October 2018 - Daily

Tageszusammenfassung - 31.10.2018
by Daily end-of-shift report 31 Oct '18

31 Oct '18

===================== = End-of-Day report = ===================== Timeframe: Dienstag 30-10-2018 18:00 − Mittwoch 31-10-2018 18:00 Handler: Dimitri Robl Co-Handler: Stephan Richter Next End-of-Day report: 2018-11-02 ===================== = News = ===================== ∗∗∗ Square, PayPal POS Hardware Open to Multiple Attack Vectors ∗∗∗ --------------------------------------------- Popular card readers like Square and PayPal have various flaws that allow attacks ranging from fraud to card data theft. --------------------------------------------- https://threatpost.com/square-paypal-pos-hardware-open-to-multiple-attack-v… ∗∗∗ Fallout Exploit Kit Releases the Kraken Ransomware on Its Victims ∗∗∗ --------------------------------------------- Alexandr Solad and Daniel Hatheway of Recorded Future are coauthors of this post. Read Recorded Future’s version of this analysis. Rising from the deep, Kraken Cryptor ransomware has had a notable development path in recent months. The first signs of Kraken came in mid-August on a popular underground forum. In mid-September it was reported that [...] --------------------------------------------- https://securingtomorrow.mcafee.com/mcafee-labs/fallout-exploit-kit-release… ∗∗∗ Using PHP 5 Becomes Dangerous in 2 Months ∗∗∗ --------------------------------------------- WordPress, Joomla, Drupal and many other popular website CMSs were written in a programming language called PHP. PHP version 5 is about to reach end-of-life and will stop receiving security updates in two months. Many WordPress and other PHP websites remain on version 5.6 or older. --------------------------------------------- https://www.wordfence.com/blog/2018/10/php5-dangerous/ ∗∗∗ 5 Types of Malware Currently Affecting macOS ∗∗∗ --------------------------------------------- Mac malware, or macOS malware, exists contrary to the popular belief that Apple’s operating system is immune to online threats. Cybersecurity researchers have been closely observing the threat landscape only to conclude that malware infections targeting Mac devices have increased in 2018. --------------------------------------------- https://www.tripwire.com/state-of-security/security-awareness/5-types-of-ma… ∗∗∗ Wenn Sie in eine Abo-Falle getappt sind… ∗∗∗ --------------------------------------------- Auf der Suche nach kostenlosen Angeboten und gratis Dienstleistungen werden Sie im Internet schnell fündig. Doch Vorsicht: Hier ist nicht alles Gold, was glänzt! Oft handelt es sich nämlich um Abo-Fallen, bei denen Ihnen unbegründet Rechnungen zugeschickt werden und man Ihnen mit Inkassobüro oder Rechtsanwaltsschreiben droht. Die Lösung? Auf gar keinen Fall bezahlen! --------------------------------------------- https://www.watchlist-internet.at/news/wenn-sie-in-eine-abo-falle-getappt-s… ∗∗∗ Warnung vor sierrasport-berlin.de ∗∗∗ --------------------------------------------- Der Online-Shop sierrasport-berlin.de vertreibt Markenfälschungen. Das können Konsument/innen daran erkennen, dass sämtliche Produkte stark rabattiert und lagernd sind. Kaufen sie bei sierrasport-berlin.de ein, müssen sie mit hohen Zusatzkosten, rechtlichen Konsequenzen und einem Identitätsdiebstahl rechnen. Von einem Einkauf bei sierrasport-berlin.de wird dringend abgeraten! --------------------------------------------- https://www.watchlist-internet.at/news/warnung-vor-sierrasport-berlinde/ ===================== = Vulnerabilities = ===================== ∗∗∗ DSA-2018-136: Dell EMC Integrated Data Protection Appliance Undocumented Accounts Vulnerability ∗∗∗ --------------------------------------------- Integrated Data Protection Appliance (iDPA) contains undocumented accounts with limited access which may potentially be used by a malicious user to compromise the affected system. --------------------------------------------- https://seclists.org/fulldisclosure/2018/Oct/53 ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (gitlab), Debian (gnutls28), Fedora (audiofile, coreutils, firefox, hesiod, kernel, kernel-headers, kernel-tools, libssh, lighttpd, mosquitto, opencc, patch, php-horde-nag, sos-collector, strongswan, and thunderbird), Gentoo (libxkbcommon, mutt-1.10, postgresql, systemd, xen, and xorg-server), Mageia (curl, libtiff, samba, spamassassin, and unzip), Oracle (java-1.7.0-openjdk and python-paramiko), Red Hat (git, glusterfs, java-1.7.0-openjdk, [...] --------------------------------------------- https://lwn.net/Articles/770203/ ∗∗∗ VMSA-2015-0008.2 ∗∗∗ --------------------------------------------- VMware product updates address information disclosure issue. Updated advisory to add vCloud Director fixes for 9.0.0.x and 9.1.0.x versions that now address CVE-2015-3269. --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2015-0008.html ∗∗∗ HPESBHF03894 rev.1 - HPE Integrated Lights-Out 5 (iLO 5) Firmware Updates, Local Bypass of Security Restrictions ∗∗∗ --------------------------------------------- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_n… ∗∗∗ ElegantThemes (divi, extra, divi-builder) - Authenticated Stored Cross-Site Scripting (XSS) ∗∗∗ --------------------------------------------- https://wpvulndb.com/vulnerabilities/9140 ∗∗∗ Apple security updates ∗∗∗ --------------------------------------------- https://support.apple.com/en-us/HT201222 ∗∗∗ Security Advisory - SegmentSmack Vulnerability in Linux Kernel ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2018/huawei-sa-20181031-… ∗∗∗ Security Advisory - Improper Authorization Vulnerability in Huawei Watches ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2018/huawei-sa-20181031-… ∗∗∗ IBM Security Bulletin: IBM Robotic Process Automation could disclose sensitive information in a web request (CVE-2018-1878) ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10735977 ∗∗∗ IBM Security Bulletin: Passwords are unencrypted locally in IBM Robotic Process Automation with Automation Anywhere (CVE-2018-1877) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10735973 ∗∗∗ IBM Security Bulletin: Passwords printed to log files in IBM Robotic Process Automation with Automation Anywhere (CVE-2018-1876) ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10735967 ∗∗∗ IBM Security Bulletin: ViewONE is vulnerable to XXE attack when opening PDF documents ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10733815 ∗∗∗ IBM Security Bulletin: IBM RackSwitch firmware products are affected by vulnerabilities in Python (CVE-2016-5636 CVE-2017-1000158) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10737147 ∗∗∗ IBM Security Bulletin: IBM Flex System switch firmware products are affected by vulnerabilities in Python (CVE-2016-5636 CVE-2017-1000158) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10737125 ∗∗∗ IBM Security Bulletin: IBM BladeCenter Switch Modules are affected by vulnerabilities in python (CVE-2016-5636 CVE-2017-1000158) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10736105 ∗∗∗ IBM Security Bulletin: Remote Code Execution vulnerability in IBM Robotic Process Automation with Automation Anywhere (CVE-2018-1552) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22016247 ∗∗∗ XSS vulnerability in undisclosed TMUI page CVE-2018-15314 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K04524282 ∗∗∗ XSS vulnerability in undisclosed TMUI page CVE-2018-15313 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K21042153 ∗∗∗ TMM vulnerability CVE-2018-15320 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K72442354 ∗∗∗ BIG-IP tmsh vulnerability CVE-2018-15321 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K01067037 ∗∗∗ MQTT vulnerability CVE-2018-15323 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K26583415 ∗∗∗ BIG-IP Configuration utility vulnerability CVE-2018-15327 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K20222812 ∗∗∗ tmsh utility vulnerability CVE-2018-15322 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K28003839 ∗∗∗ BIG-IP APM portal access vulnerability CVE-2018-15324 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K52206731 ∗∗∗ TMM vulnerability CVE-2018-15319 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K64208870 ∗∗∗ BIG-IP iControl & tmsh vulnerability CVE-2018-15325 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K77313277 ∗∗∗ BIG-IP APM CRL vulnerability CVE-2018-15326 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K34652116 ∗∗∗ TMM vulnerability CVE-2018-15318 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K16248201 ∗∗∗ TMM vulnerability CVE-2018-15317 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K43625118 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 30.10.2018
by Daily end-of-shift report 30 Oct '18

30 Oct '18

===================== = End-of-Day report = ===================== Timeframe: Montag 29-10-2018 18:00 − Dienstag 30-10-2018 18:00 Handler: Dimitri Robl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ CommonRansom Ransomware Demands RDP Access to Decrypt Files ∗∗∗ --------------------------------------------- A new ransomware called CommonRansom was discovered that has a very bizarre request. In order to decrypt a computer after a payment is made, they require the victim to open up Remote Desktop Services on the affected computer and send them admin credentials in order to decrypt the victims files. --------------------------------------------- https://www.bleepingcomputer.com/news/security/commonransom-ransomware-dema… ∗∗∗ Krankenkassen: Vivy-App gibt Daten preis ∗∗∗ --------------------------------------------- Sicherheitsforscher haben einige gravierende Lücken in der Krankenkassen-App Vivy gefunden. Unter anderem konnte auf Dokumente, die man mit dem Arzt teilte, unberechtigt zugegriffen werden. (Medizin, Verschlüsselung) --------------------------------------------- https://www.golem.de/news/krankenkassen-vivy-app-gibt-daten-preis-1810-1373… ∗∗∗ Disrupting the Flow: Exposed and Vulnerable Water and Energy Infrastructures ∗∗∗ --------------------------------------------- by Stephen Hilt, Numaan Huq, Vladimir Kropotov, Robert McArdle, Cedric Pernet, and Roel Reyes Energy and water are two of the most central critical infrastructures (CIs). Both sectors have undergone necessary changes to reflect the latest in technology and improve how natural resources are harnessed and distributed. At present, these changes are heading toward more interconnected [...] --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/5LDw-xUlnAw/ ∗∗∗ Sicherheitsupdates: Multifunktionsgeräte von Lexmark anfällig für "böse" Faxe ∗∗∗ --------------------------------------------- Sicherheitspatches für Drucker-Fax-Kopier-Kombinationen von Lexmark schließen zwei Lücken. Eine davon gilt als kritisch. --------------------------------------------- http://heise.de/-4206719 ∗∗∗ Systemd: DHCPv6-Pakete können Linux-Rechner kapern ∗∗∗ --------------------------------------------- Eine Systemd-Komponente in vielen modernen Linux-Systemen kann missbraucht werden, um den Rechner übers Netz zu kapern. --------------------------------------------- http://heise.de/-4206800 ∗∗∗ Erpresserische E-Mails drohen mit Masturbationsvideo ∗∗∗ --------------------------------------------- Kriminelle versenden betrügerische Nachrichten. Darin behaupten sie, dass sie das Passwort der Empfänger/innen kennen, angeblich Zugriff auf ihren Computer haben und deshalb über Masturbationsvideos verfügen. Die Adressat/innen sollen Bitcoins bezahlen, damit es zu keiner Veröffentlichung der Aufnahmen kommt. Konsument/innen können das Schreiben ignorieren, denn es ist erfunden. Eine Reaktion ist nicht erforderlich. --------------------------------------------- https://www.watchlist-internet.at/news/erpresserische-e-mails-drohen-mit-ma… ===================== = Vulnerabilities = ===================== ∗∗∗ Squid Proxy Cache Security Update Advisory SQUID-2018:4 ∗∗∗ --------------------------------------------- Due to incorrect input handling, Squid is vulnerable to a Cross-Site Scripting vulnerability when generating HTTPS response messages about TLS errors. --------------------------------------------- http://www.squid-cache.org/Advisories/SQUID-2018_4.txt ∗∗∗ Squid Proxy Cache Security Update Advisory SQUID-2018:5 ∗∗∗ --------------------------------------------- Due to a memory leak in SNMP query rejection code, Squid is vulnerable to a denial of service attack. --------------------------------------------- http://www.squid-cache.org/Advisories/SQUID-2018_5.txt ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by CentOS (xorg-x11-server), Debian (xen), Red Hat (389-ds-base, binutils, curl and nss-pem, fuse, glibc, glusterfs, GNOME, gnutls, jasper, java-1.7.0-openjdk, kernel, kernel-alt, kernel-rt, krb5, libcdio, libkdcraw, libmspack, libreoffice, libvirt, openssl, ovmf, python, python-paramiko, qemu-kvm, qemu-kvm-ma, samba, setup, sssd, wget, wpa_supplicant, X.org X11, xerces-c, zsh, and zziplib), and SUSE (ardana-monasca, ardana-spark, kafka, kafka-kit, [...] --------------------------------------------- https://lwn.net/Articles/770031/ ∗∗∗ Sandbox Bypass in Script Security and Pipeline Groovy Plugins ∗∗∗ --------------------------------------------- https://jenkins.io/security/advisory/2018-10-29/ ∗∗∗ GitLab Security Release: 11.4.3, 11.3.8, and 11.2.7 ∗∗∗ --------------------------------------------- https://about.gitlab.com/2018/10/29/security-release-gitlab-11-dot-4-dot-3-… ∗∗∗ IBM Security Bulletin: Code execution vulnerability with OpenID connect in WebSphere Application Server Liberty (CVE-2018-1851) ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10735105 ∗∗∗ IBM Security Bulletin: Vulnerability in the IBM FlashSystem model V840 ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10732968 ∗∗∗ IBM Security Bulletin: A vulnerability in Samba affects IBM Spectrum Scale SMB protocol access method (CVE-2018-10858) ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10732876 ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Content Collector for SAP Applications ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10737813 ∗∗∗ IBM Security Bulletin: A vulnerability in IBM Java SDK affects IBM Spectrum Scale ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10735169 ∗∗∗ IBM Security Bulletin: Multiple Vulnerabilities in IBM Java SDK affect IBM Integration Designer ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10733845 ∗∗∗ reposync vulnerability CVE-2018-10897 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K23200408 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 29.10.2018
by Daily end-of-shift report 29 Oct '18

29 Oct '18

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 25-10-2018 18:00 − Montag 29-10-2018 18:00 Handler: Dimitri Robl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Windows 10 Bug Allowed UWP Apps Full Access to File System ∗∗∗ --------------------------------------------- A bug in Windows 10 allowed UWP apps (Universal Windows Platform) to have access to the entire file system in Windows without permission from the user. This could have allowed a malicious app to access any data stored on the computer without the knowledge or consent of the user. --------------------------------------------- https://www.bleepingcomputer.com/news/security/windows-10-bug-allowed-uwp-a… ∗∗∗ Linux und BSD: Sicherheitslücke in X.org ermöglicht Root-Rechte ∗∗∗ --------------------------------------------- Eine Sicherheitslücke im Displayserver X.org erlaubt unter bestimmten Umständen das Überschreiben von Dateien und das Ausweiten der Benutzerrechte. Der passende Exploit passt in einen Tweet. (Sicherheitslücke, OpenBSD) --------------------------------------------- https://www.golem.de/news/linux-und-bsd-sicherheitsluecke-in-x-org-ermoegli… ∗∗∗ Sicherheitslücke: Steuerung von Bau-Kran lässt sich übernehmen ∗∗∗ --------------------------------------------- Eine Sicherheitslücke in der kabellosen Kransteuerung Telecrane F25 ermöglicht es, Signale mitzuschneiden und mit diesen anschließend den Kran fernzusteuern. Ein Sicherheitsupdate steht bereit. (Sicherheitslücke, Mobil) --------------------------------------------- https://www.golem.de/news/sicherheitsluecke-steuerung-von-bau-kran-laesst-s… ∗∗∗ OWASP Top 10 Security Risks – Part II ∗∗∗ --------------------------------------------- It is National Cyber Security Awareness Month and in order to bring awareness to what threatens the integrity of websites, we have started a series of posts on the OWASP top 10 security risks. --------------------------------------------- https://blog.sucuri.net/2018/10/owasp-top-10-security-risks-part-ii.html ∗∗∗ The D in Systemd stands for Dammmmit! A nasty DHCPv6 packet can pwn a vulnerable Linux box ∗∗∗ --------------------------------------------- Hole opens up remote-code execution to miscreants – or a crash, if youre lucky A security bug in Systemd can be exploited over the network to, at best, potentially crash a vulnerable Linux machine, or, at worst, execute malicious code on the box. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2018/10/26/systemd_dhc… ∗∗∗ Google schreibt Android-Herstellern zwei Jahre Sicherheitspatches vor ∗∗∗ --------------------------------------------- In einem Vertrag schreibt Google Herstellern von Android-Smartphones regelmäßige Sicherheitsupdates vor. Diese Verpflichtung gilt bereits seit dem Sommer. --------------------------------------------- http://heise.de/-4203113 ∗∗∗ Ransomware and the enterprise: A new white paper ∗∗∗ --------------------------------------------- Ransomware remains a serious threat and this new white paper explains what enterprises need to know, and do, to reduce risk The post Ransomware and the enterprise: A new white paper appeared first on WeLiveSecurity --------------------------------------------- https://www.welivesecurity.com/2018/10/29/ransomware-enterprise-new-white-p… ===================== = Vulnerabilities = ===================== ∗∗∗ GEOVAP Reliance 4 SCADA/HMI ∗∗∗ --------------------------------------------- This advisory includes mitigations for a cross-site scripting vulnerability in GEOVAPs Reliance 4 SCADA/HMI system. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-18-298-01 ∗∗∗ Advantech WebAccess ∗∗∗ --------------------------------------------- This advisory includes mitigations for stack-based buffer overflow, and improper access control vulnerabilities in Advantechs WebAccess. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-18-298-02 ∗∗∗ Cisco Advanced Malware Protection for Endpoints on Windows DLL Preloading Vulnerability ∗∗∗ --------------------------------------------- A vulnerability in the DLL loading component of Cisco Advanced Malware Protection (AMP) for Endpoints on Windows could allow an authenticated, local attacker to disable system scanning services or take other actions to prevent detection of unauthorized intrusions. --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (firefox), CentOS (firefox), Debian (389-ds-base, openjdk-8, thunderbird, and xorg-server), Fedora (firefox), openSUSE (GraphicsMagick, jhead, mysql-community-server, ntp, postgresql96, python-cryptography, rust, tomcat, webkit2gtk3, and zziplib), Scientific Linux (firefox), and SUSE (clamav, firefox, ImageMagick, libgit2, net-snmp, smt, wpa_supplicant, and xorg-x11-server). --------------------------------------------- https://lwn.net/Articles/769613/ ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (xorg-server), Debian (graphicsmagick, libmspack, paramiko, ruby2.1, teeworlds, and tiff), Fedora (lldpad), Mageia (bitcoin, blueman, busybox, dhcp, exempi, firefox, kernel, kernel-linus, kernel-tmb, lilypond, ruby, and x11-server), openSUSE (audiofile, clamav, hostapd, ImageMagick, lcms2, libgit2, mercurial, net-snmp, and wpa_supplicant), SUSE (audiofile, binutils, kdelibs3, lcms2, mysql, openssh, and xen), and Ubuntu (mysql-5.5 and xorg-server, [...] --------------------------------------------- https://lwn.net/Articles/769891/ ∗∗∗ WebKitGTK+ 2.22.3 released! ∗∗∗ --------------------------------------------- This is a bug fix release in the stable 2.22 series. What’s new in the WebKitGTK+ 2.22.3 release? [...] Fix a memory leak during media playback when using playbin3. Fix portions of Web views not being rendered after resizing. Fix Resource Timing reporting for elements. Fix the build with the remote Web Inspector [...] --------------------------------------------- https://webkitgtk.org/2018/10/29/webkitgtk2.22.3-released.html ∗∗∗ OpenSSL: Eine Schwachstelle ermöglicht das Ausspähen des privaten Schlüssels ∗∗∗ --------------------------------------------- https://adv-archiv.dfn-cert.de/adv/2018-2188/ ∗∗∗ IBM Security Bulletin: Vyatta 5600 vRouter Software Patches – Release 1801r ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10737409 ∗∗∗ IBM Security Bulletin: Cross-site scripting vulnerability affects IBM® Rational® Team Concert ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10737301 ∗∗∗ IBM Security Bulletin: Cross-site scripting vulnerability in CacheMonitor for WebSphere Application Server (CVE-2018-1767) ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10729547 ∗∗∗ Microsoft Skype for Business Audio File Processing Flaw Lets Remote Users Execute Arbitrary Code ∗∗∗ --------------------------------------------- http://www.securitytracker.com/id/1041956 ∗∗∗ Apache Tomcat vulnerability CVE-2018-11784 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K64921482 ∗∗∗ Mozilla NSS vulnerability CVE-2018-12384 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K41738501 ∗∗∗ HPESBMU03895 rev.1 - HPE Real Time Management System (RTMS), Multiple Remote Security Issues ∗∗∗ --------------------------------------------- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_n… ∗∗∗ HPESBHF03869 rev.1 - HPE Windows Firmware Installer for certain HPE Gen9,Gen8, G7, and G6 Servers, Local Disclosure of Privileged Information ∗∗∗ --------------------------------------------- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_n… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 25.10.2018
by Daily end-of-shift report 25 Oct '18

25 Oct '18

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 24-10-2018 18:00 − Donnerstag 25-10-2018 18:00 Handler: Dimitri Robl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ sLoad Banking Trojan Downloader Displays Sophisticated Recon and Targeting ∗∗∗ --------------------------------------------- The sLoad downloader is an example of the stealthy, smart malware trend. --------------------------------------------- https://threatpost.com/sload-banking-trojan-downloader-displays-sophisticat… ∗∗∗ Magecart Cybergang Targets 0days in Third-Party Magento Extensions ∗∗∗ --------------------------------------------- Over two dozen third-party ecommerce plugins contain zero-day vulnerabilities being exploited in a recent Magecart campaign. --------------------------------------------- https://threatpost.com/magecart-cybergang-targets-0days-in-third-party-mage… ∗∗∗ BSI-Mindeststandard zur Protokollierung und Detektion von Cyber-Angriffen ∗∗∗ --------------------------------------------- Cyber-Angriffe auf die IT-Systeme der Bundesverwaltung finden täglich statt. Neben ungezielten Massenangriffen sind die Netze des Bundes auch gezielten Angriffskampagnen ausgesetzt. Um die Detektion von Cyber-Angriffen zu verbessern, hat das Bundesamt für Sicherheit in der Informationstechnik (BSI) einen Mindeststandard zur Protokollierung und der darauf basierenden Erkennung von Cyber-Angriffen definiert. --------------------------------------------- https://www.bsi.bund.de/DE/Presse/Pressemitteilungen/Presse2018/Mindeststan… ∗∗∗ EU-Kommission will Zertifizierung für sichere Internetgeräte schaffen ∗∗∗ --------------------------------------------- Die EU arbeitet an einer Verordnung zur Sicherheitszertifizierung, die insbesondere die Geräte im Internet of Things in den Blick nimmt. --------------------------------------------- http://heise.de/-4202642 ∗∗∗ Sicherheitsupdate: Gefährliche Lücke in Cisco Webex Meetings ∗∗∗ --------------------------------------------- Angreifer könnten den Update-Mechanismus von Webex missbrauchen, um eigenen Code auszuführen. Ein Sicherheitsupdate schließt die Schwachstelle. --------------------------------------------- http://heise.de/-4202886 ∗∗∗ Gandcrab: Aktualisiertes Entschlüsselungstool für Erpressungstrojaner ∗∗∗ --------------------------------------------- Opfer der Ransomware Gandcrab in den Versionen 1, 4 und 5 können ihre Daten nun kostenlos entschlüsseln. --------------------------------------------- http://heise.de/-4203283 ∗∗∗ Sextortion emails: They're probably not watching you ∗∗∗ --------------------------------------------- Yes, those sextortion email scams using old passwords are still making the rounds. How can you spot a real sextortion attempt from an empty threat? And when should you report to authorities? Read on to find out. --------------------------------------------- https://blog.malwarebytes.com/101/2018/10/sextortion-emails-theyre-probably… ===================== = Vulnerabilities = ===================== ∗∗∗ Cisco Webex Meetings Desktop App Update Service Command Injection Vulnerability ∗∗∗ --------------------------------------------- A vulnerability in the update service of Cisco Webex Meetings Desktop App for Windows could allow an authenticated, local attacker to execute arbitrary commands as a privileged user.The vulnerability is due to insufficient validation of user-supplied parameters. An attacker could exploit this vulnerability by invoking the update service command with a crafted argument. An exploit could allow the attacker to run arbitrary commands with SYSTEM user privileges. --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Xen Security Advisory 278 v1 - x86: Nested VT-x usable even when disabled ∗∗∗ --------------------------------------------- When running HVM guests, virtual extensions are enabled in hardware because Xen is using them. As a result, a guest can blindly execute the virtualisation instructions, and will exit to Xen for processing. --------------------------------------------- https://lists.xenproject.org/archives/html/xen-announce/2018-10/msg00000.ht… ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (389-ds-base, clamav, firefox-esr, and mosquitto), openSUSE (Chromium and firefox), Oracle (firefox and kernel), Red Hat (chromium-browser, firefox, java-1.6.0-sun, java-1.7.0-oracle, and java-1.8.0-oracle), SUSE (dom4j, exempi, mercurial, ntp, python-cryptography, tiff, tomcat, and webkit2gtk3), and Ubuntu (audiofile and firefox). --------------------------------------------- https://lwn.net/Articles/769529/ ∗∗∗ IBM Security Bulletin: Vulnerability in OpenSSH affects AIX (CVE-2018-15473) Security Bulletin ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10733751 ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM OS Image for Red Hat Linux Systems on IBM PureApplication ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10728607 ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Platform Symphony and IBM Spectrum Symphony ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10732846 ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in WebSphere Application Server Admin Console affect IBM Spectrum Control (formerly Tivoli Storage Productivity Center) (CVE-2018-1770, CVE-2018-1777) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10737065 ∗∗∗ IBM Security Bulletin: Rational DOORS Web Access is affected by Apache Tomcat vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/support/docview.wss?uid=ibm10735863 ∗∗∗ IBM Security Bulletin: A vulnerability in Samba affects IBM OS Image for Red Hat Linux Systems on IBM PureApplication (CVE-2018-1050) ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10728649 ∗∗∗ IBM Security Bulletin : IBM Storwize V7000 Unified is affected by multiple GSKit vulnerabilities in GPFS ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10734249 ∗∗∗ IBM Security Bulletin: IBM Security Access Manager is affected by multiple vulnerabilities in GSKit ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22016890 ∗∗∗ IBM Security Bulletin: IBM WebSphere Commerce could allow some server-side code injection (CVE-2018-1808) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10735905 ∗∗∗ Reflected XSS vulnerability in an undisclosed Configuration utility page CVE-2018-15315 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K41704442 Next End-of-Day report: 2018-10-29 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 24.10.2018
by Daily end-of-shift report 24 Oct '18

24 Oct '18

===================== = End-of-Day report = ===================== Timeframe: Dienstag 23-10-2018 18:00 − Mittwoch 24-10-2018 18:00 Handler: Dimitri Robl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ The Key New Security Features & Capabilities to Know in Windows 10 ∗∗∗ --------------------------------------------- Last year's WannaCry and Petya malware outbreaks couldn't breach Windows 10's latest security defenses, but companies still running outdated [...] --------------------------------------------- https://www.beyondtrust.com/blog/key-new-security-features-in-windows-10/ ∗∗∗ Hacker Discloses New Windows Zero-Day Exploit On Twitter ∗∗∗ --------------------------------------------- A security researcher with Twitter alias SandboxEscaper—who two months ago publicly dropped a zero-day exploit for Microsoft Windows Task Scheduler—has yesterday released another proof-of-concept exploit for a new Windows zero-day vulnerability. --------------------------------------------- https://thehackernews.com/2018/10/windows-zero-day-exploit.html ∗∗∗ Sicherheitsupdates: Backup-Software von Arcserve kann Daten leaken ∗∗∗ --------------------------------------------- Angreifer könnten unberechtigt auf Daten von Host-Systemen, auf denen die Backup-Lösung Arcserve Unified Data Protection läuft, zugreifen. --------------------------------------------- http://heise.de/-4202167 ∗∗∗ Einkaufsbetrug mit gefälschten Smile Bank-Nachrichten ∗∗∗ --------------------------------------------- Privatverkäufer/innen erhalten Nachrichten von Kriminellen. Sie geben vor, im Ausland zu sein und wollen die angebotene Ware kaufen. Sie überweisen angeblich einen überhöhten Geldbetrag an ihre Vertragspartner/innen. Das sollen gefälschte Smile Bank-Nachrichten belegen. Schließlich sollen Verkäufer/innen den Differenzbetrag und die Ware ins Ausland senden. Dadurch verlieren sie ihre personenbezogenen Daten, ihr Geld und ihre Produkte an Betrüger/innen. --------------------------------------------- https://www.watchlist-internet.at/news/einkaufsbetrug-mit-gefaelschten-smil… ∗∗∗ Nike-Markenfälscher auf coldenemy.com ∗∗∗ --------------------------------------------- Die neuesten Schuhe von Nike um 70 Prozent vergünstigt? Das gibt's auf coldenemy.com. Wer hier bestellt, erhält minderwertige Ware, die nichts mit dem gekauften Produkt zu tun hat. Außerdem gelangen Kredit- und Personendaten in die Hände von Kriminellen. --------------------------------------------- https://www.watchlist-internet.at/news/nike-markenfaelscher-auf-coldenemyco… ===================== = Vulnerabilities = ===================== ∗∗∗ Advantech WebAccess ∗∗∗ --------------------------------------------- This advisory includes mitigations for stack-based buffer overflow, external control of file name or path, improper privilege management, and path traversal vulnerabilities in Advantechs WebAccess. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-18-296-01 ∗∗∗ GAIN Electronic Co. Ltd SAGA1-L Series ∗∗∗ --------------------------------------------- This advisory includes mitigations for authentication bypass by capture-relay, improper access control, and improper authentication vulnerabilities in GAIN Electronics SAGA1-L series transmitters. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-18-296-02 ∗∗∗ Telecrane F25 Series ∗∗∗ --------------------------------------------- This advisory includes mitigations for an authentication bypass by capture-replay vulnerability in the Telecrane F25 Series software. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-18-296-03 ∗∗∗ BitDefender Digital Signature Bypass Lets Remote Users Execute Arbitrary Code ∗∗∗ --------------------------------------------- A remote user can cause arbitrary code that is located elsewhere to be executed on the target users system due to a bypass of the digital signature GravityZone verification tools. Additional information is available at: https://labs.nettitude.com/blog/cve-2018-8955-bitdefender-gravityzone-arbit… --------------------------------------------- https://www.securitytracker.com/id/1041940 ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Fedora (hesiod, lighttpd, and opencc), openSUSE (apache-pdfbox, net-snmp, pam_pkcs11, rpm, tiff, udisks2, and wireshark), SUSE (dhcp, ghostscript-library, ImageMagick, libraw, net-snmp, ntp, postgresql96, rust, tiff, xen, and zziplib), and Ubuntu (mysql-5.5, mysql-5.7). --------------------------------------------- https://lwn.net/Articles/769415/ ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ ∗∗∗ October 23, 2018 TNS-2018-13 [R1] LCE 5.1.1 Fixes Multiple Third-party Vulnerabilities ∗∗∗ --------------------------------------------- http://www.tenable.com/security/tns-2018-13 ∗∗∗ October 23, 2018 TNS-2018-14 [R1] Nessus 8.0.0 Fixes Multiple Third-party Vulnerabilities ∗∗∗ --------------------------------------------- http://www.tenable.com/security/tns-2018-14 ∗∗∗ Security vulnerabilities fixed in Firefox ESR 60.3 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2018-27/ ∗∗∗ Security vulnerabilities fixed in Firefox 63 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2018-26/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 23.10.2018
by Daily end-of-shift report 23 Oct '18

23 Oct '18

===================== = End-of-Day report = ===================== Timeframe: Montag 22-10-2018 18:00 − Dienstag 23-10-2018 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Malicious Powershell using a Decoy Picture ∗∗∗ --------------------------------------------- I found another interesting piece of malicious Powershell while hunting. The file size is 1.3MB and most of the file is a PE file Base64 encoded. You can immediately detect it by checking the first characters of the string: [...] --------------------------------------------- https://isc.sans.edu/forums/diary/Malicious+Powershell+using+a+Decoy+Pictur… ∗∗∗ Jetzt patchen! Scanner und Exploits für kritische libssh-Lücke aufgetaucht ∗∗∗ --------------------------------------------- Da das Angriffsrisiko wächst, sollten Admins zügig die aktuelle libssh-Version auf Servern installieren. --------------------------------------------- http://heise.de/-4198976 ∗∗∗ Serverless botnets could soon become reality ∗∗∗ --------------------------------------------- We have been accustomed to think about botnets as a network of compromised machines – personal devices, IoT devices, servers – waiting for their masters' orders to begin their attack, but Protego researchers say that many compromised machines are definitely not a requirement: botnets can quite as easily be comprised of serverless functions. --------------------------------------------- https://www.helpnetsecurity.com/2018/10/23/serverless-botnets/ ∗∗∗ Who Is Agent Tesla? ∗∗∗ --------------------------------------------- A powerful, easy-to-use password stealing program known as Agent Tesla has been infecting computers since 2014, but recently this malware strain has seen a surge in popularity - attracting more than 6,300 customers who pay monthly fees to license the software. Although Agent Tesla includes a multitude of features designed to help it remain undetected on host computers, the malwares apparent creator seems to have done little to hide his real-life identity. --------------------------------------------- https://krebsonsecurity.com/2018/10/who-is-agent-tesla/ ∗∗∗ Betrug mit Euro-Lottosystem & Goggins-Transport ∗∗∗ --------------------------------------------- Konsument/innen erhalten eine betrügerische E-Mail, in der es heißt, dass sie bei einem Euro-Lottosystem 97.000 Euro gewonnen haben. Sie sollen Geld an Goggings-Transport bezahlen, damit sie den Preis ausbezahlt bekommen. Es folgen weitere Zahlungsaufforderungen. Mit jeder Bezahlung verliert das Opfer Geld, denn den Gewinn gibt es nicht. --------------------------------------------- https://www.watchlist-internet.at/news/betrug-mit-euro-lottosystem-goggins-… ∗∗∗ Konsolen-kobold.de liefert keine Ware! ∗∗∗ --------------------------------------------- Kaufen Sie nicht auf konsolen-kobold.de ein. Die dort angebotenen Playstations, Xboxen, Nintendos und Spiele sind zwar verlockend günstig, werden aber auch nicht geliefert! Bezahlt wird per Vorkasse und Ihr Geld ist somit weg. --------------------------------------------- https://www.watchlist-internet.at/news/konsolen-koboldde-liefert-keine-ware/ ∗∗∗ CVE-2018–8414: A Case Study in Responsible Disclosure ∗∗∗ --------------------------------------------- The process of vulnerability disclosure can be riddled with frustrations, concerns about ethics, and communication failure. I have had tons of bugs go well. I have had tons of bugs go poorly. --------------------------------------------- https://posts.specterops.io/cve-2018-8414-a-case-study-in-responsible-discl… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by CentOS (java-1.8.0-openjdk), Fedora (mosquitto), openSUSE (binutils, clamav, exiv2, fuse, haproxy, singularity, and zziplib), Slackware (firefox), SUSE (apache-pdfbox, net-snmp, pam_pkcs11, postgresql94, rpm, tiff, and wireshark), and Ubuntu (kernel, libssh, linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon, linux-azure, linux-lts-trusty, linux-lts-xenial, linux-aws, net-snmp, paramiko, requests, and texlive-bin). --------------------------------------------- https://lwn.net/Articles/769300/ ∗∗∗ IBM Security Bulletin: IBM BladeCenter Switch Modules are affected by information disclosure vulnerability (CVE-2014-8730) ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10736107 ∗∗∗ IBM Security Bulletin: IBM Integrated Management Module II (IMM2) is affected by vulnerability in OpenSLP (CVE-2017-17833) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10735359 ∗∗∗ IBM Security Bulletin: Vulnerabilities in GNU OpenSSL affect IBM Netezza Analytics ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10734825 ∗∗∗ IBM Security Bulletin: IBM WebSphere Commerce could allow a remote attacker to obtain sensitive information (CVE-2018-1811) ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10735589 ∗∗∗ IBM Security Bulletin: An Information Disclosure Vulnerability affects WebSphere Commerce (CVE-2018-1809) ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10732972 ∗∗∗ IBM Security Bulletin: A authenticated open redirect vulnerability affects IBM WebSphere Commerce Accelerator Tool (CVE-2018-1807) ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10735581 ∗∗∗ IBM Security Bulletin: An Information Disclosure Vulnerability affects WebSphere Commerce (CVE-2018-1806) ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10733149 ∗∗∗ IBM Security Bulletin: A cross site scripting vulnerability affects IBM WebSphere Commerce Accelerator tool (CVE-2018-1541) ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10731225 ∗∗∗ IPsec IKEv1 vulnerability CVE-2018-5389 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K42378447 ∗∗∗ Linux kernel vulnerability CVE-2018-14634 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K20934447 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 22.10.2018
by Daily end-of-shift report 22 Oct '18

22 Oct '18

===================== = End-of-Day report = ===================== Timeframe: Freitag 19-10-2018 18:00 − Montag 22-10-2018 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Remote Code Execution Flaws Found in FreeRTOS - Popular OS for Embedded Systems ∗∗∗ --------------------------------------------- FreeRTOS, the open-source operating system that powers most of the small microprocessors and microcontrollers in smart homes and critical infrastructure systems has 13 vulnerabilities, a third of them allowing remote code execution. --------------------------------------------- https://www.bleepingcomputer.com/news/security/remote-code-execution-flaws-… ∗∗∗ Sicherheitsupdate: Ein Klick zu viel und Microsoft Yammer führt Schadcode aus ∗∗∗ --------------------------------------------- Es gibt einen wichtigen Patch für die Desktop-Anwendung von Yammer. --------------------------------------------- http://heise.de/-4198055 ∗∗∗ Jetzt patchen! Kritische Lücke in den Mediaplayern VLC und MPlayer ∗∗∗ --------------------------------------------- Angreifer könnten Nutzer der Medienabspieler VLC und MPlayer mit vergleichsweise wenig Aufwand attackieren. --------------------------------------------- http://heise.de/-4198129 ∗∗∗ l+f: Snackautomaten-Flatrate ∗∗∗ --------------------------------------------- Ein Sicherheitsforscher wird zum Snackosaurus. --------------------------------------------- http://heise.de/-4198336 ∗∗∗ TCP/IP, Sockets, and SIGPIPE ∗∗∗ --------------------------------------------- There is a spectre haunting the Internet - the spectre of SIGPIPE errors. Its a bug in the original design of Unix networking from 1981 that is perpetuated by college textbooks, which teach students to ignore it. As a consequence, sometimes software unexpectedly crashes. This is particularly acute on industrial and medical networks, where security professionals cant run port/security scans for fear of crashing critical devices. --------------------------------------------- https://blog.erratasec.com/2018/10/tcpip-sockets-and-sigpipe.html ∗∗∗ Warnung vor verda-maehroboter.de ∗∗∗ --------------------------------------------- Der betrügerische Online-Shop verda-maehroboter.de verkauft günstige Mähroboter und Rasentraktoren. Wer bei ihm einkauft, verliert sein Geld und seine Identität an Verbrecher/innen. Zu einer Warenlieferung kommt es nicht. Der Fake-Shop verda-maehroboter.de ist mithilfe einer Internetrecherche, eines Preisvergleichs und einer Überprüfung der Zahlungsmethoden erkennbar. --------------------------------------------- https://www.watchlist-internet.at/news/warnung-vor-verda-maehroboterde/ ∗∗∗ Let's talk about PAKE ∗∗∗ --------------------------------------------- The first rule of PAKE is: nobody ever wants to talk about PAKE. The second rule of PAKE is that this is a shame, because PAKE — which stands for Password Authenticated Key Exchange — is actually one of the most useful technologies that (almost) never gets used. It should be deployed everywhere, and yet it isn't. --------------------------------------------- https://blog.cryptographyengineering.com/2018/10/19/lets-talk-about-pake/ ===================== = Vulnerabilities = ===================== ∗∗∗ libssh Authentication Bypass Vulnerability Affecting Cisco Products: October 2018 ∗∗∗ --------------------------------------------- A vulnerability in libssh could allow an unauthenticated, remote attacker to bypass authentication on a targeted system.The vulnerability is due to improper authentication operations by the server-side state machine of the affected software. An attacker could exploit this vulnerability by presenting a SSH2_MSG_USERAUTH_SUCCESS message to a targeted system. A successful exploit could allow the attacker to bypass authentication and gain unauthorized access to a targeted system. --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ SECURITY BULLETIN: Trend Micro Antivirus for Mac (Consumer) Privilege Escalation Vulnerabilities ∗∗∗ --------------------------------------------- Trend Micro has released fixes for the Trend Micro Antivirus for Mac family of consumer products which resolve vulnerabilities that could allow an attacker to escalate privileges on a vulnerable system that they otherwise would not have had access to. --------------------------------------------- https://esupport.trendmicro.com/en-US/home/pages/technical-support/1121296.… ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (thunderbird), Debian (drupal7, exiv2, and ghostscript), Fedora (apache-commons-compress, git, libssh, and patch), Mageia (389-ds-base, calibre, clamav, docker, ghostscript, glib2.0, libtiff, mgetty, php-smarty, rust, tcpflow, and vlc), openSUSE (Chromium, icinga, and libssh), and SUSE (clamav, fuse, GraphicsMagick, haproxy, libssh, thunderbird, tomcat, udisks2, and Xerces-c). --------------------------------------------- https://lwn.net/Articles/769163/ ∗∗∗ IBM Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU – Jul 2018 – Includes Oracle Jul 2018 CPU affects IBM Tivoli Composite Application Manager for Transactions ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10735807 ∗∗∗ IBM Security Bulletin: Vulnerabilities in GNU binutils affect IBM Netezza Analytics ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10733785 ∗∗∗ BIG-IP-reflected XSS vulnerability in an undisclosed Configuration utility page CVE-2018-15315 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K41704442 ∗∗∗ PEPPERL+FUCHS ecom Mobile devices prone to Android privilege elevation vulnerability ∗∗∗ --------------------------------------------- https://cert.vde.com/de-de/advisories/vde-2018-016 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 19.10.2018
by Daily end-of-shift report 19 Oct '18

19 Oct '18

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 18-10-2018 18:00 − Freitag 19-10-2018 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ SSH Key Management Overview & 6 Best Practices ∗∗∗ --------------------------------------------- Secure Socket Shell (SSH), also called Secure Shell, is a special network protocol leveraging .. --------------------------------------------- https://www.beyondtrust.com/blog/ssh-key-management-overview-6-best-practic… ∗∗∗ How we discovered a Ukranian cybercrime hotspot ∗∗∗ --------------------------------------------- Our researchers wanted to take a closer look at the GandCrab ransomware. Then they found an entire cybercrime network, operating from Ukraine. --------------------------------------------- https://www.gdatasoftware.com/blog/2018/10/31187-ukranian-cybercrime-hotspo… ∗∗∗ The Underground Job Market ∗∗∗ --------------------------------------------- "Leave your ego at the door every morning, and just do some truly great work. Few things will make you feel better than a job brilliantly done." Robin S. Sharma The last time we visited the .. --------------------------------------------- https://trustwave.com/Resources/SpiderLabs-Blog/The-Underground-Job-Market/ ∗∗∗ Hack.lu 2018 Wrap-Up Day #3 ∗∗∗ --------------------------------------------- Here we go with the last wrap-up of the 2018 edition! The first presentation was about worms: “Worms that turn: nematodes and neotodes” by Matt Wixey. The first slide contained the mention: “for educational purposes only”. What could we .. --------------------------------------------- https://blog.rootshell.be/2018/10/18/hack-lu-2018-wrap-up-day-3/ ∗∗∗ Jetzt patchen! Kritische Lücken in Drupal gefährden ganze Websites ∗∗∗ --------------------------------------------- Aufgrund von mehreren Schwachstellen sollten Web-Admins zügig ihre Drupal-Installation auf den aktuellen Stand bringen. --------------------------------------------- http://heise.de/-4196243 ∗∗∗ Sicherheitslücke in jQuery-File-Upload Plug-in macht unzählige Server verwundbar ∗∗∗ --------------------------------------------- Es ist ein wichtiges Sicherheitsupdate für das jQuery-File-Upload-Plug-in erschienen. Eine globale Installation ist jedoch utopisch. --------------------------------------------- http://heise.de/-4196771 ∗∗∗ Encrypted SNI Comes to Firefox Nightly ∗∗∗ --------------------------------------------- TL;DR: Firefox Nightly now supports encrypting the TLS Server Name Indication (SNI) extension, which helps prevent attackers on your network from learning your browsing history. You can enable encrypted SNI today and .. --------------------------------------------- https://blog.mozilla.org/security/2018/10/18/encrypted-sni-comes-to-firefox… ===================== = Vulnerabilities = ===================== ∗∗∗ DSA-4323 drupal7 - security update ∗∗∗ --------------------------------------------- https://www.debian.org/security/2018/dsa-4323 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 18.10.2018
by Daily end-of-shift report 18 Oct '18

18 Oct '18

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 17-10-2018 18:00 − Donnerstag 18-10-2018 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Hack.lu 2018 Wrap-Up Day #2 ∗∗∗ --------------------------------------------- The second day started early with an eye-opener talk: “IPC – the broken dream of inherent security” by Thanh Bui. IPC or “Inter-Process Communications” are everywhere. You can compare them as a network connection between a .. --------------------------------------------- https://blog.rootshell.be/2018/10/17/hack-lu-2018-wrap-up-day-2/ ∗∗∗ Sicherheitslücken-Cocktail bringt D-Link-Router zu Fall ∗∗∗ --------------------------------------------- Ein Sicherheitsforscher kombiniert drei Sicherheitslücken und erlangt die volle Kontrolle über D-Link-Router. Patches gibt es noch nicht. --------------------------------------------- http://heise.de/-4195134 ∗∗∗ Distrust of the Symantec PKI: Immediate action needed by site operators ∗∗∗ --------------------------------------------- Chrome 70 has now been released to the Stable Channel, and users will start to see full screen interstitials on sites which still use certificates issues by the Legacy Symantec .. --------------------------------------------- https://security.googleblog.com/2018/03/distrust-of-symantec-pki-immediate.… ∗∗∗ VestaCP compromised in a new supply-chain attack ∗∗∗ --------------------------------------------- Customers see their admin credentials stolen and their servers infected with .. --------------------------------------------- https://www.welivesecurity.com/2018/10/18/new-linux-chachaddos-malware-dist… ===================== = Vulnerabilities = ===================== ∗∗∗ TYPO3-PSA-2018-001: By-passing Protection of PharStreamWrapper Interceptor ∗∗∗ --------------------------------------------- It has been discovered that the protection against insecure deserialization can be by-passed in PharStreamWrapper component. --------------------------------------------- https://typo3.org/security/advisory/typo3-psa-2018-001/ ∗∗∗ Drupal Core - Multiple Vulnerabilities - SA-CORE-2018-006 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-core-2018-006 ∗∗∗ Drupal Core - 3rd-party libraries -SA-CORE-2018-005 ∗∗∗ --------------------------------------------- https://www.drupal.org/SA-CORE-2018-005 ∗∗∗ HTML Mail - Critical - Remote Code Execution - SA-CONTRIB-2018-069 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2018-069 ∗∗∗ Mime Mail - Critical - Remote Code Execution - SA-CONTRIB-2018-068 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2018-068 ∗∗∗ Cisco Wireless LAN Controller Software Cross-Site Scripting Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 17.10.2018
by Daily end-of-shift report 17 Oct '18

17 Oct '18

===================== = End-of-Day report = ===================== Timeframe: Dienstag 16-10-2018 18:00 − Mittwoch 17-10-2018 18:00 Handler: Alexander Riepl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Injecting Code into Windows Protected Processes using COM - Part 1 ∗∗∗ --------------------------------------------- Posted by James Forshaw, Google Project ZeroAt Recon Montreal 2018 I presented "Unknown Known DLLs and other Code Integrity Trust Violations" with Alex Ionescu. We described the implementation of Microsoft Windows' Code Integrity mechanisms and how Microsoft implemented Protected Processes (PP). As part of that I demonstrated various ways of bypassing Protected Process Light (PPL), some requiring administrator privileges, others not. --------------------------------------------- https://googleprojectzero.blogspot.com/2018/10/injecting-code-into-windows-… ∗∗∗ Multiple D-Link Routers Open to Complete Takeover with Simple Attack ∗∗∗ --------------------------------------------- The vendor only plans to patch two of the eight impacted devices, according to a researcher. --------------------------------------------- https://threatpost.com/multiple-d-link-routers-open-to-complete-takeover-wi… ∗∗∗ Party like its 1987... SVGA code bug haunts VMwares house, lets guests flee to host OS ∗∗∗ --------------------------------------------- Malicious code in VMs can leap over ESXi, Workstation, Fusion hypervisor security Get busy, VMware admins and users: the virtualisation virtuoso has patched a programming blunder in ESXi, Workstation Pro and Player, and Fusion and Fusion Pro products that can be exploited by malicious code to jump from guest OS to host machine. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2018/10/17/vmware_svga… ∗∗∗ Warnung vor gefälschtem A1-Update ∗∗∗ --------------------------------------------- Konsument/innen erhalten eine angebliche Nachricht von A1, in der es heißt, dass der Mobilfunkanbieter ein Update für sie bereit stellt. Kund/innen sollen es installieren, damit sie weiterhin das Mobilfunknetz des Anbieters nutzen können. Kommen sie der Aufforderung nach, installieren sie Schadsoftware auf ihrem Smartphone. --------------------------------------------- https://www.watchlist-internet.at/news/warnung-vor-gefaelschtem-a1-update/ ∗∗∗ IT-Sicherheit - 100.000 Geräte: "Netter" Hacker entfernt ungefragt Sicherheitslücken ∗∗∗ --------------------------------------------- Seit April sind verheerende Sicherheitslücken bei Routern der Marke Mikrotik bekannt - vom Hersteller gibt es kein Update --------------------------------------------- https://derstandard.at/2000089517357/Netter-Hacker-entfernt-ungefragt-Siche… ∗∗∗ Persistent Credential Theft with Authorization Plugins ∗∗∗ --------------------------------------------- Credential theft is often one of the first tactics leveraged by attackers once they’ve escalated privileges on a victim’s machine. Credential theft on OSX has become more difficult with the introduction of System Integrity Protection (SIP). Attackers can no longer use methods such as extracting the master keys from the securityd process and decrypting the victim’s login keychain. An example of this can be seen here. --------------------------------------------- https://posts.specterops.io/persistent-credential-theft-with-authorization-… ===================== = Vulnerabilities = ===================== ∗∗∗ Omron CX-Supervisor ∗∗∗ --------------------------------------------- This advisory includes mitigations for improper restriction of operations within the bounds of a memory buffer, out-of-bounds read, use-after-free, and incorrect type conversion or cast vulnerabilities in Omrons CX-Supervisor software. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-18-290-01 ∗∗∗ Authentication bypass in server code in libssh ∗∗∗ --------------------------------------------- There is a vulnerability within the server code which can enable a client to bypass the authentication process and set the internal state machine maintained by the library to authenticated, enabling the (otherwise prohibited) creation of channels. --------------------------------------------- https://www.libssh.org/security/advisories/CVE-2018-10933.txt ∗∗∗ VMSA-2018-0026 ∗∗∗ --------------------------------------------- VMware ESXi, Workstation, and Fusion updates address an out-of-bounds read vulnerability --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2018-0026.html ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by CentOS (tomcat), Debian (asterisk, graphicsmagick, and libpdfbox-java), openSUSE (apache2 and git), Oracle (tomcat), Red Hat (kernel and Satellite 6.4), Slackware (libssh), SUSE (binutils, ImageMagick, and libssh), and Ubuntu (clamav, libssh, moin, and paramiko). --------------------------------------------- https://lwn.net/Articles/768617/ ∗∗∗ Synology-SA-18:55 DSM ∗∗∗ --------------------------------------------- A vulnerability allows remote authenticated users to obtain sensitive information via a susceptible version of Synology Diskstation Manager (DSM). --------------------------------------------- https://www.synology.com/en-global/support/security/Synology_SA_18_55 ∗∗∗ Oracle Critical Patch Update Advisory - October 2018 ∗∗∗ --------------------------------------------- https://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html ∗∗∗ Solaris Third Party Bulletin - October 2018 ∗∗∗ --------------------------------------------- http://www.oracle.com/technetwork/topics/security/bulletinoct2018-5139632.h… ∗∗∗ Security Advisory - Information Leak Vulnerability in Some Huawei Smart Phones ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2018/huawei-sa-20181017-… ∗∗∗ HPESBHF03891 rev.1 - HPE UIoT, Remote Unauthorized Access ∗∗∗ --------------------------------------------- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_n… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 16.10.2018
by Daily end-of-shift report 16 Oct '18

16 Oct '18

===================== = End-of-Day report = ===================== Timeframe: Montag 15-10-2018 18:00 − Dienstag 16-10-2018 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ pEp-Foundation hat Sicherheitslücke in Enigmail/pEp geschlossen ∗∗∗ --------------------------------------------- Die pEp-Foundation hat eine Sicherheitslücke gestopft: Das Add-on Enigmail unter Windows hatte vorgeblich verschlüsselte Mails im Klartext verschickt. --------------------------------------------- http://heise.de/-4191426 ∗∗∗ Android 9 Pie: Google knüpft Backup-Verschlüsselung an gerätespezifische Passcodes ∗∗∗ --------------------------------------------- Der Zugriff auf Anwendungsdaten in Androids Cloud-Backups erfordert künftig einen Entschlüsselungskey, den selbst Google nicht kennt. --------------------------------------------- http://heise.de/-4191017 ∗∗∗ Old dog, new tricks - Analysing new RTF-based campaign distributing Agent Tesla, Loki with PyREbox ∗∗∗ --------------------------------------------- Cisco Talos has discovered a new malware campaign that drops the sophisticated information-stealing trojan called "Agent Tesla," and other malware such as the Loki information stealer. Initially, Talos telemetry systems detected a .. --------------------------------------------- https://blog.talosintelligence.com/2018/10/old-dog-new-tricks-analysing-new… ∗∗∗ Phishers are after something unusual in ploy targeting book publishers ∗∗∗ --------------------------------------------- In a new twist on the theme, the scammers have their sights set on book manuscripts, among other .. --------------------------------------------- http://feedproxy.google.com/~r/eset/blog/~3/lABhPeu59as/ ∗∗∗ Fake-Shop-Alarm auf macbooks-billiger.de ∗∗∗ --------------------------------------------- Auf macbooks-billiger.de werden Apple-Produkte, wie MacBooks, iPhones, Apple Watches und iPads zu konkurrenzlos günstigen Preisen angeboten. Wie das geht, fragen Sie? Die Antwort lautet „Betrug!“. Sie .. --------------------------------------------- https://www.watchlist-internet.at/index.php?id=71&tx_news_pi1[news]=3169&tx… ∗∗∗ Removing Old Versions of TLS ∗∗∗ --------------------------------------------- In March of 2020, Firefox will disable support for TLS 1.0 and TLS 1.1. On the Internet, 20 years is an eternity. TLS 1.0 will be 20 years old in January 2019. In that time, TLS has protected .. --------------------------------------------- https://blog.mozilla.org/security/2018/10/15/removing-old-versions-of-tls/ ===================== = Vulnerabilities = ===================== ∗∗∗ DSA-4319 spice - security update ∗∗∗ --------------------------------------------- https://www.debian.org/security/2018/dsa-4319 ∗∗∗ DSA-4318 moin - security update ∗∗∗ --------------------------------------------- https://www.debian.org/security/2018/dsa-4318 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 15.10.2018
by Daily end-of-shift report 15 Oct '18

15 Oct '18

===================== = End-of-Day report = ===================== Timeframe: Freitag 12-10-2018 18:00 − Montag 15-10-2018 18:00 Handler: Alexander Riepl Co-Handler: Dimitri Robl ===================== = News = ===================== ∗∗∗ l+f: Krypto-Miner hegt und pflegt Flash ∗∗∗ --------------------------------------------- Ein Trojaner tut erst Gutes und dann Böses. --------------------------------------------- http://heise.de/-4190878 ∗∗∗ Patching, Re-Patching and Meta-Patching the Jet Database Engine RCE (CVE-2018-8423) ∗∗∗ --------------------------------------------- Flawed Patches Will Always Happen, But We Can Change How They Get Fixed by Mitja Kolsek, the 0patch TeamTL;DR: Microsoft patched CVE-2018-8423 eighteen days after we had micropatched it. Their official patch turned out to be incomplete so we re-micropatched it.This is a story about a Windows vulnerability that was reported to Microsoft, published as "0day" before the official patch was available, micropatched by us one day later, subsequently patched by Microsoft, found to be [...] --------------------------------------------- https://blog.0patch.com/2018/10/patching-re-patching-and-meta-patching.html ∗∗∗ Datendiebstahl mit gefälschter WhatsApp-Rechnung ∗∗∗ --------------------------------------------- Datendiebe versenden eine gefälschte WhatsApp-Rechnung per E-Mail. Darin behaupten sie in betrügerischer Absicht, dass Konsument/innen für den Messenger bezahlen müssen. Dazu sollen sie auf einer Website ihre Kreditkartendaten und ihren TAN-Code bekannt geben. Das führt zur Übermittlung der Informationen an Kriminelle. Dadurch verlieren Opfer ihr Geld und ihre Identität an Datendiebe. --------------------------------------------- https://www.watchlist-internet.at/news/datendiebstahl-mit-gefaelschter-what… ∗∗∗ IT-Security - "PHP-Zeitbombe": 62 Prozent aller Internetseiten sind bald unsicher ∗∗∗ --------------------------------------------- Mit Ende des Jahres endet der Support für PHP 5.6, das immer noch vielfach genutzt wird --------------------------------------------- https://derstandard.at/2000089376436/PHP-Zeitbombe-62-Prozent-aller-Interne… ===================== = Vulnerabilities = ===================== ∗∗∗ MS-ISAC Releases Advisory on PHP Vulnerabilities ∗∗∗ --------------------------------------------- The Multi-State Information Sharing & Analysis Center (MS-ISAC) has released an advisory on multiple Hypertext Preprocessor (PHP) vulnerabilities. An attacker could exploit some of these vulnerabilities to take control of an affected system.NCCIC encourages users and administrators to review MS-ISAC Advisory 2018-113 and the PHP Downloads page and apply the necessary updates. --------------------------------------------- https://www.us-cert.gov/ncas/current-activity/2018/10/12/MS-ISAC-Releases-A… ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (wireshark-cli), Debian (imagemagick, otrs2, tomcat7, and wireshark), Fedora (ca-certificates, dislocker, dolphin-emu, kernel-headers, kernel-tools, libgit2, mbedtls, mingw-openjpeg2, nekovm, openjpeg2, patch, strongswan, and thunderbird), Mageia (firefox, git, nextcloud, and texlive), Oracle (kernel and openssl), Scientific Linux (spamassassin), SUSE (libtirpc), and Ubuntu (requests). --------------------------------------------- https://lwn.net/Articles/768406/ ∗∗∗ Security Advisory - Arbitrary Memory Read Write Vulnerability in Huawei Smart Phones ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20170306-… ∗∗∗ IBM Security Bulletin: Vulnerability CVE-2018-11763 in the IBM i HTTP Server affects IBM i. ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10735045 ∗∗∗ IBM Security Bulletin: Potential cross-site scripting vulnerability in the WebSphere Application Server Admin Console (CVE-2018-1777) ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10730631 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 12.10.2018
by Daily end-of-shift report 12 Oct '18

12 Oct '18

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 11-10-2018 18:00 − Freitag 12-10-2018 18:00 Handler: Dimitri Robl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Jetzt patchen! Proof-of-Concept-Code für Windows-Lücke veröffentlicht ∗∗∗ --------------------------------------------- Ein Sicherheitsforscher zeigt, wie er mit einem vergleichsweise simplen Skript aus dem Browser Edge heraus eine andere Anwendung startet. --------------------------------------------- http://heise.de/-4189565 ∗∗∗ Adaptable, All-in-One Android Trojan Shows the Future of Malware ∗∗∗ --------------------------------------------- GPlayed may be the new face of malware -- flexible and adaptable, with a Swiss Army knife-like toolbox that can be used to target pretty much anyone. --------------------------------------------- https://threatpost.com/adaptable-all-in-one-android-trojan-shows-the-future… ∗∗∗ New Drupalgeddon Attacks Enlist Shellbot to Open Backdoors ∗∗∗ --------------------------------------------- Drupalgeddon 2.0 vulnerability is being exploited again by attackers using a time-honored technique of Shellbot, or PerlBot. --------------------------------------------- https://threatpost.com/new-drupalgeddon-attacks-enlist-shellbot-to-open-bac… ∗∗∗ Google Adds Control-Flow Integrity to Beef up Android Kernel Security ∗∗∗ --------------------------------------------- Google has added a new security feature to the latest Linux kernels for Android devices to prevent it against code reuse attacks that allow attackers to achieve arbitrary code execution by exploiting control-flow hijacking vulnerabilities. --------------------------------------------- https://thehackernews.com/2018/10/android-linux-kernel-cfi.html ∗∗∗ AA18-284A: Publicly Available Tools Seen in Cyber Incidents Worldwide ∗∗∗ --------------------------------------------- This report is a collaborative research effort by the cyber security authorities of five nations: Australia, Canada, New Zealand, the United Kingdom, and the United States. In it we highlight the use of five publicly available tools, which have been used for malicious purposes in recent cyber incidents around the world. --------------------------------------------- https://www.us-cert.gov/ncas/alerts/AA18-284A ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (net-snmp), Fedora (php-horde-nag), openSUSE (git, java-1_8_0-openjdk, libxml2, mgetty, moinmoin-wiki, postgresql10, and soundtouch), Oracle (spamassassin), Red Hat (spamassassin), SUSE (apache2, axis, kernel, libX11 and libxcb, and texlive), and Ubuntu (clamav, git, and texlive-bin). --------------------------------------------- https://lwn.net/Articles/768244/ ∗∗∗ NUUO NVRmini2 and NVRsolo ∗∗∗ --------------------------------------------- This advisory includes mitigations for stack-based buffer overflow and leftover debug code vulnerabilities in NUUOs NVRmini2 and NVRsolo network video recorders. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-18-284-01 ∗∗∗ NUUO CMS ∗∗∗ --------------------------------------------- This advisory includes mitigations for use of insufficiently random values, use of obsolete function, incorrect permission assignment for critical resource, and use of hard-coded credentials vulnerabilities in a NUUOs CMS software management platform. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-18-284-02-NUUO-CMS ∗∗∗ Delta Industrial Automation TPEditor ∗∗∗ --------------------------------------------- This advisory includes mitigations for out-of-bounds write and stack-based buffer overflow vulnerabilities in the Delta Industrial Automation TPEditor software. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-18-284-03 ∗∗∗ Critical Patch Update - October 2018 - Pre-Release Announcement ∗∗∗ --------------------------------------------- https://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html ∗∗∗ IBM Security Bulletin: IBM Flex System Chassis Management Module (CMM) is affected by a vulnerability in glibc (CVE-2018-11236) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10734721 ∗∗∗ IBM Security Bulletin: IBM Flex System Chassis Management Module (CMM) is affected by vulnerabilities in OpenSSH ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10734739 ∗∗∗ IBM Security Bulletin: Vulnerabilities in procps affect IBM BladeCenter Advanced Management Module (AMM) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10733895 ∗∗∗ IBM Security Bulletin: IBM Flex System Chassis Management Module (CMM) is affected by vulnerabilities in procps ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10734741 ∗∗∗ IBM Security Bulletin: IBM Flex System Chassis Management Module (CMM) is affected by a vulnerability in OpenSLP (CVE-2017-17833) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10734657 ∗∗∗ IBM Security Bulletin: IBM Security Key Lifecycle Manager is vulnerable to Path Traversal (CVE-2018-1744) ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10733353 ∗∗∗ IBM Security Bulletin: IBM Flex System Chassis Management Module (CMM) is affected by vulnerabilities in libjpeg ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10734731 ∗∗∗ IBM Security Bulletin: IBM Security Key Lifecycle Manager is vulnerable to a XML External Entity Injection (XXE) attack (CVE-2018-1747) ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10733429 ∗∗∗ IBM Security Bulletin: Vulnerabilities in Python affect IBM BladeCenter Advanced Management Module (AMM) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10733909 ∗∗∗ IBM Security Bulletin: IBM Flex System Chassis Management Module (CMM) is affected by vulnerabilities in ICU ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10734727 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 11.10.2018
by Daily end-of-shift report 11 Oct '18

11 Oct '18

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 10-10-2018 18:00 − Donnerstag 11-10-2018 18:00 Handler: Dimitri Robl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ 5 Endpoint Threats Impacting Security ∗∗∗ --------------------------------------------- Introduction Endpoint threats pose serious security risks to many organizations. Companies are reporting attacks ranging from ransomware to phishing attacks. These attacks lead to the loss of customer data, resulting in massive damage to the company’s reputation, finances and structure. --------------------------------------------- https://resources.infosecinstitute.com/5-endpoint-threats-impacting-securit… ∗∗∗ ICS Tactical Security Trends: Analysis of the Most Frequent SecurityRisks Observed in the Field ∗∗∗ --------------------------------------------- Introduction FireEye iSIGHT Intelligence compiled extensive data from dozens of ICS security health assessment engagements (ICS Healthcheck) performed by Mandiant, FireEyes consulting team, to identify the most pervasive and highest priority security risks in industrial facilities. The information was acquired from hands-on assessments carried out over the last few years across a broad range of industries [...] --------------------------------------------- http://www.fireeye.com/blog/threat-research/2018/10/ics-tactical-security-t… ∗∗∗ DNS-Schlüsselwechsel: Wie man DNS-Ausfälle erkennt, was dagegen hilft ∗∗∗ --------------------------------------------- Am 11.10. wechselt die ICANN den DNS-Vertrauensanker. Dabei kann es zu Ausfällen von Internet-Diensten kommen. Wir fassen zusammen, was dagegen hilft. --------------------------------------------- https://heise.de/-4187064 ∗∗∗ Sicherheitsupdates: Junipers Junos OS offen für Fernzugriff ohne Passwort ∗∗∗ --------------------------------------------- In Junos OS klaffen zum Teil kritische Sicherheitslücken. Aktualisierte Versionen des Betriebssystems schließen die Schwachstellen. --------------------------------------------- http://heise.de/-4188397 ∗∗∗ Nicht bei saturn-media.net einkaufen ∗∗∗ --------------------------------------------- Saturn-media.net lockt mit günstigen Technikangeboten und versucht durch den Domain eine Verbindung zu den seriösen Anbietern Media Markt und Saturn herzustellen. Saturn-media.net hat jedoch nichts mit den genannten Anbietern zu tun, es handelt sich um einen Fakeshop. Sie erhalten keine Ware und verlieren ihr Geld! --------------------------------------------- https://www.watchlist-internet.at/news/nicht-bei-saturn-medianet-einkaufen/ ===================== = Vulnerabilities = ===================== ∗∗∗ Juniper Networks Releases Security Updates ∗∗∗ --------------------------------------------- Original release date: October 10, 2018 Juniper Networks has released security updates to address vulnerabilities affecting multiple Junos OS versions. An attacker could exploit some of these vulnerabilities to take control of an affected system.NCCIC encourages users and administrators to review the Juniper Security Advisories website and apply the necessary updates and workarounds. This product is provided subject to this Notification and this Privacy & Use policy. --------------------------------------------- https://www.us-cert.gov/ncas/current-activity/2018/10/10/Juniper-Networks-R… ∗∗∗ NVP field - Moderately critical - Cross Site Scripting - SA-CONTRIB-2018-066 ∗∗∗ --------------------------------------------- Project: NVP fieldDate: 2018-October-10Security risk: Moderately critical 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site ScriptingDescription: NVP field module allows you to create a field type of name/value pairs, with customtitles and easily editable rendering with customizable HTML/text surrounding the pairs.The module doesnt sufficiently handle sanitization of its field formatters output. --------------------------------------------- https://www.drupal.org/sa-contrib-2018-066 ∗∗∗ Search API Solr Search - Moderately critical - Access bypass - SA-CONTRIB-2018-065 ∗∗∗ --------------------------------------------- Project: Search API Solr SearchVersion: 7.x-1.13Date: 2018-October-10Security risk: Moderately critical 10∕25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:UncommonVulnerability: Access bypassDescription: This module provides support for creating searches using the Apache Solr search engine and the Search API Drupal module.The module doesnt sufficiently take the searched fulltext fields into account when creating a search excerpt. --------------------------------------------- https://www.drupal.org/sa-contrib-2018-065 ∗∗∗ Lightbox2 - Critical - Cross Site Scripting - SA-CONTRIB-2018-064 ∗∗∗ --------------------------------------------- Project: Lightbox2Version: 7.x-2.x-devDate: 2018-October-10Security risk: Critical 18∕25 AC:None/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site ScriptingDescription: The Lightbox2 module enables you to overlay images on the current page.The module did not sanitize some inputs when used in combination with a custom view leading to potential Cross Site Scripting (XSS).Solution: Install the latest version [...] --------------------------------------------- https://www.drupal.org/sa-contrib-2018-064 ∗∗∗ Teltonika RUT9XX Unauthenticated OS Command Injection ∗∗∗ --------------------------------------------- Teltonika RUT9XX routers with firmware before 00.04.233 are prone to multiple unauthenticated OS command injection vulnerabilities in autologin.cgi and hotspotlogin.cgi due to insufficient user input sanitization. This allows remote attackers to execute arbitrary commands with root privileges. --------------------------------------------- https://github.com/sbaresearch/advisories/tree/public/2018/SBA-ADV-20180319… ∗∗∗ Teltonika RUT9XX Reflected Cross-Site Scripting (XSS) ∗∗∗ --------------------------------------------- Teltonika RUT9XX routers with firmware before 00.05.01.1 are prone to cross-site scripting vulnerabilities in hotspotlogin.cgi due to insufficient user input sanitization. --------------------------------------------- https://github.com/sbaresearch/advisories/tree/public/2018/SBA-ADV-20180410… ∗∗∗ Teltonika RUT9XX Missing Access Control to UART Root Terminal ∗∗∗ --------------------------------------------- Teltonika RUT9XX routers with firmware before 00.04.233 provide a root terminal on a serial interface without proper access control. This allows attackers with physical access to execute arbitrary commands with root privileges. --------------------------------------------- https://github.com/sbaresearch/advisories/tree/public/2018/SBA-ADV-20180319… ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (dnsruby, gnulib, and jekyll), Fedora (calamares, fawkes, git, kernel-headers, librime, and pdns), openSUSE (ImageMagick), Oracle (kernel), Scientific Linux (glusterfs, kernel, and nss), Slackware (git), SUSE (ImageMagick), and Ubuntu (tomcat7, tomcat8). --------------------------------------------- https://lwn.net/Articles/768145/ ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in GNU Binutils affect IBM Netezza Platform Software clients. ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10728795 ∗∗∗ IBM Security Bulletin: Vyatta 5600 vRouter Software Patches – Release 1801q ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10731217 ∗∗∗ IBM Security Bulletin: Potential bypass security vulnerability in Expression Language library used by WebSphere Application Server (CVE-2014-7810) ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10729557 ∗∗∗ IBM Security Bulletin: Potential traversal vulnerability in IBM WebSphere Application Server Admin Console (CVE-2018-1770) ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10729521 ∗∗∗ IBM Security Bulletin: IBM FileNet Content Manager component FileNet Deployment Manager security vulnerability ∗∗∗ --------------------------------------------- https://www.ibm.com/support/docview.wss?uid=ibm10732755 ∗∗∗ IBM Security Bulletin: Remote code execution vulnerability (CVE-2018-1260) affects IBM Spectrum Symphony 7.2.0.2 and 7.2.1 ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10731859 ∗∗∗ IBM Security Bulletin: Cross-site scripting vulnerabilities affect Rational Publishing Engine ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10734697 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 10.10.2018
by Daily end-of-shift report 10 Oct '18

10 Oct '18

===================== = End-of-Day report = ===================== Timeframe: Dienstag 09-10-2018 18:00 − Mittwoch 10-10-2018 18:00 Handler: Dimitri Robl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Zero-day exploit (CVE-2018-8453) used in targeted attacks ∗∗∗ --------------------------------------------- Yesterday, Microsoft published their security bulletin, which patches CVE-2018-8453, among others. It is a vulnerability in win32k.sys discovered by Kaspersky Lab in August. Microsoft confirmed the vulnerability and designated it CVE-2018-8453. --------------------------------------------- https://securelist.com/cve-2018-8453-used-in-targeted-attacks/88151/ ∗∗∗ Patchday: Zero-Day-Fix für Windows, kritische Exchange-Lücke ∗∗∗ --------------------------------------------- Im Oktober behebt Microsoft knapp 50 Sicherheitsprobleme. Darunter kritische Lücken in Windows-Komponenten und im Exchange Mail-Server. --------------------------------------------- http://heise.de/-4186268 ∗∗∗ Kritische Sicherheitslücke gefährdet Milliarden WhatsApp-Nutzer ∗∗∗ --------------------------------------------- Eine Sicherheitslücke in WhatsApp ermöglicht es, ein Smartphone mit einem einzigen Video-Call zu kapern. Potentiell betroffen sind Milliarden WhatsApp-Nutzer. --------------------------------------------- http://heise.de/-4186365 ∗∗∗ Patchday: Adobe stopft kritische Lücke in Digital Editions ∗∗∗ --------------------------------------------- Ein Sicherheitsupdate für Flash, das keins ist, und die Abwesenheit von Reader-Patches sorgen bei Adobe für einen eher untypischen Patchday. --------------------------------------------- http://heise.de/-4186327 ∗∗∗ IIS attacks surge from 2,000 to 1.7 million over last quarter ∗∗∗ --------------------------------------------- IIS, Drupal, and Oracle WebLogic web technologies experienced increased attacks in Q2 2018. According to a new threat report from eSentire, IIS attacks showed a massive increase, from 2,000 to 1.7 million, since last quarter. --------------------------------------------- https://www.helpnetsecurity.com/2018/10/10/iis-attacks-surge/ ∗∗∗ Magecart hacks Shopper Approved to simultaneously hit many e-commerce sites ∗∗∗ --------------------------------------------- The cybercriminal groups under the Magecart umbrella strike again and again, and one of them has apparently specialized in compromising third parties to more easily get in as many online shops as possible. The latest target of Magecart Group 5, as it has been dubbed by RiskIQ researcher Yonathan Klijnsma, is Shopper Approved, an organization that provides rating seals for online stores. --------------------------------------------- https://www.helpnetsecurity.com/2018/10/10/magecart-hacks-shopper-approved/ ∗∗∗ Kleinanzeigenbetrug mit Western Union Überweisungen ∗∗∗ --------------------------------------------- Vorsicht beim Kleinanzeigenverkauf! BetrügerInnen, die sich als KaufinteressentInnen ausgeben, behaupten, ihren Opfern überhöhte Geldbeträge überwiesen zu haben, die nur durch eine Western Union Transaktion an ein Speditionsunternehmen freigeschalten werden können. Führen Sie diese Transaktion nicht durch, denn Ihr Geld wäre verloren und die freizuschaltende Überweisung gibt es nicht! --------------------------------------------- https://www.watchlist-internet.at/news/kleinanzeigenbetrug-mit-western-unio… ===================== = Vulnerabilities = ===================== ∗∗∗ Security Bulletins Posted ∗∗∗ --------------------------------------------- Adobe has published security bulletins for Adobe Digital Editions (APSB18-27), Adobe Experience Manager (APSB18-36), Adobe Framemaker (APSB18-37) and Adobe Technical Communications Suite (APSB18-38). Adobe recommends users update their product installations to the latest versions using the instructions referenced [...] --------------------------------------------- https://blogs.adobe.com/psirt/?p=1633 ∗∗∗ jQuery-File-Upload < = v9.22.0 unauthenticated arbitrary file upload vulnerability ∗∗∗ --------------------------------------------- Topic: jQuery-File-Upload < = v9.22.0 unauthenticated arbitrary file upload vulnerability Risk: Medium Text:Title: jQuery-File-Upload < = v9.22.0 unauthenticated arbitrary file upload vulnerability Author: Larry W. Cashdollar [...] --------------------------------------------- https://cxsecurity.com/issue/WLB-2018100094 ∗∗∗ GE iFix ∗∗∗ --------------------------------------------- This advisory includes mitigations for an unsafe ActiveX control marked safe for scripting vulnerability in a Gigasoft component affecting GE’s iFix HMI products. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-18-282-01 ∗∗∗ Fuji Electric Energy Savings Estimator ∗∗∗ --------------------------------------------- This advisory includes mitigations for an uncontrolled search path element (DLL Hijacking) vulnerability in the Fuji Electric Energy Savings Estimator software. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-18-282-07 ∗∗∗ October 2018 Security Update Release ∗∗∗ --------------------------------------------- Today, we released security updates to provide additional protections against malicious attackers. As a best practice, we encourage customers to turn on automatic updates. More information about this month’s security updates can be found in the Security Update Guide. --------------------------------------------- https://blogs.technet.microsoft.com/msrc/2018/10/09/october-2018-security-u… ∗∗∗ October 2018 Microsoft Patch Tuesday, (Tue, Oct 9th) ∗∗∗ --------------------------------------------- Microsoft released patches for 48 vulnerabilities today and one advisory regarding a defense in depth update for Office. No Adobe updates are included so far, but Adobe has released updates to PDF Reader / Acrobat about a week ago. --------------------------------------------- https://isc.sans.edu/diary/rss/24186 ∗∗∗ VMSA-2018-0025 ∗∗∗ --------------------------------------------- VMware ESXi, Workstation, and Fusion workarounds address a denial-of-service vulnerability --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2018-0025.html ∗∗∗ USN-3787-1: Tomcat vulnerability ∗∗∗ --------------------------------------------- tomcat7, tomcat8 vulnerabilityA security issue affects these releases of Ubuntu and its derivatives:Ubuntu 16.04 LTSUbuntu 14.04 LTSSummaryTomcat could be made to redirect to arbitrary locations.Software Descriptiontomcat8 - Servlet and JSP enginetomcat7 - Servlet and JSP engineDetailsIt was discovered that Tomcat incorrectly handled returning redirects to adirectory. A remote attacker could possibly use this issue with a speciallycrafted URL to redirect to arbitrary URIs. --------------------------------------------- https://usn.ubuntu.com/3787-1/ ∗∗∗ October 2018 Office Update Release ∗∗∗ --------------------------------------------- The October 2018 Public Update releases for Office are now available! This month, there are 23 security updates and 17 non-security updates. All of the security and non-security updates are listed in KB article 4464656. A new version of Office 2013 Click-To-Run is available: 15.0.5075.1001 A new version of Office 2010 Click-To-Run is available: 14.0.7214.5000 --------------------------------------------- https://blogs.technet.microsoft.com/office_sustained_engineering/2018/10/09… ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (patch), CentOS (firefox, glusterfs, kernel, and nss), Debian (net-snmp), Oracle (firefox, glusterfs, kernel, and nss), Red Hat (glusterfs, kernel, and nss), Scientific Linux (firefox), SUSE (kernel), and Ubuntu (webkit2gtk). --------------------------------------------- https://lwn.net/Articles/768041/ ∗∗∗ BSRT 2018-004 Information Disclosure Vulnerability in Management Console Impacts UEM ∗∗∗ --------------------------------------------- http://support.blackberry.com/kb/articleDetail?language=en_US&articleNumber… ∗∗∗ Security Advisory - Improper Authentication Vulnerability on Smartphones ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2018/huawei-sa-20181010-… ∗∗∗ IBM Security Bulletin: Multiple Vulnerabilities in WebSphere Application Server in IBM Cloud July 2018 CPU ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10734161 ∗∗∗ IBM Security Bulletin: IBM FileNet Content Manager affected by Apache PDFBox security vulnerability ∗∗∗ --------------------------------------------- https://www.ibm.com/support/docview.wss?uid=ibm10716315 ∗∗∗ IBM Security Bulletin: Multiple security vulnerabilities affect IBM WebSphere Application Server in IBM Cloud ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10734167 ∗∗∗ IBM Security Bulletin: Server Automation is affected by the following GSKit vulnerabilities (CVE-2018-1447, CVE-2018-1427, CVE-2018-1428) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10718773 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 09.10.2018
by Daily end-of-shift report 09 Oct '18

09 Oct '18

===================== = End-of-Day report = ===================== Timeframe: Montag 08-10-2018 18:00 − Dienstag 09-10-2018 18:00 Handler: Dimitri Robl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Millionen Xiongmai-Überwachungskameras durch Cloud-Feature unsicher (XMEye P2P Coud) ∗∗∗ --------------------------------------------- Über 9 Millionen IoT-Geräte des chinesischem OEM-Herstellers "Xiongmai" sind unsicher (selbst jene hinter einer Firewall), weil sie ein unsicheres Cloud-Feature namens "XMEye P2P cloud" standardmäßig aktiv haben. --------------------------------------------- https://www.sec-consult.com/blog/2018/10/millionen-xiongmai-ueberwachungska… ∗∗∗ Sicherheitsupdates: Kritische Lücken in Cisco DNA gefährden ganze Netzwerke ∗∗∗ --------------------------------------------- Cisco stellt Patches für verschiedene Produkte bereit und schließt damit viele Sicherheitslücken. --------------------------------------------- http://heise.de/-4184517 ∗∗∗ Oktober ist Europäischer Monat der Cyber-Sicherheit! ∗∗∗ --------------------------------------------- Auch diesen Oktober nimmt Österreich wieder an der EU-weiten Kampagne European Cyber Security Month (ECSM) teil. Im Fokus steht dabei die Bewusstseinsbildung für Risiken im Netz. --------------------------------------------- https://www.watchlist-internet.at/news/oktober-ist-europaeischer-monat-der-… ===================== = Vulnerabilities = ===================== ∗∗∗ [20181005] - Core - CSRF hardening in com_installer ∗∗∗ --------------------------------------------- Project: Joomla! SubProject: CMS Impact: Moderate Severity: Low Versions: 2.5.0 through 3.8.12 Exploit type: CSRF Reported Date: 2018-September-26 Fixed Date: 2018-October-02 CVE Number: CVE-2018-17858 Description Added additional CSRF hardening in com_installer actions in the backend. Affected Installs Joomla! CMS versions 2.5.0 through 3.8.12 Solution Upgrade to version 3.8.13 Contact The JSST at the Joomla! Security Centre. Reported By: Raviraj A. Powar --------------------------------------------- http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/nfI3_UnJIrM/755-20181005-c… ∗∗∗ [20181004] - Core - ACL Violation in com_users for the admin verification ∗∗∗ --------------------------------------------- Project: Joomla! SubProject: CMS Impact: Moderate Severity: Low Versions: 1.5.0 through 3.8.12 Exploit type: ACL Violation Reported Date: 2017-December-27 Fixed Date: 2018-October-02 CVE Number: CVE-2018-17855 Description In case that an attacker gets access to the mail account of an user who can approve admin verifications in the registration process he can activate himself. Affected Installs Joomla! CMS versions 1.5.0 through 3.8.12 Solution Upgrade to version 3.8.13 --------------------------------------------- http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/qGhSucxwoZo/754-20181004-c… ∗∗∗ [20181003] - Core - Access level Violation in com_tags ∗∗∗ --------------------------------------------- Project: Joomla! SubProject: CMS Impact: Moderate Severity: Low Versions: 3.1.0 through 3.8.12 Exploit type: ACL Violation Reported Date: 2018-June-20 Fixed Date: 2018-October-02 CVE Number: CVE-2018-17857 Description Inadequate checks on the tags search fields can lead to an access level violation. Affected Installs Joomla! CMS versions 3.1.0 through 3.8.12 Solution Upgrade to version 3.8.13 Contact The JSST at the Joomla! Security Centre. --------------------------------------------- http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/nIIfD6jUDgU/753-20181003-c… ∗∗∗ [20181002] - Core - Inadequate default access level for com_joomlaupdate ∗∗∗ --------------------------------------------- Project: Joomla! SubProject: CMS Impact: High Severity: Low Versions: 2.5.4 through 3.8.12 Exploit type: Object Injection Reported Date: 2018-June-21 Fixed Date: 2018-October-02 CVE Number: CVE-2018-17856 Description Joomla’s com_joomlaupdate allows the execution of arbitrary code. The default ACL config enabled access of Administrator-level users to access com_joomlaupdate and trigger a code execution. Affected Installs Joomla! CMS versions 2.5.4 through 3.8.12 --------------------------------------------- http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/MptbHWIJjXM/752-20181002-c… ∗∗∗ [20181001] - Core - Hardening com_contact contact form ∗∗∗ --------------------------------------------- Project: Joomla! SubProject: CMS Impact: Moderate Severity: Low Versions: 2.5.0 through 3.8.12 Exploit type: Incorrect Access Control Reported Date: 2018-September-17 Fixed Date: 2018-October-02 CVE Number: CVE-2018-17859 Description Inadequate checks in com_contact could allowed mail submission in disabled forms. Affected Installs Joomla! CMS versions 2.5.0 through 3.8.12 Solution Upgrade to version 3.8.13 Contact The JSST at the Joomla! Security Centre. Reported By: David Jardin (JSST) --------------------------------------------- http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/lkwPYx4JflE/751-20181001-c… ∗∗∗ SAP Security Patch Day - October 2018 ∗∗∗ --------------------------------------------- On 9th of October 2018, SAP Security Patch Day saw the release of 11 Security Notes. Additionally, there were 4 updates to previously released security notes. --------------------------------------------- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=500633095 ∗∗∗ SSA-347726: Denial-of-Service Vulnerability in SIMATIC S7-1500, SIMATIC S7-1500 Software Controller and SIMATIC ET 200SP Open Controller ∗∗∗ --------------------------------------------- Versions of SIMATIC S7-1500, SIMATIC S7-1500 Software Controller and SIMATIC ET 200 SP Open Controller are affected by a denial-of-service vulnerability. An attacker with network access to the PLC can cause a Denial-of-Service condition on the network stack. --------------------------------------------- https://cert-portal.siemens.com/productcert/txt/ssa-347726.txt ∗∗∗ SSA-254686: Foreshadow / L1 Terminal Fault Vulnerabilities in Industrial Products ∗∗∗ --------------------------------------------- Security researchers published information on vulnerabilities known as Foreshadow and L1 Terminal Fault (L1TF). These vulnerabilities affect many modern processors from different vendors to a varying degree. Several Siemens Industrial Products contain processors that are affected by the vulnerabilities. --------------------------------------------- https://cert-portal.siemens.com/productcert/txt/ssa-254686.txt ∗∗∗ SSA-464260: TLS ROBOT vulnerability in SCALANCE W1750D ∗∗∗ --------------------------------------------- The latest update for SCALANCE W1750D addresses a vulnerability known as _ROBOT Attack_. The vulnerability could allow an attacker to decrypt TLS traffic. Siemens provides a firmware update and recommends users to update to the new version. --------------------------------------------- https://cert-portal.siemens.com/productcert/txt/ssa-464260.txt ∗∗∗ SSA-493830: Privilege Escalation in ROX II ∗∗∗ --------------------------------------------- The latest update for ROX II fixes two vulnerabilities. One vulnerability could allow an attacker with a low-privileged user account to execute arbitrary commands. The other vulnerability could allow an attacker with a low-privileged user account to escalate his privileges. --------------------------------------------- https://cert-portal.siemens.com/productcert/txt/ssa-493830.txt ∗∗∗ SSA-507847: Cross-Site Request Forgery Vulnerability in SIMATIC S7-1200 CPU Family ∗∗∗ --------------------------------------------- The latest firmware update for S7-1200 CPU family version 4 fixes a Cross-Site Request Forgery vulnerability. Siemens recommends to update affected devices as soon as possible. --------------------------------------------- https://cert-portal.siemens.com/productcert/txt/ssa-507847.txt ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (git), Debian (kernel, samba, and tinc), Fedora (kernel-headers), Oracle (firefox), Red Hat (firefox and qemu-kvm-rhev), Scientific Linux (firefox), SUSE (java-1_8_0-ibm, kubernetes-salt, velum, libxml2, and postgresql10), and Ubuntu (libxkbcommon). --------------------------------------------- https://lwn.net/Articles/767948/ ∗∗∗ iCloud for Windows 7.7 ∗∗∗ --------------------------------------------- https://support.apple.com/kb/HT209141 ∗∗∗ iOS 12.0.1 ∗∗∗ --------------------------------------------- https://support.apple.com/kb/HT209162 ∗∗∗ Zimbra Collaboration Suite: Eine Schwachstelle ermöglicht das Darstellen falscher Informationen ∗∗∗ --------------------------------------------- https://adv-archiv.dfn-cert.de/adv/2018-2038/ ∗∗∗ IBM Security Bulletin: IBM Netcool/OMNIbus Probe DSL Factory Framework is affected by Apache Camel’s Core vulnerability ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10731893 ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in WebSphere application server affect IBM Workload Scheduler ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10734305 ∗∗∗ Remote Code Execution via XMeye P2P Cloud in Xiongmai IP Cameras, NVRs and DVRs ∗∗∗ --------------------------------------------- https://www.sec-consult.com/en/blog/advisories/vulnerabilities-xiongmai-ip-… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 08.10.2018
by Daily end-of-shift report 08 Oct '18

08 Oct '18

===================== = End-of-Day report = ===================== Timeframe: Freitag 05-10-2018 18:00 − Montag 08-10-2018 18:00 Handler: Dimitri Robl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Git Project Patches Remote Code Execution Vulnerability in Git ∗∗∗ --------------------------------------------- The Git Project announced yesterday a critical arbitrary code execution vulnerability in the Git command line client, Git Desktop, and Atom that could allow malicious repositories to remotely execute commands on a vulnerable machine. --------------------------------------------- https://www.bleepingcomputer.com/news/security/git-project-patches-remote-c… ∗∗∗ Sony Smart TV Bug Allows Remote Access, Root Privileges ∗∗∗ --------------------------------------------- Software patching becomes a new reality for smart TV owners. --------------------------------------------- https://threatpost.com/sony-smart-tv-bug-allows-remote-access-root-privileg… ∗∗∗ ENISA publishes annual report on trust services security incidents 2017 ∗∗∗ --------------------------------------------- ENISA publishes the first full-year annual report on security incidents with electronic trust services, covering 2017. --------------------------------------------- https://www.enisa.europa.eu/news/enisa-news/enisa-publishes-annual-report-o… ∗∗∗ Sicherheitsupdate: D-Link Central WiFi Manager anfällig für Schadcode ∗∗∗ --------------------------------------------- In der Windows-Version von D-Link Central WiFi Manager klaffen mehrere Sicherheitslücken. Mindestens eine davon gilt als kritisch. Ein Patch schafft Abhilfe. --------------------------------------------- http://heise.de/-4183206 ∗∗∗ macOS: Code-Signing teilweise aushebelbar ∗∗∗ --------------------------------------------- Gatekeeper soll dafür sorgen, dass bekannte Malware auf dem Mac nicht startet. Überprüft wird aber oft nur ein Mal, warnt ein Sicherheitsforscher. --------------------------------------------- http://heise.de/-4182870 ===================== = Vulnerabilities = ===================== ∗∗∗ VU#176301: Auto-Maskin DCU 210E RP 210E and Marine Pro Observer App ∗∗∗ --------------------------------------------- Vulnerability Note VU#176301 Auto-Maskin DCU 210E RP 210E and Marine Pro Observer App Original Release date: 06 Oct 2018 | Last revised: 08 Oct 2018 Overview Auto-Maskin RP remote panels and DCU controls units are used to monitor and control ship engines. The units have several authentication and encryption vulnerabilities which can allow attackers to access the units and control connected engines. Description CWE 798: Use of Hard-Coded Credentials - CVE–2018-5399 [...] --------------------------------------------- http://www.kb.cert.org/vuls/id/176301 ∗∗∗ FLIR Systems FLIR Thermal Traffic Cameras Websocket Device Manipulation ∗∗∗ --------------------------------------------- FLIR thermal traffic cameras suffer from an unauthenticated device manipulation vulnerability utilizing the websocket protocol. The affected FLIR Intelligent Transportation Systems - ITS models use an insecure implementation of websocket communication used for administering the device. Authentication and authorization bypass via referencing a direct object allows an attacker to directly modify running configurations, disclose information or initiate a denial of service (DoS) scenario with [...] --------------------------------------------- http://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5490.php ∗∗∗ FLIR Systems FLIR Thermal Traffic Cameras RTSP Stream Disclosure ∗∗∗ --------------------------------------------- FLIR thermal traffic cameras suffer from an unauthenticated and unauthorized live RTSP video stream access. --------------------------------------------- http://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5489.php ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (adplug, git, php-horde, php-horde-core, and php-horde-kronolith), Fedora (firefox, liblouis, libmad, mediawiki, opensc, php-horde-horde, php-horde-Horde-Core, php-horde-kronolith, and rust), Gentoo (imagemagick, openssh, and sox), openSUSE (ghostscript, gitolite, java-1_8_0-openjdk, kernel, php5, php7, python, thunderbird, tomcat, and unzip), Red Hat (firefox and rh-haproxy18-haproxy), and SUSE (ImageMagick, java-1_8_0-openjdk, kernel, qpdf, [...] --------------------------------------------- https://lwn.net/Articles/767873/ ∗∗∗ IBM Security Bulletin: IBM Security Key Lifecycle Manager Misses Authentication for Critical Function (CVE-2018-1745) ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10733355 ∗∗∗ IBM Security Bulletin: IBM Security Key Lifecycle Manager is vulnerable to Improper Authentication (CVE-2018-1738) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10733309 ∗∗∗ IBM Security Bulletin: IBM Tivoli Netcool Impact is affected by an Information disclosure of stack trace vulnerability (CVE-2018-1553) ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10733541 ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli Netcool Impact ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10733543 ∗∗∗ IBM Security Bulletin: Vulnerabilities in NTP, OpenSSL and Intel CPU’s affect IBM Netezza Firmware Diagnostics. ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=swg22016330 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 05.10.2018
by Daily end-of-shift report 05 Oct '18

05 Oct '18

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 04-10-2018 18:00 − Freitag 05-10-2018 18:00 Handler: Dimitri Robl Co-Handler: Stefan Lenzhofer ===================== = News = ===================== ∗∗∗ Fallout Exploit Kit Now Installing the Kraken Cryptor Ransomware ∗∗∗ --------------------------------------------- The Fallout Exploit has been distributing the GandCrab Ransomware for the past few weeks, but has now switched its payload to the Kraken Cryptor Ransomware. --------------------------------------------- https://www.bleepingcomputer.com/news/security/fallout-exploit-kit-now-inst… ∗∗∗ 365 Days Later: Finding and Exploiting Safari Bugs using Publicly Available Tools ∗∗∗ --------------------------------------------- Posted by Ivan Fratric, Google Project ZeroAround a year ago, we published the results of research about the resilience of modern browsers against DOM fuzzing, a well-known technique for finding browser bugs. Together with the bug statistics we also published Domato, our DOM fuzzing tool that was used to find those bugs.Given that in the previous research, Apple Safari, or more specifically, WebKit (its DOM engine) did noticeably worse than other browsers, we decided to revisit it after a year [...] --------------------------------------------- https://googleprojectzero.blogspot.com/2018/10/365-days-later-finding-and-e… ∗∗∗ ThreatList: 83% of Routers Contain Vulnerable Code ∗∗∗ --------------------------------------------- Five out of six name brand routers, such as Linksys, NETGEAR and D-Link, contain known open-source vulnerabilities. --------------------------------------------- https://threatpost.com/threatlist-83-of-routers-contain-vulnerable-code/137… ∗∗∗ Domain Name System: Vorsichtsmaßnahmen für den DNS-Schlüsseltausch ∗∗∗ --------------------------------------------- Der kryptografische Hauptschlüssel des DNS wird in einer Woche gewechselt. Für unvorbereitete Provider kann das fatale Folgen haben. --------------------------------------------- http://heise.de/-4179793 ===================== = Vulnerabilities = ===================== ∗∗∗ Carestream Vue RIS ∗∗∗ --------------------------------------------- This advisory includes mitigations for an information exposure through an error message vulnerability in the Carestream Vue RIS, a web-based radiology information system. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSMA-18-277-01 ∗∗∗ Change Healthcare PeerVue Web Server ∗∗∗ --------------------------------------------- This advisory includes mitigations for an information exposure through an error message vulnerability in the Change Healthcare PeerVue Web Server. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSMA-18-277-02 ∗∗∗ WECON PI Studio ∗∗∗ --------------------------------------------- This advisory includes information on stack-based buffer overflow, out-of-bounds write, and out-of-bounds read vulnerabilities in WECON’s PI Studio HMI project programmer. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-18-277-01 ∗∗∗ Security Advisory 2018-06: Security Update for OTRS Framework ∗∗∗ --------------------------------------------- October 05, 2018 — Please read carefully and check if the version of your OTRS system is affected by this vulnerability. Please send information regarding vulnerabilities in OTRS to: security(a)otrs.org PGP Key pub 2048R/9C227C6B 2011-03-21 [expires at: 2020-11-16] uid OTRS Security Team GPG Fingerprint E330 4608 DA6E 34B7 1551 C244 7F9E 44E9 9C22The post Security Advisory 2018-06: Security Update for OTRS Framework appeared first on | community.otrs.com. --------------------------------------------- https://community.otrs.com/security-advisory-2018-06-security-update-for-ot… ∗∗∗ VMSA-2018-0024.1 ∗∗∗ --------------------------------------------- VMware Workspace ONE Unified Endpoint Management Console (AirWatch Console) update resolves SAML authentication bypass vulnerability --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2018-0024.html ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (kernel), Fedora (lcms2, php-tcpdf, and udisks2), openSUSE (ImageMagick, libX11, openssl-1_0_0, openssl-1_1, and otrs), SUSE (kernel, php5, php53, php7, and python), and Ubuntu (apparmor and imagemagick). --------------------------------------------- https://lwn.net/Articles/767689/ ∗∗∗ IBM Security Bulletin: A vulnerability in yum-utils affects PowerKVM ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10728307 ∗∗∗ IBM Security Bulletin: Vulnerabilities in docker affect PowerKVM ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10725649 ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Rational DOORS Web Access ∗∗∗ --------------------------------------------- https://www.ibm.com/support/docview.wss?uid=ibm10733857 ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Rational Application Developer for WebSphere Software ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10733905 ∗∗∗ IBM Security Bulletin: IBM Security Key Lifecycle Manager generates Application Error (CVE-2018-1753) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10733359 ∗∗∗ IBM Security Bulletin: IBM Security Key Lifecycle Manager is vulnerable to Incorrect Permission Assignment for Critical Resource (CVE-2018-1750) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10733311 ∗∗∗ IBM Security Bulletin: IBM Security Key Lifecycle Manager is vulnerable to Hazardous Input Validation ( CVE-2018-1749) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10733303 ∗∗∗ IBM Security Bulletin: IBM Security Key Lifecycle Manager is vulnerable to Information Exposure (CVE-2018-1743) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10733351 ∗∗∗ IBM Security Bulletin: IBM Security Key Lifecycle Manager Uses Hard-coded Credentials (CVE-2018-1742) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10733419 ∗∗∗ IBM Security Bulletin: IBM Security Key Lifecycle Manager is vulnerable to Improper Control of Interaction Frequency (CVE-2018-1741) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10733425 ∗∗∗ Security vulnerabilities fixed in Thunderbird 60.2.1 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2018-25/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 04.10.2018
by Daily end-of-shift report 04 Oct '18

04 Oct '18

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 03-10-2018 18:00 − Donnerstag 04-10-2018 18:00 Handler: Stephan Richter Co-Handler: Dimitri Robl ===================== = News = ===================== ∗∗∗ Phishing Attacks Distributed Through CloudFlares IPFS Gateway ∗∗∗ --------------------------------------------- Yesterday we reported on a phishing attack that utilizes Azure Blob storage in order to have login forms secured by a Microsoft issued SSL certificate. After reviewing the URLs used by the same attacker, BleepingComputer has discovered that these same bad actors are utilizing the Cloudflare IPFS gateway for the same purpose. --------------------------------------------- https://www.bleepingcomputer.com/news/security/phishing-attacks-distributed… ∗∗∗ Nicht bei conquerconsoles.com, konsolenkammer24.de oder konsolenstation24.com kaufen ∗∗∗ --------------------------------------------- Die Fakeshops conquerconsoles.com, konsolenkammer24.de und konsolenstation24.com vertreiben Spielkonsolen und Spiele zu unschlagbaren Preisen. Die Fakeshops locken mit Angeboten, wo Sie eine PlayStation 4 samt Spiel und Controller kostengünstig erwerben können. Sie können nur im Voraus per Banküberweisung bezahlen, erhalten aber keine Ware! --------------------------------------------- https://www.watchlist-internet.at/news/nicht-bei-conquerconsolescom-konsole… ===================== = Vulnerabilities = ===================== ∗∗∗ Printer, email and PDF versions - Highly critical - Remote Code Execution - SA-CONTRIB-2018-063 ∗∗∗ --------------------------------------------- Project: Printer, email and PDF versionsVersion: 7.x-2.x-devDate: 2018-October-03Security risk: Highly critical 20∕25 AC:None/A:None/CI:All/II:All/E:Theoretical/TD:UncommonVulnerability: Remote Code ExecutionDescription: This module provides printer-friendly versions of content, including send by e-mail and PDF versions.The module doesnt sufficiently sanitize the arguments passed to the wkhtmltopdf executable, allowing a remote attacker to execute arbitrary shell commands. --------------------------------------------- https://www.drupal.org/sa-contrib-2018-063 ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (firefox and python-django), Debian (dnsmasq, firefox-esr, imagemagick, and linux-4.9), Fedora (haproxy), openSUSE (bitcoin, firefox, and texlive), SUSE (openslp), and Ubuntu (apache2). --------------------------------------------- https://lwn.net/Articles/767611/ ∗∗∗ Cisco Digital Network Architecture Center Unauthenticated Access Vulnerability ∗∗∗ --------------------------------------------- A vulnerability in Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated, remote attacker to bypass authentication and have direct unauthorized access to critical management functions.The vulnerability is due to an insecure default configuration of the affected system. An attacker could exploit this vulnerability by directly connecting to the exposed services. An exploit could allow the attacker to retrieve and modify critical system files. --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco Digital Network Architecture Center Authentication Bypass Vulnerability ∗∗∗ --------------------------------------------- A vulnerability in the identity management service of Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated, remote attacker to bypass authentication and take complete control of identity management functions.The vulnerability is due to insufficient security restrictions for critical management functions. An attacker could exploit this vulnerability by sending a valid identity management request to the affected system. --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ More Cisco Security Advisories ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/publicationListing.x ∗∗∗ Red Hat JBoss Web Server: Eine Schwachstelle ermöglicht das Erlangen von Benutzerrechten ∗∗∗ --------------------------------------------- https://adv-archiv.dfn-cert.de/adv/2018-1992/ ∗∗∗ Apache Tomcat: Eine Schwachstelle ermöglicht das Darstellen falscher Informationen ∗∗∗ --------------------------------------------- https://adv-archiv.dfn-cert.de/adv/2018-2000/ ∗∗∗ ClamAV: Mehrere Schwachstellen ermöglichen verschiedene Denial-of-Service-Angriffe ∗∗∗ --------------------------------------------- https://adv-archiv.dfn-cert.de/adv/2018-2008/ ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 03.10.2018
by Daily end-of-shift report 03 Oct '18

03 Oct '18

===================== = End-of-Day report = ===================== Timeframe: Dienstag 02-10-2018 18:00 − Mittwoch 03-10-2018 18:00 Handler: Dimitri Robl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Phishing Attack Uses Azure Blob Storage to Impersonate Microsoft ∗∗∗ --------------------------------------------- A new Office 365 phishing attack utilizes an interesting method of storing their phishing form hosted on Azure Blob Storage in order to be secured by a Microsoft SSL certificate. --------------------------------------------- https://www.bleepingcomputer.com/news/security/phishing-attack-uses-azure-b… ∗∗∗ ct deckt auf: Enigmail verschickt Krypto-Mails im Klartext ∗∗∗ --------------------------------------------- In der verbreiteten Thunderbird-Erweiterung Enigmail steckt ein fataler Fehler. Das Problem betrifft den Junior-Modus, der seit April standardmäßig aktiv ist. --------------------------------------------- https://heise.de/-4180405 ∗∗∗ Popular TP-Link wireless home router open to remote hijacking ∗∗∗ --------------------------------------------- By concatenating a known improper authentication flaw with a newly discovered CSRF vulnerability, remote unauthenticated attackers can obtain full control over TP-Link TL-WR841N, a popular wireless consumer router used worldwide. "This type of remote attack can also compromise routers behind a network address translator (NAT) and those not exposed to the public wide area network (WAN) as the vulnerability is remotely reflected off a locally connected host, rather than coming directly over [...] --------------------------------------------- https://www.helpnetsecurity.com/2018/10/03/tp-link-wireless-home-router-hij… ===================== = Vulnerabilities = ===================== ∗∗∗ Delta Electronics ISPSoft ∗∗∗ --------------------------------------------- This advisory includes mitigations for a stack-based buffer overflow vulnerability in the Delta Electronics ISPSoft software. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-18-275-01 ∗∗∗ GE Communicator ∗∗∗ --------------------------------------------- This advisory includes mitigations for a heap-based buffer overflow vulnerability in GEs Communicator, an application for programming and monitoring supported metering devices. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-18-275-02 ∗∗∗ Entes EMG 12 ∗∗∗ --------------------------------------------- This advisory includes mitigations for improper authentication and information exposure through query strings in GET request vulnerabilities in the Entes EMG 12 Ethernet Modbus Gateway. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-18-275-03 ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Fedora (elfutils), Gentoo (firefox), Red Hat (instack-undercloud, openstack-tripleo-heat-templates and openstack-nova), Slackware (mozilla), SUSE (ghostscript, ImageMagick, kernel, mgetty, qemu, and unzip), and Ubuntu (firefox, haproxy, kernel, liblouis, and webkit2gtk). --------------------------------------------- https://lwn.net/Articles/767539/ ∗∗∗ ZDI-18-1107: (0Day) Wecon PIStudio screendata HSC Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-18-1107/ ∗∗∗ ZDI-18-1106: (0Day) Wecon PIStudio xmlparser LoadXMLFile XML External Entity Processing Information Disclosure Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-18-1106/ ∗∗∗ ZDI-18-1109: (0Day) Wecon PIStudio basedll TextContent Stack-based Buffer Overflow Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-18-1109/ ∗∗∗ ZDI-18-1108: (0Day) Wecon PIStudio cximageu Image Parsing Out-Of-Bounds Read Information Disclosure Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-18-1108/ ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ ∗∗∗ HPESBGN03900 rev.1 - HPE enhanced Internet Usage Manager (eIUM) Remote Unauthorized Disclosure of Information vulnerability and Remote Bypass Security Restrictions ∗∗∗ --------------------------------------------- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_n… ∗∗∗ Security vulnerabilities fixed in Firefox 62.0.3 and Firefox ESR 60.2.2 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2018-24/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 02.10.2018
by Daily end-of-shift report 02 Oct '18

02 Oct '18

===================== = End-of-Day report = ===================== Timeframe: Montag 01-10-2018 18:00 − Dienstag 02-10-2018 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Security Update for Foxit PDF Reader Fixes 118 Vulnerabilities ∗∗∗ --------------------------------------------- It has not been a good week for PDF programs. We had an Adobe Acrobat & Reader update released yesterday that fixed 86 vulnerabilities, including numerous critical ones. Not to be beaten, an update for Foxit PDF Reader and Foxit PhantomPDF was released last Friday that fixes a whopping 116 vulnerabilities. --------------------------------------------- https://www.bleepingcomputer.com/news/security/security-update-for-foxit-pd… ∗∗∗ Nine NAS Bugs Open LenovoEMC, Iomega Devices to Attack ∗∗∗ --------------------------------------------- Rated as high-risk vulnerabilities, these privilege-escalation flaws could allow an unauthenticated attacker to access protected content. --------------------------------------------- https://threatpost.com/nine-nas-bugs-open-lenovoemc-iomega-devices-to-attac… ∗∗∗ Keine Rechnung von ibostream.de und sobastream.de zahlen ∗∗∗ --------------------------------------------- Die Abo-Fallen ibostream.de und sobastream.de sehen für ihre Nutzung eine kostenlose Registrierung vor. Fünf Tagen nach der Registrierung erhalten Konsument/innen von der Ibo Das Limited oder der Stream It Limited eine Rechnung von 359,88- Euro. Nutzer/innen müssen die Summe nicht bezahlen, denn zwischen ihnen und ibostream.de oder sobastream.de gibt es keinen Vertrag. --------------------------------------------- https://www.watchlist-internet.at/news/keine-rechnung-von-ibostreamde-und-s… ===================== = Vulnerabilities = ===================== ∗∗∗ Kritische Sicherheitslücken in Adobe Acrobat und Reader - Patches verfügbar ∗∗∗ --------------------------------------------- Adobe hat ausserhalb des monatlichen Patch-Zyklus Updates für Acrobat und Reader veröffentlicht, mit denen teils kritische Sicherheitslücken geschlossen werden. --------------------------------------------- https://www.cert.at/warnings/all/20181002.html ∗∗∗ Android Security Bulletin - October 2018 ∗∗∗ --------------------------------------------- The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. [...] The most severe of these issues is a critical security vulnerability in Framework that could enable a remote attacker using a specially crafted file to execute arbitrary code within the context of a privileged process. --------------------------------------------- https://source.android.com/security/bulletin/2018-10-01.html ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (lib32-libxml2, libxml2, mosquitto, and ntp), Debian (kernel and strongswan), Fedora (firefox), openSUSE (zsh), Oracle (kernel), Red Hat (ceph-iscsi-cli), SUSE (openssl-1_0_0), and Ubuntu (kernel, linux, linux-aws, linux-gcp, linux-kvm, linux-oem, linux-raspi2, linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon, linux-hwe, linux-gcp, linux-lts-trusty, linux-lts-xenial, linux-aws, and strongswan). --------------------------------------------- https://lwn.net/Articles/767467/ ∗∗∗ Vuln: LibTIFF CVE-2018-17795 Heap Based Buffer Overflow Vulnerability ∗∗∗ --------------------------------------------- http://www.securityfocus.com/bid/105445 ∗∗∗ Red Hat JBoss A-MQ, Red Hat JBoss Fuse: Eine Schwachstelle ermöglicht das Erlangen von Benutzerrechten ∗∗∗ --------------------------------------------- https://adv-archiv.dfn-cert.de/adv/2018-1989/ ∗∗∗ IBM Security Bulletin: Multiple security vulnerabilities in GSKit used by Edge Caching proxy of WebSphere Application Server ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10732391 ∗∗∗ IBM Security Bulletin: Cross-site scripting vulnerability in OAuth ear in WebSphere Application Server (CVE-2018-1794) ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10729571 ∗∗∗ IBM Security Bulletin: Cross-site scripting vulnerability in SAML ear in WebSphere Application Server (CVE-2018-1793) ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10729563 ∗∗∗ IBM Security Bulletin: Multiple Security Vulnerabilities affect IBM® Cloud Private (CVE-2018-0739,CVE-2017-17512, CVE-2018-1000122) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10719199 ∗∗∗ IBM Security Bulletin: IBM b-type Network/Storage switches are affected by Sweet32: Birthday attacks on 64-bit block ciphers in TLS and OpenVPN (openssl ,redhat,openVPN) vulnerabilities. ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ssg1S1010724 ∗∗∗ Password disclosure vulnerability & XSS in PTC ThingWorx ∗∗∗ --------------------------------------------- https://www.sec-consult.com/en/blog/advisories/password-disclosure-vulnerab… ∗∗∗ HPESBHF03897 rev.1 - HPE Switches and Routers using OpenSSL, and Intelligent Management Center (iMC) PLAT, Remote Denial of Service ∗∗∗ --------------------------------------------- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_n… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 01.10.2018
by Daily end-of-shift report 01 Oct '18

01 Oct '18

===================== = End-of-Day report = ===================== Timeframe: Freitag 28-09-2018 18:00 − Montag 01-10-2018 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ IC3 Issues Alert Regarding Remote Desktop Protocol (RDP) Attacks ∗∗∗ --------------------------------------------- The Internet Crime Complaint Center (IC3), in collaboration with the Department of Homeland Security and the FBI, have issued a security alert regarding attacks being conducted through the Windows Remote Desktop Protocol. --------------------------------------------- https://www.bleepingcomputer.com/news/security/ic3-issues-alert-regarding-r… ∗∗∗ FBI löst Rätsel um 15 Jahre alte Malware ∗∗∗ --------------------------------------------- Jahrelang spionierte die Fruitfly-Malware unbemerkt Mac-User aus. Nun wurde bekannt, wie die Schadsoftware verbreitet wurde. --------------------------------------------- https://futurezone.at/digital-life/fbi-loest-raetsel-um-15-jahre-alte-malwa… ∗∗∗ Dark Web Azorult Generator Offers Free Binaries to Cybercrooks ∗∗∗ --------------------------------------------- The Gazorp online builder makes it easy to start stealing passwords, credit-card information, cryptocurrency wallet data and more. --------------------------------------------- https://threatpost.com/dark-web-azorult-generator-offers-free-binaries-to-c… ∗∗∗ 70+ different types of home routers(all together 100,000+) are being hijacked by GhostDNS ∗∗∗ --------------------------------------------- note:We have informed various ISPs on the IoC list, and OVH, ORACLE, Google have taken down the related IPs and some others are working on it (Thanks!)Background introductionDNSchanger is not something new and was quite active years ago [1], we occasionally encountered one every once in a [...] --------------------------------------------- http://blog.netlab.360.com/70-different-types-of-home-routers-all-together-… ∗∗∗ Oktober ist Cyber Security-Monat! ∗∗∗ --------------------------------------------- Unter dem Titel "Cyber Security is a Shared Responsibility" findet im Oktober die inzwischen 7. Kampagne der EU zur Verbesserung der allgemeinen Informationssicherheit statt: Der Europäische Cybersicherheitsmonat (ECSM) ist ein breit koordiniertes und umfangreich aufgestelltes Veranstaltungsformat, das Bewusstsein fördern und Kenntnisse vermitteln will. So werden Schritte aufzeigt, die alle Bürger*innen und Organisationen zum Schutz von persönlichen, finanziellen [...] --------------------------------------------- https://www.ikarussecurity.com/at/ueber-ikarus/security-blog/oktober-ist-cy… ∗∗∗ Facebook-Hack: Kombination aus mehreren Software-Lücken war schuld ∗∗∗ --------------------------------------------- Drei Lücken exponierten Millionen Facebook-Konten, darunter das von Mark Zuckerberg. Womöglich waren auch Drittanbieter-Dienste per Facebook-Login betroffen. --------------------------------------------- https://heise.de/-4178569 ∗∗∗ Explosion of look-alike domains aims to steal sensitive data from online shoppers ∗∗∗ --------------------------------------------- Venafi released research on the explosion of look-alike domains, which are routinely used to steal sensitive data from online shoppers. Venafi's research analyzed suspicious domains targeting the top 20 retailers in five key markets: the U.S., U.K., France, Germany and Australia. --------------------------------------------- https://www.helpnetsecurity.com/2018/10/01/look-alike-domains/ ∗∗∗ Erpressung mit intimen Videomaterial ∗∗∗ --------------------------------------------- Kriminelle versenden eine E-Mail, in der es heißt, dass sie das Empfänger/innen-Konto übernommen haben und sein Passwort kennen. Opfer sollen 600 US-Dollar in Bitcoins zahlen, damit die Verbrecher/innen kein intimes Videomaterial veröffentlichen. Konsument/innen können die Nachricht ignorieren und müssen nur ihr Passwort ändern. Eine Zahlung ist nicht erforderlich. --------------------------------------------- https://www.watchlist-internet.at/news/erpressung-mit-intimen-videomaterial/ ===================== = Vulnerabilities = ===================== ∗∗∗ Skype On Debian Microsoft Apt Repo Addition ∗∗∗ --------------------------------------------- Topic: Skype On Debian Microsoft Apt Repo Addition Risk: High Text:Level: Critical Description: The Skype debian packege for Skype (even when not installed via their offical repo) [...] --------------------------------------------- https://cxsecurity.com/issue/WLB-2018090274 ∗∗∗ UPDATED: Security Bulletins Posted ∗∗∗ --------------------------------------------- [...] UPDATE: As of September 28, Adobe is aware of a report that CVE-2018-15961 is being actively exploited in the wild. The updates for ColdFusion 2018 and ColdFusion 2016 announced in APSB18-33 have been elevated to Priority 1, and Adobe recommends customers update to the latest version as soon as possible. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1607 ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (mediawiki), CentOS (389-ds-base, firefox, flatpak, kernel, mod_perl, nss, spice and spice-gtk, and spice-gtk and spice-server), Debian (389-ds-base, ghostscript, mosquitto, and python3.5), Fedora (ca-certificates, firefox, glusterfs, kernel-headers, kernel-tools, libxkbcommon, udisks2, and zchunk), Mageia (firefox), openSUSE (gd, gnutls, mgetty, openssl, and yast2-smt), Oracle (firefox and kernel), Scientific Linux (firefox), SUSE (libX11 and [...] --------------------------------------------- https://lwn.net/Articles/767373/ ∗∗∗ Security Advisory - FRP Bypass Vulnerability in MyCloud APP of Huawei Smart Phones ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2018/huawei-sa-20180930-… ∗∗∗ IBM Security Bulletin: IBM Security Guardium is affected by a Publicly disclosed Apache Struts vulnerability ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10732783 ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM i ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10731329 ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Security Guardium ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10732785 ∗∗∗ IBM Security Bulletin: Cross-site scripting vulnerabilities affect multiple IBM Rational products based on IBM Jazz technology ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10732477 ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Tivoli Netcool/OMNIbus (Multiple CVEs) ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10733457 ∗∗∗ IBM Security Bulletin: IBM Security Guardium is affected by a Using Components with Known Vulnerabilities vulnerability ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10730313 ∗∗∗ IBM Security Bulletin: IBM Security Guardium is affected by a Improper Certificate Validation vulnerability ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10730321 ∗∗∗ IBM Security Bulletin: IBM Security Guardium is affected by a Using Components with Known Vulnerabilities vulnerabilities ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10730329 ∗∗∗ IBM Security Bulletin: IBM Security Guardium is affected by a Missing Security Control vulnerability ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10730323 ∗∗∗ IBM Security Bulletin: IBM Security Guardium is affected by a Password in Clear Text vulnerability ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10730317 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily October 2018