (used in the home and by SMEs) can be modified from the Internet to run custom code. ... For demonstration purposes I decided to get Doom running on the printer (Doom as in the classic 90s computer game). --------------------------------------------- http://www.contextis.co.uk/resources/blog/hacking-canon-pixma-printers-doom… *** Bugtraq: Open-Xchange Security Advisory 2014-09-15 *** --------------------------------------------- http://www.securityfocus.com/archive/1/533443 *** [Honeypot Alert] New Bot Malware (BoSSaBoTv2) Attacking Web Servers Discovered *** --------------------------------------------- Our web honeypots picked up some interesting attack traffic. The initial web application attack vector (PHP-CGI vulnerability) is not new, the malware payload is. We wanted to get this information out to the community quickly due to the following combined threat elements - Active exploit attempts to upload/install the malware The overall low detection rates among AV vendors The malware is actively being sold in underground .. --------------------------------------------- http://blog.spiderlabs.com/2014/09/honeypot-alert-bossabotv2-irc-botnetbitc…

1 0

Tageszusammenfassung - Freitag 12-09-2014
by Daily end-of-shift report 12 Sep '14

12 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 11-09-2014 18:00 − Freitag 12-09-2014 18:00 Handler: Robert Waldner Co-Handler: n/a *** Hacker publishes tech support phone scammer slammer *** --------------------------------------------- Security pro Matthew Weeks has released a Metasploit module that can take over computers running the Ammyy Admin remote control software popular among "Hi this is Microsoft, theres a problem with your computer" tech support scammers. Weeks day job is director at Root9b, but hes taken time to detail a zero-day flaw in Ammyy Admin he hopes will be used to fight back against tech support scammers. --------------------------------------------- http://www.theregister.co.uk/2014/09/12/phone_scammer_slammer/ *** Cisco Unified Communications Manager glibc Arbitrary Code Execution Vulnerability *** --------------------------------------------- A vulnerability in the GNU C library of Cisco Unified Communications Manager (Cisco Unified CM) could allow an unauthenticated, local attacker to input crafted data to cause a heap-based buffer overflow. The vulnerability is due to incorrect sanitization of data. An attacker could exploit this vulnerability by setting an environment variable to a malicious value. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Schneider Electric VAMPSET Buffer Overflow *** --------------------------------------------- This advisory provides mitigation details for a buffer overflow vulnerability in Schneider Electric's VAMPSET software product. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-254-01 *** Ecava Integraxor SCADA Server Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for vulnerabilities in the Ecava Integraxor SCADA Server. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-224-01 *** Linux Kernel logi_dj_recv_destroy_djhid_device buffer overflow *** --------------------------------------------- Linux Kernel is vulnerable to a buffer overflow, caused by improper bounds checking by the logi_dj_recv_destroy_djhid_device function. By sending an overly long string, a local attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/95928 *** DNS cache poisoning used to steal emails *** --------------------------------------------- Does this happen in practice? CERT/CC researchers Jonathan Spring and Leigh Metcalf have evidence to suggest that it does. Using passive DNS data, they found a number of incorrect responses for A records belonging to mail servers of the big three webmail providers (Gmail, Yahoo! and Hotmail). Even though an increasing number of emails are sent over encrypted connections (using STARTTLS), there isnt really a way for the receiving mail server to enforce this, as HSTS does for secure HTTP --------------------------------------------- https://www.virusbtn.com/blog/2014/09_12.xml?rss *** Multiple security bulletins for IBM products *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin…

1 0

Tageszusammenfassung - Donnerstag 11-09-2014
by Daily end-of-shift report 11 Sep '14

11 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 10-09-2014 18:00 − Donnerstag 11-09-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** iOS 8 stopft Hintertüren weitestgehend *** --------------------------------------------- Apple hat die für Diagnosezwecke gedachten Systemdienste in iOS 8 grösstenteils abgeschottet, berichtet ein Sicherheitsforscher. Bislang lassen sich darüber zahlreiche Nutzerdaten auslesen. --------------------------------------------- http://www.heise.de/security/meldung/iOS-8-stopft-Hintertueren-weitestgehen… *** Multiple vulnerabilities in Juniper products *** --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10646 http://kb.juniper.net/index?page=content&id=JSA10645 http://kb.juniper.net/index?page=content&id=JSA10647 *** IBM Security Bulletin: Fixes available for Security Vulnerabilities in IBM WebSphere Portal (CVE-2014-4762; CVE-2014-4792) *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** Apache Warns of Tomcat Remote Code Execution Vulnerability *** --------------------------------------------- Some older versions of Apache Tomcat, the company's open source web server and servlet container, are vulnerable to remote code execution. --------------------------------------------- http://threatpost.com/apache-warns-of-tomcat-remote-code-execution-vulnerab… *** IBM Security Bulletin: Administrator password can be reset without authentication on SAN Volume Controller and Storwize Family (CVE-2014-4811) *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** AIX OpenSSL Denial of Service due to double free *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/aix_openssl_denial_of… *** Cisco Unified Communications Manager GLIBC Arbitrary Code Execution Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco TelePresence System MXP Series Software Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** SA-CONTRIB-2014-087 - Drupal Commerce - Information disclosure *** --------------------------------------------- Drupal Commerce is used to build eCommerce websites and applications of all sizes. The commerce_order module can be used to create new user accounts where email addresses are used as user names. Since user names are not considered .. --------------------------------------------- https://www.drupal.org/node/2336357 *** Oracle MySQL Server MyISAM code execution *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/95881 *** Swiss economy makes online security its priority *** --------------------------------------------- Switzerland is one of the safest countries in the world. To make also the Internet a secure place in Switzerland, the Swiss online economy has started the Swiss Internet .. --------------------------------------------- http://securityblog.switch.ch/2014/09/11/swiss-economy-makes-online-securit… *** SHA1 deprecation: what you need to know *** --------------------------------------------- The news is that SHA1, a very popular hashing function, is on the way out. Strictly speaking, this development is not new. The first signs of weaknesses in SHA1 appeared (almost) ten years ago. In 2012, some calculations showed how breaking SHA1 is becoming feasible for those who can afford it. In November 2013, Microsoft announced that they wouldnt be accepting SHA1 certificates after 2016. --------------------------------------------- http://blog.ivanristic.com/2014/09/sha1-deprecation-what-you-need-to-know.h… *** Tabnabbing: A New Type of Phishing Attack *** --------------------------------------------- Most phishing attacks depend on an original deception. If you detect that you are at the wrong URL, or that something is amiss on a page, the chase is up. You've escaped the attackers. In fact, the time that wary people are most wary is exactly when they first navigate to a site. What we don't expect is that a page we've been looking at will change behind our backs, when we aren't looking. That'll catch us by surprise. --------------------------------------------- http://www.azarask.in/blog/post/a-new-type-of-phishing-attack/ *** Sicherheitslücke in vielen WordPress-Themes *** --------------------------------------------- Ein Fehler im beliebten Plug-in Slider Revolution erlaubt es, beliebige Dateien vom Webserver herunterzuladen. Damit kann ein Angreifer im schlimmsten Fall den ganzen Server kompromittieren. Das Plug-in ist in einer grossen Zahl von Themes fest verbaut. --------------------------------------------- http://www.heise.de/security/meldung/Sicherheitsluecke-in-vielen-WordPress-… *** A system that facilitates malware identification in smartphones *** --------------------------------------------- The tool, developed by these UC3M researchers, baptized DENDROID and detailed in a study published in the review Expert Systems with Applications, allows security analysts to scrutinize a large quantity of apps to determine the origins of a malware sample and the family to which it belongs. --------------------------------------------- http://www.alphagalileo.org/ViewItem.aspx?ItemId=145206 *** Home Articles PCI Updates Skimming Prevention Guide - Best Practices for Protecting Merchants from POS Attacks *** --------------------------------------------- At a time when retailers are seeing a surge in point-of-sale breaches, The PCI Security Standards Council has released an update to its guidance for merchants on protecting against card skimming attacks in POS environments. --------------------------------------------- http://www.bankinfosecurity.co.uk/pci-updates-skimming-prevention-guide-a-7… *** Key Flaw Enables Recovery of Files Encrypted by TorrentLocker *** --------------------------------------------- Crypto ransomware, a relatively unknown phenomenon a couple of years ago, has exploded into one of the nastier malware problems for Internet users. Variants such as CryptoLocker and CryptoWall have been siphoning money from victims for some time, and now researchers have dissected a newer .. --------------------------------------------- http://threatpost.com/key-flaw-enables-recovery-of-files-encrypted-by-torre…

1 0

Tageszusammenfassung - Mittwoch 10-09-2014
by Daily end-of-shift report 10 Sep '14

10 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 09-09-2014 18:00 − Mittwoch 10-09-2014 18:00 Handler: Robert Waldner Co-Handler: n/a *** Security updates available for Adobe Flash Player (APSB14-21) *** --------------------------------------------- Adobe has released security updates for Adobe Flash Player for Windows, Macintosh and Linux. These updates address vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe recommends users update their product installations to the latest versions ... CVE-2014-0547, CVE-2014-0548, CVE-2014-0549, CVE-2014-0550, CVE-2014-0551, CVE-2014-0552, CVE-2014-0553, CVE-2014-0554, CVE-2014-0555, CVE-2014-0556, CVE-2014-0557, CVE-2014-0559 --------------------------------------------- http://helpx.adobe.com/security/products/flash-player/apsb14-21.html *** Assessing risk for the September 2014 security updates *** --------------------------------------------- Today we released four security bulletins addressing 42 unique CVE's. One bulletin has a maximum severity rating of Critical and the other three have maximum severity Important. This table is designed to help you prioritize the deployment of updates appropriately for your environment. --------------------------------------------- http://blogs.technet.com/b/srd/archive/2014/09/09/assessing-risk-for-the-se… *** MSRT September 2014 - Zemot *** --------------------------------------------- This month we added the Win32/Zemot family to the Malicious Software Removal Tool. The Zemot family of trojan downloaders are frequently used by malware with a number of different payloads. We started seeing activity from TrojanDownloader:Win32/Upatre.B in late 2013 and identified this threat as the main distributor of the click fraud malware PWS:Win32/Zbot.gen!AP and PWS:Win32/Zbot.CF. We renamed the downloader to Zemot in May 2014. Recently, other malware such as Win32/Rovnix, --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2014/09/09/msrt-september-2014-zemo… *** Microsoft IIS Web Server - CMD Process Contributing to Website Reinfections *** --------------------------------------------- We often spend a lot of time talking about application level malware, but from time to time we do like to dabble in the ever so interesting web server infections as well. It is one of those things that comes with the job. Today, we're going to chat about an interesting reinfection case in which the client was running their website on a Microsoft's Internet Information Services (IIS) web server. Yes, contrary to popular belief many organizations, especially large enterprise --------------------------------------------- http://blog.sucuri.net/2014/09/microsof-iis-web-server-cmd-process-contribu… *** VMware vSphere product updates to third party libraries *** --------------------------------------------- The Apache Struts library is updated to address a security issue. This issue may lead to remote code execution after authentication. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2014-0114 to this issue. --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2014-0008.html *** The September 2014 issue of our SWITCH Security Report is available! *** --------------------------------------------- A new issue of our monthly SWITCH Security Report has just been released. Topics: - Inside information on government Trojans used internationally published on Twitter - Page not found: Network blocking in in Switzerland and neighbouring countries - Breaking bad - malvertising ransomware: ZeroLocker / CryptoLocker / CryptoWall / SynoLocker - Canvas or cookies - choosing between Scylla and Charybdis - The Clipboard: Interesting presentations, articles and videos --------------------------------------------- http://securityblog.switch.ch/2014/09/10/the-september-2014-issue-of-our-sw…

1 0

Tageszusammenfassung - Dienstag 9-09-2014
by Daily end-of-shift report 09 Sep '14

09 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 08-09-2014 18:00 − Dienstag 09-09-2014 18:00 Handler: Robert Waldner Co-Handler: n/a *** Cisco Unified Computing System E-Series Blade Servers Cisco Integrated Management Controller SSH Denial of Service Vulnerability *** --------------------------------------------- A vulnerability in the Cisco Integrated Management Controller (Cisco IMC) SSH module of the Cisco Unified Computing System E-Series Blade servers could allow an unauthenticated, remote attacker to cause a denial of service condition. The vulnerability is due to a failure to properly handle a crafted SSH packet. An attacker could exploit this vulnerability by sending a crafted packet to the SSH server running on the Cisco IMC of an affected device, which could result in the Cisco IMC becoming unresponsive. The operating system running on the blade will be unaffected. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco IOS XR Software DHCPv6 Denial Of Service Vulnerability *** --------------------------------------------- A vulnerability in the DHCP version 6 (DHCPv6) code of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause the DHCPv6 server process on an affected device to crash. The vulnerability is due to incorrect handling of malformed DHCPv6 packets. An attacker could exploit this vulnerability by sending a malformed DHCPv6 packet to an affected device configured with DHCPv6 server functionality. An exploit could allow the attacker to cause the DHCPv6 process on the device to crash. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Netgear ProSafe Plus Configuration Utility information disclosure *** --------------------------------------------- Netgear ProSafe Plus Configuration Utility could allow a remote attacker to obtain sensitive information, caused by the storing of passwords in plaintext within the backup file. An attacker could exploit this vulnerability using the configuration backup file to obtain sensitive information. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/95780 *** Researchers reveal security issues in Android apps *** --------------------------------------------- On Monday, the University of New Haven revealed its first video in a series of security findings. --------------------------------------------- http://www.scmagazine.com/researchers-reveal-security-issues-in-android-app… *** Why Google Is Pushing For a Web Free of SHA-1 *** --------------------------------------------- An anonymous reader writes: Google recently announced Chrome will be gradually phasing out support for certificates using SHA-1 encryption. They said, "We need to ensure that by the time an attack against SHA-1 is demonstrated publicly, the web has already moved away from it." Developer Eric Mill has written up a post explaining why SHA-1 is dangerously weak, and why moving browsers away from acceptance of SHA-1 is a lengthy, but important process. --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/ME5Z29v_gGw/story01.htm *** Salesforce: Oh no! Dyre RATs are thirsty for our customers logins *** --------------------------------------------- But attacks werent the cause of server outage, were told Salesforce has warned that miscreants are trying to infect its customers with a remote access trojan (RAT) dubbed Dyre that siphons off Salesforce.com login data. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/09/08/salesforcec… *** H1 2014 Threat Report *** --------------------------------------------- Our latest Threat Report is now available. The report includes our statistics, incidents calendar and threatscape summaries for H1(Q1+Q2) 2014. --------------------------------------------- http://www.f-secure.com/weblog/archives/00002741.html *** QEMU VGA Emulator Bug Lets Local Guest Users Obtain Potentially Sensitive Information from the Host System *** --------------------------------------------- Description: A vulnerability was reported in QEMU. A local user on a guest system can obtain potentially sensitive information from the host system. A guest system Graphics Output Protocol driver can set a high resolution to trigger a flaw in the VGA emulator and obtain host memory contents. Impact: A local user on a guest system can obtain potentially sensitive information from the host system memory. --------------------------------------------- http://www.securitytracker.com/id/1030817 *** Enigmail PGP plugin forgets to encrypt mail sent as blind copies *** --------------------------------------------- User now waiting for the bad guys come and get me with their water-boards Enigmail has patched a hole in the worlds most popular PGP email platform that caused mail to be sent unencrypted when all security check boxes were ticked. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/09/09/enigmail_en… *** Kaspersky Internet Security Android App Certificate Validation Flaw Lets Remote Users Spoof Servers *** --------------------------------------------- A vulnerability was reported in Kaspersky Internet Security app for Android. A remote user can spoof servers. The application (com.kms.free) does not verify X.509 certificates from SSL servers. A remote user with the ability conduct a man-in-the-middle attack can supply a specially crafted certificate to spoof an SSL server obtain or modify sensitive information --------------------------------------------- http://www.securitytracker.com/id/1030815 *** OpenSSL Security Policy *** --------------------------------------------- Recent flaws have captured the attention of the media and highlighted how much of the internet infrastructure is based on OpenSSL. Weve never published our policy on how we internally handle security issues; that process being based on experience and has evolved over the years. --------------------------------------------- https://www.openssl.org/about/secpolicy.html *** 'Google Dorking' - Waking Up Web Admins Everywhere *** --------------------------------------------- Last July, the US Department of Homeland Security warned of a new kind of criminal attack: 'Google dorking'. This refers to asking Google for things they have found via special search operators. Let's look closely and see what this is. Google finds things online using a program that accesses web sites: the Google web crawler, called ... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/DdLfN3jTMhw/ *** How a DNS Sinkhole Can Protect Against Malware *** --------------------------------------------- The Domain Name Service (DNS) is an integral part of Internet access. It translates human-recognized domain names into computer-readable IP addresses in order to facilitate online communication and connection between devices. ... And one of the best ways to gain control is via DNS itself, in order to disrupt malware transmission at the very point of connection. A DNS sinkhole, or sinkhole server, gives organizations this control in order to prevent internal access to malicious websites. --------------------------------------------- http://resources.infosecinstitute.com/dns-sinkhole-can-protect-malware/ *** Threat Spotlight: 'Kyle and Stan' Malvertising Network Threatens Windows and Mac Users With Mutating Malware *** --------------------------------------------- Once the victim gets redirected to the final URL, the website automatically starts the download of a unique piece of malware for every user. The file is a bundle of legitimate software, like a media-player, and compiles malware and a unique-to-every-user configuration into the downloaded file. The attackers are purely relying on social engineering techniques, in order to get the user to install the software package. No drive-by exploits are being used thus far. --------------------------------------------- https://blogs.cisco.com/security/kyle-and-stan/ *** Modern anti-spam and E2E crypto *** --------------------------------------------- ... asked me to write up some thoughts on how spam filtering and fully end to end crypto would interact, so its all available in one message instead of scattered over other threads. Specifically he asked for brain dumps on: - how does antispam currently work at large email providers - how would widespread E2E crypto affect this - what are the options for moving things to the client (and pros, cons) - is this feasible for email? --------------------------------------------- https://moderncrypto.org/mail-archive/messaging/2014/000780.html *** Research Finds No Large Scale Heartbleed Exploit Attempts Before Vulnerability Disclosure *** --------------------------------------------- In the days and weeks following the public disclosure of the OpenSSL Heartbleed vulnerability in April, security researchers and others wondered aloud whether there were some organizations - perhaps the NSA - that had known about the bug for some time and had been using it for targeted attacks. A definitive answer to that question may never come, but ... --------------------------------------------- http://threatpost.com/research-finds-no-large-scale-heartbleed-exploit-atte… *** UPDATE: Upcoming Security Updates for Adobe Reader and Acrobat (APSB14-20) *** --------------------------------------------- UPDATE: The security update for Adobe Reader and Acrobat has been re-scheduled from September 9, 2014 to the week of September 15, 2014. This delay was necessary to address issues identified during routine regression testing. --------------------------------------------- http://blogs.adobe.com/psirt/?p=1121

1 0

Tageszusammenfassung - Montag 8-09-2014
by Daily end-of-shift report 08 Sep '14

08 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 05-09-2014 18:00 − Montag 08-09-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Apple IDs targeted by Kelihos botnet phishing campaign *** --------------------------------------------- Botnet targets Apple customers, launching phishing email campaign to lure victims into disclosing their Apple IDs and passwords. Days after numerous celebrities were found to have their iCloud accounts compromised, a major botnet has turned its attention to Apple customers, launching a phishing email campaign .. --------------------------------------------- http://www.symantec.com/connect/blogs/apple-ids-targeted-kelihos-botnet-phi… *** USB firmware: An upcoming threat for home and enterprise users *** --------------------------------------------- Every year, thousands of hackers and security researchers from around the world descend on Las Vegas to attend the annual Black Hat security conference. The conference boasts top notch security presentations from industry leaders - often centered on breaking computer security. Although many of the presentations are on breaking things, most of the .. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2014/09/02/usb-firmware-an-upcoming… *** Stupid Spammer Tricks - Reversing Characters *** --------------------------------------------- Spammers engaged in phishing attacks constantly try to get their emails past spam filters. They try many different tactics, and these can include taking advantage of HTML coding characteristics. These HTML tricks can make the email look normal when rendered in a mail client, but the actual .. --------------------------------------------- http://blog.spiderlabs.com/2014/09/stupid-spammer-tricks-reversing-characte… *** Mozilla 1024-Bit Cert Deprecation Leaves 107,000 Sites Untrusted *** --------------------------------------------- Mozilla has deprecated 1024-bit RSA certificate authority certificates in Firefox 32 and Thunderbird. While there are pluses to the move such as a requirement for longer, stronger keys, at least 107,000 websites will no longer be trusted by Mozilla. Data from HD Moores Project Sonar, which .. --------------------------------------------- http://it.slashdot.org/story/14/09/05/2120246/mozilla-1024-bit-cert-depreca… *** Cisco Integrated Management Controller SSH Denial of Service Vulnerability *** --------------------------------------------- A vulnerability in the Cisco Integrated Management Controller (Cisco IMC) SSH module of the Cisco Unified Computing System E-Series Blade servers could allow an unauthenticated, remote attacker to cause a denial of service condition. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Nuclear Exploit Kit and Flash CVE-2014-0515 *** --------------------------------------------- For this blog, wed like to walk you through a recent attack involving Nuclear Exploit Kit (EK) that we analyzed. It was found leveraging CVE-2014-0515, a buffer overflow in Adobe Flash Player discovered in April 2014. Nuclear Exploit kit .. --------------------------------------------- http://research.zscaler.com/2014/09/nuclear-exploit-kit-and-flash-cve-2014.… *** WPS-Sicherheitslücke: Wahrscheinlich wenige Router betroffen *** --------------------------------------------- Auf Anfrage von heise Netze haben sich einige Hersteller von in Deutschland verbreiteten Routern zur Sicherheitslücke in WPS-PIN geäussert, bei der sich die Zugangsnummer offline errechnen lässt. --------------------------------------------- http://www.heise.de/security/meldung/WPS-Sicherheitsluecke-Wahrscheinlich-w… *** Popular Photo Sharing Website Likes.com Vulnerable To Multiple Critical Flaws *** --------------------------------------------- Likes.com, one of the emerging social networking site and popular image browsing platform, is found vulnerable to several critical vulnerabilities that could allow an attacker to completely delete users' account in just one click. Likes.com is a social networking website that helps you to connect .. --------------------------------------------- http://thehackernews.com/2014/09/popular-photo-sharing-website.html *** Demasking Google Users With a Timing Attack *** --------------------------------------------- A 3rd party site can determine if a website viewer has access to a particular Google Drive document. ... How it works: The attack is straightforward. A malicious page repeatedly instantiates an image whose source points at the URL of a Google Drive document. If that document is viewable by the .. --------------------------------------------- http://blog.andrewcantino.com/blog/2014/09/04/demasking-google-users-with-a… *** Bugtraq: [security bulletin] HPSBUX03102 SSRT101681 rev.1 - HP-UX Apache Server Suite running Apache Tomcat or PHP, Remote Execution of Arbitrary Code and Denial of Service (DoS) and Other Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/archive/1/533370 *** iCloud: Apple verschickt neue Warnhinweise *** --------------------------------------------- Nach den aus iCloud-Accounts entwendeten Promi-Nacktfotos hat Apple damit begonnen, neue Benachrichtigungen zu versenden, wenn auf den Cloud-Dienst zugegriffen wird. Weitere Schutzfunktionen sind angekündigt. --------------------------------------------- http://www.heise.de/security/meldung/iCloud-Apple-verschickt-neue-Warnhinwe…

1 0

Tageszusammenfassung - Freitag 5-09-2014
by Daily end-of-shift report 05 Sep '14

05 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 04-09-2014 18:00 − Freitag 05-09-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** 5 things you should know about email unsubscribe links before you click *** --------------------------------------------- We all get emails we don't want and cleaning them up can be as easy as clicking unsubscribe at the bottom of the email. However, some of those handy little links can cause more trouble than they solve. --------------------------------------------- http://nakedsecurity.sophos.com/2014/09/04/5-things-you-should-know-about-e… *** Google acceleration of SHA-1 deprecation draws resistance *** --------------------------------------------- Google said Chrome 39, to be released within 12 weeks, will treat some sites as untrusted, accelerating the transition and user woes. --------------------------------------------- http://www.scmagazine.com/google-acceleration-of-sha-1-deprecation-draws-re… *** Fresh phish served with a helping of AES *** --------------------------------------------- Attempts to use encryption to make analysis of phishing websites more difficult may be a sign of things to come. Obfuscated phishing sites are nothing new. Various techniques such as JavaScript encryption tools (which offer very primitive obfuscation), data URIs (where the page content is mostly Base64-encoded), and .. --------------------------------------------- http://www.symantec.com/connect/blogs/fresh-phish-served-helping-aes *** Researchers discover two SQL injection flaws in WordPress security plugin *** --------------------------------------------- High-Tech Bridge discovered two SQL injection vulnerabilities in All In One WordPress Security and Firewall plugin and notified the vendor. --------------------------------------------- http://www.scmagazine.com/researchers-discover-two-sql-injection-flaws-in-w… *** Malware Bypasses Chrome Extension Security Feature *** --------------------------------------------- Originally created to extend a browser's functionality, browser extensions have become yet another tool for cybercriminals' schemes. Earlier this year, Google has addressed the issue of malicious browser extensions by .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/malware-bypasses… *** Red Hat Enterprise Virtualization Manager 3.4.2 update *** --------------------------------------------- It was discovered that, when loading XML/RSDL documents, the oVirt Engine back end module used an insecure DocumentBuilderFactory. A remote, authenticated attacker could use this flaw to read files accessible to the user running the .. --------------------------------------------- https://rhn.redhat.com/errata/RHSA-2014-1161.html *** Microsoft Security Bulletin Advance Notification for September 2014 *** --------------------------------------------- This is an advance notification of security bulletins that Microsoft is intending to release on September 9, 2014. ... The following table summarizes the security bulletins for this month in order of severity. Bulletin 1.. --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS14-SEP *** renotification Security Advisory for Adobe Reader and Acrobat (APSB14-20) *** --------------------------------------------- Adobe is planning to release security updates on Tuesday, September 9, 2014 for Adobe Reader and Acrobat for Windows and Macintosh .. --------------------------------------------- http://helpx.adobe.com/security/products/reader/apsb14-20.html *** Apple verspricht mehr Sicherheit nach Hacker-Angriff *** --------------------------------------------- Apple-Nutzer sollen künftig über Versuche zur Passwortänderung informiert werden, um Datendiebstahl zu verhindern. --------------------------------------------- http://futurezone.at/digital-life/apple-verspricht-mehr-sicherheit-nach-hac… *** Apache POI 3.10.1-20140818 security issues with OOXML *** --------------------------------------------- The Apache POI project is pleased to announce the release of POI 3.10.1-20140818. This release is a bugfix release to fix two... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014090022 *** Security of Password Managers *** --------------------------------------------- At USENIX Security this year there were two papers studying the security of password managers: David Silver, Suman Jana, and Dan Boneh, "Password Managers: Attacks and Defenses." Zhiwei Li, Warren He, Devdatta Akhawe, and Dawn Song, "The Emperors New Password Manager: Security Analysis of Web-based Password Managers." Its interesting work, especially because it looks at security problems in something that .. --------------------------------------------- https://www.schneier.com/blog/archives/2014/09/security_of_pas.html *** BankAPI - What is it? *** --------------------------------------------- BankAPI is a secure decentralized messaging system to send files/messages between banks and other types of financial institutions. There is a reference implementation of the protocol which can be used off-the-shelf, which is production grade quality and is not only for testing and demonstration, although it .. --------------------------------------------- https://github.com/trustly/bankapi/ *** Remote-Code-Execution-Lücke in F5 BigIP *** --------------------------------------------- Im Hochverfügbarkeits-Modus wiesen die Load-Balancer der Firma F5 ein Sicherheitsproblem auf, das Angreifern die volle Kontrolle über das System ermöglicht. Der Hersteller bessert nach. --------------------------------------------- http://www.heise.de/security/meldung/Remote-Code-Execution-Luecke-in-F5-Big…

1 0

Tageszusammenfassung - Donnerstag 4-09-2014
by Daily end-of-shift report 04 Sep '14

04 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 03-09-2014 18:00 − Donnerstag 04-09-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Paper: Prosecting the Citadel botnet - revealing the dominance of the Zeus descendent: part one *** --------------------------------------------- Aditya K. Sood and Rohit Bansal dissect botnet primarily used for financial fraud.It is unlikely that anyone still thinks that cybercrime is performed by 16-year-old kids who write short pieces of code that wreak havoc all over the world, but if you do still hold that belief, it wont hurt to take a look behind the scenes of a modern botnet operation. Todays botnets show how cybercrime has become a professional industry in which many tactics seen in the legitimate e-commerce and IT service --------------------------------------------- http://www.virusbtn.com/blog/2014/09_03.xml *** [webapps] - vBulletin 4.0.x - 4.1.2 (search.php, cat param) - SQL Injection Exploit *** --------------------------------------------- http://www.exploit-db.com/exploits/34526 *** WordPress Plugins Bogged Down with CSRF, XSS Vulnerabilities *** --------------------------------------------- A handful of bugs, mostly XSS and CSRF vulnerabilities, have been plaguing at least eight different Wordpress plugins as of late. --------------------------------------------- http://threatpost.com/wordpress-plugins-bogged-down-with-csrf-xss-vulnerabi… *** CERT/CC Enumerates Android App SSL Validation Failures *** --------------------------------------------- The CERT Coordination Center at Carnegie Mellon today released a list of Android applications hosted on Google Play and Amazon that it says fail to validate SSL certificates over HTTPS. --------------------------------------------- http://threatpost.com/certcc-enumerates-android-app-ssl-validation-failures… *** Splunk Enterprise 6.0.6 addresses two vulnerabilities *** --------------------------------------------- Description Splunk Enterprise version 6.0.6 addresses the following vulnerabilities: OpenSSL TLS protocol downgrade attack (SPL-88587, CVE-2014-3511) Reflective cross-site scripting (XSS) referer header vulnerability (SPL-85360) At the time of this announcement, Splunk is not aware of any cases where these vulnerabilities have been actively exploited. Previous Product Security Announcements can be found on our Splunk .. --------------------------------------------- http://www.splunk.com/view/SP-CAAANE2 *** Identifying Firewalls from the Outside-In. Or, "Theres Gold in them thar UDP ports!", (Thu, Sep 4th) *** --------------------------------------------- In a penetration test, often the key to bypassing a security control is as simple as knowing identifying the platform its implemented on. In other words, its a lot easier to get past something if you know what it is. For instance, quite often youll be probing a set of perimeter addresses, and if there are no vulnerable hosts NAT-ed out for you, you might start .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18617 *** Mozilla Firefox <v32 Secret Leak PoC *** --------------------------------------------- Depending on a variety of factors, problems like that may leak secrets across web origins, or more prosaically, may help attackers bypass security measures such as ASLR. This code is a proof of concept for versions prior to 32. --------------------------------------------- http://cxsecurity.com/issue/WLB-2014090017 *** heap overflow in procmails formail utility *** --------------------------------------------- prcomails formail utility is vulnerable to a heap-based buffer overflow, caused by improper bounds checking when parsing addresses with unbalanced quotes. By sending an overly long argument, a remote attacker could overflow a buffer .. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/95688 *** Kostenloses G-Data-Tool schützt vor BadUSB-Angriffen *** --------------------------------------------- Der G Data USB Keyboard Guard kontrolliert neu an den PC angeschlossene Tastaturen. Der Anwender kann damit entscheiden, ob er diese tatsächlich benutzen will oder ob er einen Angriff befürchtet und das Gerät lieber aussperrt. --------------------------------------------- http://www.heise.de/newsticker/meldung/Kostenloses-G-Data-Tool-schuetzt-vor… *** Akamai warnt vor Linux-Server-Botnet *** --------------------------------------------- Mit einer Sicherheitswarnung mit "Risikofaktor: Hoch" warnt Netzwerk-Spezialist Akamai vor einem Botnetz aus Linux-Servern, das verteilte DoS-Attacken durchführt, um andere Server in die Knie zu zwingen. --------------------------------------------- http://www.heise.de/security/meldung/Akamai-warnt-vor-Linux-Server-Botnet-2… *** zAnti - Android Penetration Testing Toolkit (Free!) *** --------------------------------------------- zANTI is a comprehensive network diagnostics toolkit that enables complex audits and penetration tests at the push of a button. It provides cloud-based reporting that walks you through simple guidelines to ensure network safety. zANTI offers a comprehensive range of fully customizable scans to reveal everything from authentication, backdoor and brute-force attempts to database, DNS and protocol-specific attacks - including rogue access points. --------------------------------------------- http://hack-tools.blackploit.com/2014/09/zanti-android-penetration-testing.… *** New file-encrypting ransomware called CryptoGraphic Locker *** --------------------------------------------- A new file-encrypting ransomware was discovered today by BartBlaze called CryptoGraphic Locker. Just like other encrypting ransomware, this infection will scan your your data files and encrypt them so that they are unusable. The infection will then display a ransom note that requires you to purchase .. --------------------------------------------- http://www.bleepingcomputer.com/forums/t/546749/new-file-encrypting-ransomw… *** Apple OS X: Security Through Obscurity is becoming an Absurdity *** --------------------------------------------- Today's blog on a new Mac malware is a reminder that attackers go where the money is. Apple usage within the enterprise is growing rapidly, with 52 percent of newly issued computers being Macs according to Forrester. Forrester also .. --------------------------------------------- http://www.fireeye.com/blog/corporate/2014/09/apple-os-x-security-through-o… *** Forced to Adapt: XSLCmd Backdoor Now on OS X *** --------------------------------------------- Introduction FireEye Labs recently discovered a previously unknown variant of the APT backdoor XSLCmd - OSX.XSLCmd - which is designed to compromise Apple OS X systems. This .. --------------------------------------------- http://www.fireeye.com/blog/technical/malware-research/2014/09/forced-to-ad… *** VU#855836: Arris Touchstone cable modem information leakage vulnerabiliity *** --------------------------------------------- Arris Touchstone DG950A cable modem enables SNMP public access by default. Description CWE-200 - Information ExposureThe Arris Touchstone DG950A cable modem running software version 7.10.131 was found to expose sensitive .. --------------------------------------------- http://www.kb.cert.org/vuls/id/855836 *** Semalt botnet hijacked nearly 300k computers *** --------------------------------------------- The "Semalt" botnet is quickly spreading across the Internet, Incapsula researchers warn. The botnet is named after a Ukrainian startup that poses as a legitimate online SEO service, and it currently numbers around 290,000 malware infected machines that continually spam millions of websites in a large-scale, referrer spam campaign. --------------------------------------------- http://www.net-security.org/malware_news.php?id=2857

1 0

Tageszusammenfassung - Mittwoch 3-09-2014
by Daily end-of-shift report 03 Sep '14

03 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 02-09-2014 18:00 − Mittwoch 03-09-2014 18:00 Handler: Robert Waldner Co-Handler: n/a *** Bugtraq: Defense in depth -- the Microsoft way (part 18): Microsoft Office 2010 registers command lines with unquoted pathnames *** --------------------------------------------- Microsoft Office 2010 registers the following command lines with unquoted pathnames containing spaces for various supported file types: --------------------------------------------- http://www.securityfocus.com/archive/1/533317 *** Quick Analysis of a DDoS Attack Using SSDP *** --------------------------------------------- Last week, one of our many clients came under an interesting attack. Enough that it was flagged for human intervention. The interesting aspect of the case was that it was a multi-faceted DDoS attack. The first issue we noticed was a Layer 7, HTTP Flood Attack, Distributed Denial of Service (DDoS) attack ... --------------------------------------------- http://blog.sucuri.net/2014/09/quick-analysis-of-a-ddos-attack-using-ssdp.h… *** New international cybercrime unit, J-CAT, launches pilot program *** --------------------------------------------- A new European cybercrime organization, the Joint Cybercrime Action Taskforce (J-CAT), announced the launch of its six-month pilot program yesterday. The group will investigate global cybercrime threats and targets, according to a release. The Federal Bureau of Investigation (FBI) and the U.K.'s National Crime Agency (NCA) have partnered up to create the unit. Other countries, including Canada and Australia, have signed on to the initiative. --------------------------------------------- http://www.scmagazine.com/new-international-cybercrime-unit-j-cat-launches-… *** ShadowServer Scans Confirm Scale of Netis Threat *** --------------------------------------------- Our friends at the ShadowServer Foundation are now scanning for the Netcore/Netis router backdoor which we found in August. Their findings are in line with what we published then: that the vast majority of those affected in China, with more than a million scanned IP addresses currently affected by this threat. --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/CSrl4YNzdgE/ *** Firefox 32 released, time to update *** --------------------------------------------- Firefox 32 released, time to update - now with support for Public Certificate Pinning. Release notes here: https://www.mozilla.org/en-US/firefox/32.0/releasenotes/ --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18609&rss *** IBM Security Bulletin: Missing access restriction on service types in IBM Business Process Manager (BPM) and WebSphere Lombardi Edition (CVE-2014-4758) *** --------------------------------------------- When invoking a service using the callService URL, there is no access restriction based on the service type and services that were meant for internal use only are available for authenticated users. CVE(s): CVE-2014-4758 Affected product(s) and affected version(s): IBM Business Process Manager Standard V7.5.x, 8.0.x 8.5.x IBM Business Process Manager Express V7.5.x, 8.0.x 8.5.x IBM Business Process Manager Advanced V7.5.x, 8.0.x 8.5.x IBM WebSphere Lombardi Edition V7.2.x --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** Mozilla Firefox for Android file: Protocol Lets Remote Users Obtain Potentially Sensitive Information in Certain Cases *** --------------------------------------------- A vulnerability was reported in Mozilla Firefox for Android. A remote user can obtain potentially sensitive information from the target user's system in certain cases. A remote user can create a specially crafted 'file:' URL that, when loaded by the target user, will access a local file in the Firefox profile directory and copy the data to the SD card without user intervention. A local application can then access the data. --------------------------------------------- http://www.securitytracker.com/id/1030792 *** LogAnalyzer 3.6.5 Cross Site Scripting *** --------------------------------------------- It was found that an XSS injection is possible on a syslog server running LogAnalyzer version 3.6.5. by changing the hostname of any entity logging to syslog server with LogAnalyzer to <script>alert("xss")</script>, and sending an arbitrary syslog message, a client-side script injection execution is possible. --------------------------------------------- http://cxsecurity.com/issue/WLB-2014090008 *** Exploit PHP's mail() to get remote code execution *** --------------------------------------------- While searching around the web for new nifty tricks I stumbled across this post about how to get remote code exeution exploiting PHP's mail() function. First, I must say that this is only going to happen under some really rare circustances. Never the less, it's really something to think about and keep an eye out for. I will explain an example scenario which I think could be a real life scenario later in this article. --------------------------------------------- http://securitysucks.info/exploit-phps-mail-to-get-remote-code-execution/ *** Tests compare Mac OS X anti-malware products *** --------------------------------------------- Every day, independent test lab AV-TEST.org captures more than 400,000 new malware samples for Windows and 5,000 new samples for Android. For the Mac they identify less than 100 per month. But there is malware out there for the Mac and it does hit users in the real world, if less often and less intensely than on the PC. ... Thats why AV-TEST just completed a test of 18 products in this space --------------------------------------------- http://www.zdnet.com/tests-compare-mac-os-x-anti-malware-products-700003317… *** Xen Project Maintenance Releases Available (Versions 4.4.1, 4.3.3, 4.2.5) *** --------------------------------------------- Vulnerabilities fixed: Xen 4.4.1 CVE-2014-2599 CVE-2014-3125 CVE-2014-3124 CVE-2014-2915 CVE-2014-2986 CVE-2014-3714 CVE-2014-3715 CVE-2014-3716 CVE-2014-3717 CVE-2014-3967 CVE-2014-3968 CVE-2014-3969 CVE-2014-4021 CVE-2014-4022 CVE-2014-5147 CVE-2014-5148 Xen 4.2.5 + 4.3.3 CVE-2014-2599 CVE-2014-3124 CVE-2014-3967 CVE-2014-3968 CVE-2014-4021 Apart from those there are many further bug fixes and improvements. --------------------------------------------- http://lists.xen.org/archives/html/xen-announce/2014-09/msg00000.html *** ZDI-14-301: SAP Crystal Reports Datasource Stack Buffer Overflow Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SAP Crystal Reports. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-14-301/

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily September 2014