Daily November 2018

daily@lists.cert.at

1 participants
21 discussions

Tageszusammenfassung - 30.11.2018
by Daily end-of-shift report 30 Nov '18

30 Nov '18

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 29-11-2018 18:00 − Freitag 30-11-2018 18:00 Handler: Dimitri Robl Co-Handler: Robert Waldner ===================== = News = ===================== ∗∗∗ Here are another 45,000 reasons to patch Windows systems against old NSA exploits ∗∗∗ --------------------------------------------- Its 2018 and UPnP is still opening up networks - this time to leaked SMB cyber-weapons Earlier this year, Akamai warned that vulnerabilities in Universal PlugNPlay (UPnP) had been exploited by scumbags to hijack 65,000 home routers. In follow-up research released this week, it revealed little has changed.… --------------------------------------------- https://www.theregister.co.uk/2018/11/30/akamai_routerwreckers_active/ ∗∗∗ Good practices for identifying and assessing cybersecurity interdependencies ∗∗∗ --------------------------------------------- A glance at the interdependency landscape reveals several emerging interdependencies between operators of essential services (OES) and digital service providers (DSP), at both system and service level. Due to these interdependencies, there is an increasing number of cybersecurity incidents that either propagated across organisations (often across borders), or had a cascading effect at the level of essential services. --------------------------------------------- https://www.enisa.europa.eu/news/enisa-news/good-practices-for-identifying-… ∗∗∗ Gezielte Angriffe gegen Firmen mit Trojaner in AutoCAD-Dateien ∗∗∗ --------------------------------------------- Echte CAD-Pläne mit beigefügten Skripten kopieren unbemerkt Firmengeheimnisse, warnen Sicherheitsforscher. --------------------------------------------- http://heise.de/-4236488 ∗∗∗ Hackers in Hot Water. Pwning smart hot tubs, yes really ∗∗∗ --------------------------------------------- We were given a tip by the awesome Ceri Coburn that something was amiss with the Balboa Water App, a mobile app used for controlling >30,000 hot tubs. You can remotely control your tub, so you can heat it up for when you’re ready, saving […] --------------------------------------------- https://www.pentestpartners.com/security-blog/hackers-in-hot-water-pwning-s… ===================== = Vulnerabilities = ===================== ∗∗∗ Critical Zoom Flaw Lets Hackers Hijack Conference Meetings ∗∗∗ --------------------------------------------- Hackers can spoof messages, hijack screen controls and kick others out of meetings. --------------------------------------------- https://threatpost.com/critical-zoom-flaw-lets-hackers-hijack-conference-me… ∗∗∗ GatherContent - Moderately critical - Access bypass - SA-CONTRIB-2018-075 ∗∗∗ --------------------------------------------- Project: GatherContent Date: 2018-November-28 Security risk: Moderately critical 13∕25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:All Vulnerability: Access bypass Description: This module enables you to import and export data from the GatherContent service.The module didnt properly protect its administrative paths. Solution: Install the latest version:If you use the gathercontent module for Drupal 7.x, upgrade to gathercontent 7.x-3.5Also see the GatherContent project page. --------------------------------------------- https://www.drupal.org/sa-contrib-2018-075 ∗∗∗ DSA-4347 perl - security update ∗∗∗ --------------------------------------------- https://www.debian.org/security/2018/dsa-4347 ∗∗∗ INVT Electric VT-Designer ∗∗∗ --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-18-333-01 ∗∗∗ IBM Security Bulletin: Potential Privilege escalation vulnerability in WebSphere Application Server (CVE-2018-1840) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-potential-privilege-e… ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli Monitoring ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-multiple-vulnerabilit… ∗∗∗ OpenSSL and Intel processor SMT side-channel vulnerability (PortSmash) CVE-2018-5407 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K49711130 ∗∗∗ USN-3833-1: Linux kernel (AWS) vulnerabilities ∗∗∗ --------------------------------------------- https://usn.ubuntu.com/3833-1/ ∗∗∗ USN-3832-1: Linux kernel (AWS) vulnerabilities ∗∗∗ --------------------------------------------- https://usn.ubuntu.com/3832-1/ ∗∗∗ HPESBHF03906 rev.1 - HPE Intelligent Management Center (IMC), Remote Buffer Overflow, Code Execution, Denial of Service ∗∗∗ --------------------------------------------- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_n… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 29.11.2018
by Daily end-of-shift report 29 Nov '18

29 Nov '18

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 28-11-2018 18:00 − Donnerstag 29-11-2018 18:00 Handler: Dimitri Robl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Sicherheitsvorfall: Dell setzt Kennwörter von Kunden zurück ∗∗∗ --------------------------------------------- Unbekannte hatten Zugriff auf Dell.com und waren auf der Suche nach Kundendaten. --------------------------------------------- http://heise.de/-4235101 ∗∗∗ PayPal-Käuferschutz-Falle bei Kleinanzeigenkauf ∗∗∗ --------------------------------------------- PayPal genießt hohes Vertrauen bei seinen Nutzer/innen aufgrund des angebotenen Käuferschutzes. Dennoch ist hier Vorsicht geboten, denn nicht immer kommt der Käuferschutz zum Tragen. Nutzen Sie beim Einkauf über Willhaben, Ebay, Geizhals und Co nicht die Funktion "Geld an Freunde oder Familie senden" bei PayPal. Der Käuferschutz gilt nicht und Ihr Geld ist verloren. --------------------------------------------- https://www.watchlist-internet.at/news/paypal-kaeuferschutz-falle-bei-klein… ∗∗∗ Achtung bei Anrufen von Microsoft ∗∗∗ --------------------------------------------- Aktuell häufen sich wieder betrügerische Anrufe von angeblichen Microsoft-Mitarbeiter/innen, die Sie auf Probleme mit Ihrem Computer aufmerksam machen. Im Zuge eine Fernwartung übernehmen Kriminelle Ihren Computer und fangen sensible Daten ab. Es handelt sich um eine Betrugsmasche. Legen Sie gleich auf! --------------------------------------------- https://www.watchlist-internet.at/news/achtung-bei-anrufen-von-microsoft/ ∗∗∗ Fake-Shop-Alarm bei modchips24.com ∗∗∗ --------------------------------------------- Modchips24.com bietet neben R4-Karten für diverse Konsolen, wie die Nintendo 3DS oder die Nintendo Switch, auch Playstations, Xboxen und unterschiedlichstes Zubehör an. Sie sollten hier auf keinen Fall bestellen, denn uns erreichen zahlreiche Meldungen über ausbleibende Lieferungen. Bezahlen müssen Sie per Vorkasse, Ihr Geld wäre also verloren. --------------------------------------------- https://www.watchlist-internet.at/news/fake-shop-alarm-bei-modchips24com/ ∗∗∗ Not A Security Boundary: Breaking Forest Trusts ∗∗∗ --------------------------------------------- For years Microsoft has stated that the forest was the security boundary in Active Directory. For example, Microsoft's "What Are Domains and Forests?" document (last updated in 2014) has a "Forests as Security Boundaries" section which states (emphasis added): --------------------------------------------- https://posts.specterops.io/not-a-security-boundary-breaking-forest-trusts-… ===================== = Vulnerabilities = ===================== ∗∗∗ Bootstrap - Moderately critical - Cross site scripting - SA-CONTRIB-2018-074 ∗∗∗ --------------------------------------------- Project: BootstrapVersion: 7.x-3.228.x-3.14Date: 2018-November-28Security risk: Moderately critical 11∕25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Cross site scriptingDescription: This base theme bridges the gap between Drupal and the Bootstrap Framework.The theme doesnt sufficiently filter valid targets under the scenario of opening modals, popovers, and tooltips. --------------------------------------------- https://www.drupal.org/sa-contrib-2018-074 ∗∗∗ Norton and SEP Multiple Issues ∗∗∗ --------------------------------------------- Symantec has released updates to address issues that were discovered in the Norton, Symantec Endpoint Protection (SEP), Symantec Endpoint Protection Small Business Edition (SEP SBE) and Symantec Endpoint Protection Cloud (SEP Cloud) products. --------------------------------------------- https://support.symantec.com/content/unifiedweb/en_US/article.SYMSA1468.html ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Gentoo (openssl and rpm), Mageia (icecast and yaml-cpp), Oracle (kernel and sos-collector), Red Hat (rh-ruby23-ruby, rh-ruby24-ruby, and rh-ruby25-ruby), Slackware (samba), SUSE (tomcat6), and Ubuntu (ghostscript). --------------------------------------------- https://lwn.net/Articles/773296/ ∗∗∗ 2018-11-26: Vulnerability in CP400 Panel Builder TextEditor 2.0 - Improper Input Validation Vulnerability ∗∗∗ --------------------------------------------- https://search.abb.com/library/Download.aspx?DocumentID=3BSE091042&Language… ∗∗∗ jQuery vulnerability CVE-2012-6708 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K62532311 ∗∗∗ SNMPv2 vulnerability CVE-1999-0517 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K04463175 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 28.11.2018
by Daily end-of-shift report 28 Nov '18

28 Nov '18

===================== = End-of-Day report = ===================== Timeframe: Dienstag 27-11-2018 18:00 − Mittwoch 28-11-2018 18:00 Handler: Dimitri Robl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ The Nature of Mass Exploitation Campaigns ∗∗∗ --------------------------------------------- Examples of how attackers carry out mass exploitation campaigns and how to defend against them. --------------------------------------------- https://threatpost.com/the-nature-of-mass-exploitation-campaigns/139428/ ∗∗∗ TA18-331A: 3ve – Major Online Ad Fraud Operation ∗∗∗ --------------------------------------------- This joint Technical Alert (TA) is the result of analytic efforts between the Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI). DHS and FBI are releasing this TA to provide information about a major online ad fraud operation—referred to by the U.S. Government as "3ve"—involving the control of over 1.7 million unique Internet Protocol (IP) addresses --------------------------------------------- https://www.us-cert.gov/ncas/alerts/TA18-331A ∗∗∗ Windows 10 1809: Update gegen Spectre-NG-Lücken ∗∗∗ --------------------------------------------- Mit dem Update KB4465065 liefert Microsoft Microcode-Updates für einige Intel-Prozessortypen zum Schutz gegen L1TF sowie Spectre V3a und V4. --------------------------------------------- http://heise.de/-4234362 ===================== = Vulnerabilities = ===================== ∗∗∗ AVEVA Vijeo Citect and Citect SCADA ∗∗∗ --------------------------------------------- This advisory includes mitigations for an uncontrolled search path element vulnerability in Schneider Electrics Software Update utility affecting AVEVAs Vijeo Citect and Citect SCADA products. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-18-331-01 ∗∗∗ Cisco Prime License Manager SQL Injection Vulnerability ∗∗∗ --------------------------------------------- A vulnerability in the web framework code of Cisco Prime License Manager(PLM) could allow an unauthenticated, remote attacker to execute arbitrary SQL queries. --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ FreeBSD: Multiple vulnerabilities in NFS server code ∗∗∗ --------------------------------------------- Insufficient and improper checking in the NFS server code could cause a denial of service or possibly remote code execution via a specially crafted network packet. --------------------------------------------- https://www.freebsd.org/security/advisories/FreeBSD-SA-18:13.nfs.asc ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (powerdns-recursor and samba), Debian (ghostscript), Fedora (community-mysql, flatpak, gettext, git, php-PHPMailer, php-phpmailer6, and wireshark), Oracle (kernel and NetworkManager), Scientific Linux (ghostscript, kernel, NetworkManager, and sos-collector), SUSE (dpdk, java-1_7_1-ibm, kernel, python-oslo.cache, python-oslo.concurrency, python-oslo.db, python-oslo.log, python-oslo.messaging, python-oslo.middleware, python-oslo.serialization, [...] --------------------------------------------- https://lwn.net/Articles/773179/ ∗∗∗ Synology-SA-18:60 Samba AD DC ∗∗∗ --------------------------------------------- CVE-2018-16841 and CVE-2018-16851 allow remote authenticated users to conduct denial-of-service attacks via a susceptible version of Synology Active Directory Server.None of Synology products are affected by CVE-2018-14629, CVE-2018-16852, CVE-2018-16853, and CVE-2018-16857 as these vulnerabilities only affect Samba 4.9.0 and later. --------------------------------------------- https://www.synology.com/en-global/support/security/Synology_SA_18_60 ∗∗∗ Microsoft Windows: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K18-1128 ∗∗∗ Security Advisory - Out-of-bounds Write Vulnerability on Several Smartphones ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2018/huawei-sa-20181128-… ∗∗∗ IBM Security Bulletin: A vulnerability in IBM Java SDK affects IBM Spectrum Scale packaged in IBM Elastic Storage Server (CVE-2018-12539) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-a-vulnerability-in-ib… ∗∗∗ IBM Security Bulletin: Vulnerability in IBM Java Runtime affect IBM SONAS (CVE-2016-0705) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-vulnerability-in-ibm-… ∗∗∗ IBM Security Bulletin: The Elastic Storage Server is affected by a vulnerability in IBM Spectrum Scale (CVE-2018-1783) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-the-elastic-storage-s… ∗∗∗ IBM Security Bulletin: The Elastic Storage Server is affected by a vulnerability in IBM Spectrum Scale (CVE-2018-1782) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-the-elastic-storage-s… ∗∗∗ IBM Security Bulletin: Cross-site scripting vulnerability affects multiple IBM Rational products based on IBM Jazz technology ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-cross-site-scripting-… ∗∗∗ IBM Security Bulletin: IBM® Db2® LUW on AIX and Linux Affected by a Vulnerability in IBM® Spectrum Scale (CVE-2018-1723). CVE-2018-1723, gpfs, spectrum scale Security Bulletin ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-ibm-db2-luw-on-aix-an… ∗∗∗ IBM Security Bulletin: This Power System firmware update is being released to address DHCP issue number CVE-2018-5732 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-this-power-system-fir… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 27.11.2018
by Daily end-of-shift report 27 Nov '18

27 Nov '18

===================== = End-of-Day report = ===================== Timeframe: Montag 26-11-2018 18:00 − Dienstag 27-11-2018 18:00 Handler: Dimitri Robl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ AutoIt-Compiled Worm Affecting Removable Media Delivers Fileless Version of BLADABINDI/njRAT Backdoor ∗∗∗ --------------------------------------------- BLADABINDI, also known as njRAT/Njw0rm, is a remote access tool (RAT) with a myriad of backdoor capabilities - from keylogging to carrying out distributed denial of service (DDoS) — and has been rehashed and reused in various cyberespionage campaigns since it first emerged. Indeed, BLADABINDI's customizability and seeming availability in the underground make it a prevalent threat. --------------------------------------------- https://blog.trendmicro.com/trendlabs-security-intelligence/autoit-compiled… ∗∗∗ NPM-Paket EventStream mit Bitcoin-Miner infiziert ∗∗∗ --------------------------------------------- In die Code-Bibliothek EventStream hat sich Schadcode eingeschlichen, der das Bitcoin Wallet Copay für Angreifer öffnet. --------------------------------------------- http://heise.de/-4233171 ∗∗∗ Lux-Codex nicht bestellen! ∗∗∗ --------------------------------------------- Auf lux-codex.com und wideally.com wird Ihnen der Lux-Codex - eine LED-Lampe in ausgefallenem Design - angeboten. Sie sollten hier nicht bestellen, denn Konsument/innen berichten uns von ausbleibender Lieferung trotz erfolgter Bezahlung! --------------------------------------------- https://www.watchlist-internet.at/news/lux-codex-nicht-bestellen/ ===================== = Vulnerabilities = ===================== ∗∗∗ Cisco Webex Meetings Desktop App Update Service Command Injection Vulnerability ∗∗∗ --------------------------------------------- A vulnerability in the update service of Cisco Webex Meetings Desktop App for Windows could allow an authenticated, local attacker to execute arbitrary commands as a privileged user.The vulnerability is due to insufficient validation of user-supplied parameters. An attacker could exploit this vulnerability by invoking the update service command with a crafted argument. An exploit could allow the attacker to run arbitrary commands with SYSTEM user privileges. --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ SSB-439005: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP ∗∗∗ --------------------------------------------- Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the current firmware version V2.6.0 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP. These GNU/Linux vulnerabilities have been externally identified and will be fixed with the next firmware version. --------------------------------------------- https://cert-portal.siemens.com/productcert/txt/ssb-439005.txt ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (gnuplot and samba), Fedora (flatpak, kernel-headers, kernel-tools, mariadb-connector-c, php-PHPMailer, php-phpmailer6, and xml-security-c), Gentoo (binutils, libav, mupdf, spice-gtk, strongswan, and tablib), Mageia (libpng(12), mariadb, and openssl), Oracle (ghostscript), Red Hat (.NET Core, ghostscript, java-1.7.1-ibm, kernel, kernel-alt, kernel-rt, NetworkManager, rh-nginx112-nginx, rh-nginx114-nginx, and sos-collector), Scientific Linux [...] --------------------------------------------- https://lwn.net/Articles/773100/ ∗∗∗ Vuln: Multiple Pivotal Cloud Foundry Products CVE-2018-15759 Access Bypass Vulnerability ∗∗∗ --------------------------------------------- http://www.securityfocus.com/bid/106019 ∗∗∗ Vuln: TIBCO Statistica Server CVE-2018-18807 Cross Site Scripting Vulnerability ∗∗∗ --------------------------------------------- http://www.securityfocus.com/bid/106021 ∗∗∗ ZDI-18-1362: (ODay) Juuko DATA Packet Command Injection Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-18-1362/ ∗∗∗ IBM Security Bulletin: Vulnerabilities identified in IBM® Java SDK affect WebSphere Service Registry and Repository and WebSphere Service Registry and Repository Studio (CVE-2018-3139 and CVE-2018-3180) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-vulnerabilities-ident… ∗∗∗ IBM Security Bulletin: Multiple security vulnerabilities affect Liberty for Java for IBM Cloud ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-multiple-security-vul… ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Rational Developer for i and Rational Developer for AIX and Linux – July 2018 Security Bulletin ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-multiple-vulnerabilit… ∗∗∗ IBM Security Bulletin: IBM Spectrum Scale for IBM Elastic Storage Server is affected by a vulnerability which could allow an unprivileged, authenticated user with access to a GPFS node to read arbitrary files available on this node (CVE-2018-1723) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-ibm-spectrum-scale-fo… ∗∗∗ IBM Security Bulletin: IBM Maximo Asset Management is vulnerable to cross site scripting (CVE-2018-1584) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-ibm-maximo-asset-mana… ∗∗∗ Samba: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K18-1123 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 26.11.2018
by Daily end-of-shift report 26 Nov '18

26 Nov '18

===================== = End-of-Day report = ===================== Timeframe: Freitag 23-11-2018 18:00 − Montag 26-11-2018 18:00 Handler: Dimitri Robl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ His phone went dark, then $1m was sucked out in SIM-swap crypto-heist ∗∗∗ --------------------------------------------- A 21-year-old allegedly SIM-swapped Silicon Valley execs' phones to steal cryptocurrency, including one mans $1m tuition fund for his kids. --------------------------------------------- https://nakedsecurity.sophos.com/2018/11/26/his-phone-went-dark-then-1m-was… ∗∗∗ Unseriöse Handwerker aus dem Internet ∗∗∗ --------------------------------------------- Konsument/innen, die in der Nacht Probleme mit ihren Heizkörpern, ihrem Schloss oder ihrer Elektronik haben, können über das Internet unseriöse Installateur/innen, Schlosser/innen oder Elektriker/innen finden. Sie werben auf Websites mit günstigen Angeboten. Vor Ort verlangen die Unternehmen jedoch ein Vielfaches des vereinbarten Preises. Nachträgliche Beanstandungen sind nicht möglich, weil sie Kund/innen erfundene Daten nennen. --------------------------------------------- https://www.watchlist-internet.at/news/unserioese-handwerker-aus-dem-intern… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (gnuplot5, icecast2, liblivemedia, otrs2, phpbb3, roundcube, squid3, and xml-security-c), Fedora (kio-extras, tmux, and xen), Gentoo (asterisk, chromium, exiv2, ghostscript-gpl, and thunderbird), openSUSE (libwpd, openssl, openssl-1_1, postgresql10, and SDL2_image), Red Hat (chromium-browser, rh-mysql57-mysql, rh-nginx110-nginx, and rh-nginx18-nginx), SUSE (exiv2, libgcrypt, rpm, and tiff), and Ubuntu (firefox and qemu). --------------------------------------------- https://lwn.net/Articles/772954/ ∗∗∗ ZDI-18-1361: (0Day) INVT Electric VT-Designer PM3 File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-18-1361/ ∗∗∗ ZDI-18-1360: (0Day) INVT Electric VT-Designer File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-18-1360/ ∗∗∗ IBM Security Bulletin: Vulnerability in IBM Java Runtime affects IBM Storwize V7000 Unified (CVE-2016-0705) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-vulnerability-in-ibm-… ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Spectrum Protect Snapshot for VMware (CVE-2018-1656, CVE-2018-12539) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-multiple-vulnerabilit… ∗∗∗ IBM Security Bulletin: Content Collector for Email is affected by spoofing attack vulnerability in WAS Logout Form ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-content-collector-for… ∗∗∗ IBM Security Bulletin: Content Collector for Email is affected by java deserialization vulnerability resulting in execution of untrusted data via the application server’s SOAP port ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-content-collector-for… ∗∗∗ IBM Security Bulletin: Information Disclosure in IBM WebSphere Application Server Liberty affects IBM Spectrum Protect Snapshot for VMware (CVE-2018-1553) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-information-disclosur… ∗∗∗ git: Schwachstelle ermöglicht Privilegieneskalation ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K18-1120 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 23.11.2018
by Daily end-of-shift report 23 Nov '18

23 Nov '18

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 22-11-2018 18:00 − Freitag 23-11-2018 18:00 Handler: Dimitri Robl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Aurora / Zorro Ransomware Actively Being Distributed ∗∗∗ --------------------------------------------- A ransomware that has been distributed since the summer of 2018 has started to pick up steam in the latest variant. This new variant is currently being called Zorro Ransomware, but has also been called Aurora Ransomware in the past. --------------------------------------------- https://www.bleepingcomputer.com/news/security/aurora-zorro-ransomware-acti… ∗∗∗ Old Printer Vulnerabilities Die Hard ∗∗∗ --------------------------------------------- New research on an old problem reveals despite efforts, the InfoSec professionals still have a way to go when it comes to securing printers. --------------------------------------------- https://threatpost.com/old-printer-vulnerabilities-die-hard/139318/ ∗∗∗ Sicherheitsupdate: VMware Fusion und Workstation anfällig für Schadcode ∗∗∗ --------------------------------------------- Aktualisierte Versionen von Fusion und Workstation schließen eine kritische Sicherheitslücke. --------------------------------------------- http://heise.de/-4231452 ∗∗∗ l+f: Hacker ärgern Hacker ∗∗∗ --------------------------------------------- Online-Kreditkarten-Skimmer fechten Revierkämpfe aus. --------------------------------------------- http://heise.de/-4231527 ===================== = Vulnerabilities = ===================== ∗∗∗ IBM Security Bulletin: A Vulnerability in IBM Java SDK (April 2018) affecting IBM Application Delivery Intelligence V5.0.5 and V5.0.4 (CVE-2018-2783) ∗∗∗ --------------------------------------------- A vulnerability is identified in IBM® SDK Java Technology Edition Version 1.7 and Version 1.8 that are used by IBM Application Delivery Intelligence V5.0.4 and V5.0.5 respectively. This issue was disclosed as part of the IBM Java SDK updates in April 2018.CVE(s): CVE-2018-2783Affected product(s) and affected version(s):IBM Application Delivery Intelligence V5.0.4IBM Application Delivery Intelligence V5.0.5Refer to the following reference URLs for remediation and additional vulnerability [...] --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-a-vulnerability-in-ib… ∗∗∗ VMSA-2018-0030 ∗∗∗ --------------------------------------------- VMware Workstation and Fusion updates address an integer overflow issue. --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2018-0030.html ∗∗∗ Security updates for (US) Thanksgiving Day ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (ceph, openssl, and pixman), Fedora (kernel-headers, kernel-tools, libconfuse, python-urllib3, and xen), Mageia (gettext and roundcubemail), openSUSE (GraphicsMagick and libwpd), Oracle (thunderbird), Slackware (openssl), and Ubuntu (libapache2-mod-perl2). --------------------------------------------- https://lwn.net/Articles/772811/ ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (flashplugin, lib32-libtiff, and webkit2gtk), Debian (libphp-phpmailer and openjdk-7), Mageia (flash-player-plugin, Ghostscript, and poppler), openSUSE (chromium and virtualbox), and SUSE (java-1_8_0-ibm, libwpd, openssl, openssl-1_1, realtime-kernel, salt, and SDL_image). --------------------------------------------- https://lwn.net/Articles/772851/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 22.11.2018
by Daily end-of-shift report 22 Nov '18

22 Nov '18

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 21-11-2018 18:00 − Donnerstag 22-11-2018 18:00 Handler: Stephan Richter Co-Handler: Alexander Riepl ===================== = News = ===================== ∗∗∗ New mining Trojan for Linux removes anti-viruses ∗∗∗ --------------------------------------------- November 20, 2018 One of today’s most common ways of obtaining illegal earnings is to mine cryptocurrency covertly, using the resources of a computer without the owner’s consent. Doctor Web recently discovered a .. --------------------------------------------- https://news.drweb.com/show/?i=12942&lng=en&c=9 ∗∗∗ ECCploit: Rowhammer-Angriff funktioniert auch mit ECC ∗∗∗ --------------------------------------------- Ein Forscherteam konnte zeigen, dass Angriffe mit Bitflips im Arbeitsspeicher auch dann möglich sind, wenn man Speichermodule mit Fehlerkorrektur verwendet. --------------------------------------------- https://www.golem.de/news/eccploit-rowhammer-angriff-funktioniert-auch-mit-… ∗∗∗ Malware scum want to build a Linux botnet using Mirai ∗∗∗ --------------------------------------------- Hadoop YARN is the attack vector, so lock it away Diligent hackers .. --------------------------------------------- www.theregister.co.uk/2018/11/22/mirai_for_linux_on_x86/ ∗∗∗ Markenfälschungen auf rmc-bad-grosspertholz.at ∗∗∗ --------------------------------------------- Bei rmc-bad-grosspertholz.at finden Sie Markenkleidung, Schuhe und Accessoires zu sagenhaften Preisen. Erwarten Sie sich jedoch nicht viel von Ihrer Bestellung, Sie werden – falls überhaupt – minderwertige Waren .. --------------------------------------------- https://www.watchlist-internet.at/news/markenfaelschungen-auf-rmc-bad-gross… ∗∗∗ Achtung: Betrug über den Amazon Marketplace ∗∗∗ --------------------------------------------- Kriminelle übernehmen Amazon-Händlerkonten und bieten günstige Waren an. Ihre Bestellung wird zunächst angenommen, dann aber grundlos storniert. Kontaktieren Sie die Anbieter per E-Mail, erhalten Sie .. --------------------------------------------- https://www.watchlist-internet.at/news/achtung-betrug-ueber-den-amazon-mark… ===================== = Vulnerabilities = ===================== ∗∗∗ IBM Security Bulletin: Java Vulnerability Affects IBM Sterling Connect:Direct Browser User Interface (CVE-2018-1656) ∗∗∗ --------------------------------------------- There is a vulnerability in IBM® Runtime Environment Java Technology Edition, Version 8 that is used by IBM Sterling Connect:Direct Browser User Interface. These issues were disclosed as part of the .. --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-java-vulnerability-af… ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in Apache Tomcat, Open SSL, and Apache HTTPD affects Rational Build Forge ∗∗∗ --------------------------------------------- Apache Tomcat, Open SSL, and Apache Tomcat have multiple security vulnerabilities that could allow a remote attacker to exploit the Rational Build Forge application. Respective security vulnerabilities are discussed in .. --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-multiple-vulnerabilit… ∗∗∗ IBM Security Bulletin: WebSphere MQ V5.3 for HP NonStop Server (MIPS and Itanium) is affected by OpenSSL vulnerability CVE-2018-0732 ∗∗∗ --------------------------------------------- Security Bulletin: WebSphere MQ V5.3 for HP NonStop Server (MIPS and Itanium) is affected by OpenSSL vulnerability CVE-2018-0732CVE(s): CVE-2018-0732Affected product(s) and affected version(s):WebSphere .. --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-websphere-mq-v5-3-for… ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Integration Bus, IBM App Connect Enterpise v11 and WebSphere Message Broker ∗∗∗ --------------------------------------------- Summary There are multiple vulnerabilities in IBM® SDK Java Technology Edition, Version 8.0.5.5 & 8.0.5.15 and IBM® Runtime Environment Java Versions 7.0.10.15 & 7.0.10.25 used by IBM Integration .. --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-multiple-vulnerabilit… ∗∗∗ IBM Security Bulletin: WebSphere MQ V5.3 for HP NonStop Server (MIPS and Itanium) is affected by OpenSSL vulnerability CVE-2018-0737 ∗∗∗ --------------------------------------------- WebSphere MQ V5.3 for HP NonStop Server (MIPS and Itanium) has addressed the following vulnerability: CVE-2018-0737 CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)CVE(s): CVE-2018-0737Affected .. --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-websphere-mq-v5-3-for… ∗∗∗ Download WP-DBManager <= 2.79.1 - Arbitrary File Delete ∗∗∗ --------------------------------------------- https://wpvulndb.com/vulnerabilities/9151 ∗∗∗ Security Advisory - Smart SMS Verification Code Vulnerability in Some Huawei Smart Phones ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2018/huawei-sa-20181121-… ∗∗∗ Moodle Login Access Control Flaw Lets Remote Users Conduct Cross-Site Request Forgery Attacks ∗∗∗ --------------------------------------------- http://www.securitytracker.com/id/1042154 ∗∗∗ WebKitGTK+ and WPE WebKit Security Advisory WSA-2018-0008 ∗∗∗ --------------------------------------------- https://webkitgtk.org/security/WSA-2018-0008.html -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 21.11.2018
by Daily end-of-shift report 21 Nov '18

21 Nov '18

===================== = End-of-Day report = ===================== Timeframe: Dienstag 20-11-2018 18:00 − Mittwoch 21-11-2018 18:00 Handler: Dimitri Robl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Governikus: Personalausweis-Webanwendungen lassen sich austricksen ∗∗∗ --------------------------------------------- Mit einem relativ simplen Trick lässt sich die Authentifizierung von Webanwendungen mit dem elektronischen Personalausweis austricksen. Der Hersteller Governikus behauptet, dass dies in realen Anwendungen nicht funktioniert, kann aber nicht erklären, warum. (E-Personalausweis, Java) --------------------------------------------- https://www.golem.de/news/governikus-personalausweis-webanwendungen-lassen-… ∗∗∗ Werbe-Malware für macOS ∗∗∗ --------------------------------------------- Ein unter "SearchAwesome" und "SearchPageInjector" bekannter Datenschädling macht jetzt auf Macs die Runde. Er manipuliert Reklame und kann CPU-Zeit klauen. --------------------------------------------- http://heise.de/-4227303 ∗∗∗ Dell und VMware teilen sich Sicherheitslücken und servieren Patches ∗∗∗ --------------------------------------------- In Dell EMC Avamar Virtual Edition und VMware vSphere Data Protection klafft eine kritische Sicherheitslücke. --------------------------------------------- http://heise.de/-4228698 ∗∗∗ XSS Injection Campaign Exploits WordPress AMP Plugin ∗∗∗ --------------------------------------------- News broke last week disclosing a number of vulnerabilities in the AMP For WP plugin, installed on over 100,000 WordPress sites. WordPress contributor Sybre Waaijer identified the security issue and confidentially disclosed it to the WordPress plugins team. To exploit the flaw, an attacker needs to have a minimum of subscriber-level access on a vulnerable site. --------------------------------------------- https://www.wordfence.com/blog/2018/11/xss-injection-campaign-exploits-word… ∗∗∗ Warnung vor gefälschter PayLife-Sicherheits-App ∗∗∗ --------------------------------------------- Kriminelle versenden eine gefälschte PayLife-Nachricht. Darin fordern sie Kund/innen dazu auf, dass sie sich eine vermeintliche Sicherheits-App auf ihrem Smartphone installieren. Sie ist angeblich für die weitere Nutzung von PayLife-Kreditkarten notwendig. In Wahrheit ist die gefälschte PayLife-Sicherheits-App Schadsoftware, die wichtige Daten von Kund/innen stiehlt. Dadurch können Kriminelle Geld ihrer Opfer stehlen. --------------------------------------------- https://www.watchlist-internet.at/news/warnung-vor-gefaelschter-paylife-sic… ===================== = Vulnerabilities = ===================== ∗∗∗ Teledyne DALSA Sherlock ∗∗∗ --------------------------------------------- This advisory includes mitigations for a stack-based buffer overflow vulnerability in Teledyne DALSAs Sherlock machine vision software interface. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-18-324-01 ∗∗∗ Schneider Electric Modicon M221 ∗∗∗ --------------------------------------------- This advisory includes mitigations for an insufficient verification of data authenticity vulnerability in the Schneider Electric Modicon M221 product. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-18-324-02 ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (libtiff), CentOS (java-1.7.0-openjdk, spice-server, and thunderbird), Debian (jasper, liblivemedia, ruby-i18n, and ruby-rack), Fedora (curl, elfutils, firefox, kde-connect, kio-extras, libarchive, poppler, and webkit2gtk3), openSUSE (chromium, GraphicsMagick, kernel, libmatroska, mkvtoolnix, SDL2_image, and squid), Oracle (qemu), and Red Hat (flash-plugin and kernel). --------------------------------------------- https://lwn.net/Articles/772718/ ∗∗∗ Security Advisory - Information Leak Vulnerability in Some Huawei Smartphones ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2018/huawei-sa-20181121-… ∗∗∗ IBM Security Bulletin: The Community Edition of IBM ILOG CPLEX Optimization Studio is affected by a vulnerability in libcurl (CVE-2018-16840) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-the-community-edition… ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime IBM affect IBM Decision Optimization Center and IBM ILOG ODM Enterprise ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-multiple-vulnerabilit… ∗∗∗ IBM Security Bulletin: Potential XML External Entity (XXE) Injection Vulnerability in WebSphere Application Server (CVE-2018-1905) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-potential-xml-externa… ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Security Guardium Data Redaction ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-multiple-vulnerabilit… ∗∗∗ IBM Security Bulletin: Vulnerabilities in Python affect IBM Tivoli Application Dependency Discovery Manager (TADDM) (CVE-2018-1061, CVE-2018-1060) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-vulnerabilities-in-py… ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in Node.js affect IBM Integration Bus & IBM App Connect Enterprise V11 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-multiple-vulnerabilit… ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in OpenSSL affect WebSphere Message Broker , IBM Integration Bus and IBM App Connect ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-multiple-vulnerabilit… ∗∗∗ IBM Security Bulletin: IBM Integration Bus affected by a JDBC XA switch load files Vulnerability(CVE-2017-1418) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-ibm-integration-bus-a… ∗∗∗ IBM Security Bulletin: Security vulnerabilities affect multiple IBM Rational products based on IBM Jazz technology ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-security-vulnerabilit… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 20.11.2018
by Daily end-of-shift report 20 Nov '18

20 Nov '18

===================== = End-of-Day report = ===================== Timeframe: Montag 19-11-2018 18:00 − Dienstag 20-11-2018 18:00 Handler: Dimitri Robl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Datendiebstahl durch FinanzOnline-Phishing-Mails ∗∗∗ --------------------------------------------- Kriminelle versenden im Namen des Bundesministeriums für Finanzen (BMF) betrügerische Phishing-Mails. Darin werden Sie dazu aufgefordert, Ihre Daten zu aktualisieren, um eine Steuerrückzahlung zu ermöglichen. Folgen Sie den Anweisungen nicht, denn Sie könnten erheblichen finanziellen Schaden erleiden! Es handelt sich um einen Versuch, Ihre persönlichen Daten und Kontoinformationen zu stehlen. --------------------------------------------- https://www.watchlist-internet.at/news/datendiebstahl-durch-finanzonline-ph… ∗∗∗ Internet Domain Services Austria-Mahnung nicht bezahlen ∗∗∗ --------------------------------------------- Unternehmen erhalten von Internet Domain Services Austria (IDSA) einen Payment Reminder. Darin heißt es, dass es unbeglichene Rechnungen gebe und der Betrag in Höhe von 237 Euro innerhalb von 5 Tagen bezahlt werden müsse. Empfänger/innen müssen den Betrag nicht bezahlen, denn dafür gibt es keinen Rechtsgrund. --------------------------------------------- https://www.watchlist-internet.at/news/internet-domain-services-austria-mah… ∗∗∗ TP-Link-Router TL-R600VPN vielfältig angreifbar ∗∗∗ --------------------------------------------- Es gibt wichtige Sicherheitsupdates für einen VPN-Router von TP-Link. --------------------------------------------- http://heise.de/-4225979 ∗∗∗ Notfall-Patch: Adobe sichert Flash außer der Reihe ab ∗∗∗ --------------------------------------------- Eigentlich veröffentlicht Adobe nur ein Mal im Monat Sicherheitsupdates für seine Produkte. Für eine gefährliche Flash-Lücke macht der Hersteller eine Ausnahme. --------------------------------------------- http://heise.de/-4227033 ===================== = Vulnerabilities = ===================== ∗∗∗ VMSA-2018-0029 ∗∗∗ --------------------------------------------- vSphere Data Protection (VDP) updates address multiple security issues. --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2018-0029.html ∗∗∗ Vulnerability Spotlight: Multiple remote code execution vulnerabilities in Atlantis Word Processor ∗∗∗ --------------------------------------------- Today, Cisco Talos is disclosing three remote code execution vulnerabilities in the Atlantis Word Processor. Atlantis Word Processor is a traditional word processor that provides a number of basic features for users, in line with what is in other similar types of software. --------------------------------------------- https://blog.talosintelligence.com/2018/11/Atlantis-Word-Processor-RCE-vuln… ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (chromium), Debian (mariadb-10.1, openjpeg2, systemd, and uriparser), Mageia (389-ds-base, apache, and soundtouch), SUSE (libwpd, py26-compat-salt, salt, and SMS3.1), and Ubuntu (systemd). --------------------------------------------- https://lwn.net/Articles/772621/ ∗∗∗ x86: DoS from attempting to use INVPCID with a non-canonical addresses ∗∗∗ --------------------------------------------- A buggy or malicious PV guest can crash the host. --------------------------------------------- https://xenbits.xen.org/xsa/advisory-279.html ∗∗∗ Fix for XSA-240 conflicts with shadow paging ∗∗∗ --------------------------------------------- A malicious or buggy x86 PV guest may cause Xen to crash, resulting in a DoS (Denial of Service) affecting the entire host. Privilege escalation as well as information leaks cannot be ruled out. --------------------------------------------- https://xenbits.xen.org/xsa/advisory-280.html ∗∗∗ Insufficient TLB flushing / improper large page mappings with AMD IOMMUs ∗∗∗ --------------------------------------------- A malicious or buggy guest may be able to escalate its privileges, may cause a Denial of Service (DoS) affecting the entire host, or may be able to access data it is not supposed to access (information leak). --------------------------------------------- https://xenbits.xen.org/xsa/advisory-275.html ∗∗∗ Resource accounting issues in x86 IOREQ server handling ∗∗∗ --------------------------------------------- A compromised DM stubdomain may cause Xen to crash, resulting in a DoS (Denial of Service) affecting the entire host. Privilege escalation as well as information leaks cannot be ruled out. --------------------------------------------- https://xenbits.xen.org/xsa/advisory-276.html ∗∗∗ x86: incorrect error handling for guest p2m page removals ∗∗∗ --------------------------------------------- A malicious or buggy guest may cause a deadlock, resulting in a DoS (Denial of Service) affecting the entire host. --------------------------------------------- https://xenbits.xen.org/xsa/advisory-277.html ∗∗∗ Ricoh myPrint Hardcoded Credentials / Information Disclosure ∗∗∗ --------------------------------------------- https://cxsecurity.com/issue/WLB-2018110154 ∗∗∗ IBM Security Bulletin: Multiple Vulnerabilities in IBM® Java SDK affect WebSphere Application Server October 2018 CPU ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-multiple-vulnerabilit… ∗∗∗ IBM Security Bulletin: A Security Vulnerability affects IBM® Cloud Private Cloud Foundry (CVE-2018-14645) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-a-security-vulnerabil… ∗∗∗ IBM Security Bulletin: A Security Vulnerability affects IBM® Cloud Private (CVE-2018-1843) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-a-security-vulnerabil… ∗∗∗ IBM Security Bulletin: A Security Vulnerability affects IBM® Cloud Private (CVE-2015-9251) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-a-security-vulnerabil… ∗∗∗ IBM Security Bulletin: A Security Vulnerability could affect IBM® Cloud Private (CVE-2017-7526) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-a-security-vulnerabil… ∗∗∗ IBM Security Bulletin: Multiple Security Vulnerabilities affect IBM® Cloud Private Cloud Foundry (CVE-2018-3646, CVE-2018-3615, CVE-2018-3620) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-multiple-security-vul… ∗∗∗ IBM Security Bulletin: Vulnerabilities in IBM Java SDK (July 2018) affecting IBM Application Delivery Intelligence V5.0.5 and V5.0.4 (CVE-2016-0705, CVE 2017-3732, CVE 2017-3736, and CVE-2018-2973) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-vulnerabilities-in-ib… ∗∗∗ IBM Security Bulletin: Multiple Vulnerabilities in IBM Java Runtime Affect IBM Sterling Connect:Direct FTP+ ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-multiple-vulnerabilit… ∗∗∗ IBM Security Bulletin: Multiple Vulnerabilities in IBM Java Runtime Affect IBM Sterling Connect:Direct for UNIX ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-multiple-vulnerabilit… ∗∗∗ IBM Security Bulletin: Multiple Vulnerabilities in IBM Java Runtime Affect IBM Sterling Connect:Direct for Microsoft Windows ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-multiple-vulnerabilit… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 19.11.2018
by Daily end-of-shift report 19 Nov '18

19 Nov '18

===================== = End-of-Day report = ===================== Timeframe: Freitag 16-11-2018 18:00 − Montag 19-11-2018 18:00 Handler: Dimitri Robl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Schwere Sicherheitslücken in GPS-Kinderuhren ∗∗∗ --------------------------------------------- Eigentlich sollten GPS-Uhren die Sicherheit der Kinder erhöhen. Nun werden sie selbst zum Risiko. --------------------------------------------- https://futurezone.at/digital-life/schwere-sicherheitsluecken-in-gps-kinder… ===================== = Vulnerabilities = ===================== ∗∗∗ Synaccess netBooter NP-0801DU 7.4 CSRF Add Admin Exploit ∗∗∗ --------------------------------------------- The application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges if a logged-in user visits a malicious web site. --------------------------------------------- http://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5501.php ∗∗∗ Synaccess netBooter NP-02x/NP-08x 6.8 Authentication Bypass ∗∗∗ --------------------------------------------- netBooter suffers from an authentication bypass vulnerability due to missing control check when calling webNewAcct.cgi script while creating users. This allows an unauthenticated attacker to create admin user account and bypass authentication giving her the power to turn off a power supply to a resource. --------------------------------------------- http://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5500.php ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (grafana and patch), Debian (chromium-browser), Fedora (cabextract, curl, elfutils, firefox, flatpak, glusterfs, kernel, kernel-headers, kernel-tools, kio-extras, libmspack, mariadb, mupdf, poppler, suricata, and wireshark), Mageia (hylafax+, jhead, libmspack/cabextract, nginx, sdl2/mingw-SDL2, and squid), openSUSE (amanda, apache-pdfbox, chromium, ImageMagick, LibreOffice and dependency libraries, libxkbcommon, openssh, systemd, and [...] --------------------------------------------- https://lwn.net/Articles/772522/ ∗∗∗ Serial number disclosure in the FortiOS PPTP server hostname protocol field ∗∗∗ --------------------------------------------- https://fortiguard.com/psirt/FG-IR-18-101 ∗∗∗ Cross-site scripting (XSS) vulnerability via DHCP Hostname parameter ∗∗∗ --------------------------------------------- https://fortiguard.com/psirt/FG-IR-18-121 ∗∗∗ IBM Security Bulletin: Vulnerability in IBM Java SDK Affects IBM Algo Credit Manager ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-vulnerability-in-ibm-… ∗∗∗ IBM Security Bulletin: IBM API Connect is affected by a denial of service vulnerability via large JSON payloads (CVE-2018-1779) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-ibm-api-connect-is-af… ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Performance Management products ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-multiple-vulnerabilit… ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM® SDK, Java™ Technology Edition affect IBM Operational Decision Manager ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-multiple-vulnerabilit… ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Host On-Demand ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-multiple-vulnerabilit… ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in WebSphere Application Server affect IBM Spectrum Control (formerly Tivoli Storage Productivity Center) (CVE-2018-1683, CVE-2018-8039) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-multiple-vulnerabilit… ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Tivoli Storage Manager FastBack (CVE-2018-1656, CVE-2018-12539) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-multiple-vulnerabilit… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily November 2018