Daily October 2019

daily@lists.cert.at

1 participants
23 discussions

Tageszusammenfassung - 03.10.2019
by Daily end-of-shift report 03 Oct '19

03 Oct '19

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 02-10-2019 18:00 − Donnerstag 03-10-2019 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Sodinokibi Ransomware Builds An All-Star Team of Affiliates ∗∗∗ --------------------------------------------- The Sodinokibi Ransomware (REvil) has been making news lately as they target the enterprise, MSPs, and government entities through their hand-picked team of all-star affiliates. These affiliates appear to have had a prior history with the GandCrab RaaS and use similar distribution methods. --------------------------------------------- https://www.bleepingcomputer.com/news/security/sodinokibi-ransomware-builds… ∗∗∗ A New Wave of Buggy WordPress Infections ∗∗∗ --------------------------------------------- We’ve been following an ongoing malware campaign for the past couple of years now. This campaign is renowned for its prompt addition of exploits for newly discovered WordPress theme and plugin vulnerabilities. Every other week, the attackers introduce new domain names and slightly change the obfuscation of their scripts to prevent detection. --------------------------------------------- https://blog.sucuri.net/2019/10/a-new-wave-of-buggy-wordpress-infections.ht… ∗∗∗ FBI: Don’t pay ransomware demands, stop encouraging cybercriminals to target others ∗∗∗ --------------------------------------------- The FBI has some unambiguous advice for organisations on how they should handle ransomware demands: Dont pay. --------------------------------------------- https://www.tripwire.com/state-of-security/featured/fbi-dont-pay-ransomware/ ===================== = Vulnerabilities = ===================== ∗∗∗ Gefährliche Lücke in Magenta-Routern entdeckt ∗∗∗ --------------------------------------------- Die bereits in UPC-Zeiten verteilte Connect Box kann von außen übernommen werden. Ein Firmware-Update soll Abhilfe schaffen. --------------------------------------------- https://futurezone.at/produkte/gefaehrliche-luecke-in-magenta-routern-entde… ∗∗∗ WhatsApp Flaw Opens Android Devices to Remote Code Execution ∗∗∗ --------------------------------------------- A double-free bug could allow an attacker to achieve remote code execution; users are encouraged to update to a patched version of the messaging app. --------------------------------------------- https://threatpost.com/whatsapp-flaw-opens-android-devices-to-remote-code-e… ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by CentOS (kernel), Debian (jackson-databind, libapreq2, and subversion), Fedora (glpi, memcached, and zeromq), openSUSE (rust), Oracle (kernel), Red Hat (patch), and SUSE (dovecot23, git, jasper, libseccomp, and thunderbird). --------------------------------------------- https://lwn.net/Articles/801226/ ∗∗∗ Localization update - Moderately critical - Insecure server configuration - SA-CONTRIB-2019-072 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2019-072 ∗∗∗ Simple AMP (Accelerated Mobile Pages) - Moderately critical - Access bypass - SA-CONTRIB-2019-071 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2019-071 ∗∗∗ Ubercart - Moderately critical - Cross site scripting - SA-CONTRIB-2019-070 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2019-070 ∗∗∗ Cisco Security Advisories ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/publicationListing.x ∗∗∗ IBM Security Bulletin: IBM Security Key Lifecycle Manager is affected by Cross-Site Scripting (CVE-2019-4564) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-ibm-security-key-life… ∗∗∗ IBM Security Bulletin: IBM Security Key Lifecycle Manager is affected by information exposure (CVE-2019-4514) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-ibm-security-key-life… ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Installation Manager and IBM Packaging Utility ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-multiple-vulnerabilit… ∗∗∗ IBM Security Bulletin: Java Vulnerability Affects IBM Connect:Direct Web Services (CVE-2019-10246, CVE-2019-10247, CVE-2019-10241 & CVE-2018-12545) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-java-vulnerability-af… ∗∗∗ IBM Security Bulletin: IBM MQ AMQP Listeners are vulnerable to a session fixation attack (CVE-2019-4227) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-ibm-mq-amqp-listeners… ∗∗∗ HPESBST03958 rev.1 - HPE Command View Advanced Edition (CVAE) Multiple Vulnerabilities ∗∗∗ --------------------------------------------- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_n… ∗∗∗ HPESBST03959 rev.1 - HPE Command View Advanced Edition (CVAE) Multiple Vulnerabilities ∗∗∗ --------------------------------------------- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_n… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 02.10.2019
by Daily end-of-shift report 02 Oct '19

02 Oct '19

===================== = End-of-Day report = ===================== Timeframe: Dienstag 01-10-2019 18:00 − Mittwoch 02-10-2019 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Ethical hacking: Passive information gathering with Maltego ∗∗∗ --------------------------------------------- In this article, we’ll discuss passive information gathering. We’ll first look at how we can use Maltego, a common information gathering tool, to perform this form of reconnaissance. Using a hands-on walkthrough of Maltego, we’ll see how you can acquire IP addresses, sub-domains and perform different levels of reconnaissance to inform your information gathering [...] --------------------------------------------- https://resources.infosecinstitute.com/ethical-hacking-passive-information-… ∗∗∗ Hackers Turn to OpenDocument Format to Avoid AV Detection ∗∗∗ --------------------------------------------- Malware laced OpenDocument files target Microsoft Office, OpenOffice and LibreOffice users. --------------------------------------------- https://threatpost.com/hackers-turn-to-opendocument/148817/ ∗∗∗ Magecart hits again, leveraging compromised sites and newly registered domains ∗∗∗ --------------------------------------------- During alert monitoring, ThreatLabZ researchers came across multiple cases of shopping sites being compromised and injected with a skimming script. This injected script looks for the payment method and personally identifiable information (PII) and captures supplied financial information which is then sent to an adversary-controlled gate server even before the user hits the submit form. --------------------------------------------- https://www.zscaler.com/blogs/research/magecart-hits-again-leveraging-compr… ∗∗∗ Erfundene Speditionen beim Autokauf über Kleinanzeigen! ∗∗∗ --------------------------------------------- Auf der Suche nach günstigen Gebrauchtautos, Wohnmobilen, Motorrädern oder Oldtimern sind Kleinanzeigenplattformen häufig die beste Option. Doch seien Sie vorsichtig, wenn Ihr Gegenüber sich angeblich im Ausland befindet und der Kauf über eine Spedition abgewickelt werden soll. Meist handelt es sich hierbei um Kriminelle, die Ihnen das Geld aus der Tasche ziehen wollen. Das versprochene Gefährt erhalten Sie nie! --------------------------------------------- https://www.watchlist-internet.at/news/erfundene-speditionen-beim-autokauf-… ∗∗∗ Understanding and Defending Against Access Token Theft: Finding Alternatives to winlogon.exe ∗∗∗ --------------------------------------------- https://posts.specterops.io/understanding-and-defending-against-access-toke… ===================== = Vulnerabilities = ===================== ∗∗∗ Interpeak IPnet TCP/IP Stack ∗∗∗ --------------------------------------------- This advisory contains mitigations for stack-based buffer overflow, heap-based buffer overflow, integer underflow, improper restriction of operations within the bounds of a memory buffer, race condition, argument injection, and null pointer dereference vulnerabilities in the Interpeak IPnet TCP/IP stack. --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-19-274-01 ∗∗∗ Yokogawa Products ∗∗∗ --------------------------------------------- This advisory includes mitigations for an unquoted search path or element vulnerability reported in Yokogawa’s Exaopc, Exaplog, Exaquantum, Exasmoc, Exarqe, GA10, and InsightSuiteAE products. --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-19-274-02 ∗∗∗ Moxa EDR 810 Series ∗∗∗ --------------------------------------------- This advisory includes mitigations for improper input validation and improper access control vulnerabilities reported in Moxa’s EDR 810 router. --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-19-274-03 ∗∗∗ Inadequate Patch in Hewlett Packard Enterprise iMC 7.3 E0703 ∗∗∗ --------------------------------------------- [...] This means there are (at least) two unpatched, known vulnerabilities in iMC with a CVSSv2 base score of 10.0. Basically, these bugs have been lurking around without proper patches since December 2018. --------------------------------------------- https://medium.com/tenable-techblog/inadequate-patch-in-hewlett-packard-ent… ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (openssl and openssl1.0), Fedora (expat, kernel, kernel-headers, kernel-tools, and phpMyAdmin), openSUSE (nghttp2 and u-boot), Oracle (kernel), Red Hat (rh-nodejs8-nodejs), Slackware (libpcap), SUSE (bind, jasper, libgcrypt, openssl-1_0_0, and php7), and Ubuntu (clamav). --------------------------------------------- https://lwn.net/Articles/801130/ ∗∗∗ PuTTY: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-0863 ∗∗∗ Fortinet FortiSIEM 5.0 / 5.2.1 Improper Certification Validation ∗∗∗ --------------------------------------------- https://cxsecurity.com/issue/WLB-2019100006 ∗∗∗ IBM Security Bulletin: IBM Security Guardium is affected by a jackson-databind vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-ibm-security-guardium… ∗∗∗ IBM Security Bulletin: Information disclosure vulnerability in WebSphere Application Server (CVE-2019-4441) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-information-disclosur… ∗∗∗ IBM Security Bulletin: Multiple Security Vulnerabilities have been addressed in IBM Security Access Manager Appliance ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-multiple-security-vul… ∗∗∗ IBM Security Bulletin: IBM Security Guardium is affected by an Escalation of Privileges vulnerability ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-ibm-security-guardium… ∗∗∗ IBM Security Bulletin: Vulnerabilities in FasterXML Jackson libraries affect IBM Cúram Social Program Management (CVE-2019-14439, CVE-2019-14379, CVE-2019-12814, CVE-2019-12086) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-vulnerabilities-in-fa… ∗∗∗ IBM Security Bulletin: IBM Security Guardium is affected by a jackson-databind vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-ibm-security-guardium… ∗∗∗ IBM Security Bulletin: IBM Security Access Manager Appliance has shipped a security vulnerability fix for WebSphere Application Server (CVE-2019-4046) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-ibm-security-access-m… ∗∗∗ IBM Security Bulletin: Security Vulnerabilities affect IBM Cloud Private for Data – OpenSSL (CVE-2019-1543), Kubernetes (CVE-2019-1002100) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-security-vulnerabilit… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 01.10.2019
by Daily end-of-shift report 01 Oct '19

01 Oct '19

===================== = End-of-Day report = ===================== Timeframe: Montag 30-09-2019 18:00 − Dienstag 01-10-2019 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Free Ouroboros Ransomware (Zeropadypt NextGen) Decryption Available ∗∗∗ --------------------------------------------- Victims of the Ouroboros Ransomware, otherwise known as Zeropadypt NextGen, can get their files decrypted for free with the help of a security researcher and a decryptor that has been made for different variants. --------------------------------------------- https://www.bleepingcomputer.com/news/security/free-ouroboros-ransomware-ze… ∗∗∗ Beyond the SISSDEN event horizon ∗∗∗ --------------------------------------------- Between May 2016 and April 2019, The Shadowserver Foundation participated in the SISSDEN EU Horizon 2020 project. The main goal of the project was to improve the cybersecurity posture of EU entities and end users through the development of situational awareness and sharing of actionable information. It exceeded KPIs, with 257 sensors in 59 countries, using 974 IP addresses across 119 ASNs and 383 unique /24 (Class C) networks, and collected 31TB of threat data. --------------------------------------------- https://www.shadowserver.org/news/beyond-the-sissden-event-horizon/ ∗∗∗ Decades-Old Code Is Putting Millions of Critical Devices at Risk ∗∗∗ --------------------------------------------- Nearly two decades ago, a company called Interpeak created a network protocol that became an industry standard. It also had severe bugs that are only now coming to light. --------------------------------------------- https://www.wired.com/story/urgent-11-ipnet-vulnerable-devices ∗∗∗ Vorsicht bei zu günstigen Technik-Angeboten ∗∗∗ --------------------------------------------- sgt-sonic.store, alpha-tech.store, omega-tech.store, grand-elec.store und beta-elec.store bieten ein breites Technik-Sortiment mit unschlagbaren Angeboten. Sehen Sie jedoch von einer Bestellung ab, denn es handelt sich um Fake-Shops. Die Ware wird trotz Vorab-Zahlung nie geliefert. Sie verlieren Ihr Geld! --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-bei-zu-guenstigen-technik-a… ===================== = Vulnerabilities = ===================== ∗∗∗ Noch ein Update für iOS, iPadOS und watchOS ∗∗∗ --------------------------------------------- Bei Apple kommen die Aktualisierungen Schlag auf Schlag. iOS 13.1.2, iPadOS 13.1.2 und watchOS 6.0.1 beheben erneut Fehler. --------------------------------------------- https://heise.de/-4543459 ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (apache2, linux-4.9, netty, phpbb3, and poppler), openSUSE (chromium, djvulibre, ghostscript, python-numpy, SDL2, and varnish), Oracle (nodejs:10), Red Hat (httpd24-httpd and httpd24-nghttp2, kpatch-patch, and rh-nodejs10-nodejs), and Ubuntu (linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon, and SDL 2.0). --------------------------------------------- https://lwn.net/Articles/801010/ ∗∗∗ Red Hat Produkte: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-0860 ∗∗∗ Foxit Reader: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-0862 ∗∗∗ Theme Editor <= 2.1 - Multiple Vulnerabilities ∗∗∗ --------------------------------------------- https://wpvulndb.com/vulnerabilities/9894 ∗∗∗ Cisco Webex Meetings Enumeration Attack ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ IBM Security Bulletin: Multiple security vulnerabilities have been addressed in IBM Security Directory Server ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-multiple-security-vul… ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affecting Rational Functional Tester ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-multiple-vulnerabilit… ∗∗∗ IBM Security Bulletin: Vulnerabilities in OpenSSL affect GCM16 & GCM32 and LCM8 & LCM16 KVM Switch Firmware (CVE-2018-0732 CVE-2019-1559) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-vulnerabilities-in-op… ∗∗∗ HPESBHF03955 rev.1 - HPE Simplivity Omnistack, Local and Remote File Modification and Deletion ∗∗∗ --------------------------------------------- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_n… ∗∗∗ HPESBST03956 rev.1 - HPE Simplivity Omnistack, Local and Remote Arbitrary Command Execution ∗∗∗ --------------------------------------------- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_n… ∗∗∗ HPESBHF03954 rev.1 - HPE UioT, Remote Unauthorized Access and Access to sensitive Data ∗∗∗ --------------------------------------------- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_n… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily October 2019