Daily June 2020

daily@lists.cert.at

1 participants
20 discussions

Tageszusammenfassung - 16.06.2020
by Daily end-of-shift report 16 Jun '20

16 Jun '20

===================== = End-of-Day report = ===================== Timeframe: Montag 15-06-2020 18:00 − Dienstag 16-06-2020 18:00 Handler: Dimitri Robl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ New Java STRRAT ships with .crimson ransomware module ∗∗∗ --------------------------------------------- This Java based malware installs RDPWrap, steals credentials, logs keystrokes and remote controls Windows systems. It may soon be capable to infect without Java installed. --------------------------------------------- https://www.gdatasoftware.com/blog/strrat-crimson ∗∗∗ SOHO Device Exploitation ∗∗∗ --------------------------------------------- This blog describes one such session of auditing the Netgear R7000 router, analyzing the resulting vulnerability, and the exploit development process that followed. The write-up and code for the vulnerability described in this blog post can be found in our NotQuite0DayFriday repository. --------------------------------------------- https://blog.grimm-co.com/2020/06/soho-device-exploitation.html ∗∗∗ The Curious Case of Copy & Paste – on risks of pasting arbitrary content in browsers ∗∗∗ --------------------------------------------- This writeup is a summary of my research on issues in handling copying and pasting in: browsers, popular WYSIWYG editors, and websites. --------------------------------------------- https://research.securitum.com/the-curious-case-of-copy-paste/ ∗∗∗ 19 Zero-Day Vulnerabilities Amplified by the Supply Chain ∗∗∗ --------------------------------------------- The JSOF research lab has discovered a series of zero-day vulnerabilities in a widely used low-level TCP/IP software library developed by Treck, Inc. The 19 vulnerabilities, given the name Ripple20, affect hundreds of millions of devices (or more), and include multiple remote code execution vulnerabilities. The risks inherent in this situation are high. Just a few examples: data could be stolen off of a printer, an infusion pump behavior changed, or industrial control devices could be made to [...] --------------------------------------------- https://www.jsof-tech.com/ripple20/ ∗∗∗ Fake-Trachtenshops werben auf Facebook & Instagram ∗∗∗ --------------------------------------------- Auf Facebook und Instagram sind wir umgeben von Werbung, jedoch ist nicht jede Werbeschaltung seriös. Aktuell werben die Fake-Shops marjo-trachten.com, statuskelidmode.de und linennew.com intensiv mit Facebook-Anzeigen. Wer dort bestellt hat, wird trotz Bezahlung keine oder nur minderwertige Ware bekommen! --------------------------------------------- https://www.watchlist-internet.at/news/fake-trachtenshops-werben-auf-facebo… ∗∗∗ Warning issued over hackable security cameras ∗∗∗ --------------------------------------------- The owners of the vulnerable indoor cameras are advised to unplug the devices immediately --------------------------------------------- https://www.welivesecurity.com/2020/06/15/warning-issued-hackable-security-… ===================== = Vulnerabilities = ===================== ∗∗∗ Security Bulletins Posted ∗∗∗ --------------------------------------------- Adobe has published security bulletins for Adobe Campaign Classic (APSB20-34), Adobe After Effects (APSB20-35), Adobe Illustrator (APSB20-37), Adobe Premiere Pro (APSB20-38), Adobe Premiere Rush (APSB20-39) and Adobe Audition (APSB20-40). Adobe recommends users update their product installations to the latest versions using the instructions referenced in the bulletin. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1884 ∗∗∗ Beckhoff Security Advisory 2020-002: EtherLeak in TwinCAT RT network driver ∗∗∗ --------------------------------------------- In case an network interface sends Ethernet frames with payloads smaller than the minimum frame length, memory content is disclosed within the padding. --------------------------------------------- https://download.beckhoff.com/download/document/product-security/Advisories… ∗∗∗ Root-Lücke bedroht IBM Spectrum Protect Server ∗∗∗ --------------------------------------------- Unter anderem gefährliche Sicherheitslücken in IBMs Datenbankmanagementsystem Db2 gefährden Spectrum Protect Server. --------------------------------------------- https://heise.de/-4785158 ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Fedora (galera, grafana, libjcat, libvirt, mariadb-connector-c, and perl), Gentoo (asterisk, bubblewrap, cyrus-imapd, faad2, json-c, openconnect, openjdk-bin, pcre2, PEAR-Archive_Tar, thunderbird, and tomcat), Mageia (mbedtls and scapy), openSUSE (libntlm, libupnp, prboom-plus, varnish, and xen), Oracle (libexif), Red Hat (kpatch-patch), Scientific Linux (libexif), SUSE (mariadb, nodejs6, and poppler), and Ubuntu (apport). --------------------------------------------- https://lwn.net/Articles/823199/ ∗∗∗ Synology-SA-20:13 CallStranger ∗∗∗ --------------------------------------------- A vulnerability allows remote attackers to obtain sensitive information or conduct denial-of-service attack via a susceptible version of Synology Router Manager (SRM) or Media Server. --------------------------------------------- https://www.synology.com/en-global/support/security/Synology_SA_20_13 ∗∗∗ Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-0588 ∗∗∗ Security Bulletin: Vulnerabilities addressed in IBM Cloud Pak System (CVE-2019-4521, CVE-2019-4095) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-addressed… ∗∗∗ Security Bulletin: IBM MQ is vulnerable to a denial of service attack due to an error within the Data Conversion logic. (CVE-2020-4310) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-is-vulnerable-to-a… ∗∗∗ Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU for WebSphere MQ Internet Pass-Thru – April 2020 – Includes Oracle April 2020 CPU (CVE-2020-2781) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sdk-java-technology-e… ∗∗∗ Security Bulletin: IBM MQ Appliance is affected by OpenSSL vulnerabilities (CVE-2019-1547 and CVE-2019-1563) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-appliance-is-affec… ∗∗∗ Security Bulletin: IBM MQ and MQ Appliance could allow an authenticated user cause a denial of service due to a memory leak. (CVE-2020-4267) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-and-mq-appliance-c… ∗∗∗ Security Bulletin: Security Vulnerabilities in IBM® Java SDK April 2020 CPU affect multiple IBM Continuous Engineering products based on IBM Jazz Technology ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-security-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple vulnerabilities affect IBM® SDK for Node.js™ in IBM Cloud ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: IBM MQ Appliance is affected by Network Security Services (NSS) vulnerabilities (CVE-2019-11729 and CVE-2019-11745) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-appliance-is-affec… ∗∗∗ Security Bulletin: Cross-site scripting vulnerability in IBM Cloud Pak System (CVE-2019-4098) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-cross-site-scripting-vuln… ∗∗∗ Security Bulletin: IBM MQ AMQP channels fail to block connections restricted by SSLPEER setting (CVE-2020-4320) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-amqp-channels-fail… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 15.06.2020
by Daily end-of-shift report 15 Jun '20

15 Jun '20

===================== = End-of-Day report = ===================== Timeframe: Freitag 12-06-2020 18:00 − Montag 15-06-2020 18:00 Handler: Dimitri Robl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Mirai Botnet Activity, (Sat, Jun 13th) ∗∗∗ --------------------------------------------- This past week, I noticed new activity from the Mirai botnet in my honeypot. The sample log with the IP and file associated with the first log appears to have been taken down (96.30.193.26) which appeared multiple times this week including today. However, the last two logs from today are still active which is using a Bash script to download multiple exploits targeting various device types (MIPS, ARM4-7, MPSL, x86, PPC, M68k). Something else of interest is the User-Agent: XTC and the name viktor [...] --------------------------------------------- https://isc.sans.edu/diary/rss/26234 ∗∗∗ What is the Gibberish Hack? ∗∗∗ --------------------------------------------- Discovering some random folder with numbers and letters you don’t remember on your website would make any website owner put on their detective cap. At first, you may think, “Did I leave my FTP client open and my cat ran across the keyboard?” But when you open the folder, you find a series of HTML files, each named with some kind of nonsensical phrases like “cheap-cool-hairstyles-photos.html.” If you open one of these files on the browser, you’ll likely be [...] --------------------------------------------- https://blog.sucuri.net/2020/06/gibberish-hack.html ===================== = Vulnerabilities = ===================== ∗∗∗ D-Link patcht älteren WLAN-Router DIR-865L – aber nur ein bisschen ∗∗∗ --------------------------------------------- Ein wichtiges Sicherheitsupdate für den WLAN-Router DIR865L schließt mehrere Sicherheitslücken. Eine kritische Schwachstelle bleibt aber offen. --------------------------------------------- https://heise.de/-4783566 ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (intel-microcode, libexif, mysql-connector-java, and thunderbird), Fedora (gnutls, grafana, kernel, kernel-headers, mingw-gnutls, mod_auth_openidc, NetworkManager, and pdns-recursor), Gentoo (adobe-flash, ansible, chromium, firefox, glibc, mailutils, nokogiri, readline, ssvnc, and webkit-gtk), Mageia (axel, bind, dbus, flash-player-plugin, libreoffice, networkmanager, and roundcubemail), openSUSE (java-1_8_0-openjdk, kernel, nodejs8, rubygem-bundler, [...] --------------------------------------------- https://lwn.net/Articles/823107/ ∗∗∗ Security Bulletin: Vulnerability in Apache Tomcat affects IBM Spectrum Protect Plus (CVE-2020-1938) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-apache-t… ∗∗∗ Security Bulletin: IBM Spectrum Protect Plus vulnerable to Logjam (CVE-2015-4000) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-spectrum-protect-plus… ∗∗∗ Security Bulletin: Multiple Java vulnerabilities affect IBM Spectrum Protect Plus ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-java-vulnerabili… ∗∗∗ Security Bulletin: Vulnerability in MongoDB affects IBM Spectrum Protect Plus (CVE-2019-2389) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-mongodb-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Spectrum Protect Plus (CVE-2020-4469, CVE-2020-4471, CVE-2020-4470) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM InfoSphere Information Server ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Vulnerability in Go programming language affects IBM Spectrum Protect Server (CVE-2019-16276) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-go-progr… ∗∗∗ Security Bulletin: Db2 vulnerabilities affect IBM Spectrum Protect Server (CVE-2020-4230, CVE-2020-4135, CVE-2020-4204, CVE-2020-4200) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-db2-vulnerabilities-affec… ∗∗∗ Security Bulletin: Vulnerability in IBM Java Runtime affects the IBM Spectrum Protect Server (CVE-2019-2989) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-ibm-java… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Spectrum Protect Operations Center and Client Management Service (CVE-2019-4732, CVE-2019-2989, CVE-2019-2964) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Denial of Service vulnerability in Linux Kernel affects IBM Spectrum Protect Plus (CVE-2020-12114) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-denial-of-service-vulnera… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 12.06.2020
by Daily end-of-shift report 12 Jun '20

12 Jun '20

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 10-06-2020 18:00 − Freitag 12-06-2020 18:00 Handler: Dimitri Robl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Hackers are quick to notice exposed Elasticsearch servers ∗∗∗ --------------------------------------------- Bad guys find unprotected Elasticsearch servers exposed on the web faster than search engines can index them. A study found that threat actors are mainly going for cryptocurrency mining and credential theft. --------------------------------------------- https://www.bleepingcomputer.com/news/security/hackers-are-quick-to-notice-… ∗∗∗ Intel patches chip flaw that could leak your cryptographic secrets ∗∗∗ --------------------------------------------- Intel chip features that were intended to help you do cryptography better could have leaked your inner secrets. --------------------------------------------- https://nakedsecurity.sophos.com/2020/06/12/intel-patches-chip-flaw-that-co… ∗∗∗ ConnectWise issues a slightly scary but unusually significant security advisory ∗∗∗ --------------------------------------------- Because IT service providers use ConnectWise to run your IT and this is its first-ever bug report ConnectWise isn't a vendor most Reg readers deal with directly, but the fact the company has just issued its first-ever security advisory deserves attention. --------------------------------------------- https://go.theregister.com/feed/www.theregister.com/2020/06/12/connectwise_… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by CentOS (tomcat), Debian (intel-microcode, libphp-phpmailer, mysql-connector-java, python-django, thunderbird, and xawtv), Fedora (kernel and thunderbird), Gentoo (perl), openSUSE (libexif and vim), Oracle (dotnet, kernel, microcode_ctl, and tomcat), Red Hat (net-snmp), Scientific Linux (libexif and tomcat), Slackware (kernel), and SUSE (adns, audiofile, ed, kvm, nodejs12, and xen). --------------------------------------------- https://lwn.net/Articles/822964/ ∗∗∗ Critical Vulnerabilities Expose Siemens LOGO! Controllers to Attacks ∗∗∗ --------------------------------------------- Siemens’ LOGO! programmable logic controllers (PLCs) are affected by critical vulnerabilities that can be exploited remotely to launch denial-of-service (DoS) attacks and modify the device’s configuration. --------------------------------------------- https://www.securityweek.com/critical-vulnerabilities-expose-siemens-logo-c… ∗∗∗ 6 New Vulnerabilities Found on D-Link Home Routers ∗∗∗ --------------------------------------------- Six new D-Link vulnerabilities found in D-Links DIR-865L home cloud router. Consumers should patch ASAP. --------------------------------------------- https://unit42.paloaltonetworks.com/6-new-d-link-vulnerabilities-found-on-h… ∗∗∗ Vulnerabilities in Citrix Workspace app and Receiver for Windows ∗∗∗ --------------------------------------------- Vulnerabilities have been identified in Citrix Workspace app and Receiver for Windows that could result in a local user escalating their privilege level to administrator during the uninstallation process. --------------------------------------------- https://support.citrix.com/article/CTX275460 ∗∗∗ Red Hat JBoss Application Server (JBoss): Mehrere Schwachstellen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-0580 ∗∗∗ Drupal: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-0579 ∗∗∗ WordPress: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-0583 ∗∗∗ Security Advisory - Denial of Service Vulnerability in Huawei FusionAccess Product ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20200610-… ∗∗∗ Security Advisory - FasterXML Jackson-databind Injection Vulnerability in Huawei Products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20200610-… ∗∗∗ Security Bulletin: Vulnerabilities CVE-2020-1927 and CVE-2020-1934 in Apache HTTP Server affect IBM i ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-cve-2020-… ∗∗∗ Security Bulletin: Multiple Oracle Database Server Security Vulnerabilities Affect IBM Emptoris Program Management ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-oracle-database-… ∗∗∗ Security Bulletin: IBM Workload Scheduler potentially vulnerable to cross site scripting ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-workload-scheduler-po… ∗∗∗ Security Bulletin: IBM Event Streams is affected by Apache CXF vulnerability CVE-2019-12406 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-event-streams-is-affe… ∗∗∗ Security Bulletin: Multiple Oracle Database Server Security Vulnerabilities Affect IBM Emptoris Supplier Lifecycle Mgmt ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-oracle-database-… ∗∗∗ Security Bulletin: Multiple Oracle Database Server Security Vulnerabilities Affect IBM Emptoris Contract Management ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-oracle-database-… ∗∗∗ Security Bulletin: Multiple Oracle Database Server Security Vulnerabilities Affect IBM Emptoris Strategic Supply Management Platform ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-oracle-database-… ∗∗∗ Security Bulletin: IBM Event Streams is affected by Go vulnerability CVE-2019-16276 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-event-streams-is-affe… ∗∗∗ Security Bulletin: IBM Event Streams is affected by WebSphere Liberty Profile vulnerability CVE-2019-4441 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-event-streams-is-affe… ∗∗∗ Security Bulletin: IBM Event Streams is affected by jackson-databind vulnerability CVE-2019-20330 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-event-streams-is-affe… ∗∗∗ Security Bulletin: Multiple Oracle Database Server Security Vulnerabilities Affect IBM Emptoris Supplier Lifecycle Mgmt ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-oracle-database-… ∗∗∗ Security Bulletin: IBM API Connect V5 is vulnerable to cross site scripting (XSS) (CVE-2020-4251) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-api-connect-v5-is-vul… ∗∗∗ Security Bulletin: IBM Event Streams is affected by kafka vulnerability CVE-2019-12399 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-event-streams-is-affe… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 10.06.2020
by Daily end-of-shift report 10 Jun '20

10 Jun '20

===================== = End-of-Day report = ===================== Timeframe: Dienstag 09-06-2020 18:00 − Mittwoch 10-06-2020 18:00 Handler: Dimitri Robl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Zahlreiche Beschwerden zu Kammerjaeger.pro, elektro-24.info und anderen Handwerkern ∗∗∗ --------------------------------------------- Ungeziefer zuhause? Die BetreiberInnen von der Seite Kammerjaeger.pro sollten Sie bei Problemen mit Schädlingen lieber nicht beauftragen. Denn: KonsumentInnen berichten von überhöhten Zahlungsforderungen. Nachträgliche Beschwerden sind nicht möglich, da nach der Bezahlung niemand mehr erreichbar ist. --------------------------------------------- https://www.watchlist-internet.at/news/zahlreiche-beschwerden-zu-kammerjaeg… ∗∗∗ Neue Quiz-App: Testen Sie Ihr Wissen zum Thema Internetsicherheit! ∗∗∗ --------------------------------------------- Wissen Sie was Phishing bedeutet? Erkennen Sie einen Fake-Shop? Durchschauen Sie Abo-Fallen? Testen und stärken Sie Ihr Wissen mit der neuen Quiz-App zum Thema Internetsicherheit. --------------------------------------------- https://www.watchlist-internet.at/news/neue-quiz-app-testen-sie-ihr-wissen-… ===================== = Vulnerabilities = ===================== ∗∗∗ Patchday: Microsoft lässt über 120 Sicherheitsupdates auf Windows & Co. los ∗∗∗ --------------------------------------------- Wer Betriebssysteme und Software von Microsoft nutzt, sollte sicherstellen, dass die aktuellen Updates installiert sind. --------------------------------------------- https://heise.de/-4779414 ∗∗∗ Blackberry BSRT-2020-002 Input Validation Vulnerability in Server Configuration Management Impacts BlackBerry Workspaces Server (deployed with Appliance-X) ∗∗∗ --------------------------------------------- This advisory addresses an input validation vulnerability in the server configuration management of affected versions of BlackBerry Workspaces Server (deployed with Appliance-X) that could potentially allow a successful attacker to conduct an information disclosure, tampering or denial of service attack. BlackBerry is not aware of any exploitation of this vulnerability. --------------------------------------------- http://support.blackberry.com/kb/articleDetail?language=en_US&articleNumber… ∗∗∗ Intel IPAS: Security Advisories for June 2020 ∗∗∗ --------------------------------------------- * INTEL-SA-00266 2020.1 IPU – Intel SSD Advisory * INTEL-SA-00295 2020.1 IPU – Intel CSME, SPS, TXE, AMT and DAL Advisory * INTEL-SA-00320 2020.1 IPU – Special Register Buffer Data Sampling * INTEL-SA-00322 2020.1 IPU – BIOS Advisory * INTEL-SA-00366 Intel Innovation Engine Advisory --------------------------------------------- https://blogs.intel.com/technology/2020/06/ipas-security-advisories-for-jun… ∗∗∗ SMBleed: A New Critical Vulnerability Affects Windows SMB Protocol ∗∗∗ --------------------------------------------- Cybersecurity researchers today uncovered a new critical vulnerability affecting the Server Message Block (SMB) protocol that could allow attackers to leak kernel memory remotely, and when combined with a previously disclosed "wormable" bug, the flaw can be exploited to achieve remote code execution attacks. --------------------------------------------- https://thehackernews.com/2020/06/SMBleed-smb-vulnerability.html ∗∗∗ VMSA-2020-0013 ∗∗∗ --------------------------------------------- VMware Horizon Client for Windows update addresses privilege escalation vulnerability (CVE-2020-3961) --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2020-0013.html ∗∗∗ XSA-320 ∗∗∗ --------------------------------------------- Special Register Buffer speculative side channel --------------------------------------------- https://xenbits.xen.org/xsa/advisory-320.html ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (chromium, firefox, gnutls, python-django, thunderbird, tomcat7, tomcat8, and tomcat9), CentOS (unbound), Debian (bluez, firefox-esr, kernel, and linux-4.9), Oracle (kernel), Red Hat (.NET Core, .NET Core 3.1, kernel, kernel-rt, libexif, microcode_ctl, pcs, and virt:rhel), SUSE (gnutls, java-1_7_0-ibm, kernel, microcode_ctl, nodejs10, nodejs8, rubygem-bundler, texlive, texlive-filesystem, thunderbird, and ucode-intel), and Ubuntu (intel-microcode, [...] --------------------------------------------- https://lwn.net/Articles/822719/ ∗∗∗ WAGO: PPPD in PFC100 and PFC200 Series is vulnerable to CVE-2020-8597 ∗∗∗ --------------------------------------------- WAGO PLCs pppd is vulnerable to CVE-2020-8597 in case the daemon has been activated. --------------------------------------------- https://cert.vde.com/de-de/advisories/vde-2020-020 ∗∗∗ Citrix Hypervisor Security Updates ∗∗∗ --------------------------------------------- CTX275165 NewCitrix Hypervisor Security Updates Applicable Products: Citrix_Hypervisor_8_0, Citrix_Hypervisor_8_1, XenServer_7_0, XenServer_7_1_Cumulative_Update_2 [...] A security issue has been identified in certain CPU hardware that may allow unprivileged code running on a host to observe the entropy provided by the CPU to other processes, virtual machines or the hypervisor that are, or have recently been, running, irrespective of whether they are running on the same processor core or thread. For example, if a process in one guest VM were to use the RDSEED instruction to get a random value to use as a secret encryption key, another process in a different VM might be able to observe the result of that RDSEED instruction and so determine the secret encryption key. --------------------------------------------- https://support.citrix.com/article/CTX275165 ∗∗∗ Security Advisory - Insufficient Input Verification of Some Huawei products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20200610-… ∗∗∗ Security Advisory - Improper Authorization Vulnerability in Some Huawei Smartphones ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20200610-… ∗∗∗ Security Advisory - Improper Authentication Vulnerability in Some Huawei Smartphones ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20200610-… ∗∗∗ Security Bulletin: IBM QRadar Network Packet Capture does not require that users should have strong passwords by default (CVE-2019-4576) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-qradar-network-packet… ∗∗∗ Security Bulletin: OpenSSL vulnerabilites impacting IBM Aspera Streaming for Video 3.8.0 and earlier (CVE-2019-1552) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-openssl-vulnerabilites-im… ∗∗∗ Security Bulletin: A Security Vulnerability affects IBM Cloud Private – Go (CVE-2019-16276) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: Public disclosed vulnerability from OpenSSL affect IBM Netezza Host Management ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-public-disclosed-vulnerab… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM WebSphere Cast Iron Solution & App Connect Professional ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple security vulnerabilities have been identified In Jackson Databind library shipped with IBM Global Mailbox (CVE-2019-14892, CVE-2019-14893) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnera… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Rational Developer for i and Rational Developer for AIX and Linux – January 2020 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple vulnerabilities of Mozilla Firefox (less than Firefox 68.6.0 ESR) hava affected Synthetic Playback Agent 8.1.4.0-8.1.4 IF11 + ICAM2019.3.0 – 2020.1.0 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Various vulnerabilities affecting certain Aspera applications (CVE-2020-4432, CVE-2020-4433, CVE-2020-4434, CVE-2020-4435, CVE-2020-4436) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-various-vulnerabilities-a… ∗∗∗ Dell BIOS & Computer: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-0562 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 09.06.2020
by Daily end-of-shift report 09 Jun '20

09 Jun '20

===================== = End-of-Day report = ===================== Timeframe: Montag 08-06-2020 18:00 − Dienstag 09-06-2020 18:00 Handler: Dimitri Robl Co-Handler: Robert Waldner ===================== = News = ===================== ∗∗∗ CallStranger: Große Sicherheitslücke betrifft Millionen UPnP-Geräte ∗∗∗ --------------------------------------------- Eine Schwachstelle im UPnP-Standard ermöglicht Netzwerk-Scans und DDoS-Angriffe. Bis alle Hersteller Updates bereitstellen, dürfte es lange dauern. --------------------------------------------- https://www.golem.de/news/callstranger-grosse-sicherheitsluecke-betrifft-mi… ∗∗∗ Sicherheitslücke: GnuTLS setzt Session-Keys auf null ∗∗∗ --------------------------------------------- Eine gravierende Sicherheitslücke in GnuTLS führt dazu, dass TLS-1.2-Verbindungen nachträglich entschlüsselt werden können. --------------------------------------------- https://www.golem.de/news/sicherheitsluecke-gnutls-setzt-session-keys-auf-n… ∗∗∗ Verwundbare NAS mit Photo Station: QNAP meldet neue Angriffe auf alte Lücken ∗∗∗ --------------------------------------------- Die Ransomware "eCh0raix " nutzt derzeit alte Einfallstore, um QNAP-NAS mit Photo Station anzugreifen. Updates für QTS stehen seit letztem Jahr bereit. --------------------------------------------- https://heise.de/-4778457 ∗∗∗ So erkennen Sie betrügerische KäuferInnen auf willhaben, shpock und Co ∗∗∗ --------------------------------------------- Der Verkauf gebrauchter Gegenstände über shpock, willhaben, ebay und Co verläuft in der Regel unkompliziert und problemlos, es sei denn, Sie geraten an unseriöse KäuferInnen. Behaupten KäuferInnen, dass sie den Betrag inklusive einer Versicherungsgebühr bei DHL oder einem anderen Versandunternehmen hinterlegt haben, dann handelt es sich um Betrug. Brechen Sie den Kontakt ab und ignorieren weitere E-Mails. --------------------------------------------- https://www.watchlist-internet.at/news/so-erkennen-sie-betruegerische-kaeuf… ===================== = Vulnerabilities = ===================== ∗∗∗ Adobe: Security Bulletins Posted ∗∗∗ --------------------------------------------- Adobe has published security bulletins for Adobe Flash Player (APSB20-30), Adobe Experience Manager (APSB20-31) and Adobe Framemaker (APSB20-32). Adobe recommends users update their product installations to the latest versions using the instructions referenced in the bulletin. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1882 ∗∗∗ [Security-announce] VMSA-2020-0012 - VMware ESXi, Workstation and Fusion updates address out-of-bounds read vulnerability (CVE-2020-3960) ∗∗∗ --------------------------------------------- Impacted Products: * VMware vSphere ESXi (ESXi) * VMware Workstation Pro / Player (Workstation) * VMware Fusion Pro / Fusion (Fusion) --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2020-0012.html ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (libpam-tacplus), Gentoo (gnutls), Oracle (unbound), Scientific Linux (freerdp and unbound), and SUSE (firefox, java-11-openjdk, java-1_7_0-openjdk, java-1_8_0-openjdk, nodejs10, and ruby2.1). --------------------------------------------- https://lwn.net/Articles/822588/ ∗∗∗ Citrix Systems Workspace App: Mehrere Schwachstellen ermöglichen Privilegieneskalation ∗∗∗ --------------------------------------------- Die Citrix Workspace App ist eine Client Software, die es ermöglicht von zahlreichen Geräten wie Smartphones, Tablets und PCs auf Dokumente, Applikationen und Desktops zuzugreifen. Ein lokaler Angreifer kann mehrere Schwachstellen in Citrix Systems Workspace App ausnutzen, um seine Privilegien zu erhöhen. --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-0549 ∗∗∗ SAP Patchday Juni 2020 ∗∗∗ --------------------------------------------- Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in SAP Produkten und Anwendungskomponenten ausnutzen, um die Vertraulichkeit, Verfügbarkeit und die Integrität der Anwendungen zu gefährden. --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-0555 ∗∗∗ Siemens SSA-817401: Missing Authentication Vulnerability in SIEMENS LOGO! ∗∗∗ --------------------------------------------- https://cert-portal.siemens.com/productcert/txt/ssa-817401.txt ∗∗∗ Siemens SSA-927095: UltraVNC Vulnerabilities in SINUMERIK Products ∗∗∗ --------------------------------------------- https://cert-portal.siemens.com/productcert/txt/ssa-927095.txt ∗∗∗ Siemens SSA-352504: Urgent/11 TCP/IP Stack Vulnerabilities in Siemens Power Meters ∗∗∗ --------------------------------------------- https://cert-portal.siemens.com/productcert/txt/ssa-352504.txt ∗∗∗ Siemens SSA-462066: Vulnerability known as TCP SACK PANIC in Industrial Products ∗∗∗ --------------------------------------------- https://cert-portal.siemens.com/productcert/txt/ssa-462066.txt ∗∗∗ Siemens SSA-480230: Denial-of-Service in Webserver of Industrial Products ∗∗∗ --------------------------------------------- https://cert-portal.siemens.com/productcert/txt/ssa-480230.txt ∗∗∗ Siemens SSA-689942: Denial-of-Service and DLL Hijacking Vulnerabilities in Multiple SIMATIC Software Products ∗∗∗ --------------------------------------------- https://cert-portal.siemens.com/productcert/txt/ssa-689942.txt ∗∗∗ Siemens SSA-312271: Unquoted Search Path Vulnerabilities in Windows-based Industrial Software Applications ∗∗∗ --------------------------------------------- https://cert-portal.siemens.com/productcert/txt/ssa-312271.txt ∗∗∗ Security Bulletin: Vulnerability in Dojo Toolkit affecting Watson Knowledge Catalog for IBM Cloud Pak for Data ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-dojo-too… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 08.06.2020
by Daily end-of-shift report 08 Jun '20

08 Jun '20

===================== = End-of-Day report = ===================== Timeframe: Freitag 05-06-2020 18:00 − Montag 08-06-2020 18:00 Handler: Dimitri Robl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Fake ransomware decryptor double-encrypts desperate victims files ∗∗∗ --------------------------------------------- A fake decryptor for the STOP Djvu Ransomware is being distributed that lures already desperate people with the promise of free decryption. Instead of getting their files back for free, they are infected with another ransomware that makes their situation even worse. --------------------------------------------- https://www.bleepingcomputer.com/news/security/fake-ransomware-decryptor-do… ∗∗∗ SMBGhost: Code für Windows-Exploit veröffentlicht ∗∗∗ --------------------------------------------- Auf Github ist nutzbarer Code für eine Sicherheitslücke im SMBv3-Protokoll veröffentlicht worden. Verwundbare Systeme sollten dringend gepatcht werden. --------------------------------------------- https://www.golem.de/news/smbghost-code-fuer-windows-exploit-veroeffentlich… ∗∗∗ Evasion Tactics in Hybrid Credit Card Skimmers ∗∗∗ --------------------------------------------- The most common type of Magento credit card stealing malware is client-side JavaScript that grabs data entered in a checkout form and sends it to a third-party server controlled by the attackers. Though popular with bad actors, one of the drawbacks of this approach is that it’s possible to track requests to suspicious servers if you monitor the traffic generated by checkout pages — or any other infected pages. A lesser-known, but still very popular, type of skimmer can instead be [...] --------------------------------------------- https://blog.sucuri.net/2020/06/evasion-tactics-in-hybrid-credit-card-skimm… ∗∗∗ Abo-Falle statt Gebrauchsanweisung auf anleitungenfinden.com ∗∗∗ --------------------------------------------- Sind Sie gerade auf der Suche nach einer Gebrauchsanweisung für Ihr Smartphone, Ihren Fernseher, ein Haushaltsgerät oder ähnliches? Dann nehmen Sie sich vor der Website anleitungefinden.com in Acht. Für den Betrag von 0,95 Euro sollen Sie die gewünschte Anleitung für Ihr Gerät erhalten. Tatsächlich schließen Sie damit aber ein verstecktes Abonnement über 49,95 Euro monatlich ab, das automatisch von Ihrer Kreditkarte abgebucht wird. --------------------------------------------- https://www.watchlist-internet.at/news/abo-falle-statt-gebrauchsanweisung-a… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (cups, dbus, gnutls28, graphicsmagick, libupnp, and nodejs), Fedora (gnutls, kernel, libarchive, php-phpmailer6, and sympa), openSUSE (axel, GraphicsMagick, libcroco, libreoffice, libxml2, and xawtv), Oracle (bind, firefox, freerdp, and kernel), Red Hat (bind, freerdp, and unbound), Scientific Linux (firefox), SUSE (dpdk, file-roller, firefox, gnuplot, libexif, php7, php72, slurm_20_02, and vim), and Ubuntu (gnutls28). --------------------------------------------- https://lwn.net/Articles/822512/ ∗∗∗ Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU – Apr 2020 – Includes Oracle Apr 2020 CPU minus CVE-2020-2773 affects Liberty for Java for IBM Cloud ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sdk-java-technology-e… ∗∗∗ Security Bulletin: IBM Maximo Asset Management is vulnerable to server side request forgery (SSRF) (CVE-2020-4529) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-maximo-asset-manageme… ∗∗∗ Security Bulletin: There is an information disclosure vulnerability in Liberty for Java (CVE-2020-4329) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-there-is-an-information-d… ∗∗∗ Security Bulletin: Potential spoofing attack in Liberty for Java (CVE-2020-4421) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-potential-spoofing-attack… ∗∗∗ Security Bulletin: CVE-2019-2949 may affect IBM® SDK, Java™ Technology Edition used in Liberty for Java ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-cve-2019-2949-may-affect-… ∗∗∗ Red Hat OpenShift Application Runtimes: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-0543 ∗∗∗ Red Hat Enterprise Linux: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-0542 ∗∗∗ Node.js: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-0544 ∗∗∗ ffmpeg: Schwachstelle ermöglicht nicht spezifizierten Angriff ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-0548 ∗∗∗ Perl: Mehrere Schwachstellen ermöglichen Ausführen von beliebigem Programmcode mit den Rechten des Dienstes ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-0546 ∗∗∗ ImageMagick: Schwachstelle ermöglicht nicht spezifizierten Angriff ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-0545 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 05.06.2020
by Daily end-of-shift report 05 Jun '20

05 Jun '20

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 04-06-2020 18:00 − Freitag 05-06-2020 18:00 Handler: Thomas Pribitzer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Ongoing eCh0raix ransomware campaign targets QNAP NAS devices ∗∗∗ --------------------------------------------- After remaining relatively quiet over the past few months, the threat actors behind the eCh0raix Ransomware have launched a brand new campaign targeting QNAP storage devices. --------------------------------------------- https://www.bleepingcomputer.com/news/security/ongoing-ech0raix-ransomware-… ∗∗∗ Understanding the Payload-Less Email Attacks Evading Your Security Team ∗∗∗ --------------------------------------------- Business email compromise (BEC) attacks represent a small percentage of email attacks, but disproportionately represent the greatest financial risk. --------------------------------------------- https://threatpost.com/understanding-payload-less-email-attacks/156299/ ∗∗∗ Botnet blasts WordPress sites with configuration download attacks ∗∗∗ --------------------------------------------- A million sites attacked by 20,000 different computers. --------------------------------------------- https://nakedsecurity.sophos.com/2020/06/05/botnet-blasts-wordpress-sites-w… ∗∗∗ Not so FastCGI!, (Fri, Jun 5th) ∗∗∗ --------------------------------------------- This past month, we've seen some new and different scans targeting tcp ports between 8000 and 10,000. The first occurrence was on 30 April 2020 and originated from ip address 23.95.67.187 and containing payload: [...] --------------------------------------------- https://isc.sans.edu/diary/rss/26208 ∗∗∗ IBM Releases Open Source Toolkits for Processing Data While Encrypted ∗∗∗ --------------------------------------------- IBM this week announced the availability of open source toolkits that allow for data to be processed while it’s still encrypted. --------------------------------------------- https://www.securityweek.com/ibm-releases-open-source-toolkits-processing-d… ∗∗∗ Achtung: Gewinn24.de fordert hohe Geldsummen am Telefon ∗∗∗ --------------------------------------------- „Guten Tag, Inkassobüro XY spricht. Sie haben einen Abo-Vertrag mit Gewinn24 abgeschlossen und sind mit Ihrer Zahlung im Rückstand“. So oder so ähnlich beginnen BetrügerInnen, die im Auftrag von Gewinn24.de anrufen, das Telefongespräch. Ein vermeintliches Inkassobüro erklärt am Telefon, dass die Kosten für ein Abo mit Gewinn24.de nicht bezahlt wurden. Die Opfer wissen jedoch selten von so einem Abo. Das ist auch nicht verwunderlich: [...] --------------------------------------------- https://www.watchlist-internet.at/news/achtung-gewinn24de-fordert-hohe-geld… ∗∗∗ New Sandbox Evasions spot in VBS samples ∗∗∗ --------------------------------------------- While hidden Macro 4.0 samples are on the rise, we recently spotted some very interesting evasive VBS samples. In this short blog post, we will look at sample files#_56117.vbs, MD5: 147091e61ec59f67ab598d26f15ad0e7 and outline some of the evasive tricks. --------------------------------------------- http://blog.joesecurity.org/2020/06/new-evasive-vbs-samples-spot.html ∗∗∗ Ransomware nimmt Windows- und Linux-Systeme mit neuartigem Angriff ins Visier ∗∗∗ --------------------------------------------- Die Hintermänner programmieren die Erpressersoftware in Java. Die Verteilung erfolgt über eine Java-Image-Datei. Sicherheitsforschern zufolge hilft das Vorgehen bei der Verschleierung der Aktivitäten der Malware. --------------------------------------------- https://www.zdnet.de/88380548/ransomware-nimmt-windows-und-linux-systeme-mi… ===================== = Vulnerabilities = ===================== ∗∗∗ Security: Sicherheitslücken betreffen praktisch alle Qnap-NAS-Systeme ∗∗∗ --------------------------------------------- Gleich drei Security-Probleme sind von Qnap gemeldet worden. Das Unternehmen rät zu einem sofortigen Update des Betriebssystems. --------------------------------------------- https://www.golem.de/news/security-sicherheitsluecken-betreffen-praktisch-a… ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by CentOS (bind, firefox, and freerdp), Debian (netqmail and python-django), Fedora (cacti, cacti-spine, dbus, firefox, gjs, mbedtls, mozjs68, and perl), Oracle (freerdp and kernel), Scientific Linux (bind and firefox), Slackware (mozilla), SUSE (krb5-appl, libcroco, libexif, libreoffice, libxml2, qemu, transfig, and vim), and Ubuntu (firefox, freerdp, and python-django). --------------------------------------------- https://lwn.net/Articles/822342/ ∗∗∗ Security Bulletin: WebSphere Application Server is vulnerable to an information exposure vulnerability (CVE-2020-4449) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-websphere-application-ser… ∗∗∗ Security Bulletin: Session is not invalidated After Logout ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-session-is-not-invalidate… ∗∗∗ Security Bulletin: Remote code execution vulnerability in WebSphere Application Server ND (CVE-2020-4448) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-remote-code-execution-vul… ∗∗∗ Security Bulletin: IBM Integrated Management Module II (IMM2) is affected by multiple vulnerabilities in libssh2 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-integrated-management… ∗∗∗ Security Bulletin: Vulnerability in Apache CXF affects WebSphere Application Server that is installed with IBM SPSS Analytic Server (CVE-2019-12406) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-apache-c… ∗∗∗ Security Bulletin: WebSphere Application Server is vulnerable to a remote code execution vulnerability (CVE-2020-4450) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-websphere-application-ser… ∗∗∗ Security Bulletin: IBM Integrated Management Module II (IMM2) is affected by a vulnerability in libssh2 (CVE-2016-0787) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-integrated-management… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 04.06.2020
by Daily end-of-shift report 04 Jun '20

04 Jun '20

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 03-06-2020 18:00 − Donnerstag 04-06-2020 18:00 Handler: Thomas Pribitzer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Sophisticated Info-Stealer Targets Air-Gapped Devices via USB ∗∗∗ --------------------------------------------- The newly discovered USBCulprit malware is part of the arsenal of an APT known as Cycldek, which targets government entities. --------------------------------------------- https://threatpost.com/info-stealer-air-gapped-devices-usb/156262/ ∗∗∗ AddTrust: Auswirkungen auf E-Mail-Dienste durch abgelaufenes Zertifkat ∗∗∗ --------------------------------------------- Obwohl das abgelaufene AddTrust-Zwischenzertifikat in erster Linie alte Clients betrifft, kann es durchaus Auswirkungen auf den regulären E-Mail-Betrieb haben. --------------------------------------------- https://heise.de/-4774588 ∗∗∗ Bekannte stecken coronabedingt im Ausland und brauchen Geld? ∗∗∗ --------------------------------------------- Kriminelle nützen gehackte E-Mail-Accounts, übernommene Facebook-Konten und Ähnliches, um ihren Opfern Geld aus der Tasche zu ziehen. So kann es passieren, dass Sie scheinbar von einer guten Freundin oder einem guten Freund eine Nachricht bekommen. Diese säßen im Ausland fest und könnten wegen Covid-19 nicht zurück nach Hause kommen. Um ihnen zu helfen, sollen Sie ihnen Geld per Bargeldtransferdienst schicken. Vorsicht: es handelt sich um einen Betrugsversuch! --------------------------------------------- https://www.watchlist-internet.at/news/bekannte-stecken-coronabedingt-im-au… ===================== = Vulnerabilities = ===================== ∗∗∗ Updates für IOS, NX-OS und Co. – Cisco flickt seine Netzwerkbetriebssysteme ∗∗∗ --------------------------------------------- Ein ganzes Bündel frisch veröffentlichter Updates behebt zahlreiche Sicherheitsprobleme, von denen viele als "High" bis "Critical" eingestuft wurden. --------------------------------------------- https://heise.de/-4774667 ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (firefox-esr), Fedora (firefox and prboom-plus), Oracle (bind), Red Hat (firefox), and SUSE (osc). --------------------------------------------- https://lwn.net/Articles/822220/ ∗∗∗ MISP 2.4.126 released (Spring release edition) ∗∗∗ --------------------------------------------- [...] This version includes a security fix and various quality of life improvements.Security fix - fixed XSSFixed a persistent XSS (CVE-2020-13153) that could be triggered by correlating an attribute via the freetext import tool with an attribute that contains a javascript payload in the comment field. --------------------------------------------- https://www.misp-project.org/2020/06/04/MISP.2.4.126.released.html ∗∗∗ HPESBHF04005 rev.1 - HPE Edgeline EL300 Converged Edge System Running HPE Integrated System Manager (iSM), Remote Denial of Service ∗∗∗ --------------------------------------------- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_n… ∗∗∗ GnuTLS: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-0532 ∗∗∗ Services - Moderately critical - Access bypass - SA-CONTRIB-2020-022 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2020-022 ∗∗∗ Security Bulletin: IBM QRadar is vulnerable to an XML External Entity Injection (XXE) attack (CVE-2020-4509) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-qradar-is-vulnerable-… ∗∗∗ Security Bulletin: Vulnerability in IBM Java Runtime affect Financial Transaction Manager for Corporate Payment Services v2.1.1 (CVE-2020-2654) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-ibm-java… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by an OS Command Injection vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by an Improper Restriction of Excessive Authentication Attempts vulnerability ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Security Bulletin: A vulnerability in Python affects IBM Cloud App Management (CVE-2020-8492) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-python… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by a kernel vulnerability ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Security Bulletin: A vulnerability in Apache CXF affects IBM Cloud App Management (CVE-2019-12406) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-apache… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by a Use of a Broken or Risky Cryptographic Algorithm vulnerability ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Security Bulletin: Three vulnerabilities in Nimbus JOSE+JWT affect IBM Spectrum Conductor ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-three-vulnerabilities-in-… ∗∗∗ Cayin Digital Signage System xPost 2.5 Pre-Auth SQLi Remote Code Execution ∗∗∗ --------------------------------------------- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5571.php ∗∗∗ Cayin Content Management Server 11.0 Root Remote Command Injection ∗∗∗ --------------------------------------------- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5570.php ∗∗∗ Cayin Signage Media Player 3.0 Root Remote Command Injection ∗∗∗ --------------------------------------------- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5569.php -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 03.06.2020
by Daily end-of-shift report 03 Jun '20

03 Jun '20

===================== = End-of-Day report = ===================== Timeframe: Dienstag 02-06-2020 18:00 − Mittwoch 03-06-2020 18:00 Handler: Thomas Pribitzer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Mukashi malware: What it is, how it works and how to prevent it | Malware spotlight ∗∗∗ --------------------------------------------- Learning from the past can be an important part of future success in any endeavor, including cyberattacks. Attack groups observe this concept and apply it when they create new attack campaigns before they are released into the wild. Mukashi is an example of a malware that uses what has worked well for attackers in [...] --------------------------------------------- https://resources.infosecinstitute.com/mukashi-malware-what-it-is-how-it-wo… ∗∗∗ System Takeover Through New SAP ASE Vulnerabilities ∗∗∗ --------------------------------------------- Organizations often store their most critical data in databases, which, in turn, are often necessarily exposed in untrusted or publicly exposed environments. This makes vulnerabilities like these essential to address and test quickly since they not only threaten the data in the database but potentially the full host that it is running on. --------------------------------------------- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/system-take… ∗∗∗ Jetzt patchen! Weltweit immer noch mehr als 1 Millionen Exim-Server attackierbar ∗∗∗ --------------------------------------------- Die National Security Agency (NSA) warnt vor Attacken auf Exim-Mailserver. Sicherheitsupdates sind schon länger verfügbar. --------------------------------------------- https://heise.de/-4772712 ∗∗∗ Large Scale Attack Campaign Targets Database Credentials ∗∗∗ --------------------------------------------- Between May 29 and May 31, 2020, the Wordfence Firewall blocked over 130 million attacks intended to harvest database credentials from 1.3 million sites by downloading their configuration files. The peak of this attack campaign occurred on May 30, 2020. At this point, attacks from this campaign accounted for 75% of all attempted exploits of [...] --------------------------------------------- https://www.wordfence.com/blog/2020/06/large-scale-attack-campaign-targets-… ∗∗∗ Zahlreiche China-Shops werben auf Facebook mit günstiger Damenmode ∗∗∗ --------------------------------------------- Das Unternehmen „Chicv International Holding Limited“ ist schon länger bekannt, da es für zahlreiche Online-Shops verantwortlich ist. Laut Erfahrungsberichten von KonsumentInnen treffen die bestellten Produkte von diesen Shops – wenn überhaupt – sehr spät ein. Sind die Waren schließlich angekommen, zeigt sich schnell, dass diese nichts mit den Bildern und Beschreibungen im Online-Shop zu tun haben. --------------------------------------------- https://www.watchlist-internet.at/news/zahlreiche-china-shops-werben-auf-fa… ∗∗∗ Sophos Web Appliance: Certificate validation failed for sites signed by Sectigo root CA ∗∗∗ --------------------------------------------- Websites that are signed by Sectigo root CA may fail to connect and a certificate validation failed due to certificate AddTrust External CA Root expired on May 30th 2020. --------------------------------------------- https://community.sophos.com/kb/en-US/135544 ===================== = Vulnerabilities = ===================== ∗∗∗ Sicherheitsupdates: Firefox und Tor Browser könnten private Schlüssel leaken ∗∗∗ --------------------------------------------- Mehrere Sicherheitslücken in den Webbrowsern Firefox, Firefox ESR und Tor Browser gefährden Computer. --------------------------------------------- https://heise.de/-4772615 ∗∗∗ Vulnerability Spotlight: Two vulnerabilities in Zoom could lead to code execution ∗∗∗ --------------------------------------------- Cisco Talos recently discovered two vulnerabilities in the popular Zoom video chatting application that could allow a malicious user to execute arbitrary code on victims’ machines. --------------------------------------------- https://blog.talosintelligence.com/2020/06/vuln-spotlight-zoom-code-executi… ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Fedora (java-11-openjdk, perl-Email-MIME, perl-Email-MIME-ContentType, and slurm), openSUSE (imapfilter, mailman, and python-rpyc), Red Hat (bind and firefox), SUSE (evolution-data-server, python, qemu, and w3m), and Ubuntu (python-django). --------------------------------------------- https://lwn.net/Articles/822136/ ∗∗∗ Security Advisory - Memory Leak Vulnerability in Some Huawei Products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20200603-… ∗∗∗ Security Advisory - Improper Handling of Exceptional Condition Vulnerability in Huawei Smartphones ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20200603-… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by a Cross-Site Scripting vulnerability ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by Use of Hard-Coded Credentials vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by an Improper Access Control vulnerability ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Rational Directory Server (Tivoli) & Rational Directory Administrator. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Security Guardium ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by a Hard-coded passwords vulnerability ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by an OS Command Injection vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Security Bulletin: WebSphere Application Server Liberty is vulnerable to Cross-site Scripting (CVE-2020-4303, CVE-2020-4304) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-websphere-application-ser… ∗∗∗ Security Bulletin: The vanruability (net.sf.ehcache blocking in FasterXML jackson-databind has an unknown impact) found Network Performance Insight (CVE-2019-17571) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-the-vanruability-net-sf-e… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by Oracle MySQL vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ June 2, 2020 TNS-2020-04 [R1] Nessus Network Monitor 5.11.1 Fixes One Third-party Vulnerability ∗∗∗ --------------------------------------------- http://www.tenable.com/security/tns-2020-04 ∗∗∗ docker: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-0524 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 02.06.2020
by Daily end-of-shift report 02 Jun '20

02 Jun '20

===================== = End-of-Day report = ===================== Timeframe: Freitag 29-05-2020 18:00 − Dienstag 02-06-2020 18:00 Handler: Thomas Pribitzer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Critical Exim bugs being patched but many servers still at risk ∗∗∗ --------------------------------------------- Patching Exim mail servers is not going fast enough and members of the Russian hacker group Sandworm are actively exploiting three critical vulnerabilities that allow executing remote command or code remotely. --------------------------------------------- https://www.bleepingcomputer.com/news/security/critical-exim-bugs-being-pat… ∗∗∗ How to scan email headers for phishing and malicious content ∗∗∗ --------------------------------------------- Phishing emails are one of the most common attack vectors used by cybercriminals. They can be used to deliver a malicious payload or steal user credentials from their target. Spearphishing emails are designed to be more specifically targeted and more believable to their intended victims. By crafting a pretext that is extremely personal to [...] --------------------------------------------- https://resources.infosecinstitute.com/how-to-scan-email-headers-for-phishi… ∗∗∗ In-depth analysis of the new Team9 malware family ∗∗∗ --------------------------------------------- Publicly discovered in late April 2020, the Team9 malware family (also known as ‘Bazar [1]’) appears to be a new malware being developed by the group behind Trickbot. Even though the development of the malware appears to be recent, [...] --------------------------------------------- https://blog.fox-it.com/2020/06/02/in-depth-analysis-of-the-new-team9-malwa… ∗∗∗ Apple schließt kritische Lücke in Anmeldedienst "Sign in with Apple" ∗∗∗ --------------------------------------------- In Apples bequemem Anmeldedienst klaffte eine kritische Sicherheitslücke, mit der sich beliebige Nutzerkonten übernehmen ließen. Sie ist inzwischen geschlossen. --------------------------------------------- https://heise.de/-4770560 ∗∗∗ How I tricked Symantec with a Fake Private Key ∗∗∗ --------------------------------------------- Lately, some attention was drawn to a widespread problem with TLS certificates. Many people are accidentally publishing their private keys. Sometimes they are released as part of applications, in Github repositories or with common filenames on web servers. If a private key is compromised, a certificate authority is obliged to revoke it. The Baseline Requirements – a set of rules that browsers and certificate authorities agreed upon – regulate this and say that in such a case a [...] --------------------------------------------- https://blog.hboeck.de:443/archives/888-How-I-tricked-Symantec-with-a-Fake-… ===================== = Vulnerabilities = ===================== ∗∗∗ Multiple Cisco UCS-Based Products UEFI Secure Boot Bypass Vulnerability ∗∗∗ --------------------------------------------- A vulnerability in the firmware of the Cisco UCS C-Series Rack Servers could allow an authenticated, physical attacker to bypass Unified Extensible Firmware Interface (UEFI) Secure Boot validation checks and load a compromised software image on an affected device. --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco NX-OS Software Unexpected IP in IP Packet Processing Vulnerability ∗∗∗ --------------------------------------------- A vulnerability in the network stack of Cisco NX-OS Software could allow an unauthenticated, remote attacker to bypass certain security boundaries or cause a denial of service (DoS) condition on an affected device.The vulnerability is due to the affected device unexpectedly decapsulating and processing IP in IP packets that are destined to a locally configured IP address. An attacker could exploit this vulnerability by sending a crafted IP in IP packet to an affected device. --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (ant, bind, freerdp, and unbound), CentOS (bind, freerdp, and git), Debian (python-httplib2), Fedora (ant, kernel, sqlite, and sympa), openSUSE (java-11-openjdk and qemu), Oracle (bind), Red Hat (freerdp), Scientific Linux (python-pip and python-virtualenv), Slackware (firefox), SUSE (qemu), and Ubuntu (Apache Ant, ca-certificates, flask, and freerdp2). --------------------------------------------- https://lwn.net/Articles/822036/ ∗∗∗ VMware Cloud Director Vulnerability Has Major Impact for Cloud Providers ∗∗∗ --------------------------------------------- A recently patched vulnerability affecting VMware Cloud Director has a major impact for cloud services providers as it can allow an attacker to take full control of all private clouds hosted on the same infrastructure, cybersecurity firm Citadelo revealed on Monday. --------------------------------------------- https://www.securityweek.com/vmware-cloud-director-vulnerability-has-major-… ∗∗∗ Androids June 2020 Patches Fix Critical RCE Vulnerabilities ∗∗∗ --------------------------------------------- Google has started rolling out the June 2020 security patches for the Android operating system, which address a total of 43 vulnerabilities, including several rated critical. --------------------------------------------- https://www.securityweek.com/androids-june-2020-patches-fix-critical-rce-vu… ∗∗∗ [20200604] - Core - XSS in jQuery.htmlPrefilter ∗∗∗ --------------------------------------------- https://developer.joomla.org:443/security-centre/816-20200604-core-xss-in-j… ∗∗∗ [20200603] - Core - XSS in com_modules tag options ∗∗∗ --------------------------------------------- https://developer.joomla.org:443/security-centre/815-20200603-core-xss-in-c… ∗∗∗ [20200605] - Core - CSRF in com_postinstall ∗∗∗ --------------------------------------------- https://developer.joomla.org:443/security-centre/817-20200605-core-csrf-in-… ∗∗∗ [20200602] - Core - Inconsistent default textfilter settings ∗∗∗ --------------------------------------------- https://developer.joomla.org:443/security-centre/814-20200602-core-inconsis… ∗∗∗ [20200601] - Core - XSS in modules heading tag option ∗∗∗ --------------------------------------------- https://developer.joomla.org:443/security-centre/813-20200601-core-xss-in-m… ∗∗∗ Security Bulletin: A vulnerability in IBM Java Runtime affects IBM Spectrum Conductor and IBM Spectrum Conductor with Spark ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-ibm-ja… ∗∗∗ Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to security vulnerabilities. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-has-announced-a-relea… ∗∗∗ Security Bulletin: CVE-2019-4667 Lack of Built in HSTS option ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-cve-2019-4667-lack-of-bui… ∗∗∗ Security Bulletin: Vulnerabilities in Open Source Python affects IBM Tivoli Application Dependency Discovery Manager (CVE-2019-18348) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-open-s… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Spectrum Conductor and IBM Spectrum Conductor with Spark ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to security vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-has-announced-a-relea… ∗∗∗ Security Bulletin: Vulnerability in Apache CXF affects WebSphere Application Server (CVE-2019-12406) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-apache-c… ∗∗∗ Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU – Jan 2020 – Includes Oracle Jan 2020 CPU minus CVE-2020-2585, CVE-2020-2654, and CVE-2020-2590 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sdk-java-technology-e… ∗∗∗ Security Bulletin: CVE-2020-2654 may affect IBM® SDK, Java™ Technology Edition ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-cve-2020-2654-may-affect-… ∗∗∗ Security Bulletin: WebSphere liberty is vulnerable to a DOS (CVE-2019-4720) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-websphere-liberty-is-vuln… ∗∗∗ Security Bulletin: Vulnerability in Apache CXF affects WebSphere Application Server Liberty (CVE-2019-12406) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-apache-c… ∗∗∗ Security Bulletin: IBM Planning Analytics Workspace is affected by security vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-planning-analytics-wo… ∗∗∗ NTP vulnerability CVE-2020-11868 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K44305703?utm_source=f5support&utm_mediu… ∗∗∗ PEPPERL+FUCHS, PACTware: Two password vulnerabilities found ∗∗∗ --------------------------------------------- https://cert.vde.com/de-de/advisories/vde-2020-017 ∗∗∗ PHOENIX CONTACT FL MGUARD, TC MGUARD, TC ROUTER and TC CLOUD CLIENT: PPPD vulnerable to CVE-2020-8597 ∗∗∗ --------------------------------------------- https://cert.vde.com/de-de/advisories/vde-2020-018 ∗∗∗ Red Hat OpenShift Application Runtimes: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-0516 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily June 2020