Daily December 2022

daily@lists.cert.at

1 participants
20 discussions

Tageszusammenfassung - 15.12.2022
by Daily end-of-shift report 15 Dec '22

15 Dec '22

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 14-12-2022 18:00 − Donnerstag 15-12-2022 18:00 Handler: Robert Waldner Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ LEGO BrickLink bugs let hackers hijack accounts, breach servers ∗∗∗ --------------------------------------------- Security analysts have discovered two API security vulnerabilities in BrickLink.com, LEGO Groups official second-hand and vintage marketplace for LEGO bricks. --------------------------------------------- https://www.bleepingcomputer.com/news/security/lego-bricklink-bugs-let-hack… ∗∗∗ Hacking Using SVG Files to Smuggle QBot Malware onto Windows Systems ∗∗∗ --------------------------------------------- Phishing campaigns involving the Qakbot malware are using Scalable Vector Graphics (SVG) images embedded in HTML email attachments. --------------------------------------------- https://thehackernews.com/2022/12/hacking-using-svg-files-to-smuggle-qbot.h… ∗∗∗ Technical Review: A Deep Analysis of the Dirty Pipe Vulnerability ∗∗∗ --------------------------------------------- Dirty Pipe (CVE-2022-0847) proved that there is a new way to exploit Linux syscalls to write to files with a read-only privileges. --------------------------------------------- https://blog.aquasec.com/deep-analysis-of-the-dirty-pipe-vulnerability ∗∗∗ Digging Inside Azure Functions: HyperV Is the Last Line of Defense ∗∗∗ --------------------------------------------- We investigated Azures serverless architecture and found that a HyperV VM was the remaining defense after a container breakout. --------------------------------------------- https://unit42.paloaltonetworks.com/azure-serverless-functions-security/ ∗∗∗ Patch Tuesday: (zur Abwechslung) Augen auf! ∗∗∗ --------------------------------------------- Manchmal gelangen wir die verzwickte Lage, dass sich in den Patchnotes Updates für Schwachstellen verbergen, aufgrund derer wir zwar keine Warnung veröffentlichen, aber auf die wir dennoch explizit hinweisen wollen. Diesen Monat ist es wieder einmal soweit. --------------------------------------------- https://cert.at/de/blog/2022/12/patch-tuesday-zur-abwechslung-augen-auf ∗∗∗ Windows Server 2019/2022: Dezember 2022-Sicherheitsupdates verursachen Hyper-V-Probleme ∗∗∗ --------------------------------------------- Die zum Dezember 2022 Patchday von Microsoft ausgerollten Sicherheitsupdates führen in bestimmten Konstellationen zum Problemen mit Hyper-V. --------------------------------------------- https://www.borncity.com/blog/2022/12/15/windows-server-2019-2022-dezember-… ∗∗∗ Microsoft-Zertifikate zur Signatur von Malware missbraucht (Dez. 2022) ∗∗∗ --------------------------------------------- Sicherheitsforscher sind auf Fälle gestoßen, wo es Cyberkriminellen gelungen ist, Malware durch gültige digitale Zertifikate von Microsoft zu signieren. --------------------------------------------- https://www.borncity.com/blog/2022/12/15/microsoft-zertifikate-zur-signatur… ===================== = Vulnerabilities = ===================== ∗∗∗ Microsoft Reclassifies SPNEGO Extended Negotiation Security Vulnerability as Critical ∗∗∗ --------------------------------------------- Microsoft has revised the severity of a security vulnerability it originally patched in September 2022, upgrading it to "Critical" after it emerged that it could be exploited to achieve remote code execution. --------------------------------------------- https://thehackernews.com/2022/12/microsoft-reclassifies-spnego-extended.ht… ∗∗∗ Typo3: Neue Fassungen schließen hochriskante Sicherheitslücke ∗∗∗ --------------------------------------------- Angreifer könnten in Typo3 etwa eigenen PHP-Code einschleusen. Mit neuen Versionen schließen die Entwickler diese und weitere Sicherheitslücken. --------------------------------------------- https://heise.de/-7395790 ∗∗∗ Microsoft Patch Tuesday, December 2022 Edition ∗∗∗ --------------------------------------------- Microsoft has released its final monthly batch of security updates for 2022, fixing more than four dozen security holes in its various Windows operating systems and related software. --------------------------------------------- https://krebsonsecurity.com/2022/12/microsoft-patch-tuesday-december-2022-e… ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (firefox-esr and git), Slackware (mozilla and xorg), SUSE (apache2-mod_wsgi, capnproto, xorg-x11-server, xwayland, and zabbix), and Ubuntu (emacs24, firefox, linux-azure, linux-azure-5.15, linux-azure-fde, linux-oem-6.0, and xorg-server, xorg-server-hwe-18.04, xwayland). --------------------------------------------- https://lwn.net/Articles/917947/ ∗∗∗ Der unsichtbare Feind: Buffer Overflow Schwachstellen in Zyxel Routern nach wie vor problematisch ∗∗∗ --------------------------------------------- https://sec-consult.com/de/blog/detail/enemy-within-unauthenticated-buffer-… ∗∗∗ Drupal Releases Security Updates to Address Vulnerabilities in H5P and File (Field) Paths ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ncas/current-activity/2022/12/15/drupal-releases-s… ∗∗∗ [R1] Tenable.ad Versions 3.29.4, 3.19.12 and 3.11.9 Fix One Vulnerability ∗∗∗ --------------------------------------------- https://www.tenable.com/security/tns-2022-27 ∗∗∗ Multiple Vulnerabilities in CloudPak for Watson AIOPs ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6848189 ∗∗∗ Multiple Vulnerabilities in CloudPak for Watson AIOPs ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6848195 ∗∗∗ Multiple vulnerabilities in IBM Java SDK affect IBM License Metric Tool v9. ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6848221 ∗∗∗ Netcool Operations Insight v1.6.7 contains fixes for multiple security vulnerabilities. ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6848225 ∗∗∗ A vulnerability in Python affects IBM Elastic Storage System (CVE-2022-0391) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6848229 ∗∗∗ IBM Spectrum Control is vulnerable to multiple weaknesses related to Node [CVE-2022-39353] ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6848213 ∗∗∗ Vulnerabilities in IBM Java SDK affect IBM Spectrum Control ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6847605 ∗∗∗ IBM Spectrum Control is vulnerable to multiple weaknesses related IBM WebSphere Application Server Liberty and FasterXML jackson-databind ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6847541 ∗∗∗ Security vulnerability is addressed with IBM Cloud Pak for Business Automation iFixes for November 2022 ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6848295 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 14.12.2022
by Daily end-of-shift report 14 Dec '22

14 Dec '22

===================== = End-of-Day report = ===================== Timeframe: Dienstag 13-12-2022 18:00 − Mittwoch 14-12-2022 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Microsoft-signed malicious Windows drivers used in ransomware attacks ∗∗∗ --------------------------------------------- Microsoft has revoked several Microsoft hardware developer accounts after drivers signed through their profiles were used in cyberattacks, including ransomware incidents. --------------------------------------------- https://www.bleepingcomputer.com/news/microsoft/microsoft-signed-malicious-… ∗∗∗ Open-source repositories flooded by 144,000 phishing packages ∗∗∗ --------------------------------------------- Unknown threat actors have uploaded a total of 144,294 phishing-related packages on the open-source package repositories NuGet, PyPI, and NPM. --------------------------------------------- https://www.bleepingcomputer.com/news/security/open-source-repositories-flo… ∗∗∗ Input Validation for Website Security ∗∗∗ --------------------------------------------- Web forms are incredibly useful tools. They allow you to gather important information about potential clients and site visitors, collect comments and feedback, upload files, subscribe new users to your blog, or even collect payment details. But if your forms aren’t properly validating user inputs, you might be in for a nasty surprise: a variety of issues can occur if data is uploaded to your site’s environment without specific controls. --------------------------------------------- https://blog.sucuri.net/2022/12/input-validation-for-website-security.html ∗∗∗ Google Launches OSV-Scanner Tool to Identify Open Source Vulnerabilities ∗∗∗ --------------------------------------------- Google on Tuesday announced the open source availability of OSV-Scanner, a scanner that aims to offer easy access to vulnerability information about various projects.The Go-based tool, powered by the Open Source Vulnerabilities (OSV) database, is designed to connect "a projects list of dependencies with the vulnerabilities that affect them," [..] --------------------------------------------- https://thehackernews.com/2022/12/google-launches-largest-distributed.html ∗∗∗ New GoTrim Botnet Attempting to Break into WordPress Sites Admin Accounts ∗∗∗ --------------------------------------------- A new Go-based botnet has been spotted scanning and brute-forcing self-hosted websites using the WordPress content management system (CMS) to seize control of the targeted systems."This new brute forcer is part of a new campaign we have named GoTrim because it was written in Go and uses :::trim::: to split data communicated to and from the C2 server," --------------------------------------------- https://thehackernews.com/2022/12/new-gotrim-botnet-attempting-to-break.html ∗∗∗ Ade iOS 15: Apple stellt Support auf neueren iPhones offenbar ein ∗∗∗ --------------------------------------------- iPhones ab Baujahr 2017 erhalten Sicherheits-Updates nur noch nach Upgrade auf iOS 16. Lücken in iOS 15 werden laut Apple aktiv ausgenutzt. --------------------------------------------- https://heise.de/-7394913 ∗∗∗ BSI-Magazin mit Schwerpunkt "Ransomware" veröffentlicht ∗∗∗ --------------------------------------------- Die zweite Ausgabe des BSI-Magazins "Mit Sicherheit" in diesem Jahr ist erschienen. Das BSI stellt in diesem BSI-Magazin eine der aktuell größten Bedrohungen für die IT-Sicherheit in einem Sonderteil in den Mittelpunkt: Ransomware. [..] Weitere Themen sind Automotive Security, der Digitale Verbraucherschutz sowie die Zusammenarbeit von BSI und NATO zur Gestaltung der Cloud-Sicherheit im Bündnis. Außerdem gibt es im neuen BSI-Magazin eine neue Checkliste mit Tipps für ein sicheres Heimnetzwerk. --------------------------------------------- https://www.bsi.bund.de/DE/Service-Navi/Presse/Alle-Meldungen-News/Meldunge… ∗∗∗ NSA, CISA, and ODNI Release Guidance on Potential Threats to 5G Network Slicing ∗∗∗ --------------------------------------------- Original release date: December 13, 2022Today, the National Security Agency (NSA), CISA, and the Office of the Director of National Intelligence (ODNI), published Potential Threats to 5G Network Slicing. This guidance—created by the Enduring Security Framework (ESF), a public-private cross-sector working group led by the NSA and CISA—presents both the benefits and risks associated with 5G network slicing. It also provides mitigation strategies that address potential threats to 5G network slicing. --------------------------------------------- https://us-cert.cisa.gov/ncas/current-activity/2022/12/13/nsa-cisa-and-odni… ===================== = Vulnerabilities = ===================== ∗∗∗ Vulnerabilities found on Arcadyan Routers ∗∗∗ --------------------------------------------- The two vulnerabilities were found by Asher Davila L. in Arcadyan wireless modems with model number VRV9506JAC23. It is probable that they are also present in other Arcadyan models as well because their web interfaces are similar and they have common features. The following are the two found vulnerabilities: * CVE-2020-9420: Cleartext transmission of sensitive information * CVE-2020-9419: Stored cross-site scripting --------------------------------------------- https://gist.github.com/AsherDLL/03d0762b5a535e300f1121caebe333ce ∗∗∗ Webbrowser: Chrome-Update dichtet acht Sicherheitslecks ab ∗∗∗ --------------------------------------------- Google hat eine aktualisierte Version des Webbrowsers Chrome bereitgestellt. Sie schließt mindestens vier hochriskante Sicherheitslücken. --------------------------------------------- https://heise.de/-7394554 ∗∗∗ VMSA-2022-0032: VMware Workspace ONE Access (Access), VMware Identity Manager (vIDM), VMware Cloud Foundation (Cloud Foundation) ∗∗∗ --------------------------------------------- Synopsis: VMware Workspace ONE Access and Identity Manager updates address multiple vulnerabilities (CVE-2022-31700, CVE-2022-31701). --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2022-0032.html ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (pngcheck), Fedora (qemu), Mageia (admesh, busybox, emacs, libarchive, netkit-telnet, ruby, rxvt-unicode, and shadowutils), Oracle (bcel and kernel), Red Hat (389-ds-base, bcel, dbus, firefox, grub2, kernel, kernel-rt, kpatch-patch, thunderbird, and usbguard), Scientific Linux (bcel), SUSE (containerd, firefox, grafana, java-1_8_0-openjdk, libtpms, net-snmp, and wireshark), and Ubuntu (pillow). --------------------------------------------- https://lwn.net/Articles/917839/ ∗∗∗ Adobe Patches 38 Flaws in Enterprise Software Products ∗∗∗ --------------------------------------------- After skipping last month, Adobe returned to its scheduled Patch Tuesday cadence with the release of fixes for at least 38 vulnerabilities in multiple enterprise-facing products.The San Jose, California software maker said the flaws could expose users to code execution and privilege escalation attacks across all computer platforms. --------------------------------------------- https://www.securityweek.com/adobe-patches-38-flaws-enterprise-software-pro… ∗∗∗ ICS Patch Tuesday: Siemens Fixes 80 OpenSSL, OpenSSH Flaws in Switches ∗∗∗ --------------------------------------------- Industrial giants Siemens and Schneider Electric have addressed over 140 vulnerabilities with their December 2022 Patch Tuesday updates.Siemensread more --------------------------------------------- https://www.securityweek.com/ics-patch-tuesday-siemens-fixes-80-openssl-ope… ∗∗∗ Apple Releases Security Updates for Multiple Products ∗∗∗ --------------------------------------------- Original release date: December 13, 2022Apple has released security updates to address vulnerabilities in multiple products. An attacker could exploit some of these vulnerabilities to take control of an affected device.CISA encourages users and administrators to review the Apple security updates page for the following products and apply the necessary updates as soon as possible: iCloud for Windows 14.1 Safari 16.2 macOS Monterey 12.6.2 macOS Big Sur 11.7.2 tvOS 16.2 watchOS 9.2 iOS 15.7.2 and iPadOS 15.7.2 iOS 16.2 and iPadOS 16.2 macOS Ventura 13.1 --------------------------------------------- https://us-cert.cisa.gov/ncas/current-activity/2022/12/13/apple-releases-se… ∗∗∗ Sonicwall Capture Client Local Privilege Escalation via SentinelOne Agent (Aikido) ∗∗∗ --------------------------------------------- An arbitrary file deletion vulnerability (Aikido) in Sonicwall Capture Client via SentinelOne Agent could allow a local attacker to escalate privileges and delete files. The exploit was confirmed to work with 6 vulnerable EDR products, including the SentinelOne Agent for Windows.Please note: an attacker must first obtain low-privileged access on the target system in order to exploit this vulnerability. --------------------------------------------- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0025 ∗∗∗ Cisco Identity Services Engine Unauthorized File Access Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Weidmueller: Multiple IoT and control products affected by JavaScript injection vulnerability ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2022-056/ ∗∗∗ NVIDIA GPU Display Driver Advisory - November 2022 ∗∗∗ --------------------------------------------- http://support.lenovo.com/product_security/PS500536-NVIDIA-GPU-DISPLAY-DRIV… ∗∗∗ Vulnerabilities in Linux Kernel, Golang Go, and cURL libcurl may affect IBM Spectrum Protect Plus ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6847643 ∗∗∗ Vulnerability in IBM WebSphere Application Server Liberty may affect IBM Spectrum Protect Operations Center and Client Management Service (CVE-2022-34165) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6847655 ∗∗∗ Vulnerabilities in zlib and Golang Go may affect the IBM Spectrum Protect Server (CVE-2018-25032, CVE-2022-27664) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6847653 ∗∗∗ IBM Copy Services Manager is vulnerable to a remote attack vulnerabilities due to IBM WebSphere Application Server Liberty vulnerabilities (CVE-2022-22476) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6847789 ∗∗∗ IBM Tivoli Netcool\/OMNIbus Transport Module Common Integration Library is affected by vulnerability in Apache Kafka (CVE-2022-34917) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6847829 ∗∗∗ IBM Tivoli Netcool\/OMNIbus Probe and Integrations Library are affected by vulnerabilities in FasterXML jackson-databind (CVE-2022-42004, CVE-2022-42003) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6846525 ∗∗∗ IBM Sterling Connect:Direct for UNIX is vulnerable to denial of service due to FasterXML jackson-databind (CVE-2022-42003) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6847939 ∗∗∗ IBM Sterling Connect:Direct for UNIX is vulnerable to denial of service due to FasterXML jackson-databind (CVE-2022-42004) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6847945 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 13.12.2022
by Daily end-of-shift report 13 Dec '22

13 Dec '22

===================== = End-of-Day report = ===================== Timeframe: Montag 12-12-2022 18:00 − Dienstag 13-12-2022 18:00 Handler: Stephan Richter Co-Handler: Robert Waldner ===================== = News = ===================== ∗∗∗ Amazon ECR Public Gallery flaw could have wiped or poisoned any image ∗∗∗ --------------------------------------------- The researcher reported the vulnerability to AWS Security on November 15, 2022, and Amazon rolled out a fix in under 24 hours. While there are no signs of this flaw being abused in the wild, threat actors could have used it in massive-scale supply chain attacks against many users. --------------------------------------------- https://www.bleepingcomputer.com/news/security/amazon-ecr-public-gallery-fl… ∗∗∗ IIS modules: The evolution of web shells and how to detect them ∗∗∗ --------------------------------------------- This blog aims to provide further guidance on detecting malicious IIS modules and other capabilities that you can use during your own incident response investigations. --------------------------------------------- https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-ev… ∗∗∗ A Deep Dive into BianLian Ransomware ∗∗∗ --------------------------------------------- BianLian ransomware is a Golang malware that performed targeted attacks across multiple industries in 2022. The ransomware employed anti-analysis techniques consisting of API calls that would likely crash some sandboxes/automated analysis systems. The malware targets all drives identified on the machine and deletes itself after the encryption is complete. --------------------------------------------- https://resources.securityscorecard.com/research/bian-lian-deep-dive ∗∗∗ New Python-Based Backdoor Targeting VMware ESXi Servers ∗∗∗ --------------------------------------------- Security researchers with Juniper Networks’ Threat Labs warn of a new Python-based backdoor targeting VMware ESXi virtualization servers. The targeted servers were impacted by known security defects (such as CVE-2019-5544 and CVE-2020-3992) that were likely used for initial compromise, but what caught the researchers’ attention was the simplicity, persistence, and capabilities of the deployed backdoor. --------------------------------------------- https://www.securityweek.com/new-python-based-backdoor-targeting-vmware-esx… ∗∗∗ What’s My Name Again? Reolink camera command injection ∗∗∗ --------------------------------------------- TL;DR Research on Reolink’s RLC-520A smart motion detection camera has turned up an authenticated command injection vulnerability. Exploiting this vulnerability with an injected system command can render the device useless. --------------------------------------------- https://www.pentestpartners.com/security-blog/whats-my-name-again-reolink-c… ∗∗∗ Aktuelle Welle an DDoS Angriffen auf staatsnahe und kritische Infrastruktur in Österreich ∗∗∗ --------------------------------------------- Seit ca. zwei Wochen sehen sich vermehrt österreichische staatliche/staatsnahe Organisationen sowie Unternehmen der kritischen Infrastruktur mit DDoS Angriffen konfrontiert. Die genauen Hintergründe und Motive der Attacken sind uns zurzeit nicht bekannt. Die Täter:innen greifen hierbei zu verschiedenen Methoden und versuchen auch, sich an getroffene Gegenmaßnahmen anzupassen. --------------------------------------------- https://cert.at/de/aktuelles/2022/12/aktuelle-welle-an-ddos-angriffen-auf-s… ∗∗∗ REPORT: A new trick from Facebook scammers and Sharkbot Android malware returns ∗∗∗ --------------------------------------------- A new wave of scams utilizes Facebook’s tagging feature to trick Page owners into believing they’ve violated Facebook’s terms and conditions. Several variations of the attack exist, but all lead to phishing sites designed to steal Page owner’s credentials. --------------------------------------------- https://blog.f-secure.com/f-alert-report-a-new-trick-from-facebook-scammers… ===================== = Vulnerabilities = ===================== ∗∗∗ Redmine vulnerable to cross-site scripting ∗∗∗ --------------------------------------------- Redmine contains a cross-site scripting vulnerability. --------------------------------------------- https://jvn.jp/en/jp/JVN60211811/ ∗∗∗ Announcing TYPO3 12.1.1 [12.1.2], 11.5.20 and 10.4.33 security releases ∗∗∗ --------------------------------------------- today weve released TYPO3 12.1.1, 11.5.20 LTS and 10.4.33 LTS, which are ready for you to download. All versions are security releases and contain important security fixes [unfortunately TYPO3 v12.1.1 contained a regression, which has been fixed in TYPO3 v12.1.2.] --------------------------------------------- https://lists.typo3.org/pipermail/typo3-announce/2022/000523.html ∗∗∗ Vulnerabilities in multiple third party TYPO3 CMS extensions ∗∗∗ --------------------------------------------- several vulnerabilities have been found in the following third party TYPO3 extensions: * "Change password for frontend users" (fe_change_pwd) * "Newsletter subscriber management" (fp_newsletter) * "Master-Quiz" (fp_masterquiz) For further information on the issues, please read the related advisories TYPO3-EXT-SA-2022-016, TYPO3-EXT-SA-2022-017 and TYPO3-EXT-SA-2022-018 which were published today --------------------------------------------- https://lists.typo3.org/pipermail/typo3-announce/2022/000524.html ∗∗∗ OpenSSL: X.509 Policy Constraints Double Locking (CVE-2022-3996) ∗∗∗ --------------------------------------------- Severity: Low If an X.509 certificate contains a malformed policy constraint and policy processing is enabled, then a write lock will be taken twice recursively. On some operating systems (most widely: Windows) this results in a denial of service when the affected process hangs. Policy processing being enabled on a publicly facing server is not considered to be a common setup. --------------------------------------------- https://www.openssl.org/news/secadv/20221213.txt ∗∗∗ Patchday SAP: 14 neue Sicherheitsmeldungen im Dezember ∗∗∗ --------------------------------------------- Zum Jahresende behandelt SAP in 14 Sicherheitsnotizen Schwachstellen in der Software des Unternehmens. IT-Verantwortliche sollten die Updates rasch anwenden. --------------------------------------------- https://heise.de/-7392718 ∗∗∗ Jetzt patchen! Kritische Zero-Day-Lücke in FortiOS wird angegriffen ∗∗∗ --------------------------------------------- Fortinet meldet eine kritische Sicherheitslücke in FortiOS. Cyberkriminelle missbrauchen diese bereits für Angriffe. Updates stehen bereit. --------------------------------------------- https://heise.de/-7392455 ∗∗∗ VMSA-2022-0031 ∗∗∗ --------------------------------------------- Synopsis: VMware vRealize Network Insight (vRNI) updates address command injection and directory traversal security vulnerabilities (CVE-2022-31702, CVE-2022-31703) --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2022-0031.html ∗∗∗ VMSA-2022-0033 ∗∗∗ --------------------------------------------- Synopsis: VMware ESXi, Workstation, and Fusion updates address a heap out-of-bounds write vulnerability (CVE-2022-31705) --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2022-0033.html ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (node-tar and pngcheck), SUSE (colord, containerd, and tiff), and Ubuntu (containerd, linux-azure, linux-azure, linux-azure-5.4, linux-oem-5.17, and vim). --------------------------------------------- https://lwn.net/Articles/917749/ ∗∗∗ Security Vulnerabilities fixed in Thunderbird 102.6 ∗∗∗ --------------------------------------------- In general, these flaws cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts. --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2022-53/ ∗∗∗ Security Vulnerabilities fixed in Firefox ESR 102.6 ∗∗∗ --------------------------------------------- CVE-2022-46880: Use-after-free in WebGL CVE-2022-46872: Arbitrary file read from a compromised content process CVE-2022-46881: Memory corruption in WebGL CVE-2022-46874: Drag and Dropped Filenames could have been truncated to malicious extensions CVE-2022-46875: Download Protections were bypassed by .atloc and .ftploc files on Mac OS CVE-2022-46882: Use-after-free in WebGL CVE-2022-46878: Memory safety bugs fixed in Firefox 108 and Firefox ESR 102.6 --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2022-52/ ∗∗∗ Security Vulnerabilities fixed in Firefox 108 ∗∗∗ --------------------------------------------- CVE-2022-46871: libusrsctp library out of date CVE-2022-46872: Arbitrary file read from a compromised content process CVE-2022-46873: Firefox did not implement the CSP directive unsafe-hashes CVE-2022-46874: Drag and Dropped Filenames could have been truncated to malicious extensions CVE-2022-46875: Download Protections were bypassed by .atloc and .ftploc files on Mac OS CVE-2022-46877: Fullscreen notification bypass CVE-2022-46878: Memory safety bugs fixed in Firefox 108 and Firefox ESR 102.6 CVE-2022-46879: Memory safety bugs fixed in Firefox 108 --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2022-51/ ∗∗∗ Citrix ADC and Citrix Gateway Security Bulletin for CVE-2022-27518 ∗∗∗ --------------------------------------------- A vulnerability has been discovered in Citrix Gateway and Citrix ADC, listed below, that, if exploited, could allow an unauthenticated remote attacker to perform arbitrary code execution on the appliance. CVE-ID: CVE-2022-27518 --------------------------------------------- https://support.citrix.com/article/CTX474995/citrix-adc-and-citrix-gateway-… ∗∗∗ Privilege Escalation Schwachstellen (UNIX Insecure File Handling) in SAP® Host Agent (saposcol) ∗∗∗ --------------------------------------------- Due to insecure file handling issues of the SAP® Host Agent, a local attacker can exploit the helper binary saposcol to escalate privileges on UNIX systems. Successful exploitation leads to full system compromise with root access. --------------------------------------------- https://sec-consult.com/de/vulnerability-lab/advisory/privilege-escalation-… ∗∗∗ ICS Advisory (ICSA-22-347-03): Contec CONPROSSYS HMI System (CHS) ∗∗∗ --------------------------------------------- https://www.cisa.gov/uscert/ics/advisories/icsa-22-347-03 ∗∗∗ ICS Advisory (ICSA-22-347-02): Schneider Electric APC Easy UPS Online ∗∗∗ --------------------------------------------- https://www.cisa.gov/uscert/ics/advisories/icsa-22-347-02 ∗∗∗ ICS Advisory (ICSA-22-347-01): ICONICS and Mitsubishi Electric Products ∗∗∗ --------------------------------------------- https://www.cisa.gov/uscert/ics/advisories/icsa-22-347-01 ∗∗∗ Wiesemann & Theis multiple products prone to web interface vulnerability ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2022-057/ ∗∗∗ Festo: Vulnerable WIBU-SYSTEMS CodeMeter Runtime in multiple products ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2022-038/ ∗∗∗ A vulnerability in IBM WebSphere Application Server Liberty affects IBM Spectrum Scale packaged in IBM Elastic Storage Server ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6847315 ∗∗∗ AIX is vulnerable to a denial of service due to libxml2 (CVE-2022-29824) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6619729 ∗∗∗ IBM QRadar Network Packet Capture has released 7.3.1 Patch 1, and 7.2.8 Patch 1 in response to the vulnerabilities known as Spectre and Meltdown. ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/571419 ∗∗∗ Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli Netcool Impact (CVE-2021-41041, CVE-2022-3676) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6847341 ∗∗∗ Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli Netcool Impact ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6847351 ∗∗∗ Multiple vulnerabilities have been identified in IBM WebSphere Application Server Liberty shipped with IBM Tivoli Netcool Impact (CVE-2022-24839, CVE-2022-37734, CVE-2022-34165) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6847349 ∗∗∗ Multiple vulnerabilities have been identified in Smack API shipped with IBM Tivoli Netcool Impact (CVE-2014-0363, CVE-2014-0364) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6847337 ∗∗∗ Multiple Linux Kernel vulnerabilities may affect IBM Elastic Storage System ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6847563 ∗∗∗ WebSphere Application Server is vulnerable to SOAPAction spoofing when processing JAX-WS Web Services requests which affects Content Collector for Email ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6847593 ∗∗∗ Content Collector for Email is affected by a vulnerability found in embedded WebSphere Application Server ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6847591 ∗∗∗ Content Collector for Email is affected by a vulnerability found in embedded WebSphere Application Server ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6847587 ∗∗∗ Content Collector for Email is affected by a vulnerability found in embedded WebSphere Application Server ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6847595 ∗∗∗ Vulnerability in OAuthlib affects IBM Spectrum Protect Plus Container backup and restore for Kubernetes and OpenShift (CVE-2022-36087) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6842215 ∗∗∗ Vulnerabilities in Redis affect IBM Spectrum Protect Plus Container backup and restore for Kubernetes and OpenShift (CVE-2022-24736, CVE-2022-24735) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6842235 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 12.12.2022
by Daily end-of-shift report 12 Dec '22

12 Dec '22

===================== = End-of-Day report = ===================== Timeframe: Freitag 09-12-2022 18:00 − Montag 12-12-2022 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Clop ransomware partners with TrueBot malware for access to networks ∗∗∗ --------------------------------------------- Security researchers have noticed a spike in devices infected with the TrueBot malware downloader created by a Russian-speaking hacking group known as Silence. --------------------------------------------- https://www.bleepingcomputer.com/news/security/clop-ransomware-partners-wit… ∗∗∗ Popular WAFs Subverted by JSON Bypass ∗∗∗ --------------------------------------------- Web application firewalls from AWS, Cloudflare, F5, Imperva, and Palo Alto Networks are vulnerable to a database attack using the popular JavaScript Object Notation (JSON) format. --------------------------------------------- https://www.darkreading.com/application-security/popular-wafs-json-bypass ∗∗∗ On-device WebAuthn and what makes it hard to do well ∗∗∗ --------------------------------------------- WebAuthn improves login security a lot by making it significantly harder for a users credentials to be misused - a WebAuthn token will only respond to a challenge if its issued by the site a secret was issued to, and in general will only do so if the user provides proof of physical presence[1]. But giving people tokens is tedious and also I have a new laptop which only has USB-C but does have a working fingerprint reader and I [...] --------------------------------------------- https://mjg59.dreamwidth.org/62746.html ∗∗∗ Hack-for-Hire Group Targets Travel and Financial Entities with New Janicab Malware Variant ∗∗∗ --------------------------------------------- Travel agencies have emerged as the target of a hack-for-hire group dubbed Evilnum as part of a broader campaign aimed at legal and financial investment institutions in the Middle East and Europe. The attacks, which took place during 2020 and 2021 and likely went as far back as 2015, involved a revamped variant of a malware called Janicab that leverages a number of public services like WordPress [...] --------------------------------------------- https://thehackernews.com/2022/12/hack-for-hire-group-targets-travel-and.ht… ∗∗∗ Log4j’s Log4Shell Vulnerability: One Year Later, It’s Still Lurking ∗∗∗ --------------------------------------------- Despite mitigation, one of the worst bugs in internet history is still prevalent—and being exploited. --------------------------------------------- https://www.wired.com/story/log4j-log4shell-one-year-later/ ∗∗∗ Practically-exploitable Cryptographic Vulnerabilities in Matrix ∗∗∗ --------------------------------------------- We report several practically-exploitable cryptographic vulnerabilities in the end-to-end encryption in Matrix and describe proof-of-concept attacks exploiting these vulnerabilities. [...] Whilst the language of the paper and this website is in present tense, many of the vulnerabilities disclosed have been fixed. See our paper (or Matrix’ website) for more details. --------------------------------------------- https://nebuchadnezzar-megolm.github.io/ ∗∗∗ Cisco Working on Patch for Publicly Disclosed IP Phone Vulnerability ∗∗∗ --------------------------------------------- Cisco informed customers on Thursday that it’s working on patches for a high-severity vulnerability affecting some of its IP phones. --------------------------------------------- https://www.securityweek.com/cisco-working-patch-publicly-disclosed-ip-phon… ∗∗∗ So schützen Sie sich vor problematischen Online-Shops ∗∗∗ --------------------------------------------- Immer wieder werden uns Online-Shops gemeldet, die zwar keine Fake-Shops, aber trotzdem problematisch sind. Lieferzeiten werden nicht eingehalten, die Qualität der Produkte lässt zu wünschen übrig, oder es kommt zu hohen Zoll- oder Retourenkosten. Wir zeigen Ihnen, worauf Sie achten müssen, um keine bösen Überraschungen beim Online-Shopping zu erleben! --------------------------------------------- https://www.watchlist-internet.at/news/so-schuetzen-sie-sich-vor-problemati… ∗∗∗ So schützen Sie sich vor Abo-Fallen im Internet ∗∗∗ --------------------------------------------- Auch im Internet hat niemand etwas zu verschenken! Lassen Sie Vorsicht walten bei Angeboten, die zu gut sind, um wahr zu sein. Diese „Angebote“ nutzen Kriminelle, um Sie in die Falle zu locken. Wenn Sie bemerken, dass Geldbeträge ohne Ihre Zustimmung von Ihrem Konto abgebucht werden, handelt es sich möglicherweise um eine Abo-Falle! --------------------------------------------- https://www.watchlist-internet.at/news/so-schuetzen-sie-sich-vor-abo-fallen… ∗∗∗ Was tun, wenn Sie in eine Abo-Falle getappt sind? ∗∗∗ --------------------------------------------- Auf der Suche nach kostenlosen Angeboten und gratis Testversionen werden Sie im Internet schnell fündig. Doch Vorsicht: Hier ist nicht alles Gold, was glänzt! Oft handelt es sich nämlich um Abo-Fallen, bei denen Ihnen unbegründet Rechnungen zugeschickt oder Geldbeträge vom Konto abgebucht werden und man Ihnen mit Inkassobüros oder Rechtsanwaltsschreiben droht. Die Lösung? Auf keinen Fall bezahlen! --------------------------------------------- https://www.watchlist-internet.at/news/was-tun-wenn-sie-in-eine-abo-falle-g… ∗∗∗ Precious Gemstones: The New Generation of Kerberos Attacks ∗∗∗ --------------------------------------------- Unit 42 researchers show new methods to improve detection of a next-gen line of Kerberos attacks, which allow attackers to modify Kerberos tickets to maintain privileged access. --------------------------------------------- https://unit42.paloaltonetworks.com/next-gen-kerberos-attacks/ ===================== = Vulnerabilities = ===================== ∗∗∗ FortiOS - heap-based buffer overflow in sslvpnd ∗∗∗ --------------------------------------------- A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests. Fortinet is aware of an instance where this vulnerability was exploited in the wild, and recommends immediately validating your systems against the following indicators of compromise: [...] --------------------------------------------- https://www.fortiguard.com/psirt/FG-IR-22-398 ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (cacti, grub2, hsqldb, node-eventsource, and openexr), Fedora (bcel, keylime, rust-capnp, rust-sequoia-octopus-librnp, xfce4-screenshooter, and xfce4-settings), Oracle (nodejs:18), Scientific Linux (grub2), Slackware (libarchive), SUSE (go1.18, go1.19, nautilus, opera, python-slixmpp, and samba), and Ubuntu (python2.7, python3.5, qemu, and squid3). --------------------------------------------- https://lwn.net/Articles/917690/ ∗∗∗ IFM: weak password recovery vulnerability in moneo appliance ∗∗∗ --------------------------------------------- Summary: An unauthenticated remote attacker could reset the administrators password with information from the default, self-signed certificate. Impact: An unathenticated attacker can remotely reset the administrator password. Solution: Mitigation: The certificate is renewed by adjusting the hostname to an own customer-specific, so it does not contain the serial number. Remediation: The password-reset mechanism will be updated in a future version. --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2022-050/ ∗∗∗ IBM Security Bulletins 2022-12-09 - 2022-12-12 ∗∗∗ --------------------------------------------- Apache Commons HttpClient 3.x (and few others), Apache POI, IBM App Connect Enterprise, IBM® Db2® Net Search Extender, IBM Elastic Storage System, IBM Engineering Workflow Management (EWM), IBM InfoSphere Information Server, IBM Spectrum Copy Data Management, IBM Spectrum Protect Backup-Archive Client, IBM Spectrum Protect for Virtual Environments, IBM Spectrum Scale packaged in IBM Elastic Storage Server, IBM Spectrum Scale packaged in IBM Elastic Storage System, IBM Tivoli Application Dependency Discovery Manager (TADDM), Rational Team Concert (RTC), z/Transaction Processing Facility --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ Intel Data Center Manager 5.1 Local Privilege Escalation ∗∗∗ --------------------------------------------- https://cxsecurity.com/issue/WLB-2022120027 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 09.12.2022
by Daily end-of-shift report 09 Dec '22

09 Dec '22

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 07-12-2022 18:00 − Freitag 09-12-2022 18:00 Handler: Thomas Pribitzer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Unsichtbare npm-Malware umgeht Sicherheitsprüfungen mit manipulierten Versionen ∗∗∗ --------------------------------------------- JFrog hat ein unerwartetes Verhalten der npm-Werkzeuge entdeckt: Für Pakete bestimmter Versionsformate zeigen sie wohl keine sicherheitsrelevanten Hinweise an. --------------------------------------------- https://heise.de/-7372357 ∗∗∗ So schützen Sie sich vor Fake-Shops ∗∗∗ --------------------------------------------- Fake-Shops locken mit gutem Design und unschlagbaren Preisen in die Falle. Doch wie erkennen Sie Fake-Shops und andere betrügerische Online-Shops, bevor es zu spät ist? Hier beschreiben wir hier die gängigsten Formen von Fake-Shops und ihre Erkennungsmerkmale. Ein Einkauf in einem Fake-Shop kann Sie nämlich wahrlich teuer zu stehen kommen. --------------------------------------------- https://www.watchlist-internet.at/news/so-schuetzen-sie-sich-vor-fake-shops/ ∗∗∗ Ransomware: Löschen statt entschlüsseln ∗∗∗ --------------------------------------------- Die defekte Ransomware Cryptonite kann Ihre Dateien nicht entschlüsseln, selbst wenn Sie das Lösegeld bezahlen. Stattdessen werden alle Daten einfach gelöscht. --------------------------------------------- https://www.zdnet.de/88405737/ransomware-loeschen-statt-entschluesseln/ ∗∗∗ New Zombinder platform binds Android malware with legitimate apps ∗∗∗ --------------------------------------------- A darknet platform dubbed Zombinder allows threat actors to bind malware to legitimate Android apps, causing victims to infect themselves while still having the full functionality of the original app to evade suspicion. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-zombinder-platform-binds… ∗∗∗ Hacked corporate email accounts used to send MSP remote access tool ∗∗∗ --------------------------------------------- MuddyWater hackers, a group associated with Irans Ministry of Intelligence and Security (MOIS), used compromised corporate email accounts to deliver phishing messages to their targets. --------------------------------------------- https://www.bleepingcomputer.com/news/security/hacked-corporate-email-accou… ∗∗∗ DeathStalker targets legal entities with new Janicab variant ∗∗∗ --------------------------------------------- While hunting for less common Deathstalker intrusions, we identified a new Janicab variant used in targeting legal entities in the Middle East throughout 2020. --------------------------------------------- https://securelist.com/deathstalker-targets-legal-entities-with-new-janicab… ∗∗∗ How to train your Ghidra ∗∗∗ --------------------------------------------- Brief introduction to setting up Ghidra, and then configuring it with a familiar UI and shortcuts, so that you would not need to re-learn all the key sequences you have got used to over the years. --------------------------------------------- https://securelist.com/how-to-train-your-ghidra/108272/ ∗∗∗ Finding Gaps in Syslog - How to find when nothing happened, (Wed, Dec 7th) ∗∗∗ --------------------------------------------- I recently got a call from a client, they had an outage that required a firewall reboot, but couldn't give me an exact clock time. They were looking for anything in the logs just prior to that reboot that might indicate a carrier issue, as they had experienced a few outages like this recently. --------------------------------------------- https://isc.sans.edu/diary/rss/29314 ∗∗∗ Port Scanning in Powershell Redux: Speeding Up the Results (challenge accepted!), (Fri, Dec 9th) ∗∗∗ --------------------------------------------- In the story I wrote in October about using PowerShell for Port Scanning (https://isc.sans.edu/diary/29202), I noted that the basic "test-connect" operation made for a pretty slow port scanner, which seems to be the message that everyone latched onto. Of course, my immediate response was "challenge accepted!", so let's go - let's make that operation faster! --------------------------------------------- https://isc.sans.edu/diary/rss/29324 ∗∗∗ Trojanized OneNote Document Leads to Formbook Malware ∗∗∗ --------------------------------------------- Cybercriminals have long used Microsoft documents to pass along malware and they are always experimenting with new ways to deliver malicious packages. As defenders, Trustwave SpiderLabs’ researchers are always looking out for new or unusual file types, and through this ongoing research, we uncovered threat actors using a OneNote document to move Formbook malware, an information stealing trojan sold on an underground hacking forum since mid-2016 as malware-as-a-service. --------------------------------------------- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-… ∗∗∗ Compromised Cloud Compute Credentials: Case Studies From the Wild ∗∗∗ --------------------------------------------- A walk-through of attacks in the wild that abuse stolen cloud compute credentials in the cloud environment. Unit 42 researchers highlight two case studies. --------------------------------------------- https://unit42.paloaltonetworks.com/compromised-cloud-compute-credentials/ ∗∗∗ Fantasy - a new Agrius wiper deployed through a supply‑chain attack ∗∗∗ --------------------------------------------- ESET researchers analyzed a supply-chain attack abusing an Israeli software developer to deploy Fantasy, Agrius’s new wiper, with victims including the diamond industry --------------------------------------------- https://www.welivesecurity.com/2022/12/07/fantasy-new-agrius-wiper-supply-c… ∗∗∗ On hacking forums, even the scammers aren’t safe ∗∗∗ --------------------------------------------- Cybercriminals use a range of techniques to steal victims’ money — from developing malicious software to siphon financial data to old-fashioned “rip-and-runs” — but that doesn’t mean they’re immune to falling for these scams themselves. Scammers scamming scammers, including sometimes the scammers who have scammed them, is “an entire sub-economy” on darknet marketplaces, according to [...] --------------------------------------------- https://therecord.media/on-hacking-forums-even-the-scammers-arent-safe/ ∗∗∗ OpenSSL CVE-2022-3786: Food for Thought on the Importance of Security Scanning ∗∗∗ --------------------------------------------- After a CVE on open source software has been discovered and a fix has been released, a fruitful practice for security researchers is to go deep into the nature of the CVE and the fix. --------------------------------------------- https://checkmarx.com/blog/openssl-cve-2022-3786-food-for-thought-on-the-im… ===================== = Vulnerabilities = ===================== ∗∗∗ Cisco IP Phone 7800 and 8800 Series Cisco Discovery Protocol Stack Overflow Vulnerability ∗∗∗ --------------------------------------------- A vulnerability in the Cisco Discovery Protocol processing feature of Cisco IP Phone 7800 and 8800 Series firmware could allow an unauthenticated, adjacent attacker to cause a stack overflow on an affected device. This vulnerability is due to insufficient input validation of received Cisco Discovery Protocol packets. An attacker could exploit this vulnerability by sending crafted Cisco Discovery Protocol traffic to an affected device. --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ IBM Security Bulletins 2022-12-05 ∗∗∗ --------------------------------------------- IBM App Connect Enterprise, IBM Cloud Transformation Advisor, IBM Event Streams, IBM InfoSphere Information Server, IBM Power System, IBM QRadar SIEM, IBM Rational Functional Tester, IBM Rational Test Automation Server, IBM Spectrum Scale, IBM Sterling Secure Proxy, IBM Watson Developer Cloud --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ IBM Security Bulletins 2022-12-06 ∗∗∗ --------------------------------------------- IBM Business Automation Workflow, IBM Content Navigator, IBM Operations Analytics, IBM Rational Business Developer, IBM SPSS Collaboration and Deployment Services, IBM Security SiteProtector System, IBM Sterling External Authentication Server, IBM Tivoli Application Dependency Discovery Manager, IBM Tivoli Business Service Manager, IBM Tivoli Composite Application Manager for Transactions, IBM WebSphere Application Server --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ IBM Security Bulletins 2022-12-07 ∗∗∗ --------------------------------------------- AIX, HMC, IBM Business Automation Workflow Event Emitters, IBM CICS TX Advanced, IBM CICS TX Standard, IBM Data Risk Manager, IBM Enterprise Content Management System Monitor, IBM Match 360, IBM PowerVM Novalink, IBM Virtualization Engine TS7700, IBM Watson Assistant for IBM Cloud Pak for Data --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ IBM Security Bulletins 2022-12-08 ∗∗∗ --------------------------------------------- AIX, IBM API Connect, IBM CICS Transaction Gateway, IBM Cloud Transformation Advisor, IBM InfoSphere Information Server, IBM MQ, IBM PowerVM Novalink, IBM Security Verify --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ IBM Security Bulletins 2022-12-09 ∗∗∗ --------------------------------------------- IBM App Connect Enterprise Certified Container, IBM Security Verify Governance, IBM Spectrum Copy Data Management, IBM Spectrum Protect for Space Management Client, IBM Tivoli Application Dependency Discovery Manager, z/Transaction Processing Facility --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ VMSA-2022-0030 ∗∗∗ --------------------------------------------- VMware ESXi and vCenter Server updates address multiple security vulnerabilities (CVE-2022-31696, CVE-2022-31697, CVE-2022-31698, CVE-2022-31699) --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2022-0030.html ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (dlt-daemon, jqueryui, and virglrenderer), Fedora (firefox, vim, and woff), Oracle (kernel and nodejs:18), Red Hat (java-1.8.0-ibm and redhat-ds:11), Slackware (python3), SUSE (buildah, matio, and osc), and Ubuntu (heimdal and postgresql-9.5). --------------------------------------------- https://lwn.net/Articles/917398/ ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (leptonlib), Fedora (woff), Red Hat (grub2), Slackware (emacs), SUSE (busybox, chromium, java-1_8_0-openjdk, netatalk, and rabbitmq-server), and Ubuntu (gcc-5, gccgo-6, glibc, protobuf, and python2.7, python3.10, python3.6, python3.8). --------------------------------------------- https://lwn.net/Articles/917530/ ∗∗∗ Synology-SA-22:23 PWN2OWN TORONTO 2022 ∗∗∗ --------------------------------------------- Multiple vulnerabilities reported by PWN2OWN TORONTO 2022 have been addressed. --------------------------------------------- https://www.synology.com/en-global/support/security/Synology_SA_22_23 ∗∗∗ AMI MegaRAC SP-X BMC Vulnerabilities ∗∗∗ --------------------------------------------- https://support.lenovo.com/product_security/PS500535-AMI-MEGARAC-SP-X-BMC-V… ∗∗∗ Security Advisory - Denial of Service Vulnerability in Huawei Smart WiFi Router ∗∗∗ --------------------------------------------- https://www.huawei.com/en/psirt/security-advisories/2022/huawei-sa-dosvihsw… ∗∗∗ K87046687: VMware Tools vulnerability CVE-2022-31676 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K87046687 ∗∗∗ Advantech iView ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-22-342-01 ∗∗∗ AVEVA InTouch Access Anywhere ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-22-342-02 ∗∗∗ Rockwell Automation Logix controllers ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-22-342-03 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 07.12.2022
by Daily end-of-shift report 07 Dec '22

07 Dec '22

===================== = End-of-Day report = ===================== Timeframe: Dienstag 06-12-2022 18:00 − Mittwoch 07-12-2022 18:00 Handler: Stephan Richter Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ For Cyberattackers, Popular EDR Tools Can Turn into Destructive Data Wipers ∗∗∗ --------------------------------------------- Microsoft, three others release patches to fix a vulnerability in their respective products that enables such manipulation. Other EDR products potentially are affected as well. --------------------------------------------- https://www.darkreading.com/vulnerabilities-threats/cyberattackers-popular-… ∗∗∗ DEV-0139 launches targeted attacks against the cryptocurrency industry ∗∗∗ --------------------------------------------- Microsoft security researchers investigate an attack where the threat actor, tracked DEV-0139, used chat groups to target specific cryptocurrency investment companies and run a backdoor within their network. --------------------------------------------- https://www.microsoft.com/en-us/security/blog/2022/12/06/dev-0139-launches-… ∗∗∗ New Go-based Botnet Exploiting Exploiting Dozens of IoT Vulnerabilities to Expand its Network ∗∗∗ --------------------------------------------- A novel Go-based botnet called Zerobot has been observed in the wild proliferating by taking advantage of nearly two dozen security vulnerabilities in the internet of things (IoT) devices and other software. --------------------------------------------- https://thehackernews.com/2022/12/new-go-based-zerobot-botnet-exploiting.ht… ∗∗∗ ChatGPT shows promise of using AI to write malware ∗∗∗ --------------------------------------------- For even the most skilled hackers, it can take at least an hour to write a script to exploit a software vulnerability and infiltrate their target. Soon, a machine may be able to do it in mere seconds. --------------------------------------------- https://www.cyberscoop.com/chatgpt-ai-malware/ ∗∗∗ So schützen Sie sich vor Scams ∗∗∗ --------------------------------------------- Beim Scamming - auch Vorschussbetrug genannt - versuchen Kriminelle, Sie zu einer Vorauszahlung zu drängen. Sie werden beispielsweise mit einem Millionengewinn, einer Erbschaft oder einem günstigen Kreditangebot geködert. --------------------------------------------- https://www.watchlist-internet.at/news/so-schuetzen-sie-sich-vor-scams/ ∗∗∗ OpenSSL punycode – with hindsight ∗∗∗ --------------------------------------------- The next Heartbleeds were about to be announced, two critical vulnerabilities that affect everyone and everything, everywhere. And then they were released. And everyone was let down. --------------------------------------------- https://blog.checkpoint.com/2022/12/07/openssl-punycode-with-hindsight/ ∗∗∗ Malware Distributed with Disguised Filenames (RIGHT-TO-LEFT OVERRIDE) ∗∗∗ --------------------------------------------- In August, the ASEC analysis team made a post on the malware being distributed with filenames that utilize RTLO (Right-To-Left Override). --------------------------------------------- https://asec.ahnlab.com/en/43518/ ∗∗∗ Industry 4.0: CNC Machine Security Risks Part 3 ∗∗∗ --------------------------------------------- This three-part blog series explores the risks associated with CNC machines --------------------------------------------- https://www.trendmicro.com/en_us/research/22/l/cnc-machine-security-risks-p… ===================== = Vulnerabilities = ===================== ∗∗∗ Fortinet schließt Sicherheitslücken in mehreren Produkten ∗∗∗ --------------------------------------------- Für zahlreiche Produkte aus dem Portfolio hat Fortinet Sicherheitsupdates herausgegeben. Sie schließen teils hochriskante Schwachstellen. --------------------------------------------- https://heise.de/-7368520 ∗∗∗ Dienste-Monitoring: Angreifer können Cacti beliebigen Code unterschieben ∗∗∗ --------------------------------------------- In der Webanwendung Cacti, die etwa zur Diensteüberwachung dient, könnten Angreifer beliebigen Code einschleusen und ausführen. Ein Patch ist verfügbar. --------------------------------------------- https://heise.de/-7369455 ∗∗∗ Jetzt patchen: Fehlkonfiguration in Netgear-Router lässt Angreifer auf das Gerät ∗∗∗ --------------------------------------------- Forscher warnen vor Fremdzugriffen auf den Nighthawk WiFi 6 Router von Netgear. Ein Update ist verfügbar, soll sich aber nicht automatisch installieren. --------------------------------------------- https://heise.de/-7369071 ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (cgal, ruby-rails-html-sanitizer, and xfce4-settings), Red Hat (dbus, grub2, kernel, pki-core, and usbguard), Scientific Linux (pki-core), SUSE (bcel, LibVNCServer, and xen), and Ubuntu (ca-certificates and u-boot). --------------------------------------------- https://lwn.net/Articles/917208/ ∗∗∗ Cross-Site Scripting in Handy Macros for Confluence (SYSS-2022-049) ∗∗∗ --------------------------------------------- Durch eine Cross-Site Scripting-Schwachstelle im "Handy Tip"-Makro in Handy Macros for Confluence kann ausführbarer Schadcode in Seiten eingebaut werden. --------------------------------------------- https://www.syss.de/pentest-blog/cross-site-scripting-in-handy-macros-for-c… ∗∗∗ K35253541: Java vulnerabilities CVE-2020-14779, CVE-2020-14781, CVE-2020-14782, CVE-2020-14797 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K35253541 ∗∗∗ K71522481: Java vulnerability CVE-2021-2163 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K71522481 ∗∗∗ Sprecher SPRECON-E-C/-E-P/-E-T3: Schwachstelle in der Firmwareverifikation ∗∗∗ --------------------------------------------- https://www.sprecher-automation.com/it-sicherheit/security-alerts -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 06.12.2022
by Daily end-of-shift report 06 Dec '22

06 Dec '22

===================== = End-of-Day report = ===================== Timeframe: Montag 05-12-2022 18:00 − Dienstag 06-12-2022 18:00 Handler: Thomas Pribitzer Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Hackers hijack Linux devices using PRoot isolated filesystems ∗∗∗ --------------------------------------------- Hackers are abusing the open-source Linux PRoot utility in BYOF (Bring Your Own Filesystem) attacks to provide a consistent repository of malicious tools that work on many Linux distributions. --------------------------------------------- https://www.bleepingcomputer.com/news/security/hackers-hijack-linux-devices… ∗∗∗ Sneaky hackers reverse defense mitigations when detected ∗∗∗ --------------------------------------------- A financially motivated threat actor is hacking telecommunication service providers and business process outsourcing firms, actively reversing defensive mitigations applied when the breach is detected. --------------------------------------------- https://www.bleepingcomputer.com/news/security/sneaky-hackers-reverse-defen… ∗∗∗ Mirai Botnet and Gafgyt DDoS Team Up Against SOHO Routers., (Tue, Dec 6th) ∗∗∗ --------------------------------------------- Since 2014, self-replicating variants of DDoS attacks against routers and Linux-based IoT devices have been rampant. Gafgyt botnets target vulnerable IoT devices and use them to launch large-scale distributed denial-of-service attacks. SOHO and IoT devices are ubiquitous, less likely to have secure configurations or routine patches, and more likely to be at the internet edge. --------------------------------------------- https://isc.sans.edu/diary/rss/29304 ∗∗∗ Building A Virtual Machine inside ChatGPT ∗∗∗ --------------------------------------------- Did you know, that you can run a whole virtual machine inside of ChatGPT? --------------------------------------------- https://www.engraved.blog/building-a-virtual-machine-inside/ ∗∗∗ Exploring Prompt Injection Attacks ∗∗∗ --------------------------------------------- Prompt Injection is a new vulnerability that is affecting some AI/ML models and, in particular, certain types of language models using prompt-based learning. --------------------------------------------- https://research.nccgroup.com/2022/12/05/exploring-prompt-injection-attacks/ ∗∗∗ Phishing-Mail „Erneut identifizieren“ im Namen der WKO ignorieren! ∗∗∗ --------------------------------------------- Unternehmerinnen und Unternehmer aufgepasst: Aktuell versenden Kriminelle Phishing-Mails im Namen der Wirtschaftskammer Österreich. Man spielt Ihnen vor, dass eine neuerliche Identifikation notwendig wäre. Ignorieren Sie die Nachricht, denn auf der verlinkten Website eingegebene Daten landen in den Händen Krimineller. --------------------------------------------- https://www.watchlist-internet.at/news/phishing-mail-erneut-identifizieren-… ∗∗∗ Vice Society: Profiling a Persistent Threat to the Education Sector ∗∗∗ --------------------------------------------- Vice Society, a ransomware gang, has been involved in high-profile activity against schools this year. --------------------------------------------- https://unit42.paloaltonetworks.com/vice-society-targets-education-sector/ ∗∗∗ Tractors vs. threat actors: How to hack a farm ∗∗∗ --------------------------------------------- Forget pests for a minute. Modern farms also face another – and more insidious – breed of threat. --------------------------------------------- https://www.welivesecurity.com/2022/12/05/tractors-threat-actors-how-hack-f… ===================== = Vulnerabilities = ===================== ∗∗∗ NETGEAR Nighthawk WiFi6 Router Network Misconfiguration ∗∗∗ --------------------------------------------- A network misconfiguration is present in versions prior to 1.0.9.90 of the NETGEAR RAX30 AX2400 series of routers. --------------------------------------------- https://www.tenable.com/security/research/tra-2022-36 ∗∗∗ Patchday: Schadcode über Bluetooth auf Android-Geräte schieben ∗∗∗ --------------------------------------------- Es gibt wichtige Sicherheitsupdates für Android 10, 11, 12, 12L und 13. Google hat unter anderem vier kritische Lücken geschlossen. --------------------------------------------- https://heise.de/-7367211 ∗∗∗ Virenschutz: Rechteausweitung durch Schwachstelle in AVG und Avast ∗∗∗ --------------------------------------------- Die Virenscanner von AVG und Avast hätten Angreifern ermöglichen können, ihre Rechte im System auszuweiten. Updates zum Beheben des Fehlers sind verfügbar. --------------------------------------------- https://heise.de/-7367529 ∗∗∗ Schwachstelle in Trend Micros Apex One ermöglicht Rechteausweitung ∗∗∗ --------------------------------------------- Der Virenschutz Apex One von Trend Micro enthält Sicherheitslücken, durch die Angreifer ihre Rechte ausweiten oder Dateien auf dem System löschen lassen können. --------------------------------------------- https://heise.de/-7367824 ∗∗∗ Server-Wartung: Gefährliche BMC-Lücken könnte Supply-Chain-Attacken auslösen ∗∗∗ --------------------------------------------- Sicherheitsforscher sind unter anderem auf eine kritische Sicherheitslücke in Baseboard Management Controllern von American Megatrend gestoßen. --------------------------------------------- https://heise.de/-7367963 ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Ubuntu (binutils and ca-certificates). --------------------------------------------- https://lwn.net/Articles/917080/ ∗∗∗ Schwachstelle in Citrix Workspace App for Windows ermöglicht Passwort-Klau ∗∗∗ --------------------------------------------- Der Hersteller Citrix warnt seit September 2022 vor einiger Schwachstelle in seiner Citrix Workspace App. --------------------------------------------- https://www.borncity.com/blog/2022/12/06/schwachstelle-in-citrix-workspace-… ∗∗∗ Vulnerability Spotlight: NVIDIA driver memory corruption vulnerabilities discovered ∗∗∗ --------------------------------------------- Cisco Talos recently discovered two memory corruption vulnerabilities in shader functionality of an NVIDIA driver. --------------------------------------------- https://blog.talosintelligence.com/vulnerability-spotlight-nvidia-driver-me… ∗∗∗ Multiple critical vulnerabilities in ILIAS eLearning platform ∗∗∗ --------------------------------------------- https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulner… ∗∗∗ XSA-424 ∗∗∗ --------------------------------------------- https://xenbits.xen.org/xsa/advisory-424.html ∗∗∗ XSA-423 ∗∗∗ --------------------------------------------- https://xenbits.xen.org/xsa/advisory-423.html ∗∗∗ Edge 108.0.1462.42 als Sicherheitsupdate ∗∗∗ --------------------------------------------- https://www.borncity.com/blog/2022/12/06/edge-108-0-1462-41-42-als-sicherhe… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 05.12.2022
by Daily end-of-shift report 05 Dec '22

05 Dec '22

===================== = End-of-Day report = ===================== Timeframe: Freitag 02-12-2022 18:00 − Montag 05-12-2022 18:00 Handler: Thomas Pribitzer Co-Handler: n/a ===================== = News = ===================== ∗∗∗ BlackProxies proxy service increasingly popular among hackers ∗∗∗ --------------------------------------------- A new residential proxy market is becoming popular among hackers, cybercriminals, phishers, scalpers, and scammers, selling access to a million claimed proxy IP addresses worldwide. --------------------------------------------- https://www.bleepingcomputer.com/news/security/blackproxies-proxy-service-i… ∗∗∗ Hackers use new, fake crypto app to breach networks, steal cryptocurrency ∗∗∗ --------------------------------------------- The North Korean Lazarus hacking group is linked to a new attack spreading fake cryptocurrency apps under the made-up brand, "BloxHolder," to install the AppleJeus malware for initial access to networks and steal crypto assets. --------------------------------------------- https://www.bleepingcomputer.com/news/security/hackers-use-new-fake-crypto-… ∗∗∗ If one sheep leaps over the ditch… ∗∗∗ --------------------------------------------- In this report, Kaspersky researchers discuss propagation methods of several ransomware families, and a vulnerable driver abuse case that may become a trend. --------------------------------------------- https://securelist.com/crimeware-report-ransomware-tactics-vulnerable-drive… ∗∗∗ OWASP Top 10 CI/CD Security Risks ∗∗∗ --------------------------------------------- This document helps defenders identify focus areas for securing their CI/CD ecosystem. It is the result of extensive research into attack vectors associated with CI/CD, and the analysis of high profile breaches and security flaws. --------------------------------------------- https://owasp.org/www-project-top-10-ci-cd-security-risks/ ∗∗∗ #StopRansomware: Cuba Ransomware Alert (AA22-335A) ∗∗∗ --------------------------------------------- This joint Cybersecurity Advisory (CSA) is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. --------------------------------------------- https://www.cisa.gov/uscert/ncas/alerts/aa22-335a ∗∗∗ CryWiper: Fake-Ransomware zerstört Daten insbesondere in Russland ∗∗∗ --------------------------------------------- Die Virenanalysten von Kaspersky haben den Schädling CryWiper entdeckt, der sich als Ransomware ausgibt, Daten aber unwiderbringlich zerstört. --------------------------------------------- https://heise.de/-7366160 ===================== = Vulnerabilities = ===================== ∗∗∗ Severe AMI MegaRAC flaws impact servers from AMD, ARM, HPE, Dell, others ∗∗∗ --------------------------------------------- Three vulnerabilities in the American Megatrends MegaRAC Baseboard Management Controller (BMC) software impact server equipment used in many cloud service and data center providers. --------------------------------------------- https://www.bleepingcomputer.com/news/security/severe-ami-megarac-flaws-imp… ∗∗∗ Sicherheitsupdate: Schadcode könnte durch Sophos-Firewalls schlüpfen ∗∗∗ --------------------------------------------- Die Entwickler des Sicherheitssoftware-Anbieters Sophos haben in hauseigenen Firewalls sieben Sicherheitslücken geschlossen. Eine gilt als kritisch. --------------------------------------------- https://heise.de/-7366076 ∗∗∗ Sicherheitslücke: Codeschmuggel mit Ping in FreeBSD ∗∗∗ --------------------------------------------- Angreifer könnten FreeBSD mit manipulierten Ping-Anfragen zum Ausführen untergejubelten Schadcodes bringen. Aktualisierungen stehen bereit. --------------------------------------------- https://heise.de/-7366590 ∗∗∗ Notfall-Update: Zero-Day-Sicherheitslücke in Google Chrome unter Beschuss ∗∗∗ --------------------------------------------- Google hat ein ungeplantes Update für Chrome herausgegeben. Damit schließt der Hersteller eine Sicherheitslücke im Webbrowser, die derzeit angegriffen wird. --------------------------------------------- https://heise.de/-7365415 ∗∗∗ Veritas NetBackup: Update schließt teils kritische Scherheitslücken ∗∗∗ --------------------------------------------- In Veritas NetBackup Flex Scale und Access Appliance könnten Angreifer aus dem Netz ohne Anmeldung Befehle einschleusen. Hotfixes beheben die Fehler. --------------------------------------------- https://heise.de/-7365984 ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (awstats, chromium, clamav, g810-led, giflib, http-parser, jhead, libpgjava, node-cached-path-relative, node-fetch, and vlc), Fedora (fastnetmon, kernel, librime, qpress, rr, thunderbird, and wireshark), Red Hat (kernel, kernel-rt, and kpatch-patch), Slackware (mozilla), SUSE (cherrytree and chromium), and Ubuntu (libbpf, libxml2, linux-gcp-5.15, linux-gke, linux-gke-5.15, and linux-gke). --------------------------------------------- https://lwn.net/Articles/916979/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 02.12.2022
by Daily end-of-shift report 02 Dec '22

02 Dec '22

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 01-12-2022 18:00 − Freitag 02-12-2022 18:00 Handler: Michael Schlagenhaufer Co-Handler: Robert Waldner ===================== = News = ===================== ∗∗∗ Unpatched Redis servers targeted in new Redigo malware attacks ∗∗∗ --------------------------------------------- A new Go-based malware threat that researchers call Redigo has been targeting Redis servers vulnerable to CVE-2022-0543 to plant a stealthy backdoor and allow command execution. --------------------------------------------- https://www.bleepingcomputer.com/news/security/unpatched-redis-servers-targ… ∗∗∗ Samsung, Mediatek, LG: Android-Malware mit OEM-Zertifikaten signiert ∗∗∗ --------------------------------------------- Google hat Malware gefunden, die mit den Zertifikaten von Android-Herstellern signiert sind. Das kann für Systemberechtigungen genutzt werden. --------------------------------------------- https://www.golem.de/news/samsung-mediatek-lg-android-malware-mit-oem-zerti… ∗∗∗ obama224 distribution Qakbot tries .vhd (virtual hard disk) images, (Fri, Dec 2nd) ∗∗∗ --------------------------------------------- Qakbot (also called Qbot) is a long-running malware family that has seen wide-spread distribution through malicious spam (malspam) in recent years. During an infection, Qakbot performs different functions as an information stealer, backdoor, and malware downloader. --------------------------------------------- https://isc.sans.edu/diary/rss/29294 ∗∗∗ Researchers Find a Way Malicious NPM Libraries Can Evade Vulnerability Detection ∗∗∗ --------------------------------------------- New findings from cybersecurity firm JFrog show that malware targeting the npm ecosystem can evade security checks by taking advantage of an "unexpected behavior" in the npm command line interface (CLI) tool. --------------------------------------------- https://thehackernews.com/2022/11/researchers-find-way-malicious-npm.html ∗∗∗ Flaws in GX Works3 Threaten Mitsubishi Electric Safety PLC Security ∗∗∗ --------------------------------------------- In this blog, we uncover three additional vulnerabilities that affect Mitsubishi Electric GX Works3, tracked under CVE-2022-29831, CVE-2022-29832, and CVE-2022-29833 (Mitsubishi Electric advisory 2022-015, CISA advisory ICSA-22-333-05), and that, in the worst-case scenario, may lead to the compromise of safety PLCs with the only requirement being the possession of associated GX Works3 project files. --------------------------------------------- https://www.nozominetworks.com/blog/flaws-in-gx-works3-threaten-mitsubishi-… ∗∗∗ Jetzt patchen! Angreifer attackieren Firewalls und Proxies von Fortinet ∗∗∗ --------------------------------------------- Sicherheitsforscher warnen vor Attacken auf Firmen. Der Grund ist eine kritische Lücke in Fortinet-Produkten. --------------------------------------------- https://heise.de/-7364286 ∗∗∗ Wordpress: Attackiert schon während der Installation ∗∗∗ --------------------------------------------- Noch bevor das System live geht, haben Angreifer es oft unbemerkt mit Hintertüren versehen. Die stehen nämlich schon nach wenigen Minuten auf der Matte. --------------------------------------------- https://heise.de/-7364588 ∗∗∗ IBM Cloud Vulnerability Exposed Users to Supply Chain Attacks ∗∗∗ --------------------------------------------- IBM recently patched a vulnerability in IBM Cloud Databases for PostgreSQL that could have exposed users to supply chain attacks. The vulnerability has been named Hell’s Keychain by cloud security firm Wiz, whose researchers discovered the issue. It has been described by the company as a “first-of-its-kind supply-chain attack vector impacting a cloud provider’s infrastructure”. --------------------------------------------- https://www.securityweek.com/ibm-cloud-vulnerability-exposed-users-supply-c… ∗∗∗ Three Innocuous Linux Vulnerabilities Chained to Obtain Full Root Privileges ∗∗∗ --------------------------------------------- Qualys’ Threat Research Unit has shown how a new Linux vulnerability could be chained with two other apparently harmless flaws to gain full root privileges on an affected system. --------------------------------------------- https://www.securityweek.com/three-innocuous-linux-vulnerabilities-chained-… ∗∗∗ Blowing Cobalt Strike Out of the Water With Memory Analysis ∗∗∗ --------------------------------------------- Unit 42 researchers examine several malware samples that incorporate Cobalt Strike components, and discuss some of the ways that we catch these samples by analyzing artifacts from the deltas in process memory at key points of execution. We will also discuss the evasion tactics used by these threats, and other issues that make their analysis problematic. --------------------------------------------- https://unit42.paloaltonetworks.com/cobalt-strike-memory-analysis/ ∗∗∗ Protecting major events: an incident response blueprint ∗∗∗ --------------------------------------------- Cisco Talos Incident Response (Talos IR) is sharing a white paper on the steps organizations should follow to secure any major event. These ten focus areas should help guide any organizing committee or participating businesses in preparation for securing such events. --------------------------------------------- https://blog.talosintelligence.com/protecting-major-events-an-incident-resp… ∗∗∗ Industry 4.0: CNC Machine Security Risks Part 2 ∗∗∗ --------------------------------------------- This three-part blog series explores the risks associated with CNC machines --------------------------------------------- https://www.trendmicro.com/en_us/research/22/l/cnc-machine-security-risks-p… ===================== = Vulnerabilities = ===================== ∗∗∗ IBM Security Bulletins 2022-12-01 ∗∗∗ --------------------------------------------- IBM Watson, IBM App Connect, Rational Functional Tester, IBM Security Guardium, IBM Cloud Object Storage Systems, IBM API Connect. --------------------------------------------- https://www.ibm.com/blogs/psirt/ ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (snapd), Fedora (firefox, libetpan, ntfs-3g, samba, thunderbird, and xen), SUSE (busybox, emacs, and virt-v2v), and Ubuntu (linux, linux-aws, linux-aws-5.15, linux-gcp, linux-gkeop, linux-hwe-5.15, linux-ibm, linux-intel-iotg, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-oracle, linux-oracle-5.15, linux-raspi, linux, linux-aws, linux-aws-5.4, linux-gcp, linux-gcp-5.4, linux-gkeop, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-kvm, linux-oracle, linux-oracle-5.4, linux-raspi, linux-raspi-5.4, linux, linux-aws, linux-dell300x, linux-gcp-4.15, linux-kvm, linux-oracle, linux-raspi2, linux-snapdragon, linux, linux-aws, linux-gcp, linux-ibm, linux-kvm, linux-lowlatency, linux-oracle, linux-raspi, linux, linux-aws, linux-kvm, linux-lts-xenial, linux-aws-hwe, linux-gcp, linux-hwe, linux-oracle, and tiff). --------------------------------------------- https://lwn.net/Articles/916658/ ∗∗∗ BD BodyGuard Pumps ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsma-22-335-01 ∗∗∗ Mitsubishi Electric MELSEC iQ-R Series ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-22-335-01 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 01.12.2022
by Daily end-of-shift report 01 Dec '22

01 Dec '22

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 30-11-2022 18:00 − Donnerstag 01-12-2022 18:00 Handler: Stephan Richter Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ New Windows malware scans victims’ mobile phones for data to steal ∗∗∗ --------------------------------------------- Security researchers found a previously unknown backdoor they call Dophin thats been used by North Korean hackers in highly targeted operations for more than a year to steal files and send them to Google Drive storage. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-windows-malware-scans-vi… ∗∗∗ New DuckLogs malware service claims having thousands of ‘customers’ ∗∗∗ --------------------------------------------- A new malware-as-a-service (MaaS) operation named DuckLogs has emerged, giving low-skilled attackers easy access to multiple modules to steal information, log key strokes, access clipboard data, and remote access to the compromised host. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-ducklogs-malware-service… ∗∗∗ Making unphishable 2FA phishable ∗∗∗ --------------------------------------------- One of the huge benefits of WebAuthn is that it makes traditional phishing attacks impossible. But what if there was a mechanism for an attacker to direct a user to a legitimate login page, resulting in a happy WebAuthn flow, and obtain valid credentials for that user anyway? --------------------------------------------- https://mjg59.dreamwidth.org/62175.html ∗∗∗ Whats the deal with these router vulnerabilities?, (Thu, Dec 1st) ∗∗∗ --------------------------------------------- Earlier today, I was browser recently made public vulnerabilities for tomorrow's version of our @Risk newsletter. What stuck out was a set of about twenty vulnerabilities in Netgear and DLink routers. --------------------------------------------- https://isc.sans.edu/diary/rss/29288 ∗∗∗ Sirius XM flaw unlocks so-called smart cars thanks to code flaw ∗∗∗ --------------------------------------------- Telematics program doesn't just give you music, but a big security flaw Sirius XMs Connected Vehicle Services has fixed an authorization flaw that would have allowed an attacker to remotely unlock doors and start engines on connected cars knowing only the vehicle identification number (VIN). --------------------------------------------- https://www.theregister.com/2022/11/30/siriusxm_connected_cars_hacking/ ∗∗∗ l+f: Sicherheitsforscher legen aus Versehen gesamtes Botnet KmsdBot lahm ∗∗∗ --------------------------------------------- Wie ein Typo kriminellen Machenschaften das Handwerk legt. --------------------------------------------- https://heise.de/-7363007 ∗∗∗ Vorsicht, wenn Sie ein SMS von Amazon erhalten ∗∗∗ --------------------------------------------- Kriminelle geben sich als Amazon aus und versenden gefälschte Benachrichtigungen. Im SMS steht, dass Ihr Amazon-Konto vorübergehend gesperrt wurde und Sie Informationen aktualisieren müssen. Dafür sollten Sie auf einen Link klicken. Achtung: Der Link führt zu einer gefälschten Login-Seite. Kriminelle stehlen damit Ihre Benutzer- und Kreditkartendaten! --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-wenn-sie-ein-sms-von-amazon… ∗∗∗ LastPass-Kundendaten nach Hack eines Cloud-Speicherdiensts abgezogen (Nov. 2022) ∗∗∗ --------------------------------------------- Der Dienst LastPass informierte vor einigen Stunden seine Kunden, dass kürzlich "ungewöhnliche Aktivitäten" bei einem Cloud-Speicherdienst eines Drittanbieters entdeckt wurden. --------------------------------------------- https://www.borncity.com/blog/2022/12/01/lastpass-kundendaten-nach-hack-ein… ∗∗∗ Vulnerability Spotlight: Lansweeper directory traversal and cross-site scripting vulnerabilities ∗∗∗ --------------------------------------------- Cisco Talos recently discovered several directory traversal and cross-site scripting vulnerabilities in Lansweeper. --------------------------------------------- https://blog.talosintelligence.com/vulnerability-spotlight-lansweeper-direc… ===================== = Vulnerabilities = ===================== ∗∗∗ Critical RCE bugs in Android remote keyboard apps with 2M installs ∗∗∗ --------------------------------------------- Three Android applications that allow users to use devices as remote keyboards for their computers have critical vulnerabilities that could expose key presses and enable remote code execution. --------------------------------------------- https://www.bleepingcomputer.com/news/security/critical-rce-bugs-in-android… ∗∗∗ IBM Security Bulletins 2022-11-30 ∗∗∗ --------------------------------------------- IBM API Connect, IBM MQ Operator and Queue manager container images, IBM Security Guardium, IBM Sterling Control Center, IBM Watson Discovery for IBM Cloud Pak for Data, IBM WebSphere Automation for IBM Cloud Pak for Watson AIOps, IBM Db2® on Cloud Pak for Data and Db2 Warehouse® on Cloud Pak for Data. --------------------------------------------- https://www.ibm.com/blogs/psirt/ ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by CentOS (device-mapper-multipath, firefox, hsqldb, krb5, thunderbird, and xorg-x11-server), Debian (libraw), Fedora (freerdp and grub2), SUSE (bcel, emacs, glib2, glibc, grub2, nodejs10, and tomcat), and Ubuntu (linux-azure-fde and snapd). --------------------------------------------- https://lwn.net/Articles/916443/ ∗∗∗ Open Social - Moderately critical - Access bypass - SA-CONTRIB-2022-062 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2022-062 ∗∗∗ Open Social - Moderately critical - Access bypass - SA-CONTRIB-2022-061 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2022-061 ∗∗∗ Social Base - Moderately critical - Access bypass - SA-CONTRIB-2022-060 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2022-060 ∗∗∗ Horner Automation Remote Compact Controller ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-22-335-02 ∗∗∗ Replay Angriffe & Darstellung beliebiger Inhalte in Zhuhai Suny Technology ESL Tag / ETAG-TECH protocol (electronic shelf labels) ∗∗∗ --------------------------------------------- https://sec-consult.com/de/vulnerability-lab/advisory/replay-attacks-displa… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily December 2022