Daily April 2015

daily@lists.cert.at

1 participants
21 discussions

Tageszusammenfassung - Donnerstag 30-04-2015
by Daily end-of-shift report 30 Apr '15

30 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 29-04-2015 18:00 − Donnerstag 30-04-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** MailChimp - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-101 *** --------------------------------------------- The MailChimp Signup submodule does not properly sanitize some user input, allowing a malicious user to embed scripts within a page, resulting in a Cross-site Scripting (XSS) vulnerability. --------------------------------------------- https://www.drupal.org/node/2480253 *** My Website Was Blacklisted By Google and Distributing Email Spam *** --------------------------------------------- Being blacklisted is one of the worst things that can happen to a website. The public shame coming from every visitor being stopped by the Big Red Warning page can literally destroy .. --------------------------------------------- https://blog.sucuri.net/2015/04/my-website-was-blacklisted-by-google-and-di… *** Cisco StarOS for Cisco ASR 5000 Series HTTP Packet Processing Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38580 *** Bedep trojan malware spread by the Angler exploit kit gets political *** --------------------------------------------- We recently observed what seems to be a group of cybercriminals helping spread pro-Russia messaging by artificially inflating video views and ratings on a popular video website. The .. --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/Bedep-trojan-malware-sp… *** Cyber threat intelligence group links Russia to cyber espionage and attacks *** --------------------------------------------- "Operation Armageddon," active since at least mid-2013, exposes a cyber espionage campaign devised to provide a military advantage to Russian leadership by targeting Ukrainian government, law enforcement, and military .. --------------------------------------------- http://www.liveleak.com/view?i=b39_1430249732 *** WhatsApp durchleuchtet: Vorbildliche Verschlüsselung weitgehend nutzlos *** --------------------------------------------- Um die Frage zu beantworten wie vertrauenswürdig die von WhatsApp seit einigen Monaten eingesetzte Ende-zu-Ende-Verschlüsselung ist, hat c't sie unter die Lupe genommen: Zwar setzt WhatsApp die richtige Technik ein, viel nützt das aber trotzdem nicht. --------------------------------------------- http://heise.de/-2629081 *** Voiceprint: Stimmenerkennung ist die neue Gesichtserkennung *** --------------------------------------------- Statt mit einem Passwort können sich Bankkunden mittlerweile mit ihrer Stimme am Telefon identifizieren. Akustische Biometriesysteme werden in immer mehr Firmen eingesetzt. Die Gefahr: Auch Geheimdienste und Staaten können auf die Technik zugreifen. --------------------------------------------- http://www.golem.de/news/voiceprint-stimmenerkennung-ist-die-neue-gesichtse… *** Analysis of a MICROSOFT WORD INTRUDER sample: execution, check-in and payload delivery *** --------------------------------------------- On April 1st FireEye released a report on 'MWI; and 'MWISTAT' which is a sort of exploit kit for Word Documents if you will: A New Word Document Exploit Kit In the article FireEye goes over MWI which is the short for 'Microsoft Word Intruder' coded .. --------------------------------------------- http://blog.0x3a.com/post/117760824504/analysis-of-a-microsoft-word-intrude… *** A Brief Look at DNS Zone Transfer for Alexia's Top 1M Domains *** --------------------------------------------- The folks at Rapid7 have released another scan. This one is looking at Alexa's top 1 million domains for DNS servers which have allowed unauthenticated requests for Zone Transfer. --------------------------------------------- http://atechdad.com/a-brief-look-at-dns-zone-transfer-for-alexias-top-1m-do… *** TA15-120A: Securing End-to-End Communications *** --------------------------------------------- Securing end-to-end communications plays an important role in protecting privacy and preventing some forms of man-in-the-middle (MITM) attacks. Recently, researchers described a MITM attack used to inject code, .. --------------------------------------------- https://www.us-cert.gov/ncas/alerts/TA15-119A-0 *** The BACKRONYM MySQL Vulnerability *** --------------------------------------------- Earlier this year, I - along with some members of our DevOps team - noticed some interesting behavior in libmysqlclient and the MySQL CLI: no matter how hard we tried (no matter how many MYSQL_OPT_SSL_* options we set) we could not make the client enforce the use of SSL. If the server claimed not to support it, the .. --------------------------------------------- https://www.duosecurity.com/blog/backronym-mysql-vulnerability

1 0

Tageszusammenfassung - Mittwoch 29-04-2015
by Daily end-of-shift report 29 Apr '15

29 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 28-04-2015 18:00 − Mittwoch 29-04-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** VU#534407: Barracuda Web Filter insecurely performs SSL inspection *** --------------------------------------------- Barracuda Web Filter prior to version 8.1.0.005 does not properly check upstream certificate validity when performing SSL inspection, and delivers one of three default root CA certificates across multiple machines for SSL inspection. --------------------------------------------- http://www.kb.cert.org/vuls/id/534407 *** Cisco IOS XE Software OTV Processing Code Denial of Service Vulnerability *** --------------------------------------------- A vulnerability in the Overlay Transport Virtualization (OTV) processing code of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a reload of the affected device. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38549 *** Cisco StarOS for Cisco ASR 5000 Series HAMGR Service Proxy Mobile IPv6 Processing Denial of Service Vulnerability *** --------------------------------------------- A vulnerability in proxy mobile (PM) IPv6 processing of Cisco StarOS for Cisco ASR 5000 Series devices could allow an unauthenticated, remote attacker to cause a reload of the hamgr service on the affected device. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38557 *** Android: Tausende Apps akzeptieren gefälschte Zertifikate *** --------------------------------------------- Die Schwachstelle ist seit einem halben Jahr bekannt, doch noch immer können Tausende Android-Apps mit gefälschten Zertifikaten überlistet werden, verschlüsselte Verbindungen aufzubauen. Über diese können Zugangsdaten abgegriffen werden --------------------------------------------- http://www.golem.de/news/android-tausende-apps-akzeptieren-gefaelschte-zert… *** Example setup of WordPress with static export *** --------------------------------------------- 'the only winning move is not to play' - Joshua, Wargames 2 So another advice from CIRCL is: whenever it is possible, the Content Management System component should be removed from the attack surface. This article gives an example about how to set up a system that exposes only static websites without dynamically generated content to the user and attacker. --------------------------------------------- https://www.circl.lu/pub/tr-36/ *** Malware Analysis-Basics: Static Analysis *** --------------------------------------------- Hi all, I have started learning malware analysis sometime back, and will share my learning through a series of articles on malware analysis. I will start from very basic and go to advanced level of analysis. So in this this document we .. --------------------------------------------- http://resources.infosecinstitute.com/malware-analysis-basics-static-analys… *** Und täglich grüsst die D-Link-Lücke *** --------------------------------------------- Seit mindestens August klafft eine kritische Lücke in Routern der Firmen D-Link und Trendnet. Diese geht auf ein Toolkit der Firma Realtek zurück, die Anfragen von Sicherheitsforschern für Monate beharrlich ignorierte. Nun ist die Lücke öffentlich. --------------------------------------------- http://heise.de/-2628562 *** Unboxing Linux/Mumblehard: Muttering spam from your servers *** --------------------------------------------- Today, ESET researchers reveal a family of Linux malware that stayed under the radar for more than 5 years. We have named this family Linux/Mumblehard. A white paper about this threat is available for download on WeLiveSecuriy. --------------------------------------------- http://www.welivesecurity.com/2015/04/29/unboxing-linuxmumblehard-muttering… *** Magento updaten! ASAP! *** --------------------------------------------- Für die Onlineshop-Software Magento ist bereits im Februar ein Patch (SUPEE-5344) erschienen, der eine schwerwiegende Sicherheitslücke schliesst. Die Firma Check Point, die die Schwachstelle entdeckt hat, .. --------------------------------------------- http://www.cert.at/services/blog/20150429154511-1469.html *** TA15-119A: Top 30 Targeted High Risk Vulnerabilities *** --------------------------------------------- Cyber threat actors continue to exploit unpatched software to conduct attacks against critical infrastructure organizations. As many as 85 percent of targeted attacks are .. --------------------------------------------- https://www.us-cert.gov/ncas/alerts/TA15-119A *** Container Security: Just The Good Parts *** --------------------------------------------- Security is usually a matter of trade-offs. Questions like: 'Is X Secure?', don't often have direct yes or no answers. A technology can mitigate certain classes of risk even .. --------------------------------------------- https://securityblog.redhat.com/2015/04/29/container-security-just-the-good… *** Report: SSDP reflection attacks spike, and other Q1 2015 DDoS trends *** --------------------------------------------- The largest distributed denial-of-service attack ever detected by Arbor Networks systems was observed in the first quarter of this year. --------------------------------------------- http://www.scmagazine.com/largest-ddos-detected-in-q1-report-says/article/4… *** ZDI-15-157: Samsung Security Manager ActiveMQ Broker Service MOVE Method Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Security Manager. Authentication is not required to exploit this vulnerability. Successful exploitation allows an attacker to gain complete control of the system on which the product is installed. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-157/ *** ZDI-15-156: Samsung Security Manager ActiveMQ Broker Service PUT Method Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Security Manager. Authentication is not required to exploit this vulnerability. Successful exploitation allows an attacker to gain complete control of the system on which the product is installed. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-156/

1 0

Tageszusammenfassung - Dienstag 28-04-2015
by Daily end-of-shift report 28 Apr '15

28 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 27-04-2015 18:00 − Dienstag 28-04-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Fake Security Scams - 2015 Edition *** --------------------------------------------- New Year, Similar Scams In 2013, I wrote an article talking about the popular Fake Microsoft Security Scams that were doing the rounds. As expected, these type of scams have continued to grow .. --------------------------------------------- http:////www.webroot.com/blog/2015/04/27/fake-security-scams-2015-edition/ *** 10 Ways to Ensure Your Privileged Password Management Strategy Will Succeed *** --------------------------------------------- Leveraging complex, frequently updated passwords is a basic security best practice for protecting privileged accounts in your organisation. But if passwords are such a no-brainer, why do so many data breaches tie back to poor password management? --------------------------------------------- http://blog.beyondtrust.com/10-reasons-your-privileged-password-management-… *** When Prevention Fails, Incident Response Begins, (Mon, Apr 27th) *** --------------------------------------------- Ive been asked a few times this year ($dayjob) to discuss and review incident handling practices with some of our clients. This topic seems to have come up to the surface again, and with some breaches getting main-stream coverage, it only .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19629 *** WordPress 4.2.1 Security Release *** --------------------------------------------- https://wordpress.org/news/2015/04/wordpress-4-2-1/ *** SendGrid: Employee Account Hacked, Used to Steal Customer Credentials *** --------------------------------------------- Sendgrid, an email service used by tens of thousands of companies -- including Silicon Valley giants as well as Bitcoin exchange Coinbase -- said attackers compromised a Sendgrid employees account, which was then used to steal the usernames, email .. --------------------------------------------- http://krebsonsecurity.com/2015/04/sendgrid-employee-account-hacked-used-to… *** Booby trapped! Malvertising campaign hit Adult Site xHamster *** --------------------------------------------- A New malvertising campaign hit adult website xHamster by abusing ad provider TrafficHaus and exploiting the Google's URL shortener service. Malversting campaigns are becoming a serious problem for web users, cyber criminals are exploiting .. --------------------------------------------- http://securityaffairs.co/wordpress/36367/cyber-crime/malvertising-campaign… *** Best Free and Open Source SQL Injection Tools *** --------------------------------------------- SQL injection is one of the most common attacks against web applications. This is used against websites which use SQL to query data from the database server. A successful .. --------------------------------------------- http://resources.infosecinstitute.com/best-free-and-open-source-sql-injecti… *** Hacker tarnen sich als Rüstungsfirma und tricksen Antiviren-Programme aus *** --------------------------------------------- Angreifer nutzten die Gunst der Stunde und verschickten im Zuge einer Firmenübernahme als Willkommensnachricht getarnte Phishing-Mails, um mit einer raffinierten Methode Schadcode auf die Computer von Angestellten zu schmuggeln. --------------------------------------------- http://heise.de/-2625892 *** Kritische Sicherheitslücke in WordPress *** --------------------------------------------- Angesichts der potentiellen Auswirkung der Lücke und der hohen Anzahl an installierten WordPress Content Management Systemen bittet CERT.at um Beachtung der folgenden .. --------------------------------------------- https://cert.at/warnings/all/20150428.html *** Inside the Zeroaccess Trojan *** --------------------------------------------- The Zeroaccess trojan (Maxx++, Sierief, Crimeware) has affected millions of computers worldwide, and it is the number one cause of cyber click fraud and Bitcoin mining on the Internet. --------------------------------------------- http://blog.norsecorp.com/2015/04/27/inside-the-zeroaccess-trojan/ *** Cisco IOS Software and Cisco IOS XE Software Crafted RADIUS Packet Denial of Service Vulnerability *** --------------------------------------------- The vulnerability is due to improper processing of crafted RADIUS packets by a device running the affected software. An authenticated, remote attacker could exploit this vulnerability by sending crafted RADIUS packets to an affected device. If successful, the attacker could cause the device to crash, resulting in a DoS condition. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38544 *** Cisco IOS Software and Cisco IOS XE Software Crafted DHCPv6 Sequence Denial of Service Vulnerability *** --------------------------------------------- The vulnerability is due to improper handling of DHCPv6 packets for a SOLICIT message for an Identity Association for Non-Temporary Addresses (IA-NA) by a device running the affected software. An unauthenticated, adjacent attacker could exploit this vulnerability by sending a crafted sequence exchange of DHCPv6 packets for a SOLICIT message for an IA-NA to an affected device. If successful, the attacker could cause the device to crash, resulting in a DoS condition. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38543

1 0

Tageszusammenfassung - Montag 27-04-2015
by Daily end-of-shift report 27 Apr '15

27 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 24-04-2015 18:00 − Montag 27-04-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Sicherheitslücke im Yubikey Neo *** --------------------------------------------- Der USB-Stick Yubikey Neo lässt sich auch als Smartcard nutzen. Durch einen Bug kann man die eigentlich erforderliche Eingabe der PIN umgehen. Ein Angreifer kann die Krypto-Funktionen dadurch sogar über Funk missbrauchen. --------------------------------------------- http://heise.de/-2621122 *** CVE-2015-0359 (Flash up to 17.0.0.134) and Exploit Kits *** --------------------------------------------- http://malware.dontneedcoffee.com/2015/04/cve-2015-0359-flash-up-to-1700134… *** Security Advisory: NTP vulnerability CVE-2015-1799 *** --------------------------------------------- The symmetric-key feature in the receive function in ntp_proto.c in ntpd in NTP 3.x and 4.x before 4.2.8p2 performs state-variable updates upon receiving certain invalid packets, which makes it easier for man-in-the-middle attackers to cause a denial of service (synchronization loss) by spoofing the source IP address of a peer. --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/500/sol16506.htm… *** What's Your Security Maturity Level? *** --------------------------------------------- Not long ago, I was working on a speech and found myself trying to come up with a phrase that encapsulates the difference between organizations that really make cybersecurity a part of their culture and those that merely pay it lip service and do the bare minimum (think 15 pieces of flair). When .. --------------------------------------------- http://krebsonsecurity.com/2015/04/whats-your-security-maturity-level/ *** Sunday, April 26. 2015 How Kaspersky makes you vulnerable to the FREAK attack and other ways Antivirus software lowers your HTTPS security *** --------------------------------------------- Lately a lot of attention has been payed to software like Superfish and Privdog that intercepts TLS connections to be able to manipulate HTTPS traffic. These programs had severe (technically different) vulnerabilities that allowed attacks on HTTPS connections. --------------------------------------------- https://blog.hboeck.de/archives/869-How-Kaspersky-makes-you-vulnerable-to-t… *** Pwning a thin client in less than two minutes *** --------------------------------------------- The point of this blog post is to demonstrate that a malicious actor can compromise such thin clients in a trivial and quick way provided physical access, a standard prerequisite in an attack against a kiosk. --------------------------------------------- http://blog.malerisch.net/2015/04/pwning-hp-thin-client.html *** Clickjacking, Cursorjacking & Filejacking *** --------------------------------------------- Same origin bypasses using clickjacking Clickjacking (User Interface redress attack, UI redress attack, UI redressing) is a malicious technique of tricking a web user into clicking on something different from what the user perceives they are clicking on, thus potentially revealing confidential information .. --------------------------------------------- http://resources.infosecinstitute.com/bypassing-same-origin-policy-part-3-c… *** Defenders think in lists. Attackers think in graphs. As long as this is true, attackers win. *** --------------------------------------------- A lot of network defense goes wrong before any contact with an adversary, starting with how defenders conceive of the battlefield. Most defenders focus on protecting their assets, prioritizing them, and sorting them by workload and .. --------------------------------------------- http://blogs.technet.com/b/johnla/archive/2015/04/26/defenders-think-in-lis… *** IBM Security Bulletin: SPSS Statistics ActiveX Control Code Execution Vulnerability Notification *** --------------------------------------------- SPSS Statistics ActiveX control on Windows 32 bit installations could allow a remote attacker to execute arbitrary code on the system. By persuading a victim to visit a specially-crafted Web page with Internet Explorer, a local attacker could exploit this vulnerability to execute arbitrary code on the system or cause the application to crash. --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21697746 *** A Javascript-based DDoS Attack as seen by Safe Browsing *** --------------------------------------------- To protect users from malicious content, Safe Browsing's infrastructure analyzes web pages with web browsers running in virtual machines. This allows us to determine if a page contains malicious content, such as Javascript .. --------------------------------------------- http://googleonlinesecurity.blogspot.co.at/2015/04/a-javascript-based-ddos-… *** Node.js Server-Side JavaScript Injection Detection & Exploitation *** --------------------------------------------- Late last year, Burp scanner started testing for Server-Side JavaScript (SSJS) code injection. As you'd expect, this is where an attacker injects JavaScript into a server side parser and results in arbitrary code execution. --------------------------------------------- http://blog.gdssecurity.com/labs/2015/4/15/nodejs-server-side-javascript-in… *** Critical Persistent XSS 0day in WordPress *** --------------------------------------------- Yes, you've read it right: a critical, unpatched 0-day vulnerability affecting WordPress' comment mechanisms was disclosed earlier today by Klikki Oy. Who's affected If your .. --------------------------------------------- https://blog.sucuri.net/2015/04/critical-persistent-xss-0day-in-wordpress.h… *** TeslaCrypt - Decrypt It Yourself *** --------------------------------------------- After the takedown of Cryptolocker, we have seen the rise of Cryptowall. Cryptowall 2 introduced 'features' such as advanced anti-debugging techniques, only to have many of those features removed in Cryptowall 3. Ransomware is .. --------------------------------------------- http://blogs.cisco.com/security/talos/teslacrypt

1 0

Tageszusammenfassung - Freitag 24-04-2015
by Daily end-of-shift report 24 Apr '15

24 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 23-04-2015 18:00 − Freitag 24-04-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** When automation does not help, (Thu, Apr 23rd) *** --------------------------------------------- In a lot of web application penetration tests that Ive done in last couple of years I noticed that the amount of technical vulnerabilities (i.e. XSS or SQL injection) is slowly declining.Of course, this depends on developers awareness but also on frameworks that are used for development of such applications. One of the best (or worst, depending on the point of view) is definitely .NET (yeah, I know, it feels weird to say that Microsoft is best in something security related). With .NET... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19615&rss *** Security Advisory: NTP vulnerability CVE-2015-1798 *** --------------------------------------------- (SOL16505) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/500/sol16505.htm… *** CVE-2014-6284 - Probe login access vulnerability in SAP ASE *** --------------------------------------------- The SpiderLabs team at Trustwave published a new advisory today which details issues discovered in the SAP ASE (Adaptive Server Enterprise) by Martin Rakhmanov, a SpiderLabs Senior Researcher. SAP ASE is a relational database management system for UNIX, Linux, and... --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/CVE-2014-6284----Probe-… *** VMSA-2015-0003.5 *** --------------------------------------------- VMware product updates address critical information disclosure issue in JRE --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2015-0003.html *** The Rise of Counterintelligence in Malware Investigations *** --------------------------------------------- The key to operationalizing cybersecurity threat intelligence rests in the critical thinking that establishes that a given indicator is, in fact, malicious. There has been a great deal of talk about the emerging field of cybersecurity threat intelligence in recent years. CTI is the application of intelligence tactics to gain insights on adversarial actors and their tools, techniques, and procedures. However, one aspect that's not frequently discussed is the use of counterintelligence... --------------------------------------------- http://www.darkreading.com/partner-perspectives/general-dynamics-fidelis/th… *** Objectifying Cyber Intel Indicators *** --------------------------------------------- I've had the fortune of visiting a good number of SOCs (including building some) and meeting with a number of leaders in the SOC/IR space over the years- and the better teams will tell you that you simply cannot look at every single alert that fires. Expanding upon this even more, in regards to an Intel-driven IR program, this means that you cannot simply dump all indicators into production; I've seen this fail for both immature programs (overwhelmed with alerts) as well as mature... --------------------------------------------- http://seanmason.com/2014/08/25/objectifying-cyber-intel-indicators/ *** Honeywell XLWEB SCADA Path Traversal *** --------------------------------------------- Topic: Honeywell XLWEB SCADA Path Traversal Risk: Medium Text:SCADA - EXPLOITING CVE-2015-0984 FOR SHELL ACCESS This post is a follow up detailing how to achieve control of the actual X... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015040161 *** Magento-Lücke wird aktiv ausgenutzt *** --------------------------------------------- Wer einen Magento-Shop betreibt und noch nicht das jüngste Sicherheits-Update installiert hat, muss mit unerwünschten Besuchern rechnen. Hacker nutzen die Lücke aus, um SQL-Befehle in den Datenbankserver einzuschleusen. --------------------------------------------- http://heise.de/-2620110 *** IBM Products affected by Vulnerability in RC4 stream cipher ("Bar Mitzvah Attack") and other Vulnerabilities *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/?lang=en_us *** Dyreza's anticrypt *** --------------------------------------------- In the previous post, we have described how to set up a loft to monitor Dyreza with the help of virtual machines configured with breakpoints at addresses where communications appear in clear text. Configuration file updates can thus be obtained in real-time easily. Another way to monitor this kind of malware using a decentralised architecture is to implement parts of the malicious binary in a thin client, which requires to fully understand its decryption routine details. --------------------------------------------- http://www.lexsi-leblog.com/cert-en/dyrezas-anticrypt.html *** Antiviren-Software und Apples Schutzmechanismen für Mac OS X nutzlos *** --------------------------------------------- Einem Sicherheitsforscher zufolge sei es trivial, einen Mac nachhaltig mit Malware zu verseuchen. Weder würde gängige Antivirensoftware helfen, noch Apples eigene Mechanismen wie XProtect oder das Signieren von Apps. --------------------------------------------- http://heise.de/-2620049 *** HTML5 Security: Local Storage *** --------------------------------------------- In a previous article of mine, I discussed Cross Domain Messaging in HTML5. This article walks you through another feature, called local storage, and its security. Local Storage Local storage is one of the new features added in HTML5. It was first introduced in Mozilla 1.5 and eventually embraced by the HTML5 specification. We can... --------------------------------------------- http://resources.infosecinstitute.com/html5-security-local-storage/ *** Yubikey NEO (JavaCard OpenPGP) private key operations can be accessed without PIN *** --------------------------------------------- The source code contains a logical flaw related to user PIN (aka PW1) verification that allows an attacker with local host privileges and/or physical proximity (NFC) to perform security operations without knowledge of the user's PIN code. --------------------------------------------- https://developers.yubico.com/ykneo-openpgp/SecurityAdvisory%202015-04-14.h…

1 0

Tageszusammenfassung - Donnerstag 23-04-2015
by Daily end-of-shift report 23 Apr '15

23 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 22-04-2015 18:00 − Donnerstag 23-04-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Deep dive into QUANTUM INSERT *** --------------------------------------------- Summary and recommendations QUANTUMINSERT (QI) is actually a relatively old technique. In order to exploit it, you will need a monitoring capabilities to leak information of observed TCP sessions and a host that can send spoofed packets. Your spoofed packet also needs to arrive faster than the original packet to be able to be successful. Any... --------------------------------------------- http://blog.fox-it.com/2015/04/20/deep-dive-into-quantum-insert/ *** Sicherheitsfirma warnt vor iOS-Killer-Funktion *** --------------------------------------------- Ein bösartiger Hotspot könnte iOS-Geräte in einen endlosen Reboot-Cycle schicken, warnt eine Sicherheitsfirma. Ursache ist anscheinend ein Fehler in Apples Verschlüsselungsimplementierung. --------------------------------------------- http://heise.de/-2617385 *** New Threat Report *** --------------------------------------------- Our latest comprehensive threat report, based on our analysis of H2 2014 data, is now available. --------------------------------------------- https://www.f-secure.com/weblog/archives/00002805.html *** Mobile Threats Incident Handling: Updated ENISA material *** --------------------------------------------- http://www.enisa.europa.eu/media/news-items/mobile-threats-incident-handlin… *** Schadcode durch WLAN-Pakete *** --------------------------------------------- Durch eine Lücke in dem Standard-Tool wpa_supplicant können Angreifer anfällige Systeme über WLAN kompromittieren. Es kommt unter anderem bei Android und Linux zum Einsatz. Abhilfe schafft ein Patch, eine abgesicherte Version soll folgen. --------------------------------------------- http://heise.de/-2618115 *** wpa_supplicant P2P SSID processing vulnerability *** --------------------------------------------- A vulnerability was found in how wpa_supplicant uses SSID information parsed from management frames that create or update P2P peer entries (e.g., Probe Response frame or number of P2P Public Action frames). SSID field has valid length range of 0-32 octets. However, it is transmitted in an element that has a 8-bit length field and potential maximum payload length of 255 octets. wpa_supplicant was not sufficiently verifying the payload length on one of the code paths using the SSID received from --------------------------------------------- http://w1.fi/security/2015-1/wpa_supplicant-p2p-ssid-overflow.txt *** SSA-237894 (Last Update 2015-04-23): Vulnerability in SIMATIC PCS 7 *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** PowerDNS decompression bug can cause crashes *** --------------------------------------------- Topic: PowerDNS decompression bug can cause crashes Risk: Medium Text:Hi everybody, Please be aware of PowerDNS Security Advisory 2015-01 (http://doc.powerdns.com/md/security/powerdns-advisory-... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015040155 *** Security patch 02 for ZEN 11 Appliance - Freak - See TID 7016312 *** --------------------------------------------- Abstract: Patch for CVE-2015-0204 (FREAK) - OpenSSL RSA Temporary Key Cryptographic Downgrade Vulnerability for ZCM ApplianceDocument ID: 5207650Security Alert: YesDistribution Type: PublicEntitlement Required: NoFiles:ZCM_11_Security_Patch_2.zip (12.65 MB)Products:ZENworks Configuration Management 11ZENworks Configuration Management 11.1ZENworks Configuration Management 11 SP3ZENworks Configuration Management 11.2ZENworks Configuration Management 11.2.1ZENworks Configuration Management --------------------------------------------- https://download.novell.com/Download?buildid=Ddi7yDlFrqA~ *** ZDI-15-149: Novell Zenworks Rtrlet.class Session ID Disclosure Vulnerability *** --------------------------------------------- This vulnerability allows attackers to disclose Session IDs of logged in users on vulnerable installations of Novell Zenworks. User interaction is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/ly4m30xpA5I/ *** ZDI-15-148: Novell Zenworks schedule.ScheduleQuery SQL Injection Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell Zenworks. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/04USkHANe4s/ *** ZDI-15-147: Novell Zenworks GetStoredResult.class SQL Injection Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell Zenworks. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/vaCwk090UHI/ *** ZDI-15-153: Novell ZENworks Preboot Policy Service Stack Buffer Overflow Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell ZENWorks. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/sPdD0Sy4sxQ/ *** ZDI-15-152: Novell Zenworks com.novell.zenworks.inventory.rtr.actionclasses.wcreports Information Disclosure Vulnerability *** --------------------------------------------- This vulnerability allows attackers to obtain sensitive information on vulnerable installations of Novell Zenworks. User interaction is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/GTCY2AUbObw/ *** ZDI-15-151: Novell Zenworks Rtrlet doPost Directory Traversal Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell Zenworks. By default, authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/Wi0h3ROfwWc/ *** ZDI-15-150: Novell Zenworks FileViewer Information Disclosure Vulnerability *** --------------------------------------------- This vulnerability allows attackers to obtain sensitive information on vulnerable installations of Novell Zenworks. User interaction is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/-6nZPEvRTF0/ *** Security Advisory: Linux kernel vulnerabilities CVE-2014-8159 and CVE-2014-8369 *** --------------------------------------------- (SOL16478) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/400/sol16478.htm… *** Security Advisory: Rsync vulnerability CVE-2007-6199 *** --------------------------------------------- (SOL15549) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/15000/500/sol15549.htm… *** Security Advisory: Linux kernel vulnerability CVE-2009-4537 *** --------------------------------------------- (SOL16479) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/400/sol16479.htm… *** DSA-3232 curl - security update *** --------------------------------------------- Several vulnerabilities were discovered in cURL, an URL transfer library: --------------------------------------------- https://www.debian.org/security/2015/dsa-3232 *** iPassword Manager 2.6 Script Insertion *** --------------------------------------------- Topic: iPassword Manager 2.6 Script Insertion Risk: Low Text:Document Title: iPassword Manager v2.6 iOS - Persistent Vulnerabilities References (Source): == http://www... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015040147 *** Docker Privilege Escalation *** --------------------------------------------- Topic: Docker Privilege Escalation Risk: Medium Text:TLDR; Don’t use the ‘docker’ group Docker, if you aren’t already familiar with it, is a lightweight runtime and pack... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015040151 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Vulnerability in SSLv3 affects IBM/Cisco switches and directors (CVE-2014-3566) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005132 *** IBM Security Bulletin: Vulnerabilities in OpenSSL affecting Sametime Unified Telephony (OpenSSL: CVE-2014-3569, CVE-2014-3570, CVE-2014-3572, CVE-2014-8725, CVE-2015-0204, CVE-2015-0205) *** http://www.ibm.com/support/docview.wss?uid=swg21882876 *** IBM Security Bulletin: RPM vulnerability issue on IBM SONAS (CVE-2013-6435) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005166 *** IBM Security Bulletin: RPM vulnerability issue on IBM Storwize V7000 Unified (CVE-2013-6435) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005160 *** IBM Security Bulletin: Vulnerabilities in Network Time Protocol (NTP) affect IBM Storwize V7000 Unified (CVE-2014-9293, CVE-2014-9294, CVE-2014-9295, and CVE-2014-9296) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005147 *** IBM Security Bulletin: Open Source GNU glibc vulnerabilities on IBM Storwize V7000 Unified (CVE-2014-7817, CVE-2014-9087) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005075 *** IBM Security Bulletin: Open Source GNU glibc vulnerabilities on IBM SONAS (CVE-2014-7817, CVE-2014-9087) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005152 *** IBM Security Bulletin: NSS vulnerability issue on IBM Storwize V7000 Unified (CVE-2014-3566) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005148 *** IBM Security Bulletin: Vulnerability in NSS affects SAN Volume Controller and Storwize Family (CVE-2014-3566) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005209 *** IBM Security Bulletin: Security Bulletin: IBM i is affected by several OpenSSL vulnerabilities. *** http://www.ibm.com/support/docview.wss?uid=nas8N1020693 *** IBM Security Bulletin: Vulnerabilities in OpenSSL including ClientHello DoS affect IBM Sterling B2B Integrator (CVE-2015-0209, CVE-2015-0287, CVE-2015-0292, and others) *** http://www.ibm.com/support/docview.wss?uid=swg21883249 *** IBM Security Bulletin: Vulnerabilities in OpenSSL affects Rational Software Architect for Websphere Software *** http://www.ibm.com/support/docview.wss?uid=swg21882955 *** IBM Security Bulletin: Vulnerability in IBM WebSphere Application Server affects IBM Security Access Manager for Mobile (CVE-2015-0138) *** http://www.ibm.com/support/docview.wss?uid=swg21701358 *** IBM Security Bulletin: Vulnerability in IBM WebSphere Application Server affects IBM Security Access Manager for Web (CVE-2015-0138) *** http://www.ibm.com/support/docview.wss?uid=swg21701548 *** IBM Security Bulletin: Samba vulnerability issue on IBM Storwize V7000 Unified (CVE-2015-0240) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005125 *** IBM Security Bulletin: Samba vulnerability issue on IBM SONAS (CVE-2015-0240) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005157 *** IBM Security Bulletin: Vulnerability in RC4 stream cipher affects Rational Lifecycle Integration Adapter for HP ALM (CVE-2015-2808) *** http://www.ibm.com/support/docview.wss?uid=swg21883226 *** IBM Security Bulletin: Vulnerability in RC4 stream cipher affects IBM Tivoli Composite Application Manager for Transactions (CVE-2015-2808) *** http://www.ibm.com/support/docview.wss?uid=swg21701114

1 0

Tageszusammenfassung - Mittwoch 22-04-2015
by Daily end-of-shift report 22 Apr '15

22 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 21-04-2015 18:00 − Mittwoch 22-04-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** How attackers exploit end-users psychology *** --------------------------------------------- At RSA Conference 2015, Proofpoint released the results of its annual study that details the ways attackers exploit end-users psychology to circumvent IT security. Last year was the year attacke... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/tTatKVMFrgE/secworld.php *** How to hack Avaya phones with a simple text editor *** --------------------------------------------- At RSA conference 2015 a researcher demonstrated that Avaya's Ethernet office phones can be compromised with just a simple text editor. At the RSA conference 2015 in San Francisco, Dr Ang Cui from Columbia University PhD and Red Ballon Security cofounder announced that Avaya's Ethernet office phones can be compromised with just a simple text... --------------------------------------------- http://securityaffairs.co/wordpress/36187/hacking/how-to-hack-avaya-phone.h… *** 2 out of 3 IT pros put systems at risk by making undocumented changes *** --------------------------------------------- The Netwrix 2015 State of IT Changes Survey of more than 700 IT professionals across 40 industries found that 70% of companies forget about documenting changes, up from 57% last year. Most surprisingl... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/4YM1XhU4vq4/secworld.php *** The CozyDuke APT *** --------------------------------------------- CozyDuke (aka CozyBear, CozyCar or "Office Monkeys") is a threat actor that became increasingly active in the 2nd half of 2014 and hit a variety of targets. The White House and Department of State are two of the most spectacular... --------------------------------------------- http://securelist.com/blog/research/69731/the-cozyduke-apt/ *** CozyDuke, TLP: White *** --------------------------------------------- This whitepaper provides an overview of CozyDuke, a set of tools used by one or more malicious actors for performing targeted attacks against high profile organizations, such as governmental organizations and other entities that work closely with these institutions. --------------------------------------------- https://www.f-secure.com/weblog/archives/00002804.html *** "No iOS Zone" - A New Vulnerability Allows DoS Attacks on iOS Devices *** --------------------------------------------- In today's RSA Conference presentation, (Tuesday, April 21, 2015 | 3:30 PM - 4:20 PM | West | Room: 2001) Adi Sharabani, CEO and my fellow co-founder at Skycure, and I covered the lifecycle of vulnerabilities and vendor pitfalls. We also shared some details about a vulnerability our team recently identified in iOS 8 - a vulnerability that we are currently working with Apple to fix. --------------------------------------------- https://www.skycure.com/blog/ios-shield-allows-dos-attacks-on-ios-devices/ *** Regular expressions and recommended practices *** --------------------------------------------- Whenever a security person crosses a vulnerability report, one of the the first steps is to ensure that the reported problem is actually a vulnerability. Usually, the issue falls into well known and studied categories and this step is done... --------------------------------------------- https://securityblog.redhat.com/2015/04/22/regular-expressions-and-recommen… *** RSA 2015: Thousands of Android apps found to be vulnerable *** --------------------------------------------- Vulnerability testing by CERT found tens of thousands of Android apps are vulnerable and no full register exists as they dont all get CVE assigned. --------------------------------------------- http://feedproxy.google.com/~r/SCMagazineHome/~3/42uHv7yPt0M/ *** RSA 2015: Experts discuss six dangerous attack techniques *** --------------------------------------------- Data breaches, ransomware, and threats against industrial control system were were discussed during an RSA Conference 2015 session on dangerous attack techniques. --------------------------------------------- http://feedproxy.google.com/~r/SCMagazineHome/~3/yup3ar8W41U/ *** SSA-994726 (Last Update 2015-04-22): GHOST Vulnerability in Siemens Industrial Products *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** SSA-451236 (Last Update 2015-04-22): Vulnerability in SIMATIC ProSave, SIMATIC CFC, SIMATIC STEP 7, SIMOTION Scout, and STARTER *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** HPSBGN03308 rev.1 - HP TippingPoint Security Management System (SMS) and TippingPoint Virtual Security Management System (vSMS), Remote Code Execution *** --------------------------------------------- A potential security vulnerability has been identified with the HP TippingPoint Security Management System (SMS) and vSMS. A vulnerability in JBOSS RMI could be exploited to allow remote code execution. --------------------------------------------- https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04626974 *** Manage Engine Firewall Analyzer 8.3 Build 8300 Cross Site Scripting *** --------------------------------------------- Topic: Manage Engine Firewall Analyzer 8.3 Build 8300 Cross Site Scripting Risk: Low Text: = Reflected XSS Vulnerability In Manage Engine Firewall Analyzer = . contents:: Table Of Content Overview == ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015040128 *** Cisco FireSIGHT Management Center Web Framework HTTP Header Redirection Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38486 *** Cisco Unified MeetingPlace Web Services Directory SOAP API Endpoints Cross-Site Request Forgery Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38461 *** Cisco Unified MeetingPlace Server Multiple State Changing URL API Functionalities Cross-Site Request Forgery Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38460 *** DSA-3231 subversion - security update *** --------------------------------------------- Several vulnerabilities were discovered in Subversion, a version controlsystem. The Common Vulnerabilities and Exposures project identifies thefollowing problems:... --------------------------------------------- https://www.debian.org/security/2015/dsa-3231 *** Glibc Buffer Overflow in getanswer_r() Lets Remote Users Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1032178 *** Platform Agent 2011.1r2 *** --------------------------------------------- Abstract: The Novell Audit Platform Agent (Platform Agent) facilitates auditing events by transmitting log data from multiple applications to the Audit server.Document ID: 5207351Security Alert: YesDistribution Type: PublicEntitlement Required: NoFiles:Platform-Agent_2011.1r2.sha256 (93 bytes)Platform-Agent_2011.1r2.zip (16.8 MB)Products:Sentinel 7.0Sentinel 7.0.1Sentinel 7.0.2Sentinel 7.0.3Sentinel 7.1Sentinel 7.1.1Sentinel 7.1.2Sentinel 7.2Sentinel 7.2.1Sentinel 7.2.2Sentinel 7.3Sentinel Log --------------------------------------------- https://download.novell.com/Download?buildid=dpHkpNu89zw~

1 0

Tageszusammenfassung - Dienstag 21-04-2015
by Daily end-of-shift report 21 Apr '15

21 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 20-04-2015 18:00 − Dienstag 21-04-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** JavaScript CPU cache snooper tells crooks EVERYTHING you do online *** --------------------------------------------- New research sends browser kingpins scurrying for fixes Four Cornell University boffins reckon they can spy on keystrokes and mouse clicks in a web browser tab by snooping on the PCs processor caches. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/04/21/cache_creep… *** New fileless malware found in the wild *** --------------------------------------------- Since the discovery of the Poweliks fileless Trojan in August 2014, researchers have been expecting other similar malware to pop up. The wait over: Phasebot malware, which also has fileless infecti... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/fLPIj0uz1VY/malware_news.… *** Cross-Site-Scripting: Zahlreiche Wordpress-Plugins verwenden Funktion fehlerhaft *** --------------------------------------------- Eine schlecht dokumentierte Funktion der Wordpress-API ist von zahlreichen populären Plugins fehlerhaft verwendet worden. Der Fehler führt zu Cross-Site-Scripting-Lücken: Betroffen sind unter anderem das Jetpack-Plugin, die Plugins von Yoast und das All-in-one-SEO-Plugin. --------------------------------------------- http://www.golem.de/news/cross-site-scripting-zahlreiche-wordpress-plugins-… *** 2nd workshop on National Cyber Security Strategies: 13th May *** --------------------------------------------- ENISA and the Latvian Ministry of Defence are hosting on the 13th of May 2015, the 2nd workshop on National Cyber Security Strategies in Riga, during the Presidency of the Council of the European Union. --------------------------------------------- http://www.enisa.europa.eu/media/news-items/2nd-workshop-on-national-cyber-… *** Fehlerhafte Netzwerkbibliothek macht iOS-Apps angreifbar *** --------------------------------------------- Durch einen Bug in der Bibliothek AFNetwork kann man die verschlüsselten Verbindungen zahlreicher Apps angreifen, die sie einsetzen. Eine Online-Datenbank verrät, welche Apps betroffen waren oder sind. --------------------------------------------- http://heise.de/-2615960 *** WordPress 4.1.2 Security Release *** --------------------------------------------- WordPress 4.1.2 is now available. This is a critical security release for all previous versions and we strongly encourage you to update your sites immediately. --------------------------------------------- https://wordpress.org/news/2015/04/wordpress-4-1-2/ *** Security Advisory: glibc vulnerability CVE-2013-7424 *** --------------------------------------------- (SOL16472) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/400/sol16472.htm… *** VU#260780: NetNanny uses a shared private key and root CA *** --------------------------------------------- Vulnerability Note VU#260780 NetNanny uses a shared private key and root CA Original Release date: 20 Apr 2015 | Last revised: 20 Apr 2015 Overview NetNanny uses a shared private key and root Certificate Authority (CA), making systems broadly vulnerable to HTTPS spoofing. Description NetNanny installs a Man-in-the-Middle (MITM) proxy as well as a new trusted root CA certificate. The certificate used by NetNanny is shared among all installations of NetNanny. Furthermore, the private key used --------------------------------------------- http://www.kb.cert.org/vuls/id/260780 *** Cisco Unified MeetingPlace Custom Prompts languageShortName Parameter Arbitrary Code Execution Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38455 *** Cisco Unified MeetingPlace Administrative Web Interface Reflected Cross-Site Scripting Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38459 *** HPSBMU03321 rev.1 - HP Data Protector, Remote Increase of Privilege, Denial of Service (DoS), Execution of Arbitrary Code *** --------------------------------------------- Potential security vulnerabilities have been identified with HP Data Protector. These vulnerabilities could be remotely exploited to allow an increase of privilege, create a Denial of Service (DoS), or execute arbitrary code. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** HPSBGN03305 rev.1 - HP Business Service Management (BSM) products running SSLv3, Remote Disclosure of Information *** --------------------------------------------- A potential security vulnerability has been identified with HP Business Service Management (BSM), SiteScope, Business Service Management (BSM) Integration Adaptor, Operations Manager for Windows, Unix and Linux, Reporter, Operation Agent Virtual Appliance, Performance Manager, Virtualization Performance Viewer, Operations Agent, BSM Connector and Service Health Reporter running SSLv3. The vulnerability could be exploited remotely to allow disclosure of information. --------------------------------------------- https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04626982

1 0

Tageszusammenfassung - Montag 20-04-2015
by Daily end-of-shift report 20 Apr '15

20 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 17-04-2015 18:00 − Montag 20-04-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Handling Special PDF Compression Methods, (Sun, Apr 19th) *** --------------------------------------------- Maarten Van Horenbeeck posted a diary entry (July 2008) explaining how scripts and data are stored in PDF documents (using streams), and demonstrated a Perl script to decompress streams. A couple of months before, I had started developing my pdf-parser tool, and Maartens diary entry motivated me to continue adding features to pdf-parser. Extracting and decompressing a stream (for example containing a JavaScript script) is easy with pdf-parser. You select the object that contains the stream... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19597&rss *** Taking Down Fraud Sites is Whac-a-Mole *** --------------------------------------------- I've been doing quite a bit of public speaking lately - usually about cybercrime and underground activity - and there's one question that nearly always comes from the audience: "Why are these fraud Web sites allowed to operate, and not simply taken down?" This post is intended to serve as the go-to spot for answering... --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/Da3rhmEIBt0/ *** An Analysis Of MS15-034 *** --------------------------------------------- By now you've undoubtedly heard about MS15-034. The following is a collection of my cursory research and thoughts on this vulnerability. --------------------------------------------- http://www.securitysift.com/an-analysis-of-ms15-034/ *** How to use a malicious JPEG to hack corporate networks *** --------------------------------------------- Security researcher Marcus Murray discovered a method to exploit a malicious JPEG to compromise modern Windows servers inside corporate networks. Security expert and penetration tester Marcus Murray discovered a way to use a malicious JPEG to compromise modern Windows servers and elevate privileges over targeted networks. The researcher has demonstrated the attack a few days.... --------------------------------------------- http://securityaffairs.co/wordpress/36130/hacking/malicious-jpeg-hack-corpo… *** Fiesta Exploit Kit Spreading Crypto-Ransomware - Who Is Affected? *** --------------------------------------------- Exploits kits have long been used to deliver threats to users, but they seem to have gone retro: it was recently being used to deliver fake antivirus malware. We closely monitor exploit kit activity because of their widespread use (we discussed their use in malvertising recently), so it was no great surprise to see the Fiesta... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/F_yFw0VwfG8/ *** "Rootpipe"-Lücke in OS X besteht offenbar weiter *** --------------------------------------------- Trotz Patch in der letzten Yosemite-Version scheint die Rechteausweitung nicht behoben zu sein. Schadcode soll die Lücke schon 2014 ausgenutzt haben. Ein Blogger zeigt unterdessen eine Möglichkeit auf, den Bug auch in früheren OS-X-Versionen zu fixen. --------------------------------------------- http://heise.de/-2612346 *** Bypassing Same Origin Policy, Part 3: Clickjacking, Cursorjacking & Filejacking *** --------------------------------------------- Same origin bypasses using clickjacking Clickjacking (User Interface redress attack, UI redress attack, UI redressing) is a malicious technique of tricking a web user into clicking on something different from what the user perceives they are clicking on, thus potentially revealing confidential information or taking control of their computer while clicking on seemingly innocuous web... --------------------------------------------- http://resources.infosecinstitute.com/bypassing-same-origin-policy-part-3-c… *** Bypassing Packet Filters with IP Fragmentation Overlapping *** --------------------------------------------- 1. Introduction The process of IP fragmentation occurs when the data of the network layer is too large to be transmitted over the data link layer in one piece. Then the data of the network layer is split into several pieces (fragments), and this process is called IP fragmentation. The intention of this article is... --------------------------------------------- http://resources.infosecinstitute.com/bypassing-packet-filters-with-ip-frag… *** Threats From Within: The Out of Office Reply *** --------------------------------------------- As the guy who sends out the marketing emails at Cyveillance (yes, I'm THAT guy) I see a lot of Out-of-Office auto-responders in any given month. Having worked in cybersecurity for more than seven years, I've developed an appreciation for both information and physical security. With the RSA Conference coming up in a few days, and awaiting my barrage of Out of Office emails, I think now is the perfect time to discuss this seemingly innocuous topic. Why? Amazingly, even in the security... --------------------------------------------- https://blog.cyveillance.com/threats-from-within-the-out-of-office-reply/ *** Upatre malware gets full SSL comms encryption *** --------------------------------------------- The extremely popular Upatre Trojan downloader has undergone considerable changes that will make it and its communication more difficult to spot and block. The changes were implemented in the new v... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/qIIbd4nwtHA/malware_news.… *** Critical Magento Shoplift Vulnerability (SUPEE-5344) - Patch Immediately! *** --------------------------------------------- The Magento team released a critical security patch (SUPEE-5344) to address a remote command execution (RCE) vulnerability back in February. It's been more than two months since the release and still more than 50% of all the Magento installations have not been patched, leaving them open to attacks. This means hundreds of thousands of websites are... --------------------------------------------- http://feedproxy.google.com/~r/sucuri/blog/~3/lfn2WVKTfWo/critical-magento-… *** DSA-3228 ppp - security update *** --------------------------------------------- Emanuele Rocca discovered that ppp, a daemon implementing thePoint-to-Point Protocol, was subject to a buffer overflow whencommunicating with a RADIUS server. This would allow unauthenticatedusers to cause a denial-of-service by crashing the daemon. --------------------------------------------- https://www.debian.org/security/2015/dsa-3228 *** GnuTLS RSA PKCS security bypass *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/102423 *** Zenworks Architecture ZDI Vulnerability - See TID 7016431 *** --------------------------------------------- Abstract: Fix for ZDI-CAN-2491: ZENworks Preboot Policy Service Stack Buffer Overflow Remote Code Execution Vulnerability Document ID: 5206350Security Alert: YesDistribution Type: PublicEntitlement Required: NoFiles:ZCM_11.3.2_FRU1_Patch_921190.zip (3.53 MB)ZCM_11.2.4_MU1_Patch_921190.zip (1.63 MB)Products:ZENworks Configuration Management 11.3.2ZENworks Configuration Management 11.2.4ZENworks Configuration Management 11.3.1ZENworks Configuration Management 11 SP3Superceded Patches: None --------------------------------------------- https://download.novell.com/Download?buildid=BJbybNUmQRQ~ *** Invoice - Moderately Critical - Multiple vulnerabilities - SA-CONTRIB-2015-085 *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-085Project: Invoice (third-party module)Version: 6.x, 7.xDate: 2015-March-25 Security risk: 14/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site Scripting, Cross Site Request ForgeryDescriptionInvoice module allows you to create invoices in Drupal.The module doesnt sufficiently sanitize user supplied text in some pages, thereby exposing a Cross Site Scripting vulnerability.Additionally, some URLs were not --------------------------------------------- https://www.drupal.org/node/2459337 *** DSA-3229 mysql-5.5 - security update *** --------------------------------------------- Several issues have been discovered in the MySQL database server. Thevulnerabilities are addressed by upgrading MySQL to the new upstreamversion 5.5.43. Please see the MySQL 5.5 Release Notes and OraclesCritical Patch Update advisory for further details: --------------------------------------------- https://www.debian.org/security/2015/dsa-3229 *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect IBM Sterling Connect:Direct for UNIX (CVE-2015-0286, CVE-2015-0287, CVE-2015-0289, CVE-2015-0292, CVE-2015-0293, CVE-2015-0209, CVE-2015-0288) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21883028 *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect Rational Tau (CVE-2015-0208, CVE-2015-0286, CVE-2015-0292) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21713653 *** IBM Security Bulletin: RC4 stream cipher vulnerability and HTTP request smuggling vulnerability affect IBM Tivoli Application Dependency Discovery Manager (TADDM) (CVE-2015-2808, CVE-2014-0227) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21882717 *** Bugtraq: CVE-2014-7953 Android backup agent code execution *** --------------------------------------------- http://www.securityfocus.com/archive/1/535296 *** Android 4.4 MTP Path Traversal *** --------------------------------------------- Topic: Android 4.4 MTP Path Traversal Risk: Medium Text:MTP path traversal vulnerability in Android 4.4 -- doSendObjectInfo() method of the MtpServer class implemen... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015040116

1 0

Tageszusammenfassung - Freitag 17-04-2015
by Daily end-of-shift report 17 Apr '15

17 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 16-04-2015 18:00 − Freitag 17-04-2015 18:00 Handler: Alexander Riepl Co-Handler: Robert Waldner *** Internet broken as usual. *** --------------------------------------------- We continue to see active exploitation against MS15-034. But nothing different from yesterday, so back to Infocon Green for now. (Fri, Apr 17th) --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19593&rss *** USB Defense: Stop Data Walking Out The Door *** --------------------------------------------- The bad news is that internal data breaches are on the rise. And one of the biggest culprits? USB devices. In the past few years, there has been many organizations tracking down the loss of sensitive/confidential information due to the usage of USB drives and other mass storage media. --------------------------------------------- http://thehackernews.com/2015/04/usb-security-software.html *** US-Polizei schickt Malware an Whistleblower-Anwalt *** --------------------------------------------- Drei Whistelblower beschuldigen eine Polizei in Arkansas der Korruption und des Mobbings. Das Gericht ordnet die Freigabe von Dokumenten an. Die Polizei schickt eine Festplatte mit Passwortlogger, Backdoor und Command&Control Software. --------------------------------------------- http://heise.de/-2610436 *** On false alarms in detection of DGA botnet domains - part 1 *** --------------------------------------------- Domain Generation Algorithms are often used in botnets to create specially crafted domain names which point to C&C servers. The main purpose of this is to make it more difficult to block connections to these servers (for example with domain blacklists) or to protect the C&C channel (and botnet itself) from a takeover. Often domains generated this way are composed of random .. --------------------------------------------- http://www.cert.pl//news/9887/langswitch_lang/en *** Google's April Fool's prank inadvertently broke their security *** --------------------------------------------- As part of its traditional series of April Fools day jokes, Google used its own .google gTLD to launch a backwards version of its home page from the domain com.google on 1st April. However, this years joke inadvertently undermined an important security feature on Googles real homepage, which made it vulnerable to user interface redressing attacks such as click-jacking. This vulnerability would have allowed a remote attacker to change a users search settings, including turning off SafeSearch --------------------------------------------- http://news.netcraft.com/archives/2015/04/17/googles-april-fools-prank-inad… *** GnuTLS Certificate Validation Flaw Lets Remote Users Force a Signature Algorithm Downgrade *** --------------------------------------------- A vulnerability was reported in GnuTLS. A remote user can force the use of a weaker signature algorithm. The software does not verify that the RSA PKCS #1 signature algorithm matches the signature algorithm specified in the certificate. A remote user can exploit this to force the use of a weaker encryption algorithm. --------------------------------------------- http://www.securitytracker.com/id/1032148

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily April 2015