Daily

daily@lists.cert.at

1 participants
3153 discussions

Tageszusammenfassung - 13.11.2019
by Daily end-of-shift report 13 Nov '19

13 Nov '19

===================== = End-of-Day report = ===================== Timeframe: Dienstag 12-11-2019 18:00 − Mittwoch 13-11-2019 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Network Traffic Analysis for IR: Address Resolution Protocol (ARP) with Wireshark ∗∗∗ --------------------------------------------- Introduction to the Address Resolution Protocol The Address Resolution Protocol (ARP) was first defined in RFC 826. As the name suggests, it is designed to resolve IP addresses into a form usable by other systems within a subnet. Network addressing works at a couple of different layers of the OSI model. --------------------------------------------- https://resources.infosecinstitute.com/address-resolution-protocol-arp-with… ∗∗∗ Schlüssel aus TPM-Chips lassen sich extrahieren ∗∗∗ --------------------------------------------- Mit einem Timing-Angriff lassen sich Signaturschlüssel auf Basis elliptischer Kurven aus TPM-Chips extrahieren. ... TPM-Chips sind in allen modernen PCs vorhanden und teilweise umstritten, da sie auch dazu genutzt werden können, Schutzmechanismen gegen den Willen des Nutzers umzusetzen. Trotz ihrer Verbreitung werden die Chips eher selten für kritische Applikationen genutzt, die Auswirkungen der Lücke dürften sich in Grenzen halten. --------------------------------------------- https://www.golem.de/news/tpm-fail-schluessel-aus-tpm-chips-lassen-sich-ext… ∗∗∗ GSM Traffic and Encryption: A5/1 Stream Cipher ∗∗∗ --------------------------------------------- This write-up documents some of my follow-up research with regard to analyzing the GSM traffic packets I captured using Software Defined Radio. My attempt was to better understand the GSM mobile network protocols and procedures, with an emphasis on the authentication and ciphering algorithms being deployed. --------------------------------------------- https://www.blackhillsinfosec.com/gsm-traffic-and-encryption-a5-1-stream-ci… ∗∗∗ Angriffe über USB und Bluetooth: Android-Smartphones verwundbar ∗∗∗ --------------------------------------------- Sicherheitsforscher haben Schwachstellen in mehreren älteren Android-Smartphones entdeckt, die sie über USB- und Bluetooth-Verbindungen ausnutzen konnten. --------------------------------------------- https://heise.de/-4584690 ∗∗∗ Seriöses Job-Angebot oder Auftrag zur Geldwäsche? ∗∗∗ --------------------------------------------- Auf diversen Job-Börsen und Kleinanzeigenportalen stoßen Arbeitssuchende momentan auf Angebote zur freien Mitarbeit der „TideBit Deutschland LTD“. Die Firma existiert in dieser Form nicht. Kriminelle missbrauchen den Namen eines Kryptowährungsunternehmens, um BewerberInnen zur Geldwäsche zu bringen. Wer die Aufgaben erfüllt, macht sich womöglich selbst strafbar. --------------------------------------------- https://www.watchlist-internet.at/news/serioeses-job-angebot-oder-auftrag-z… ===================== = Vulnerabilities = ===================== ∗∗∗ November 2019 security updates are available! ∗∗∗ --------------------------------------------- We have released the November security updates to provide additional protections against malicious attackers. As a best practice, we encourage customers to turn on automatic updates. More information about this month’s security updates can be found in the Security Update Guide. As a reminder, Windows 7 and Windows Server 2008 R2 will be out of extended support and no longer receiving updates as of January 14, 2020. --------------------------------------------- https://msrc-blog.microsoft.com:443/2019/11/12/november-2019-security-updat… ∗∗∗ Intel fixt Sicherheitslücken und enthüllt nebenbei eine neue ZombieLoad-Variante ∗∗∗ --------------------------------------------- Zum Patch Tuesday hat Intel 77 teils kritische Lücken gefixt, unter denen sich auch ein bislang geheim gehaltener Seitenkanalangriff befand. --------------------------------------------- https://heise.de/-4584543 ∗∗∗ VMSA-2019-0020 ∗∗∗ --------------------------------------------- VMware ESXi, Workstation, and Fusion patches provide Hypervisor-Specific Mitigations for Speculative-Execution Vulnerabilities (CVE-2018-12207, CVE-2019-11135) --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2019-0020.html ∗∗∗ VMSA-2019-0021 ∗∗∗ --------------------------------------------- VMware Workstation and Fusion updates address multiple security vulnerabilities (CVE-2019-5540, CVE-2019-5541, CVE-2019-5542) --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2019-0021.html ∗∗∗ VMSA-2019-0008.2 ∗∗∗ --------------------------------------------- VMware product updates enable Hypervisor-Specific Mitigations, Hypervisor-Assisted Guest Mitigations, and Operating System-Specific Mitigations for Microarchitectural Data Sampling (MDS) Vulnerabilities (CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, and CVE-2019-11091) --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2019-0008.html ∗∗∗ Xen Security Advisory CVE-2019-11135 / XSA-305 ∗∗∗ --------------------------------------------- A new way to sample data from microarchitectural structures has been identified. A TSX Asynchronous Abort is a state which occurs between a transaction definitely aborting (usually for reasons outside of the pipeline's control e.g. receiving an interrupt), and architectural state being rolled back to start of the transaction. During this period, speculative execution may be able to infer the value of data in the microarchitectural structures. --------------------------------------------- https://xenbits.xen.org/xsa/advisory-305.html ∗∗∗ Xen Security Advisory CVE-2018-12207 / XSA-304 ∗∗∗ --------------------------------------------- An erratum exists across some CPUs whereby an instruction fetch may cause a machine check error if the pagetables have been updated in a specific manner without invalidating the TLB. ... This corner case can be triggered by guest kernels. --------------------------------------------- https://xenbits.xen.org/xsa/advisory-304.html ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (dpdk, intel-microcode, kernel, libssh2, qemu, and webkit2gtk), Fedora (apache-commons-beanutils, bluez, iwd, kernel, kernel-headers, kernel-tools, libell, and microcode_ctl), openSUSE (gdb), Oracle (kernel), Red Hat (kernel and kernel-rt), SUSE (dhcp, evolution, kernel, libcaca, python, python-xdg, qemu, sysstat, ucode-intel, and xen), and Ubuntu (dpdk, intel-microcode, kernel, linux, linux-aws, ..., webkit2gtk) --------------------------------------------- https://lwn.net/Articles/804641/ ∗∗∗ Citrix Hypervisor Security Update ∗∗∗ --------------------------------------------- CTX263684 - A security issue has been identified in certain CPU hardware that may allow unprivileged code running on a CPU core to infer the value of memory data belonging to other processes, virtual machines or the hypervisor that are, or have recently been, running on the same CPU core. --------------------------------------------- https://support.citrix.com/article/CTX263684 ∗∗∗ Citrix ADC and Citrix Gateway Security Update (CVE-2019-0140) ∗∗∗ --------------------------------------------- CTX263807 - A vulnerability has been identified affecting Citrix Application Delivery Controller (ADC) formerly known as NetScaler ADC, and Citrix Gateway, formerly known as NetScaler Gateway, platforms which could result in privilege escalation via layer 2 network access on all network interfaces. --------------------------------------------- https://support.citrix.com/article/CTX263807 ∗∗∗ Cisco Prime Infrastructure and Evolved Programmable Network Manager Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco Identity Services Engine Cross-Site Scripting Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Security Advisory - Two Vulnerabilities in Some Huawei Products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191113-… ∗∗∗ Security Advisory - Improper File Management Vulnerability in Huawei Share ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191113-… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by kernel vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Security Bulletin: IBM NeXtScale Fan Power Controller (FPC) is affected by vulnerability in OpenSSL (CVE-2019-1559) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-nextscale-fan-power-c… ∗∗∗ libpcap vulnerability CVE-2019-15163 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K92862401?utm_source=f5support&utm_mediu… ∗∗∗ Hotfix XS80E008 - For Citrix Hypervisor 8.0 ∗∗∗ --------------------------------------------- https://support.citrix.com/article/CTX263663 ∗∗∗ Hotfix XS76E012 - For XenServer 7.6 ∗∗∗ --------------------------------------------- https://support.citrix.com/article/CTX263662 ∗∗∗ Hotfix XS71ECU2024 - For XenServer 7.1 Cumulative Update 2 ∗∗∗ --------------------------------------------- https://support.citrix.com/article/CTX263661 ∗∗∗ Hotfix XS70E075 - For XenServer 7.0 ∗∗∗ --------------------------------------------- https://support.citrix.com/article/CTX263660 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 12.11.2019
by Daily end-of-shift report 12 Nov '19

12 Nov '19

===================== = End-of-Day report = ===================== Timeframe: Montag 11-11-2019 18:00 − Dienstag 12-11-2019 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Threat Alert: TCP Amplification Attacks ∗∗∗ --------------------------------------------- TCP reflection attacks, such as SYN-ACK reflection attacks, have been less popular among attackers until recently. The lack of popularity was mainly due to the wrong assumption that TCP reflection attacks cannot generate enough amplification compared to UDP-based reflections. In general, TCP attacks are low bandwidth and less likely to saturate an internet link. --------------------------------------------- https://blog.radware.com/security/2019/11/threat-alert-tcp-reflection-attac… ∗∗∗ Tech Support Scammers Exploiting Unpatched Firefox Bug ∗∗∗ --------------------------------------------- Mozilla is working on addressing a Firefox bug that has been exploited by tech support scammers to lock the browser when users visit specially crafted websites. --------------------------------------------- https://www.securityweek.com/tech-support-scammers-exploiting-unpatched-fir… ∗∗∗ Netflix: Vorsicht vor betrügerischen Phishing-Mails ∗∗∗ --------------------------------------------- Aktuell häufen sich Meldungen über betrügerische E-Mails, die angeblich von Netflix stammen. Es sei ein Problem mit der Zahlungsabwicklung aufgetreten, sodass Netflix die Nutzungsgebühr nicht abbuchen kann und daher den Account vorübergehend gesperrt hat. Kriminelle fordern Netflix-NutzerInnen auf, die Kontoinformationen zu aktualisieren. Es handelt sich jedoch um Phishing! --------------------------------------------- https://www.watchlist-internet.at/news/netflix-vorsicht-vor-betruegerischen… ∗∗∗ This unusual new ransomware is going after servers ∗∗∗ --------------------------------------------- The previously undetected server-encrypting malware has been detailed in research by cyber security analysts at Intezer and IBM X-Force, who've named it PureLocker because it's written in written in the PureBasic programming language. ... It's currently uncertain how exactly PureLocker is delivered to victims, but researchers note that more_eggs campaigns begin with phishing emails, so the ransomware attacks could begin in the same way, with the final payload likely to be the final part of a multi-staged attack. --------------------------------------------- https://www.zdnet.com/article/this-unusual-new-ransomware-is-going-after-se… ===================== = Vulnerabilities = ===================== ∗∗∗ McAfee Patches Privilege Escalation Flaw in Antivirus Software ∗∗∗ --------------------------------------------- McAfee patched a security vulnerability discovered in all editions of its Antivirus software for Windows and enabling potential attackers to escalate privileges and execute code using SYSTEM privileges. --------------------------------------------- https://www.bleepingcomputer.com/news/security/mcafee-patches-privilege-esc… ∗∗∗ Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- A vulnerability in the implementation of the Lua interpreter integrated in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code with root privileges on the underlying Linux operating system of an affected device. --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Adobe Security Bulletins ∗∗∗ --------------------------------------------- Adobe has published security bulletins for Adobe Animate CC (APSB19-34), Adobe Illustrator CC (APSB19-36), Adobe Media Encoder (APSB19-52) and Adobe Bridge CC (APSB19-53). --------------------------------------------- https://blogs.adobe.com/psirt/?p=1801 ∗∗∗ Sicherheitsupdate: Magento-Onlineshops von Schadcode-Attacken gefährdet ∗∗∗ --------------------------------------------- Wer einen Onlineshop mit Magento-Software betreibt, sollte aus Sicherheitsgründen zügig die aktuelle Version installieren. --------------------------------------------- https://heise.de/-4584383 ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Fedora (community-mysql, crun, java-latest-openjdk, and mupdf), openSUSE (libssh2_org), and SUSE (go1.12, libseccomp, and tar). --------------------------------------------- https://lwn.net/Articles/804412/ ∗∗∗ Synology-SA-19:38 Synology Assistant ∗∗∗ --------------------------------------------- A vulnerability allows remote attackers to conduct denial-of-service attacks via a susceptible version of Synology Assistant. --------------------------------------------- https://www.synology.com/en-global/support/security/Synology_SA_19_38 ∗∗∗ SAP Security Patch Day – November 2019 ∗∗∗ --------------------------------------------- On 12th of November 2019, SAP Security Patch Day saw the release of 12 Security Notes. There are 3 updates to previously released Patch Day Security Notes. --------------------------------------------- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528880390 ∗∗∗ Security Bulletin: IBM Tivoli Netcool Impact is affected by an Apache ActiveMQ vulnerability (CVE-2018-11775) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-tivoli-netcool-impact… ∗∗∗ Security Bulletin: Incorrect permissions on restored files and directories on Windows using IBM Spectrum Protect Plus (CVE-2019-4652) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-incorrect-permissions-on-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in Java affect IBM Spectrum Protect Plus ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: IBM Tivoli Netcool Impact Configuration and Deployment Management Clickjacking ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-tivoli-netcool-impact… ∗∗∗ Security Bulletin: IBM Tivoli Netcool Impact is affected by a jQuery vulnerability (CVE-2015-9251) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-tivoli-netcool-impact… ∗∗∗ Security Bulletin: IBM Tivoli Netcool Impact is affected by a jQuery vulnerability (CVE-2019-11358) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-tivoli-netcool-impact… ∗∗∗ SSA-686531 (Last Update: 2019-11-12): Hardware based manufacturing access on S7-1200 ∗∗∗ --------------------------------------------- https://cert-portal.siemens.com/productcert/pdf/ssa-686531.pdf ∗∗∗ SSA-616472 (Last Update: 2019-11-12): ZombieLoad and Microarchitectural Data Sampling Vulnerabilities in Industrial Products ∗∗∗ --------------------------------------------- https://cert-portal.siemens.com/productcert/pdf/ssa-616472.pdf ∗∗∗ SSA-898181 (Last Update: 2019-11-12): Desigo PX Web Remote Denial of Service Vulnerability ∗∗∗ --------------------------------------------- https://cert-portal.siemens.com/productcert/pdf/ssa-898181.pdf ∗∗∗ SSA-434032 (Last Update: 2019-11-12): Vulnerability in Mentor Nucleus Networking Module ∗∗∗ --------------------------------------------- https://cert-portal.siemens.com/productcert/pdf/ssa-434032.pdf ∗∗∗ Multiple tcpdump vulnerabilities ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K44551633 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 11.11.2019
by Daily end-of-shift report 11 Nov '19

11 Nov '19

===================== = End-of-Day report = ===================== Timeframe: Freitag 08-11-2019 18:00 − Montag 11-11-2019 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ DDoS attacks in Q3 2019 ∗∗∗ --------------------------------------------- Statistically, Q3 2019 differs little from Q2. In terms of geographical distribution of attacks and targets, we saw a continuation of the now familiar trend of unexpected guests appearing, only to drop out the next quarter. --------------------------------------------- https://securelist.com/ddos-report-q3-2019/94958/ ∗∗∗ Vulnerable Versions of Adminer as a Universal Infection Vector ∗∗∗ --------------------------------------------- This past week, we’ve been monitoring a new wave of website infections mostly impacting WordPress and Magento websites. We found that hackers have been injecting scripts from scripts.trasnaltemyrecords[.]com into multiple files and database tables. This is still the same ongoing campaign that we’ve been following for the past few years, where site visitors are redirected to various kinds of scam landing pages—including tech support scams, fake lottery wins, and malicious [...] --------------------------------------------- https://blog.sucuri.net/2019/11/vulnerable-versions-of-adminer-as-a-univers… ∗∗∗ Ring Video Doorbell Pro: Mitteilsame IoT-Türklingel verriet WLAN-Zugangsdaten ∗∗∗ --------------------------------------------- Eine Klingel, die Besucher sicht- und hörbar macht, hätte Angreifern unbemerkt vollen WLAN-Zugriff verschaffen können. Automatische Updates wurden verteilt. --------------------------------------------- https://heise.de/-4583764 ∗∗∗ Sofortübersetzer von Muama Enence hält nicht, was er verspricht ∗∗∗ --------------------------------------------- Ein Gerät, das 32 Sprachen unmittelbar übersetzt und Verständigungsprobleme im Urlaub oder bei Geschäftstätigkeiten beseitigt, klingt erstmal hervorragend! Dies verspricht die UAB Ekomlita mit dem MUAMA Enence Instant Translator. Doch Vorsicht: Hier werden mitunter wichtige Informationen zum Produkt verheimlicht, es kommt zu groben Problemen beim Rücktritt und wir hegen Bedenken zum Datenschutz! --------------------------------------------- https://www.watchlist-internet.at/news/sofortuebersetzer-von-muama-enence-h… ∗∗∗ Apples Siri unterwandert E-Mail-Verschlüsselung ∗∗∗ --------------------------------------------- Nachrichten werden unter macOS im Klartext lokal gespeichert – Fehlerbereinigung laut Apple in Arbeit --------------------------------------------- https://www.derstandard.at/story/2000110928043/apples-siri-unterwandert-e-m… ===================== = Vulnerabilities = ===================== ∗∗∗ Jira Service Desk Security Advisory 2019-11-06 ∗∗∗ --------------------------------------------- CVE-2019-15003 - Authorization bypass allows information disclosure CVE-2019-15004 - URL path traversal allows information disclosure --------------------------------------------- https://confluence.atlassian.com/jira/jira-service-desk-security-advisory-2… ∗∗∗ UniFi Video Server Privilege Escalation From user to SYSTEM via unauthenticated command execution ∗∗∗ --------------------------------------------- The vulnerability, or feature depending how you look at it, is the ability to execute commands using the evostream API interface that is exposed on localhost:7440. --------------------------------------------- https://hackerone.com/reports/544928 ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (ampache, chromium, djvulibre, firefox-esr, gdal, and ruby-haml), Fedora (chromium, file, gd, hostapd, nspr, and rssh), openSUSE (bcm20702a1-firmware, firefox, gdal, libtomcrypt, php7, python-ecdsa, python3, samba, and thunderbird), SUSE (apache2-mod_auth_openidc, libssh2_org, and rsyslog), and Ubuntu (bash). --------------------------------------------- https://lwn.net/Articles/804325/ ∗∗∗ Security Bulletin: IBM QRadar SIEM is vulnerable to multiple Kernel vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-qradar-siem-is-vulner… ∗∗∗ Security Bulletin: IBM RackSwitch firmware products are affected by TCP denial of service vulnarabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-rackswitch-firmware-p… ∗∗∗ Security Bulletin: IBM Tivoli Netcool Impact is affected by an Apache Camel vulnerability (CVE-2019-0188) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-tivoli-netcool-impact… ∗∗∗ Security Bulletin: Node.js lodash vulnerability affects IBM Spectrum Control (formerly Tivoli Storage Productivity Center) ( CVE-2019-10744) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-node-js-lodash-vulnerabil… ∗∗∗ Security Bulletin: IBM Flex System Chassis Management Module (CMM) is affected by vulnerability in SQLite (CVE-2018-20346) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-flex-system-chassis-m… ∗∗∗ Security Bulletin: IBM QRadar SIEM is vulnerable to Jetty Vulnerabilities (CVE-2017-7656, CVE-2017-7657, CVE-2017-7658, CVE-2018-12536) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-qradar-siem-is-vulner… ∗∗∗ Security Bulletin: IBM Tivoli Netcool Impact is affected by an Apache Camel vulnerability (CVE-2019-0194) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-tivoli-netcool-impact… ∗∗∗ Security Bulletin: IBM QRadar SIEM is vulnerable to cross site scripting (XSS) (CVE-2019-4470) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-qradar-siem-is-vulner… ∗∗∗ Security Bulletin: Multiple vulnerabilities in Python affect IBM i ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: IBM QRadar SIEM is vulnerable to Intel Microarchitectural Data Sampling (MDS) Vulnerabilites ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-qradar-siem-is-vulner… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 08.11.2019
by Daily end-of-shift report 08 Nov '19

08 Nov '19

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 07-11-2019 18:00 − Freitag 08-11-2019 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Microsoft Warns of More Harmful Windows BlueKeep Attacks, Patch Now ∗∗∗ --------------------------------------------- The Microsoft Defender ATP Research Team says that the BlueKeep attacks detected on November 2 are connected with a coin mining campaign from September that used the same command-and-control (C2) infrastructure. --------------------------------------------- https://www.bleepingcomputer.com/news/security/microsoft-warns-of-more-harm… ∗∗∗ QNAP Warns Users to Secure Devices Against QSnatch Malware ∗∗∗ --------------------------------------------- Network-attached storage (NAS) maker QNAP urges customers to secure their NAS devices against an ongoing malicious campaign that infects them with QSnatch malware capable of stealing user credentials. --------------------------------------------- https://www.bleepingcomputer.com/news/security/qnap-warns-users-to-secure-d… ∗∗∗ Amazon Kindle, Embedded Devices Open to Code-Execution ∗∗∗ --------------------------------------------- Flaws in Das U-Boot affect third-party hardware that uses the universal bootloader as an underlying component. --------------------------------------------- https://threatpost.com/amazon-kindle-embedded-devices-code-execution/150003/ ∗∗∗ Pwn2Own Tokyo Roundup: Amazon Echo, Routers and Smart TVs Fall to Hackers ∗∗∗ --------------------------------------------- The latest edition of the bi-annual hacking contest saw creative exploits in new device categories. --------------------------------------------- https://threatpost.com/pwn2own-tokyo-2019-amazon-echo-hackers/150033/ ∗∗∗ Microsoft Apps Diverted from Their Main Use, (Fri, Nov 8th) ∗∗∗ --------------------------------------------- This week, the CERT.eu[1] organized its yearly conference in Brussels. Across many interesting presentations, one of them covered what they called the "catnmouse" game that Blue and Red teams are playing continuously. When the Blue team has detected an attack technique, they write a rule or implement a new control to detect or block it. Then, the Red team has to find an alternative attack path, [...] --------------------------------------------- https://isc.sans.edu/diary/rss/25502 ∗∗∗ Skimmers for Both Magento and WordPress ∗∗∗ --------------------------------------------- We often write about malware that steal payment information from sites built with Magento and other types of e-commerce CMS. When discussing credit card skimmers like Magecart, it’s sometimes overlooked that WordPress also has a decent share in the ecommerce segment. There are numerous popular plugins that can easily turn a WordPress site into a full-featured online store. In fact, Woocommerce alone has over 5 million installations. --------------------------------------------- https://blog.sucuri.net/2019/11/skimmers-for-both-magento-and-wordpress.html ∗∗∗ Wireshark Tutorial: Examining Trickbot Infections ∗∗∗ --------------------------------------------- A tutorial offering tips on how to identify Trickbot, an information stealer and banking malware that has been infecting victims since 2016. --------------------------------------------- https://unit42.paloaltonetworks.com/wireshark-tutorial-examining-trickbot-i… ===================== = Vulnerabilities = ===================== ∗∗∗ Medtronic Valleylab FT10 and LS10 ∗∗∗ --------------------------------------------- This medical advisory contains mitigations for improper authentication and protection mechanism failure vulnerabilities in Medtronic’s Valleylab FT10 and LS10 energy and electrosurgery products. --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsma-19-311-01 ∗∗∗ Medtronic Valleylab FT10 and FX8 ∗∗∗ --------------------------------------------- This medical advisory contains mitigations for use of hard-coded credentials, reversible one-way hash, and improper input validation vulnerabilities in Medtronic’s Valleylab FT10 and FX8 products. --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsma-19-311-02 ∗∗∗ Mitsubishi Electric MELSEC-Q Series and MELSEC-L Series CPU Modules ∗∗∗ --------------------------------------------- This advisory contains mitigations for an uncontrolled resource consumption vulnerability in select Mitsubishi Electrics CPU modules. --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-19-311-01 ∗∗∗ Fuji Electric V-Server ∗∗∗ --------------------------------------------- This advisory contains mitigations for a heap-based buffer overflow vulnerability in Fuji Electrics V-Server data collection and management service. --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-19-311-02 ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (linux-hardened), Debian (fribidi), Gentoo (oniguruma, openssh/openssh, openssl, and pump), Mageia (chromium-browser-stable, expat, firefox, freetds, proftpd, python, thunderbird, and unbound), Oracle (sudo), Scientific Linux (thunderbird), Slackware (kernel), SUSE (rubygem-haml), and Ubuntu (fribidi and webkit2gtk). --------------------------------------------- https://lwn.net/Articles/804202/ ∗∗∗ IBM Security Bulletin: Security vulnerabilities affect multiple IBM Rational products based on IBM Jazz technology ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-security-vulnerabilit… ∗∗∗ tcpdump vulnerability CVE-2018-14879 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K51512510 ∗∗∗ WebKitGTK and WPE WebKit Security Advisory WSA-2019-0006 ∗∗∗ --------------------------------------------- https://webkitgtk.org/security/WSA-2019-0006.html ∗∗∗ Squid: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-0966 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 07.11.2019
by Daily end-of-shift report 07 Nov '19

07 Nov '19

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 06-11-2019 18:00 − Donnerstag 07-11-2019 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Specially Crafted ZIP Files Used to Bypass Secure Email Gateways ∗∗∗ --------------------------------------------- Attackers are always looking for new tricks to distribute malware without them being detected by antivirus scanners and secure email gateways. This was illustrated in a new phishing campaign that utilized a specially crafted ZIP file that was designed to bypass secure email gateways to distribute the NanoCore RAT. --------------------------------------------- https://www.bleepingcomputer.com/news/security/specially-crafted-zip-files-… ∗∗∗ How to Secure Critical Infrastructure When Patching Isn’t Possible ∗∗∗ --------------------------------------------- Mission-critical systems cant just be switched off to apply security updates -- so patching can take weeks if not years. --------------------------------------------- https://threatpost.com/secure-critical-infrastructure-when-patching-isnt-po… ∗∗∗ Vulnerability hunting with Semmle QL: DOM XSS ∗∗∗ --------------------------------------------- In two previous blog posts ( part 1 and part 2), we talked about using Semmle QL in C and C++ codebases to find vulnerabilities such as integer overflow, path traversal, and those leading to memory corruption. In this post, we will explore applying Semmle QL to web security by hunting for one of the [...] --------------------------------------------- https://msrc-blog.microsoft.com:443/2019/11/06/vulnerability-hunting-with-s… ∗∗∗ Getting the best value out of security assessments, (Thu, Nov 7th) ∗∗∗ --------------------------------------------- Since my day job is all about hacking, I get a lot of questions (and there appears to be a lot of confusion) about what a vulnerability scan, penetration test or red team assessment is. --------------------------------------------- https://isc.sans.edu/diary/rss/25498 ∗∗∗ Magento 1 End of Life ∗∗∗ --------------------------------------------- It’s no secret that a CMS without support will develop vulnerabilities. Eventually, these lead to a compromised website — which cripples any ecommerce business. When you consider the popularity of the Magento ecommerce platform, it’s easy to see how their announcement of the Magento 1 end of life could leave a significant portion of ecommerce retailers scrambling for new solutions. --------------------------------------------- https://blog.sucuri.net/2019/11/magento-1-end-of-life.html ∗∗∗ VB2019 paper: DNS on fire ∗∗∗ --------------------------------------------- In a paper presented at VB2019, Cisco Talos researchers Warren Mercer and Paul Rascagneres looked at two recent attacks against DNS infrastructure: DNSpionage and Sea Turtle. Today we publish their paper and the recording of their presentation. --------------------------------------------- https://www.virusbulletin.com:443/blog/2019/11/vb2019-paper-dns-fire/ ∗∗∗ C2 With It All: From Ransomware To Carding ∗∗∗ --------------------------------------------- Cisco Talos recently discovered a new server hosting a large stockpile of malicious files. Our analysis of these files shows that these attackers were able to obtain a deep level of access to victims infrastructure — all of which allowed us to identify several targets of these attacks, including one American manufacturing company. Talos notified these targets of the attack. --------------------------------------------- https://blog.talosintelligence.com/2019/11/c2-with-it-all.html ∗∗∗ 5 Tipps zur Steigerung der Cybersecurity Awareness von Angestellten ∗∗∗ --------------------------------------------- Wie können Firmen ein Arbeitsumfeld schaffen, das es Angestellten ermöglicht, die nötigen Fähigkeiten zu erwerben, um Cybergefahren richtig einzuschätzen? --------------------------------------------- https://www.welivesecurity.com/deutsch/2019/11/07/5-tipps-steigerung-cybers… ∗∗∗ Falsche Gewinnspiele für Kinogutscheine kosten 80 Euro pro Monat ∗∗∗ --------------------------------------------- Mit Facebook-Anzeigen und nachgebauten Facebook-Seiten von Kinos in ganz Österreich werben Kriminelle für ein Gewinnspiel. Angeblich können Kinogutscheine gewonnen werden. Doch Vorsicht: Hier gibt es nichts zu gewinnen! Statt eines Kinobesuchs gibt es nur Ärger. Die Kreditkartendaten landen in den Händen von Kriminellen, die dann 80 bis 90 Euro pro Monat abbuchen. --------------------------------------------- https://www.watchlist-internet.at/news/falsche-gewinnspiele-fuer-kinogutsch… ===================== = Vulnerabilities = ===================== ∗∗∗ Gamers Hit with Nvidia GPU Driver, GeForce Flaws ∗∗∗ --------------------------------------------- Vulnerabilities in several PC gaming products offered by Nvidia can lead to escalation of privilege, denial of service and other malicious attacks. --------------------------------------------- https://threatpost.com/gamers-hit-with-nvidia-gpu-driver-geforce-flaws/1499… ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (squid), Fedora (chromium, libssh2, and wpa_supplicant), openSUSE (chromium), Red Hat (ansible, chromium-browser, openstack-octavia, patch, qemu-kvm-rhev, sudo, and thunderbird), Scientific Linux (sudo), SUSE (bluez, gdb, php72, and thunderbird), and Ubuntu (cpio and rygel). --------------------------------------------- https://lwn.net/Articles/804091/ ∗∗∗ Cisco: All these routers have the same embedded crypto keys, so update firmware ∗∗∗ --------------------------------------------- Cisco removes static encryption keys that were shared across its small-business routers. --------------------------------------------- https://www.zdnet.com/article/cisco-all-these-routers-have-the-same-embedde… ∗∗∗ Open Social - Critical - Insecure Session Management - SA-CONTRIB-2019-075 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2019-075 ∗∗∗ PEPPERL+FUCHS Linux Kernel Vulnerability on ecom Mobile Devices ∗∗∗ --------------------------------------------- https://cert.vde.com/de-de/advisories/vde-2019-021 ∗∗∗ Red Hat OpenShift Container Platform: Schwachstelle ermöglicht Offenlegung von Informationen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-0965 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 06.11.2019
by Daily end-of-shift report 06 Nov '19

06 Nov '19

===================== = End-of-Day report = ===================== Timeframe: Dienstag 05-11-2019 18:00 − Mittwoch 06-11-2019 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Emotet, Trickbot, Ryuk – ein explosiver Malware-Cocktail ∗∗∗ --------------------------------------------- Der aktuell "zerstörerischste" Schädling Emotet besteht aus einer Kaskade mehrerer Schadprogramme, die zusammen vielstellige Millionenschäden verursachen. --------------------------------------------- https://heise.de/-4573848 ∗∗∗ Überteuerte Visums- und Einreisegenehmigungsangebote im Internet ∗∗∗ --------------------------------------------- Ihr nächstes Urlaubsziel verlangt ein Visum? Dann nehmen Sie sich vor unseriösen Websites in Acht, die ein Vielfaches der tatsächlich anfallenden Gebühr für die Einreisegenehmigungen verlangen. Besondere Vorsicht ist beispielsweise bei Reisen nach Australien, Ägypten, Vietnam, Indien sowie Kanada oder in die USA und die Türkei geboten – theoretisch ist die Masche aber bei allen Destinationen mit Visumspflicht möglich. --------------------------------------------- https://www.watchlist-internet.at/news/ueberteuerte-visums-und-einreisegene… ∗∗∗ German Dridex spam campaign is unfashionably large ∗∗∗ --------------------------------------------- VB has analysed a malicious spam campaign targeting German-speaking users with obfuscated Excel malware that would likely download Dridex but that mostly stood out through its size. --------------------------------------------- https://www.virusbulletin.com:443/blog/2019/11/german-malspam-campaign-unfa… ∗∗∗ Scammers Are Exploiting a Firefox Bug to Freeze Your Browser ∗∗∗ --------------------------------------------- Fraudulent tech-support sites are causing the browser to lock up and display a disturbing message. Force quitting is the only way out. --------------------------------------------- https://www.wired.com/story/scammers-are-exploiting-a-firefox-bug-to-freeze… ∗∗∗ Siemens PLC Feature Can Be Exploited for Evil - and for Good ∗∗∗ --------------------------------------------- A hidden feature in some newer models of the vendors programmable logic controllers leaves the devices open to attack. Siemens says it plans to fix it. --------------------------------------------- https://www.darkreading.com/vulnerabilities---threats/siemens-plc-feature-c… ∗∗∗ Kamerka OSINT tool shows your countrys internet-connected critical infrastructure ∗∗∗ --------------------------------------------- Kamerka lets you see what a hacker sees. It plots maps with SCADA equipment, webcams, and printers that have been left exposed on the internet inside any given country. --------------------------------------------- https://www.zdnet.com/article/kamerka-osint-tool-shows-your-countrys-intern… ===================== = Vulnerabilities = ===================== ∗∗∗ Omron CX-Supervisor ∗∗∗ --------------------------------------------- This advisory contains mitigations for a use of obsolete function vulnerability in Omrons CX-Supervisor SCADA and HMI package. --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-19-309-01 ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (cpio, openafs, proftpd-dfsg, simplesamlphp, and wordpress), Fedora (thunderbird), openSUSE (binutils, docker-runc, kernel, nfs-utils, php7, python3, and samba), Red Hat (389-ds:1.4, ansible, bind, container-tools:1.0, container-tools:rhel8, curl, dbus, dhcp, dovecot, edk2, elfutils, evolution, freeradius:3.0, gdb, gettext, glib2, glibc, GNOME, gnutls, go-toolset:rhel8, http-parser, httpd:2.4, kernel, kernel-rt, libarchive, libjpeg-turbo, libqb, [...] --------------------------------------------- https://lwn.net/Articles/804018/ ∗∗∗ Smartwares HOME easy v1.0.9 Database Backup Information Disclosure Exploit ∗∗∗ --------------------------------------------- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5541.php ∗∗∗ Smartwares HOME easy v1.0.9 Client-Side Authentication Bypass ∗∗∗ --------------------------------------------- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5540.php ∗∗∗ Cisco Security Advisories ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/publicationListing.x ∗∗∗ Security Advisory - Insufficient Authentication Vulnerability in Several Band Products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191106-… ∗∗∗ libpcap vulnerability CVE-2018-16301 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K86252029 ∗∗∗ Red Hat Enterprise Linux: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-0959 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 05.11.2019
by Daily end-of-shift report 05 Nov '19

05 Nov '19

===================== = End-of-Day report = ===================== Timeframe: Montag 04-11-2019 18:00 − Dienstag 05-11-2019 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Alexa und Siri: Sprachbefehle unhörbar per Laser übertragen ∗∗∗ --------------------------------------------- Sprachbefehle müssen nicht unbedingt per Sprache übertragen werden: Forschern ist es gelungen, smarte Lautsprecher wie Amazon Echo oder Google Home mit einem Laser aus bis zu 110 Metern Entfernung zu steuern - und so beispielsweise ein Garagentor zu öffnen. --------------------------------------------- https://www.golem.de/news/alexa-und-siri-sprachbefehle-unhoerbar-per-laser-… ∗∗∗ Magecart Groups Attack Simultaneous Sites in Card-Theft Frenzy ∗∗∗ --------------------------------------------- Stealing payment-card data and PII from e-commerce sites has become so lucrative that some are being targeted by multiple groups at the same time. --------------------------------------------- https://threatpost.com/magecart-groups-attack-simultaneous-sites-in-card-th… ∗∗∗ Bluekeep exploitation causing Bluekeep vulnerability scan to fail, (Tue, Nov 5th) ∗∗∗ --------------------------------------------- I woke up this morning to the long anticipated news that Bluekeep exploitation is happening in the wild. As some of you may recall, back in August I wrote a diary demonstrating a way to scan for Bluekeep vulnerable devices. So the next thing I did was check my Bluekeep scan results and was presented with this graph. --------------------------------------------- https://isc.sans.edu/diary/rss/25488 ∗∗∗ Pwning a Smart Car Charger, Building a Bot-Net ∗∗∗ --------------------------------------------- ...or Why We Don’t Build Commercial IoT on a Raspberry Pi. A positive story of disclosure and remediation. We’re quite in to our electric vehicles at PTP, so we started hunting for a smart car charger. There are plenty of industrial chargers out there and some research has been done in the past. We got [...] --------------------------------------------- https://www.pentestpartners.com/security-blog/pwning-a-smart-car-charger-bu… ∗∗∗ Bestellen Sie nicht bei kafrosa.de ∗∗∗ --------------------------------------------- kafrosa.de vertreibt Kaffeemaschinen, Kaffeevollautomaten und sogar Kaffee zu günstigen Preisen. Der Aufbau von kafrosa.de wirkt seriös, verpflichtende Angaben über das Unternehmen werden angeführt und die Auszeichnungen des Shops stiften Vertrauen. Doch Vorsicht: Der Schein trügt. Es handelt sich um einen Fake-Shop, der keine Ware liefert! --------------------------------------------- https://www.watchlist-internet.at/news/bestellen-sie-nicht-bei-kafrosade/ ∗∗∗ A look at WP-VCD, todays largest WordPress hacking operation ∗∗∗ --------------------------------------------- Exclusive look into the WP-VCD gang operations! --------------------------------------------- https://www.zdnet.com/article/a-look-at-wp-vcd-todays-largest-wordpress-hac… ===================== = Vulnerabilities = ===================== ∗∗∗ Windows-Kernel-Lücke in Netzwerküberwachsungssoftware PRTG geschlossen ∗∗∗ --------------------------------------------- Die in Paessler PRTG integrierte Paket-Sniffer-Bibliothek Npcap ist verwundbar. Das haben die Entwickler nun repariert. --------------------------------------------- https://heise.de/-4577699 ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (electron, ghostscript, glibc, python2, and samba), Debian (webkit2gtk), Slackware (libtiff), SUSE (ImageMagick, python-ecdsa, and samba), and Ubuntu (apport, haproxy, ruby-nokogiri, and whoopsie). --------------------------------------------- https://lwn.net/Articles/803885/ ∗∗∗ Synology-SA-19:37 DSM ∗∗∗ --------------------------------------------- Multiple vulnerabilities allow remote authenticated users to execute arbitrary commands or conduct denial-of-service attacks, or allow remote attackers to delete arbitrary files via a susceptible version of DiskStation Manager (DSM). --------------------------------------------- https://www.synology.com/en-global/support/security/Synology_SA_19_37 ∗∗∗ Microsoft Office365 Integrity Validation / Remote Code Execution ∗∗∗ --------------------------------------------- https://cxsecurity.com/issue/WLB-2019110022 ∗∗∗ [20191002] - Core - Path Disclosure in phpuft8 mapping files ∗∗∗ --------------------------------------------- http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/Zi-lVuM4KoY/795-20191002-c… ∗∗∗ [20191001] - Core - CSRF in com_template overrides view ∗∗∗ --------------------------------------------- http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/LaIC5kOPGB0/794-20191001-c… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM MessageGateway ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: IBM QRadar Advisor With Watson is vulnerable to Hazardous Input Validation in some cases ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-qradar-advisor-with-w… ∗∗∗ November 4, 2019 TNS-2019-07 [R1] PHP Stand-alone Patch Available for Tenable.sc versions 5.7.x to 5.11.x ∗∗∗ --------------------------------------------- http://www.tenable.com/security/tns-2019-07 ∗∗∗ FRF.16 parser vulnerability CVE-2018-14468 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K04367730 ∗∗∗ Dell integrated Dell Remote Access Controller: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-0957 ∗∗∗ Google Android: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-0958 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 04.11.2019
by Daily end-of-shift report 04 Nov '19

04 Nov '19

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 31-10-2019 18:00 − Montag 04-11-2019 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Windows: Schadsoftware nutzt erstmals Bluekeep-Sicherheitslücke aus ∗∗∗ --------------------------------------------- Als eine Sicherheitslücke wie Wanna Cry beschreibt Microsoft Bluekeep. Nun entdeckten Sicherheitsforscher die erste Schadsoftware, die die Lücke ausnutzt. Diese ist jedoch noch weit entfernt von dem Worst-Case-Szenario. --------------------------------------------- https://www.golem.de/news/windows-schadsoftware-nutzt-erstmals-bluekeep-sic… ∗∗∗ Malware "QSnatch" attackiert QNAP-Netzwerkspeicher – auch in Deutschand ∗∗∗ --------------------------------------------- QSnatch hat es auch hierzulande auf NAS von QNAP abgesehen. Ob ein Firmware-Update hilft, ist unklar – durchführen sollte man es dennoch. --------------------------------------------- https://heise.de/-4573483 ∗∗∗ Android Beam erlaubt Einschleusen fremder Apps ∗∗∗ --------------------------------------------- Über NFC könnten fast unbemerkt gefährliche Apps auf Android-Geräte gelangen. Betroffen sind Android 8, 9 und 10. Es gibt Abhilfe. --------------------------------------------- https://heise.de/-4574396 ===================== = Vulnerabilities = ===================== ∗∗∗ Advantech WISE-PaaS/RMM ∗∗∗ --------------------------------------------- This advisory contains mitigations for path traversal, missing authorization, improper restriction of XML external entity reference, and SQL injection vulnerabilities in Advantech’s WISE-PaaS/RMM IoT device remote monitoring and management platform. --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-19-304-01 ∗∗∗ Honeywell equIP Series IP Cameras ∗∗∗ --------------------------------------------- This advisory contains mitigations for an improper input validation vulnerability in Honeywells equIP series IP cameras. --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-19-304-02 ∗∗∗ Honeywell equIP and Performance Series IP Cameras ∗∗∗ --------------------------------------------- This advisory contains mitigations for a missing authentication for critical function vulnerability in Honeywells equIP series and Performance series IP cameras. --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-19-304-03 ∗∗∗ Honeywell equIP and Performance Series IP Cameras and Recorders ∗∗∗ --------------------------------------------- This advisory contains mitigations for an authentication bypass by capture-relay vulnerability in Honeywells equIP series and Performance series IP cameras and recorders. --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-19-304-04 ∗∗∗ Watch Out IT Admins! Two Unpatched Critical RCE Flaws Disclosed in rConfig ∗∗∗ --------------------------------------------- If youre using the popular rConfig network configuration management utility to protect and manage your network devices, here we have an important and urgent warning for you. A cybersecurity researcher has recently published details and proof-of-concept exploits for two unpatched, critical remote code execution vulnerabilities in the rConfig utility, at least one of which could allow [...] --------------------------------------------- https://thehackernews.com/2019/11/rConfig-network-vulnerability.html ∗∗∗ Microsoft Office for Mac cannot properly disable XLM macros ∗∗∗ --------------------------------------------- The Microsoft Office for Mac option "Disable all macros without notification" enables XLM macros without prompting, which can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. --------------------------------------------- https://kb.cert.org/vuls/id/125336/ ∗∗∗ Update verfügbar: MikroTik sichert Router gegen vier Schwachstellen ab ∗∗∗ --------------------------------------------- Schwachstellen in RouterOS lassen sich zu einer Exploit-Chain zusammenbauen. Gerätebesitzer sollten jetzt updaten. --------------------------------------------- https://heise.de/-4573749 ∗∗∗ Xcode: Lücken in Entwicklungsumgebung erlaubten beliebige Codeausführung ∗∗∗ --------------------------------------------- Zwei Lücken in der macOS-Entwicklungsumgebung Xcode vor Version 11.2 erlaubten die beliebige Programmcode-Ausführung – möglicherweise auch aus der Ferne. --------------------------------------------- https://heise.de/-4575632 ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by CentOS (firefox, sudo, and thunderbird), Debian (libarchive and qtbase-opensource-src), Oracle (php), Red Hat (php, rh-php71-php, and rh-php72-php), Scientific Linux (firefox and php), and SUSE (kernel and samba). --------------------------------------------- https://lwn.net/Articles/803651/ ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (chromium and qt5-webengine), CentOS (firefox and php), Fedora (file, java-latest-openjdk, nspr, nss, php, t1utils, and webkit2gtk3), Mageia (ansible, aspell, golang, libsoup, and libxslt), openSUSE (chromium and chromium, re2), Oracle (php), and Ubuntu (apport and file). --------------------------------------------- https://lwn.net/Articles/803785/ ∗∗∗ Synology-SA-19:36 PHP ∗∗∗ --------------------------------------------- CVE-2019-11043 allows remote attackers to execute arbitrary code via a susceptible version of PHP 7.2, or PHP 7.3. --------------------------------------------- https://www.synology.com/en-global/support/security/Synology_SA_19_36 ∗∗∗ [remote] Microsoft Windows Server 2012 - Group Policy Security Feature Bypass ∗∗∗ --------------------------------------------- https://www.exploit-db.com/exploits/47559 ∗∗∗ [remote] Microsoft Windows Server 2012 - Group Policy Remote Code Execution ∗∗∗ --------------------------------------------- https://www.exploit-db.com/exploits/47558 ∗∗∗ Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with IBM Cloud Orchestrator (CVE-2019-4442) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: IBM Flex System Chassis Management Module (CMM) is affected by vulnerabilities in PHP (CVE-2019-6978, CVE-2019-6977) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-flex-system-chassis-m… ∗∗∗ Security Bulletin: IBM Navigator for i is affected by CVE-2019-4450 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-navigator-for-i-is-af… ∗∗∗ Security Bulletin: IBM Flex System Chassis Management Module (CMM) is affected by vulnerabilities in libssh2 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-flex-system-chassis-m… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by a TCP SACK PANIC -Kernel vulnerability ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Security Bulletin: IBM Flex System Chassis Management Module (CMM) is affected by vulnerability in PHP. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-flex-system-chassis-m… ∗∗∗ Security Bulletin: IBM Content Navigator is affected by a vulnerability in Apache Commons Beanutils (CVE-2019-10086) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-content-navigator-is-… ∗∗∗ Security Bulletin: IBM Navigator for i is affected by CVE-2019-4450 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-navigator-for-i-is-af… ∗∗∗ BIG-IP TMUI XSS vulnerability CVE-2019-6657 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K22441651 ∗∗∗ BIG-IP AFM SQL injection vulnerability CVE-2019-6658 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K21121741 ∗∗∗ Citrix Hypervisor Security Update ∗∗∗ --------------------------------------------- https://support.citrix.com/article/CTX263477 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 31.10.2019
by Daily end-of-shift report 31 Oct '19

31 Oct '19

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 30-10-2019 18:00 − Donnerstag 31-10-2019 18:00 Handler: Dimitri Robl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ EML attachments in O365 - a recipe for phishing, (Thu, Oct 31st) ∗∗∗ --------------------------------------------- Ive recently come across interesting behavior of Office 365 when EML files are attached to e-mail messages, which can be useful for any red teamers out there but which can potentially also make certain types of phishing attacks more successful. --------------------------------------------- https://isc.sans.edu/diary/rss/25474 ∗∗∗ Data URLs and HTML Entities in New WordPress Malware ∗∗∗ --------------------------------------------- Last week, an ongoing WordPress malware campaign started a new wave which included a variety of experimental injection types. Scripts as Data URLs The first type looks pretty similar to what we discussed in our recent post. However, instead of placing the code between the … tags, these injections have begun to embed them inline using a so called data URL notation in the src parameter. --------------------------------------------- https://blog.sucuri.net/2019/10/data-urls-and-html-entities-in-new-wordpres… ∗∗∗ MS-ISAC Releases EOS Software Report List ∗∗∗ --------------------------------------------- Original release date: October 30, 2019The Multi-State Information Sharing and Analysis Center (MS-ISAC) has released an end-of-support (EOS) software report list. Software that has reached its EOS date no longer receives security updates and patches from the vendor and is, therefore, susceptible to exploitation from security vulnerabilities. --------------------------------------------- https://www.us-cert.gov/ncas/current-activity/2019/10/30/ms-isac-releases-e… ∗∗∗ 5th eHealth Security Conference: ENISA advises on cybersecurity for hospitals ∗∗∗ --------------------------------------------- ENISA, the EU Agency for Cybersecurity organised the 5th consecutive eHealth Security Conference in cooperation with the Spanish Authorities and the Centre for Information Security of Catalonia (CESICAT) on the 30th October in Barcelona. --------------------------------------------- https://www.enisa.europa.eu/news/enisa-news/5th-ehealth-security-conference… ∗∗∗ Office 365 Users Targeted by Voicemail Scam Pages ∗∗∗ --------------------------------------------- Over the past few weeks McAfee Labs has been observing a new phishing campaign using a fake voicemail message to lure victims into entering their Office 365 email credentials. At first, we believed that only one phishing kit was being used to harvest the user’s credentials. However, during our investigation, we found three different malicious [...] --------------------------------------------- https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/office-365-user… ∗∗∗ Ungenutzte E-Mail-Adressen ermöglichen Zugang zu persönlichen Konten ∗∗∗ --------------------------------------------- E-Mail-Adressen, die nicht mehr genutzt werden, werden oft neu vergeben. Wenn diese Adressen noch bei Social-Media-Konten, Gaming-Accounts, Online-Shops oder anderen Zugangsdaten hinterlegt sind, können sich die neuen BesitzerInnen Zugang zu diesen Konten verschaffen. Kriminelle nutzen das zu Betrugs- und Erpressungszwecken aus. --------------------------------------------- https://www.watchlist-internet.at/news/ungenutzte-e-mail-adressen-ermoeglic… ∗∗∗ Untitled Goose Game security hole could have allowed hackers to wreak havoc ∗∗∗ --------------------------------------------- The highly popular “Untitled Goose Game” has been found to be vulnerable to an attack that could allow hackers to run malicious code on your computer. --------------------------------------------- https://hotforsecurity.bitdefender.com/blog/untitled-goose-game-security-ho… ∗∗∗ Home & Small Office Wireless Routers Exploited to Attack Gaming Servers ∗∗∗ --------------------------------------------- Unit 42 researchers discovered an updated Gafgy variant that looks to infect home and small office WiFi routers of known commercial brands, like Zyxel, Huawei, and Realtek to attack gaming servers. More than 32,000 WiFi routers are potentially vulnerable to these exploits around the world. --------------------------------------------- https://unit42.paloaltonetworks.com/home-small-office-wireless-routers-expl… ∗∗∗ Vorwarnung: Neue Webseite kommt nächste Woche ∗∗∗ --------------------------------------------- tl;dr: Nein, wir werden nächste Woche nicht gehackt, wir stellen nur eine neue Webseite online. --------------------------------------------- http://www.cert.at/services/blog/20191031121150-2561.html ===================== = Vulnerabilities = ===================== ∗∗∗ XSA-299 Security Vulnerability ∗∗∗ --------------------------------------------- IBM is aware of a reported XSA-299 security vulnerability (CVE-2019-18421) that potentially would permit an attacker from within a VSI to elevate privileges to that of the host.There are no known malicious exploits of this vulnerability, which potentially impacts the hypervisor.IBM is implementing updates to remediate this vulnerability. No downtime for clients is expected and no client action is necessary for IBM Cloud virtual servers. While we do not anticipate any issues with remediation, we [...] --------------------------------------------- https://www.ibm.com/blogs/psirt/xsa-299-security-vulnerability/ ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (italc and python-ecdsa), Fedora (php and sudo), openSUSE (binutils and docker-runc), Oracle (thunderbird), Red Hat (firefox and sudo), SUSE (ardana-ansible, ardana-glance, ardana-horizon, ardana-input-model, ardana-manila, ardana-neutron, ardana-nova, ardana-octavia, ardana-tempest, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, galera-3, grafana, mariadb, mariadb-connector-c, novnc, openstack-cinder, openstack-glance, openstack-heat, [...] --------------------------------------------- https://lwn.net/Articles/803583/ ∗∗∗ XSA-303 - ARM: Interrupts are unconditionally unmasked in exception handlers ∗∗∗ --------------------------------------------- https://xenbits.xen.org/xsa/advisory-303.html ∗∗∗ XSA-302 - passed through PCI devices may corrupt host memory after deassignment ∗∗∗ --------------------------------------------- https://xenbits.xen.org/xsa/advisory-302.html ∗∗∗ XSA-301 - add-to-physmap can be abused to DoS Arm hosts ∗∗∗ --------------------------------------------- https://xenbits.xen.org/xsa/advisory-301.html ∗∗∗ XSA-299 - Issues with restartable PV type change operations ∗∗∗ --------------------------------------------- https://xenbits.xen.org/xsa/advisory-299.html ∗∗∗ XSA-298 - missing descriptor table limit checking in x86 PV emulation ∗∗∗ --------------------------------------------- https://xenbits.xen.org/xsa/advisory-298.html ∗∗∗ XSA-296 - VCPUOP_initialise DoS ∗∗∗ --------------------------------------------- https://xenbits.xen.org/xsa/advisory-296.html Next End-of-Day report: 2019-11-04 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 30.10.2019
by Daily end-of-shift report 30 Oct '19

30 Oct '19

===================== = End-of-Day report = ===================== Timeframe: Dienstag 29-10-2019 18:00 − Mittwoch 30-10-2019 18:00 Handler: Dimitri Robl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Paradise Ransomware Decryptor Gets Your Files Back for Free ∗∗∗ --------------------------------------------- A decryptor for the Paradise Ransomware has been released by Emsisoft that allows victims to decrypt their files for free. --------------------------------------------- https://www.bleepingcomputer.com/news/security/paradise-ransomware-decrypto… ∗∗∗ A1 warnt Android-Nutzer vor App, die Bankdaten stiehlt ∗∗∗ --------------------------------------------- Kunden sollten sich vor einer App mit dem Titel „Netztest“ in Acht nehmen. --------------------------------------------- https://futurezone.at/digital-life/a1-warnt-android-nutzer-vor-app-die-bank… ∗∗∗ Gewinnversprechen von Coca-Cola in Höhe von 1 Million US-Dollar ist Scam ∗∗∗ --------------------------------------------- Wenn Sie per E-Mail über einen Gewinn in Millionenhöhe benachrichtigt werden, handelt es sich um einen Betrugsversuch. Aktuell geben sich Kriminelle als Kommunikationsbeauftragte von Coca-Cola aus und informieren Sie über einen vermeintlichen Gewinn. Die Gewinnsumme wird im Austausch Ihrer persönlichen Daten und Ausweiskopien übermittelt. Vorsicht: Kriminelle versuchen an Ihr Geld zu kommen, stehlen Ihre Identität und missbrauchen sie für Straftaten in Ihrem [...] --------------------------------------------- https://www.watchlist-internet.at/news/gewinnversprechen-von-coca-cola-in-h… ===================== = Vulnerabilities = ===================== ∗∗∗ PHOENIX CONTACT Automation Worx Software Suite ∗∗∗ --------------------------------------------- This advisory contains mitigations for an improper input validation vulnerability in Phoenix Contacts Automation Worx Software Suite products. --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-19-302-01 ∗∗∗ Apple Releases Security Updates ∗∗∗ --------------------------------------------- Original release date: October 30, 2019Content: Apple has released security updates to address vulnerabilities in multiple products. An attacker could exploit some of these vulnerabilities to take control of an affected system.The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review the Apple security pages for the following products and apply the necessary updates: [...] --------------------------------------------- https://www.us-cert.gov/ncas/current-activity/2019/10/30/apple-releases-sec… ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (imapfilter, libvncserver, and pam-python), Fedora (tcpdump), Mageia (file, graphviz, kernel, and php, pcre2), openSUSE (nfs-utils), Red Hat (heketi and samba), Scientific Linux (thunderbird), SUSE (libtomcrypt, php7, and runc), and Ubuntu (apport, libarchive, libidn2, samba, and whoopsie). --------------------------------------------- https://lwn.net/Articles/803474/ ∗∗∗ Synology-SA-19:35 Samba ∗∗∗ --------------------------------------------- These vulnerabilities allow remote attackers to bypass security constraints via a susceptible version of DiskStation Manager (DSM), Synology Router Manager (SRM), and allow remote authenticated users to conduct denial-of-service attacks via a susceptible version of Synology Directory Server. --------------------------------------------- https://www.synology.com/en-global/support/security/Synology_SA_19_35 ∗∗∗ Security Advisory - Two Heap Buffer Overflow Vulnerabilities in Broadcom WiFi Chipset Drivers ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191030-… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily