Daily July 2015

daily@lists.cert.at

1 participants
23 discussions

Tageszusammenfassung - Freitag 31-07-2015
by Daily end-of-shift report 31 Jul '15

31 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 30-07-2015 18:00 − Freitag 31-07-2015 18:00 Handler: Alexander Riepl Co-Handler: Stephan Richter *** Derelict TrueCrypt Russia portal is command hub for Ukraine spying op *** --------------------------------------------- Backdoored code slung at officials, journos etc Malware used to attack Ukrainian government, military, and major news agencies in the country, was distributed from the Russian portal of encryption utility TrueCrypt, new research has revealed. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/07/30/truecrypt_r… *** Username Enumeration against OpenSSH-SELinux with CVE-2015-3238 *** --------------------------------------------- I recently disclosed a low-risk vulnerability in Linux-PAM < 1.2.1 , which allows attackers to conduct username enumeration and denial of service attacks. Below I will provide more technical details about this vulnerability. The Past Time-based username enumeration is an... --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/Username-Enumeration-ag… *** Flash Threats: Not Just In The Browser *** --------------------------------------------- July has been a fairly poor month for Adobe Flash Player security, to say the least. Three separate zero-day vulnerabilities (all courtesy of the Hacking Team dump) have left many people concerned about Flash security, with many (including this blog) calling for it to go away. Some sort of reaction from Adobe to improve Flash... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/6YRcRVFMKYg/ *** Bundestags-Hack: Reparatur des Bundestagsnetzes soll vier Tage dauern *** --------------------------------------------- Das Netzwerk des Bundetages soll zwischen dem 13. und 17. August 2015 neu aufgesetzt werden. In dieser Zeit wird es komplett abgeschaltet. Auch E-Mails können dann nicht mehr empfangen oder versendet werden. --------------------------------------------- http://www.golem.de/news/bundestags-hack-reparatur-des-bundestagsnetzes-sol… *** Compromised site serves Nuclear exploit kit together with fake BSOD *** --------------------------------------------- Support scammers not lying about a malware infection for a change.During our work on the development of the VBWeb tests, which will be started soon, we came across an interesting case of an infected website that served not only the Nuclear exploit kit, but also a fake blue screen of death (BSOD) that attempted to trick the user into falling for a support scam.When a (legitimate) website includes (legitimate) advertisements, these ads themselves are rarely included in the HTML code. Rather, the... --------------------------------------------- http://www.virusbtn.com/blog/2015/07_31.xml?rss *** MMS Not the Only Attack Vector for "Stagefright" *** --------------------------------------------- Earlier this week Zimperium zLabs revealed an Android vulnerability which could be used to install malware on a device via a simple multimedia message. This vulnerability, now known as Stagefright, has gained a lot of attention for the potential attacks it can cause. Stagefright makes it possible, for example, for an attacker to install a spyware app... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/fiKsjboNusw/ *** Real World Ramifications of Cyber Attacks *** --------------------------------------------- Warning: the following blog contains gratuitous use of sarcasm and hyperbole from the start. Reader discretion is advised. And so, ladies and gentlemen, it has finally happened. The Internet-of-Things has risen up, Skynet style, and we are doomed. This much prophesied event finally came to pass with reports of hackers disabling cars from miles away, and altering rifle trajectories. At last, it seems, the crossover has been made from the digital world to the physical one; the end is nigh. Then... --------------------------------------------- https://blog.team-cymru.org/2015/07/real-world-ramifications-of-cyber-attac… *** Symantec Endpoint Protection Multiple Issues *** --------------------------------------------- Revisions None Severity CVSS2 Base Score ... --------------------------------------------- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=se… *** Cisco Security Advisories *** --------------------------------------------- *** Cisco ASR 1000 Series Aggregation Services Routers Fragmented Packet Denial of Service Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco Prime Central Hosted Collaboration Solution Cross-Site Scripting Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=40214 *** Cisco IM and Presence Service Reflected Cross-Site Scripting Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=40217 *** Cisco AnyConnect Secure Mobilty Client Directory Traversal Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=40175 *** Cisco Unified Communications Manager Prime Collaboration Deployment Information Disclosure Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=40223 *** Schneider Electric InduSoft Web Studio and InTouch Machine Edition 2014 Password Storage Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a password storage vulnerability in the Schneider Electric InduSoft Web Studio and InTouch Machine Edition 2014 products. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-211-01 *** ZDI-15-372: IBM Tivoli Storage Manager FastBack Server Opcode 4755 Stack Buffer Overflow Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Tivoli Storage Manager FastBack. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/lONzWRepYUI/ *** ZDI-15-373: IBM Tivoli Storage Manager FastBack Server Opcode 1365 Files Restore Agents Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Tivoli Storage Manager FastBack. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/Np2gm5rVOXQ/ *** ZDI-15-374: IBM Tivoli Storage Manager FastBack Server Opcode 1365 Volumes Restore Agents Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Tivoli Storage Manager FastBack. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/zJI4EVNVvMM/ *** ZDI-15-375: IBM Tivoli Storage Manager FastBack Server Opcode 4115 Stack Buffer Overflow Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Tivoli Storage Manager FastBack. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/x0uVs7pbpJo/ *** ZDI-15-376: IBM Tivoli Storage Manager FastBack Server Opcode 8192 Stack Buffer Overflow Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Tivoli Storage Manager FastBack. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/L9RNtcsUYnU/ *** More IBM Security Bulletins *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/?lang=en_us

1 0

Tageszusammenfassung - Donnerstag 30-07-2015
by Daily end-of-shift report 30 Jul '15

30 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 29-07-2015 18:00 − Donnerstag 30-07-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Der Stagefright Bug *** --------------------------------------------- Bald ist die Blackhat Konferenz in Vegas und der Schwachstellen-Zirkus rundherum ist im vollen Gange. Aktuell sind eine Reihe von Verwundbarkeiten in der Stagefright Library von Android groß im Gespräch. Was steckt da .. --------------------------------------------- http://www.cert.at/services/blog/20150730175038-1560.html *** Anatomy of a Scamware Network - MultiPlug *** --------------------------------------------- While examining our cloud sandbox data recently, we uncovered a large MultiPlug network that caught our attention due to its use pattern of code signing certificates and the breadth of its hosting infrastructure. Overview of the Scamware .. --------------------------------------------- http://research.zscaler.com/2015/07/anatomy-of-scamware-network-multiplug.h… *** Tsar Team Microsoft Office Zero Day CVE-2015-2424 *** --------------------------------------------- After the publication of Flash and IE zero days following the Hacking Team leak, researchers have discovered the use of another zero-day vulnerability by the Tsar Team sometimes .. --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/Tsar-Team-Microsoft-Off… *** Telefonanlage gehackt – 14.000 Euro Schaden für Firma in Oberwart *** --------------------------------------------- Der Fall einer Firma, deren Telefonanlage von Unbekannten gehackt worden ist, beschäftigt Kriminalisten in Oberwart: Dem Unternehmer flatterten Rechnungen über insgesamt 14.000 Euro ins Haus. Wie der Schaden entstehen konnte, sei noch Gegenstand von Ermittlungen, teilte die Landespolizeidirektion Burgenland mit. --------------------------------------------- http://derstandard.at/2000019966507 *** Android: Video-Attacke kann Geräte unbenutzbar machen *** --------------------------------------------- Die Sicherheit von Googles mobilem Betriebssystem Android kommt einmal mehr unter Beschuss: Nur wenige Tage nachdem Zimperium vor mehreren Lücken im Media Framework Stagefright gewarnt hat, meldet sich nun auch Trend Micro zu Wort. In einem Blog-Eintrag warnt der Sicherheitsdienstleister vor zwei weiteren Fehlern in Stagefright, durch die ein Android-Gerät vorübergehend keinen Laut mehr von sich gibt. Auch reagiert ein solcherart angegriffenes Geräte kaum bis gar nicht mehr. --------------------------------------------- http://derstandard.at/2000019966485 *** Windows 10 speichert Festplattenverschlüsselungs-Keys in der Cloud *** --------------------------------------------- Mit Windows 10 steht seit kurzem die neueste Betriebssystemgeneration von Microsoft zur Verfügung. Die ersten Tests kommen zu überwiegende positiven Urteilen, und doch steht der Softwarehersteller nun einmal mehr in der Kritik – und zwar von Sicherheitsexperten. --------------------------------------------- http://derstandard.at/2000019972950 *** Throwback Thursday: Riotous Assembly *** --------------------------------------------- This Throwback Thursday, we turn the clock back to January 1994, shortly after Cyber Riot had emerged as the first virus capable of infecting the Windows kernel.Today, malware that affects the Windows kernel is ubiquitous - the .. --------------------------------------------- http://www.virusbtn.com/blog/2015/07_30.xml *** Beginners Guide to "Use after free Exploits #IE 6 0-day #Exploit Development" *** --------------------------------------------- Last week a friend asked few queries regarding use after free vulnerabilities, . Its been a while I wrote a tutorial so taught of cooking a beginners guide this week end. I wanted a live target for the tutorial so my plans were to .. --------------------------------------------- http://garage4hackers.com/content.php?r=143-Beginners-Guide-to-Use-after-fr… *** Admin-Oberfläche Froxlor verrät Datenbank-Passwörter *** --------------------------------------------- Das Server-Management-Panel Froxlor ist verwundbar und Angreifer können unter Umständen das Datenbank-Passwort aus der Ferne auslesen. Eine gefixte Version ist aber noch nicht für alle Linux-Distributionen verfügbar. --------------------------------------------- http://heise.de/-2765508 *** OpenBSD patch Lets Remote Users Execute Arbitrary Commands on the Target System *** --------------------------------------------- http://www.securitytracker.com/id/1033126 *** CVE-2015-0097 Exploited in the Wild *** --------------------------------------------- In March 2015, Microsoft patched a remote code execution (RCE) vulnerability (CVE-2015-0097) in Microsoft Office. In July 2015, Eduardo Prado released a Proof of Concept (PoC) exploit for this vulnerability here. It did not take long for attackers to repackage this PoC and use it in attacks .. --------------------------------------------- https://www.fireeye.com/blog/threat-research/2015/07/cve-2015-0097_exploi.h… *** l+f: Smarter Safe lässt sich clever ausrauben *** --------------------------------------------- Präparierten USB-Stick anstecken, 60 Sekunden warten und schon öffnen sich die Tresor-Türen: Mehr als 10.000 in den USA installierte vermeintlich smarte Tresore sollen sich so knacken lassen. Die Spuren lassen sich dabei restlos verwischen. --------------------------------------------- http://heise.de/-2765663 *** Why is Passive Mixed Content so serious? *** --------------------------------------------- One of the most important tools in web security is Transport Layer Security (TLS). It not only protects sensitive information during transit, but also verifies that .. --------------------------------------------- https://blog.whitehatsec.com/why-is-passive-mixed-content-so-serious/

1 0

Tageszusammenfassung - Mittwoch 29-07-2015
by Daily end-of-shift report 29 Jul '15

29 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 28-07-2015 18:00 − Mittwoch 29-07-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** New RC4 Attack *** --------------------------------------------- New research: "All Your Biases Belong To Us: Breaking RC4 in WPA-TKIP and TLS," by Mathy Vanhoef and Frank Piessens: Abstract: We present new biases in RC4, break the Wi-Fi Protected Access Temporal Key Integrity Protocol (WPA-TKIP), and design a practical .. --------------------------------------------- https://www.schneier.com/blog/archives/2015/07/new_rc4_attack_1.html *** Cisco UCS Central Software File Access Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40151 *** Cisco AnyConnect Secure Mobility Client Local Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40176 *** SweetCAPTCHA Returns Hijacking Another Plugin *** --------------------------------------------- Yesterday we observed a strange short return of the SweetCaptcha plugin to WordPress.org repository. In June we reported that SweetCaptcha injected third-party ad code to their scripts which lead to malvertising problems on the .. --------------------------------------------- https://blog.sucuri.net/2015/07/sweetcaptcha-returns-hijacking-another-plug… *** CVE-2015-5477: An error in handling TKEY queries can cause named to exit with a REQUIRE assertion failure *** --------------------------------------------- An error in the handling of TKEY queries can be exploited by an attacker for use as a denial-of-service vector, as a constructed packet can use the defect to trigger a REQUIRE assertion failure, causing BIND to exit. --------------------------------------------- https://kb.isc.org/article/AA-01272 *** Trend Micro Discovers Vulnerability That Renders Android Devices Silent *** --------------------------------------------- We have discovered a vulnerability in Android that can render a phone apparently dead - silent, unable to make calls, with a lifeless screen. This vulnerability is present from Android 4.3 (Jelly Bean) up to the current version, Android .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/trend-micro-disc… *** Hackers Can Disable a Sniper Rifle - Or Change Its Target *** --------------------------------------------- If a hacker attacks your TrackingPoint smart gun over its Wi-Fi connection, you may find the weapon is aiming at a different target than you think. --------------------------------------------- http://www.wired.com/2015/07/hackers-can-disable-sniper-rifleor-change-targ… *** Eigene Keys zum Verschlüsseln der Google Cloud Platform *** --------------------------------------------- Nutzer der Google Cloud Platform können ihre Umgebung nun mit eigenen Keys verschlüsseln. So sollen weder Betreiber noch Externe Zugriff auf die Daten erhalten. --------------------------------------------- http://heise.de/-2764751 *** Phishing: Betrüger zocken Nutzer mit "WhatsApp Gold" ab *** --------------------------------------------- Fake-Angebot lockt mit "besserer Audioqualität" und größeren Gruppen – bringt aber nur Werbung --------------------------------------------- http://derstandard.at/2000019919056 *** A third of workers admit theyd leak sensitive biz data for peanuts *** --------------------------------------------- And three per cent of employees would consider offers as low as 100 pound. A third of employees would sell information on company patents, financial records and customer credit card details .. --------------------------------------------- www.theregister.co.uk/2015/07/29/third_workers_would_leak_data_cash/ *** Die Git-Stolperfalle: Viele Webseiten geben sensible Daten preis *** --------------------------------------------- Wenn Web-Admins beim Hochladen von Projekten nicht aufpassen, stellen sie unter Umständen ohne es mitzubekommen Passwort-Datenbanken und weitere schützenswerte Daten zum Abruf für jedermann bereit. --------------------------------------------- http://heise.de/-2764756 *** Remote code execution via serialized data *** --------------------------------------------- Most programming languages contain powerful features, that used correctly are incredibly powerful, but used incorrectly can be incredibly dangerous. Serialization (and deserialization) is one such feature available in most modern programming .. --------------------------------------------- https://securityblog.redhat.com/2015/07/29/remote-code-execution-via-serial… *** Analyzing VUPEN's CVE-2012-1856 *** --------------------------------------------- Quite some time ago (more than a year before the HackingTeam leaks) I came across a number of interesting exploit samples that make use of CVE-2012-1856. With the recent HackingTeam leaks a .. --------------------------------------------- http://blog.ropchain.com/2015/07/27/analyzing-vupens-cve-2012-1856/ *** Sicherheitsupdate von Chrysler gefährlicher als Hack *** --------------------------------------------- Zum Schließen einer Sicherheitslücke, die eine Fernsteuerung des Autos ermöglichen könnte, bot Chrysler den Download von ".exe"- und ".zip"-Dateien für die Autoelektronik an. --------------------------------------------- http://fm4.orf.at/stories/1761148/ *** Windows 10 Shares Your Wi-Fi With Contacts *** --------------------------------------------- Starting today, Microsoft is offering most Windows 7 and Windows 8 users a free upgrade to the software giants latest operating system -- Windows 10. But theres a very important security caveat that users should know about before transitioning to the .. --------------------------------------------- http://krebsonsecurity.com/2015/07/windows-10-shares-your-wi-fi-with-contac…

1 0

Tageszusammenfassung - Dienstag 28-07-2015
by Daily end-of-shift report 28 Jul '15

28 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 27-07-2015 18:00 − Dienstag 28-07-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Cisco Firepower 9000 Series Unauthenticated Web Page Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40136 *** Cisco Email Security Appliance AsyncOS Cross-Site Scripting Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40172 *** Angler Exploit Kit Used to Find and Infect PoS Systems *** --------------------------------------------- An attack aiming to infect PoS systems was found using the Angler Exploit Kit to push a PoS reconnaissance Trojan,This Trojan, detected as TROJ_RECOLOAD.A, checks for multiple conditions in the infected system like if it is a PoS machine or part of a PoS .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/angler-exploit-k… *** PHP File Manager hat gravierende Sicherheitslücken *** --------------------------------------------- Seit Jahren ungepatchte Schwachstellen im PHP File Manager gefährden zahlreiche Server, darunter auch von großen Unternehmen. Der Hersteller reagiert nicht auf Anfragen --------------------------------------------- http://www.golem.de/news/security-php-file-manager-hat-gravierende-sicherhe… *** 2. Konferenz zur Cyber Security Challenge: Das Programm steht *** --------------------------------------------- Die Gefahren und andererseits die Möglichkeiten zum Schutz und der Prävention vor Cyberangriffen sind das zentrale Thema der 2. Konferenz zur Cyber Security Challenge Germany Mitte September in Berlin. --------------------------------------------- http://heise.de/-2761878 *** [2015-07-28] McAfee Application Control multiple vulnerabilities *** --------------------------------------------- McAfee Application Control contains multiple vulnerabilities which can be used by an attacker to bypass the provided application whitelisting protection and attack availability of the system. Moreover, the identified vulnerabilities negatively affect the security of the underlying operating system. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015… *** IMI 2015 - IT meets Industry 29.-30. September 2015 *** --------------------------------------------- Interconnecting IT and Automation offers great opportunities for the operation of industrial production sites. However, this may carry along some complex risks. With the title “IT meets Industry” IMI 2015 brings together the ICS- and IT-Community. The goal: make the most of opportunities – and minimise risks. --------------------------------------------- https://it-meets-industry.de/ *** Honeynet-Projekt analysiert Gefahren für Industrie 4.0 *** --------------------------------------------- Acht Monate lang beobachteten Experten des TÜV SÜD, welche Angriffe von wo aus auf ihr simuliertes Wasserwerk erfolgten. Ihre Erkenntnisse sollten arglose Unternehmen spätestens jetzt wachrütteln. --------------------------------------------- http://heise.de/-2763978 *** Aaron Zauner presented preliminary results on TLS usage in email *** --------------------------------------------- Aaron Zauner presented our preliminary results on the usage of TLS in the email ecosystem at the IETF meeting last week. As part of our project TLSiP we are actively scanning the Internet (/0) for TLS configurations as well as its problems with it. As .. --------------------------------------------- https://www.sba-research.org/2015/07/28/aaron-zauner-presented-preliminary-… *** The Russian Underground - Revamped *** --------------------------------------------- When big breaches happen and hundreds of millions of credit card numbers and SSNs get stolen, they resurface in other places. The underground now offers a vast landscape of shops, where criminals can buy credit cards and other things at irresistible prices. Million dollar breaches News and media coverage .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/the-russian-unde… *** Cisco 2015 Midyear Security Report [PDF] *** --------------------------------------------- http://www.cisco.com/web/offers/pdfs/cisco-msr-2015.pdf *** Security: Apples App Store als Einfallstor für Schadcode *** --------------------------------------------- Über eine Schwachstelle in der Verarbeitung von Belegen für Einkäufe in Apples App Store lässt sich Code auf fremden Rechnern einschleusen. --------------------------------------------- http://www.golem.de/news/security-apples-app-store-als-einfallstor-fuer-sch…

1 0

Tageszusammenfassung - Montag 27-07-2015
by Daily end-of-shift report 27 Jul '15

27 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 24-07-2015 18:00 − Montag 27-07-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Multiple Cisco Products LDAP Server SSL Certificate Validation Vulnerability *** --------------------------------------------- A vulnerability in SSL certificate validation of multiple Cisco products could allow an unauthenticated, remote attacker to stage a man-in-the-middle attack. The vulnerability is due to lack of SSL certificate validation for secure LDAP. An attacker could exploit this vulnerability to stage a man-in-the-middle attack when .. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40137 *** IT-Sicherheit bei smarten Autos "viel zu lange ignoriert" *** --------------------------------------------- Nach dem Hack eines Jeeps gibt es Einigung darüber, dass noch viel Nachholbedarf besteht --------------------------------------------- http://derstandard.at/2000019712190 *** DSA-3317 lxc - security update *** --------------------------------------------- Several vulnerabilities have been discovered in LXC, the LinuxContainers userspace tools. Roman Fiedler discovered a directory traversal flaw in LXC when creating lock files. A local attacker could exploit this flaw to create an arbitrary .. --------------------------------------------- https://www.debian.org/security/2015/dsa-3317 *** Hacking Team: "Wir sind das Opfer" *** --------------------------------------------- Der Hersteller von aggressiver Überwachungs-Software sieht sich als einziges Opfer in der Affäre um die Veröffentlichung von Daten, die die Zusammenarbeit des Unternehmens mit autoritären Staaten belegen sollen. --------------------------------------------- http://heise.de/-2763077 *** WP Statistics <= 9.4 - SQL Injection *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8116 *** WP Slimstat <= 4.1.5.2 - Referer Header Cross-Site Scripting (XSS) *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8117 *** Password Hashing Competition: Hashfunktion Argon2 gewinnt Wettbewerb *** --------------------------------------------- In einem Wettbewerb ist nach neuen Hashfunktionen gesucht worden, die sich für das Hashen von Passwörtern eignen. Jetzt steht der Gewinner fest: Argon2, entwickelt von einem Team an der Universität Luxemburg. --------------------------------------------- http://www.golem.de/news/password-hashing-competition-hashfunktion-argon2-g… *** Security: Zahlreiche Steam-Konten gehackt *** --------------------------------------------- Die Steam-Konten mehrerer Twitch-Streamer wurden offenbar von Unbekannten übernommen. Sie nutzen einen Fehler in der Anmeldefunktion aus. Valve hat bereits ein Update bereitgestellt. --------------------------------------------- http://www.golem.de/news/security-zahlreiche-steam-konten-gehackt-1507-1154… *** Advertising hijacking made by Invisible rogue mobile apps are wasting petabytes of data a day *** --------------------------------------------- Mobile Malware is growing and crooks are targeting the advertising industry to redirect users to ad pages in a sort of Advertising hijacking. Mobile Malware is growing and crooks are targeting the advertising industry with malicious .. --------------------------------------------- http://securityaffairs.co/wordpress/38885/cyber-crime/mobile-advertising-hi… *** Citrix XenServer Multiple Security Updates *** --------------------------------------------- A number of security vulnerabilities have been identified in Citrix XenServer that may allow a malicious administrator of a guest VM to crash the host ... --------------------------------------------- http://support.citrix.com/article/CTX201145 *** ManageEngine Exchange Reporter Plus Auth Bypass / Arbitrary SQL Statement Execution *** --------------------------------------------- The ManageEngine Exchange Reporter product installs a JBoss server which listens on default port 8181 (tcp/http) for incoming requests. It offers an admin panel on that port. Without authorization/authentication it is possible to .. --------------------------------------------- https://blogs.securiteam.com/index.php/archives/2533 *** Experts Found a Unicorn in the Heart of Android *** --------------------------------------------- Gaining remote code execution privileges merely by having access to the mobile number? Enter Stagefright. The targets for this kind of attack can be anyone from Prime ministers, govt. officials, company executives, security officers to IT managers. --------------------------------------------- http://blog.zimperium.com/experts-found-a-unicorn-in-the-heart-of-android/

1 0

Tageszusammenfassung - Freitag 24-07-2015
by Daily end-of-shift report 24 Jul '15

24 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 23-07-2015 18:00 − Freitag 24-07-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Four Zero Days Disclosed in Internet Explorer Mobile *** --------------------------------------------- [...] The four vulnerabilities originally were reported to Microsoft as affecting IE on the desktop, and later on it was discovered that they also affected IE Mobile on Windows Phones. Microsoft has patched all of the vulnerabilities in the desktop version of the browser, but the bugs remain open on IE Mobile. ZDI’s original advisories on these flaws said that they were zero days on Internet Explorer, as well. The company updated the advisories late Thursday to reflect the fact that the bugs only affect IE Mobile. --------------------------------------------- http://threatpost.com/four-zero-days-disclosed-in-internet-explorer/113911 *** Fixing hundreds of websites in one day *** --------------------------------------------- Remedying Angler infections in Switzerland In recent weeks the Angler exploit kit has become the dominating tool for DriveBy attacks. Cleaning Angler compromised web servers is a challenge which has been well mastered in Switzerland, thanks to the close collaboration... --------------------------------------------- http://securityblog.switch.ch/2015/07/24/fixing-hundreds-of-websites-in-one… *** The OpenSSH Bug That Wasnt *** --------------------------------------------- Much has been written about a purported OpenSSH vulnerability. On closer inspection, the reports actually got most of their facts wrong. Read on for the full story.It all started with a blog post dated July 16, 2015, titled OpenSSH keyboard-interactive authentication brute force vulnerability (MaxAuthTries bypass), where the TL;DR is that its possible to get an almost infinite number of tries at authentication -- good for bruteforce password guessing, for example -- if you only tickle the... --------------------------------------------- http://bsdly.blogspot.com/2015/07/the-openssh-bug-that-wasnt.html *** Malicious Google Analytics Referral Spam *** --------------------------------------------- Robots (bots) have outnumbered people on the Internet for almost two years, and they browse much faster than your average visitor. Aside from spamming your comment systems and crawling for vulnerable websites to attack, bots can also cause a lot of confusion in your website traffic reporting systems. If you use analytics software on yourRead More The post Malicious Google Analytics Referral Spam appeared first on Sucuri Blog. --------------------------------------------- https://blog.sucuri.net/2015/07/malicious-google-analytics-referral-spam.ht… *** libuser vulnerabilities *** --------------------------------------------- It was discovered that the libuser library contains two vulnerabilities which, in combination, allow unprivileged local users to gain root privileges. libuser is a library that provides read and write access to files like /etc/passwd, which constitute the system user... --------------------------------------------- https://securityblog.redhat.com/2015/07/23/libuser-vulnerabilities/ *** Emerging Web Infrastructure Threats *** --------------------------------------------- A secure cloud relies on some weak Internet infrastructure with some new BGP vulnerabilities that will be disclosed at Black Hat USA. --------------------------------------------- http://www.darkreading.com/cloud/emerging-web-infrastructure-threats/d/d-id… *** Boffins sting spooks with HORNET onion router *** --------------------------------------------- Spies eyss will water with effort as they try to slice into 93 Gb/s Tor cousin Five academics have developed a Tor alternative network that can handle up to 93 Gb/s of traffic while maintaining privacy. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/07/24/hornet_high… *** SANS ICS Amsterdam 2015 - 22-28 September, 2015 *** --------------------------------------------- SANS ICS Amsterdam 2015 remains open for registration. This dedicated event for those tasked with securing Industrial Control Systems will be led by SANS ICS/SCADA Instructors and subject-matter experts from across the globe. --------------------------------------------- https://www.sans.org/event/ics-amsterdam-2015 *** IT-Sicherheitsgesetz tritt in Kraft *** --------------------------------------------- Das "Gesetz zur Erhöhung der Sicherheit informationstechnischer Systeme" bringt zunächst verschärfte Anforderungen für Serveradmins und Meldepflichten für Provider sowie Kernkraftwerksbetreiber mit sich. --------------------------------------------- http://www.heise.de/newsticker/meldung/IT-Sicherheitsgesetz-tritt-in-Kraft-… *** How to manage PCI DSS 3.1 Requirement 6.6 for your web applications *** --------------------------------------------- One of the PCI DSS 3.1 requirements is Requirement 6.6 dedicated to web application security. In this blog post we will try to understand how to comply with the requirement in cost-efficient manner. --------------------------------------------- https://www.htbridge.com/blog/how-to-manage-pci-dss-3-1-requirement-6-6-for… *** SweetCaptcha Returns Hijacking Another Plugin *** --------------------------------------------- Yesterday we observed a strange short return of the SweetCaptcha plugin to WordPress.org repository. In June we reported that SweetCaptcha injected third-party ad code to their scripts which lead to malvertising problems on the sites that used this CAPTCHA service. After that incident, the SweetCaptcha WordPress plugin had been removed from the official plugin repository.Read More The post SweetCaptcha Returns Hijacking Another Plugin appeared first on Sucuri Blog. --------------------------------------------- https://blog.sucuri.net/2015/07/sweetcaptcha-returns-hijacking-another-plug… *** DSA-3314 typo3-src - end of life *** --------------------------------------------- Upstream security support for Typo3 4.5.x ended three months ago and thesame now applies to the Debian packages as well. --------------------------------------------- https://www.debian.org/security/2015/dsa-3314 *** userhelper/libuser Multiple vulns *** --------------------------------------------- Topic: userhelper/libuser Multiple vulns Risk: Medium Text:Qualys Security Advisory CVE-2015-3245 userhelper chfn() newline filtering CVE-2015-3246 libuser passwd file handling ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015070115 *** Siemens RuggedCom ROS and ROX-based Devices TLS POODLE Vulnerability (UPDATE A) *** --------------------------------------------- This updated advisory is a follow-up to the original advisory titled ICSA-15-202-03 Siemens RuggedCom ROS and ROX-based Devices TLS POODLE Vulnerability that was published July 22, 2015 on the ICS-CERT web site. This advisory provides mitigation details for a Transport Layer Security Padding Oracle On Downgraded Legacy Encryption vulnerability in the web interface of the Siemens RuggedCom ROS and ROX-based devices. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-202-03A

1 0

Tageszusammenfassung - Donnerstag 23-07-2015
by Daily end-of-shift report 23 Jul '15

23 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 22-07-2015 18:00 − Donnerstag 23-07-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Flash zero-day monster Angler dominates exploit kit crime market *** --------------------------------------------- If only you could buy shares SophosLabs researcher Fraser Howard says the Angler exploit kit is dominating the highly-competitive underground malware market, growing from exploding a quarter to 83 percent of market share within nine months . --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/07/23/sophos_angl… *** Hintergrund: Das Geschäft mit den Zero Days *** --------------------------------------------- Der Verkauf von bisher unbekannten Sicherheitslücken, sogenannten Zero Days, scheidet die Geister. Manche halten dieses Geschäft für unmoralisch, andere sagen, es sollte illegal sein. Vor allem ist es aber wohl sehr lukrativ. --------------------------------------------- http://heise.de/-2757303 *** Security: Schwachstelle erlaubt lokale Rechteausweitung in OS X 10.10 *** --------------------------------------------- Ein Fehler in Apples OS X 10.10.4 erlaubt es, sich administrative Privilegien zu verschaffen. Die Schwachstelle kann nur lokal ausgenutzt werden und wurde in der Beta von OS X 10.11 bereits behoben. --------------------------------------------- http://www.golem.de/news/security-schwachstelle-erlaubt-lokale-rechteauswei… *** 3 important questions raised by Wired's car hack *** --------------------------------------------- Wired.com broke a shocking but hardly surprising story on July 21st. The reporter was driving his Jeep on the highway when strange things started to happen. First the fan and radio went on and later the whole car came to a stop. On the highway! Andy Greenburg was not in control of the car anymore. --------------------------------------------- http://safeandsavvy.f-secure.com/2015/07/23/3-important-questions-raised-by… *** Löchrige VMs: Den PGP-Schlüssel des Nachbarn klauen *** --------------------------------------------- Teilt man sich auf einem virtuellen Server die gleiche Hardware mit anderen VMs, kann man diese ausspionieren. Dabei lassen sich auf überraschend vielen Wegen Side-Channel-Angriffe durchführen. --------------------------------------------- http://heise.de/-2760695 *** Hacking Team: a zero-day market case study *** --------------------------------------------- This article documents Hacking Teams third-party acquisition of zero-day (0day) vulnerabilities and exploits. The recent compromise of Hacking Teams email archive offers one of the first public case studies of the market for 0days. Because of its secretive nature, this market has been the source of endless debates on the ethics of its participants. The archive also offers insight into the capabilities and limits of offensive-intrusion software developers. Hacking Team was seriously exploit... --------------------------------------------- http://tsyrklevich.net/2015/07/22/hacking-team-0day-market/ *** Securing Cookies using HTTP Headers *** --------------------------------------------- In the previous articles in this series on defending against web attacks using HTTP headers, we have seen the usage of X-Frame-Options and X-XSS-Protection headers. In this article, we will see some HTTP headers to secure cookies. Introduction: Cookies are one of the most sensitive items during a user's session. An authentication cookie is as... --------------------------------------------- http://resources.infosecinstitute.com/defending-against-web-attacks-using-h… *** Another Day, Another Patch *** --------------------------------------------- FreeBSD users were treated this week to an interesting new denial of service attack vector. All supported versions of the OS are affected by the bug, which has now been patched. Junos OS, which is based on FreeBSD, is also affected. If you're a FreeBSD admin and you haven't patched, feel free to disappear now and do so. Don't worry, we'll be here when you're done - Right, now that's out of the way, we can peruse the vulnerability at our leisure. The bug... --------------------------------------------- https://blog.team-cymru.org/2015/07/another-day-another-patch/ *** SBA Afterworks Summer Special: Hacking Team Hacked? => Lessons Learned! *** --------------------------------------------- August 06, 2015 - 5:00 pm - 6:00 pm SBA Research Favoritenstraße 16 1040 Wien --------------------------------------------- https://www.sba-research.org/events/security-afterworks-hacking-team-hacked… *** Sicherheitsupdate für WordPress *** --------------------------------------------- WordPress 4.2.3 stopft unter anderem ein Sicherheitsloch, durch die Nutzer mit bestimmten Rechten die gesamte Site kompromittieren können. --------------------------------------------- http://heise.de/-2761788 *** Microsofts Advanced Threat Analytics soll Firmennetze schützen *** --------------------------------------------- Microsoft will Firmennetze mit Advanced Threat Analytics gegen Angriffe und Eindringlinge wappnen. Die Software setzt am Active Directory an, soll lernfähig sein und präsentiert Verdächtiges in einer Zeitleiste. --------------------------------------------- http://heise.de/-2761360 *** Cisco IOS Software TFTP Server Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco Unified MeetingPlace Unauthorized Password Change Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco Application Policy Infrastructure Controller Access Control Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco IOS XR LPTS Network Stack Remote Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40068 *** Security Advisory: PCRE library vulnerability CVE-2015-2325 *** --------------------------------------------- (SOL16983) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/900/sol16983.htm… *** Security Advisory: Multiple PHP vulnerabilities CVE-2015-4025 and CVE-2015-4026 *** --------------------------------------------- (SOL16993) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/900/sol16993.htm… *** DSA-3312 cacti - security update *** --------------------------------------------- Multiple SQL injection vulnerabilities were discovered in cacti, a webinterface for graphing of monitoring systems. --------------------------------------------- https://www.debian.org/security/2015/dsa-3312 *** DSA-3313 linux - security update *** --------------------------------------------- Several vulnerabilities have been discovered in the Linux kernel thatmay lead to a privilege escalation or denial of service. --------------------------------------------- https://www.debian.org/security/2015/dsa-3313 *** EMC Avamar Lets Remote Users Traverse the Directory to View Files on the Target System *** --------------------------------------------- http://www.securitytracker.com/id/1033026 *** USN-2676-1: NBD vulnerabilities *** --------------------------------------------- Ubuntu Security Notice USN-2676-122nd July, 2015nbd vulnerabilitiesA security issue affects these releases of Ubuntu and its derivatives: Ubuntu 15.04 Ubuntu 14.10 Ubuntu 14.04 LTS Ubuntu 12.04 LTSSummarySeveral security issues were fixed in NBD.Software description nbd - Network Block Device protocol DetailsIt was discovered that NBD incorrectly handled IP address matching. Aremote attacker could use this issue with an IP address that has a partialmatch and bypass access restrictions. This... --------------------------------------------- http://www.ubuntu.com/usn/usn-2676-1/ *** Time Tracker - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-135 *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-135Project: Time Tracker (third-party module)Version: 7.xDate: 2015-July-22Security risk: 14/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site Scripting, Multiple vulnerabilitiesDescriptionThis module enables you to track time on entities and comments.The module doesnt sufficiently filter notes added to time entries, leading to an XSS/JavaScript injection vulnerability. This vulnerability is mitigated by... --------------------------------------------- https://www.drupal.org/node/2537866 *** OSF for Drupal - Critical - Multiple vulnerabilities - SA-CONTRIB-2015-134 *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-134Project: OSF for Drupal (third-party module)Version: 7.xDate: 2015-July-22Security risk: 15/25 ( Critical) AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross Site Scripting, Access bypass, Cross Site Request ForgeryDescriptionThe Open Semantic Framework (OSF) for Drupal is a middleware layer that allows structured data (RDF) and associated vocabularies (ontologies) to "drive" tailored tools and data displays within... --------------------------------------------- https://www.drupal.org/node/2537860 *** FTC Uconnect Vulnerability *** --------------------------------------------- NCCIC/ICS-CERT is aware of a public report and video of researchers demonstrating remote exploits on a magazine reporter's automobile. The report and video focus on unauthorized remote access to the Fiat Chrysler Automobile (FCA) Connect automotive infotainment system. ICS-CERT is issuing this alert to provide notice of this report and video, and that a patch is available from the FCA. --------------------------------------------- https://ics-cert.us-cert.gov/alerts/ICS-ALERT-15-203-01 *** WordPress 4.2.3 Security and Maintenance Release *** --------------------------------------------- July 23, 2015 --------------------------------------------- https://wordpress.org/news/2015/07/wordpress-4-2-3/ *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in current releases of IBM WebSphere Real Time *** http://www.ibm.com/support/docview.wss?uid=swg21962496 *** IBM Security Bulletin: Current Release of IBM SDK for Node.js in IBM Bluemix is affected by CVE-2015-5380 *** http://www.ibm.com/support/docview.wss?uid=swg21962754 *** IBM Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects IBM Tealeaf Customer Experience (CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=swg21959030 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Rational Service Tester (CVE-2015-4000, CVE-2015-0478, CVE-2015-1916). *** http://www.ibm.com/support/docview.wss?uid=swg21962216 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK (CVE-2015-0478, CVE-2015-0488, and CVE-2015-1916) and with Diffie-Hellman ciphers (CVE-2015-4000) may affect IBM Integration Designer (IID) and WebSphere Integration Developer (WID) *** http://www.ibm.com/support/docview.wss?uid=swg21961812 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM WebSphere Cast Iron (CVE-2015-0478, CVE-2015-0488) *** http://www.ibm.com/support/docview.wss?uid=swg21961728 *** IBM Security Bulletin: Vulnerabilities in OpenSSL affects IBM Workload Deployer (CVE-2015-0209, CVE-2015-0286, CVE-2015-0287, CVE-2015-0288, CVE-2015-0289, CVE-2015-0292, and CVE-2015-0293) *** http://www.ibm.com/support/docview.wss?uid=swg21962334 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Image Construction and Composition Tool (CVE-2015-0410 and CVE-2014-6593) *** http://www.ibm.com/support/docview.wss?uid=swg21962370

1 0

Tageszusammenfassung - Mittwoch 22-07-2015
by Daily end-of-shift report 22 Jul '15

22 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 21-07-2015 18:00 − Mittwoch 22-07-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** WP-CLI Guide: Secure WordPress Backup and Update *** --------------------------------------------- Welcome to our second post in the series on WP-CLI for WordPress management over SSH. In our previous post, we discussed how to get your SSH credentials and use WP-CLI to connect to your website over the command line. Before we get into changing anything, we'll show you how to back up your database and compress... --------------------------------------------- https://blog.sucuri.net/2015/07/wp-cli-guide-secure-wordpress-backup-update… *** Exclusive: Visa application portal closed following SC Magazine investigation *** --------------------------------------------- VFS Global closes visa application portal following SC Magazine investigation. Editable Schengen visa application forms accessed FOUR DAYS after operating company VFS Global said a vulnerability had been fixed. --------------------------------------------- http://www.scmagazine.com/exclusive-visa-application-portal-closed-followin… *** Free security tools help detect Hacking Team malware *** --------------------------------------------- Vulnerabilities and other threats exposed in the Hacking Team leaks has spurred Rook Security and Facebook to each release free security tools. --------------------------------------------- http://www.scmagazine.com/rook-security-facebook-release-free-security-tool… *** "Super-Spion": Android-Überwachungssoftware von Hacking Team nutzt allerhand schmutzige Tricks *** --------------------------------------------- Eine Analyse der Spionage-App RCSAndroid zeigt umfassende Ausspähfunktionen auf. Die Infektion erfolgt über Exploits - und möglicherweise auch Google Play. --------------------------------------------- http://heise.de/-2759365 *** Introduction to Alternate Data Streams *** --------------------------------------------- In this post, we defined what is an alternate data stream (ADS), showed how it can be created and read, and how one can remove unwanted ADS.Categories: All Things DevTags: adsalternate data streamsPieter Arntzpowershellstreams(Read more...) --------------------------------------------- https://blog.malwarebytes.org/development/2015/07/introduction-to-alternate… *** Think your website isn't worth anything to hackers? Think again *** --------------------------------------------- Have you ever thought about the cost of your website compromise? --------------------------------------------- https://www.htbridge.com/blog/think-your-website-isn-t-worth-anything-to-ha… *** l+f: Falsche Microsoft-Techniker simulieren falsche Bluescreens *** --------------------------------------------- Die Telefonabzocker, die sich als Microsoft-Techniker ausgeben, haben sich eine neue Masche überlegt - und sind jetzt auch telefonisch erreichbar. --------------------------------------------- http://heise.de/-2760509 *** DFN-CERT-2015-1107: FreeBSD, Transmission Control Protocol (TCP): Eine Schwachstelle erlaubt einen Denial-of-Service-Angriff *** --------------------------------------------- Eine Schwachstelle im Transmission Control Protocol (TCP) der TCP/IP Protocol Suite ermöglicht einem entfernten, nicht authentisierten Angreifer einen kompletten Denial-of-Service-Zustand zu bewirken. Von der Schwachstelle sind alle derzeit unterstützten FreeBSD-Versionen betroffen. Sicherheitsupdates stehen bereit. --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-1107/ *** IBM Security Bulletins *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/?lang=en_us *** Cisco IOS XR Concurrent Data Management Replication Process BGP Process Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40067 *** Cisco WebEx Meetings Server Cross-Site Request Forgery Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40021 *** [R1] PHP < 5.4.43 Vulnerability Affects Tenable SecurityCenter *** --------------------------------------------- http://www.tenable.com/security/tns-2015-09 *** Hospira Symbiq Infusion System Vulnerability *** --------------------------------------------- This advisory was originally posted to the US-CERT secure Portal library on June 23, 2015, and is being released to the NCCIC/ICS-CERT web site. This advisory provides compensating measures for a vulnerability in the Hospira Symbiq Infusion System. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-174-01 *** Counter-Strike 1.6 GameInfo Query Reflection DoS *** --------------------------------------------- Topic: Counter-Strike 1.6 GameInfo Query Reflection DoS Risk: Medium Text:#!/usr/bin/perl # # Counter-Strike 1.6 GameInfo Query Reflection DoS # Proof Of Concept # # Copyright 2015 (c) Todor ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015070103

1 0

Tageszusammenfassung - Dienstag 21-07-2015
by Daily end-of-shift report 21 Jul '15

21 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 20-07-2015 18:00 − Dienstag 21-07-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl Co-Handler: Stephan Richter *** One Perfect Bug: Exploiting Type Confusion in Flash *** --------------------------------------------- Posted by Natalie Silvanovich, Dazed and (Type) ConfusedFor some attackers, it is important that an exploit be extremely reliable. That is to say, the exploit should consistently lead to code execution when it is run on a system with a known platform and Flash version. One way to create such an exploit is to use an especially high-quality bug. This post describes the exploitation of one such bug, and the factors that make it especially good for reliable exploitation.The BugCVE-2015-3077 is a... --------------------------------------------- http://googleprojectzero.blogspot.com/2015/07/one-perfect-bug-exploiting-ty… *** Hackers Remotely Kill a Jeep on the Highway - With Me in It *** --------------------------------------------- I was driving 70 mph on the edge of downtown St. Louis when the exploit began to take hold. --------------------------------------------- http://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/ *** Searching Through the VirusTotal Database, (Tue, Jul 21st) *** --------------------------------------------- Now that my overview of Sysinternals tools with VirusTotal support is complete (Process Explorer, Autoruns and Sigcheck), lets address a couple of remarks I received (BTW, if I missed a Sysinternals tools, let me know with a comment). 1) Upload of files. Some people are worried that the Sysinternals tools will upload (confidential) files to VirusTotal. That is a valid concern, but for each tool I described, I showed how to enable hash searching first. Configured like this, the Sysinternals... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19945&rss *** Finding XSS Vulnerabilities More Quickly with Dynamic Contextual Analysis *** --------------------------------------------- Cross-Site Scripting (XSS) has been around since the 1990s and countless scanners have been created to find this vulnerability class. Each scanner has its own set of payloads with some more extensive than others. However, almost all of these payloads... --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/Finding-XSS-Vulnerabili… *** Black Hat 2015: 32 SCADA, mobile zero-day vulns will drop *** --------------------------------------------- Pwn storm brews Gird your loins, admins; researchers are set to drop 32 zero-day vulnerabilities at the Black Hat hacking fest in Las Vegas in August. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/07/21/black_hat_2… *** x86 Exploitation 101: "House of Spirit" - Friendly stack overflow *** --------------------------------------------- The last technique from the "Malloc Maleficarum" is different from all the others because, among the requirements, there's a stack overflow. --------------------------------------------- https://gbmaster.wordpress.com/2015/07/21/x86-exploitation-101-house-of-spi… *** Cybercrime - Tipping the Balance *** --------------------------------------------- It's been said before (on this very blog) but it's worth saying again; if you work back far enough from any cybercrime, eventually you find a person. Someone, somewhere is writing the code and calling the shots. When this statement is presented to a non-technical audience, the question that typically follows is "so who are these people?", and hot on it's heels "why are they doing this?". Simple and reasonable queries, but as most of us know, the answers... --------------------------------------------- https://blog.team-cymru.org/2015/07/cybercrime-tipping-the-balance/ *** Key findings from the ENISA Workshop: Protection of Electronic Communications Infrastructure and Information Sharing *** --------------------------------------------- ENISA’s Workshop on the Protection of Electronic Communications Infrastructure and Information Sharing successfully concluded with the participation of more than forty-five (45) participants from twenty (20) Member States. Representatives included Ministries and National Regulatory Agencies, Electronic communication providers and infrastructure owners. --------------------------------------------- http://www.enisa.europa.eu/media/news-items/key-findings-from-the-enisa-wor… *** Operation Shrouded Horizon: Darkode and its Ties to Bulletproof Hosting Services *** --------------------------------------------- One of the challenges in fighting cybercrime is that it is borderless; cybercriminals can conduct their malicious activities in countries that do not have strict implementation of cybercrime laws. However, no matter how difficult and perilous the task of arresting attackers and taking down cybercriminal operations is, it can be achieved through collaboration between security researchers... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/-S0neNV90as/ *** DFN-CERT-2015-1104: Microsoft Internet Explorer: Mehrere Schwachstellen ermöglichen das Ausführen beliebigen Programmcodes *** --------------------------------------------- ZDI-15-362-1: Schwachstelle im Internet Explorer ermöglicht das Ausführen beliebigen Programmcodes Eine Schwachstelle im Internet Explorer basiert auf der Behandlung von CTreePos-Objekten, die durch eine bestimmte Manipulation von Elementen eines Dokumentes zu der Wiederverwendung eines Zeigers auf bereits freigegebenen Speicher führt ("Use-After-Free"). Ein entfernter, nicht authentifizierter Angreifer kann diese Schwachstelle mit Hilfe einer speziell präparierten Website oder Datei ausnutzen, wenn er einen Benutzer zum Besuch der Webseite oder zum Öffnen der Datei verleiten kann, um beliebigen Programmcode zur Ausführung zu bringen. ZDI-15-361-1: Schwachstelle im Internet Explorer ermöglicht das Ausführen beliebigen Programmcodes Eine Schwachstelle im Internet Explorer basiert auf der Behandlung von CCurrentStyle-Objekten, die durch eine bestimmte Manipulation von Elementen eines Dokumentes zu der Wiederverwendung eines Zeigers auf bereits freigegebenen Speicher führt ("Use-After-Free"). Ein entfernter, nicht authentifizierter Angreifer kann diese Schwachstelle mit Hilfe einer speziell präparierten Website oder Datei ausnutzen, wenn er einen Benutzer zum Besuch der Webseite oder zum Öffnen der Datei verleiten kann, um beliebigen Programmcode zur Ausführung zu bringen. ZDI-15-360-1: Schwachstelle im Internet Explorer ermöglicht das Ausführen beliebigen Programmcodes Eine Schwachstelle im Internet Explorer basiert auf der Behandlung von CAttrArray-Objekten, die durch eine bestimmte Manipulation von Elementen eines Dokumentes zu der Wiederverwendung eines Zeigers auf bereits freigegebenen Speicher führt ("Use-After-Free"). Ein entfernter, nicht authentifizierter Angreifer kann diese Schwachstelle mit Hilfe einer speziell präparierten Website oder Datei ausnutzen, wenn er einen Benutzer zum Besuch der Webseite oder zum Öffnen der Datei verleiten kann, um beliebigen Programmcode zur Ausführung zu bringen. ZDI-15-359-1: Schwachstelle im Internet Explorer ermöglicht das Ausführen beliebigen Programmcodes Eine Schwachstelle im Internet Explorer basiert auf der Verarbeitung von Arrays für die Repräsentation von HTML-Tabellen, die durch eine bestimmte Manipulation von Elementen eines Dokumentes zu einem Speicherüberlauf ("Out-Of-Bounds Memory Access") führt. Ein entfernter, nicht authentifizierter Angreifer kann diese Schwachstelle mit Hilfe einer speziell präparierten Website oder Datei ausnutzen, wenn er einen Benutzer zum Besuch der Webseite oder zum Öffnen der Datei verleiten kann, um beliebigen Programmcode zur Ausführung zu bringen. --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-1104/ *** MS15-078 - Critical: Vulnerability in Microsoft Font Driver Could Allow Remote Code Execution (3079904) - Version: 1.0 *** --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS15-078 *** ZDI-15-358: BitTorrent/uTorrent URI Protocol Command Line Injection Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of BitTorrent and uTorrent. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-358/ *** ZDI-15-363: (0Day) Hewlett-Packard Client Automation Agent Stack Based Buffer Overflow Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett-Packard Client Automation. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-363/ *** ZDI-15-364: (0Day) Hewlett-Packard Client Automation Agent Command Injection Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett-Packard Client Automation. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-364/ *** ZDI-15-365: Apache Groovy Deserialization of Untrusted Data Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apache Groovy. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-365/ *** VU#912036: N-Able RSMWinService contains hard coded security constants allowing decryption of domain administrator password *** --------------------------------------------- Vulnerability Note VU#912036 N-Able RSMWinService contains hard coded security constants allowing decryption of domain administrator password Original Release date: 20 Jul 2015 | Last revised: 20 Jul 2015 Overview SolarWinds N-Able N-Central is an agent-based enterprise support and management solution. N-Able N-Central contains several hard-coded encryption constants in the web interface that allow decryption of the password when combined. Description CWE-547: Use of Hard-coded,... --------------------------------------------- http://www.kb.cert.org/vuls/id/912036 *** Cisco WebEx Meetings Reflected Cross-Site Scripting Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39755 *** Cisco WebEx Training Center Stored Cross-Site Scripting Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39753 *** Cisco WebEx Administration Site Stored Cross-Site Scripting Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39756 *** Cisco Videoscape Policy Resource Manager Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40050 *** [R1] OpenSSL secadv_20150709 Vulnerability Affects Tenable SecurityCenter *** --------------------------------------------- http://www.tenable.com/security/tns-2015-08 *** SSA-267489 (Last Update 2015-07-21): Vulnerabilities in Android App Sm@rtClient *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** SSA-396873 (Last Update: 2015-07-21): TLS Vulnerability in Ruggedcom ROS- and ROX-based Devices *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** Active Super Shop 1.0 Cross Site Scripting *** --------------------------------------------- Topic: Active Super Shop 1.0 Cross Site Scripting Risk: Low Text:# Exploit Title:Active Super Shop Persistent XSS # Date: Fri July 17 2015 # Exploit Author: Angelo Ruwantha # Vendor Homepag... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015070101 *** WordPress Mailcwp 1.99 Shell Upload *** --------------------------------------------- Topic: WordPress Mailcwp 1.99 Shell Upload Risk: High Text:Title: Remote file upload vulnerability in mailcwp v1.99 wordpress plugin Author: Larry W. Cashdollar, @_larry0 Date: 2015-07... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015070100

1 0

Tageszusammenfassung - Montag 20-07-2015
by Daily end-of-shift report 20 Jul '15

20 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 17-07-2015 18:00 − Montag 20-07-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Cyber-securitys dirty little secret: Its not as bad as you think *** --------------------------------------------- And as for botnets - on their way out A new research report from the Global Commission on Internet Governance has reached a surprising conclusion: cyberspace is actually getting safer. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/07/18/cybersecuri… *** Its the Data, Stupid! *** --------------------------------------------- At least with MySQL, PostgreSQL and much of the relational database software the defaults are fairly secure: listen on the local interface only and provide some form of authorization by default. This isnt the case with some of the newer NoSQL products that started entering mainstream fairly recently. For the purpose of this article I will talk about one of the more popular NoSQL products called MongoDB, though much of what is being said also applies to other software (Im looking at you Redis). --------------------------------------------- https://blog.shodan.io/its-the-data-stupid/ *** RedStar OS Watermarking *** --------------------------------------------- During the last few months information about one of North Koreas operating systems was leaked. It is a Linux based OS that tries to simulate the look and feel of a Mac. Some of it's features have already been discussed on various blog posts and news articles. We thought we would take a short look at the OS. This blog post contains some of the results. --------------------------------------------- http://www.insinuator.net/2015/07/redstar-os-watermarking/ *** Autoruns and VirusTotal, (Fri, Jul 17th) *** --------------------------------------------- Continuing my diary entries on Sysinternals tools with VirusTotal support, I'm taking a look at autoruns. Autoruns is another fine Sysinternals tool that comes with VirusTotal integration. If you are not familiar with autoruns, it scans all auto-starting locations in Windows and provides a comprehensive report. This gives you an overview of all programs that start automatically on the scanned Windows machine. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19933 *** Sigcheck and VirusTotal, (Fri, Jul 17th) *** --------------------------------------------- Continuing my diary entries on Sysinternals tools with VirusTotal support, I'm taking a look at sigcheck. Sigcheck is a command-line utility to check the digital signature of files like PE files (EXEs). --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19935 *** Disabled Adobe Flash browser plugin? This might not be enough *** --------------------------------------------- I went to the Adobes Flash test page and opened it in IE (top left). As expected, the plugin couldnt run because (see the Manage Add-ons window in the bottom-left corner) it has been disabled. And yet when I opened the same test URL in HH - Flash was right there. And this is a problem. Yes, by disabling Flash in the main browsers we have significantly reduced the risk but we have not eliminated it. --------------------------------------------- http://blog.kulshitsky.com/2015/07/disabled-adobe-flash-browser-plugin.html *** Parlamentswebsite nur mehr mit aktuellen Browsern nutzbar *** --------------------------------------------- SSL-Verschlüsselungsprotokolle werden auf den neuesten Stand gebracht --------------------------------------------- http://derstandard.at/2000019420275 *** Ashley Madison hacked: Site for people who cant be trusted cant be trusted *** --------------------------------------------- Bin site or well spaff everything, say hax0rz Adulterers hookup website Ashley Madison has been hacked, with the miscreants threatening to release personal details, including users sexual fantasies, unless the site is shut down. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/07/20/ashley_madi… *** BSI warnt vor Sicherheitslücke in Blackberry-Link-App für Mac und PC *** --------------------------------------------- Das Bundesamt für Sicherheit in der Informationstechnik warnt vor einem Fehler in dem Synchronisationstool. Nutzer sollten aktualisieren. --------------------------------------------- http://heise.de/-2753660 *** Zero Days, the documentary *** --------------------------------------------- VPRO (the Dutch public broadcasting organisation) produced a 45-minute documentary about hacking and the trade of zero days. The documentary has now been released in English on Youtube. --------------------------------------------- https://www.f-secure.com/weblog/archives/00002821.html *** BGP Security Alerts Coming to Twitter *** --------------------------------------------- At Black Hat, researchers from OpenDNS are expected to launch a new Twitter feed called BGP Stream that will send out alerts on possible BGP and DNS hijacking attacks. --------------------------------------------- http://threatpost.com/bgp-security-alerts-coming-to-twitter/113843 *** Maligno: An Open Source Pentesting Tool *** --------------------------------------------- Today I want show you a new tool that could help in your penetration testing activity. Maligno is an open source penetration-testing tool under the FreeBSD license, written in Python for maximum compatibility with Metasploit. It uses the Metasploit framework, in particular msfvenom, to generate the shellcode AES encrypted and encoded prior to transmission. Maligno... --------------------------------------------- http://resources.infosecinstitute.com/maligno-open-source-penetration-testi… *** Cyber savvy? Take a Quick Security Awareness Quiz to Find Out *** --------------------------------------------- So you think you are cyber-savvy knowledgeable in the cyber security risks you face every day in the digital world? Take this quick security quiz and find out. Just get record your answers as you take the quiz. There are 10 questions for this security awareness quiz. You can refer to the Answers Section to... --------------------------------------------- http://resources.infosecinstitute.com/cyber-savvy-take-a-quick-security-awa… *** Free Tool Looks for HackingTeam Malware *** --------------------------------------------- Researchers at Rook Security have released a new tool that looks for HackingTeam malware on target systems, and also have published a set of indicators of compromise to help organizations look for signs of an infection from the intrusion software. The HackingTeam Remote Control System is the company's flagship surveillance and intrusion platform. It sold... --------------------------------------------- http://threatpost.com/free-tool-looks-for-hackingteam-malware/113850 *** OpenSSH anfällig für Bruteforce-Angriffe *** --------------------------------------------- Die eingestellte Grenze der maximal möglichen Passwort-Angaben vor einem Verbindungsabbruch lässt sich in einigen Konfigurationen recht einfach austricksen. --------------------------------------------- http://heise.de/-2753501 *** OpenSSH keyboard-interactive authentication brute force vulnerability (MaxAuthTries bypass) *** --------------------------------------------- Topic: OpenSSH keyboard-interactive authentication brute force vulnerability (MaxAuthTries bypass) Risk: Low Text:OpenSSH has a default value of six authentication tries before it will close the connection (the ssh client allows only three p... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015070097 *** VU#813631: Total Commander File Info plugin vulnerable to denial of service via an out-of-bounds read *** --------------------------------------------- Vulnerability Note VU#813631 Total Commander File Info plugin vulnerable to denial of service via an out-of-bounds read Original Release date: 20 Jul 2015 | Last revised: 20 Jul 2015 Overview Total Commanders File Info plugin version 2.21 attempts an out-of-bounds read when reading a file carefully crafted by an attacker. Description CWE-125: Out-of-bounds Read - CVE-2015-2869An attacker that can control the contents of certain file types may be able to cause an out-of-bounds read error in --------------------------------------------- http://www.kb.cert.org/vuls/id/813631 *** DFN-CERT-2015-1093: JBoss Enterprise Portal Platform: Eine Schwachstelle ermöglicht das Umgehen von Sicherheitsmaßnahmen *** --------------------------------------------- Durch eine Schwachstelle in JBoss Portal Plattform ist es einem entfernten, einfach authentifizierten Angreifer möglich, Sicherheitsvorkehrungen zu umgehen. Red Hat stellt für die Komponente PortletBridge von Red Hat JBoss Portal 6.2.0 ein Sicherheitsupdate zur Verfügung. --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-1093/ *** Security Advisory: PCRE library vulnerability CVE-2015-2326 *** --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/900/sol16984.htm… *** HPSBUX03379 SSRT101976 rev.1 - HP-UX Running BIND, Remote Denial of Service (DoS) *** --------------------------------------------- A potential security vulnerability has been identified with HP-UX running BIND. This vulnerability could be exploited remotely to create a Denial of Service (DoS). --------------------------------------------- https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04745746 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Power Systems Firmware affected by Open Source - 2 issues for OpenSSL (CVE-2015-0286, CVE-2015-0287) *** http://www.ibm.com/support/docview.wss?uid=isg3T1022521 *** IBM Security Bulletin: DH key exchange protocol vulnerability ("Logjam") in IBM Java SDK affects IBM SPSS Analytic Server (CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=swg21961993 *** IBM Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects IBM Virtualization Engine TS7700 (CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005295 *** IBM Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects Content Manager Enterprise Edition (CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=swg21962455 *** IBM Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects Websphere Partner Gateway Enterprise/Advanced Editions (CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=swg21962162 *** IBM Security Bulletin: Vulnerabilities in OpenSSL including Logjam affect Rational Publishing Engine (CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=swg21961086 *** IBM Security Bulletin: DH key exchange protocol vulnerability ("Logjam") in IBM Java SDK affects IBM SPSS Statistics (CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=swg21961214 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM SPSS Collaboration and Deployment Services (CVE-2015-0478, CVE-2015-0488, CVE-2015-2808, CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=swg21960528 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDKs affect IBM Virtualization Engine TS7700 - April 2015 *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005294 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect WebSphere Partner Gateway Advanced/Enterprise (CVE-2015-0488, CVE-2015-1916, CVE-2015-2808, CVE-2015-0204) *** http://www.ibm.com/support/docview.wss?uid=swg21957734 *** IBM Security Bulletin: Vulnerability in RC4 stream cipher affects Rational Publishing Engine (CVE-2015-2808) *** http://www.ibm.com/support/docview.wss?uid=swg21961080 *** IBM Security Bulletin: Security Vulnerability in IBM WebSphere Application Server affects IBM WebSphere Partner Gateway Advanced/Enterprise (CVE-2015-1920) *** http://www.ibm.com/support/docview.wss?uid=swg21957802 *** IBM Security Bulletin: Insufficient authorization in Service REST API and cross site scripting vulnerability in REST API affecting IBM Business Process Manager (CVE-2015-1905, CVE-2015-1906) *** http://www.ibm.com/support/docview.wss?uid=swg21700717 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM PureApplication System (CVE-2015-0410 and CVE-2014-6593) *** http://www.ibm.com/support/docview.wss?uid=swg21962372

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily July 2015