Daily October 2016

daily@lists.cert.at

1 participants
20 discussions

Tageszusammenfassung - Freitag 14-10-2016
by Daily end-of-shift report 14 Oct '16

14 Oct '16

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 13-10-2016 18:00 − Freitag 14-10-2016 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Gezinkte Primzahlen ermöglichen Hintertüren in Verschlüsselung *** --------------------------------------------- Ein Forscherteam hat aufgezeigt, dass man durch geschickte Konstruktion einer Primzahl eine Hintertür in Verschlüsselungsverfahren einbauen kann. Nicht auszuschließen, dass dies bei etablierten Verfahren längst passiert ist. --------------------------------------------- https://heise.de/-3347585 *** Security through Confusion – The FUD Factor *** --------------------------------------------- The FUD factor has been employed by sales and marketing teams from multiple industries for decades. It stands for fear, uncertainty and doubt (FUD) and first appeared in the 70’s as a tactic used by competitors in the computer .. --------------------------------------------- https://blog.sucuri.net/2016/10/security-confusion-fud-factor.html *** Cyber Europe 2016: the pan-European exercise to protect EU Infrastructures against coordinated cyber-attack *** --------------------------------------------- https://www.enisa.europa.eu/news/enisa-news/cyber-europe-2016 *** Floating Down .Stream (Shady TLD Research, Part 17) *** --------------------------------------------- The end of September means the leaves are starting to change -- and our quarterly Top Ten list of the shadiest TLDs is changing as well, with three newcomers since last time .. --------------------------------------------- https://www.bluecoat.com/security-blog/2016-10-13/floating-down-stream-shad… *** OSIsoft PI Web API 2015 R2 Service Account Permissions Vulnerability *** --------------------------------------------- This advisory contains mitigation details for a permissions vulnerability in OSIsoft’s PI Web API. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-16-287-01 *** Siemens Automation License Manager Vulnerabilities *** --------------------------------------------- This advisory contains mitigation details for vulnerabilities in Siemen’s Automation License Manager (ALM). --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-16-287-02 *** Rockwell Automation Stratix Denial-of-Service and Memory Leak Vulnerabilities *** --------------------------------------------- This advisory contains mitigation details for vulnerabilities contained in Rockwell Automation’s Allen-Bradley Stratix industrial switches. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-16-287-04 *** Moxa ioLogik E1200 Series Vulnerabilities *** --------------------------------------------- This advisory contains mitigation details for vulnerabilities in Moxas ioLogik E1200 series application. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-16-287-05 *** Fatek Automation Designer Memory Corruption Vulnerabilities *** --------------------------------------------- This advisory contains mitigation details for a heap memory corruption and two stack buffer overflow vulnerabilities in Fatek’s Automation PM and FV Designer applications. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-16-287-06 *** Kabona AB WDC Vulnerabilities *** --------------------------------------------- This advisory contains mitigation details for vulnerabilities in Kabona AB’s WebDatorCentral (WDC) application. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-16-287-07 *** Pork Explosion flaw splatters Foxconns Android phones *** --------------------------------------------- Full compromise over USB bacon-ed in to smartmobes Security researcher John Sawyer says a limited backdoor has been found in some Foxconn-manufactured Android phones, allowing attackers to root phones they have in hand. --------------------------------------------- www.theregister.co.uk/2016/10/14/pork_explosion_foxconn_flaw/ *** LockyDump - All Your Configs Are Belong To Us *** --------------------------------------------- This post will discuss a new Locky configuration extractor that Talos is releasing, which we are naming LockyDump. This is the first open source tool which can dump .. --------------------------------------------- http://blog.talosintel.com/2016/10/lockydump.html *** Quickly audit and adjust SSH server configurations with SSH-audit *** --------------------------------------------- SSH-audit is a standalone open source tool for auditing and fixing SSH server configurations. It has no dependencies and will run wherever Python is available. It supports OpenSSH, Dropbear SSH and libssh, and reports on every detail of the tested SSH server, including detailed information about .. --------------------------------------------- https://www.helpnetsecurity.com/2016/10/14/ssh-audit-fix-ssh-server-configu… *** Magento-Updates: Checkout-Prozess als Einfallstor für Angreifer *** --------------------------------------------- Sicherheits-Patches für das Shop-System schließen mehrere Lücken. Zwei davon gelten als kritisch. --------------------------------------------- https://heise.de/-3350195 *** Apache OpenOffice 4.1.3 *** --------------------------------------------- Apache OpenOffice 4.1.3 ist ein Release zur Fehlerbeseitigung, welches Sicherheitsprobleme beseitigt, Wörterbücher aktualisiert und einige sonstige bekannte Fehler korrigiert. Allen Benutzern von Apache Openoffice 4.1.2 oder älteren Versionen wird empfohlen zu aktualisieren. --------------------------------------------- https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=65873798 *** SSHowDowN: Zwölf Jahre alter OpenSSH-Bug gefährdet unzählige IoT-Geräte *** --------------------------------------------- Akamai warnt davor, dass Kriminelle unvermindert Millionen IoT-Geräte für DDoS-Attacken kapern. Die dafür ausgenutzte Lücke ist älter als ein Jahrzehnt. Viele Geräte sollen sich nicht patchen lassen. --------------------------------------------- https://www.heise.de/newsticker/meldung/SSHowDowN-Zwoelf-Jahre-alter-OpenSS… *** Cyber-attacks Against Nuclear Plants: A Disconcerting Threat *** --------------------------------------------- Introduction A cyber-attack against critical infrastructure could cause the paralysis of critical operations with serious consequences for a country and its population. In a worst case scenario, a cyber-attack could affect processes that in .. --------------------------------------------- http://resources.infosecinstitute.com/cyber-attacks-against-nuclear-plants-… *** Wosign und Startcom: Mozilla macht Ernst mit dem Rauswurf *** --------------------------------------------- Mozilla hat auf der Entwicklermailingliste angekündigt, Zertifikaten von Wosign und Startcom mit der übernächsten Firefox Version 51 nicht mehr zu vertrauen. Die Version ist für den kommenden Januar geplant. --------------------------------------------- http://www.golem.de/news/wosign-und-startcom-mozilla-macht-ernst-mit-dem-ra… *** GlobalSign annulliert versehentlich Zertifikate von vielen Webseiten *** --------------------------------------------- Aktuell warnen einige Webbrowser davor, dass Verbindungen zu Webseiten wie etwa Wikipedia nicht mehr gesichert sind, da mit dem Zertifikat der Seite etwas nicht stimmt. --------------------------------------------- https://heise.de/-3350544 *** IT-Experten des Bundesheeres finden kritische Lücke in Microsoft Office *** --------------------------------------------- Analyse eines Cyberangriffs – Schwachstelle wurde 11. Oktober mit einem Update beseitigt --------------------------------------------- http://derstandard.at/2000045921807

1 0

Tageszusammenfassung - Donnerstag 13-10-2016
by Daily end-of-shift report 13 Oct '16

13 Oct '16

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 12-10-2016 18:00 − Donnerstag 13-10-2016 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Gefälschte Finanzministerium-Phishingmail im Umlauf *** --------------------------------------------- In E-Mailpostfächern findet sich eine vermeintliche Benachrichtigung des Bundesministerium für Finanzen. In dem Schreiben heißt es, dass das BMF Empfänger/innen die Überzahlung von 716,43 Euro zurückerstatte. Dafür sei es notwendig, dass diese ein "Steuer formular" im Anhang der E-Mail ausfüllen. Es handelt sich um einen Phishingversuch von Kriminellen. --------------------------------------------- https://www.watchlist-internet.at/phishing/gefaelschte-finanzministerium-ph… *** Gratulation an unser milCERT *** --------------------------------------------- Gestern war der monatliche Patchday von Microsoft und mitten in den Bugs, die Remote Code Execution erlauben findet sich auch folgendes: Acknowledgments - 2016 MS16-121 Microsoft Office Memory Corruption Vulnerability CVE-2016-7193 Austrian MilCERT | Wir gratulieren unseren Kollegen aus der Stiftskaserne zu dem Fund und erwarten die Details dazu demnächst über dem einen oder anderen Bier. Autor: Otmar Lendl --------------------------------------------- http://www.cert.at/services/blog/20161012185042-1798.html *** Everyone Loves Selfies, Including Malware! *** --------------------------------------------- I was talking with some of my coworkers the other day about why I wanted to jump to the larger iPhone 7 Plus. For me it came down to the camera. I travel a lot for work and even though photography is something of a hobby of mine, I don't always have my "good camera"... --------------------------------------------- https://blogs.mcafee.com/consumer/everyone-loves-selfies-including-malware/ *** A Look at the BIND Vulnerability: CVE-2016-2776 *** --------------------------------------------- On September 27, the Internet Systems Consortium (ICS) announced the release of patches for a critical vulnerability that would allow attackers to launch denial-of-service (DoS) attacks using the Berkeley Internet Name Domain (BIND) exploits. The critical error was discovered during internal testing by the ISC. BIND is a very popular open-source software component that implements DNS protocols. It is also known as the de facto standard for Linux and other Unix-based systems, which means a... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/78QqkPE96mw/ *** WSF attachments are the latest malware delivery vehicle *** --------------------------------------------- Most users have by now learned not to open executable (.EXE), various MS Office, RTF and PDF files delivered via unsolicited emails, but malware peddlers are always trying out new ways to trick users, email filters and AV software. Number of blocked emails containing malicious WSF attachments by month According to Symantec, Windows Script Files (WSFs) are the latest file types to be exploited to deliver malware via email. --------------------------------------------- https://www.helpnetsecurity.com/2016/10/13/wsf-attachments-malware-delivery/ *** CryPy: ransomware behind Israeli lines *** --------------------------------------------- A Tweet posted recently by AVG researcher, Jakub Kroustek, suggested that a new ransomware, written entirely in Python, had been found in the wild, joining the emerging trend for Pysomwares such as the latest HolyCrypt, Fs0ciety Locker and others. --------------------------------------------- http://securelist.com/blog/research/76318/crypy-ransomware-behind-israeli-l… *** IoT Devices as Proxies for Cybercrime *** --------------------------------------------- Multiple stories published here over the past few weeks have examined the disruptive power of hacked "Internet of Things" (IoT) devices such as routers, IP cameras and digital video recorders. This post looks at how crooks are using hacked IoT devices as proxies to hide their true location online as they engage in a variety of other types of cybercriminal activity -- from frequenting underground forums to credit card and tax refund fraud. --------------------------------------------- https://krebsonsecurity.com/2016/10/iot-devices-as-proxies-for-cybercrime/ *** 6000 Online-Shops angeblich mit Kreditkarten-Skimmern verseucht - Tendenz steigend *** --------------------------------------------- Online-Kriminelle greifen derzeit vermehrt Kreditkarten-Daten auf Webseiten von Online-Shops ab, berichtet ein Sicherheitsforscher. --------------------------------------------- https://heise.de/-3349185 *** What is MANRS and does your network have it? *** --------------------------------------------- While the internet itself was first envisioned as a way of enabling robust, fault-tolerant communication, the global routing infrastructure that underlies it is relatively fragile. A simple error like the misconfiguration of routing information in one of the 7,000 to 10,000 networks central to global routing can lead to a widespread outage, and deliberate actions, like preventing traffic with spoofed source IP addresses, can lead to distributed denial of service (DDoS) attacks. --------------------------------------------- http://www.cio.com/article/3130707/internet/what-is-manrs-and-does-your-net… *** Cisco Security Advisories *** --------------------------------------------- *** Cisco cBR-8 Converged Broadband Router vty Integrity Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco Wide Area Application Services Central Manager Denial of Service Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco Unified Communications Manager iFrame Data Clickjacking Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco Prime Infrastructure and Evolved Programmable Network Manager Database Interface SQL Injection Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco Meeting Server Client Authentication Bypass Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco Finesse Cross-Site Request Forgery Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Juniper Security Bulletins *** --------------------------------------------- *** JSA10763 - 2016-10 Security Bulletin: Junos: Multiple privilege escalation vulnerabilities in Junos CLI (CVE-2016-4922) *** http://kb.juniper.net/index?page=content&id=JSA10763&actp=RSS --------------------------------------------- *** JSA10766 - 2016-10 Security Bulletin: vMX: Information leak vulnerability (CVE-2016-4924) *** http://kb.juniper.net/index?page=content&id=JSA10766&actp=RSS --------------------------------------------- *** JSA10767 - 2016-10 Security Bulletin: JUNOSe: Line Card Reset: processor exception 0x68616c74 (halt) task: scheduler, upon receipt of crafted IPv6 packet (CVE-2016-4925) *** http://kb.juniper.net/index?page=content&id=JSA10767&actp=RSS --------------------------------------------- *** JSA10764 - 2016-10 Security Bulletin: Junos J-Web: Cross Site Scripting Vulnerability (CVE-2016-4923) *** http://kb.juniper.net/index?page=content&id=JSA10764&actp=RSS --------------------------------------------- *** JSA10762 - 2016-10 Security Bulletin: Junos: IPv6 denial of service vulnerability due to resource exhaustion (CVE-2016-4921) *** http://kb.juniper.net/index?page=content&id=JSA10762&actp=RSS --------------------------------------------- *** JSA10761 - 2016-10 Security Bulletin: CTPView: Multiple vulnerabilities in CTPView *** http://kb.juniper.net/index?page=content&id=JSA10761&actp=RSS --------------------------------------------- *** JSA10760 - 2016-10 Security Bulletin: Junos Space: Multiple vulnerabilities *** http://kb.juniper.net/index?page=content&id=JSA10760&actp=RSS --------------------------------------------- *** JSA10759 - 2016-10 Security Bulletin: OpenSSL security updates *** http://kb.juniper.net/index?page=content&id=JSA10759&actp=RSS --------------------------------------------- *** Security Advisory: PCRE vulnerability CVE-2016-3191 *** --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/k/51/sol51440224.html?… *** Brocade NetIron MLX Line Card IPSec Processing Bug Lets Remote Users Cause the Target Line Card to Reset *** --------------------------------------------- http://www.securitytracker.com/id/1037010 *** Fortinet FortiManager Input Validation Flaw in Advanced Settings Page Lets Remote Authenticated Administrative Users Conduct Cross-Site Scripting Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1036982 *** Fortinet FortiAnalyzer Input Validation Flaw in Advanced Settings Page Lets Remote Authenticated Administrative Users Conduct Cross-Site Scripting Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1036981 *** Palo Alto PAN-OS Range Header Null Pointer Dereference Lets Remote Users Cause the Target Service to Crash *** --------------------------------------------- http://www.securitytracker.com/id/1037007 *** DFN-CERT-2016-1689: Ghostscript: Mehrere Schwachstellen ermöglichen u.a. das Ausführen beliebigen Programmcodes *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2016-1689/ *** Vuln: SAP NetWeaver ABAP ST-PI Component SQL Injection Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/93506 *** Vuln: SAP BusinessObjects Unspecified Cross Site Request Forgery Vulnerability *** -------------------------------------------- http://www.securityfocus.com/bid/93508 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM BigFix Remote Control (CVE-2016-2183, CVE-2016-6304, CVE-2016-2177, CVE-2016-2178, CVE-2016-6306) *** http://www-01.ibm.com/support/docview.wss?uid=swg21991896 --------------------------------------------- *** IBM Security Bulletin: IBM InfoSphere Information Server is vulnerable to information disclosure (CVE-2016-5994) *** http://www-01.ibm.com/support/docview.wss?uid=swg21992171 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in OpenSSL affects IBM BigFix Remote Control (CVE-2016-2183) *** http://www-01.ibm.com/support/docview.wss?uid=swg21991894 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in Apache Tomcat affects IBM Websphere that is used by IBM BigFix Remote Control. (CVE-2016-3092) *** http://www-01.ibm.com/support/docview.wss?uid=swg21991866 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in IBM Websphere Application Server affects IBM BigFix Remote Control (CVE-2016-5983) *** http://www-01.ibm.com/support/docview.wss?uid=swg21991902 --------------------------------------------- *** IBM Security Bulletin: IBM Kenexa LCMS Premier on Cloud has addressed (CVE-2016-5949) *** http://www.ibm.com/support/docview.wss?uid=swg21992276 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in Apache Commons FileUpload affects IBM Campaign, IBM Interact, IBM Distributed Marketing, IBM Marketing Operations (CVE-2016-3092) *** http://www.ibm.com/support/docview.wss?uid=swg21991786 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in Open Source Apache Tomcat , Commons FileUpload Vulnerabilities IBM Algorithmics Algo Risk Application *** http://www.ibm.com/support/docview.wss?uid=swg21990262 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect IBM Integrated Management Module (IMM) for System x & BladeCenter (CVE-2016-2177, CVE-2016-2178) *** https://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=migr-5099492 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in Apache Struts affect IBM BigFix Remote Control (CVE-2016-1181, CVE-2016-1182) *** http://www-01.ibm.com/support/docview.wss?uid=swg21991903 ---------------------------------------------

1 0

Tageszusammenfassung - Mittwoch 12-10-2016
by Daily end-of-shift report 12 Oct '16

12 Oct '16

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 11-10-2016 18:00 − Mittwoch 12-10-2016 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** VU#396440: MatrixSSL contains multiple vulnerabilities *** --------------------------------------------- Heap-based Buffer Overflow - CVE-2016-6890The Subject Alt Name field of X.509 certificates is not properly parsed. A specially crafted certificate may result in a heap-based buffer overflow .. --------------------------------------------- http://www.kb.cert.org/vuls/id/396440 *** October 2016 security update release *** --------------------------------------------- Today we released security updates to provide additional protections against malicious attackers. As a best practice, we encourage customers to apply security updates as soon as they are released. More information about this month’s security .. --------------------------------------------- https://blogs.technet.microsoft.com/msrc/2016/10/11/october-2016-security-u… *** Security Advisory: Expat XML library vulnerability CVE-2015-1283 *** --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/k/15/sol15104541.html *** Top of the Junk Pile (Shady TLD research part 16) *** --------------------------------------------- [Sorry about neglecting the external blog during all of the Symantec excitement this summer, but we had a lot going on... This post is from our internal blog, back in July (7/08/2016), and we wanted to get it out on the site when we resumed blogging, since a lot of people have been .. --------------------------------------------- https://www.bluecoat.com/2016-10-04/top-junk-pile-shady-tld-research-part-16 *** MSRT October 2016 release: Adding more unwanted software detections *** --------------------------------------------- Unwanted software often piggy-backs on program downloads, delivered by software bundlers. These bundles, which you might have downloaded, can include software .. --------------------------------------------- https://blogs.technet.microsoft.com/mmpc/2016/10/11/msrt-october-2016-relea… *** Four vulnerabilities found in Dell SonicWALL Email Security virtual appliance application *** --------------------------------------------- Digital Defense (DDI) disclosed the discovery of four security vulnerabilities found in the Dell SonicWALL Email Security virtual appliance application. The appliance is frequently deployed as a perimeter device. Further, .. --------------------------------------------- https://www.helpnetsecurity.com/2016/10/12/sonicwall-email-security-vulnera… *** Scan Ruby-based apps for security issues with Dawnscanner *** --------------------------------------------- Dawnscanner is an open source static analysis scanner designed to review the security of web applications written in Ruby. Dawnscanner’s genesis Its developer, Paolo Perego, says that he was motivated to create it back in spring .. --------------------------------------------- https://www.helpnetsecurity.com/2016/10/12/scan-ruby-based-apps-dawnscanner/ *** WiFi Still Remains a Good Attack Vector *** --------------------------------------------- WiFi networks areeverywhere! When we plan to visit a place or reserve ahotel for our holidays, we always check first if free WiFi is available (be honest, you do!). Oncewe connected our beloved devices to an external wireless .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=21583 *** Security Advisory - Multiple Security Vulnerabilities in Driver of Huawei Smart Phones *** --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2016/huawei-sa-20161012-… *** List of 2016 OWASP London Talks & Videos *** --------------------------------------------- https://www.youtube.com/owasplondon *** VMware vRealize Operations Lets Remote Authenticated Users Gain Elevated Privileges *** --------------------------------------------- http://www.securitytracker.com/id/1036999 *** Several Exploit Kits Now Deliver Cerber 4.0 *** --------------------------------------------- We have tracked three malvertising campaigns and one compromised site campaign using Cerber ransomware after version 4.0 (detected as as Ransom_CERBER.DLGE) was .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/several-exploit-…

1 0

Tageszusammenfassung - Dienstag 11-10-2016
by Daily end-of-shift report 11 Oct '16

11 Oct '16

======================= = End-of-Shift report = ======================= Timeframe: Montag 10-10-2016 18:00 − Dienstag 11-10-2016 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Denial of Service Vulnerability in Citrix License Server *** --------------------------------------------- A vulnerability has been identified in the Citrix License Server for Windows and Citrix License Server VPX that could allow a remote ... --------------------------------------------- http://support.citrix.com/article/CTX217430 *** [2016-10-11] XXE vulnerability in RSA ECAT Client *** --------------------------------------------- By exploiting the XXE vulnerability, an attacker can get read access to the filesystem of the users system using RSA ECAT client and thus obtain sensitive information from the system. It is also possible to scan ports of the internal hosts and cause DoS on the affected host. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2016… *** Erpressungs-Trojaner DXXD nimmt Windows-Server ins Visier *** --------------------------------------------- Die Hintermänner der Ransomware haben ihren Schädling optimiert und das kostenlose Entschlüsselungs-Tool unbrauchbar gemacht. Zudem verspotten Sie Sicherheitsforscher öffentlich. --------------------------------------------- https://heise.de/-3344979 *** Bugtraq: [SEARCH-LAB advisory] AVTECH IP Camera, NVR, DVR multiple vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/archive/1/539567 *** Nymaim: Deep Technical Dive - Adventures in Evasive Malware *** --------------------------------------------- Nymaim is mostly known worldwide as a downloader, although it seems they evolved from former versions, now having new functionalities to obtain data on the machine with no need to download a new payload. Some of the exported .. --------------------------------------------- http://www.seculert.com/blogs/nymaim-deep-technical-dive-adventures-in-evas… *** Zertifizierungsstellen: Bei WoSign und StartCom rollen Köpfe *** --------------------------------------------- Die beiden Kostenlos-CAs bekommen jeweils eine neue Firmenspitze und sollen komplett voneinander getrennt werden. Damit soll das verlorene Vertrauen zurückgewonnen werden. --------------------------------------------- https://heise.de/-3344229 *** APT 28: Wie ein französischer Fernsehsender gehackt wurde *** --------------------------------------------- Im Jahr 2015 ist der französische Fernsehsender TV5 nach einem Angriff auf die IT-Infrastruktur für Stunden lahmgelegt worden. Eine Untersuchung der französischen Polizei zeigt nun, wie planvoll die Angreifer vorgegangen sind. --------------------------------------------- http://www.golem.de/news/apt-28-wie-ein-franzoesischer-fernsehsender-gehack… *** Security Bulletins Posted *** --------------------------------------------- Adobe has published security bulletins for Adobe Flash Player (APSB16-32), Adobe Acrobat and Reader (APSB16-33), and Adobe Creative Cloud Desktop Application (APSB16-34). Adobe recommends users update their product installations .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1409 *** DDOS: Was Cloudflare vom Mirai-Botnetz sieht *** --------------------------------------------- Cloudflare hat sich die aktuellen DDoS-Angriffe genauer angeschaut - und berichtet, dass einige Angriffe 1,75 Millionen HTTP-Anfragen pro Sekunde erzeugen. --------------------------------------------- http://www.golem.de/news/ddos-was-cloudflare-vom-mirai-botnetz-sieht-1610-1…

1 0

Tageszusammenfassung - Montag 10-10-2016
by Daily end-of-shift report 10 Oct '16

10 Oct '16

======================= = End-of-Shift report = ======================= Timeframe: Freitag 07-10-2016 18:00 − Montag 10-10-2016 18:00 Handler: Stephan Richter Co-Handler: n/a *** Europe to Push New Security Rules Amid IoT Mess *** --------------------------------------------- The European Commission is drafting new cybersecurity requirements to beef up security around so-called Internet of Things (IoT) devices such as Web-connected security cameras, routers and digital video recorders (DVRs). News of the expected proposal comes as security firms are warning that a great many IoT devices are equipped with little or no security protections. --------------------------------------------- https://krebsonsecurity.com/2016/10/europe-to-push-new-security-rules-amid-… *** Mehr Sicherheit für das Internet der Dinge *** --------------------------------------------- Die vernetzten Geräte des Internet of Things (IoT) sammeln und verarbeiten immer mehr Daten, versagen jedoch häufig beim Schutz dieser Daten. Ein ausführlicher Leitfaden will bei der Entwicklung sicherer Geräte helfen. --------------------------------------------- https://heise.de/-3343482 *** Security Economics of the Internet of Things *** --------------------------------------------- Brian Krebs is a popular reporter on the cybersecurity beat. He regularly exposes cybercriminals and their tactics, and consequently is regularly a target of their ire. Last month, he wrote about an online attack-for-hire service that resulted in the arrest of the two proprietors. In the aftermath, his site was taken down by a massive DDoS attack.In many ways, this is nothing new. Distributed denial-of-service attacks are a family of attacks that cause websites and other Internet-connected... --------------------------------------------- https://www.schneier.com/blog/archives/2016/10/security_econom_1.html *** Mirai: DDoS per IoT *** --------------------------------------------- In den letzten Wochen wurde mal wieder ein neuer Rekord für den bisher stärksten gemessenen Distributed Denial of Service (DDoS) Angriff aufgestellt. Das ist soweit nicht überraschend, die verfügbare Bandbreite im Internet wächst immer noch stark, da ist klar, dass damit auch die Angriffsstärke zunehmen kann. Überraschend war aber, dass der Rekord nicht über einen "reflected DDoS" erreicht wurde. Diese Methode... --------------------------------------------- http://www.cert.at/services/blog/20161010095630-1789.html *** Strange Loop - IP Spoofing *** --------------------------------------------- I recently gave a talk at the Strange Loop conference in St Louis. The recording and slides are available, but for easier consumption heres a transcript. --------------------------------------------- https://idea.popcount.org/2016-09-20-strange-loop---ip-spoofing/ *** VMware stopft Informationsleck in Horizon View *** --------------------------------------------- Wichtige Sicherheits-Updates sollen VMware Horizon View unter Windows sicherer machen. --------------------------------------------- https://heise.de/-3343678 *** Radare2: rahash2, (Mon, Oct 10th) *** --------------------------------------------- Radare2 is an open-source reverse-engineering framework. Some time ago I wrote about recovering ransomed pictures. By calculating the entropy of the ransomed files with my byte-stats tool, I could see that the file was not completely encrypted. rahash2 is one of the tools in the Radare2 framework. As it names implies, it calculates (cryptographic) hashes, but it is quite versatile. For example, it will also calculate entropy: And like my byte-stats.py tool, it can also split the file in blocks... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=21577&rss *** Remove ransomware infections from your PC using these free tools *** --------------------------------------------- A how-to on finding out what ransomware is squatting in your PC -- and how to get rid of it. --------------------------------------------- http://www.zdnet.com/article/remove-ransomware-infections-from-your-pc-usin… *** Open-Source-Router: 1000 Turris Omnia ausgeliefert *** --------------------------------------------- Nachdem es ursprünglich im Sommer losgehen sollte, lieferte der Hersteller cz.nic doch erst Ende September die ersten Turris-Omnia-Router aus. Vor ein paar Tagen wurde bereits das tausendste Exemplar verschickt. --------------------------------------------- https://heise.de/-3344417 *** VU#338624: U by BB and T iOS banking application fails to properly validate SSL certificates *** --------------------------------------------- Vulnerability Note VU#338624 U by BB&T iOS banking application fails to properly validate SSL certificates Original Release date: 30 Sep 2016 | Last revised: 06 Oct 2016 Overview U by BB&T for iOS, version 1.5.4 and earlier, fails to properly validate SSL certificates provided by HTTPS connections, which may enable an attacker to conduct man-in-the-middle (MITM) attacks. Description CWE-295: Improper Certificate Validation - CVE-2016-6550U by BB&T is a banking application. On iOS... --------------------------------------------- http://www.kb.cert.org/vuls/id/338624 *** Vuln: GraphicsMagick CVE-2016-7997 NULL Pointer Denial of Service Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/93467 *** DSA-3689 php5 - security update *** --------------------------------------------- Several vulnerabilities were found in PHP, a general-purpose scriptinglanguage commonly used for web application development. --------------------------------------------- https://www.debian.org/security/2016/dsa-3689 *** Toshiba FlashAir does not require authentication in "Internet pass-thru Mode" *** --------------------------------------------- FlashAir provided by Toshiba Corporation does not require authentication on accepting a connection from STA side LAN when "Internet pass-thru Mode" is enabled. --------------------------------------------- http://jvn.jp/en/jp/JVN39619137/ *** IBM Security Bulletin: Financial Transaction Manager for Corporate Payment Services: Clickjacking (CVE-2016-3060) *** --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg21992051 *** IBM Security Bulletin: HTTP Response Splitting in Liberty affects IBM MessageSight (CVE-2016-0359) *** --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg21991096 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Flex System Manager (FSM) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=isg3T1024350 *** IBM Security Bulletin: A security vulnerability in IBM Java Runtime affects IBM Systems Director Storage Control ( CVE-2015-4872) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=isg3T1024349

1 0

Tageszusammenfassung - Freitag 7-10-2016
by Daily end-of-shift report 07 Oct '16

07 Oct '16

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 06-10-2016 18:00 − Freitag 07-10-2016 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Gefälschtes Bank Austria-Sicherheitszertifikat ist Schadsoftware *** --------------------------------------------- In einer gefälschten Bank Austria-Nachricht mit dem Betreff "Sicherheitszertifikat" behaupten Kriminelle, dass Empfänger/innen ein Programm für ihr Smartphone installieren müssen. Das ist angeblich notwendig, damit sie ihr OnlineBanking-Konto nützen können. In Wahrheit handelt es sich bei dem Programm um Schadsoftware. --------------------------------------------- https://www.watchlist-internet.at/schadsoftware/gefaelschtes-bank-austria-s… *** Upcoming Security Updates for Adobe Acrobat and Reader (APSB16-33) *** --------------------------------------------- A prenotification Security Advisory (APSB16-33) has been posted regarding upcoming releases for Adobe Acrobat and Reader scheduled for Tuesday, October 11, 2016. We will continue to provide updates on the upcoming releases via the Security Advisory as well as the Adobe... --------------------------------------------- https://blogs.adobe.com/psirt/?p=1405 *** 100+ online shops compromised with payment data-stealing code *** --------------------------------------------- Since March 2016 (and possibly even earlier), someone has been compromising a variety of online shops and injecting them with malicious JavaScript code that exfiltrates payment card and other kinds of information users entered to pay for their shopping. According to RiskIQ and ClearSky researchers, the campaign - which they dubbed Magecart - is still ongoing, albeit at a reduced scope and pace. Since March, the threat actor behind it has compromised more than 100... --------------------------------------------- https://www.helpnetsecurity.com/2016/10/07/payment-data-stealing-code/ *** Hintergrund: Analysiert: Werbekeule statt Glitzersteine - Android-Malware CallJam seziert *** --------------------------------------------- Trotz verschiedener Sicherheits-Checks schleicht sich immer wieder Malware in Googles App Store. Eine davon gibt sich als vermeintliches Helferlein für das unfassbar erfolgreiche Spiel "Clash Royale" aus. --------------------------------------------- https://heise.de/-3340267 *** Lovoo: Sicherheitslücke ermüglicht Erstellung von Bewegungsprofilen *** --------------------------------------------- Über die Web-API des Dating-Dienstes ließen sich bis vor kurzem Informationen über Nutzer abrufen - auch ohne Login. Per Skript-Automatisierung können damit Bewegungsprofile erstellt werden. --------------------------------------------- http://www.golem.de/news/lovoo-sicherheitsluecke-ermoeglicht-erstellung-von… *** Positive Technologies: Security Trends & Vulnerabilities Review Industrial Control Systems (PDF) *** --------------------------------------------- This study examines components of ICS from different vendors. In the period from 2012 to 2015, a total of 743 vulnerabilities were discovered in ICS components; most of them were detected in products from well-known companies: Siemens, Schneider Electric, and Advantech. Most vulnerabilities are of either high or medium risk (47% high, 47% medium). ... Summary: The study shows that the number of vulnerable ICS components is not reducing from year to year. Nearly half of identified... --------------------------------------------- https://www.ptsecurity.com/upload/iblock/6bd/ics_vulnerability_2016_eng.pdf *** An attachment that wasn't there *** --------------------------------------------- By Slavo Greminger and Oli Schacher | On a daily basis we collect tons of Spam emails, which we analyze for malicious content. Of course, this is not done manually by our thousands of minions, but automated using some Python-fu. Python... --------------------------------------------- https://securityblog.switch.ch/2016/10/07/an-attachment-that-wasnt-there/ *** Sicherheits-Updates: Angreifer können Cisco-Switches kapern *** --------------------------------------------- Der Netzwerkausrüster kümmert sich um zwei als kritisch eingestufte Sicherheitslücken in Switches der Nexus-Serie und verteilt Sicherheits-Patches für 15 weitere Schwachstellen in verschiedenen Produkten. --------------------------------------------- https://heise.de/-3342846 *** OS X El Capitan: Warten auf das große Sicherheitsupdate *** --------------------------------------------- Mit Apples neuem Betriebssystem macOS Sierra werden zahlreiche Lücken gestopft, die in der Vorversion stecken. Doch ein eigenes Update für OS X El Capitan hat der Hersteller noch nicht publiziert. --------------------------------------------- https://heise.de/-3342343 *** Malware könnte Video und Audio vom Mac aufzeichnen *** --------------------------------------------- Der Sicherheitsforscher Patrick Wardle hat einen Demo-Exploit entwickelt, der Kamera- und Mikrofondaten mitschneiden kann, während Chats laufen. --------------------------------------------- https://heise.de/-3342336 *** VMSA-2016-0015 VMware Horizon View updates address directory traversal vulnerability (CVE-2016-7087) *** --------------------------------------------- Severity: Important VMware Horizon View contains a vulnerability that may allow for a directory traversal on the Horizon View Connection Server. Exploitation of this issue may lead to a partial information disclosure. --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2016-0015.html *** IDM 4.5 One SSO Provider (OSP) 6.0.0.5 *** --------------------------------------------- Abstract: This hotfix provides enhancements and software fixes for the One SSO Provider for Identity Manager. For more information about these updates, see the hotfix details.Document ID: 5256490Security Alert: YesDistribution Type: PublicEntitlement Required: NoFiles:IDM45-OSP60-HF-5.zip (23.28 MB)Products:Identity Manager 4.5Access Review 1.1Access Review 1.5Superceded Patches:IDM 4.5 One SSO Provider (OSP) --------------------------------------------- https://download.novell.com/Download?buildid=Z0jKqCEDM7k~ *** Atlassian HipChat Secret Key Disclosure *** --------------------------------------------- Topic: Atlassian HipChat Secret Key Disclosure Risk: Medium Text:This email refers to the following advisory pages: * Bitbucket Server - https://confluence.atlassian.com/x/0QkcMg * Conflue... --------------------------------------------- https://cxsecurity.com/issue/WLB-2016100066 *** DFN-CERT-2016-1653: KDE: Mehrere Schwachstellen in KMail ermöglichen u.a. das Ausführen beliebigen Programmcodes *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2016-1653/ *** GE Bently Nevada 3500/22M Improper Authorization Vulnerability *** --------------------------------------------- This advisory was originally posted to the US-CERT secure Portal library on September 8, 2016, and is being released to the NCCIC/ICS-CERT web site. This advisory contains mitigation details for an improper authorization vulnerability in the GE Bently Nevada 3500/22M monitoring system. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-16-252-01 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: IBM WebSphere Dashboard Framework is affected by a security vulnerability in Apache POI (CVE-2016-5000) *** http://www.ibm.com/support/docview.wss?uid=swg21991850 --------------------------------------------- *** IBM Security Bulletin: IBM Web Experience Factory is affected by a security vulnerability in Apache POI (CVE-2016-5000) *** http://www-01.ibm.com/support/docview.wss?uid=swg21991851 --------------------------------------------- *** IBM Security Bulletin: IBM WebSphere Dashboard Framework is affected by multiple security vulnerabilities in Apache POI *** http://www-01.ibm.com/support/docview.wss?uid=swg21991839 --------------------------------------------- *** IBM Security Bulletin: IBM Web Experience Factory is affected by multiple security vulnerabilities in Apache POI *** http://www-01.ibm.com/support/docview.wss?uid=swg21991845------------------… --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Rational Performance Tester (CVE-2016-3485) *** http://www.ibm.com/support/docview.wss?uid=swg21991877 --------------------------------------------- *** IBM Security Bulletin: : Multiple vulnerabilities in IBM Java SDK affect Rational Service Tester (CVE-2016-3485) *** http://www.ibm.com/support/docview.wss?uid=swg21991879 --------------------------------------------- *** IBM Security Bulletin: IBM Streams is affected by Open Source Apache Xerces-C XML parser Vulnerabilities (CVE-2016-4463) *** http://www-01.ibm.com/support/docview.wss?uid=swg21991111 --------------------------------------------- *** IBM Security Bulletin: IBM Streams is affected by Libxml2 vulnerabilities (CVE-2016-4447, CVE-2016-4448, CVE-2016-4449) *** http://www-01.ibm.com/support/docview.wss?uid=swg21991061 --------------------------------------------- *** IBM Security Bulletin: IBM Streams may be impacted by a vulnerability in WebSphere Liberty (CVE-2016-2923) *** http://www-01.ibm.com/support/docview.wss?uid=swg21991058 --------------------------------------------- *** IBM Security Bulletin: IBM Streams is affected by Open Source Apache Xerces-C XML parser Vulnerabilities (CVE-2016-0729) *** http://www-01.ibm.com/support/docview.wss?uid=swg21991112 ---------------------------------------------

1 0

Tageszusammenfassung - Donnerstag 6-10-2016
by Daily end-of-shift report 06 Oct '16

06 Oct '16

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 05-10-2016 18:00 − Donnerstag 06-10-2016 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Symantec Web Gateway Management Console Interface Command Injection *** --------------------------------------------- Symantec has released an update to address a Symantec Web Gateway (SWG) Management Console Interface command injection issue bypassing validation restrictions to add an unauthorized whitelist entry. Highest severity issue: Medium --------------------------------------------- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=se… *** NIST: People have given up on cybersecurity - its too much hassle *** --------------------------------------------- To help change peoples mental models so that they will participate in cybersecurity, Theofanos said technology professionals have to do more work for the people using their products, so that people dont need to make too many decisions. "We need to make it easy for them to do the right thing," she said. "We need to make these things habits, so they dont really have to think about it." --------------------------------------------- http://www.theregister.co.uk/2016/10/06/go_ahead_steal_my_muffin_recipe/ *** Spotify: Gratis-Version lieferte Schadsoftware für Windows und Mac aus *** --------------------------------------------- Offensichtlich über Werbung von Dritten eingeschleust - Spotify bestätigt und entschuldigt sich bei Nutzern --------------------------------------------- http://derstandard.at/2000045458665 *** Malicious actions not necessarily focused on causing disruptions in TELECOM, but system failures still are *** --------------------------------------------- ENISA publishes its Annual Incidents report which gives the aggregated analysis of the security incidents causing severe outages in 2015. --------------------------------------------- https://www.enisa.europa.eu/news/malicious-actions-not-necessarily-focused-… *** Vorsicht vor Verteilung von Malware via Steam-Chat *** --------------------------------------------- Aktuell häufen sich Hinweise, dass Kriminelle verstärkt über gekaperte Steam-Accounts Links zu Webseiten mit Trojanern verschicken. --------------------------------------------- https://heise.de/-3342136 *** Denial of Service Vulnerability in Citrix License Server *** --------------------------------------------- A vulnerability has been identified in the Citrix License Server for Windows and Citrix License Server VPX that could allow a remote, unauthenticated attacker to crash the License Server. This vulnerability affects all versions of Citrix License Server for Windows and Citrix License Server VPX earlier than version 11.14.0.1. This vulnerability has been assigned the following CVE number: CVE-2016-6273 --------------------------------------------- http://support.citrix.com/article/CTX217430 *** Vulnerability in Citrix Linux VDA (formerly known as Linux Virtual Desktop) Could Result in Privilege Escalation *** --------------------------------------------- A vulnerability has been identified in the Linux Virtual Delivery Agent (VDA) component of Citrix XenDesktop that could allow a local user to execute commands as root on the Linux VDA. The vulnerability affects all versions of the Citrix Linux VDA earlier than version 1.4.0. This vulnerability has been assigned the following CVE number: CVE-2016-6276 --------------------------------------------- http://support.citrix.com/article/CTX216628 *** Sicherheits-Patches: Foxit beugt Angriffen auf Reader und PhantomPDF vor *** --------------------------------------------- Die Entwickler schließen mehrere kritische Lücken in den Linux-, OS-X- und Windows-Versionen. --------------------------------------------- https://heise.de/-3341878 *** Wave your false flags! *** --------------------------------------------- Targeted attackers are using an increasingly wide range of deception techniques to muddy the waters of attribution, planting "False Flag" timestamps, language strings, malware, among other things, and operating under the cover of non-existent groups. --------------------------------------------- http://securelist.com/analysis/publications/76273/wave-your-false-flags/ *** Announcing CERT Basic Fuzzing Framework Version 2.8 *** --------------------------------------------- Today we are announcing the release of the CERT Basic Fuzzing Framework Version 2.8 (BFF 2.8). Its been about three years since we released BFF 2.7. In this post, I highlight some of the changes weve made. --------------------------------------------- https://insights.sei.cmu.edu/cert/2016/10/announcing-cert-basic-fuzzing-fra… *** Palo Alto PAN-OS GlobalProtect Portal Web Interface Lets Remote Users Obtain Potentially Sensitive Information on the Target System *** --------------------------------------------- http://www.securitytracker.com/id/1036968 *** Erpressungs-Trojaner Cerber lernt dazu und verschlüsselt noch mehr *** --------------------------------------------- Sicherheitsforscher warnen vor einer neuen Version der Ransomware, die nun unter anderem auch bestimmte laufende Prozesse beenden kann, um so Datenbanken in ihre Fänge zu bekommen. --------------------------------------------- https://heise.de/-3341992 *** Cisco Security Advisories *** --------------------------------------------- *** Cisco ASA Software DHCP Relay Denial of Service Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco Unified Intelligence Center (CUIC) Software Cross-Site Request Forgery Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco Unified Intelligence Center (CUIC) Software Unauthenticated User Account Creation Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco Unified Intelligence Center (CUIC) Software Cross-Site Scripting Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco Nexus 7000 and 7700 Series Switches Overlay Transport Virtualization Buffer Overflow Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco NX-OS Software-Based Products Authentication, Authorization, and Accounting Bypass Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco Nexus 9000 Information Disclosure Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco IOS XR Software Command-Line Interface Privilege Escalation Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco IOS and IOS XE IKEv2 Denial of Service Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco Firepower Management Center Console Local File Inclusion Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco Firepower Management Center Console Authentication Bypass Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco Firepower Threat Management Console Remote Command Execution Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco NX-OS Software Malformed DHCPv4 Packet Denial of Service Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco NX-OS Software Crafted DHCPv4 Packet Denial of Service Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco Host Scan Package Cross-Site Scripting Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco IOS Software for Cisco Catalyst 6500 Series Switches and 7600 Series Routers ACL Bypass Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco NX-OS Border Gateway Protocol Denial of Service Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: A vulnerability in crypto++ affects PowerKVM (CVE-2016-3995) *** http://www.ibm.com/support/docview.wss?uid=isg3T1024263 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in Python affect PowerKVM *** http://www.ibm.com/support/docview.wss?uid=isg3T1024236 --------------------------------------------- *** IBM Security Bulletin: A vulnerability in PHP affects PowerKVM (CVE-2016-5385) *** http://www.ibm.com/support/docview.wss?uid=isg3T1024261 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in the Linux kernel affect PowerKVM *** http://www.ibm.com/support/docview.wss?uid=isg3T1024270 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affects WebSphere Application Server July 2016 CPU (CVE-2016-3485) that is bundled with IBM WebSphere Application Server Patterns and IBM WebSphere Application Server for Cloud. *** http://www-01.ibm.com/support/docview.wss?uid=swg21991149 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in Apache Tomcat affects SAN Volume Controller and Storwize Family (CVE-2016-3092) *** http://www-01.ibm.com/support/docview.wss?uid=ssg1S1009284 --------------------------------------------- *** IBM Security Bulletin: Vulnerability affects multiple IBM Rational products based on IBM Jazz technology (CVE-2016-2947) *** http://www.ibm.com/support/docview.wss?uid=swg21991477 --------------------------------------------- *** IBM Security Bulletin: XStream XML information discloure vulnerability affects IBM Rational Quality Manager (CVE-2016-3674) *** http://www.ibm.com/support/docview.wss?uid=swg21991406 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities exist in Watson Explorer Analytical Components, Watson Content Analytics, and OmniFind Enterprise Edition (CVE-2016-0359, CVE-2016-3092, CVE-2016-3485) *** http://www-01.ibm.com/support/docview.wss?uid=swg21990062 --------------------------------------------- *** IBM Security Bulletin: A vulnerability in Open Source BeanShell has been addressed by IBM Kenexa LMS (CVE-2016-2510) *** http://www-01.ibm.com/support/docview.wss?uid=swg21987703 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in qemu affect PowerKVM *** http://www.ibm.com/support/docview.wss?uid=isg3T1024322 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in nagios affect PowerKVM *** http://www.ibm.com/support/docview.wss?uid=isg3T1024264 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in nginx affect PowerKVM *** http://www.ibm.com/support/docview.wss?uid=isg3T1024237 --------------------------------------------- *** IBM Security Bulletin: A vulnerability in NRPE affects PowerKVM (CVE-2014-2913) *** http://www.ibm.com/support/docview.wss?uid=isg3T1024235 --------------------------------------------- *** IBM Security Bulletin: A vulnerability in lighttpd affects PowerKVM (CVE-2016-1000212) *** http://www.ibm.com/support/docview.wss?uid=isg3T1024260 --------------------------------------------- *** IBM Security Bulletin: A vulnerability in pigz affects PowerKVM (CVE-2015-1191) *** http://www.ibm.com/support/docview.wss?uid=isg3T1024213 --------------------------------------------- *** IBM Security Bulletin: A vulnerability in ganglia affects PowerKVM (CVE-2015-6816) *** http://www.ibm.com/support/docview.wss?uid=isg3T1024262 ---------------------------------------------

1 0

Tageszusammenfassung - Mittwoch 5-10-2016
by Daily end-of-shift report 05 Oct '16

05 Oct '16

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 04-10-2016 18:00 − Mittwoch 05-10-2016 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Security Advisory: XSS vulnerability in the BIG-IP and Enterprise Manager Configuration utilities CVE-2015-1470 *** --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/800/sol16838.htm… *** Android Security Bulletin October 2016 *** --------------------------------------------- The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Alongside the bulletin, we have released a security update to Nexus devices through an over-the-air (OTA) update. --------------------------------------------- https://source.android.com/security/bulletin/2016-10-01.html *** Security Advisory: OpenSSL vulnerability CVE-2016-2183 *** --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/k/13/sol13167034.html?… *** WordPress Hack Modifies Core Files to Share Spam *** --------------------------------------------- One of the worst feelings a website owner can experience is discovering that your site has been hacked. Without proper security measures in place, even website owners with the best intentions can lose control of their website. When hackers gain access to your site, they can use it to host phishing content, distribute malware, steal sensitive information and more. In this analysis, we look at a website that was unintentionally sharing spam content in the form of Windows keys. --------------------------------------------- https://blog.sucuri.net/2016/10/wordpress-hack-shares-spam-when-core-modifi… *** Researchers spot remote code execution flaw in FreeImage *** --------------------------------------------- Cisco Talos researchers spotted a remote code execution vulnerability in the FreeImage Library XMP Image Handling affecting version 3.17.0. --------------------------------------------- http://www.scmagazine.com/remote-code-execution-flaw-spotted-in-freeimage-l… *** Security Advisory: OpenSSL vulnerability CVE-2016-6303 *** --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/k/35/sol35543324.html?… *** INDAS Web SCADA Path Traversal Vulnerability *** --------------------------------------------- This advisory contains mitigation details for a path traversal vulnerability in the INDAS Web SCADA application. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-16-278-01 *** Beckhoff Embedded PC Images and TwinCAT Components Vulnerabilities *** --------------------------------------------- This advisory contains mitigation details for vulnerabilities in Beckhoff's Embedded PC Images and TwinCAT Components. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-16-278-02 *** Siemens SIMATIC WinCC, PCS 7, and WinCC Runtime Professional Vulnerabilities (Update B) *** --------------------------------------------- This updated advisory is a follow-up to the advisory update titled ICSA-16-208-01A Siemens SIMATIC WinCC, PCS 7, and WinCC Runtime Professional Vulnerabilities that was published August 16, 2016, on the NCCIC/ICS-CERT web site. This advisory contains mitigation details for two vulnerabilities in the Siemens SIMATIC WinCC, PCS 7, and WinCC Runtime Professional. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-16-208-01 *** Lets not meet up with JPEG 2000 - researchers find security hole in image codec *** --------------------------------------------- Wont it be strange when were all fully pwned? Researchers are warning about a newly discovered security vulnerability in a popular open-source JPEG 2000 parser that could let corrupted image files trigger remote code execution. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2016/10/04/jpeg_2000_s… *** DressCode-Malware: 400 Trojaner-Apps infiltrieren Google Play *** --------------------------------------------- Sicherheitsforscher warnen vor getarnten Android-Spionage-Apps, die aus Firmen-Netzwerken Informationen absaugen sollen. --------------------------------------------- https://heise.de/-3340921 *** Xen Security Advisory CVE-2016-7777 / XSA-190 version 5: CR0.TS and CR0.EM not always honored for x86 HVM guests *** --------------------------------------------- A malicious unprivileged guest user may be able to obtain or corrupt sensitive information (including cryptographic material) in other programs in the same guest. --------------------------------------------- http://xenbits.xen.org/xsa/advisory-190.html *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Vulnerability in IBM Financial Transaction Manager for Corporate Payment Services (CVE-2016-5920) *** http://www.ibm.com/support/docview.wss?uid=swg21989062 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Rational Directory Server (Tivoli) and Rational Directory Administrator *** http://www.ibm.com/support/docview.wss?uid=swg21989495 --------------------------------------------- *** IBM Security Bulletin: IBM Security Guardium is affected by Open Source XMLsoft Libxml2 Vulnerabilities (CVE-2016-3705) *** http://www-01.ibm.com/support/docview.wss?uid=swg21990231 --------------------------------------------- *** IBM Security Bulletin: IBM Security Guardium Database Activity Monitor is affected by Open Source XMLsoft Libxml2 Vulnerabilities (CVE-2016-3627) *** http://www-01.ibm.com/support/docview.wss?uid=swg21991063 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in Open Source GNU glibc affect IBM Workload Deployer (CVE-2014-9761, CVE-2015-8778, CVE-2015-8779) *** http://www.ibm.com/support/docview.wss?uid=swg21991777 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in Open Source GNU glibc affects IBM Workload Deployer. (CVE-2015-8776) *** http://www.ibm.com/support/docview.wss?uid=swg21991465 --------------------------------------------- *** IBM Security Bulletin: Cross-Site Scripting Vulnerability (CVE-2016-0243) Affects IBM Connections Mail *** http://www.ibm.com/support/docview.wss?uid=swg21991265 --------------------------------------------- *** IBM Security Bulletin: IBM Security Guardium is affected by Cross-Site Scripting vulnerability (CVE-2016-0246) *** http://www-01.ibm.com/support/docview.wss?uid=swg21990377 ---------------------------------------------

1 0

Tageszusammenfassung - Dienstag 4-10-2016
by Daily end-of-shift report 04 Oct '16

04 Oct '16

======================= = End-of-Shift report = ======================= Timeframe: Montag 03-10-2016 18:00 − Dienstag 04-10-2016 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Cisco IOS and Cisco IOS XE Software TCP Denial of Service Vulnerability *** --------------------------------------------- A vulnerability in the handling of remote TCP connections in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a partial denial of service (DoS) condition due to low memory.The vulnerability is due to the handling of out-of-order, or otherwise invalid, TCP packets on a remote connection to an affected device. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Vuln: SAP Security Audit Log CVE-2016-4551 Security Bypass Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/93288 *** Security Advisory: Nginx vulnerability CVE-2016-4450 *** --------------------------------------------- os/unix/ngx_files.c in nginx before 1.10.1 and 1.11.x before 1.11.1 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a crafted request, involving writing a client request body to a temporary file. (CVE-2016-4450) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/k/08/sol08250500.html?… *** Researchers gut EMCs VMAX, vApp with five god mode hack holes *** --------------------------------------------- Complete compromise: DIY admin, or DoS your victim Researchers with Digital Defence have reported six dangerous vulnerabilities in EMCs VMAX product line that can grant remote attackers arbitrary command execution with root privileges. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2016/10/04/researchers… *** SAP Netweaver 7.40 SP 12 SCTC_REFRESH_EXPORT_TAB_COMP Command Injection *** --------------------------------------------- Topic: SAP Netweaver 7.40 SP 12 SCTC_REFRESH_EXPORT_TAB_COMP Command Injection Risk: High Text:Onapsis Security Advisory ONAPSIS-2016-041: SAP OS Command Injection in SCTC_REFRESH_EXPORT_TAB_COMP 1. Impact on Business ... --------------------------------------------- https://cxsecurity.com/issue/WLB-2016100025 *** SAP Netweaver 7.40 SP 12 SCTC_REFRESH_CHECK_ENV Command Injection *** --------------------------------------------- Topic: SAP Netweaver 7.40 SP 12 SCTC_REFRESH_CHECK_ENV Command Injection Risk: High Text:Onapsis Security Advisory ONAPSIS-2016-042: SAP OS Command Injection in SCTC_REFRESH_CHECK_ENV 1. Impact on Business ... --------------------------------------------- https://cxsecurity.com/issue/WLB-2016100024 *** SAP Netweaver 7.40 SP 12 SCTC_TMS_MAINTAIN_ALOG Command Injection *** --------------------------------------------- Topic: SAP Netweaver 7.40 SP 12 SCTC_TMS_MAINTAIN_ALOG Command Injection Risk: High Text:Onapsis Security Advisory ONAPSIS-2016-043: SAP OS Command Injection in SCTC_TMS_MAINTAIN_ALOG 1. Impact on Business ... --------------------------------------------- https://cxsecurity.com/issue/WLB-2016100023 *** NCCIC/ICS-CERT 2015 Assessment Report [PDF] *** --------------------------------------------- This report provides a year-end summary of the NCCIC/ICS-CERT security assessment activities. --------------------------------------------- https://ics-cert.us-cert.gov/sites/default/files/Annual_Reports/FY2015_Indu… *** Major security flaw in Samsung Knox could give hackers full control of your phone *** --------------------------------------------- Israeli researchers found three vulnerabilities in Samsung Knox - they have since been patched but out-of-date devices may still be at risk --------------------------------------------- http://www.wired.co.uk/article/samsung-knox-security-vulnerabilities *** Industrial control kit hackable, warn researchers *** --------------------------------------------- Plus: Ethernet I/O devices web app fails to sanitise user input Multiple vulnerabilities in MOXA ioLogik controllers placed industrial facilities at risk if they do not apply patches. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2016/10/04/ios_10_flaw/ *** Samsung Knox flaws open unpatched devices to compromise *** --------------------------------------------- Researchers from Viral Security Group have discovered three vulnerabilities in Samsung Knox, a security platform that allows users to maintain separate identities for work and personal use, and is built into some of the company's Android smartphones and tablets. Knox is meant to protect the integrity of the entire device - both hardware and software - but apparently there are ways to bypass some of those protections, specifically those offered by the Real-time Kernel --------------------------------------------- https://www.helpnetsecurity.com/2016/10/04/samsung-knox-flaws/ *** HPE KeyView SDK File Processing Flaw Lets Remote Users Execute Arbitrary Code *** --------------------------------------------- Several vulnerabilities were reported in HPE KeyView SDK. A remote user can cause arbitrary code to be executed on the target system. A remote user can create a specially crafted file that, when processed by the target application using the HPE KeyView SDK, will execute arbitrary code on the target system. The code will run with the privileges of the target application. The specific impact depends on the application using the SDK. --------------------------------------------- http://www.securitytracker.com/id/1036935 *** Sicherheitspatches für VMAX-Storage-Systeme von Dell EMC *** --------------------------------------------- Die Enterprise-Storage-Systeme sind anfällig für Angriffe aus dem eigenen Netzwerk. Angreifer können die Kommunikation des Unisphere-Managers manipulieren und sich so vollen Zugriff zu den Netzwerkspeichern verschaffen. --------------------------------------------- https://heise.de/-3340322 *** Bugtraq: Serimux SSH Console Switch v2.4 - Multiple Cross Site Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/archive/1/539524 *** Bugtraq: ESA-2016-121: EMC Unisphere for VMAX and Solutions Enabler Virtual Appliances Multiple Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/archive/1/539526 *** Bugtraq: ESA-2016-063: EMC Replication Manager and Network Module for Microsoft Remote Code Execution Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/539525 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: IBM Notes HarfBuzz is vulnerable to a denial of service information disclosure (CVE-2015-8947) *** http://www-01.ibm.com/support/docview.wss?uid=swg21990410 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities affect IBM Sterling Secure Proxy Configuration Manager *** http://www.ibm.com/support/docview.wss?uid=swg21991278 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in Apache POI affect Asset and Service Management *** http://www-01.ibm.com/support/docview.wss?uid=swg21989525 --------------------------------------------- *** IBM Security Bulletin: IBM Tivoli Monitoring (CVE-2016-4472, CVE-2016-0718) *** http://www.ibm.com/support/docview.wss?uid=swg21990634 --------------------------------------------- *** IBM Security Bulletin: A vulnerability in IBM Java Runtime affects: WebSphere Dashboard Framework (CVE-2016-3485) *** http://www.ibm.com/support/docview.wss?uid=swg21990404 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM MQ Light (CVE-2016-3426) *** http://www.ibm.com/support/docview.wss?uid=swg21988437 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Rational Synergy (CVE-2016-3426) *** http://www.ibm.com/support/docview.wss?uid=swg21990945 --------------------------------------------- *** IBM Security Bulletin: IBM i Integrated Web Application Server version 8.5 is affected by multiple vulnerabilities. *** http://www-01.ibm.com/support/docview.wss?uid=nas8N1021649 --------------------------------------------- *** IBM Security Bulletin: IBM Security Guardium Database Activity Monitor is affected by SQL Injection vulnerability (CVE-2016-0249) *** http://www-01.ibm.com/support/docview.wss?uid=swg21990363 --------------------------------------------- *** IBM Security Bulletin: IBM Security Guardium is affected by Password in Clear Text vulnerability (CVE-2016-0247) *** http://www-01.ibm.com/support/docview.wss?uid=swg21990368 --------------------------------------------- *** IBM Security Bulletin: FileNet Workplace XT and FileNet Workplace (Application Engine), can be affected by Cross Site Scripting vulnerabilities (CVE-2016-5981) *** http://www.ibm.com/support/docview.wss?uid=swg21990899 --------------------------------------------- *** IBM Security Bulletin: Cross Site Scripting vulnerability in IBM Business Process Manager (CVE-2016-5901) *** http://www-01.ibm.com/support/docview.wss?uid=swg21990852 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Sterling Connect:Direct Browser User Interface (CVE-2016-3426, CVE-2016-3485) *** http://www.ibm.com/support/docview.wss?uid=swg21991387 --------------------------------------------- *** IBM Security Bulletin: HTML injection vulnerability in Business Space might affect IBM Business Process Manager (CVE-2016-3056) *** http://www-01.ibm.com/support/docview.wss?uid=swg21990850 --------------------------------------------- *** IBM Security Bulletin: Security vulnerabilities in IBM SDK for Node.js might affect IBM Business Process Manager (BPM) Configuration Editor (CVE-2014-9748, CVE-2016-1669) *** http://www-01.ibm.com/support/docview.wss?uid=swg21990841 --------------------------------------------- *** IBM Security Bulletin: Security vulnerabilities in Apache Struts might affect IBM Business Process Manager and WebSphere Lombardi Edition (CVE-2016-1181, CVE-2016-1182, CVE-2015-0899) *** http://www-01.ibm.com/support/docview.wss?uid=swg21990834 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Sterling Secure Proxy (CVE-2016-3426, CVE-2016-3485) *** http://www.ibm.com/support/docview.wss?uid=swg21991287 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Sterling External Authentication Server (CVE-2016-3426, CVE-2016-3485) *** http://www.ibm.com/support/docview.wss?uid=swg21991289 --------------------------------------------- *** IBM Security Bulletin: IBM Security Guardium Database Activity Monitor is affected by Execution with Unnecessary Privileges vulnerability (CVE-2016-0328) *** http://www-01.ibm.com/support/docview.wss?uid=swg21990226 --------------------------------------------- *** IBM Security Bulletin: IBM Security Guardium is affected by Application Error vulnerability (CVE-2016-0242) *** http://www-01.ibm.com/support/docview.wss?uid=swg21990229 --------------------------------------------- *** IBM Security Bulletin: IBM Expeditor HarfBuzz is vulnerable to a denial of service information disclosure (CVE-2015-8947) *** http://www-01.ibm.com/support/docview.wss?uid=swg21990412 ---------------------------------------------

1 0

Tageszusammenfassung - Montag 3-10-2016
by Daily end-of-shift report 03 Oct '16

03 Oct '16

======================= = End-of-Shift report = ======================= Timeframe: Freitag 30-09-2016 18:00 − Montag 03-10-2016 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Security Advisory: NAT64 vulnerability CVE-2016-5745 *** --------------------------------------------- BIG-IP devices using NAT64 are vulnerable to an unauthenticated remote attack that may allow modification of the BIG-IP system configuration. (CVE-2016-5745) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/k/64/sol64743453.html?… *** imagemagick mogrify global buffer overflow *** --------------------------------------------- Topic: imagemagick mogrify global buffer overflow Risk: High Text:Hi, imagemagick identify suffers of a global buffer overflow issue, which I reported and has been patched... --------------------------------------------- https://cxsecurity.com/issue/WLB-2016100007 *** Ubiquiti UniFi Critical Vulnerability *** --------------------------------------------- Vulnerability Details: You are able to connect to the access points database, because of an broken authentication (OWASP TOP10). So you are able to modify the database and read the data. An possible scenario you'll find in PoC section. Risk: An attacker gets access to the database and for e.g. is able to change the admins password, like you see in PoC below. --------------------------------------------- https://cxsecurity.com/issue/WLB-2016100006 *** Bundeskriminalamt plant Mobilversion des Bundestrojaners *** --------------------------------------------- Das BKA will den Einsatz des Bundestrojaners auf Smartphones und Tablets ausweiten. Das geht aus Haushaltsunterlagen des Bundestages hervor, die Süddeutsche Zeitung, NDR und WDR einsehen konnten. --------------------------------------------- https://heise.de/-3339512 *** Source Code for IoT Botnet 'Mirai' Released *** --------------------------------------------- The source code that powers the "Internet of Things" (IoT) botnet responsible for launching the historically large distributed denial-of-service (DDoS) attack against KrebsOnSecurity last month has been publicly released, virtually guaranteeing that the Internet will soon be flooded with attacks from many new botnets powered by insecure routers, IP cameras, DVRs and other easily hackable IoT devices. --------------------------------------------- https://krebsonsecurity.com/2016/10/source-code-for-iot-botnet-mirai-releas… *** cJSON buffer out of bound read *** --------------------------------------------- I would like to report a buffer out of bound read problem in cJSON, which is a embeddable JSON parser, used (I imagine) in embedded devices, or even bigger stuff like the ps4... --------------------------------------------- https://cxsecurity.com/issue/WLB-2016100013 *** Default Credentials Considered Harmful *** --------------------------------------------- The use of default credentials by vendors is an outdated, dangerous throwback to 20th century practices that has no business being used in todays world. It is this specific antique practice that is directly responsible for the existence of the record-breaking denial-of-service botnet recently used to censor Brian Krebs and the similar attack on OVH - these botnets only exist because default credentials were implemented on devices, in flagrant violation of best-practices ... --------------------------------------------- https://www.alienvault.com/blogs/security-essentials/default-credentials-co… *** The Short Life of a Vulnerable DVR Connected to the Internet, (Sun, Oct 2nd) *** --------------------------------------------- Most devices connected to the Internet these days arent maintained and monitored personal computers. Instead, they are devices who are often not understood as computers but as things, giving rise to the term Internet of Things or IoT. Over two years ago, we reported about how exploited DVRs are used to attack other devices across the internet. Back then, like today, the vulnerability was an open telnet server with a trivial default password. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=21543&rss *** Researchers Break MarsJoke Ransomware Encryption *** --------------------------------------------- Victims infected with the MarsJoke ransomware can now decrypt their files; researchers cracked the encryption in the CTB-Locker lookalike last week. --------------------------------------------- http://threatpost.com/researchers-break-marsjoke-ransomware-encryption/1210… *** Security Design: Stop Trying to Fix the User *** --------------------------------------------- Every few years, a researcher replicates a security study by littering USB sticks around an organizations grounds and waiting to see how many people pick them up and plug them in, causing the autorun function to install innocuous malware on their computers. These studies are great for making security professionals feel superior. The researchers get to demonstrate their security expertise and use the results as "teachable moments" for others. "If only everyone was more security --------------------------------------------- https://www.schneier.com/blog/archives/2016/10/security_design.html *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Multiple Vulnerabilities in OpenSSL affect IBM i *** http://www.ibm.com/support/docview.wss?uid=nas8N1021643 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Rational Application Developer for WebSphere Software (CVE-2016-3508, CVE-2016-3500, CVE-2016-3458, CVE-2016-3485) *** http://www-01.ibm.com/support/docview.wss?uid=swg21991383 --------------------------------------------- *** IBM Security Bulletin: A vulnerability in IBM Java SDK and IBM Java Runtime affects Web Experience Factory (CVE-2016-3485) *** http://www.ibm.com/support/docview.wss?uid=swg21990405 --------------------------------------------- *** IBM Security Bulletin: IBM B2B Advanced Communications is vulnerable to cross-site scripting due to the vulnerability of 10x (CVE-2016-5892) *** http://www-01.ibm.com/support/docview.wss?uid=swg21991148 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in Apache Commons affects IBM B2B Advanced Communications (CVE-2016-3092) *** http://www-01.ibm.com/support/docview.wss?uid=swg21990424 --------------------------------------------- *** IBM Security Bulletin: IBM Flex System Manager (FSM) is affected by multiple libxml2 vulnerabilities *** http://www.ibm.com/support/docview.wss?uid=isg3T1024318 --------------------------------------------- *** IBM Security Bulletin: IBM Flex System Manager (FSM) is affected by multiple openssl vulnerabilities *** http://www.ibm.com/support/docview.wss?uid=isg3T1024319 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in IBM Runtime Environments Java Technology Edition, Versions 6, 7, 8 affect Transformation Extender Design Studio (CVE-2016-3426) *** http://www-01.ibm.com/support/docview.wss?uid=swg21990356 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities affect IBM Tivoli Monitoring embedded WebSphere Application Server *** http://www.ibm.com/support/docview.wss?uid=swg21990451 --------------------------------------------- *** IBM Security Bulletin: OpenStack Glance vulnerabilities affect IBM Cloud Manager with OpenStack (CVE-2016-0757) *** http://www.ibm.com/support/docview.wss?uid=isg3T1024348 ---------------------------------------------

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily October 2016