Daily December 2019

daily@lists.cert.at

1 participants
18 discussions

Tageszusammenfassung - 30.12.2019
by Daily end-of-shift report 30 Dec '19

30 Dec '19

===================== = End-of-Day report = ===================== Timeframe: Freitag 27-12-2019 18:00 − Montag 30-12-2019 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Lesser-known Tools for Android Application PenTesting ∗∗∗ --------------------------------------------- Over time, I became familiar with the different tools, popular or not, that helped me in my assessments. In this post, I’ll list down these not-so-popular tools (in my opinion based on the different sources and blogs that I have read where these tools were not mentioned) that I’m using during my engagements. --------------------------------------------- https://captmeelo.com/pentest/2019/12/30/lesser-known-tools-for-android-pen… ∗∗∗ 36C3: Vertraue keinem Bluetooth-Gerät – schon gar nicht im vernetzten Auto ∗∗∗ --------------------------------------------- Bei Chips zur drahtlosen Datenübertragung etwa via Bluetooth gibt es massive Sicherheitslücken. Bei geteilten Antennen lässt sich etwa WLAN ausknipsen. --------------------------------------------- https://heise.de/-4624388 ===================== = Vulnerabilities = ===================== ∗∗∗ Trend Micro AntiVirus für Mac: Schwachstelle ermöglicht Manipulation von Dateien ∗∗∗ --------------------------------------------- Trend Micro AntiVirus ist eine Anti-Viren-Software. --------------------------------------------- https://www.bsi-fuer-buerger.de/SharedDocs/Warnmeldungen/DE/TW/2019/12/warn… ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by SUSE (dia, kernel, and libgcrypt). --------------------------------------------- https://lwn.net/Articles/808135/ ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (debian-lan-config, freeimage, imagemagick, libxml2, mediawiki, openssl1.0, php5, and tomcat8). --------------------------------------------- https://lwn.net/Articles/808234/ ∗∗∗ Intel SPS vulnerability CVE-2019-11109 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K54164678 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 27.12.2019
by Daily end-of-shift report 27 Dec '19

27 Dec '19

===================== = End-of-Day report = ===================== Timeframe: Montag 23-12-2019 18:00 − Freitag 27-12-2019 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Timely acquisition of network traffic evidence in the middle of an incident response procedure, (Wed, Dec 25th) ∗∗∗ --------------------------------------------- The acquisition of evidence is one of the procedures that always brings controversy in incident management. We must answer questions such as: [...] --------------------------------------------- https://isc.sans.edu/diary/rss/25560 ∗∗∗ Bypassing UAC to Install a Cryptominer ∗∗∗ --------------------------------------------- First of all, Merry Christmas to all our readers! I hope youre enjoying the break with your family and friends! Even if everything slows down in this period, there is always malicious activity ongoing. I found a small PowerShell script that looked interesting for a quick diary. First of all, it has a VT score of 2/60[1]. It installs a cryptominer and its most interesting feature is the use of a classic technique to bypass UAC[2]. --------------------------------------------- https://isc.sans.edu/forums/diary/Bypassing+UAC+to+Install+a+Cryptominer/25… ∗∗∗ Video: Identitätsdiebstahl mit gefälschten Airbnb-Mails ∗∗∗ --------------------------------------------- Airbnb genießt hohes Vertrauen bei seinen UserInnen. Das versuchen sich auch Kriminelle zu Nutze zu machen. Sie versenden betrügerische Phishing-Mails im Design von Airbnb. --------------------------------------------- https://www.watchlist-internet.at/news/video-identitaetsdiebstahl-mit-gefae… ∗∗∗ Video: Erpressungs-Mails ∗∗∗ --------------------------------------------- Kriminelle versenden massenhaft Erpressungs-Mails an InternetnutzerInnen. Darin behaupten sie, die EmpfängerInnen der Nachrichten beim Masturbieren gefilmt zu haben. Um zu vermeiden, dass das Video veröffentlicht wird, sollen gewisse Geldbeträge in Form von Bitcoins bezahlt werden. --------------------------------------------- https://www.watchlist-internet.at/news/video-erpressungs-mails/ ===================== = Vulnerabilities = ===================== ∗∗∗ New Magellan 2.0 SQLite Vulnerabilities Affect Many Programs ∗∗∗ --------------------------------------------- New vulnerabilities in the SQLite database engine affect a wide range of applications that utilize it as a component within their software packages. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-magellan-20-sqlite-vulne… ∗∗∗ AVE DOMINAplus 1.10.x Credentials Disclosure Exploit ∗∗∗ --------------------------------------------- The application suffers from clear-text credentials disclosure vulnerability that allows an unauthenticated attacker to issue a request to an unprotected directory that hosts an XML file /xml/authClients.xml and obtain administrative login information that allows for a successful authentication bypass attack. --------------------------------------------- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5550.php ∗∗∗ AVE DOMINAplus 1.10.x Authentication Bypass Exploit ∗∗∗ --------------------------------------------- DOMINAplus suffers from an authentication bypass vulnerability due to missing control check when directly calling the autologin GET parameter in changeparams.php script. Setting the autologin value to 1 allows an unauthenticated attacker to permanently disable the authentication security control and access the management interface with admin privileges without providing credentials. --------------------------------------------- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5549.php ∗∗∗ AVE DOMINAplus 1.10.x Unauthenticated Remote Reboot ∗∗∗ --------------------------------------------- The application suffers from an unauthenticated reboot command execution. Attackers can exploit this issue to cause a denial of service scenario. --------------------------------------------- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5548.php ∗∗∗ AVE DOMINAplus 1.10.x CSRF/XSS Vulnerabilities ∗∗∗ --------------------------------------------- The application suffers from multiple CSRF and XSS vulnerabilities. The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges if a logged-in user visits a malicious web site. Input passed to several GET/POST parameters is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script [...] --------------------------------------------- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5547.php ∗∗∗ Inim Electronics Smartliving SmartLAN/G/SI 6.x Hard-coded Credentials ∗∗∗ --------------------------------------------- The devices utilizes hard-coded credentials within its Linux distribution image. These sets of credentials (Telnet, SSH, FTP) are never exposed to the end-user and cannot be changed through any normal operation of the smart home device. Attacker could exploit this vulnerability by logging in and gain system access. --------------------------------------------- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5546.php ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by CentOS (freetype, kernel, nss, nss-softokn, nss-util, and thunderbird), Mageia (ghostpcl, libmirage, and spamassassin), Oracle (fribidi), and SUSE (mariadb-100, shibboleth-sp, and slurm). --------------------------------------------- https://lwn.net/Articles/808090/ ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by CentOS (firefox, fribidi, nss, nss-softokn, nss-util, openslp, and thunderbird), Debian (opensc), and Mageia (389-ds-base, apache, apache-mod_auth_openidc, kernel, libofx, microcode, php, and ruby). --------------------------------------------- https://lwn.net/Articles/808119/ ∗∗∗ CA Client Automation 14.x Privilege Escalation ∗∗∗ --------------------------------------------- https://cxsecurity.com/issue/WLB-2019120108 ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ ∗∗∗ Security Advisory - Insufficient Input Validation Vulnerability in Some Huawei Products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191225-… ∗∗∗ Security Advisory - Integer Overflow Vulnerability in the Linux Kernel (SACK Panic) ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191225-… ∗∗∗ Security Advisory - Multiple Vulnerabilities in the X.509 Implementation in Some Huawei Products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191225-… ∗∗∗ Security Advisory - Missing Integrity Checking Vulnerability on Some Huawei Products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191225-… ∗∗∗ Red Hat Enterprise Linux: Mehrere Schwachstellen ermöglichen Ausführen von beliebigem Programmcode mit den Rechten des Dienstes ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-1110 ∗∗∗ ImageMagick / GraphicsMagick: Mehrere Schwachstellen ermöglichen Denial of Service ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-1117 ∗∗∗ D-LINK Router: Schwachstelle ermöglicht Cross-Site Scripting ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-1116 ∗∗∗ Nvidia GeForce Experience: Schwachstelle ermöglicht Privilegieneskalation ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-1114 ∗∗∗ Trend Micro Maximum Security: Schwachstelle ermöglicht Denial of Service oder Offenlegung von Informationen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-1113 ∗∗∗ Trend Micro AntiVirus für Mac: Schwachstelle ermöglicht Manipulation von Dateien ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-1120 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 23.12.2019
by Daily end-of-shift report 23 Dec '19

23 Dec '19

===================== = End-of-Day report = ===================== Timeframe: Freitag 20-12-2019 18:00 − Montag 23-12-2019 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ FBI Issues Alert For LockerGoga and MegaCortex Ransomware ∗∗∗ --------------------------------------------- The FBI has issued a warning to private industry recipients to provide information and guidance on the LockerGoga and MegaCortex Ransomware. --------------------------------------------- https://www.bleepingcomputer.com/news/security/fbi-issues-alert-for-lockerg… ∗∗∗ Mozi, Another Botnet Using DHT ∗∗∗ --------------------------------------------- Mozi Botnet relies on the DHT protocol to build a P2P network, and uses ECDSA384 and the xor algorithm to ensure the integrity and security of its components and P2P network. The sample spreads via Telnet with weak passwords and some known exploits --------------------------------------------- https://blog.netlab.360.com/mozi-another-botnet-using-dht/ ∗∗∗ Extracting VBA Macros From .DWG Files, (Sun, Dec 22nd) ∗∗∗ --------------------------------------------- I updated my oledump.py tool to help with the analysis of files that embed OLE files, like AutoCAD's .dwg files with VBA macros. --------------------------------------------- https://isc.sans.edu/diary/rss/25634 ∗∗∗ Leveraging Disk Imaging Tools to Deliver RATs ∗∗∗ --------------------------------------------- This year we observed a notable uptick in disc imaging software (like .ISO) being used as a container for serving malware via email, with .ISO archives attributing to 6% of all malware attachment archives seen this year. --------------------------------------------- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/leveraging-… ∗∗∗ Looking into Attacks and Techniques Used Against WordPress Sites ∗∗∗ --------------------------------------------- This blog post lists different kinds of attacks against WordPress, by way of payload examples we observed in the wild, and how attacks have used hacked admin access and API, Alfa-Shell deployment, and SEO poisoning to take advantage of vulnerable sites. --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/mjE1ckQKGtA/ ∗∗∗ Geknackte Zwei-Faktor-Anmeldung: Warum Software Token keine gute Idee sind ∗∗∗ --------------------------------------------- Eine mutmaßlich chinesische Hackergruppe, deren Angriffe bis 2011 zurückgehen, soll einen neuartigen Angriff auf RSA-Software-Token entdeckt haben. --------------------------------------------- https://heise.de/-4622748 ∗∗∗ Jetzt updaten: Cisco ASA 5500-X Series Firewalls aus der Ferne angreifbar ∗∗∗ --------------------------------------------- Eine bereits seit 2018 bekannte ASA-Schwachstelle wird derzeit möglicherweise aktiv ausgenutzt. --------------------------------------------- https://heise.de/-4621541 ∗∗∗ Vorsicht vor GMX-Phishing-Mails ∗∗∗ --------------------------------------------- Zahlreiche LeserInnen melden uns momentan gefährliche Phishing-Mails, mit denen Kriminelle versuchen, an GMX-Konten zu gelangen. GMX-UserInnen müssen sich daher in Acht nehmen, wenn sie plötzlich wegen einer angeblichen Kontosperre, zu einem Login aufgefordert werden. Die Daten und E-Mail-Konten landen in den Händen Krimineller und können für Verbrechen unter fremder Identität genützt werden! --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-vor-gmx-phishing-mails/ ∗∗∗ War Never Changes: Attacks Against WPA3’s Enhanced Open — Part 2: Understanding OWE ∗∗∗ --------------------------------------------- https://posts.specterops.io/war-never-changes-attacks-against-wpa3s-enhance… ===================== = Vulnerabilities = ===================== ∗∗∗ Patch now: Published Citrix applications leave networks of potentially 80,000 firms at risk from attackers ∗∗∗ --------------------------------------------- Unauthorised users able to perform arbitrary code execution A critical vulnerability found in Citrix Application Delivery Controller and Citrix Gateway (formerly known as Netscaler ADC and Netscaler Gateway) means businesses with apps published using these technologies may be exposing their internal network to unauthorised access. --------------------------------------------- https://go.theregister.co.uk/feed/www.theregister.co.uk/2019/12/23/patch_no… ∗∗∗ Sicherheitslücke in Twitter-App für Android ∗∗∗ --------------------------------------------- Über eine Sicherheitslücke in der Twitter-App für Android lässt sich bösartiger Code einschleusen, der private Daten auslesen kann. Ein Update steht bereit. --------------------------------------------- https://heise.de/-4621735 ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (cups, cyrus-sasl2, tightvnc, and x2goclient), Fedora (cacti and cacti-spine), openSUSE (mariadb and samba), Oracle (fribidi, git, and python), Red Hat (fribidi, libyang, and qemu-kvm-rhev), Slackware (openssl and tigervnc), and SUSE (firefox, nspr, nss and kernel). --------------------------------------------- https://lwn.net/Articles/808026/ ∗∗∗ Synology-SA-19:43 Drupal ∗∗∗ --------------------------------------------- A vulnerability allows remote authenticated users to upload arbitrary files via a susceptible version of Drupal. --------------------------------------------- https://www.synology.com/en-global/support/security/Synology_SA_19_43 ∗∗∗ F5 Security Advisories ∗∗∗ --------------------------------------------- https://support.f5.com/csp/new-updated-articles ∗∗∗ Security Bulletin: Multiple Vulnerabilities in libpng affects IBM Watson Studio Local ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Input Validation Vulnerability in Watson Studio Local ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-input-validation-vulnerab… ∗∗∗ Security Bulletin: Multiple Vulnerabilities In Redis affects Watson Studio Local (CVE-2018-12453, CVE-2018-12326, CVE-2018-11218) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: JWT Token Check Vulnerability in Watson Studio Local ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-jwt-token-check-vulnerabi… ∗∗∗ Security Bulletin: Multiple Vulnerabilities in Kubernetes affects IBM Watson Studio Local ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Watson Studio Local Key Storage Vulnerability ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-watson-studio-local-key-s… ∗∗∗ Security Bulletin: Multiple Vulnerabilities in GNU binutils affects IBM Watson Studio Local ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple Vulnerabilities in GNU Binutils affects Watson Studio Local ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Internal SSL Communication Vulerability in Watson Studio Local (PSIRT-ADV0011800) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-internal-ssl-communicatio… ∗∗∗ Security Bulletin: Multiple Vulnerabilities in OpenSSL affects IBM Watson Studio Local ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Vulnerabilities in Samba affects IBM Watson Studio Local ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-samba-… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 20.12.2019
by Daily end-of-shift report 20 Dec '19

20 Dec '19

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 19-12-2019 18:00 − Freitag 20-12-2019 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ From dropbox(updater) to NT AUTHORITY\SYSTEM ∗∗∗ --------------------------------------------- In this post I’m going to show how to use the DropBoxUpdater service in order to get SYSTEM privileges starting from a simple Windows user. --------------------------------------------- https://decoder.cloud/2019/12/18/from-dropboxupdater-to-nt-authoritysystem/ ∗∗∗ Using WebRTC ICE Servers for Port Scanning in Chrome ∗∗∗ --------------------------------------------- Using the browser to scan a LAN isn’t a new idea. There are many implementations that use XHR requests, websockets, or plain HTML to discover and fingerprint LAN devices. But in this blog, I’ll introduce a new scanning technique using WebRTC ICE servers. This technique is fast and, unlike the other methods, bypasses the blocked ports list. Unfortunately, it only works when the victim is using Chrome. --------------------------------------------- https://medium.com/tenable-techblog/using-webrtc-ice-servers-for-port-scann… ===================== = Vulnerabilities = ===================== ∗∗∗ DSA-4590 cyrus-imapd - security update ∗∗∗ --------------------------------------------- It was discovered that the lmtpd component of the Cyrus IMAP server created mailboxes with administrator privileges if the fileinto [sieve directive] was used, bypassing ACL checks. --------------------------------------------- https://www.debian.org/security/2019/dsa-4590 ∗∗∗ Field Notice: FN - 70489 - PKI Self-Signed Certificate Expiration in Cisco IOS and Cisco IOS XE Software - Software Upgrade Recommended ∗∗∗ --------------------------------------------- Self-signed X.509 PKI certificates (SSC) that were generated on devices that run affected Cisco IOS® or Cisco IOS XE software releases expire on 2020-01-01 00:00:00 UTC. New self-signed certificates cannot be created on affected devices after 2020-01-01 00:00:00 UTC. Any service that relies on these self-signed certificates to establish or terminate a secure connection might not work after the certificate expires. --------------------------------------------- https://www.cisco.com/c/en/us/support/docs/field-notices/704/fn70489.html ∗∗∗ OpenSSL version 1.0.2u published ∗∗∗ --------------------------------------------- The OpenSSL project team is pleased to announce the release of version 1.0.2u of our open source toolkit for SSL/TLS. --------------------------------------------- https://mta.openssl.org/pipermail/openssl-announce/2019-December/000165.html ∗∗∗ VMSA-2019-0023 ∗∗∗ --------------------------------------------- VMware Workstation and Horizon View Agent updates address a DLL-hijacking issue (CVE-2019-5539) --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2019-0023.html ∗∗∗ Critical Vulnerability Patched in 301 Redirects – Easy Redirect Manager ∗∗∗ --------------------------------------------- On Friday December 13th, our Threat Intelligence team discovered vulnerabilities present in "301 Redirects – Easy Redirect Manager", a WordPress plugin installed on over 70,000 websites. These weaknesses allowed any authenticated user, even subscribers, to modify, delete, and inject redirect rules that could potentially result in a loss of site availability. We privately disclosed the issue to the plugin’s developer, who was incredibly quick to respond and release a patch. --------------------------------------------- https://www.wordfence.com/blog/2019/12/critical-vulnerability-patched-in-30… ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (cyrus-imapd and gdk-pixbuf), Fedora (cacti, cacti-spine, and fribidi), Red Hat (fribidi, git, and openstack-keystone), Scientific Linux (fribidi), Slackware (wavpack), and SUSE (firefox, kernel, mariadb, spectre-meltdown-checker, and trousers). --------------------------------------------- https://lwn.net/Articles/807851/ ∗∗∗ Atlassian Jira Software: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen ∗∗∗ --------------------------------------------- Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Atlassian Jira Software ausnutzen, um Sicherheitsvorkehrungen zu umgehen. --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-1105 ∗∗∗ Moxa EDS Ethernet Switches ∗∗∗ --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-19-353-01 ∗∗∗ Equinox Control Expert ∗∗∗ --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-19-353-02 ∗∗∗ WECON PLC Editor ∗∗∗ --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-19-353-03 ∗∗∗ Reliable Controls MACH-ProWebCom/Sys ∗∗∗ --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-19-353-04 ∗∗∗ Security Bulletin: IBM Cognos Analytics has addressed multiple vulnerabilties ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cognos-analytics-has-… ∗∗∗ Security Bulletin: Multiple vulnerabilities of Mozzila Firefox (less than Firefox 68.2.0 ESR) have affected Synthetic Playback Agent 8.1.4.0 – 8.1.4 IF09 + ICAM Synthetic 3.0 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Various security vulnerabilities in IBM Financial Transaction Manager for SWIFT Services ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-various-security-vulnerab… ∗∗∗ Security Bulletin: IBM Cognos Business Intelligence has addressed multiple vulnerabilties ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cognos-business-intel… ∗∗∗ Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM i ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple vulnerabilities of Mozzila Firefox (less than Firefox 68.2.0 ESR) have affected Synthetic Playback Agent 8.1.4.0 – 8.1.4 IF09 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ The BIG-IP DNS system may erroneously display the TSIG key secret in plain text form ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K36328238?utm_source=f5support&utm_mediu… ∗∗∗ ASM Cloud Security Services authentication vulnerability CVE-2019-6687 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K59957337?utm_source=f5support&utm_mediu… ∗∗∗ Synology-SA-19:42 Intel Processor Vulnerability ∗∗∗ --------------------------------------------- https://www.synology.com/en-global/support/security/Synology_SA_19_42 ∗∗∗ Synology-SA-19:41 WordPress ∗∗∗ --------------------------------------------- https://www.synology.com/en-global/support/security/Synology_SA_19_41 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 19.12.2019
by Daily end-of-shift report 19 Dec '19

19 Dec '19

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 18-12-2019 18:00 − Donnerstag 19-12-2019 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Emotet Gang Changes Tactics Ahead of the Winter Holidays ∗∗∗ --------------------------------------------- With the end of the year approaching fast, the authors of Emotet have made some changes that may increase their revenue for the holidays. --------------------------------------------- https://www.bleepingcomputer.com/news/security/emotet-gang-changes-tactics-… ∗∗∗ TP-Link Routers Give Cyberattackers an Open Door to Business Networks ∗∗∗ --------------------------------------------- Remote attackers can easily compromise the device and pivot to move laterally through the LAN or WAN. --------------------------------------------- https://threatpost.com/tp-link-routers-cyberattackers-open-door/151254/ ∗∗∗ Microsoft Updates November Security Updates with SharePoint Bug ∗∗∗ --------------------------------------------- Microsoft has added a fresh CVE to its security portal, linking it to the existing November security updates (the patch itself was already included in the updates, but not specifically named). The CVE describes a vulnerability in SharePoint Server. According to a Microsoft Security Advisory, an attacker could exploit the bug (CVE-2019-1491) to obtain sensitive information and then use that information to mount further attacks. --------------------------------------------- https://threatpost.com/microsoft-issues-out-of-band-update-sharepoint-bug/1… ∗∗∗ Data science for cybersecurity: A probabilistic time series model for detecting RDP inbound brute force attacks ∗∗∗ --------------------------------------------- Microsoft Defender ATP data scientists and threat hunters collaborate to use a data science-driven approach to detecting RDP brute force attacks to protect customers against real-world threats. --------------------------------------------- https://www.microsoft.com/security/blog/2019/12/18/data-science-for-cyberse… ∗∗∗ How Websites Are Used to Spread Emotet Malware ∗∗∗ --------------------------------------------- In past posts, we’ve discussed the more popular reasons why hackers target smaller websites. Today, we’ll focus instead on how hackers use compromised websites to spread dangerous malware like Emotet to end user victims. --------------------------------------------- https://blog.sucuri.net/2019/12/how-websites-are-used-to-spread-emotet-malw… ∗∗∗ Zero Day Vulnerability in Deutsche Bahn Ticket Machine Series System uncovered ∗∗∗ --------------------------------------------- Whitehat in action discovers Kiosk Escape & Escalation via Windows PasswordAgent --------------------------------------------- https://www.vulnerability-db.com/?q=articles/2019/12/13/zero-day-vulnerabil… ∗∗∗ Erpressung 2.0: Ransomware-Gangs wollen sensible Firmendaten veröffentlichen ∗∗∗ --------------------------------------------- Die Macher von Maze und Sodinokibi läuten womöglich einen unerfreulichen Trend ein: Sie wollen sensible Dokumente infizierter Unternehmen online stellen. --------------------------------------------- https://heise.de/-4619041 ∗∗∗ Gefälschte Krone.at-Werbung lockt auf Facebook mit gratis iPhones ∗∗∗ --------------------------------------------- Achtung: Auf Facebook kursieren Werbeschaltungen im Namen der Kronen Zeitung. Darin wird behauptet, dass die größte Apple-Lagerhalle gebrannt hat und nun 2173 unbeschädigte iPhones in Österreich verschenkt werden. Das ist frei erfunden und die Werbung stammt nicht von der Kronen Zeitung. Wer sich hier anmeldet, tappt in eine Abo-Falle! --------------------------------------------- https://www.watchlist-internet.at/news/gefaelschte-kroneat-werbung-lockt-au… ∗∗∗ 30 years of ransomware: How one bizarre attack laid the foundations for the malware taking over the world ∗∗∗ --------------------------------------------- In December 1989 the world was introduced to the first ever ransomware - and 30 years later ransomware attacks are now at crisis levels. --------------------------------------------- https://www.zdnet.com/article/30-years-of-ransomware-how-one-bizarre-attack… ===================== = Vulnerabilities = ===================== ∗∗∗ Drupal Releases Security Updates ∗∗∗ --------------------------------------------- Original release date: December 19, 2019Drupal has released security updates to address vulnerabilities in Drupal 7.x, 8.7.x, and 8.8.x. An attacker could exploit some of these vulnerabilities to modify data on an affected website. --------------------------------------------- https://www.us-cert.gov/ncas/current-activity/2019/12/19/drupal-releases-se… ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (git, libgit2, and shadow), Debian (debian-edu-config and python-django), Fedora (python-django), Mageia (apache-commons-beanutils, fence-agents, flightcrew, freerdp, htmldoc, libssh, pacemaker, rsyslog, samba, and sssd), Oracle (freetype and kernel), Scientific Linux (freetype and kernel), SUSE (firefox, spectre-meltdown-checker, thunderbird, xen, and zziplib), and Ubuntu (python-django). --------------------------------------------- https://lwn.net/Articles/807711/ ∗∗∗ Synology-SA-19:42 WordPress ∗∗∗ --------------------------------------------- Multiple vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML or bypass security constraint via a susceptible version of WordPress. --------------------------------------------- https://www.synology.com/en-global/support/security/Synology_SA_19_42 ∗∗∗ Security Bulletin: IBM API Connect is impacted by a vulnerability in libexpat ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-api-connect-is-impact… ∗∗∗ Security Bulletin: Multiple Vulnerabilities in GnuTLS affects IBM Watson Studio Local ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple Vulnerabilities in libpng affects IBM Watson Studio Local ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Vulnerability in jQuery affects IBM Watson Studio Local ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-jquery-a… ∗∗∗ Security Bulletin: Multiple Vulnerabilities in libxml2 affects IBM Watson Studio Local ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ PHP: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-1099 ∗∗∗ Ruby on Rails: Schwachstelle ermöglicht Offenlegung von Informationen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-1098 ∗∗∗ Citrix Systems NetScaler Gateway: Schwachstelle ermöglicht Codeausführung ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-1093 ∗∗∗ Atlassian Confluence: Schwachstelle ermöglicht Offenlegung von Informationen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-1101 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 18.12.2019
by Daily end-of-shift report 18 Dec '19

18 Dec '19

===================== = End-of-Day report = ===================== Timeframe: Dienstag 17-12-2019 18:00 − Mittwoch 18-12-2019 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Forthcoming OpenSSL release ∗∗∗ --------------------------------------------- The OpenSSL project team would like to announce the forthcoming release of OpenSSL version 1.0.2u. This release will be made available on Friday 20th December 2019 between 1300-1700 UTC. This will contain one LOW severity fix for CVE-2019-1551 previously announced here: https://www.openssl.org/news/secadv/20191206.txt --------------------------------------------- https://mta.openssl.org/pipermail/openssl-announce/2019-December/000164.html ∗∗∗ Betrügerische Zahlungsaufforderungen von top-urlaub.info nicht bezahlen! ∗∗∗ --------------------------------------------- Zahlreiche InternetnutzerInnen berichten uns momentan von betrügerischen Rechnungen und Zahlungsaufforderungen der Next Trip Ltd. Sie stoßen auf eine Werbung auf sozialen Netzwerken, die günstige Urlaubsangebote verspricht. Eine Registrierung führt zu hohen Zahlungsaufforderungen wegen einer angeblich abgeschlossenen Jahresmitgliedschaft. Die Rechnung über 239,90 Euro muss in derartigen Fällen nicht bezahlt werden! --------------------------------------------- https://www.watchlist-internet.at/news/betruegerische-zahlungsaufforderunge… ===================== = Vulnerabilities = ===================== ∗∗∗ Google Releases Security Updates for Chrome for Windows, Mac, and Linux ∗∗∗ --------------------------------------------- Google has released security updates for Chrome version 79.0.3945.88 for Windows, Mac, and Linux. This version addresses a vulnerability that an attacker could exploit to take control of an affected system. --------------------------------------------- https://www.us-cert.gov/ncas/current-activity/2019/12/18/google-releases-se… ∗∗∗ Microsoft Releases Out-of-Band Security Updates ∗∗∗ --------------------------------------------- Microsoft has released out-of-band security updates to address a vulnerability in SharePoint Server. An attacker could exploit this vulnerability to obtain sensitive information. --------------------------------------------- https://www.us-cert.gov/ncas/current-activity/2019/12/18/microsoft-releases… ∗∗∗ SpamAssassin 3.4.3 available ∗∗∗ --------------------------------------------- Apache SpamAssassin 3.4.3 contains numerous tweaks and bug fixes as we prepare to move to version 4.0.0 with better, native UTF-8 handling. There are a number of functional patches, improvements as well as security reasons to upgrade to 3.4.3. In this release, there are bug fixes for two CVEs. --------------------------------------------- https://lwn.net/Articles/807539/ ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (debian-edu-config, harfbuzz, libvorbis, and python-ecdsa), Fedora (chromium, fribidi, libssh, and openslp), openSUSE (chromium), Oracle (grub2), Red Hat (rh-maven35-apache-commons-beanutils), SUSE (kernel, libssh, mariadb, samba, and xen), and Ubuntu (openjdk-8, openjdk-lts). --------------------------------------------- https://lwn.net/Articles/807609/ ∗∗∗ Dell XPS 13 2-in-1 (7390): Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit Administratorrechten ∗∗∗ --------------------------------------------- https://www.bsi-fuer-buerger.de/SharedDocs/Warnmeldungen/DE/TW/2019/12/warn… ∗∗∗ GE S2020/S2020G Fast Switch 61850 ∗∗∗ --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-19-351-01 ∗∗∗ Security Advisory - Improper Access Control Vulnerability in Huawei Share ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191218-… ∗∗∗ Security Advisory - Insufficient Input Validation Vulnerability in Huawei Share ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191218-… ∗∗∗ Security Advisory - Buffer Overflow Vulnerability in Some Huawei Smart Phones ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191218-… ∗∗∗ Security Advisory - Information Disclosure Vulnerability in Some Huawei Products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191218-… ∗∗∗ Security Bulletin: vulnerabilities in OpenSSL affect IBM Integration Bus and IBM App Connect ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-openss… ∗∗∗ Security Bulletin: IBM Cloud Transformation Advisor is affected by a Node.js by Prototype Pollution vulnerabiliy ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cloud-transformation-… ∗∗∗ Security Bulletin: Multiple Vulnerabilities in the Linux kernel affect the IBM FlashSystem models V840 and V9000 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: IBM Cloud Transformation Advisor is affected by a Node.js vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cloud-transformation-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Cloud Transformation Advisor ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in jackson-databind affect IBM Platform Symphony and IBM Spectrum Symphony ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: IBM Planning Analytics has addressed a Security Vulnerability ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-planning-analytics-ha… ∗∗∗ Security Bulletin: Multiple Vulnerabilities in the Linux kernel affect the IBM FlashSystem models 840 and 900 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple Vulnerabilities in IBM Java Runtime affect IBM Cognos Command Center ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 17.12.2019
by Daily end-of-shift report 17 Dec '19

17 Dec '19

===================== = End-of-Day report = ===================== Timeframe: Montag 16-12-2019 18:00 − Dienstag 17-12-2019 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ #include ∗∗∗ --------------------------------------------- Recently I saw a tweet where someone mentioned that you can include /dev/stdin in C code compiled with gcc. This is, to say the very least, surprising. When you see something like this with an IT security background you start to wonder if this can be abused for an attack. --------------------------------------------- https://blog.hboeck.de/archives/898-include-etcshadow.html ∗∗∗ Is it Possible to Identify DNS over HTTPs Without Decrypting TLS? ∗∗∗ --------------------------------------------- Aside from the session length, I found that the payload length for DoH is somewhat telling. DNS queries and responses are usually a couple of hundred bytes long. HTTPS connections, on the other hand, tend to "fill" the MTU. --------------------------------------------- https://isc.sans.edu/diary/rss/25616 ∗∗∗ ESET BlueKeep (CVE‑2019‑0708) Detection‑Tool ∗∗∗ --------------------------------------------- Obwohl die BlueKeep-Schwachstelle (CVE-2019-0708) bisher nicht für weitverbreitetes Chaos sorgte, befindet sie sich doch noch in einem recht frühen Stadium der Exploit-Lebensdauer. Tatsächlich ist es so, dass viele Systeme noch nicht gepatcht sind und eine Version des Exploits als Wurm noch auftauchen könnte. Aufgrund dieser Faktoren stellt ESET ein kostenloses Detection-Tool bereit, das checken soll, ob ein System in Bezug auf BlueKeep verwundbar ist. --------------------------------------------- https://www.welivesecurity.com/deutsch/2019/12/17/eset-bluekeep-detection-t… ∗∗∗ Weihnachtseinkäufe auf Amazon: Vorsicht vor Kriminellen ∗∗∗ --------------------------------------------- Eine Bestellung auf Amazon ist für viele bereits selbstverständlich und mit einer überwiegend positiven Kauferfahrung verbunden. Doch auf Amazon finden sich auch betrügerische Angebote: werden Sie aufgefordert, HändlerInnen vorab per E-Mail zu kontaktieren oder die Zahlung über ein externes Konto und nicht über Amazon abzuwickeln, können Sie von einem unseriösen Angebot ausgehen! --------------------------------------------- https://www.watchlist-internet.at/news/weihnachtseinkaeufe-auf-amazon-vorsi… ===================== = Vulnerabilities = ===================== ∗∗∗ Joomla - [20191202] - Core - Various SQL injections through configuration parameters ∗∗∗ --------------------------------------------- Versions: 2.5.0 - 3.9.13 CVE Number: CVE-2019-19846 The lack of validation of configuration parameters used in SQL queries caused various SQL injection vectors. --------------------------------------------- https://developer.joomla.org/security-centre/797-20191202-core-various-sql-… ∗∗∗ Joomla - [20191201] - Core - Path Disclosure in framework files ∗∗∗ --------------------------------------------- Versions: 3.8.0 - 3.9.13 Number: CVE-2019-19845 Missing access check in framework files could lead to a path disclosure. --------------------------------------------- https://developer.joomla.org/security-centre/796-20191201-core-path-disclos… ∗∗∗ This Bug Could Have Let Anyone Crash WhatsApp Of All Group Members ∗∗∗ --------------------------------------------- WhatsApp, the worlds most popular end-to-end encrypted messaging application, patched an incredibly frustrating software bug that could have allowed a malicious group member to crash the messaging app for all members of the same group, The Hacker News learned. ... Check Point responsibly reported this crash bug to the WhatsApp security team back in late August this year, and the company patched the issue with the release of WhatsApp version 2.19.58 in mid-September. --------------------------------------------- https://thehackernews.com/2019/12/whatsapp-group-crash.html ∗∗∗ CVE-2019-18935: Remote Code Execution via Insecure Deserialization in Telerik UI ∗∗∗ --------------------------------------------- Telerik UI for ASP.NET AJAX is a widely used suite of UI components for web applications. It insecurely deserializes JSON objects in a manner that results in arbitrary remote code execution on the softwares underlying host. --------------------------------------------- https://know.bishopfox.com/research/cve-2019-18935-remote-code-execution-in… ∗∗∗ Vulnerabilities in multiple third party TYPO3 CMS extensions ∗∗∗ --------------------------------------------- several vulnerabilities have been found in the following third party TYPO3 extensions: - "MKSamlAuth" (mksamlauth) - "Change password for frontend users" (fe_change_pwd) - "File List" (file_list) - "femanager direct mail subscription" (femanager_dmail_subscribe) - "femanager" (femanager) --------------------------------------------- http://lists.typo3.org/pipermail/typo3-announce/2019/000455.html ∗∗∗ TYPO3 10.2.2, 9.5.13 and 8.7.30 security releases published ∗∗∗ --------------------------------------------- We are announcing the release of the following TYPO3 updates: TYPO3 10.2.2 TYPO3 9.5.13 LTS TYPO3 8.7.30 LTS All versions are security releases and contain important security fixes --------------------------------------------- https://typo3.org/article/typo3-1022-9513-and-8730-security-releases-publis… ∗∗∗ Sicherheitsupdate: Passwortabfrage von TP-Links Archer-Routern umgehbar ∗∗∗ --------------------------------------------- Angreifer könnten eine kritische Sicherheitslücke ausnutzen, um mit Admin-Rechten auf einige Router der Archer-Serie zu zugreifen. --------------------------------------------- https://heise.de/-4616996 ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (libssh, ruby2.3, and ruby2.5), Fedora (kernel and libgit2), openSUSE (chromium and libssh), Oracle (openslp), Red Hat (container-tools:1.0, container-tools:rhel8, freetype, kernel, and kpatch-patch), Scientific Linux (openslp), SUSE (git and LibreOffice), and Ubuntu (graphicsmagick). --------------------------------------------- https://lwn.net/Articles/807505/ ∗∗∗ Intel Patches Privilege Escalation Flaw in Rapid Storage Technology ∗∗∗ --------------------------------------------- A vulnerability Intel has addressed in the Rapid Storage Technology (RST) could allow a local user to escalate privileges to System. Intel RST is a Windows-based application that is provided with many computers that feature Intel chips to deliver improved performance and reliability when SATA disks are used. --------------------------------------------- https://www.securityweek.com/intel-patches-privilege-escalation-flaw-rapid-… ∗∗∗ Security Bulletin: A security vulnerability has been identified in lodash shipped with PowerAI ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: IBM MQ Appliance is affected by a libcgroup vulnerability (CVE-2018-14348) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-appliance-is-affec… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Rational Directory Server (Tivoli) & Rational Directory Administrator ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: A security vulnerability has been identified in SQLite shipped with PowerAI ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: IBM SDK Oracle Java vunerabilities affect IBM Watson Text to Speech and Speech to Text (IBM Watson™ Speech Services 1.1) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sdk-oracle-java-vuner… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 16.12.2019
by Daily end-of-shift report 16 Dec '19

16 Dec '19

===================== = End-of-Day report = ===================== Timeframe: Freitag 13-12-2019 18:00 − Montag 16-12-2019 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ PCI Point-to-Point Encryption Standard 3.0 released ∗∗∗ --------------------------------------------- The PCI Security Standards Council (PCI SSC) has updated the PCI Point-to-Point Encryption Standard (P2PE) and supporting program. PCI P2PE Version 3.0 simplifies the process for component and solution providers to validate their P2PE products for cardholder data protection efforts. --------------------------------------------- https://www.helpnetsecurity.com/2019/12/16/pci-point-to-point-encryption-st… ===================== = Vulnerabilities = ===================== ∗∗∗ Javascript: Node-Pakete können Binärdateien unterjubeln ∗∗∗ --------------------------------------------- Eine Sicherheitslücke in den Paketmanangern für Node.js, NPM und Yarn, ermöglicht das Unterschieben und Manipulieren von Binärdateien auf dem Client-System. Updates stehen bereit. --------------------------------------------- https://www.golem.de/news/javascript-node-pakete-koennen-binaerdateien-unte… ∗∗∗ 2019-11-12: Cybersecurity Advisory - Automation Builder 2.2 (and earlier), Drive Application Builder 1.0 ∗∗∗ --------------------------------------------- ABB is aware of public reports of a vulnerability in the product versions listed above. This issue will be fixed by · Version 2.3.0 of Automation Builder. The release of this version is expected for end of Q1 2020 · Version 1.1.0 of Drive Application Builder. The release of this version is expected for end of 2019 An attacker who successfully exploited this vulnerability could insert and run arbitrary JavaScript and/or ActiveX code. --------------------------------------------- https://search.abb.com/library/Download.aspx?DocumentID=3ADR010465&Language… ∗∗∗ Multiple Vulnerabilities in ABB PB610 PanelBuilder 600 ∗∗∗ --------------------------------------------- ABB is aware of a private report of four vulnerabilities in PB610 Panel Builder 600, versions 2.8.0.424 and earlier, affecting the HMIStudio and HMISimulator components. The vulnerabilities are corrected in version 2.8.0.460. --------------------------------------------- http://www02.abb.com/GLOBAL/GAD/GAD01626.NSF/0/1520A33C30E2562EC12584D20058… ∗∗∗ Vulnerability Spotlight: Multiple vulnerabilities in WAGO PFC200 ∗∗∗ --------------------------------------------- The WAGO PFC200 and PFC100 controllers contain multiple exploitable vulnerabilities. The PFC200 is one of WAGO’s programmable automation controllers that are used in many industries including automotive, rail, power engineering, manufacturing and building management. The vulnerabilities disclosed here all have their root cause within the protocol handling code of the I/O Check (iocheckd) configuration... --------------------------------------------- https://blog.talosintelligence.com/2019/12/vulnerability-spotlight-multiple… ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (davical, intel-microcode, libpgf, php-horde, spamassassin, spip, and thunderbird), Mageia (clementine, dnsmasq, git, jasper, kdelibs4, kernel, libcroco, libgit2, libvirt, ncurses, openafs, proftpd, qbittorrent, signing-party, squid, and wireshark), openSUSE (java-1_8_0-openjdk and postgresql), Oracle (kernel), Red Hat (chromium-browser and openslp), and SUSE (kernel, libssh, and xen). --------------------------------------------- https://lwn.net/Articles/807412/ ∗∗∗ Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect z/TPF ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: API Connect is impacted by credential caching ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-api-connect-is-impacted-b… ∗∗∗ Security Bulletin: A security vulnerability has been identified in Kubernetes shipped with PowerAI Vision ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: IBM MQ is vulnerable to a denial of service attack caused by an abend while processing messages. (CVE-2019-4560) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-is-vulnerable-to-a… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 13.12.2019
by Daily end-of-shift report 13 Dec '19

13 Dec '19

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 12-12-2019 18:00 − Freitag 13-12-2019 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ New Echobot Variant Exploits 77 Remote Code Execution Flaws ∗∗∗ --------------------------------------------- The Echobot botnet is still after the low hanging fruit as a new variant has been spotted with an increased number of exploits that target unpatched devices, IoT for the most part. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-echobot-variant-exploits… ∗∗∗ All in the (Ransomware) Family: 10 Ways to Take Action ∗∗∗ --------------------------------------------- Check out our list of top 10 things to do to protect your organization from the deepening scourge of ransomware. --------------------------------------------- https://threatpost.com/ransomware-family-10-ways-take-action/151080/ ∗∗∗ Multi-stage downloader Trojan sLoad abuses BITS almost exclusively for malicious activities ∗∗∗ --------------------------------------------- Many of today’s threats evolve to incorporate as many living-off-the-land techniques as possible into the attack chain. The PowerShell-based downloader Trojan known as sLoad, however, puts all its bets on BITS. --------------------------------------------- https://www.microsoft.com/security/blog/2019/12/12/multi-stage-downloader-t… ∗∗∗ Internet banking sites and their use of TLS... and SSLv3... and SSLv2?!, (Fri, Dec 13th) ∗∗∗ --------------------------------------------- Although SSLv3 has been considered obsolete and insecure for a long time, a large number of web servers still support its use. And even though the numbers are much lower, some servers on the web support SSLv2 to this day as well. And, as it turns out, this is true even when it comes to web servers hosting internet banking portals --------------------------------------------- https://isc.sans.edu/diary/rss/25606 ∗∗∗ Unmasking Black Hat SEO for Dating Scams ∗∗∗ --------------------------------------------- Malware obfuscation comes in all shapes and sizes - and it’s sometimes hard to recognize the difference between malicious and legitimate code when you see it. Recently, we came across an interesting case where attackers went a few extra miles to make it more difficult to notice the site infection. --------------------------------------------- https://blog.sucuri.net/2019/12/unmasking-black-hat-seo-for-dating-scams.ht… ∗∗∗ Threat spotlight: The curious case of Ryuk ransomware ∗∗∗ --------------------------------------------- >From comic book death god to ransomware baddie, Ryuk ransomware remains a mainstay when organizations find themselves in a crippling malware pinch. We look at Ryuks origins, attack methods, and how to protect against this ever-present threat. --------------------------------------------- https://blog.malwarebytes.com/threat-spotlight/2019/12/threat-spotlight-the… ∗∗∗ Targeted Attacks Deliver New "Anchor" Malware to High-Profile Companies ∗∗∗ --------------------------------------------- TrickBot/Anchor Campaign Could be a New Targeted Magecart Attack Against High-Profile Companies --------------------------------------------- https://www.securityweek.com/targeted-attacks-deliver-new-anchor-malware-hi… ===================== = Vulnerabilities = ===================== ∗∗∗ Advantech DiagAnywhere Server ∗∗∗ --------------------------------------------- This advisory contains mitigations for a stack-based buffer overflow vulnerability in the Advantech DiagAnywhere Server. --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-19-346-01 ∗∗∗ Omron PLC CJ and CS Series ∗∗∗ --------------------------------------------- This advisory includes information and mitigation recommendations for authentications vulnerabilities reported in the Omron PLC CJ and CS Series. --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-19-346-02 ∗∗∗ Omron PLC CJ, CS and NJ Series ∗∗∗ --------------------------------------------- This advisory includes information and mitigation recommendations for an authentication related vulnerability in the Omron PLC CJ, CS, and NJ Series. --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-19-346-03 ∗∗∗ WordPress 5.3.1 Security and Maintenance Release ∗∗∗ --------------------------------------------- This security and maintenance release features 46 fixes and enhancements. Plus, it adds a number of security fixes - see the list below. --------------------------------------------- https://wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance… ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Fedora (knot-resolver and xen), openSUSE (kernel), and SUSE (haproxy, kernel, and openssl). --------------------------------------------- https://lwn.net/Articles/807261/ ∗∗∗ Security Bulletin: Multiple vulnerabilities affect IBM Tivoli Monitoring embedded WebSphere Application and IHS server ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: A cross site scripting security vulnerability has been identified with Case Builder component in IBM Case Manager (CVE-2019-4426) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-cross-site-scripting-se… ∗∗∗ Security Bulletin: A cross site scripting security vulnerability has been identified with Case Builder component shipped with IBM Business Automation Workflow (CVE-2019-4426) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-cross-site-scripting-se… ∗∗∗ HPESBHF03974 rev.1 - HPE Servers using certain Intel Processors, Local Denial of Service, Disclosure of Information, Escalation of Privilege ∗∗∗ --------------------------------------------- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_n… ∗∗∗ Dovecot: Schwachstelle ermöglicht Denial of Service ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-1076 ∗∗∗ Trend Micro AntiVirus: Schwachstelle ermöglicht Denial of Service oder Codeausführung ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-1077 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 12.12.2019
by Daily end-of-shift report 12 Dec '19

12 Dec '19

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 11-12-2019 18:00 − Donnerstag 12-12-2019 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ (Almost) Hollow and Innocent: Monero Miner Remains Undetected via Process Hollowing ∗∗∗ --------------------------------------------- Cryptocurrencies values are increasing again, which may explain why the number of stealthy techniques to deliver them have also increased this year. We found another campaign using process hollowing and a dropper component to evade detection and analysis, and can potentially be used for other malware payloads. --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/wSpVXlrw0Ok/ ∗∗∗ Code & Data Reuse in the Malware Ecosystem ∗∗∗ --------------------------------------------- In the past, I already had the opportunity to give some "security awareness" sessions to developers. One topic that was always debated is the reuse of existing code. Indeed, for a developer, its tempting to not reinvent the wheel when somebody already wrote a piece of code that achieves the expected results. From a gain of time perspective, its a win for the developers who can focus on other code. Of course, this can have side effects and introduce bugs, backdoors, etc... --------------------------------------------- https://isc.sans.edu/forums/diary/Code+Data+Reuse+in+the+Malware+Ecosystem/… ∗∗∗ Winbox in the Wild ∗∗∗ --------------------------------------------- I’ve written, ad nauseam, about MikroTik routers. I’ve detailed vulnerabilities, post exploitation, and the protocol used by Winbox to communicate to the router on port 8291: [...] --------------------------------------------- https://medium.com/tenable-techblog/winbox-in-the-wild-9a2ee4946add?source=… ∗∗∗ The little-known ways mobile device sensors can be exploited by cybercriminals ∗∗∗ --------------------------------------------- Mobile device sensors offer great utility to users—from taking pictures and commanding voice assistants to determining which direction to flip your screen. However, they harbor little-known vulnerabilities that could be exploited by crafty cybercriminals. --------------------------------------------- https://blog.malwarebytes.com/iot/2019/12/the-little-known-ways-mobile-devi… ∗∗∗ Gefälschte Post-SMS zur Zahlung für wartende Pakete ∗∗∗ --------------------------------------------- Warten Sie gerade auf ein Paket? In der Weihnachtszeit ist das nicht unwahrscheinlich! Kriminelle nützen das und versenden gefälschte SMS mit dem Absendenamen „PST“ oder „POST“. Sie sollen eine Zahlung über 2,99 Euro bestätigen indem Sie einem Link folgen. Sie landen auf einer gefälschten Post-Website. Geben Sie Ihre Daten hier nicht ein – man versucht sie Ihnen zu stehlen! --------------------------------------------- https://www.watchlist-internet.at/news/gefaelschte-post-sms-zur-zahlung-fue… ∗∗∗ What I Learned from Reverse Engineering Windows Containers ∗∗∗ --------------------------------------------- Our researcher provides an overview on containers - starting with their Linux history - and shows the different implementations of containers in Windows, how they work, the security pitfalls that may occur, as well as the internal implementation of objects that are necessary for Containers in Windows. --------------------------------------------- https://unit42.paloaltonetworks.com/what-i-learned-from-reverse-engineering… ∗∗∗ Microsoft details the most clever phishing techniques it saw in 2019 ∗∗∗ --------------------------------------------- This years most clever phishing tricks include hijacking Google search results and abusing 404 error pages. --------------------------------------------- https://www.zdnet.com/article/microsoft-details-the-most-clever-phishing-te… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by CentOS (firefox and nss-softokn), Fedora (samba), Oracle (nss, nss-softokn, nss-util, nss-softokn, and thunderbird), Scientific Linux (thunderbird), SUSE (firefox), and Ubuntu (librabbitmq and samba). --------------------------------------------- https://lwn.net/Articles/807186/ ∗∗∗ Synology-SA-19:40 Samba AD DC ∗∗∗ --------------------------------------------- CVE-2019-14861 and CVE-2019-11479 allow remote authenticated users to conduct denial-of-service attacks or bypass security constraints via a susceptible version of Synology Directory Server. --------------------------------------------- https://www.synology.com/en-global/support/security/Synology_SA_19_40 ∗∗∗ Webform - Critical - Multiple vulnerabilities - SA-CONTRIB-2019-096 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2019-096 ∗∗∗ Modal Page - Moderately critical - Access bypass - SA-CONTRIB-2019-094 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2019-094 ∗∗∗ Taxonomy access fix - Moderately critical - Access bypass - SA-CONTRIB-2019-093 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2019-093 ∗∗∗ Smart Trim - Moderately critical - Cross site scripting - SA-CONTRIB-2019-092 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2019-092 ∗∗∗ Permissions by Term - Moderately critical - Access bypass - SA-CONTRIB-2019-095 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2019-095 ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ ∗∗∗ BIG-IP TMM vulnerability CVE-2019-6671 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K39225055 ∗∗∗ TMOS vulnerability CVE-2019-6664 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K03126093 ∗∗∗ HPESBHF03973 rev.1 - HPE Servers with certain Intel Processors, Local Disclosure of Information, Local Escalation of Privilege ∗∗∗ --------------------------------------------- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_n… ∗∗∗ Red Hat OpenShift Service Mesh: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-1067 ∗∗∗ OpenBSD: Schwachstelle ermöglicht Privilegieneskalation ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-1070 ∗∗∗ Linux Kernel und hostapd: Mehrere Schwachstellen ermöglichen Denial of Service ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-1071 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily December 2019