Daily June 2020

daily@lists.cert.at

1 participants
20 discussions

Tageszusammenfassung - 30.06.2020
by Daily end-of-shift report 30 Jun '20

30 Jun '20

===================== = End-of-Day report = ===================== Timeframe: Montag 29-06-2020 18:00 − Dienstag 30-06-2020 18:00 Handler: Dimitri Robl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Sysmon and Alternate Data Streams, (Mon, Jun 29th) ∗∗∗ --------------------------------------------- Sysmon version 11.10, released a couple of days ago, adds support for capturing content of Alternate Data Streams. --------------------------------------------- https://isc.sans.edu/diary/rss/26292 ∗∗∗ Adventures in ATM Hacking ∗∗∗ --------------------------------------------- Previously, I had some experience with PoS (Point of Sale) devices and entertained myself with kiosks at hacking conferences, but never had touched an ATM before. My companion on this saga had already some fun hacking with these devices and had some precious insights to guide us during our engagement. --------------------------------------------- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/adventures-… ∗∗∗ Enigmail warnt Nutzer vor manuellem Update auf Thunderbird 78 ∗∗∗ --------------------------------------------- Enigmail-Nutzer sollen mit dem Erscheinen von Thunderbird 78 nicht manuell auf diese Version aktualisieren – die E-Mail-Verschlüsselung ist noch nicht fertig. --------------------------------------------- https://heise.de/-4799240 ∗∗∗ BSI aktualisiert den Mindeststandard für Web-Browser ∗∗∗ --------------------------------------------- Das Bundesamt für Sicherheit in der Informationstechnik (BSI) hat am 30. Juni 2020 den Mindeststandard für Web-Browser aktualisiert. --------------------------------------------- https://www.bsi.bund.de/DE/Presse/Kurzmeldungen/Meldungen/Webbrowser_300620… ∗∗∗ Vorsicht, wenn Ihr Tinder-Match über lukrative Investitionsmöglichkeiten spricht ∗∗∗ --------------------------------------------- Der Watchlist Internet sind schon sehr viele Fälle bekannt, wo Menschen auf unseriösen Investment-Plattformen sehr viel Geld verloren haben. Aufmerksam wird man auf derartige Plattformen durch gefälschte Zeitungsbeiträge oder E-Mail-Angebote. Kriminelle bewerben ihre Plattformen aber auch vermehrt über Tinder-NutzerInnen, die von sehr gewinnbringenden Investitionsmöglichkeiten schwärmen und zu Zahlungen animieren. --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-wenn-ihr-tinder-match-ueber… ∗∗∗ A hacker gang is wiping Lenovo NAS devices and asking for ransoms ∗∗∗ --------------------------------------------- Ransom notes signed by Cl0ud SecuritY hacker group are being found on old LenovoEMC NAS devices. --------------------------------------------- https://www.zdnet.com/article/a-hacker-gang-is-wiping-lenovo-nas-devices-an… ∗∗∗ Detecting adversarial behaviour by applying NLP techniques to command lines ∗∗∗ --------------------------------------------- [...] Methodology designed to automatically detect whether a system has been compromised needs to be able to tell the difference between benign and malicious command line operations. In order to build mechanisms capable of classifying command lines in this way, we first need to understand what they do – in other words, we need to be able to parse them in a similar way to how we parse natural languages. This article describes the process we’ve been using to develop methodology capable of parsing and categorizing command lines at F-Secure. --------------------------------------------- https://blog.f-secure.com/command-lines/ ===================== = Vulnerabilities = ===================== ∗∗∗ CVE-2020-2021 PAN-OS: Authentication Bypass in SAML Authentication ∗∗∗ --------------------------------------------- When Security Assertion Markup Language (SAML) authentication is enabled and the Validate Identity Provider Certificate option is disabled (unchecked), improper verification of signatures in PAN-OS SAML authentication enables an unauthenticated network-based attacker to access protected resources. The attacker must have network access to the vulnerable server to exploit this vulnerability. --------------------------------------------- https://security.paloaltonetworks.com/CVE-2020-2021 ∗∗∗ Sicherheitsupdates sind da: Jetzt Root-Lücke in Netgear-Routern patchen ∗∗∗ --------------------------------------------- Angreifer könnten Router von Netgear attackieren und Schadcode ausführen. Abgesicherte Firmware-Versionen sind verfügbar. --------------------------------------------- https://heise.de/-4799957 ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (coturn, drupal7, libvncserver, mailman, php5, and qemu), openSUSE (curl, graphviz, mutt, squid, tomcat, and unbound), Red Hat (chromium-browser, file, kernel, microcode_ctl, ruby, and virt:rhel), Slackware (firefox), and SUSE (mariadb-100, mutt, unzip, and xmlgraphics-batik). --------------------------------------------- https://lwn.net/Articles/824822/ ∗∗∗ Security Bulletin: Multiple vulnerabilities in middleware software affect IBM Cloud Pak for Automation ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Cross-Site Scripting vulnerability affect IBM Business Automation Workflow and IBM Business Process Manager (BPM) – CVE-2020-4557 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-cross-site-scripting-vuln… ∗∗∗ Security Bulletin: Security vulnerability in Java SE affects Rational Build Forge (CVE-2019-2949) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-security-vulnerability-in… ∗∗∗ Security Bulletin: Cross-Site Scripting vulnerability affect IBM Business Automation Workflow and IBM Business Process Manager (BPM) – CVE-2020-4557 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-cross-site-scripting-vuln… ∗∗∗ Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Tivoli Netcool Impact (CVE-2019-12406) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: IBM API Connect is impacted by vulnerabilities in PHP (CVE-2020-7066, CVE-2020-7065, CVE-2020-7064) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-api-connect-is-impact… ∗∗∗ Security Bulletin: A vulnerability in OpenSSL affects IBM Rational ClearQuest (CVE-2019-1551) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-openss… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM® SDK Java™ Technology Edition affect IBM Rational Build Forge. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affects IBM Agile Lifecycle Manager ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in middleware software affect IBM Cloud Pak for Automation ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Vulnerability in IBM Java Runtime affect IBM Integration Bus and IBM App Connect Enterpise v11 (CVE-2019-2949) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-ibm-java… ∗∗∗ Security Bulletin: A vulnerability in the IBM Java Runtime affects IBM Rational ClearQuest (CVE-2020-2654) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-the-ib… ∗∗∗ OpenJPEG: Schwachstelle ermöglicht nicht spezifizierten Angriff ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-0645 ∗∗∗ Squid: Schwachstelle ermöglicht Darstellen falscher Informationen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-0644 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 29.06.2020
by Daily end-of-shift report 29 Jun '20

29 Jun '20

===================== = End-of-Day report = ===================== Timeframe: Freitag 26-06-2020 18:00 − Montag 29-06-2020 18:00 Handler: Dimitri Robl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Laravel/Telescope: Die Sicherheitslücke bei einer Bank, die es nicht gibt ∗∗∗ --------------------------------------------- Ein Leser hat uns auf eine Sicherheitslücke auf der Webseite einer Onlinebank hingewiesen. Die Lücke war echt und betrifft auch andere Seiten - die Bank jedoch scheint es nie gegeben zu haben. --------------------------------------------- https://www.golem.de/news/laravel-telescope-die-sicherheitsluecke-bei-einer… ∗∗∗ Active Directory series: Unconstrained delegation ∗∗∗ --------------------------------------------- In this article series, we will look into the most famous ways that can be used to attack Active Directory and achieve persistence. Note: Attacks discussed in this series have already been publicly disclosed on different forums. This series is for educational purposes only. --------------------------------------------- https://resources.infosecinstitute.com/active-directory-series-unconstraine… ∗∗∗ Beware "secure DNS" scam targeting website owners and bloggers ∗∗∗ --------------------------------------------- If you run a website or a blog, watch out for emails promising "DNSSEC upgrades" - these scammers are after your whole site. --------------------------------------------- https://nakedsecurity.sophos.com/2020/06/29/beware-secure-dns-scam-targetin… ∗∗∗ The face of tomorrow's cybercrime: Deepfake ransomware explained ∗∗∗ --------------------------------------------- Deepfake ransomware is a mighty combination that several security experts fear would happen soon. But what is it exactly? Is it deepfake with a ransomware twist? Or ransomware with a sprinkling of deepfake tech? --------------------------------------------- https://blog.malwarebytes.com/ransomware/2020/06/the-face-of-tomorrows-cybe… ∗∗∗ Passwort‑Manager: nützliches Alltags‑Tool ∗∗∗ --------------------------------------------- In diesem Artikel erklären wir, was einen Passwort-Manager ausmacht und warum dieser als nützliches Tool in den Alltag integriert werden sollte. --------------------------------------------- https://www.welivesecurity.com/deutsch/2020/06/26/passwort-manager-im-allta… ∗∗∗ ebay-HändlerInnen aufgepasst: gezielte Phishing-Attacken ∗∗∗ --------------------------------------------- Wenn Sie Waren auf ebay verkaufen, dann nehmen Sie sich vor betrügerischen Nachrichten in Acht, in denen man Ihnen vorspielt, dass Kundschaft von einem Kauf zurücktreten möchte. Die Nachrichten werden im ebay-Design verschickt und fordern zur Antwort auf die entsprechende Anfrage auf. Der Link führt Sie auf eine gefälschte ebay-Website, auf der Ihre Daten direkt in den Händen Krimineller landen. --------------------------------------------- https://www.watchlist-internet.at/news/ebay-haendlerinnen-aufgepasst-geziel… ∗∗∗ Adobe, Mastercard, Visa warn online store owners of Magento 1.x EOL ∗∗∗ --------------------------------------------- Almost 110,000 online stores are still running the soon-to-be-outdated Magento 1.x CMS. --------------------------------------------- https://www.zdnet.com/article/adobe-mastercard-visa-warn-online-store-owner… ===================== = Vulnerabilities = ===================== ∗∗∗ Keine Überraschung nach Fraunhofer-Test: Viele Home-Router unsicher ∗∗∗ --------------------------------------------- Sicherheitsforscher des FKIE haben 127 verschiedene Home-Router untersucht und vermuten gravierende Sicherheitsmängel. Überraschen kann das niemanden mehr. --------------------------------------------- https://heise.de/-4798342 ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (libtasn1-6, libtirpc, mcabber, picocom, pngquant, trafficserver, and zziplib), Fedora (curl and xen), openSUSE (bluez, ceph, chromium, curl, grafana, grafana-piechart-panel,, graphviz, mariadb, and mercurial), Oracle (nghttp2), Red Hat (microcode_ctl), SUSE (mutt, python3-requests, and tomcat), and Ubuntu (glib-networking and mailman). --------------------------------------------- https://lwn.net/Articles/824717/ ∗∗∗ Security Advisory - Denial of Service Vulnerability in Several Products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20200624-… ∗∗∗ Security Advisory - Information Disclosure Vulnerability in Several Smartphones ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20200624-… ∗∗∗ Security Bulletin: IBM TNPM for Wireline is vulnarable to Cross Site Request Forgery(CSRF) and Cross Site Scripting(CSS) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-tnpm-for-wireline-is-… ∗∗∗ Security Bulletin: Speech to Text, Text to Speech ICP, WebSphere Application Server Liberty Fix ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-speech-to-text-text-to-sp… ∗∗∗ Security Bulletin: IBM API Connect is vulnerable to cross-site scripting (XSS) in Drupal (sa-contrib-2020-025) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-api-connect-is-vulner… ∗∗∗ Security Bulletin: IBM MQ is vulnerable to a denial of service attack due to an error within the Data Conversion logic. (CVE-2020-4310) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-is-vulnerable-to-a… ∗∗∗ Security Bulletin: IBM API Connect V 2018 (ova) is impacted by weak cryptographic algorithms (CVE-2020-4452) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-api-connect-v-2018-ov… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Content Classification ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: IBM Integration Bus affected by multiple Apache Tomcat vulnerabilities. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-integration-bus-affec… ∗∗∗ Security Bulletin: IBM API Connect is vulnerable to arbitrary code execution and security bypass in Drupal (CVE-2020-13664, CVE-2020-13665) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-api-connect-is-vulner… ∗∗∗ Security Bulletin: A security vulnerability in Node.js affects IBM Integration Bus & IBM App Connect Enterprise V11 (CVE-2019-17592) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: IBM API Connect is vulnerable to cross-site request forgery (CSRF) (CVE-2020-13663) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-api-connect-is-vulner… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 26.06.2020
by Daily end-of-shift report 26 Jun '20

26 Jun '20

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 25-06-2020 18:00 − Freitag 26-06-2020 18:00 Handler: Dimitri Robl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Golang Worm Widens Scope to Windows, Adds Payload Capacity ∗∗∗ --------------------------------------------- A first-stage malware loader spotted in active campaigns has added additional exploits and a new backdoor capability. --------------------------------------------- https://threatpost.com/worm-golang-malware-windows-payloads/156924/ ∗∗∗ Browser-Hersteller verkürzen Zertifikats-Lebensdauer auf ein Jahr ∗∗∗ --------------------------------------------- Ab September dürfen HTTPS-Zertifikate nur noch auf maximal ein Jahr ausgestellt werden. --------------------------------------------- https://heise.de/-4796599 ∗∗∗ Web skimmer hides within EXIF metadata, exfiltrates credit cards via image files ∗∗∗ --------------------------------------------- This credit card skimmer hides in plain sight, quite literally, as it resides inside the metadata of image files. --------------------------------------------- https://blog.malwarebytes.com/threat-analysis/2020/06/web-skimmer-hides-wit… ∗∗∗ Achtung: Auf Instagram kursieren betrügerische Nachrichten ∗∗∗ --------------------------------------------- Seit kurzem melden uns Instagram-NutzerInnen, betrügerische Nachrichten, in denen sie aufgefordert werden, einem Link zu folgen. Achtung: Kriminelle, die diese Privatnachrichten zahlreich und willkürlich versenden, wollen nur an Ihre Zugangsdaten kommen! --------------------------------------------- https://www.watchlist-internet.at/news/achtung-auf-instagram-kursieren-betr… ∗∗∗ Angebliche E-Mail der Bundesregierung enthält Ransomware ∗∗∗ --------------------------------------------- Die Serie von Ransomware-Angriffen auf deutsche Unternehmen setzt sich fort. Eine neue Ransomware-Kampagne in Deutschland nutzt als Köder eine gefälschte E-Mail im Namen der Bundesregierung. --------------------------------------------- https://www.zdnet.de/88381006/angebliche-e-mail-der-bundesregierung-enthael… ===================== = Vulnerabilities = ===================== ∗∗∗ Micropatch is Available for Windows LNK Remote Code Execution Vulnerability (CVE-2020-1299) ∗∗∗ --------------------------------------------- Windows 7 and Server 2008 R2 users without Extended Security Updates have just received a micropatch for CVE-2020-1299, another "Stuxnet-like" critical LNK remote code execution issue that can get code executed on users computer just by viewing a folder with Windows Explorer.This vulnerability was patched by Microsoft with June 2020 Updates, but Windows 7 and Server 2008 users without Extended Security Updates remained vulnerable. --------------------------------------------- https://blog.0patch.com/2020/06/micropatch-is-available-for-windows-lnk.html ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (alpine), Fedora (fwupd, microcode_ctl, mingw-libjpeg-turbo, mingw-sane-backends, suricata, and thunderbird), openSUSE (uftpd), Red Hat (nghttp2), SUSE (ceph, curl, mutt, squid, tigervnc, and unbound), and Ubuntu (linux kernel and nvidia-graphics-drivers-390, nvidia-graphics-drivers-440). --------------------------------------------- https://lwn.net/Articles/824579/ ∗∗∗ Security Bulletin: Multiple vulnurabilities discovered in IBM® SDK, Java™ can affect Rational Software Architect Design Manager ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnurabilities-… ∗∗∗ Security Bulletin: Information Disclosure in IBM Spectrum Protect Plus (CVE-2020-4565) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-information-disclosure-in… ∗∗∗ Security Bulletin: A vulnerability in the IBM Java Runtime affects IBM Rational ClearCase (CVE-2020-2654) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-the-ib… ∗∗∗ Security Bulletin: Vulnerability in OpenSSL affects IBM Rational ClearCase (CVE-2019-1551) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-openssl-… ∗∗∗ Security Bulletin: NVIDIA Windows GPU Display Driver has resolved several security vulnerabilities as described below. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-nvidia-windows-gpu-displa… ∗∗∗ Security Bulletin: NVIDIA Windows GPU Display driver is vulnerable to several security vulnerabilities. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-nvidia-windows-gpu-displa… ∗∗∗ Security Bulletin: A security vulnerability in Node.js affects IBM Integration Bus & IBM App Connect Enterprise V11 (CVE-2019-10744) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 25.06.2020
by Daily end-of-shift report 25 Jun '20

25 Jun '20

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 24-06-2020 18:00 − Donnerstag 25-06-2020 18:00 Handler: Dimitri Robl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ European bank suffers biggest PPS DDoS attack, new botnet suspected ∗∗∗ --------------------------------------------- A bank in Europe was the target of a huge distributed denial-of-service (DDoS) attack that sent to its networking gear a flood of 809 million packets per second (PPS). --------------------------------------------- https://www.bleepingcomputer.com/news/security/european-bank-suffers-bigges… ∗∗∗ Defending Exchange servers under attack ∗∗∗ --------------------------------------------- Exchange servers are high-value targets. If compromised, Exchange servers provide a unique environment that could allow attackers to perform various tasks using the same built-in tools or scripts that admins use. Keeping these servers safe from these advanced attacks is of utmost importance. --------------------------------------------- https://www.microsoft.com/security/blog/2020/06/24/defending-exchange-serve… ∗∗∗ The Golden Tax Department and the Emergence of GoldenSpy Malware ∗∗∗ --------------------------------------------- Trustwave SpiderLabs has discovered a new malware family, dubbed GoldenSpy, embedded in tax payment software that a Chinese bank requires corporations to install to conduct business operations in China. --------------------------------------------- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-… ∗∗∗ Maersk, me & notPetya ∗∗∗ --------------------------------------------- [...] Establishing the exact content and format of this post has been difficult. It hasn’t been clear where to start. [...] I’ve tried to focus on the main timeline and the lessons. So this isn’t everything. But the experience we had at Maersk, or at least significant elements of it, could happen to any organisation. In fact, it does happen, to all kinds of organisations, all of the time, [...] --------------------------------------------- https://gvnshtn.com/maersk-me-notpetya/ ∗∗∗ Extending Drupal 7s End-of-Life - PSA-2020-06-24 ∗∗∗ --------------------------------------------- Previously, Drupal 7s end-of-life was scheduled for November 2021. Given the impact of COVID-19 on budgets and businesses, we will be extending the end of life until November 28, 2022. The Drupal Security Team will continue to follow the Security Team processes for Drupal 7 core and contributed projects. --------------------------------------------- https://www.drupal.org/psa-2020-06-24 ∗∗∗ Attackers Cryptojacking Docker Images to Mine for Monero ∗∗∗ --------------------------------------------- We identified a malicious Docker Hub account named "azurenql" that contained 8 repositories, hosting 6 malicious Monero mining images. --------------------------------------------- https://unit42.paloaltonetworks.com/cryptojacking-docker-images-for-mining-… ===================== = Vulnerabilities = ===================== ∗∗∗ Telnet Vulnerability Affecting Cisco Products: June 2020 ∗∗∗ --------------------------------------------- On February 28, 2020, APPGATE published a blog post regarding CVE-ID CVE-2020-10188, which is a vulnerability in Telnet servers (telnetd). For more information about this vulnerability, see the Details section. Cisco will release software updates that address this vulnerability. There are workarounds that address this vulnerability. --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Multiple vulnerabilities in Danish company Mobile Industrial Robot s products ∗∗∗ --------------------------------------------- More than 10 different robot types are affected and operate from industrial spaces to public environments, such as airports and hospitals. --------------------------------------------- https://news.aliasrobotics.com/the-week-of-mobile-industrial-robots-bugs/ ∗∗∗ Mehrere Sicherheitslücken in Grafikkarten-Treiber von Nvidia gestopft ∗∗∗ --------------------------------------------- Es gibt wichtige Sicherheitsupdates für Software und Treiber von Nvidia. Neben Windows ist auch Linux bedroht. --------------------------------------------- https://heise.de/-4794975 ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Fedora (libexif, php-horde-horde, and tcpreplay), openSUSE (rubygem-bundler), Oracle (docker-cli docker-engine, kernel, and ntp), Slackware (curl and libjpeg), and Ubuntu (mutt). --------------------------------------------- https://lwn.net/Articles/824474/ ∗∗∗ Security Bulletin: Speech to Text, Text to Speech ICP, WebSphere Application Server Liberty Fix ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-speech-to-text-text-to-sp… ∗∗∗ Security Bulletin: Speech to Text, Text to Speech ICP, WebSphere Application Server Liberty Fix ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-speech-to-text-text-to-sp… ∗∗∗ Security Bulletin: IBM Maximo Asset Management is vulnerable to SQL injection (CVE-2019-4650) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-maximo-asset-manageme… ∗∗∗ Security Bulletin: Speech to Text, Text to Speech ICP, WebSphere Application Server Liberty Fix ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-speech-to-text-text-to-sp… ∗∗∗ Security Bulletin: ICP Speech to Text, Text to Speech Oracle Java Vulnerability Fix ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-icp-speech-to-text-text-t… ∗∗∗ Security Bulletin: IBM Maximo Asset Management is vulnerable to cross-site scripting (CVE-2020-4223) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-maximo-asset-manageme… ∗∗∗ Security Bulletin: IBM Bootable Media Creator (BoMC) is affected by a vulnerability in cURL (CVE-2019-5482) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-bootable-media-creato… ∗∗∗ Security Bulletin: IBM QRadar Network Security is affected by multiple vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-qradar-network-securi… ∗∗∗ Security Bulletin: ICP Speech to Text, Text to Speech – OpenSSL vulnerability fix. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-icp-speech-to-text-text-t… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 24.06.2020
by Daily end-of-shift report 24 Jun '20

24 Jun '20

===================== = End-of-Day report = ===================== Timeframe: Dienstag 23-06-2020 18:00 − Mittwoch 24-06-2020 18:00 Handler: Dimitri Robl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ IT-Sicherheit: Etwa 80.000 Drucker sind im Internet offen ansteuerbar ∗∗∗ --------------------------------------------- Die Security-Organisation Shadowserver hat einen globalen IPP-Scan durchgeführt und viele Drucker gefunden, die offen Informationen teilen. --------------------------------------------- https://www.golem.de/news/it-sicherheit-etwa-80-000-drucker-sind-im-interne… ∗∗∗ What is DNS Poisoning and to Protect Your Enterprise Against it ∗∗∗ --------------------------------------------- Modern enterprise cybersecurity has evolved – that’s a true statement. If we were to travel back in time – say, 10 or 20 years – ago, we would have discovered, much to our stupefaction, that cybersecurity was nothing more than an auxiliary attribution, bestowed upon the (un)fortunate soul who had the (dubious privilege) of fulfilling [...] --------------------------------------------- https://heimdalsecurity.com/blog/what-is-dns-poisoning/ ∗∗∗ Magnitude exploit kit – evolution ∗∗∗ --------------------------------------------- Exploit kits still play a role in today’s threat landscape and continue to evolve. For this blogpost I studied and analyzed the evolution of one of the most sophisticated exploit kits out there – Magnitude EK – for a whole year. --------------------------------------------- https://securelist.com/magnitude-exploit-kit-evolution/97436/ ∗∗∗ Sodinokibi Ransomware Now Scans Networks For PoS Systems ∗∗∗ --------------------------------------------- Attackers are compromising large companies with the Cobalt Strike malware, and then deploying the Sodinokibi ransomware. --------------------------------------------- https://threatpost.com/sodinokibi-ransomware-now-scans-networks-for-pos-sys… ∗∗∗ Hakbit Ransomware Attack Uses GuLoader, Malicious Microsoft Excel Attachments ∗∗∗ --------------------------------------------- Recent spearphishing emails spread the Hakbit ransomware using malicious Microsoft Excel attachments and the GuLoader dropper. --------------------------------------------- https://threatpost.com/hackbit-ransomware-attack-uses-guloader-malicious-mi… ∗∗∗ Using Shell Links as zero-touch downloaders and to initiate network connections, (Wed, Jun 24th) ∗∗∗ --------------------------------------------- Probably anyone who has used any modern version of Windows is aware of their file-based shortcuts, also known as LNKs or Shell Link files. Although they were intended as a simple feature to make Windows a bit more user-friendly, over the years, a significant number[1] of vulnerabilities were identified in handling of LNKs. Many of these vulnerabilities lead to remote code execution and one (CVE-2010-2568) was even used in creation of the Stuxnet worm. --------------------------------------------- https://isc.sans.edu/diary/rss/26276 ∗∗∗ Three words you do not want to hear regarding a secure browser called SafePay... Remote. Code. Execution ∗∗∗ --------------------------------------------- How Bitdefenders security software was caught napping by ad-block bod Folks running Bitdefenders Total Security 2020 package should check they have the latest version installed following the disclosure of a remote code execution bug. --------------------------------------------- https://go.theregister.com/feed/www.theregister.com/2020/06/24/bitdefender_… ∗∗∗ WastedLocker: A New Ransomware Variant Developed By The Evil Corp Group ∗∗∗ --------------------------------------------- WastedLocker is a new ransomware locker we’ve detected being used since May 2020. We believe it has been in development for a number of months prior to this and was started in conjunction with a number of other changes we have seen originate from the Evil Corp group in 2020. Evil Corp were previously associated to the Dridex malware and BitPaymer ransomware, the latter came to prominence in the first half of 2017. Recently Evil Corp has changed a number of TTPs related to their operations further described in this article. --------------------------------------------- https://blog.fox-it.com/2020/06/23/wastedlocker-a-new-ransomware-variant-de… ∗∗∗ Gefälschte PayLife-Mails im Umlauf ∗∗∗ --------------------------------------------- Unter verschiedenen Vorwänden versuchen BetrügerInnen derzeit an Zugangs- und Kreditkartendaten von PayLife-KundInnen zu kommen. Kommt man den Aufforderungen in diesen Mails nicht nach, wird mit einer Sperre der Karte oder anderen Einschränkungen gedroht. Folgen Sie dem Link in diesen Mails nicht und laden Sie auch keine „Kartensicherheits-App“ herunter! --------------------------------------------- https://www.watchlist-internet.at/news/gefaelschte-paylife-mails-im-umlauf/ ∗∗∗ Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices ∗∗∗ --------------------------------------------- A new hybrid malware capable of cryptojacking and launching DDoS was discovered in the wild, which weve named "Lucifer." --------------------------------------------- https://unit42.paloaltonetworks.com/lucifer-new-cryptojacking-and-ddos-hybr… ∗∗∗ This sneaky malware goes to unusual lengths to cover its tracks ∗∗∗ --------------------------------------------- Glupteba creates a backdoor into infected Windows systems - and researchers think itll be offered to cyber criminals as an easy means of distributing other malware. --------------------------------------------- https://www.zdnet.com/article/this-sneaky-malware-goes-to-unusual-lengths-t… ===================== = Vulnerabilities = ===================== ∗∗∗ Kritische Sicherheitslücke bedroht Magento-Shops ∗∗∗ --------------------------------------------- Angreifer könnten Onlineshops auf Magento-Basis attackieren und im schlimmsten Fall komplett übernehmen. --------------------------------------------- https://heise.de/-4793608 ∗∗∗ Kritische Lücke: Helpdesk-App auf Qnap-NAS lädt Angreifer ein ∗∗∗ --------------------------------------------- Qnap hat eine wichtige Aktualisierung für die Support-App Helpdesk veröffentlicht. --------------------------------------------- https://heise.de/-4794415 ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by CentOS (kernel, ntp, and unbound), Fedora (php-horde-horde and tcpreplay), openSUSE (chromium, java-1_8_0-openj9, mozilla-nspr, mozilla-nss, and opera), Oracle (gnutls, grafana, thunderbird, and unbound), Red Hat (candlepin and satellite, docker, microcode_ctl, openstack-keystone, openstack-manila and openstack-manila, and qemu-kvm-rhev), Scientific Linux (kernel and ntp), Slackware (ntp), SUSE (curl, libreoffice, libssh2_org, and php5), and Ubuntu (curl). --------------------------------------------- https://lwn.net/Articles/824378/ ∗∗∗ VMware Produkte: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-0622 ∗∗∗ Security Bulletin: IBM Security Guardium is affected by Use of Hard-Coded Credentials vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Security Bulletin: Multiple vulnerabilities have been identified in IBM Tivoli Netcool/OMNIbus Probe for Network Node Manager i (CVE-2009-3555) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by an OS Command Injection vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by Oracle MySQL vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Security Bulletin: Speech to Text, Text to Speech ICP WebSphere Application Server Liberty Fix ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-speech-to-text-text-to-sp… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 23.06.2020
by Daily end-of-shift report 23 Jun '20

23 Jun '20

===================== = End-of-Day report = ===================== Timeframe: Montag 22-06-2020 18:00 − Dienstag 23-06-2020 18:00 Handler: Dimitri Robl Co-Handler: Robert Waldner ===================== = News = ===================== ∗∗∗ Comparing Office Documents with WinMerge, (Mon, Jun 22nd) ∗∗∗ --------------------------------------------- Sometimes I have to compare the internals of Office documents (OOXML files, e.g. ZIP container with XML files, ...). Since they are ZIP containers, I have to compare the files within. I used to do this with with zipdump.py tool, but recently, I started to use WinMerge because of its graphical user interface. --------------------------------------------- https://isc.sans.edu/diary/rss/26268 ∗∗∗ HTTP Request Smuggling: Abusing Reverse Proxies ∗∗∗ --------------------------------------------- SANS Penetration Testing blog about exploiting differences between web servers and their reverse proxies --------------------------------------------- https://www.sans.org/blog/http-request-smuggling-abusing-reverse-proxies?ms… ∗∗∗ XORDDoS, Kaiji Botnet Malware Variants Target Exposed Docker Servers ∗∗∗ --------------------------------------------- We have recently detected variants of two existing Linux botnet malware types targeting exposed Docker servers; these are XORDDoS malware and Kaiji DDoS malware. While the XORDDoS attack infiltrated the Docker server to infect all the containers hosted on it, the Kaiji attack deploys its own container that will contain its DDoS malware. --------------------------------------------- https://blog.trendmicro.com/trendlabs-security-intelligence/xorddos-kaiji-b… ∗∗∗ Vorschussbetrug: Ein Opfer berichtet… ∗∗∗ --------------------------------------------- Vorschussbetrug funktioniert immer ähnlich: Ihnen wird per E-Mail mitgeteilt, dass Sie auserwählt wurden, einen sehr hohen Geldbetrag zu erhalten. Jedoch müssen Sie vorab eine Geldsumme überweisen – angeblich für Zertifikate, Spesen, die Abwicklung der Überweisung oder Ähnliches. Erst dann kann der Betrag an Sie übermittelt werden. Achtung: Den angeblichen Geldbetrag erhalten Sie nie und das vorab überwiesene Geld ist weg! --------------------------------------------- https://www.watchlist-internet.at/news/vorschussbetrug-ein-opfer-berichtet/ ===================== = Vulnerabilities = ===================== ∗∗∗ Sicherheitsupdate Bitdefender: Websites könnten Schadcode auf PCs schleusen ∗∗∗ --------------------------------------------- In einer aktualisierten Version von Bitdefender Internet Security haben die Entwickler eine Sicherheitslücke geschlossen. Das Angriffsrisiko gilt als hoch. --------------------------------------------- https://heise.de/-4792200 ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by CentOS (thunderbird), Debian (wordpress), Fedora (ca-certificates, kernel, libexif, and tomcat), openSUSE (chromium, containerd, docker, docker-runc, golang-github-docker-libnetwork, fwupd, osc, perl, php7, and xmlgraphics-batik), Oracle (unbound), Red Hat (containernetworking-plugins, dpdk, grafana, kernel, kernel-rt, kpatch-patch, libexif, microcode_ctl, ntp, pcs, and skopeo), Scientific Linux (unbound), SUSE (kernel, mariadb, mercurial, and xawtv), and Ubuntu (mutt, nfs-utils). --------------------------------------------- https://lwn.net/Articles/824264/ ∗∗∗ Atlassian Jira Software: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit den Rechten des Dienstes ∗∗∗ --------------------------------------------- Ein lokaler Angreifer kann eine Schwachstelle in Atlassian Jira Software ausnutzen, um beliebigen Programmcode mit den Rechten des Dienstes auszuführen. --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-0617 ∗∗∗ Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020 ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by a Cross-Site Scripting vulnerability ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Security Bulletin: IBM API Connect V2018 (ova) is vulnerable to denial of service (CVE-2020-8551, CVE-2020-8552) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-api-connect-v2018-ova… ∗∗∗ Security Bulletin: A Security Vulnerability Has Been Identified In IBM Security Secret Server (CVE-2020-4323) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: PowerVC is impacted by an Openstack Nova vulnerability which could leak consoleauth tokens into log files (CVE-2015-9543) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-powervc-is-impacted-by-an… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by an OS Command Injection vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Security Guardium ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by a Hard-coded passwords vulnerability ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by an Improper Restriction of Excessive Authentication Attempts vulnerability ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Security Bulletin: A Security Vulnerability Has Been Identified In IBM Security Secret Server (CVE-2020-4327) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: A Security Vulnerability Has Been Identified In IBM Security Secret Server (CVE-2020-4413) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ KLCERT-20-014: Session token exposed in Honeywell ControlEdge PLC and RTU ∗∗∗ --------------------------------------------- https://ics-cert.kaspersky.com/advisories/klcert-advisories/2020/06/23/klce… ∗∗∗ KLCERT-20-013: Unencypted password transmission in Honeywell ControlEdge PLC and RTU ∗∗∗ --------------------------------------------- https://ics-cert.kaspersky.com/advisories/klcert-advisories/2020/06/23/klce… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 22.06.2020
by Daily end-of-shift report 22 Jun '20

22 Jun '20

===================== = End-of-Day report = ===================== Timeframe: Freitag 19-06-2020 18:00 − Montag 22-06-2020 18:00 Handler: Dimitri Robl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Top 8 tips for office security when employees are working from home ∗∗∗ --------------------------------------------- Who’s minding the store? Cybersecurity has become even more high profile during the current COVID-19 pandemic. A recent warning from the UK National Cyber Security Centre and the US Department of Homeland Security talks of state-backed hackers targeting healthcare organizations. Many other examples of pandemic-focused cyberattacks have popped up since the coronavirus appeared. --------------------------------------------- https://resources.infosecinstitute.com/top-8-tips-for-office-security-when-… ∗∗∗ Web skimming with Google Analytics ∗∗∗ --------------------------------------------- Recently, we identified several cases where Google Analytics was misused: attackers injected malicious code into sites, which collected all the data entered by users, and then sent it via Analytics. --------------------------------------------- https://securelist.com/web-skimming-with-google-analytics/97414/ ∗∗∗ Pi Zero HoneyPot , (Sat, Jun 20th) ∗∗∗ --------------------------------------------- The ISC has had a Pi honeypot(1) for the last couple of years, but I haven't had much time to try it on the Pi zero. Recently, I've had a chance to try it out, and it works great. --------------------------------------------- https://isc.sans.edu/diary/rss/26260 ∗∗∗ Hijacking DLLs in Windows ∗∗∗ --------------------------------------------- DLL Hijacking is a popular technique for executing malicious payloads. This post lists nearly 300 executables vulnerable to relative path DLL Hijacking on Windows 10 (1909), and shows how with a few lines of VBScript some of the DLL hijacks can be executed with elevated privileges, bypassing UAC. --------------------------------------------- https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows ∗∗∗ Turn on MFA Before Crooks Do It For You ∗∗∗ --------------------------------------------- Hundreds of popular websites now offer some form of multi-factor authentication (MFA), which can help users safeguard access to accounts when their password is breached or stolen. But people who dont take advantage of these added safeguards may find it far more difficult to regain access when their account gets hacked, because increasingly thieves will enable multi-factor options and tie the account to a device they control. Heres the story of one such incident. --------------------------------------------- https://krebsonsecurity.com/2020/06/turn-on-mfa-before-crooks-do-it-for-you/ ∗∗∗ Achtung vor gefährlicher "BawagPSK" Phishing-SMS ∗∗∗ --------------------------------------------- BetrügerInnen senden derzeit eine SMS-Nachricht im Namen der BAWAG P.S.K. aus. Als Absender wird keine Telefonnummer, sondern „BawagPSK“ angegeben. Laut der Nachricht müssen Sie einem Link folgen, um eine Anfrage zu Ihrem mobilen Banking zu bestätigen. Folgen Sie dem Link nicht! Er führt auf eine gefälschte Website und eingegebene Daten landen direkt in den Händen der Kriminellen. --------------------------------------------- https://www.watchlist-internet.at/news/achtung-vor-gefaehrlicher-bawagpsk-p… ===================== = Vulnerabilities = ===================== ∗∗∗ Sicherheitsupdate: Firmware-Bug gefährdet XG Firewalls von Sophos ∗∗∗ --------------------------------------------- Angreifer könnten über ein Schlupfloch in Sophos XG Firewalls Schadcode in Netzwerken ausführen. --------------------------------------------- https://heise.de/-4790793 ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (lynis, mutt, neomutt, ngircd, and rails), Mageia (gnutls), Oracle (thunderbird), Red Hat (chromium-browser, gnutls, grafana, thunderbird, and unbound), Scientific Linux (thunderbird and unbound), and SUSE (bind, java-1_8_0-openjdk, kernel, libgxps, and osc). --------------------------------------------- https://lwn.net/Articles/824113/ ∗∗∗ Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Elastic Elasticsearch ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-watson-discovery-for-… ∗∗∗ Security Bulletin: OpenSSL for IBM i is affected by CVE-2020-1967 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-openssl-for-ibm-i-is-affe… ∗∗∗ Security Bulletin: Publicly disclosed vulnerabilities from Kernel affect IBM Netezza Host Management ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-publicly-disclosed-vulner… ∗∗∗ Security Bulletin: Potential vulnerability with FasterXML jackson-databind ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-potential-vulnerability-w… ∗∗∗ Security Bulletin: Multiple potential vulnerabilities in Node.js ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-potential-vulner… ∗∗∗ Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Java ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-watson-discovery-for-… ∗∗∗ Security Bulletin: Apache Commons FileUpload (Publicly disclosed vulnerability) in IBM eDiscovery Manager ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-apache-commons-fileupload… ∗∗∗ Security Bulletin: January 2020 Critical Patch Update for Java ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-january-2020-critical-pat… ∗∗∗ Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in FasterXML jackson-databind ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-watson-discovery-for-… ∗∗∗ Security Bulletin: Multiple DB2 Database Server Security Vulnerabilities Affect IBM Emptoris Strategic Supply Management Platform ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-db2-database-ser… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 19.06.2020
by Daily end-of-shift report 19 Jun '20

19 Jun '20

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 18-06-2020 18:00 − Freitag 19-06-2020 18:00 Handler: Dimitri Robl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Hackers use fake Windows error logs to hide malicious payload ∗∗∗ --------------------------------------------- Hackers have been using fake error logs to store ASCII characters disguised as hexadecimal values that decode to a malicious payload designed to prepare the ground for script-based attacks. --------------------------------------------- https://www.bleepingcomputer.com/news/security/hackers-use-fake-windows-err… ∗∗∗ IBM Maximo Asset Management servers patched against attacks ∗∗∗ --------------------------------------------- Details are hazy but the overall story is clear: if you use IBM’s Maximo Asset Management, make sure you’re patched. --------------------------------------------- https://nakedsecurity.sophos.com/2020/06/19/ibm-maximo-asset-management-ser… ∗∗∗ Sicherheitsupdate für CMS: Drupal anfällig für Remote Code Execution ∗∗∗ --------------------------------------------- Die Drupal-Entwickler haben zwei Sicherheitslücken in mehreren Versionen des Content Management Systems geschlossen. --------------------------------------------- https://heise.de/-4789539 ∗∗∗ Security: Four zero-days spotted in attacks on honeypot systems ∗∗∗ --------------------------------------------- Previously unknown attacks used against fake systems show big problems remain with industrial systems security. --------------------------------------------- https://www.zdnet.com/article/security-four-zero-day-attacks-spotted-in-att… ===================== = Vulnerabilities = ===================== ∗∗∗ BlackBerry Powered by Android Security Bulletin - June 2020 ∗∗∗ --------------------------------------------- BlackBerry has released a security update to address multiple vulnerabilities in BlackBerry powered by Android smartphones. We recommend users update to the latest available software build. --------------------------------------------- https://support.blackberry.com/kb/articleDetail?language=en_US&articleNumbe… ∗∗∗ Kritische 0day-Lücke in 79 Netgear-Router-Modellen ∗∗∗ --------------------------------------------- Über einen Fehler im eingebauten Webserver lassen sich die Geräte kapern – unter Umständen schon beim Besuch einer Webseite mit dem Exploit. --------------------------------------------- https://heise.de/-4789814 ∗∗∗ VMSA-2020-0014 ∗∗∗ --------------------------------------------- VMware Tools for macOS update addresses a denial-of-service vulnerability (CVE-2020-3972) --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2020-0014.html ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (drupal7), Fedora (dbus, kernel, microcode_ctl, mingw-glib-networking, moby-engine, and roundcubemail), Mageia (libjpeg), openSUSE (chromium and rmt-server), Oracle (kernel and microcode_ctl), Red Hat (rh-nodejs8-nodejs and thunderbird), Slackware (bind), and SUSE (adns, containerd, docker, docker-runc, golang-github-docker-libnetwork, dbus-1, fwupd, gegl, gnuplot, guile, java-1_7_1-ibm, java-1_8_0-ibm, kernel, mozilla-nspr, mozilla-nss, perl, and [...] --------------------------------------------- https://lwn.net/Articles/823736/ ∗∗∗ Security Bulletin: Multiple DB2 Database Server Security Vulnerabilities Affect IBM Emptoris Contract Management ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-db2-database-ser… ∗∗∗ Security Bulletin: Multiple vulnerabilities affects IBM Engineering Requirements Management DOORS Next ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Vulnerability identified in Apache ActiveMQ used in Cloud Pak System (CVE-2020-1941) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-identified-… ∗∗∗ Security Bulletin: Multiple DB2 Database Server Security Vulnerabilities Affect IBM Emptoris Sourcing ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-db2-database-ser… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 18.06.2020
by Daily end-of-shift report 18 Jun '20

18 Jun '20

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 17-06-2020 18:00 − Donnerstag 18-06-2020 18:00 Handler: Dimitri Robl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ FF Sandbox Escape (CVE-2020-12388) ∗∗∗ --------------------------------------------- In my previous blog post I discussed an issue with the Windows Kernel’s handling of Restricted Tokens which allowed me to escape the Chrome GPU sandbox. Originally I’d planned to use Firefox for the proof-of-concept as Firefox uses the same effective sandbox level as the Chrome GPU process for its content renderers. That means a FF content RCE would give code execution in a sandbox where you could abuse the Windows Kernel Restricted Tokens issue, [...] --------------------------------------------- https://googleprojectzero.blogspot.com/2020/06/ff-sandbox-escape-cve-2020-1… ∗∗∗ BofA Phish Gets Around DMARC, Other Email Protections ∗∗∗ --------------------------------------------- The June campaign was targeted and aimed at stealing online banking credentials. --------------------------------------------- https://threatpost.com/bofa-phish-gets-around-dmarc-other-email-protections… ∗∗∗ Broken phishing accidentally exploiting Outlook zero-day, (Thu, Jun 18th) ∗∗∗ --------------------------------------------- When we think of zero-days, what comes to mind are usually RCEs or other high-impact vulnerabilities. Zero-days, however, come in all shapes and sizes and many of them are low impact, as is the vulnerability were going to discuss today. What is interesting about it, apart from it allowing a sender of an e-mail to include/change a link in an e-mail when it is forwarded by Outlook, is that I noticed it being exploited in a low-quality phishing e-mail by what appears to be a complete accident. --------------------------------------------- https://isc.sans.edu/diary/rss/26254 ∗∗∗ Gefährliche SMS von Notify stiehlt Apple-ID ∗∗∗ --------------------------------------------- Zahlreiche Leserinnen und Leser melden der Watchlist Internet eine SMS-Nachricht im Namen von Apple. Als Absender ist keine Nummer sondern „Notify“ angegeben. Angeblich wurde das Apple-Konto gesperrt. Dem Link zur Freischaltung darf nicht gefolgt werden! Hier werden Apple-ID und Kreditkartendaten gestohlen und missbraucht. --------------------------------------------- https://www.watchlist-internet.at/news/gefaehrliche-sms-von-notify-stiehlt-… ===================== = Vulnerabilities = ===================== ∗∗∗ Cisco IP Phones Call Log Information Disclosure Vulnerability ∗∗∗ --------------------------------------------- A vulnerability in the Web Access feature of Cisco IP Phones could allow an unauthenticated, remote attacker to view sensitive information on an affected device. The vulnerability is due to improper access controls on the web-based management interface of an affected device. An attacker could exploit this vulnerability by sending malicious requests to the device, which could allow the attacker to bypass access restrictions. --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Sicherheitsupdates: Cisco Webex Meetings kann sich an Fake-Updates verschlucken ∗∗∗ --------------------------------------------- Der Netzwerkausrüster Cisco hat wichtige Sicherheitsupdates für etwa Data Center Network Manager, verschiedene Router und Webex Meetings veröffentlicht. --------------------------------------------- https://heise.de/-4787456 ∗∗∗ CPU-Sicherheitslücken bei AMD-Kombiprozessoren: BIOS-Updates kommen ∗∗∗ --------------------------------------------- AMDs Kombiprozessoren der Jahre 2016 bis 2019, also auch Ryzen-Modellen, fehlen Sicherheitschecks, um SMM-Code im RAM zu verstecken. --------------------------------------------- https://heise.de/-4788807 ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (drupal7 and python-django), Fedora (glib-networking, kernel, kernel-headers, and nghttp2), openSUSE (adns, chromium, file-roller, and libEMF), SUSE (java-1_7_1-ibm), and Ubuntu (bind9 and nss). --------------------------------------------- https://lwn.net/Articles/823461/ ∗∗∗ Synology-SA-20:14 SRM ∗∗∗ --------------------------------------------- Multiple vulnerabilities allow remote attackers to execute arbitrary code via a susceptible version of Synology Router Manager (SRM). --------------------------------------------- https://www.synology.com/en-global/support/security/Synology_SA_20_14 ∗∗∗ Drupal: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-0598 ∗∗∗ Internet Systems Consortium BIND: Mehrere Schwachstellen ermöglichen Denial of Service ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-0599 ∗∗∗ Microsoft Windows 10: Schwachstelle ermöglicht Privilegieneskalation ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-0601 ∗∗∗ Red Hat OpenShift: Schwachstelle ermöglicht Offenlegung von Informationen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-0609 ∗∗∗ Ruby on Rails: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-0604 ∗∗∗ Security Advisory - Improper Privilege Management Vulnerability in FusionShpere Product ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20200617-… ∗∗∗ Security Bulletin: IBM API Connect V2018 is vulnerable to denial of service (CVE-2020-8551, CVE-2020-8552) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-api-connect-v2018-is-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Spectrum Protect Plus (CVE-2020-4469, CVE-2020-4471, CVE-2020-4470) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM® SDK, Java™ Technology Edition affect IBM Operational Decision Manager (October 2019, January 2020 and April 2020 CPUs) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: IBM Kenexa LCMS Premier On Premise – CVE-2020-2654 (deferred from Oracle Jan 2020 CPU) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-kenexa-lcms-premier-o… ∗∗∗ Security Bulletin: IBM Kenexa LCMS Premier On Premise – IBM SDK, Java Technology Edition Quarterly CPU – Apr 2020 – Includes Oracle Apr 2020 CPU ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-kenexa-lcms-premier-o… ∗∗∗ Security Bulletin: IBM Security Privileged Identity Manager is affected by security vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-privileged-i… ∗∗∗ Security Bulletin: IBM Kenexa LCMS Premier On Premise – CVE-2019-2949 (deferred from Oracle Oct 2019 CPU) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-kenexa-lcms-premier-o… ∗∗∗ Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU for IBM MQ – Jan 2020 – Includes Oracle Jan 2020 CPU minus CVE-2020-2585, CVE-2020-2654, and CVE-2020-2590 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sdk-java-technology-e… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 17.06.2020
by Daily end-of-shift report 17 Jun '20

17 Jun '20

===================== = End-of-Day report = ===================== Timeframe: Dienstag 16-06-2020 18:00 − Mittwoch 17-06-2020 18:00 Handler: Dimitri Robl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Do cybercriminals play cyber games during quarantine? ∗∗∗ --------------------------------------------- Thanks to the coronavirus pandemic, the role of the Internet in our lives has undergone changes, including irreversible ones. We decided to take a closer look at the changes around us through the prism of information security, starting with the video game industry. --------------------------------------------- https://securelist.com/do-cybercriminals-play-cyber-games-during-quarantine… ∗∗∗ When NTP Kills Your Sandbox ∗∗∗ --------------------------------------------- If it’s common to say that “Everything is a Freaking DNS problem“, other protocols can also be the source of problems… NTP (“Network Time Protocol”) is also a good candidate! A best practice is to synchronize all your devices via NTP but also to set up the same timezone! We [...] --------------------------------------------- https://blog.rootshell.be/2020/06/17/when-ntp-kills-your-sandbox/ ∗∗∗ A Click from the Backyard | Analysis of CVE-2020-9332, a Vulnerable USB Redirection Software ∗∗∗ --------------------------------------------- [...] The vulnerability represents a new attack vector that allows attackers to create fake USB devices, fully trusted by the Windows operating system (kernel), to attack a machine in unconventional and unexpected ways. --------------------------------------------- https://labs.sentinelone.com/click-from-the-backyard-cve-2020-9332/ ∗∗∗ Ripple20 erschüttert das Internet der Dinge ∗∗∗ --------------------------------------------- Eine Reihe von teils kritischen Sicherheitslücken in einer TCP/IP-Implementierung gefährdet Geräte in Haushalten, Krankenhäusern und Industrieanlagen. --------------------------------------------- https://heise.de/-4786249 ∗∗∗ Embedded security fails in ICS ∗∗∗ --------------------------------------------- Over the last 5 years, we’ve seen an increasing use of open-source software in ICS (Industrial Control Systems) devices, with a move away from traditional RTOS (Real Time Operating System) [...] --------------------------------------------- https://www.pentestpartners.com/security-blog/embedded-security-fails-in-ic… ∗∗∗ Vorsicht bei der Wohnungssuche: Günstige Traumwohnung könnte Betrug sein! ∗∗∗ --------------------------------------------- Es ist kaum zu glauben: Zentrale Lage in der Wiener Innenstadt. Eingerichtet mit neuesten Möbeln und Geräten. 87m2 und dazu noch eine Terrasse oder einen Balkon. Das Beste daran: Die Miete beträgt nur 450 Euro monatlich, weit unter dem Durchschnitt also. Kennen Sie ähnlich verlockende Wohnungsinserate? Wenn ja, sollten Sie vorsichtig sein und sich den Anbieter oder die Anbieterin genauer ansehen, bevor Sie bei dem verlockenden Schnäppchen zusagen! --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-bei-der-wohnungssuche-guens… ===================== = Vulnerabilities = ===================== ∗∗∗ SaltStack FrameWork Vulnerabilities Affecting Cisco Products ∗∗∗ --------------------------------------------- On April 29, 2020, the Salt Open Core team notified their community regarding the following two CVE-IDs: CVE-2020-11651: Authentication Bypass Vulnerability CVE-2020-11652: Directory Traversal Vulnerability Cisco Modeling Labs Corporate Edition (CML), Cisco TelePresence IX5000 Series, and Cisco Virtual Internet Routing Lab Personal Edition (VIRL-PE) incorporate a version of SaltStack that is running the salt-master service that is affected by these vulnerabilities. --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ ICS Advisory (ICSA-20-168-01) - Treck TCP/IP Stack ∗∗∗ --------------------------------------------- CISA is aware of a public report, known as "Ripple20" that details vulnerabilities found in the Treck TCP/IP stack. CISA is issuing this advisory to provide early notice of the reported vulnerabilities and identify baseline mitigations for reducing risks to these and other cybersecurity attacks. --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-20-168-01 ∗∗∗ Linux-Kernel: ACPI-Bug hebelt Schutzmechanismen von UEFI Secure Boot aus ∗∗∗ --------------------------------------------- Ein Bug im Linux-Mainline-Kernel könnte Angreifern das Laden unsignierter Kernel-Module trotz UEFI Secure Boot ermöglichen. PoC-Code und ein Patch liegen vor. --------------------------------------------- https://heise.de/-4786877 ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (dbus and intel-ucode), CentOS (libexif), Debian (vlc), SUSE (xen), and Ubuntu (dbus, libexif, and nss). --------------------------------------------- https://lwn.net/Articles/823283/ ∗∗∗ Security Bulletin: WebSphere Application Server used in IBM WebSphere Application Server in IBM Cloud is vulnerable to a server-side request forgery vulnerability (CVE-2020-4365) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-websphere-application-ser… ∗∗∗ Security Bulletin: Security Vulnerabilities in IBM® Java SDK April 2020 CPU affect multiple IBM Continuous Engineering products based on IBM Jazz Technology ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-security-vulnerabilities-… ∗∗∗ Security Bulletin: Information disclosure vulnerability affects IBM Business Automation Workflow and IBM Business Process Manager (BPM) – CVE-2020-4532 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-information-disclosure-vu… ∗∗∗ Security Bulletin: Multiple vulnerabilities in the IBM HTTP Server and IBM WebSphere Application Server used in IBM WebSphere Application Server in IBM Cloud ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily June 2020