Daily March 2017

daily@lists.cert.at

1 participants
23 discussions

Tageszusammenfassung - Freitag 31-03-2017
by Daily end-of-shift report 31 Mar '17

31 Mar '17

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 30-03-2017 18:00 − Freitag 31-03-2017 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Security SiteProtector System *** --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg22000768 *** IBM Security Bulletin: IBM Cognos Analytics is affected by multiple vulnerabilities *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21998887 *** Spotting a Hidden SEO Hack: “Play One” *** --------------------------------------------- SEO hacks continue to plague websites as attackers abuse SERP rankings for their own gain. The time and effort spent by the website owner creating content, optimizing pages and building .. --------------------------------------------- https://blog.sucuri.net/2017/03/spotting-a-hidden-seo-hack-play-one.html *** Schneider Electric Modicon PLCs *** --------------------------------------------- This advisory contains mitigation details predictable value range from previous values, use of insufficiently random values, and insufficiently protected credentials vulnerabilities in Schneider Electrics Modicon PLCs. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-17-089-02 *** Researchers steal data from shared cache of two cloud VMs *** --------------------------------------------- All of a sudden dedicated instances are looking a lot better than multi-tenancy A group of researchers, one .. --------------------------------------------- www.theregister.co.uk/2017/03/31/researchers_steal_data_from_shared_cache_o… *** Novell: Sentinel 8.0 SP1 (Sentinel 8.0.1.0) Build 3512 *** --------------------------------------------- https://download.novell.com/Download?buildid=M7_yJE9WOXE~ *** Celebrate World Backup Day the Smarter Way *** --------------------------------------------- In an effort to help the community be more cyber aware, WorldBackupDay.com celebrates on March 31st .. --------------------------------------------- https://www.webroot.com/blog/2017/03/31/celebrate-world-backup-day-smarter-… *** Samsung Galaxy S8s Facial Unlocking Feature Can Be Fooled With A Photo *** --------------------------------------------- All users need to do is simply hold their Galaxy S8 or S8 Plus in front of their eyes or their entire .. --------------------------------------------- http://thehackernews.com/2017/03/samsung-galaxy-s8-facial-unlocking.html *** Studie: TK-Infrastruktur hoffnungslos unsicher – Verschlüsselung Fehlanzeige *** --------------------------------------------- Der amerikanische Pendant zur Bundesnetzagentur hat die Sicherheit des für die Telekommunikations-Infrastruktur unverzichtbaren SS7-Protokolls untersucht. Die Bilanz ist haarsträubend; die Arbeitsgruppe empfiehlt Ende-zu-Ende-Verschlüsselung. --------------------------------------------- https://heise.de/-3671794 *** l+f: Flash für eine Handvoll Dollar *** --------------------------------------------- FedEx Office macht seinen Kunden ein unmoralisches Angebot. --------------------------------------------- https://heise.de/-3672139 *** Pornhub und Youporn stellen auf https um *** --------------------------------------------- Die beiden Pornoseiten wollen ihren Nutzern mehr Datenschutz ermöglichen --------------------------------------------- http://derstandard.at/2000055192256

1 0

Tageszusammenfassung - Donnerstag 30-03-2017
by Daily end-of-shift report 30 Mar '17

30 Mar '17

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 29-03-2017 18:00 − Donnerstag 30-03-2017 18:00 Handler: Robert Waldner Co-Handler: n/a *** Tech support scammers and their banking woes *** --------------------------------------------- We all know about tech support scams by this point. Unfortunately for the scammers, banks know this as well, making it quite difficult at times to maintain an account to store the criminal's ill-gotten gains. So how does the enterprising criminal cash out with your money? Let's take a look. --------------------------------------------- https://blog.malwarebytes.com/cybercrime/2017/03/tech-support-scammers-and-… *** Security Advisory - Exposed System Interface Vulnerability on Huawei Smart Phones *** --------------------------------------------- There is a exposed system interface vulnerability on smart phones. The software provides a system interface for interaction with external applications, but calling the interface is not properly restricted. An attacker could trick the user into installing a malicious application to call the interface and modify the system properties. CVE-2017-2735 --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20170329-… *** Widespread Email Scam Targets Github Developers with Dimnie Trojan *** --------------------------------------------- Open source developers who use the popular code-sharing site GitHub were put on alert after the discovery of a phishing email campaign that attempts to infect their computers with an advanced malware trojan. Dubbed Dimnie, the reconnaissance and espionage trojan has the ability to harvest credentials, download sensitive files, take screenshots, log keystrokes on 32-bit and 64-bit ... --------------------------------------------- http://thehackernews.com/2017/03/github-email-scam.html *** Vuln: EMC Isilon OneFS CVE-2017-4980 Directory Traversal Vulnerability *** --------------------------------------------- EMC Isilon OneFS is prone to a directory-traversal vulnerability. A remote attacker could exploit the vulnerability using directory-traversal characters ('../') to access arbitrary files that contain sensitive information. --------------------------------------------- http://www.securityfocus.com/bid/97222 *** [SANS ISC] Diverting built-in features for the bad *** --------------------------------------------- I published the following diary on isc.sans.org: 'Diverting built-in features for the bad'. Sometimes you may find very small pieces of malicious code. Yesterday, I caught this very small Javascript sample with only 2 lines of code --------------------------------------------- https://blog.rootshell.be/2017/03/30/sans-isc-diverting-built-features-bad/ *** Trend Micro InterScan Web Security Virtual Appliance Unspecified Flaws Let Remote Users Execute Arbitrary Code on the Target System *** --------------------------------------------- http://www.securitytracker.com/id/1038161 *** Mirai-Botnetz lernt neue Tricks *** --------------------------------------------- Das IoT-Botnetz Mirai beherrscht neuerdings auch DDoS-Angriffe auf dem Application Layer. Diese sind schwer zu entdecken und damit auch relativ schwer abzuwehren. --------------------------------------------- https://heise.de/-3670226 *** Hashfunktion: Der schwierige Abschied von SHA-1 *** --------------------------------------------- Die Hashfunktion SHA-1 ist seit kurzem endgültig gebrochen. Doch an vielen Stellen ist SHA-1 noch im Einsatz. Beispielsweise in Git, in Bittorrent und - was manche überraschen wird - auch in TLS. (SHA-1, Google) --------------------------------------------- https://www.golem.de/news/hashfunktion-der-schwierige-abschied-von-sha-1-17… *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: IBM Algo One - Algo Risk Application (ARA) could allow retrieval of restricted files *** http://www.ibm.com/support/docview.wss?uid=swg21999892 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Spectrum Scale packaged the Elastic Storage Server and the GPFS Storage Server *** http://www-01.ibm.com/support/docview.wss?uid=ssg1S1010042 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in the GSKit component of Tivoli Netcool/OMNIbus (CVE-2016-2183) *** https://www-01.ibm.com/support/docview.wss?uid=swg22001105 --------------------------------------------- *** IBM Security Bulletin: IBM Tivoli Monitoring Basic Services component. (CVE-2012-6702, CVE-2016-5300) *** http://www-01.ibm.com/support/docview.wss?uid=swg21998701 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in Expat affect Intel (R) Manycore Platform Software Stack (MPSS) for Linux and Windows *** https://support.podc.sl.edst.ibm.com/support/home/docdisplay?lndocid=migr-5… --------------------------------------------- *** IBM Security Bulletin: IBM TRIRIGA Document Manager Privilege Escalation (CVE-2017-1180) *** http://www.ibm.com/support/docview.wss?uid=swg22001084 --------------------------------------------- *** IBM Security Bulletin: Security vulnerabilities have been identified in data server connection and product integration shipped with InfoSphere Optim Query Workload Tuner [for LUW, z/OS *** http://www.ibm.com/support/docview.wss?uid=swg22000601 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Content Manager Enterprise Edition *** http://www.ibm.com/support/docview.wss?uid=swg22000398 --------------------------------------------- *** IBM Security Bulletin: A vulnerability in IBM Java Runtime affects IBM WebSphere MQ and IBM MQ Appliance (CVE-2016-5597) *** http://www-01.ibm.com/support/docview.wss?uid=swg22000904 --------------------------------------------- *** IBM Security Bulletin: IBM Disposal and Governance Management for IT and IBM Global Retention Policy and Schedule Management vulnerable to cross-site request forgery (CSRF) *** http://www.ibm.com/support/docview.wss?uid=swg22000771 ---------------------------------------------

1 0

Tageszusammenfassung - Mittwoch 29-03-2017
by Daily end-of-shift report 29 Mar '17

29 Mar '17

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 28-03-2017 18:00 − Mittwoch 29-03-2017 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** World Backup Day is as good as any to back up your data *** --------------------------------------------- In today’s security landscape, there are more threats to data than ever before. Beyond corruption caused by hardware or human failure, malware and cyberattacks can put data in serious danger. That’s why it’s .. --------------------------------------------- https://blogs.technet.microsoft.com/mmpc/2017/03/28/world-backup-day-is-as-… *** Siemens RUGGEDCOM ROX I *** --------------------------------------------- This advisory contains mitigation details for improper authorization, cross-site scripting, and cross-site request forgery vulnerabilities in the Siemens RUGGEDCOM ROX I. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-17-087-01 *** 3S-Smart Software Solutions GmbH CODESYS Web Server *** --------------------------------------------- This advisory contains mitigation details for arbitrary file upload and stack buffer overflow vulnerabilities in the 3S-Smart Software Solutions GmbH CODESYS Web Server. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-17-087-02 *** FBI warns of attacks on anonymous FTP servers *** --------------------------------------------- The FBI warns that attackers are targeting vulnerable FTP servers used by small medical and dental .. --------------------------------------------- http://www.cio.com/article/3185882/security/fbi-warns-of-attacks-on-anonymo… *** About the security content of iCloud for Windows 6.2 *** --------------------------------------------- https://support.apple.com/en-us/HT207607 *** Ransomware: Scammer erpressen Besucher von Pornoseiten *** --------------------------------------------- Über einen Fehler in Apples Safari für iPhone blockieren Unbekannte den Browser mit einem immer .. --------------------------------------------- https://www.golem.de/news/ransomware-scammer-erpressen-besucher-von-porno-s… *** Benutzt hier jemand JSON Encryption?If you are using ... *** --------------------------------------------- Benutzt hier jemand JSON Encryption?If you are using go-jose, node-jose, jose2go, Nimbus JOSE+JWT or jose4 with ECDH-ES please update to the latest version. RFC 7516 aka JSON Web .. --------------------------------------------- http://blog.fefe.de/?ts=a6254421 *** Vuln: ImageMagick Incomplete Fix CVE-2017-7275 Memory Corruption Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/97166 *** "Cyber-Angriff" im Bundestag: Anscheinend eine gewöhnliche Malvertising-Kampagne *** --------------------------------------------- Deutsche Medien berichten von einem erneuten Hackerangriff auf den Bundestag. Dabei scheint es sich um Abgeordnete zu handeln, die Opfer von verseuchter Werbung auf der Webseite einer israelischen Zeitung geworden sind. Infektionen gab es keine. --------------------------------------------- https://heise.de/-3668761 *** Escaping a Python sandbox with a memory corruption bug *** --------------------------------------------- https://medium.com/@gabecpike/python-sandbox-escape-via-a-memory-corruption… *** DFN-CERT-2017-0543: AppArmor: Eine Schwachstelle ermöglicht das Umgehen von Sicherheitsvorkehrungen *** --------------------------------------------- Ein entfernter, nicht authentisierter Angreifer kann eine speziell präparierte Anwendung uneingeschränkt auf einem betroffenen System einsetzen, da über AppArmor .. --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2017-0543/ *** Ausbruch aus der VM: VMware schließt kritische Pwn2Own-Lücken *** --------------------------------------------- VMware hat Sicherheitslücken in VMware Workstation, Fusion und ESXi geschlossen, mit deren Hilfe Sicherheitsforscher beim Pwn2Own-Wettbewerb aus virtuellen Maschinen ausgebrochen und das Host-System gekapert hatten. --------------------------------------------- https://heise.de/-3669902 *** PMASA-2017-8 *** --------------------------------------------- https://www.phpmyadmin.net/security/PMASA-2017-8/ *** Ebury-Rootkit: Russischer Hacker bekennt sich schuldig *** --------------------------------------------- Ein russsischer Staatsbürger hat in den USA seine Beteiligung am Auf- und Ausbau des Ebury-Botnetzes eingestanden. Ebury befällt vor allem Linux-Server und greift SSH-Logins ab. --------------------------------------------- https://heise.de/-3669617 *** Browser-Plug-in Crusader injiziert falsche Support-Telefonnummern in Webseiten *** --------------------------------------------- Eine neue Schadcode-Variante integriert sich in den Browser und tauscht Suchergebnisse aus. Dadurch kann der Anwender auf Affiliate-Seiten umgelenkt werden. Außerdem ist es möglich, ihm falsche Support-Telefonnummern unterzuschieben. --------------------------------------------- https://heise.de/-3670102 *** GitHub Users Targeted with Dimnie Trojan *** --------------------------------------------- https://www.bleepingcomputer.com/news/security/github-users-targeted-with-d…

1 0

Tageszusammenfassung - Dienstag 28-03-2017
by Daily end-of-shift report 28 Mar '17

28 Mar '17

======================= = End-of-Shift report = ======================= Timeframe: Montag 27-03-2017 18:00 − Dienstag 28-03-2017 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Bugtraq: APPLE-SA-2017-03-27-1 Pages 6.1, Numbers 4.1, and Keynote 7.1 for Mac; Pages 3.1, Numbers 3.1, and Keynote 3.1 for iOS *** --------------------------------------------- http://www.securityfocus.com/archive/1/540325 *** APT29 Used Domain Fronting, Tor to Execute Backdoor *** --------------------------------------------- APT29, a/k/a Cozy Bear, has used Tor and a technique called domain fronting in order to secure backdoor access to targets for nearly two years running. --------------------------------------------- http://threatpost.com/apt29-used-domain-fronting-tor-to-execute-backdoor/12… *** New Clues Surface on Shamoon 2’s Destructive Behavior *** --------------------------------------------- Researchers report new connections between Magic Hound and Shamoon 2, along with descriptions of how the Disttrack malware component of campaigns moves laterally within infected networks. --------------------------------------------- http://threatpost.com/new-clues-surface-on-shamoon-2s-destructive-behavior/… *** Vuln: GnuTLS GNUTLS-SA-2017-3 Multiple Security Vulnerabilities *** --------------------------------------------- GnuTLS GNUTLS-SA-2017-3 Multiple Security Vulnerabilities --------------------------------------------- http://www.securityfocus.com/bid/97040 *** Neue Sicherheitslücke im Passwort-Manager LastPass *** --------------------------------------------- Bereits zum zweiten Mal innerhalb kurzer Zeit ist der populäre Passwort-Manager mit einer Schwachstelle konfrontiert. --------------------------------------------- https://futurezone.at/produkte/neue-sicherheitsluecke-im-passwort-manager-l… *** Symantec API Flaws reportedly let attackers steal Private SSL Keys and Certificates *** --------------------------------------------- A security researcher has disclosed critical issues in the processes and third-party API used by Symantec certificate resellers to deliver and manage Symantec SSL .. --------------------------------------------- https://thehackernews.com/2017/03/symantec-ssl-certificates.html *** Threat Landscape for Industrial Automation Systems, H2 2016 *** --------------------------------------------- On average, in the second half of 2016 Kaspersky Lab products across the globe blocked attempted attacks on 39.2% of protected computers that Kaspersky Lab ICS CERT classifies as being part of industrial enterprise technology infrastructure. --------------------------------------------- http://securelist.com/analysis/publications/77842/threat-landscape-for-indu… *** From DDoS to Server Ransomware: APACHE STRUTS 2 - CVE-2017-5638 Campaign *** --------------------------------------------- As soon as a zero-day remote code execution vulnerability is disclosed, it is common to see many scans in the wild. Some of these scans are researchers, but many of .. --------------------------------------------- https://f5.com/labs/articles/threat-intelligence/malware/from-ddos-to-serve… *** This book reads you - using JavaScript *** --------------------------------------------- Apple just released a fix for one issue I reported last year in iBooks that allowed access to files on a users system when a book was opened. iBooks on El Capitan would .. --------------------------------------------- https://s1gnalcha0s.github.io/ibooks/epub/2017/03/27/This-book-reads-you-us… *** Gefahr durch Exploit für Zombie-IIS *** --------------------------------------------- Microsofts Internet Information Services 6.0 sind eigentlich Alteisen, für das es nicht einmal Sicherheits-Updates gibt. Trotzdem gibt es noch über 30.000 allein in Deutschland. Und die sind durch einen öffentlich bekannten Exploit akut bedroht. --------------------------------------------- https://heise.de/-3666599 *** Verschlüsselung: Schwachstellen in zahlreichen VoIP-Anwendungen entdeckt *** --------------------------------------------- Das ZRT-Protokoll soll für sichere Verbindungen und verschlüsselte VoIP-Telefonate sorgen. Forscher haben Schwachstellen in zahlreichen ZRTP-Anwendungen .. --------------------------------------------- https://www.golem.de/news/verschluesselung-schwachstellen-in-zahlreichen-vo… *** IronWASP – Part 1 *** --------------------------------------------- Considering not all vulnerability scanners are open source, a great deal of them are available such as: IronWASP OpenVAS Retina CS Community W3af Grabber, etc. In this article, we shall be discussing more about IronWASP. --------------------------------------------- http://resources.infosecinstitute.com/ironwasp-part-1-2/ *** Docs.com-Nutzer teilen Kennwörter und vieles mehr mit der Welt *** --------------------------------------------- Über Microsofts Dienst Docs.com lassen sich Dokumente teilen. Allerdings sind diese oft öffentlich einsehbar. Viele Anwender scheinen sich dem nicht bewusst zu sein – zu einfach finden sich Informationen wie Kennwörter. --------------------------------------------- https://heise.de/-3665975 *** Apache / ModSecurity Tutorials *** --------------------------------------------- This is a series of Apache web server tutorials that will span from the basics to advanced topics like ModSecurity and logfile visualization. --------------------------------------------- https://www.netnea.com/cms/apache-tutorials/ *** Xen Security Advisory XSA-206 - xenstore denial of service via repeated update *** --------------------------------------------- Unprivileged guests may be able to stall progress of the control domain or driver domain, possibly leading to .. --------------------------------------------- http://xenbits.xen.org/xsa/advisory-206.txt *** With iOS 10.3, iDevices get new Apple File System with native encryption support *** --------------------------------------------- On Monday, Apple released updates for its various products. As usual, they fix flaws and add capabilities, but the iOS update (v10.3) is more noteworthy than usual, .. --------------------------------------------- https://www.helpnetsecurity.com/2017/03/28/apple-file-system-encryption/ *** Ransomware: Scammer erpressen Besucher von Porno-Seiten *** --------------------------------------------- Über einen Fehler in Apples Safari für iPhone blockieren Unbekannte den Browser mit einem immer wiederkehrenden Javascript-Popup. Darin werden Nutzer aufgefordert, Lösegeld zu zahlen. Mit einem einfachen Trick lässt sich der Falle aber entgehen. --------------------------------------------- https://www.golem.de/news/ransomware-scammer-erpressen-besucher-von-porno-s…

1 0

Tageszusammenfassung - Montag 27-03-2017
by Daily end-of-shift report 27 Mar '17

27 Mar '17

======================= = End-of-Shift report = ======================= Timeframe: Freitag 24-03-2017 18:00 − Montag 27-03-2017 18:00 Handler: Robert Waldner Co-Handler: n/a *** SAP NetWeaver J2EE Platform Security *** --------------------------------------------- In the previous article, we discussed SAP NetWeaver ABAP Platform and its vulnerabilities. Today's topic is the J2EE platform, its architecture, vulnerabilities, and the latest trends in its cyber security. --------------------------------------------- http://resources.infosecinstitute.com/sap-netweaver-j2ee-platform-security/ *** [Update] Ungepatchte SAP-Systeme angreifbar für Remote Code Execution *** --------------------------------------------- Wenn die im Rahmen des SAP Security Patch Day im März 2017 veröffentlichten Patches nicht umgehend eingespielt werden, droht die Kompromittierung zentraler Datenbestände, warnen SAP-Kenner. --------------------------------------------- https://heise.de/-3664479 *** Amazon-Phishingmail: Rechnung über Ihre Verkäufergebühren *** --------------------------------------------- In einer angeblichen Nachricht von "Europe Amazon" erhalten Kund/innen die Information, dass ihr "Duplikat der elektronisch erzeugten Steuerrechnung" verfügbar sei. Sie können es in einem beigefügten Dokument, das den Login-Bereich von Amazon imitiert, herunterladen. Es handelt sich um einen Phishingversuch. --------------------------------------------- https://www.watchlist-internet.at/phishing/amazon-phishingmail-rechnung-ueb… *** Detecting and mitigating elevation-of-privilege exploit for CVE-2017-0005 *** --------------------------------------------- On March 14, 2017, Microsoft released security bulletin MS17-013 to address CVE-2017-0005, a vulnerability in the Windows Win32k component that could potentially allow elevation of privileges. A report from a trusted partner identified a zero-day exploit for this vulnerability. The exploit targeted older versions of Windows and allowed attackers to elevate process privileges on these platforms. --------------------------------------------- https://blogs.technet.microsoft.com/mmpc/2017/03/27/detecting-and-mitigatin… *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect WebSphere Dashboard Framework *** http://www-01.ibm.com/support/docview.wss?uid=swg22000663 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect IBM Web Experience Factory *** http://www-01.ibm.com/support/docview.wss?uid=swg22000643 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Process Designer used in IBM Business Process Manager and WebSphere Lombardi Edition *** http://www.ibm.com/support/docview.wss?uid=swg22000871 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in zlib affect IBM Sterling Connect:Direct for Microsoft Windows (CVE-2016-9840, CVE-2016-9841, CVE-2016-9842, CVE-2016-9843) *** http://www.ibm.com/support/docview.wss?uid=swg22000608 --------------------------------------------- *** IBM Security Bulletin: Privilege Escalation vulnerability affects Cognos Business Intelligence (CVE-2016-8960) *** http://www-01.ibm.com/support/docview.wss?uid=swg21993718 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in OpenSSL affects LCM8 & LCM16 KVM Switch Firmware and GCM16 & GCM32 KVM Switch Firmware (CVE-2016-8610) *** https://support.podc.sl.edst.ibm.com/support/home/docdisplay?lndocid=migr-5… --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in SSH affect IBM DataPower Gateways (CVE-2016-10009, CVE-2016-10012) *** http://www-01.ibm.com/support/docview.wss?uid=swg22000413&myns=swgws&mynp=O… --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in OpenSSH and OpenSSL affect GPFS for Windows V3.5 *** http://www-01.ibm.com/support/docview.wss?uid=isg3T1024968 --------------------------------------------- *** IBM Security Bulletin: IBM Sterling Selling and Fulfillment Foundation is affected by Cross Site Scripting (XSS) Vulnerability (CVE-2016-8917) *** http://www.ibm.com/support/docview.wss?uid=swg22000943 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Jazz Team Server affect IBM Rational products based on IBM Jazz technology *** https://www.ibm.com/support/docview.wss?uid=swg22000784 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in GSKit affects IBM Sterling Connect:Direct for UNIX (CVE-2016-2183) *** https://www-01.ibm.com/support/docview.wss?uid=swg22000927 --------------------------------------------- *** IBM Security Bulletin: Fix Available for IBM iNotes Cross-site Scripting Vulnerability (CVE-2016-9990) *** http://www-01.ibm.com/support/docview.wss?uid=swg21998824 ---------------------------------------------

1 0

Tageszusammenfassung - Freitag 24-03-2017
by Daily end-of-shift report 24 Mar '17

24 Mar '17

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 23-03-2017 18:00 − Freitag 24-03-2017 18:00 Handler: Robert Waldner Co-Handler: n/a *** TROOPERS 2017 Day #4 Wrap-Up *** --------------------------------------------- I'm just back from Heidelberg so here is the last wrap-up for the TROOPERS 2017 edition. --------------------------------------------- https://blog.rootshell.be/2017/03/23/troopers-2017-day-4-wrap/ *** Google slaps Symantec for sloppy certs, slow show of SNAFUs *** --------------------------------------------- Certs will keep working, but Chrome will be suspicious, soon Googles Chrome development team has posted a stinging criticism of Symantecs certificate-issuance practices, saying it has lost confidence in the companys practices and therefore in the safety of sessions hopefully-secured by Symantec-issued certificates. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2017/03/24/google_slap… *** Referrer spoofing with iframe injection *** --------------------------------------------- Last year we've been playing with a very simple method to spoof the referrer on Edge, which allowed us of course to spoof the referrer and -as a bonus- other neat things like bypass the XSS filter. Today I found out that it was patched, so I decided to give it a try and find a way around the patch. Honestly I don't feel it's a bypass but clearly a variation. From a practical point of view, it works again and bypasses the patch... --------------------------------------------- https://www.brokenbrowser.com/referer-spoofing-patch-bypass/ *** VMSA-2017-0004.6 *** --------------------------------------------- VMware product updates resolve remote code execution vulnerability via Apache Struts 2 --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2017-0004.html *** Betrugsnetzwerk: Kinox.to-Nutzern Abofallen andrehen *** --------------------------------------------- Eine Betrugskampagne nutzt Sicherheitslücken im Stock-Browser von Android aus, um Nutzern Abofallen und Premiumdienste zuzuschieben. Die Betrüger bauen gefälschte Webshops auf, um legitim zu erscheinen. (Abofallen, Server) --------------------------------------------- https://www.golem.de/news/betrugsnetzwerk-mit-fake-webshops-kinox-to-nutzer… *** DFN-CERT-2017-0524/">F5 Networks BIG-IP Protocol Security Module (PSM): Eine Schwachstelle ermöglicht einen Denial-of-Service-Angriff *** --------------------------------------------- Ein entfernter, nicht authentisierter Angreifer kann eine Schwachstelle im Traffic Management Microkernel (TMM) auf BIG-IP-Systemen durch die Versendung präparierten Netzwerkverkehrs für einen Denial-of-Service (DoS)-Angriff ausnutzen. --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2017-0524/ *** Erpressung durch iCloud-Fernlöschung: Wie Sie Ihr iPhone schützen *** --------------------------------------------- Unbekannte drohen damit, wahllos iPhones zu löschen - wenn Apple nicht zahlt. Die Angreifer sind offenbar in Besitz von iCloud-Zugangsdaten. Mac & i erklärt, wie man sich gegen einen derartigen Angriff wappnen kann. --------------------------------------------- https://heise.de/-3663802 *** LCDS - Leão Consultoria e Desenvolvimento de Sistemas LTDA ME LAquis SCADA *** --------------------------------------------- This advisory contains mitigation details for a path traversal vulnerability in the LCDS - Leão Consultoria e Desenvolvimento de Sistemas LTDA ME LAquis SCADA software. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-17-082-01 *** BD Kiestra PerformA and KLA Journal Service Applications Hard-Coded Passwords Vulnerability *** --------------------------------------------- This advisory contains mitigation details for a hard-coded password vulnerability in the Becton, Dickinson and Company (BD) Kiestra PerformA and KLA Journal Service applications that access the BD Kiestra Database. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSMA-17-082-01 *** Vuln: libpcre Multiple Security Vulnerabilities *** --------------------------------------------- libpcre is prone to the following multiple security vulnerabilities: 1. A denial-of-service vulnerability 2. Multiple stack-based buffer-overflow vulnerabilities Attackers can exploit these issues to run arbitrary code within the context of the affected application. Failed exploit attempts may result in denial-of-service conditions. libpcre1 in PCRE 8.40 is vulnerable; other versions may also be affected. --------------------------------------------- http://www.securityfocus.com/bid/97067 *** DFN-CERT-2017-0526/">F5 Networks BIG-IP Protocol Security Module (PSM): Eine Schwachstelle ermöglicht das Ausspähen von Informationen *** --------------------------------------------- Ein lokaler, einfach authentisierter Angreifer mit erweiterten Privilegien kann sensitive Daten ausspähen, die seit dem letzten Neustart betroffener Geräte angefallen sind. Dazu gehören beispielsweise die Passwörter zu kürzlich erstellten Benutzerkonten. --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2017-0526/ *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Multiple Vulnerabilities in NTP affect Power Hardware Management Console *** http://www.ibm.com/support/docview.wss?uid=nas8N1021868 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities CVE-2016-5636 and CVE-2016-5699 in Python affect IBM i *** http://www.ibm.com/support/docview.wss?uid=nas8N1021926 --------------------------------------------- *** IBM Security Bulletin: Cross-Site Scripting Vulnerability in IBM WebSphere Portal (CVE-2017-1120) *** http://www-01.ibm.com/support/docview.wss?uid=swg22000152 --------------------------------------------- *** IBM Security Bulletin: A cross-site scripting vulnerablity has been addressed in IBM Kenexa LMS on Cloud 5.1 *** http://www.ibm.com/support/docview.wss?uid=swg21999483 --------------------------------------------- *** IBM Security Bulletin: Multiple Security Vulnerabilties have been addressed in LCMS Premier on Cloud 11.0 *** http://www.ibm.com/support/docview.wss?uid=swg21998874 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect LCM8 & LCM16 KVM Switch Firmware and GCM16 & GCM32 KVM Switch Firmware *** https://support.podc.sl.edst.ibm.com/support/home/docdisplay?lndocid=migr-5… ---------------------------------------------

1 0

Tageszusammenfassung - Donnerstag 23-03-2017
by Daily end-of-shift report 23 Mar '17

23 Mar '17

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 22-03-2017 18:00 − Donnerstag 23-03-2017 18:00 Handler: Robert Waldner Co-Handler: n/a *** Google: Die Hälfte aller Android-Geräte erhält unsere Sicherheitspakete nicht *** --------------------------------------------- Google macht Fortschritte im Kampf gegen Malware im Play Store, muss aber eingestehen, dass mehr als eine halbe Milliarde Android-Geräte die regelmäßigen Sicherheitsupdates der Firma nicht erhält. Viele dieser Geräte haben eklatante Sicherheitslücken. --------------------------------------------- https://heise.de/-3662665 *** AIX for Penetration Testers *** --------------------------------------------- This was my first encounter with privilege escalation on AIX and I was pretty surprised by how little information I found online on enumerating AIX systems. ... It took me a little time going through various AIX system administration guides and command cheatsheets (links at the bottom of the post) and putting together a list of various post-exploitation techniques to use on the box. I decided to put this blog-post up with the hope that it will one day help another clueless pentester/red teamer. --------------------------------------------- https://thevivi.net/2017/03/19/aix-for-penetration-testers/ *** Avatar Rootkit: Decryption of the Key and Data *** --------------------------------------------- In this second article on the dropper, we will resume our analysis right where we left off: the decryption of the key and data. After the decryption, two structures are initialized. The equivalent pseudo-code is presented below. --------------------------------------------- http://resources.infosecinstitute.com/avatar-rootkit-dropper-analysis-part-… *** [R1] LCE 5.0.1 Fixes Two Third-party Library Vulnerabilities *** --------------------------------------------- Log Correlation Engine (LCE) 5.0.0 is impacted by multiple vulnerabilities reported in a third-party library and an encryption algorithm. LCE was errantly using 3DES on TCP port 1243. --------------------------------------------- http://www.tenable.com/security/tns-2017-09 *** Vuln: libavcodec CVE-2017-7206 Denial of Service Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/97006 *** VMware AirWatch Input Validation Flaw in Shared Filenames Lets Remote Authenticated Users Conduct Cross-Site Scripting Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1038116 *** Security Advisory - Bluetooth Unlock Bypassing Vulnerability in Some Huawei Mobile Phones *** --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20170323-… *** DFN-CERT-2017-0508/">Apple iTunes: Mehrere Schwachstellen ermöglichen u.a. das Ausführen beliebigen Programmcodes *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2017-0508/ *** Vuln: NfSen CVE-2017-6972 Unspecified Security Bypass Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/97016 *** DFN-CERT-2017-0506/">NTP: Mehrere Schwachstellen ermöglichen u.a. die Auführung beliebigen Programmcodes mit den Rechten des Dienstes *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2017-0506/ *** DFN-CERT-2017-0518/">Samba: Eine Schwachstelle ermöglicht das Ausspähen von Informationen *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2017-0518/ *** DFN-CERT-2017-0515/">Git: Eine Schwachstelle ermöglicht die Ausführung beliebigen Programmcodes *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2017-0515/ *** DFN-CERT-2017-0520/">BIG-IP Protocol Security Module (PSM): Eine Schwachstelle ermöglicht einen Denial-of-Service Angriff *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2017-0520/ *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: IBM TRIRIGA Application Privilege Escalation (CVE-2017-1153) *** http://www-01.ibm.com/support/docview.wss?uid=swg21999563 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in IBM Java SDK affects multiple IBM Rational products based on IBM Jazz technology *** http://www.ibm.com/support/docview.wss?uid=swg21999820 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM MQ and IBM MQ Appliance *** http://www.ibm.com/support/docview.wss?uid=swg22000304 --------------------------------------------- *** IBM Security Bulletin: IBM TRIRIGA Application Platform Cross-Site Scripting (XSS) (CVE-2016-9737) *** http://www-01.ibm.com/support/docview.wss?uid=swg21996200 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in Mozilla Network Security Services (NSS) affect IBM MQ Appliance (CVE-2016-2834, CVE-2016-5285, CVE-2016-8635) *** http://www-01.ibm.com/support/docview.wss?uid=swg21996836 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect Tivoli Storage FlashCopy Manager Unix (CVE-2016-6303, CVE-2016-2182, CVE-2016-2177, CVE-2016-2183, CVE-2016-6309, CVE-2016-7052, CVE-2016-2178, CVE-2016-6306) *** http://www.ibm.com/support/docview.wss?uid=swg22000209 --------------------------------------------- *** IBM Security Bulletin: IBM Jazz for Service Management (Jazz SM) is affected by a code execution vulnerability in IBM Tivoli Common Reporting (TCR) (CVE-2016-5983) *** http://www.ibm.com/support/docview.wss?uid=swg22000719 ---------------------------------------------

1 0

Tageszusammenfassung - Mittwoch 22-03-2017
by Daily end-of-shift report 22 Mar '17

22 Mar '17

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 21-03-2017 18:00 − Mittwoch 22-03-2017 18:00 Handler: Robert Waldner Co-Handler: n/a *** Cybellum verkauft Autostart-Funktion als Zero-Day *** --------------------------------------------- Mit kräftigen Worten, einem eigenen Namen und Logo und dem Prädikat "Zero-Day" stellt Cybellum eine Technik vor, mit der sich Malware in einem Windows-System verankern lässt -- nachdem es bereits die Kontrolle übernommen hat. --------------------------------------------- https://heise.de/-3662090 *** QNAP Storage Devices Multiple Flaws Let Remote Users Inject SQL Commands, Steal Cookies, Conduct Cross-Site Scripting and Clickjacking Attacks, Obtain Potentially Sensitive Informaiton, and Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1038091 *** Vuln: Malware Information Sharing Platform CVE-2017-7215 Multiple Cross Site Scripting Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/bid/96997 *** Vuln: Rockwell Automation FactoryTalk Activation CVE-2017-6015 Local Privilege Escalation Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/96996 *** Security Advisory - Information Leak Vulnerability in Huawei Hilink APP *** --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20170322-… *** Security Advisory - Phone Finder Bypass Vulnerability in Some Huawei Smart Phones *** --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20170322-… *** Phishingversuch bei der FH Oberösterreich *** --------------------------------------------- In einer gefälschten FH OOE IT-SERVICE DESK-Nachricht heißt es, dass Empfänger/innen ihr Webmail-Konto bestätigen müssen. Dazu sollen sie eine Website aufrufen und ihre Zugangsdaten bekannt geben. Es handelt sich um einen Phishingversuch. Wer der Aufforderung nachkommt, übermittelt Kriminellen die Zugangsdaten des FH OÖ-Webmailkontos. --------------------------------------------- https://www.watchlist-internet.at/phishing/phishingversuch-bei-der-fh-obero… *** Avatar Rootkit: Dropper Analysis Part 2 *** --------------------------------------------- In this second article on the dropper, we will resume our analysis right where we left off: the decryption of the key and data. After the decryption, two structures are initialized. The equivalent pseudo-code is presented below. --------------------------------------------- http://resources.infosecinstitute.com/avatar-rootkit-dropper-analysis-part-… *** Security Advisory - Sixteen OpenSSL Vulnerabilities on Some Huawei products *** --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20170322-… *** Intermediate Mitigation Measures May be Required for Apache Struts Vulnerabilities *** --------------------------------------------- The general consensus among InfoSec professionals is to patch critical vulnerabilities such as Apache Struts as soon as a patch is made available by the vendor. So why mightn't your company simply patch Apache Struts and go on your merry way? Not all events can be remediated immediately. Very often, intermediate mitigation measures must be taken to lower the risk of exploit and protect assets very quickly. --------------------------------------------- https://www.alienvault.com/blogs/security-essentials/intermediate-mitigatio… *** Passwortklau-Lücke in Lastpass geschlossen (oder auch nicht) *** --------------------------------------------- Eine Sicherheitslücke im Passwort-Manager Lastpass erlaubt das Auslesen von Passwörtern. Unter Umständen kann der Angreifer auch Code ausführen. Es gibt Berichte, dass der Fix von Lasspass die Lücke bisher nicht erfolgreich geschlossen hat. --------------------------------------------- https://heise.de/-3661616 *** Code Execution Vulnerability Found in Libpurple IM Library *** --------------------------------------------- A severe vulnerability has been disclosed in libpurple, the library used in the development of a number of popular instant messaging clients, including Pidgin and Adium for the macOS platform. Adium 1.5.10.2 is vulnerable and can be exploited to run arbitrary code remotely. ... Pidgin has been patched in version 2.12.0. --------------------------------------------- https://threatpost.com/code-execution-vulnerability-found-in-libpurple-im-l… *** Vuln: D-Link DIR-600M CVE-2017-5874 Cross Site Request Forgery Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/96999 *** Apple-Erpressung: Hacker drohen angeblich mit Fernlöschung von iPhones *** --------------------------------------------- Das Ändern der PIN aus der Ferne ist bei iPhone und iPad allerdings nur möglich, wenn der Nutzer keine Code-Sperre für sein Gerät eingerichtet hat - die Aktivierung der Code-Sperre ist auch deshalb dringend zu empfehlen. Um den Zugriff auf die eigenen iCloud-Daten besser zu schützen, sollte Apples Zwei-Faktor-Authentifizierung aktiviert werden. Die Sicherheitsfunktion hilft allerdings nicht gegen das Fernsperren und Fernlöschen... --------------------------------------------- https://www.heise.de/mac-and-i/meldung/Apple-Erpressung-Hacker-drohen-angeb… *** SAP Vulnerability Puts Business Data at Risk for Thousands of Companies *** --------------------------------------------- Researchers at ERPScan today disclosed details and a proof-of-concept exploit for a SAP GUI remote code execution vulnerability patched last week. --------------------------------------------- http://threatpost.com/sap-vulnerability-puts-business-data-at-risk-for-thou… *** Cisco Security Advisories *** --------------------------------------------- *** Cisco IOS and IOS XE Software DHCP Client Denial of Service Vulnerability *** https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… --------------------------------------------- *** Cisco IOS XE Software for Cisco ASR 920 Series Routers Zero Touch Provisioning Denial of Service Vulnerability *** https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… --------------------------------------------- *** Cisco IOS XE Software HTTP Command Injection Vulnerability *** https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… --------------------------------------------- *** Cisco IOS XE Software Web User Interface Denial of Service Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco IOS and IOS XE Software Layer 2 Tunneling Protocol Denial of Service Vulnerability *** https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… --------------------------------------------- *** Cisco IOx Data in Motion Stack Overflow Vulnerability *** https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… --------------------------------------------- *** Cisco Application-Hosting Framework Directory Traversal Vulnerability *** https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… --------------------------------------------- *** Cisco Application-Hosting Framework Arbitrary File Creation Vulnerability *** https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… --------------------------------------------- *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Fabric Manager *** https://support.podc.sl.edst.ibm.com/support/home/docdisplay?lndocid=migr-5… --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in Apache Tomcat affect SAN Volume Controller, Storwize family and FlashSystem V9000 products (CVE-2017-6056) *** http://www-01.ibm.com/support/docview.wss?uid=ssg1S1010022 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect IBM Sterling Connect:Direct for HP NonStop (CVE-2016-7055, CVE-2017-3732) *** http://www-01.ibm.com/support/docview.wss?uid=swg22000456 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Rational DOORS Web Access *** http://www.ibm.com/support/docview.wss?uid=swg21999797 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities CVE-2016-0736, CVE-2016-2161 and CVE-2016-8743 in IBM i HTTP Server *** http://www.ibm.com/support/docview.wss?uid=nas8N1021918 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in Open Source Samba, NTP and ISC BIND affect IBM Netezza Host Management *** http://www-01.ibm.com/support/docview.wss?uid=swg21997024 ---------------------------------------------

1 0

Tageszusammenfassung - Dienstag 21-03-2017
by Daily end-of-shift report 21 Mar '17

21 Mar '17

======================= = End-of-Shift report = ======================= Timeframe: Montag 20-03-2017 18:00 − Dienstag 21-03-2017 18:00 Handler: Petr Sikuta Co-Handler: Robert Waldner *** Kritische Sicherheitslücken in E-Learning-Plattform Moodle geschlossen *** --------------------------------------------- Moodle-Admins aufgepasst: Die Open-Source E-Learning-Plattform enthält Sicherheitslücken, welche es Angreifern ermöglichen, einen Moodle-Server zu kapern. --------------------------------------------- https://heise.de/-3660119 *** Personalized spam campaign targets Germany *** --------------------------------------------- The key detail of each message was the fact that the recipient's full name, mailing address, and telephone number were embedded in the middle of the message. --------------------------------------------- https://www.symantec.com/connect/blogs/personalized-spam-campaign-targets-g… *** Workaround? Abdrehen! *** --------------------------------------------- Langsam gibt es erste Details zu den 0-days, die im Vault-7-Leak enthalten sind.Betroffen sind u.A. Switche von Cisco. Patches sind noch nicht für alle Modelle verfügbar, laut Heise gibt es aber folgenden Workaround:Bis dahin empfiehlt der Hersteller Telnet auf betroffenen Geräte zu deaktivieren und bis zum Erscheinen des Patches auf SSH zu setzen. Das ist meiner Meinung nach viel zu kurz gegriffen. --------------------------------------------- http://www.cert.at/services/blog/20170321100440-1957.html *** OpenSSH Bugs Let Remote Users Decrypt Messages in Certain Cases and Let Remote Authenticated Users Create or Modify Files on the Target System *** --------------------------------------------- Impact: A remote authenticated server can create or modify files on the connected target user's system. A remote user may be able to decrypt messages in certain cases. Solution: The vendor has issued a fix (7.5). --------------------------------------------- http://www.securitytracker.com/id/1038071 *** Google: Zahl der gehackten Webseiten steigt rapide *** --------------------------------------------- Im Jahr 2016 wurden 32 Prozent mehr Webseiten gehackt, als im Jahr zuvor. Das geht aus den von Google erhobenen Daten zu infizierten Servern hervor. Die Firma gibt Webmastern deswegen Hilfestellung beim Verhindern von Hackerangriffen. --------------------------------------------- https://heise.de/-3660903 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in Apache Tomcat affect IBM UrbanCode Release *** http://www-01.ibm.com/support/docview.wss?uid=swg2C1000285 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in Apache Tomcat affect IBM UrbanCode Release *** http://www-01.ibm.com/support/docview.wss?uid=swg2C1000283 --------------------------------------------- *** IBM Security Bulletin: IBM Call Center for Commerce is affected by Cross Site Scripting (XSS) Vulnerability (CVE-2016-6056) *** http://www.ibm.com/support/docview.wss?uid=swg22000442 ---------------------------------------------

1 0

Tageszusammenfassung - Montag 20-03-2017
by Daily end-of-shift report 20 Mar '17

20 Mar '17

======================= = End-of-Shift report = ======================= Timeframe: Freitag 17-03-2017 18:00 − Montag 20-03-2017 18:00 Handler: Robert Waldner Co-Handler: n/a *** Malicious Subdirectories Strike Again *** --------------------------------------------- In a previous post, we illustrated how attackers were fetching information from compromised sites under their control to display spam content on other hacked websites. By adding malicious files into a directory and using the victim's database structure, attackers were able to inject ads and promote their products. This time, attackers used a similar technique with a little bit more sophistication to achieve their goals. Essay Spam Campaign This technique is now being used to distribute --------------------------------------------- https://blog.sucuri.net/2017/03/malicious-subdirectories-strike-again.html *** Mimikatz: Walkthrough *** --------------------------------------------- Security researchers have been obsessed with Windows security since the beginning of time. Various tools have been released over the years which try to weaken the security/bypass it in some way or the other. Mimikatz is a tool written in `C` as an attempt to play with Windows security. --------------------------------------------- http://resources.infosecinstitute.com/mimikatz-walkthrough/ *** Doctor Web: It is possible to decrypt files encrypted with Trojan.Encoder.10465 *** --------------------------------------------- March 17, 2017 Doctor Web has developed an algorithm that successfully decrypts files encrypted by Trojan.Encoder.10465. Trojan.Encoder.10465 poses a threat to Windows computers. The Trojan is written in Delphi. The encoder appends the extension .crptxxx to the infected files and also saves to the disk a text file named HOW_TO_DECRYPT.txt, which contains the following content: Warning!!! All your files are encrypted with AESalgorithm! --------------------------------------------- http://news.drweb.com/show/?i=11211&lng=en&c=9 *** Sicherheitsupdate in Sicht: Gravierende Telnet-Lücke bedroht zahlreiche Cisco-Switches *** --------------------------------------------- Offensichtlich hat Cisco den Vault-7-Leak analysiert und ist auf eine kritische Lücke in über 300 Modellen seiner Switch-Reihe mit IOS-Betriebsystem gestoßen. Bislang gibt es nur einen Workaround - ein Patch soll folgen. --------------------------------------------- https://heise.de/-3658915 *** RIPS - Finding vulnerabilities in PHP application *** --------------------------------------------- The biggest fear of any developer has always been that their site may get hacked and occasionally it does end up being hacked. For a very long time, the most popular stack being used for the development of website has been the LAMP Stack (Linux, MySQL, PHP/Perl/Python). --------------------------------------------- http://resources.infosecinstitute.com/rips-finding-vulnerabilities-php-appl… *** Browser: Update der Ask.com-Toolbar verteilt Malware *** --------------------------------------------- Die meisten Nutzer dürften sich ohnehin nur fragen, wie sie die Ask.com-Toolbar im Browser am schnellsten wieder loswerden. Doch es gibt ein weiteres Problem: Der Update-Prozess des Programms ist notorisch für Sicherheitslücken anfällig. (Malware, Virus) --------------------------------------------- https://www.golem.de/news/browser-update-der-ask-com-toolbar-verteilt-malwa… *** Gefälschte Virenwarnung auf dem Smartphone *** --------------------------------------------- Während der mobilen Nutzung des Smartphones erscheinen angebliche Virenwarnungen. Sie geben vor, dass das Endgerät mit Schadsoftware infiziert sei. Abhilfe schafft ein Schutzprogramm aus einer unbekannten Quelle. Es kann Schadsoftware installieren oder zu einem Abovertrag führen. --------------------------------------------- https://www.watchlist-internet.at/handy-abzocke/gefaelschte-virenwarnung-au… *** Low Orbit Ion Cannon: Star-Trek-Ransomware tarnt sich als DDoS-Tool *** --------------------------------------------- Wer einen DDoS-Angriff starten will, sollte seine Werkzeuge gut auswählen. Bestimmte Versionen der Low Orbit Ion Cannon starten derzeit keinen Überlastungsangriff, sondern die Verschlüsselung der eigenen Festplatte. Teuer wird es auch, wenn Spock die Festplatte entschlüsseln soll. (Star Trek, Applikationen) --------------------------------------------- https://www.golem.de/news/low-orbit-ion-cannon-star-trek-ransomware-tarnt-s… *** Cisco IOS and IOS XE Software Autonomic Networking Infrastructure Registrar Denial of Service Vulnerability *** --------------------------------------------- A vulnerability in the Autonomic Networking Infrastructure (ANI) registrar feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition.The vulnerability is due to incomplete input validation on certain crafted packets. An attacker could exploit this vulnerability by sending a crafted autonomic network channel discovery packet to a device that has all the following characteristics: --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… *** Cisco IOS and IOS XE Software IPv6 Denial of Service Vulnerability *** --------------------------------------------- A vulnerability in the Autonomic Networking Infrastructure (ANI) feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition.The vulnerability is due to incomplete input validation on certain crafted packets. An attacker could exploit this vulnerability by sending a crafted IPv6 packet to a device that is running a Cisco IOS Software or Cisco IOS XE Software release that --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: IBM Flex System Manager (FSM) is affected by bash vulnerabilities *** http://www-01.ibm.com/support/docview.wss?uid=isg3T1024962 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in IBM Java SDK affects IBM Application Delivery Intelligence v1.0.1, v1.0.1.1, and v1.0.2. (CVE-2016-2183, CVE-2016-5546, CVE-2016-5547,CVE-2016-5548, CVE-2016-5549) *** http://www-01.ibm.com/support/docview.wss?uid=swg22000014 --------------------------------------------- *** IBM Security Bulletin: IBM Flex System Manager (FSM) is affected by php5 vulnerabilities (CVE-2016-9933, CVE-2016-9935) *** http://www-01.ibm.com/support/docview.wss?uid=isg3T1024961 --------------------------------------------- *** IBM Security Bulletin: IBM Flex System Manager (FSM) is affected by an International Components for Unicode (ICU) vulnerability (CVE-2014-9911) *** http://www-01.ibm.com/support/docview.wss?uid=isg3T1024958 --------------------------------------------- *** IBM Security Bulletin: IBM Security Key Lifecycle Manager is affected by Query Parameter in SSL Request (CVE-2016-6102) *** http://www.ibm.com/support/docview.wss?uid=swg22000359 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in OpenSSL affect WebSphere Message Broker and IBM Integration Bus *** http://www.ibm.com/support/docview.wss?uid=swg22000536 ---------------------------------------------

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily March 2017