Daily October 2015

daily@lists.cert.at

1 participants
21 discussions

Tageszusammenfassung - Freitag 30-10-2015
by Daily end-of-shift report 30 Oct '15

30 Oct '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 29-10-2015 18:00 − Freitag 30-10-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** WPScan Intro: WordPress Vulnerability Scanner *** --------------------------------------------- Have you ever wanted to run security tests on your WordPress website to see if it could be easily hacked? WPScan is a black box vulnerability scanner for WordPress sponsored by Sucuri and maintained by the WPScan Team, .. --------------------------------------------- https://blog.sucuri.net/2015/10/install-wpscan-wordpress-vulnerability-scan… *** Anonymisierungsdienst Tor stellt sicheren Messenger vor *** --------------------------------------------- Es soll sich um die am einfachsten zu nutzende Verschlüsselungssoftware handeln --------------------------------------------- http://derstandard.at/2000024778063 *** Advertising Brokers: A Background Information *** --------------------------------------------- Provides background information about advertisement brokers, the men and women that are in the middle of web advertising between sites and advertisers. --------------------------------------------- https://blog.malwarebytes.org/privacy-2/2015/10/advertising-brokers-backgro… *** DSA-3384 virtualbox - security update *** --------------------------------------------- Two vulnerabilities have been discovered in VirtualBox, an x86virtualisation solution. --------------------------------------------- https://www.debian.org/security/2015/dsa-3384 *** Bankomat: Diebstahl per USB-Stick *** --------------------------------------------- Unbekannter konnte in Deutschland mehrere Geräte manipulieren --------------------------------------------- http://derstandard.at/2000024796664 *** Paper on TLS usage for all email protocols, IPv4-wide is online *** --------------------------------------------- Today we've published our paper on TLS use in e-mail protocols (SMTP, IMAP, POP..) on the Internet. Our paper and the corresponding dataset are now publicly available, you can find the paper here. Our dataset is published at scans.io. Over the time of .. --------------------------------------------- https://www.sba-research.org/2015/10/30/paper-on-tls-usage-for-all-email-pr… *** Weaknesses in the PLAID Protocol *** --------------------------------------------- In 2009, the Australian government released the Protocol for Lightweight Authentication of Identity (PLAID) protocol. It was recently analyzed (original paper is from 2014, but was just updated), and its a security disaster. Matt .. --------------------------------------------- https://www.schneier.com/blog/archives/2015/10/weaknesses_in_t.html *** Pagetable-Sicherheitslücke: Ausbruch aus dem virtuellen Xen-Käfig *** --------------------------------------------- Eine Lücke im Xen-Hypervisor erlaubt einem Gastsystem, die Kontrolle über das komplette Host-System zu übernehmen. Hierfür wird die Speicherverwaltung ausgetrickst. Die Entwickler der Qubes-Distribution üben heftige Kritik an Xen. --------------------------------------------- http://www.golem.de/news/pagetable-sicherheitsluecke-ausbruch-aus-dem-virtu… *** Citrix NetScaler Service Delivery Appliance Multiple Security Updates *** --------------------------------------------- A number of vulnerabilities have been identified in Citrix Service Delivery Appliance (SDX) that could allow a malicious, unprivileged user to .. --------------------------------------------- http://support.citrix.com/article/CTX201794 *** Fatale Sicherheitslücken in Zwangsroutern von Vodafone/Kabel Deutschland *** --------------------------------------------- Bis zu 1,3 Millionen Router im Kabel-Netz von Vodafone sind über WLAN angreifbar. Der Provider verspricht, die Lücken mit Firmware-Updates zu schliessen. Das kann sich jedoch noch bis Jahresende hinziehen. --------------------------------------------- http://heise.de/-2866037 *** Breaches, traders, plain text passwords, ethical disclosure and 000webhost *** --------------------------------------------- It's a bit hard to even know where to begin with this one, perhaps at the start and then I'll try and piece all the bits together as best I can. As you may already know if you're familiar with this blog, I run the service Have I been pwned? (HIBP) which allows people to discover where their personal data has been compromised on .. --------------------------------------------- http://www.troyhunt.com/2015/10/breaches-traders-plain-text-passwords.html *** VMSA-2015-0003.14 *** --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2015-0003.html

1 0

Tageszusammenfassung - Donnerstag 29-10-2015
by Daily end-of-shift report 29 Oct '15

29 Oct '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 28-10-2015 18:00 − Donnerstag 29-10-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Why Is the NSA Moving Away from Elliptic Curve Cryptography? *** --------------------------------------------- In August, I wrote about the NSAs plans to move to quantum-resistant algorithms for its own cryptographic needs. Cryptographers Neal Koblitz and Alfred Menezes just published a long paper speculating as to the governments real motives for doing this. They range from some new cryptanalysis of ECC to a political need after the DUAL_EC_PRNG disaster -- to the stated reason... --------------------------------------------- https://www.schneier.com/blog/archives/2015/10/why_is_the_nsa_.html *** New DDoS attacks misuse NetBIOS name server, RPC portmap, and Sentinel licensing servers *** --------------------------------------------- Akamai has observed three new reflection DDoS attacks in recent months: NetBIOS name server reflection, RPC portmap reflection, and Sentinel reflection. In a reflection DDoS attack, also called a D... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/g4MR874bgXg/secworld.php *** TLS-Zertifikate: Google greift gegen Symantec durch *** --------------------------------------------- Symantec hatte im September mehrere Tausend unberechtigte TLS-Zertifikate ausgestellt, verschweigt aber zunächst das Ausmaß des Vorfalls. Google zeigt dafür wenig Verständnis und stellt einige Bedingungen für den Verbleib der Symantec-Rootzertifikate im Chrome-Browser. (Symantec, Google) --------------------------------------------- http://www.golem.de/news/tls-zertifikate-google-greift-gegen-symantec-durch… *** Jackpotting: Geldautomaten in Deutschland mit USB-Stick ausgeräumt *** --------------------------------------------- Seit 2010 ist das Plündern von Geldautomaten per USB-Stick bekannt. In Deutschland wurde nun erstmals ein Täter dabei gefilmt, wie er zwei Automaten an einem Tag ausräumte. (Security, Black Hat) --------------------------------------------- http://www.golem.de/news/jackpotting-geldautomaten-in-deutschland-mit-usb-s… *** Security: Forscher stellen LTE-Angriffe mit 1.250-Euro-Hardware vor *** --------------------------------------------- LTE-Netzwerke galten bislang als deutlich sicherer als GSM- und 3G-Netzwerke. Anfang der Woche hat ein Team von Forschern jetzt verschiedene praktische Angriffe vorgestellt, die mit geringen Kosten und kommerzieller Hardware funktionieren sollen. (Security, Smartphone) --------------------------------------------- http://www.golem.de/news/security-forscher-stellen-lte-angriffe-mit-1-250-e… *** USB cleaning device for the masses, (Thu, Oct 29th) *** --------------------------------------------- For so long, USB keys have been a nice out-of-bandinfection vector. People like goodies and people like to plug those small pieces of plastic into their computers. Even if good solutions exists (like BitLocker- the standard solution provided by Microsoft), a lot of infrastructureare not protected against the use ofrogue USB keys for many good or obscure reasons. There are also multiple reasons to receive USB keys: from partners, customers, contractors, vendors, etc. The best practice should be... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20315&rss *** XEN Security Advisories *** --------------------------------------------- Advisory | Public release | Updated | Version | CVE(s) | Title XSA-153 | 2015-10-29 11:59 | 2015-10-29 11:59 | 3 | CVE-2015-7972 | x86: populate-on-demand balloon size inaccuracy can crash guests XSA-152 | 2015-10-29 11:59 | 2015-10-29 11:59 | 3 | CVE-2015-7971 | x86: some pmu and profiling hypercalls log without rate limiting XSA-151 | 2015-10-29 11:59 | 2015-10-29 11:59 | 3 | CVE-2015-7969 | x86: leak of per-domain profiling-related vcpu pointer array XSA-150 | 2015-10-29 11:59 | 2015-10-29... --------------------------------------------- http://xenbits.xen.org/xsa/ *** Cisco ASR 5500 SAE Gateway Lets Remote Users Cause the Target BGP Process to Restart *** --------------------------------------------- http://www.securitytracker.com/id/1034024 *** IBM DB2 TLS Diffie-Hellman Export Cipher Downgrade Attack Lets Remote Users Decrypt Connections *** --------------------------------------------- http://www.securitytracker.com/id/1033991 *** JBoss Operations Network Cassandra JMX/RMI Interface Lets Remote Users Execute Arbitrary Code on the Target System *** --------------------------------------------- http://www.securitytracker.com/id/1034002 *** DSA-3382 phpmyadmin - security update *** --------------------------------------------- https://www.debian.org/security/2015/dsa-3382 *** Security Notice - Statement About WormHole Vulnerability in Baidu Apps Preset in Huawei Phones *** --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-notices… *** Security Advisory - UE Measurement Leak Vulnerability in Huawei P8 Phones *** --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** Security Advisory: OpenSSH vulnerability CVE-2015-5352 *** --------------------------------------------- (SOL17461) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/17000/400/sol17461.htm… *** VU#573848: Qolsys IQ Panel contains multiple vulnerabilities *** --------------------------------------------- Vulnerability Note VU#573848 Qolsys IQ Panel contains multiple vulnerabilities Original Release date: 29 Oct 2015 | Last revised: 29 Oct 2015 Overview All firmware versions of Qolsys IQ Panel contain hard-coded cryptographic keys, do not validate signatures during software updates, and use a vulnerable version of Android OS. Description Qolsys IQ Panel is an Android OS-based touch screen controller for home automation devices and functions. All firmware versions contain the following --------------------------------------------- http://www.kb.cert.org/vuls/id/573848 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in IBM Java SDK affects IBM SAN Volume Controller and Storwize Family (CVE-2015-2613 CVE-2015-2601 CVE-2015-2625 CVE-2015-1931) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005435 *** IBM Security Bulletin: Vulnerabilities in OpenSSL affects SAN Volume Controller and Storwize Family (CVE-2015-1789 CVE-2015-1791 CVE-2015-1788 ) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005434 *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect IBM Storwize V7000 Unified (CVE-2014-8176, CVE-2015-1789, CVE-2015-1790, CVE-2015-1791, CVE-2015-1792) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005314 *** IBM Security Bulletin: Weak file permissions vulnerability affects IBM Tivoli Monitoring for Tivoli Storage Manager (CVE-2015-4927) *** http://www.ibm.com/support/docview.wss?uid=swg21969340 *** IBM Security Bulletin: A security vulnerability in IBM WebSphere Application Server affects IBM Security Access Manager for Web version 7.0 software installations and IBM Tivoli Access Manager for e-business (CVE-2015-1946) *** http://www.ibm.com/support/docview.wss?uid=swg21969077 *** IBM Security Bulletin: Vulnerability in RC4 stream cipher affects N-series Data ONTAP (CVE-2015-2808) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005273 *** IBM Security Bulletin: Multiple vulnerabilities in Firefox, affect IBM SmartCloud Provisioning for IBM Software Virtual Appliance (CVE-2015-4497, CVE-2015-4498) *** http://www.ibm.com/support/docview.wss?uid=swg21968836 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Security Access Manager for Mobile (CVE-2015-2613, CVE-2015-2601, CVE-2015-4749, CVE-2015-2625, CVE-2015-1931) *** http://www.ibm.com/support/docview.wss?uid=swg21963711

1 0

Tageszusammenfassung - Mittwoch 28-10-2015
by Daily end-of-shift report 28 Oct '15

28 Oct '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 27-10-2015 18:00 − Mittwoch 28-10-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** One in 20 apps on private PCs are end-of-life *** --------------------------------------------- Secunia Research revealed the state of security for PC users in a total of 14 countries, including the US. One in 20 applications on private US PCs are end-of-life and 12 percent of Windows operating ... --------------------------------------------- http://www.net-security.org/secworld.php?id=19032 *** Yahoo! crypto! chap! turns! security! code! into! evil! tracker! *** --------------------------------------------- HTTP Strict Transport Security isnt working as advertised or planned Yahoo! crypto bod Yan Zhu has found twin attacks that allow websites to learn the web histories of visitors users by targeting HTTP Strict Transport Security (HSTS). --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/10/28/sniffly/ *** Update unbedingt installieren: Joomla im Fokus von Angreifern *** --------------------------------------------- Nutzer von Joomla sollten das in der vergangenen Woche veröffentlichte Update dringend einspielen. Denn Angreifer attackieren aktuell massenweise Webseiten, die eine verwundbare Version einsetzen. --------------------------------------------- http://heise.de/-2860521 *** Windows 10 Security *** --------------------------------------------- Windows 10 was launched on July 29th of this year and had been adopted by 75 million users by the end of August. Despite its initial popularity, the adoption rate for the new operating system has slowed down since the time of its launch. While the Windows 10 market share for desktop operating systems climbed... --------------------------------------------- http://resources.infosecinstitute.com/windows-10-security/ *** Victim of its own success and (ab)used by malwares, (Wed, Oct 28th) *** --------------------------------------------- This morning, I faced an interesting case. We were notified that one of our computers was doing potentially malicious HTTP requests. The malicious URL was: api.wipmania.com. We quickly checked and detected to many hosts were sendingrequests to this API. It is a website hosted in France which provides geolocalisation services via a text/json/xml API. The usage is pretty quick and">xavier@vps2$curl http://api.wipmania.com/ip_address BE You provide an IP address and it returns its... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20311&rss *** Certificate Authorities Will Stop Issuing SHA1 Certificates as of January 1 (October 23, 2015) *** --------------------------------------------- As of midnight January 1, 2016, certificate authorities will cease issuing SHA1 digital certificates... --------------------------------------------- http://www.sans.org/newsletters/newsbites/r/17/84/308 *** We set up a simple test page to see how browsers deal with mixed language IDNs. Try it out: http://www.example.xn--comindex-634g.jp/ . Test yours. (sorry, earlier link did not render right), (Tue, Oct 27th) *** --------------------------------------------- --- Johannes B. Ullrich, Ph.D. STI|Twitter|LinkedIn (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20305&rss *** DFN-CERT-2015-1672: NTP: Mehrere Schwachstellen ermöglichen u.a. das Ausführen beliebigen Programmcodes *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-1672/ *** DSA-3381 openjdk-7 - security update *** --------------------------------------------- Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in the executionof arbitrary code, breakouts of the Java sandbox, information disclosure,or denial of service. --------------------------------------------- https://www.debian.org/security/2015/dsa-3381 *** DSA-3380 php5 - security update *** --------------------------------------------- Two vulnerabilities were found in PHP, a general-purpose scriptinglanguage commonly used for web application development. --------------------------------------------- https://www.debian.org/security/2015/dsa-3380 *** VU#350508: HP ArcSight SmartConnector fails to properly validate SSL and contains a hard-coded password *** --------------------------------------------- Vulnerability Note VU#350508 HP ArcSight SmartConnector fails to properly validate SSL and contains a hard-coded password Original Release date: 27 Oct 2015 | Last revised: 27 Oct 2015 Overview The HP ArcSight SmartConnector fails to properly validate SSL certificates, and also contains a hard-coded password. Description CWE-295: Improper Certificate Validation - CVE-2015-2902The ArcSight SmartConnector fails to validate the certificate of the upstream Logger device it is reporting logs to. --------------------------------------------- http://www.kb.cert.org/vuls/id/350508 *** Security Advisory: PAM vulnerability CVE-2015-3238 *** --------------------------------------------- (SOL17494) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/17000/400/sol17494.htm… *** Security Advisory: Datastor kernel vulnerability CVE-2015-7394 *** --------------------------------------------- (SOL17407) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/17000/400/sol17407.htm… *** Infinite Automation Systems Mango Automation Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for vulnerabilities in the Infinite Automation Systems Mango Automation application. Infinite Automation Systems has produced a new version to mitigate these vulnerabilities. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-300-02 *** Rockwell Automation Micrologix 1100 and 1400 PLC Systems Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for vulnerabilities in the Rockwell Automation Allen-Bradley MicroLogix 1100 and 1400 programmable logic controller (PLC) systems. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-300-03

1 0

Tageszusammenfassung - Dienstag 27-10-2015
by Daily end-of-shift report 27 Oct '15

27 Oct '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 23-10-2015 18:00 − Dienstag 27-10-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Botnets spreading Dridex still active, (Fri, Oct 23rd) *** --------------------------------------------- Introduction In early September 2015, we started seeing reports about arrests tied to Dridex malware [1, 2]. About that time, we noticed a lack of botnet-based malicious spam (malspam) pushing Dridex malware. During the month of September, Dridex disappeared from our radar. By the beginning of October 2015, malspam pushing Dridex came back [3], and its continued since then. However, organizations still discussed the Dridex takedown, even after Dridex came back. The most recent wave of reporting... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20295&rss *** Unsichere App-TAN: Sparkasse verteidigt ihr pushTAN-Banking *** --------------------------------------------- Die Manipulationen beträfen "veraltete Versionsstände der S-pushTAN-App" und tatsächliche Schadensfälle seien unwahrscheinlich, heißt es in einer Stellungnahme der Sparkassen zu einem erfolgreichen Angriff auf ihr AppTAN-Verfahren. --------------------------------------------- http://www.heise.de/newsticker/meldung/Unsichere-App-TAN-Sparkasse-verteidi… *** Free and Commercial Tools to Implement the SANS Top 20 Security Controls, Part 5: Malware Defenses *** --------------------------------------------- This is Part 5 of a How-To effort to compile a list of tools (free and commercial) that can help IT administrators comply with SANS Security Controls. In Part 1 we looked at Inventory of Authorized and Unauthorized Devices. In Part 2 we looked at Inventory of Authorized and Unauthorized Software. In Part 3 we looked at Secure Configurations. In Part 4 we looked at Continuous Vulnerability Assessment and Remediation. Now in Part 5 well take on Malware Defenses. 5-1 Employ automated tools... --------------------------------------------- https://www.alienvault.com/blogs/security-essentials/free-and-commercial-to… *** Beyond Automated Penetration Testing *** --------------------------------------------- #WarStoryWednesday Not too long ago, I was tasked with performing an Application Security Assessment while onsite at a client location. I had worked with this client before, and was eager to see how they had matured their applications over the past couple years. Originally, I had performed an Application Security Assessment on an older version... --------------------------------------------- http://resources.infosecinstitute.com/beyond-automated-penetration-testing/ *** Joomla SQL Injection Attacks in the Wild *** --------------------------------------------- Last week, the Joomla team released an update patching a serious vulnerability in Joomla 3.x. This vulnerability, an SQL injection (CVE-2015-7858), allows for an attacker to take over a vulnerable site with ease. We predicted that the attacks would start in the wild very soon, due to the popularity of the Joomla platform alongRead More The post Joomla SQL Injection Attacks in the Wild appeared first on Sucuri Blog. --------------------------------------------- https://blog.sucuri.net/2015/10/joomla-sql-injection-attacks-in-the-wild.ht… *** Patch außer der Reihe: Adobe schließt kritische Lücke in Shockwave *** --------------------------------------------- Angreifer können den Shockwave Player verwenden, um aus der Ferne Schadcode auf Rechner zu schleusen. Adobe bewertet die Lücke mit der höchsten Prioritätsstufe. --------------------------------------------- http://heise.de/-2860125 *** Intel x86 considered harmful (new paper) *** --------------------------------------------- Oct 27, 2015 - Joanna Rutkowska | Back in summer I have read a new book published by one of the core Intel architects about the Management Engine (ME). I didnt quite like what I read there. In fact I even found this a bit depressing, even though Intel ME wasnt particular news to me as we, at the ITL, have already studied this topic quite in-depth, so to say, back in 2008... But, as you can see in the linked article, I believed we could use VT-d to protect the host OS from the potentially... --------------------------------------------- http://blog.invisiblethings.org/2015/10/27/x86_harmful.html *** Patchday: Updates für Xen-Hypervisor *** --------------------------------------------- Xen hat einige Lücken in seinem Hypervisor geschlossen. Details werden, wie üblich, erst später bekannt gegeben. --------------------------------------------- http://www.golem.de/news/patchday-updates-fuer-xen-hypervisor-1510-117152-r… *** Volkswagen: Hacker deaktivieren Airbag über gefälschte Diagnose-Software *** --------------------------------------------- Wieder gibt es manipulierte Software bei VW - doch dieses Mal ist der Konzern nicht selbst verantwortlich. Hackern ist es offensichtlich gelungen, die Steuersoftware eines Audi TT so zu manipulieren, dass der Airbag ohne Wissen der Nutzer abgeschaltet werden kann. --------------------------------------------- http://www.golem.de/news/volkswagen-hacker-deaktivieren-airbag-ueber-gefael… *** The "Yes, but..." syndrome, (Tue, Oct 27th) *** --------------------------------------------- This weekend, I worked on a pentest report that was already pending for a while. Im honest: Im lazzy to write reports (like many of us, no?).During a pentest, it is mandatory to keep evidences of all your findings. No only the tools you used and how you used them but as much details as possible (screenshots, logs, videos, papers,etc). Every day, we had a quick debriefing meeting with the customer to make the point about the new findings. The first feedback was often a Yes, but...: Me: We were --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20303&rss *** JSA10711 - 2015-10 Out of Cycle Security Bulletin: NTP.org announcement of multiple vulnerabilities. *** --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10711&actp=RSS *** Bugtraq: [security bulletin] HPSBGN03429 rev.1 - HP Arcsight Logger, Remote Disclosure of Information *** --------------------------------------------- http://www.securityfocus.com/archive/1/536749 *** Bugtraq: [security bulletin] HPSBGN03428 rev.1 - HP Asset Manager, Local Disclosure of Sensitive Information *** --------------------------------------------- http://www.securityfocus.com/archive/1/536748 *** DSA-3377 mysql-5.5 - security update *** --------------------------------------------- Several issues have been discovered in the MySQL database server. Thevulnerabilities are addressed by upgrading MySQL to the new upstreamversion 5.5.46. Please see the MySQL 5.5 Release Notes and OraclesCritical Patch Update advisory for further details:... --------------------------------------------- https://www.debian.org/security/2015/dsa-3377 *** DSA-3378 gdk-pixbuf - security update *** --------------------------------------------- Several vulnerabilities have been discovered in gdk-pixbuf, a toolkitfor image loading and pixel buffer manipulation. The CommonVulnerabilities and Exposures project identifies the following problems:... --------------------------------------------- https://www.debian.org/security/2015/dsa-3378 *** Security Notice - Statement on the Huawei Honor phone Vulnerability Mentioned at the GeekPwn Conference *** --------------------------------------------- Oct 25, 2015 09:27 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-notices… *** Cisco Security Advisories *** --------------------------------------------- *** Cisco Secure Access Control Server Input Validation Flaw Lets Remote Conduct Cross-Site Scripting Attacks *** http://www.securitytracker.com/id/1033968 *** Cisco Secure Access Control Server Input Validation Flaw Lets Remote Authenticated Users Inject SQL Commands *** http://www.securitytracker.com/id/1033967 *** Cisco Secure Access Control Server RBAC Flaw Lets Remote Authenticated Users Modify Dashboard Portlets on the Target System *** http://www.securitytracker.com/id/1033971 *** Cisco Secure Access Control Server RBAC Flaw Lets Remote Authenticated Users Obtain System Administrator Reports and Status *** http://www.securitytracker.com/id/1033970 *** Cisco Secure Access Control Server DOM Statement Input Validation Flaw Lets Remote Conduct Cross-Site Scripting Attacks *** http://www.securitytracker.com/id/1033969 *** Siemens Rugged Operating System (ROS) Ethernet Frame Padding Bug Lets Remote Users on the Local Network Obtain Potentially Sensitive VLAN Information *** --------------------------------------------- http://www.securitytracker.com/id/1033973

1 0

Tageszusammenfassung - Freitag 23-10-2015
by Daily end-of-shift report 23 Oct '15

23 Oct '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 22-10-2015 18:00 − Freitag 23-10-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Red Hat CVE Database Revamp *** --------------------------------------------- Since 2009, Red Hat has provided details of vulnerabilities with CVE names as part of our mission to provide as much information around vulnerabilities that affect Red Hat products as possible. These CVE pages distill information from a variety .. --------------------------------------------- https://securityblog.redhat.com/2015/10/22/red-hat-cve-database-revamp/ *** Hack.lu 2015 Wrap-Up Day #3 *** --------------------------------------------- I just drove back to home after the 11th edition of hack.lu. As always, it was an amazing event organized by, amongst others, many team members of the CIRCL. So, let's write a quick wrap-up for this third day. Some talk will be less covered due to interesting chat sessions with a lot of infosec peers. Lik .. --------------------------------------------- https://blog.rootshell.be/2015/10/22/hack-lu-2015-wrap-up-day-3/ *** Oracle Critical Patch Update Advisory - October 2015 *** --------------------------------------------- http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html *** Janitza UMG Power Quality Measuring Products Vulnerabilities *** --------------------------------------------- This advisory was originally posted to the US-CERT secure Portal library on September 22, 2015, and is being released to the ICS-CERT web site. This advisory provides mitigation details for several vulnerabilities in the Janitza UMG power quality measuring products. Janitza has produced new firmware and new documentation to mitigate these vulnerabilities. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-265-03 *** 5E5: Die nächste runde Ticketnummer *** --------------------------------------------- Es ist soweit: unser Ticketsystem hat wieder eine symbolische Grenze überschritten: Wir haben das Ticket #500000 behandelt:Date: Thu Oct 22 11:07:54 2015Queue: InvestigationsSubject: [CERT.at #500000] SSDP-Service aus dem Internet erreichbar in AS12635 Was bedeuten diese Zahlen? Und was nicht? Wir bekommen und senden .. --------------------------------------------- http://www.cert.at/services/blog/20151023103846-1610.html *** Forscher demontieren App-TANs der Sparkasse *** --------------------------------------------- "Komfortabel, aber leider unsicher" - so lässt sich das Ergebnis eines Forschungsprojekts zu den von immer mehr Banken angebotetenen App-basierten TAN-Verfahren zusammenfassen. Die Online-Banking-Apps der Sparkasse haben sie bereits geknackt. --------------------------------------------- http://heise.de/-2853492 *** CCTV botnets proliferate due to unchanged default factory credentials *** --------------------------------------------- Incapsula researchers have uncovered a botnet consisting of some 9,000 CCTV cameras located around the world, which was being used to target, among others, one of the companys clients with HTTP flood... --------------------------------------------- http://www.net-security.org/secworld.php?id=19020 *** PMASA-2015-5 *** --------------------------------------------- Content spoofing vulnerability when redirecting user to an external siteAffected VersionsVersions 4.4.x (prior to 4.4.15.1) and 4.5.x (prior to 4.5.1) are affected.CVE ID2015-7873 --------------------------------------------- https://www.phpmyadmin.net/security/PMASA-2015-5/ *** Malvertising-Kampagne verteilt Exploit-Kit über ebay.de *** --------------------------------------------- Betrüger sollen aktuell Werbenetzwerke missbrauchen, um Exploit-Kits über Werbeanzeigen auf etwa ebay.de und t-online.de zu verteilen. --------------------------------------------- http://heise.de/-2853882 Aufgrund des Feiertages am kommenden Montag, den 26.10.2015, erscheint der nächste End-of-Shift Report erst am 27.10.2015.

1 0

Tageszusammenfassung - Donnerstag 22-10-2015
by Daily end-of-shift report 22 Oct '15

22 Oct '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 21-10-2015 18:00 − Donnerstag 22-10-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Cisco ASA Software DNS Denial of Service Vulnerability *** --------------------------------------------- A vulnerability in the DNS code of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause an affected system to reload. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco ASA Software DNS Denial of Service Vulnerability *** --------------------------------------------- A vulnerability in the DNS code of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause an affected system to reload. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Google Moving Gmail to Strict DMARC Implementation *** --------------------------------------------- Google said it will move gmail.com to a policy of rejecting any messages that don't pass the authentication checks spelled out in the DMARC specification. --------------------------------------------- http://threatpost.com/google-moving-gmail-to-strict-dmarc-implementation/11… *** IBM Runs World's Worst Spam-Hosting ISP? *** --------------------------------------------- This author has long sought to shame Web hosting and Internet service providers who fail to take the necessary steps to keep spammers, scammers and other online neer-do-wells .. --------------------------------------------- http://krebsonsecurity.com/2015/10/ibm-runs-worlds-worst-spam-hosting-isp *** Apple Releases Updates for iOS, WatchOS, OS X, Safari and iTunes. *** --------------------------------------------- Apple published one of its usual updates for everything. Below I took a shot at a quick summary. You can find .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20285 *** Drupal Core - Overlay - Less Critical - Open Redirect - SA-CORE-2015-004 *** --------------------------------------------- The Overlay module in Drupal core displays administrative pages as a layer over the current page (using JavaScript), rather than replacing the page in the browser window. The Overlay module does not sufficiently validate URLs prior to displaying their contents, leading to an open redirect vulnerability. --------------------------------------------- https://www.drupal.org/SA-CORE-2015-004 *** jQuery Update - Less Critical - Open Redirect - SA-CONTRIB-2015-158 *** --------------------------------------------- The jQuery Update module enables you to update jQuery on your site. The module ships with a modified version of the core Overlay JavaScript file, which is vulnerable to an open redirect attack (see SA-CORE-2015-004). --------------------------------------------- https://www.drupal.org/node/2598426 *** Hack.lu 2015 Wrap-Up Day #2 *** --------------------------------------------- Here we go with my wrap-up for the second day. After some coffee and pastries, the day started hardly with a very technical talk. Samuel Chevet & Clement Rouault presented their research about Windows local kernel debugging. Kernel debugging .. --------------------------------------------- https://blog.rootshell.be/2015/10/21/hack-lu-2015-wrap-up-day-2/ *** E-Mail-Sicherheit: Was Provider beitragen können *** --------------------------------------------- https://www.rtr.at/de/inf/E_Mail_Sicherheit05112015 *** Drahtlose Infektion: Erste Malware für Fitnesstracker entwickelt *** --------------------------------------------- Übertragung auf Fitbit Flex in zehn Sekunden möglich – Schadsoftware befällt PC von Opfer --------------------------------------------- http://derstandard.at/2000024345670 *** Geplante Obsoleszenz: Diese Software lässt Computer rasend schnell altern *** --------------------------------------------- Forscher haben ein Programm entwickelt, das Prozessoren in kurzer Zeit so abnutzt, dass sie unbrauchbar werden. Mögliche Nutznießer: Hersteller, Kunden - oder Militärs. --------------------------------------------- http://www.golem.de/news/geplante-obsoleszenz-diese-software-laesst-compute… *** [20151001] - Core - SQL Injection *** --------------------------------------------- http://developer.joomla.org/security-centre/628-20151001-core-sql-injection… *** [20151002] - Core - ACL Violations *** --------------------------------------------- http://developer.joomla.org/security-centre/629-20151002-core-acl-violation… *** [20151003] - Core - ACL Violations *** --------------------------------------------- http://developer.joomla.org/security-centre/630-20151003-core-acl-violation… *** [2015-10-22] Lime Survey Multiple Critical Vulnerabilities *** --------------------------------------------- Lime Survey contains multiple vulnerabilities which can be used by unauthenticated attackers to execute administrative functions. Moreover, in certain conditions unauthenticated attackers can run arbitrary PHP code and gain access to the filesystem and the Lime Survey database. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015… *** NAK to the Future: NTP Symmetric Association Authentication Bypass Vulnerability *** --------------------------------------------- Unauthenticated off-path attackers can force ntpd processes to peer with malicious time sources of the attacker's choosing allowing the attacker to make arbitrary changes to system time. This attack leverages a logic error in ntpd's handling of .. --------------------------------------------- http://talosintel.com/reports/TALOS-2015-0069/

1 0

Tageszusammenfassung - Mittwoch 21-10-2015
by Daily end-of-shift report 21 Oct '15

21 Oct '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 20-10-2015 18:00 − Mittwoch 21-10-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** VMSA-2015-0003.13 *** --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2015-0003.html *** APPLE-SA-2015-10-20-1 OS X: Flash Player plug-in blocked *** --------------------------------------------- Due to security issues in older versions, Apple has updated the web plug-in blocking mechanism to disable all versions prior to Flash Player 19.0.0.226 and 18.0.0.255. --------------------------------------------- http://prod.lists.apple.com/archives/security-announce/2015/Oct/msg00001.ht… *** VMSA-2015-0007.2 *** --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2015-0007.html *** Oracle Linux Bulletin - October 2015 *** --------------------------------------------- Oracle Linux Bulletin - October 2015 --------------------------------------------- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719… *** New Headaches: How The Pawn Storm Zero-Day Evaded Java's Click-to-Play Protection *** --------------------------------------------- Several months ago, we disclosed that Pawn Storm was using a then-undiscovered zero-day Java vulnerability to carry out its attacks. At the time, we noted that a separate vulnerability was used to bypass the click-to-play protection that is in use by Java. This second vulnerability has now been .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/new-headaches-ho… *** Multiple vulnerabilities in SAP products *** --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-532/ http://www.zerodayinitiative.com/advisories/ZDI-15-531/ http://www.zerodayinitiative.com/advisories/ZDI-15-530/ http://www.zerodayinitiative.com/advisories/ZDI-15-529/ http://www.zerodayinitiative.com/advisories/ZDI-15-528/ http://www.zerodayinitiative.com/advisories/ZDI-15-527/ http://www.zerodayinitiative.com/advisories/ZDI-15-526/ *** G DATA Malware Report - January - June 2015 *** --------------------------------------------- The G Data SecurityLabs published the Malware Report for the first half of 2015. Here are the most important findings. --------------------------------------------- https://blog.gdatasoftware.com/blog/article/g-data-malware-report-january-j… *** EMET: To be, or not to be, A Server-Based Protection Mechanism *** --------------------------------------------- Hi Folks - Platforms PFE Dan Cuomo here to discuss a common question seen in the field: 'My customer is deploying EMET and would like to know if it is supported on Server Operating Systems.' On the surface there is a simple answer to this question, .. --------------------------------------------- http://blogs.technet.com/b/srd/archive/2015/10/20/emet-to-be-or-not-to-be-a… *** Hack.lu 2015 Wrap-Up Day #1 *** --------------------------------------------- Today started the 11th edition of hack.lu in Luxembourg. Being one of my preferred event, I drove to Luxembourg this morning direction to the Alvisse Parc hotel! The first day started with a security breakfast and a round .. --------------------------------------------- https://blog.rootshell.be/2015/10/20/hack-lu-2015-wrap-up-day-1/ *** Flash, Java Patches Fix Critical Holes *** --------------------------------------------- Adobe has issued a patch to fix a zero-day vulnerability in its Flash Player software. Separately, Oracle today released an update to plug more than two-dozen flaws in its Java software. Both programs plug directly into the browser and are .. --------------------------------------------- http://krebsonsecurity.com/2015/10/flash-java-patches-fix-critical-holes/ *** Online-Banking: Neue Angriffe auf die mTAN *** --------------------------------------------- Betrüger haben wieder einmal eine Methode gefunden, um Daten von Kunden beim Online-Banking abzugreifen und das mTAN-System auszuhebeln. --------------------------------------------- http://heise.de/-2851624 *** Microsoft startet Bug-Bounty-Programm für .NET Core und ASP.NET *** --------------------------------------------- Bis zum 20. Januar 2016 können Entwickler im Rahmen des Programms auf Sicherheitslücken in den Betas der CoreCLR und ASP.NET 5 hinweisen. Gute Lösungsvorschläge sind Microsoft bis zu 15.000 US-Dollar wert. --------------------------------------------- http://heise.de/-2851587 *** Gwolle Guestbook <= 1.5.3 - Remote File Inclusion (RFI) *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8218 *** High-Tech Bridge launches free PCI and NIST compliant SSL test *** --------------------------------------------- High-Tech Bridge is pleased to announce availability of its new online service to test SSL/TLS server security and configuration for compliance with NIST and PCI DSS. --------------------------------------------- https://www.htbridge.com/news/high-tech-bridge-launches-free-pci-and-nist-c… *** Metadaten-Leak: 1Password stellt Dateiformat um *** --------------------------------------------- Nutzer der Abgleichfunktion "1Password Anywhere" hinterließen unter Umständen eine Liste mit den von ihnen verwendeten Websites im Netz. Ein neues Dateiformat für den Passworttresor soll Abhilfe schaffen. --------------------------------------------- http://heise.de/-2851618 *** IniNet Solutions embeddedWebServer Cleartext Storage Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a cleartext storage of sensitive information vulnerability in the IniNet Solutions GmbH embeddedWebServer. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-293-01 *** IniNet Solutions SCADA Web Server Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for three vulnerabilities in the IniNet Solutions GmbH SCADA Web Server. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-293-02 *** 3S CODESYS Gateway Null Pointer Exception Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a null pointer exception vulnerability in the 3S-Smart Software Solutions GmbH CODESYS Gateway Server. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-293-03 *** Angriffe auf Magento-Shops über bereits bekannte Lücken *** --------------------------------------------- Die aktuellen Angriffe auf Tausende von Magento-Webseiten finden wohl über Lücken statt, für die bereits Patches existieren. Außerdem werden auch Seiten angegriffen, die Magento gar nicht einsetzen. --------------------------------------------- http://heise.de/-2851842 *** Hacking Challenge: Staatsdruckerei sucht IT-Talente *** --------------------------------------------- Die Österreichische Staatsdruckerei veranstaltet auf der Karrieremesse des Campus Hagenberg der FH OÖ eine Hacking Challenge mit dem Ziel, junge IT-Talente zu finden. --------------------------------------------- http://futurezone.at/digital-life/hacking-challenge-staatsdruckerei-sucht-i… *** Kampagnen Malvertising Campaign Goes After German Users *** --------------------------------------------- Malvertising targets German users via carefully crafted attack to dupe ad networks...) --------------------------------------------- https://blog.malwarebytes.org/malvertising-2/2015/10/kampagnen-malvertising… *** Trend Micro kauft Tipping Point *** --------------------------------------------- Mit Tipping Point verleibt sich der Antiviren-Hersteller auch die Zero Day Initiative (ZDI) und die Digital Vaccine Labs ein. Tipping Point, bisher Teil von HP, ist unter anderem auch als Sponsor der Pwn2Own-Events bekannt. --------------------------------------------- http://heise.de/-2851848

1 0

Tageszusammenfassung - Dienstag 20-10-2015
by Daily end-of-shift report 20 Oct '15

20 Oct '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 19-10-2015 18:00 − Dienstag 20-10-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Joomla! - Important Security Announcement - Patch Available Soon *** --------------------------------------------- A Joomla 3.4.5 release containing a security fix will be published on Thursday 22nd October at approximately 14:00 UTC The Joomla Security Strike Team (JSST) has been informed of a critical security issue in the Joomla core. Since this is a *very important security fix*, please be prepared to update your Joomla installations next Thursday. --------------------------------------------- https://www.joomla.org/announcements/release-news/5633-important-security-a… *** JSA10700 - 2015-10 Security Bulletin: Junos: J-Web in SRX5000-Series: A remote attacker can cause a denial of service to SRX5000-Series when J-Web is enabled causing the SRX to enter debug prompt. (CVE-2014-6451) *** --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10700&actp=RSS *** ZDI-15-525: Foxit Reader Forms Out-Of-Bounds Read Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-525/ *** ZDI-15-524: Foxit Reader Forms Out-Of-Bounds Read Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-524/ *** Lets Encrypt: Cross-Sign mit Identtrust abgeschlossen *** --------------------------------------------- Let's Encrypt hat einen neuen Meilenstein erreicht: Der Cross-Sign mit Identtrust ist abgeschlossen. Ab Mitte November soll der Dienst für die breite Öffentlichkeit verfügbar sein. --------------------------------------------- http://www.golem.de/news/let-s-encrypt-cross-sign-mit-identtrust-abgeschlos… *** DSA-3375 wordpress - security update *** --------------------------------------------- Several vulnerabilities have been fixed in Wordpress, the popularblogging engine. --------------------------------------------- https://www.debian.org/security/2015/dsa-3375 *** Android 6.0: Verschlüsselung wird verpflichtend *** --------------------------------------------- Einen zweiten Anlauf nimmt Google zur Absicherung von Android-Smartphones und Tablets: Mit Android 6.0 müssen – fast – alle neuen Geräte von Haus aus verschlüsselt werden, dies schreibt die neueste Version des Android Compatibility Definition Document vor. --------------------------------------------- http://derstandard.at/2000024183416 *** Hacking ZigBee Networks *** --------------------------------------------- What is ZigBee? Internet of Things (IoT) is what most experts consider as the next step of the Internet revolution where physical objects are invariably linked to the real and virtual world at the same time. Connected devices now .. --------------------------------------------- http://resources.infosecinstitute.com/hacking-zigbee-networks/ *** OpenSSH: Erster Code von SSH für Windows frei verfügbar *** --------------------------------------------- Die portable Version des aktuellen OpenSSH 7.1 stellt Microsoft nun auch für Windows bereit. Interessierte können außerdem künftig zu dem Projekt beitragen. Der produktive Einsatz soll noch in der ersten Jahreshälfte 2016 möglich sein. --------------------------------------------- http://www.golem.de/news/openssh-erster-code-von-ssh-fuer-windows-frei-verf… *** How a criminal ring defeated the secure chip-and-PIN credit cards *** --------------------------------------------- Over $680,000 stolen via a clever man-in-the-middle attack. --------------------------------------------- http://arstechnica.com/tech-policy/2015/10/how-a-criminal-ring-defeated-the… *** .:: Attacking Ruby on Rails Applications ::. *** --------------------------------------------- This little article aims to give an introduction to the topic of attacking Ruby on Rails applications. Its neither complete nor dropping 0day. Its rather the authors attempt to accumulate the interesting attack paths and techniques in one write up. As yours truly spend most of his work on Ruby .. --------------------------------------------- http://phrack.org/papers/attacking_ruby_on_rails.html *** Korrupter Silk-Road-Ermittler zu über sechs Jahren Haft verurteilt *** --------------------------------------------- Seine verdeckten Ermittlungen gegen den Drogenmarktplatz Silk Road nutzte ein US-Beamter für eigene kriminelle Machenschaften. Unter anderem wegen Erpressung und Geldwäsche muss er nun ins Gefängnis. --------------------------------------------- http://heise.de/-2851334 *** Tech Support Scammers Impersonate Apple Technicians *** --------------------------------------------- By setting up a phishing site for Apples remote sharing service, this tech support scam looks quite genuine. --------------------------------------------- https://blog.malwarebytes.org/fraud-scam/2015/10/tech-support-scammers-impe… *** There's no place like ::1 - Malware for the masses *** --------------------------------------------- Analyzing malware samples provided by customers usually leads to interesting results. Recently, an HP customer downloaded something via Microsoft Internet Explorer and provided the sample analyzed in this blog. In some cases, analysis of these types of samples provides insight into previously unknown .. --------------------------------------------- http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/There-s-no-place-lik… *** Das BSI nimmt sich der Router-Sicherheit an *** --------------------------------------------- Das BSI hat ein Testkonzept vorgestellt, das die Sicherheit von Endkunden-Routern vergleichbar machen soll. Die 'wesentliche Sicherheitskomponente zum Schutz des internen Netzes' soll endlich sicher werden. --------------------------------------------- http://heise.de/-2851354

1 0

Tageszusammenfassung - Montag 19-10-2015
by Daily end-of-shift report 19 Oct '15

19 Oct '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 16-10-2015 18:00 − Montag 19-10-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** eFast browser hijacks file associations *** --------------------------------------------- We take a look at an Eorezo/Tuto4PC hijacker that installs a new browser called eFast rather than hijacking an existing one. --------------------------------------------- https://blog.malwarebytes.org/online-security/2015/10/efast-browser-hijacks… *** Surveillance Malware Trends: Tracking Predator Pain and HawkEye *** --------------------------------------------- Malicious actors employ a range of tools to achieve their objectives. One of the most damaging activities an actor pursues is the theft of authentication information, whether it .. --------------------------------------------- http://researchcenter.paloaltonetworks.com/2015/10/surveillance-malware-tre… *** SDG Technologies Plug and Play SCADA XSS Vulnerability *** --------------------------------------------- NCCIC/ICS-CERT is aware of a public disclosure of a cross-site scripting vulnerability with proof-of-concept (PoC) exploit code affecting SDG Technologies Plug and Play SCADA, a supervisory control and data acquisition/human-machine .. --------------------------------------------- https://ics-cert.us-cert.gov/alerts/ICS-ALERT-15-288-01 *** DSA-3373 owncloud - security update *** --------------------------------------------- Multiple vulnerabilities were discovered in ownCloud, a cloud storageweb service for files, music, contacts, calendars and many more. These flaws may lead to the execution of arbitrary code, authorization bypass,information disclosure, cross-site scripting or denial of service. --------------------------------------------- https://www.debian.org/security/2015/dsa-3373 *** Massive Magento Guruincsite Infection *** --------------------------------------------- We are currently seeing a massive attack on Magento sites where hackers inject malicious scripts that create iframes from 'guruincsite[.]com'. Google already blacklisted about seven thousand sites because of this malware. There are two .. --------------------------------------------- https://blog.sucuri.net/2015/10/massive-magento-guruincsite-infection.html *** New Neutrino EK Campaign Drops Andromeda *** --------------------------------------------- On October 15th, we started seeing a new pattern of redirections to the Neutrino Exploit Kit via compromised websites. What actually caught our attention was one of the file names used to inject an iframe pointing to the exploit kit landing page. Ironically, it was called neitrino.php. --------------------------------------------- https://blog.malwarebytes.org/exploits-2/2015/10/new-neutrino-ek-campaign-d… *** Freies Unix: OpenBSD 5.8 zähmt das System *** --------------------------------------------- Etwas eher als üblich ist OpenBSD auf den Tag genau 20 Jahre nach der Projektgründung erschienen. Für bessere Sicherheit wird das NX-Bit nun auch in der 32-Bit-X86-Architektur genutzt, der Sudo-Befehl ist ersetzt worden und das System kann offiziell gezähmt werden. --------------------------------------------- http://www.golem.de/news/freies-unix-openbsd-5-8-zaehmt-das-system-1510-116… *** 1Password Leaks Your Data *** --------------------------------------------- For those of you who don't know, 1PasswordAnywhere is a feature of 1Password which allows you to access your data without needing their client software. 1Password originally only used the �Agile Keychain� format to store their data (not including when they were OS X keychain only). This format basically stores your data as a series of JavaScript files which are decrypted .. --------------------------------------------- http://myers.io/2015/10/22/1password-leaks-your-data/ *** Staatliche Hackerangriffe: Facebook will seine Nutzer warnen *** --------------------------------------------- Facebook will von staatlichen Angriffen bedrohte Nutzer künftig warnen und ihnen den Einsatz von Zwei-Faktor-Authentifizeriung empfehlen. Bei der Klarnamenpflicht bleibt das Unternehmen aber bei seiner Position. --------------------------------------------- http://www.golem.de/news/staatliche-hackerangriffe-facebook-will-seine-nutz… *** Supporting the Android Ecosystem *** --------------------------------------------- A few months ago, a widely-publicized set of vulnerabilities called StageFright hit the Android ecosystem. While Google fixed the vulnerabilities in what appears to be a reasonable amount of time, the deployment of those fixes to .. --------------------------------------------- https://insights.sei.cmu.edu/cert/2015/10/supporting-the-android-ecosystem.…

1 0

Tageszusammenfassung - Freitag 16-10-2015
by Daily end-of-shift report 16 Oct '15

16 Oct '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 15-10-2015 18:00 − Freitag 16-10-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Security Updates Available for Adobe Flash Player (APSB15-27) *** --------------------------------------------- A security bulletin (APSB15-27) has been published regarding security updates for Adobe Flash Player. These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe is aware of a report that an... --------------------------------------------- https://blogs.adobe.com/psirt/?p=1288 *** Exposing the most dangerous financial malware threats *** --------------------------------------------- Cyphort analyzed the top eight types of financial malware cybercriminals are using today to target banks and electronic payment systems. The most dangerous financial malware threats have resulted i... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/otxCIk5qeu4/malware_news.… *** Data dump points to a breach at Electronic Arts *** --------------------------------------------- Account details of some 600 Electronic Arts (EA) customers have apparently been leaked on Pastebin. The company has yet to confirm that the leak is genuine, but they are "taking steps to secure any ac... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/-grCjlQtA4c/secworld.php *** Enhanced Mitigation Experience Toolkit (EMET) version 5.5 Beta is now available *** --------------------------------------------- Enhanced Mitigation Experience Toolkit (EMET) version 5.5 Beta is now available The Enhanced Mitigation Experience Toolkit (EMET) benefits enterprises and all computer users by helping to protect against security threats and breaches that can disrupt businesses and daily lives. It does this by anticipating, diverting, terminating, blocking, or otherwise invalidating the most common actions and techniques adversaries might use to compromise a computer. In this way, EMET can help protect your... --------------------------------------------- http://blogs.technet.com/b/srd/archive/2015/10/15/enhanced-mitigation-exper… *** Windows Drivers are True'ly Tricky *** --------------------------------------------- Posted by James Forshaw, Driving for BugsAuditing a product for security vulnerabilities can be a difficult challenge, and there's no guarantee you'll catch all vulnerabilities even when you do. This post describes an issue I identified in the Windows Driver code for Truecrypt, which has already gone through a security audit. The issue allows an application running as a normal user or within a low-integrity sandbox to remap the main system drive and elevate privileges to SYSTEM or... --------------------------------------------- http://googleprojectzero.blogspot.com/2015/10/windows-drivers-are-truely-tr… *** Breaking Diffie-Hellman with Massive Precomputation (Again) *** --------------------------------------------- The Internet is abuzz with this blog post and paper, speculating that the NSA is breaking the Diffie-Hellman key-exchange protocol in the wild through massive precomputation. I wrote about this at length in May when this paper was first made public. (The reason its news again is that the paper was just presented at the ACM Computer and Communications Security... --------------------------------------------- https://www.schneier.com/blog/archives/2015/10/breaking_diffie.html *** Auch Ubuntu Phone hat seine Sicherheitslücken *** --------------------------------------------- Eine App aus dem Ubuntu Phone Store hat eine Sicherheitslücke aufgezeigt, mit der Angreifer die komplette Kontrolle über die Geräte der Opfer hätte erlangen können. Stattdessen ändert die App nur den Boot-Splash. --------------------------------------------- http://heise.de/-2849370 *** Elasticsearch 1.7.3 released *** --------------------------------------------- Today, we are happy to announce the bug fix release of Elasticsearch 1.7.3, based on Lucene 4.10.4. This is the latest stable release. Users are advised to upgrade if they find themselves affected by any of the bugs which have been fixed.You can download Elasticsearch 1.7.3 and read the full changes list here.Previous blog posts about the 1.7 series:Elasticsearch 1.7.2Elasticsearch 1.7.1Elasticsearch 1.7.0This release contains a number of bug fixes including:Synced flushes were reactivating... --------------------------------------------- https://www.elastic.co/blog/elasticsearch-1-7-3-released *** VMSA-2015-0003.12 *** --------------------------------------------- VMware product updates address critical information disclosure issue in JRE --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2015-0003.html *** Bugtraq: [security bulletin] HPSBUX03512 SSRT102254 rev.1 - HP-UX Web Server Suite running Apache, Remote Denial of Service (DoS) and Other Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/archive/1/536687 *** Bugtraq: [security bulletin] HPSBOV03503 rev.1 - HP OpenVMS CSWS_JAVA running Tomcat, Multiple Remote Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/archive/1/536689 *** Updated F5 Security Advisory: OpenSSL vulnerability CVE-2014-0224 *** --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/15000/300/sol15325.htm… *** F5 Security Advisory: vCMP DoS vulnerability CVE-2015-6546 *** --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/17000/300/sol17386.htm… *** APPLE-SA-2015-10-15-1 Keynote 6.6, Pages 5.6, Numbers 3.6, and iWork for iOS 2.6 *** --------------------------------------------- APPLE-SA-2015-10-15-1 Keynote 6.6, Pages 5.6, Numbers 3.6, andiWork for iOS 2.6Keynote 6.6, Pages 5.6, Numbers 3.6, and iWork for iOS 2.6 are nowavailable which address the following:Keynote, Pages, and NumbersAvailable for: OS X Yosemite v10.10.4 or later, iOS 8. [...] --------------------------------------------- http://prod.lists.apple.com/archives/security-announce/2015/Oct/msg00000.ht… *** USN-2772-1: PostgreSQL vulnerabilities *** --------------------------------------------- Ubuntu Security Notice USN-2772-116th October, 2015postgresql-9.1, postgresql-9.3, postgresql-9.4 vulnerabilitiesA security issue affects these releases of Ubuntu and its derivatives: Ubuntu 15.04 Ubuntu 14.04 LTS Ubuntu 12.04 LTSSummaryPostgreSQL could be made to crash or expose private information if ithandled specially crafted data.Software description postgresql-9.1 - Object-relational SQL database postgresql-9.3 - Object-relational SQL database postgresql-9.4 - Object-relational SQL... --------------------------------------------- http://www.ubuntu.com/usn/usn-2772-1/ *** 3S CODESYS Runtime Toolkit Null Pointer Dereference Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a NULL pointer dereference vulnerability in the 3S-Smart Software Solutions GmbHs CODESYS Runtime Toolkit. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-288-01 *** Bugtraq: Qualys Security Advisory - LibreSSL (CVE-2015-5333 and CVE-2015-5334) *** --------------------------------------------- http://www.securityfocus.com/archive/1/536692 *** Windows 10 Sandboxed Mount Reparse Point Creation Mitigation Bypass (MS15-111) *** --------------------------------------------- Topic: Windows 10 Sandboxed Mount Reparse Point Creation Mitigation Bypass (MS15-111) Risk: Medium Text:Source: https://code.google.com/p/google-security-research/issues/detail?id=486 Windows: Sandboxed Mount Reparse Point Crea... --------------------------------------------- https://cxsecurity.com/issue/WLB-2015100120 *** Bugtraq: ERPSCAN Research Advisory [ERPSCAN-15-017] SAP NetWeaver J2EE DAS service - Unauthorized Access *** --------------------------------------------- http://www.securityfocus.com/archive/1/536695

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily October 2015