Daily

daily@lists.cert.at

1 participants
3158 discussions

Tageszusammenfassung - Montag 25-07-2016
by Daily end-of-shift report 25 Jul '16

25 Jul '16

======================= = End-of-Shift report = ======================= Timeframe: Freitag 22-07-2016 18:00 − Montag 25-07-2016 18:00 Handler: Stephan Richter Co-Handler: n/a *** Gratis Entschlüsselungs-Tools nehmen es mit elf Erpressungs-Trojanern auf *** --------------------------------------------- AVG und Trend Micro haben ihre kostenlosen Tools aktualisiert, mit denen Opfer von diversen Verschlüsselungs-Trojanern unter Umständen wieder Zugriff auf ihre Daten bekommen können. --------------------------------------------- http://heise.de/-3277015 *** PowerWare Ransomware Masquerades as Locky to Intimidate Victims *** --------------------------------------------- PowerWare ransomware spoofs Locky malware family in an attempt to scare victims into paying up. --------------------------------------------- http://threatpost.com/ransomware-powerware-masquerades-as-locky-to-intimida… *** Cross-platform malware Adwind infects Mac *** --------------------------------------------- We examine a cross-platform malware with a Mac payload and found the hackers behind it really didnt put that much effort into making it work on the Mac.Categories: Mac Threat analysisTags: Applemacmalwarerat(Read more...) --------------------------------------------- https://blog.malwarebytes.com/threat-analysis/2016/07/cross-platform-malwar… *** Kovter becomes almost file-less, creates a new file type, and gets some new certificates *** --------------------------------------------- Trojan:Win32/Kovter is a well-known click-fraud malware which is challenging to detect and remove because of its file-less persistence on infected PCs. In this blog, we will share some technical details about the latest changes we have seen in Kovter's persistence method and some updates on their latest malvertising campaigns. New persistence method Since June 2016,... --------------------------------------------- https://blogs.technet.microsoft.com/mmpc/2016/07/22/kovter-becomes-almost-f… *** It Is Our Policy, (Sat, Jul 23rd) *** --------------------------------------------- How many times have you heard someone say out loud our our security policy requires...?Many times we hear and are sometimes even threatened with the security policy. Security policy should set behavioral expectations and be the basis for every technical, administrative and physical control that is implemented. Unfortunately, solid security policies are often elusive for several key reasons. I regularly get the question, How many security policiesshould I have? My response is often found by... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=21293&rss *** Nemucod dot dot..WSF *** --------------------------------------------- The latest Nemucod campaign shows the malware distributing a spam email attachment with a .wsf extension, specifically ..wsf (with a double dot) extension. It is a variation of what has been observed since last year (2015) - the TrojanDownloader:JS/Nemucod malware downloader using JScript. It still spreads through spam email attachment, typically inside a .zip file,... --------------------------------------------- https://blogs.technet.microsoft.com/mmpc/2016/07/23/nemucod/ *** Europol will Opfern von Internet-Erpressung helfen *** --------------------------------------------- Mit der Website nomoreransom.org will die Europol Opfern von Krypto-Trojanern helfen, wieder Zugang zu ihren Daten zu bekommen. --------------------------------------------- http://futurezone.at/digital-life/europol-will-opfern-von-internet-erpressu… *** Stealing Bitcoin With Math - HOPE XI *** --------------------------------------------- by Filippo Valsorda Published July 23, 2016 in Programming Explaining Bitcoin and attacks old and new. WARNING: contains more than 15 math formulas. --------------------------------------------- https://speakerdeck.com/filosottile/stealing-bitcoin-with-math-hope-xi *** Bypassing UAC on Windows 10 using Disk Cleanup *** --------------------------------------------- Matt Graeber (@mattifestation) and I recently dug into Windows 10, and discovered a rather interesting method of bypassing User Account Control [...]. Currently, there are a couple of public UAC bypass techniques, most of which require a privileged file copy using the IFileOperation COM object or WUSA extraction to take advantage of a DLL hijack. [...] The technique covered in this post differs from the other methods and provides a useful alternative as it does not rely on a privileged file... --------------------------------------------- https://enigma0x3.net/2016/07/22/bypassing-uac-on-windows-10-using-disk-cle… *** Researchers discover 110 snooping Tor nodes *** --------------------------------------------- In a period spanning 72 days, two researchers from Northeastern University have discovered at least 110 "misbehaving" and potentially malicious hidden services directories (HSDirs) on the Tor anonymity network. What's an HSDir? An HSDir is a Tor node that receives descriptors for hidden services - servers configured to receive inbound connections only through Tor, meaning their IP address and network location remains hidden - and, upon request, directs users to... --------------------------------------------- https://www.helpnetsecurity.com/2016/07/25/snooping-tor-nodes/ *** DSA-3625 squid3 - security update *** --------------------------------------------- Several security issues have been discovered in the Squid caching proxy. --------------------------------------------- https://www.debian.org/security/2016/dsa-3625 *** DSA-3626 openssh - security update *** --------------------------------------------- Eddie Harari reported that the OpenSSH SSH daemon allows userenumeration through timing differences when trying to authenticateusers. When sshd tries to authenticate a non-existing user, it will pickup a fixed fake password structure with a hash based on the Blowfishalgorithm. If real users passwords are hashed using SHA256/SHA512, thena remote attacker can take advantage of this flaw by sending largepasswords, receiving shorter response times from the server fornon-existing users. --------------------------------------------- https://www.debian.org/security/2016/dsa-3626 *** DSA-3627 phpmyadmin - security update *** --------------------------------------------- Several vulnerabilities have been fixed in phpMyAdmin, the web-basedMySQL administration interface. --------------------------------------------- https://www.debian.org/security/2016/dsa-3627 *** [2016-07-25] Multiple vulnerabilities in Micro Focus (Novell) Filr appliance *** --------------------------------------------- The Micro Focus (Novell) Filr Appliance contains several vulnerabilities that, when combined, allow an unauthenticated attacker to execute arbitrary system commands as the user "root" or allow an authenticated attacker to hijack user and administrator sessions. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2016… *** Filr 2.0 - Security Update 2 *** --------------------------------------------- Abstract: This patch provides a number of Security Updates for Filr, Search and MySQL 2.0.0 appliances including updated Java applets.Document ID: 5250090Security Alert: YesDistribution Type: PublicEntitlement Required: NoFiles:Filr-2.0.0.465.HP.zip (204.82 MB)preinstall-filr20su2.zip (409 bytes)Search-2.0.0.414.HP.zip (24.96 MB)MySQL-2.0.0.195.HP.zip (24.2 MB)Products:Filr 2Superceded Patches: None --------------------------------------------- https://download.novell.com/Download?buildid=3V-3ArYN85I~ *** Filr 1.2 - Security Update 3 *** --------------------------------------------- Abstract: This patch provides a number of Security Updates for Filr, Search and MySQL 1.2 appliances including updated Java applets.Document ID: 5250470Security Alert: YesDistribution Type: PublicEntitlement Required: NoFiles:MySQL-1.2.0.416.HP.zip (11 kB)Filr-1.2.0.871.HP.zip (153.52 MB)Search-1.2.0.1008.HP.zip (11.04 kB)Products:Filr 1.2Superceded Patches: None --------------------------------------------- https://download.novell.com/Download?buildid=BOTiHcBFfv0~ *** Bugtraq: CA20160721-01: Security Notice for CA eHealth *** --------------------------------------------- CA20160721-01: Security Notice for CA eHealth --------------------------------------------- http://www.securityfocus.com/archive/1/538982 *** Vuln: Objective Systems ASN1C CVE-2016-5080 Heap Based Buffer Overflow Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/91836 *** Vulnerability in Objective Systems ASN1C Compiler Affecting Cisco Products *** --------------------------------------------- A vulnerability in the ASN1C compiler by Objective Systems affects Cisco ASR 5000 devices running StarOS and Cisco Virtualized Packet Core (VPC) systems. The vulnerability could allow an unauthenticated, remote attacker to create a denial of service (DoS) condition or potentially execute arbitrary code. --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: A vulnerability in the Linux kernel affects PowerKVM (CVE-2016-3044) *** http://www.ibm.com/support/docview.wss?uid=isg3T1023969 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in ImageMagick affect PowerKVM *** http://www.ibm.com/support/docview.wss?uid=isg3T1023934 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in ntp affect PowerKVM *** http://www.ibm.com/support/docview.wss?uid=isg3T1023885 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in PCRE affect PowerKVM *** http://www.ibm.com/support/docview.wss?uid=isg3T1023886 --------------------------------------------- *** IBM Security Bulletin: A vulnerability in lcms affects PowerKVM (CVE-2013-7455) *** http://www.ibm.com/support/docview.wss?uid=isg3T1023876 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in InstallAnywhere affects IBM Tivoli Storage Manager Administration Center (CVE-2016-4560) *** http://www.ibm.com/support/docview.wss?uid=swg21985483 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in InstallAnywhere affects IBM Tivoli Monitoring for Tivoli Storage Manager Server (CVE-2016-4560) *** http://www.ibm.com/support/docview.wss?uid=swg21984949 ---------------------------------------------

1 0

Tageszusammenfassung - Freitag 22-07-2016
by Daily end-of-shift report 22 Jul '16

22 Jul '16

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 21-07-2016 18:00 − Freitag 22-07-2016 18:00 Handler: Alexander Riepl Co-Handler: Robert Waldner *** 15 Vulnerabilities in SAP HANA Outlined *** --------------------------------------------- SAP recently fixed 15 different vulnerabilities that existed in the database management system HANA and subsequent communication channels. The bugs affect 10,000 users running the software. --------------------------------------------- http://threatpost.com/15-vulnerabilities-in-sap-hana-outlined/119406/ *** IDM 4.5 JDBC Fanout 1.0.1.0 *** --------------------------------------------- https://download.novell.com/Download?buildid=GfcX9EX05Hs~ *** DSA-3624 mysql-5.5 - security update *** --------------------------------------------- Several issues have been discovered in the MySQL database server. Thevulnerabilities are addressed by upgrading MySQL to the new upstreamversion 5.5.50. Please see the MySQL 5.5 Release Notes and OraclesCritical Patch Update advisory for further details: --------------------------------------------- https://www.debian.org/security/2016/dsa-3624 *** CrypMIC ransomware is a CryptXXX copycat, with a few twists *** --------------------------------------------- CryptXXX ransomware has a doppelganger - its called CrypMIC. And the resemblance doesnt appear to be a coincidence. --------------------------------------------- http://www.scmagazine.com/crypmic-ransomware-is-a-cryptxxx-copycat-with-a-f… *** Security Notice - Statement on Heap Overflow Vulnerability in Code Generated by Objective Systems ASN1C *** --------------------------------------------- http://www.huawei.com/en/psirt/security-notices/2016/huawei-sn-20160722-01-… *** HPE IceWall Identity Manager and HPE IceWall SSO Password Reset Option running Apache Commons FileUpload, Remote Denial of Service (DoS) *** --------------------------------------------- A potential security vulnerability has been identified with HPE IceWall Identity Manager and HPE IceWall SSO Password Reset Option running Apache Commons .. --------------------------------------------- https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05204371 *** US-Polizei will Smartphone eines Toten mittels künstlichem Finger entsperren *** --------------------------------------------- Eine US-Polizeibehörde will mittels eines 3D-gedruckten Fingers das Smartphone eines Toten entsperren. Sie erhofft sich, so den Mörder des Smartphone-Besitzers zu fassen. --------------------------------------------- http://heise.de/-3276618 *** Sicherheitsfirma Quadsys hat Konkurrenten gehackt *** --------------------------------------------- Mitglieder des Managements einer britischen Security-Firma sollen die Datenbanken einer konkurrierenden Firma gehackt haben, um an Kundendaten zu gelangen. Das haben die Beschuldigten nun auch zugegeben. --------------------------------------------- http://heise.de/-3276742 *** STARTTLS: Keine Verschlüsselung mit der SPD *** --------------------------------------------- Der Mailanbieter Posteo hat die Möglichkeit eingeführt, E-Mails nur noch zu verschicken, wenn der Zielserver die STARTTLS-Verschlüsselung anbietet. Dabei fielen einige Mailserver auf, die den längst etablierten Verschlüsselungsstandard nicht unterstützen. --------------------------------------------- http://www.golem.de/news/starttls-keine-verschluesselung-mit-der-spd-1607-1… *** Decrypter for Locky-mimicking PowerWare ransomware released *** --------------------------------------------- Palo Alto Networks’ researchers have created a decrypter for the variant of the PoshCoder ransomware that imitates the Locky ransomware. Dubbed PowerWare by the researchers, the malware adds the “.locky” filename .. --------------------------------------------- https://www.helpnetsecurity.com/2016/07/22/powerware-ransomware-decrypter/ *** Promi-Mailaccounts gehackt: Gefängnisstrafe für US-Amerikaner *** --------------------------------------------- Ein junger US-Amerikaner spionierte unter anderem Hollywood-Stars aus, indem er sich per Phishing Zugriff auf über 360 Mailaccounts verschaffte. Dafür wurde er nun verurteilt. --------------------------------------------- http://heise.de/-3276992

1 0

Tageszusammenfassung - Donnerstag 21-07-2016
by Daily end-of-shift report 21 Jul '16

21 Jul '16

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 20-07-2016 18:00 − Donnerstag 21-07-2016 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Cisco Unified Computing System Performance Manager Input Validation Vulnerability *** --------------------------------------------- A vulnerability in the web framework of Cisco Unified Computing System (UCS) Performance Manager could allow an authenticated, remote attacker to execute arbitrary commands.The vulnerability is due to insufficient input validation performed on parameters .. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** SoakSoak Botnets Now Pushing Neutrino Exploit Kit and CryptXXX Ransomware *** --------------------------------------------- Research spot SoakSoak botnets spreading the Neutrino Exploit Kit that in turn infect the unsuspecting with the CryptXXX ransomware. --------------------------------------------- http://threatpost.com/soaksoak-botnets-now-pushing-neutrino-exploit-kit-and… *** Everyones favorite infosec biz - Blue Coat - must cough up $40m to rival in patent rip-off row *** --------------------------------------------- >From SSL cert blowup to busted infringement appeal Blue Coat has lost its appeal challenging a nearly $40m patent infringement lawsuit brought by rival security company .. --------------------------------------------- www.theregister.co.uk/2016/07/20/blue_coat_finjan_lawsuit/ *** Tor Could Protect Your Smart Fridge From Spies and Hackers *** --------------------------------------------- There's a growing fear that the exploding internet of things - from baby cams to pacemakers - could be a goldmine for spies and criminal hackers alike. Tor could help protect them.The post Tor Could Protect Your Smart Fridge From Spies and Hackers appeared first on The Intercept. --------------------------------------------- https://theintercept.com/2016/07/20/tor-could-protect-your-smart-fridge-fro… *** Facebook malware - the missing piece *** --------------------------------------------- Recently we revealed that a threat actors exploited social networks to spread a Trojan that captures a victim's entire browser traffic. Approximately 10,000 Facebook users with Windows PCs were hit by malicious friend notifications. In this article we will explain the security issue and attack. --------------------------------------------- http://securelist.com/blog/research/75476/facebook-malware-the-missing-piec… *** Firefox blockiert bald Flash-Inhalte *** --------------------------------------------- Ab Version 48 folgt ein strengerer Umgang mit der sterbenden Web-Technologie --------------------------------------------- http://derstandard.at/2000041512429 *** Dell SonicWALL GSM comes with hidden default account *** --------------------------------------------- While developing new audit modules for the company's vulnerability scanning technology, Digital Defense researchers found six vulnerabilities in Dell's SonicWALL Global Management System, four of them deemed critical. SonicWALL GMS is a central control, .. --------------------------------------------- https://www.helpnetsecurity.com/2016/07/21/dell-sonicwall-gsm-backdoor/ *** Kritischer Fehler: Wichtiges Update für Mac-Netzwerkkontrolleur Little Snitch *** --------------------------------------------- Ein Bug ermöglicht einem Angreifer, den Netzwerkfilter der Mac-Software zu überlisten – die neu veröffentlichte Version soll das Problem ausräumen. Little Snitch überwacht ausgehende Netzwerkverbindungen in Mac OS X. --------------------------------------------- http://heise.de/-3275508 *** Ciscos Unified Computing System anfällig für Schad-Code *** --------------------------------------------- Im Unified Computing System Performance Manager klafft eine kritische Sicherheitslücke. Admins sollten die verfügbare abgesicherte Version zügig installieren. --------------------------------------------- http://heise.de/-3275609 *** Canadian Man Behind Popular 'Orcus RAT' *** --------------------------------------------- Far too many otherwise intelligent and talented software developers these days apparently think they can get away with writing, selling and supporting malicious software and then couching their commerce .. --------------------------------------------- http://krebsonsecurity.com/2016/07/canadian-man-is-author-of-popular-orcus-…

1 0

Tageszusammenfassung - Mittwoch 20-07-2016
by Daily end-of-shift report 20 Jul '16

20 Jul '16

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 19-07-2016 18:00 − Mittwoch 20-07-2016 18:00 Handler: Alexander Riepl Co-Handler: n/a *** DDoS trends: Bigger, badder but not longer *** --------------------------------------------- 10Gbps is the new norm, warns Arbor Networks DDoS attacks once again escalated in both size and frequency during the first six months of 2016. --------------------------------------------- www.theregister.co.uk/2016/07/19/ddos_sitrep/ *** Critical Patch Update - July 2016 *** --------------------------------------------- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html *** Solaris Third Party Bulletin - July 2016 *** --------------------------------------------- http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.h… *** Oracle Linux Bulletin - July 2016 *** --------------------------------------------- http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090… *** Oracle VM Server for x86 Bulletin - July 2016 *** --------------------------------------------- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-309054… *** ASN.1 Anyone? CVE-2016-5080, (Tue, Jul 19th) *** --------------------------------------------- *Queue Back to the Future Music* Over more than a decade ago there was a major discovery in ASN.1 that contributed to arguably one of the worst vulnerabilities in a long time. Fast forward *Queue awful fast forward tape music* to .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=21277 *** WordPress admin? Thinking of spending time with the family? Think again *** --------------------------------------------- P0wnage party pops plugins, providing plenty of party-pooping projects The Dutch hacking communitys Summer of Pwnage (SoP) has disclosed three vulnerabilities in WordPress plugins, including an XSS in the popular Ninja Forms. --------------------------------------------- www.theregister.co.uk/2016/07/20/wordpress_admin_thinking_of_spending_time_… *** Flaws found in security products from AVG, Symantec and McAfee *** --------------------------------------------- Patch frenzy imminent, say researchers, thanks to bad use of code hooking Hundreds of security products may not be up the job, researchers say, thanks to flawed uses of code hooking.… --------------------------------------------- www.theregister.co.uk/2016/07/20/hooks_cooked_hackers_crack_tonnes_of_secur… *** Ruining the Magic of Magentos Encryption Library *** --------------------------------------------- Lets look at how Magento implements cryptography, with a series of exhibits followed by an explanation of whats happening and why its dangerous: ... If you looked at the code, I promise this is every bit as bad as it looks at a glance. --------------------------------------------- http://www.openwall.com/lists/oss-security/2016/07/19/3 *** Hackers Allegedly Steal 1.4M Passwords From Mac Forums, Web Hosting Talk *** --------------------------------------------- A hacker or hackers has allegedly stolen more than 1.4 million passwords, email addresses, and other data from the databases of popular forums including Web Hosting Talk, and Mac Forums and HotScripts. --------------------------------------------- https://motherboard.vice.com/read/hackers-allegedly-steal-14m-passwords-fro… *** DNSSEC-Schlüsseltausch 2017 – die Vorbereitungen laufen *** --------------------------------------------- Wer am 11. Oktober 2017 meint, dass sein Internet kaputt ist, der sollte bei seinem Provider nachfragen, ob das mit dem DNSSEC-Schlüsseltausch zu tun hat. Bis dahin ist es zwar noch ein wenig hin, doch die Vorbereitungen laufen auf Hochtouren. --------------------------------------------- http://heise.de/-3273136 *** ICS Security Training In London *** --------------------------------------------- SANS ICS London takes place on September 19-25th, at the Grand Connaught Rooms. - Attend the one-day European ICS Security Summit on Monday 19th September. - Take ICS515: ICS Active Defence and Incident Response - a 5-day course, .. --------------------------------------------- https://www.sans.org/event/ics-london-2016 *** Vtiger CRM does not properly restrict access to application data *** --------------------------------------------- http://jvn.jp/en/jp/JVN01956993/ *** WordPress plugin "Nofollow Links" vulnerable to cross-site scripting *** --------------------------------------------- http://jvn.jp/en/jp/JVN13582657/ *** Petya Ransomware Analysis Part I *** --------------------------------------------- Introduction What makes Petya a special ransomware is that it doesn’t aim to encrypt each file individually, but aims for low-level disk encryption. In this series, we’ll be looking .. --------------------------------------------- http://resources.infosecinstitute.com/petya-ransomware-analysis-part-i/ *** Rekord-Quartals-Update: Oracle fixt 276 Sicherheitslücken in seinen Produkten *** --------------------------------------------- Die meisten Schwachstellen klaffen in Fusion Middleware und der Sun System Products Suite. Aber auch Java SE ist verwundbar und bekommt Sicherheits-Updates spendiert. --------------------------------------------- http://heise.de/-3273522 *** Unechte Bank Austria-Mails und Phishing-Apps im Umlauf *** --------------------------------------------- Mit unechten Bank Austria-Nachrichten oder der Phishing-App „Bank Austria SmsSecurity“ versuchen Kriminelle, an Zugangsdaten von Kunden des Unternehmens zu gelangen. Damit verfolgen sie das Ziel, auf fremde Kosten Transaktionen durchzuführen und sich zu bereichern. --------------------------------------------- https://www.watchlist-internet.at/phishing/unechte-bank-austria-mails-und-p…

1 0

Tageszusammenfassung - Dienstag 19-07-2016
by Daily end-of-shift report 19 Jul '16

19 Jul '16

======================= = End-of-Shift report = ======================= Timeframe: Montag 18-07-2016 18:00 − Dienstag 19-07-2016 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Third time (un)lucky – improved Petya is out *** --------------------------------------------- So far, we dedicated several articles to the interesting, low-level ransomware called Petya, hijacking the boot sector. Each of those versions was using Salsa20 algorithm to encrypt Master File Table and make disk inaccessible. However, .. --------------------------------------------- https://blog.malwarebytes.com/threat-analysis/2016/07/third-time-unlucky-im… *** DSA-3622 python-django - security update *** --------------------------------------------- It was discovered that Django, a high-level Python web developmentframework, is prone to a cross-site scripting vulnerability in theadmins add/change related popup. --------------------------------------------- https://www.debian.org/security/2016/dsa-3622 *** World-Check terror suspect DB hits the web at just US$6750 *** --------------------------------------------- Last months borked Couchdb breach delivers more pain to Thomson Reuters The World-Check database that lists "heightened risk individuals and organizations" is reportedly up for sale on the dark web. --------------------------------------------- www.theregister.co.uk/2016/07/19/6750_buys_you_22_million_worldcheck_citize… *** Carbanak Gang Tied to Russian Security Firm? *** --------------------------------------------- Among the more plunderous cybercrime gangs is a group known as "Carbanak," Eastern European hackers blamed for stealing more than a billion dollars from banks. Today .. --------------------------------------------- http://krebsonsecurity.com/2016/07/carbanak-gang-tied-to-russian-security-f… *** Lauschangriff: Netzwerk-Geräte von Juniper akzeptierten selbst signierte Zertifikate *** --------------------------------------------- Juniper hat in seinem Betriebssystem Junos OS einen Bug geschlossen, der die Signatur-Prüfung von Zertifikaten aushebelte. --------------------------------------------- http://heise.de/-3270285 *** Apple aktualisiert alle seine Betriebssysteme *** --------------------------------------------- iOS 9.3.3, OS X El Captian 10.11.6, watchOS 2.2.2 und tvOS 9.2.2 stehen zum Download bereit – und beheben Fehler vor dem nächsten großen Update. --------------------------------------------- http://heise.de/-3270059 *** Malware History: Code Red *** --------------------------------------------- Fifteen years (5479 days) ago… Code Red hit its peak. An infamous computer worm, Code Red exploited a vulnerability in Microsoft Internet Information Server (IIS) to propagate. Infected servers displayed the following .. --------------------------------------------- https://labsblog.f-secure.com/2016/07/19/malware-history-code-red/ *** Cross-Site Scripting in third party library mso/idna-convert *** --------------------------------------------- https://typo3.org/news/article/cross-site-scripting-in-third-party-library-… *** Cross-Site Scripting vulnerability in typolinks *** --------------------------------------------- https://typo3.org/news/article/cross-site-scripting-vulnerability-in-typoli… *** SQL Injection in TYPO3 Frontend Login *** --------------------------------------------- https://typo3.org/news/article/sql-injection-in-typo3-frontend-login/ *** Cross-Site Scripting in TYPO3 Backend *** --------------------------------------------- https://typo3.org/news/article/cross-site-scripting-in-typo3-backend-1/ *** Pokémon Go: Sicherheitsforscher stoßen auf 215 Fake-Apps *** --------------------------------------------- In verschiedenen Android-App-Stores sollen gefährliche Trittbrettfahrer-Apps lauern, die mit Pokémon Go bis auf den Namen nichts gemein haben. Im schlimmsten Fall spionieren sie Geräte aus. --------------------------------------------- http://heise.de/-3270676 *** Long lasting Magnitude EK malvertising campaign not affected by slowdown in EK activity *** --------------------------------------------- We have been tracking a malvertising campaign distributing the Cerber ransomware linked to the actor behind the Magnitude exploit kit for months. Despite a global slowdown in .. --------------------------------------------- https://blog.malwarebytes.com/cybercrime/exploits/2016/07/long-lasting-magn…

1 0

Tageszusammenfassung - Montag 18-07-2016
by Daily end-of-shift report 18 Jul '16

18 Jul '16

======================= = End-of-Shift report = ======================= Timeframe: Freitag 15-07-2016 18:00 − Montag 18-07-2016 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** New Realstatistics Attack Vector Compromising Joomla Sites *** --------------------------------------------- Over the past few weeks we’ve seen a large number of Joomla websites compromised with the Realstatistics malware campaign. This mass infection is still evolving and continues .. --------------------------------------------- https://blog.sucuri.net/2016/07/new-realstatistics-attack-vector-compromisi… *** Security Advisory - Input Validation Vulnerabilities in Camera Driver of Huawei Smart Phones *** --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2016/huawei-sa-20160716-… *** Zwei Millionen Nutzerdaten vom Ubuntu-Forum gestohlen *** --------------------------------------------- Das Internet-Forum der Linux-Distribution Ubuntu wurde gehackt. Zwei Millionen Datensätze von Nutzern wurden dabei gestohlen. Passwörter sollen nicht betroffen sein. --------------------------------------------- http://futurezone.at/digital-life/zwei-millionen-nutzerdaten-vom-ubuntu-for… *** Alter Trillian-Forumsserver gehackt, gut drei Millionen Nutzerdatensätze abgegriffen *** --------------------------------------------- Bei den Betreibern des Instant Messengers Trillian ist ein Server gehackt worden, der zu Archivzwecken Support-Forum und Blog hostete. Ein paar Millionen Nutzerdaten sind dabei in fremde Hände gelangt. Der eigentliche Messenger-Dienst ist nicht betroffen. --------------------------------------------- http://heise.de/-3269058 *** OWASP just posted AppSecEU 16 videos. Heres the playlist for those interested. *** --------------------------------------------- https://www.youtube.com/watch?v=qrTShcOW8kM&list=PLpr-xdpM8wG-Kf1_BOnT2LFZU… *** OpenSSH has user enumeration bug *** --------------------------------------------- Blowfish is faster than SHA256, and thats a problem when servers talk back A bug in OpenSSH allows an .. --------------------------------------------- www.theregister.co.uk/2016/07/17/openssh_has_user_enumeration_bug/ *** Extortion trojan watches until crims find you doing something dodgy *** --------------------------------------------- And then the extortion starts and youre asked to steal critical data A newly-detected piece of malware dubbed "Delilah" has been fingered as probably the first such code created .. --------------------------------------------- www.theregister.co.uk/2016/07/18/first_insider_theft_extortion_trojan_found/ *** Security firm clarifies power-station SCADA malware claim *** --------------------------------------------- Its not the next Stuxnet, says SentinelOne, its just very naughty code Malware hyped as aimed at the hear of power plants is nothing of the sort according to security .. --------------------------------------------- www.theregister.co.uk/2016/07/18/firm_calls_bullshit_on_scada_malware/ *** Understanding Electronic Control Units (ECUs) in Connected Automobiles and How They Can Be Hacked *** --------------------------------------------- Before you read any further, I must caution you that the weaknesses described in this article impact multiple ECUs on the market today and therefore have had all identifiers, such as references to specific automobile and ECU .. --------------------------------------------- https://www.alienvault.com/blogs/security-essentials/understanding-electron… *** Online Banking: User hatten Zugriff auf fremde Konten *** --------------------------------------------- Es ist eine Horrorvorstellung für viele Kunden: Ein Fremder schaut plötzlich auf das eigene Bankkonto. Das ist nun bei der Comdirect passiert - wegen einer technischen Panne. --------------------------------------------- http://futurezone.at/digital-life/online-banking-user-hatten-zugriff-auf-fr… *** Kritische Sicherheitslücke in CGI-Umgebungen (Apache, IIS, ...) *** --------------------------------------------- Es wurde ein Designfehler in diversen Implementationen des CGI Standards gefunden, der schwerwiegende Folgen für die Sicherheit der Webserver haben kann. CERT.at bittet daher um Beachtung der folgenden Hinweise. --------------------------------------------- https://cert.at/warnings/all/20160718.html

1 0

Tageszusammenfassung - Freitag 15-07-2016
by Daily end-of-shift report 15 Jul '16

15 Jul '16

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 14-07-2016 18:00 − Freitag 15-07-2016 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Erpressungstrojaner: Locky kann jetzt auch offline *** --------------------------------------------- Eine neue Version der Locky-Ransomware kann jetzt auch Rechner ohne Internetverbindung verschlüsseln. Die Offline-Variante hat für die Opfer immerhin einen kleinen Vorteil. --------------------------------------------- http://www.golem.de/news/erpressungstrojaner-locky-kann-jetzt-auch-offline-… *** Untangling Kovter's persistence methods *** --------------------------------------------- Kovter is a click-fraud malware famous from the unconventional tricks used for persistence. It hides malicious modules in PowerShell scripts as well as in registry keys to make detection and analysis difficult. In this post we will take a deep dive into the techniques used by its latest samples to see all the elements and...Categories: Malware Threat analysisTags: click fraudkovter(Read more...) --------------------------------------------- https://blog.malwarebytes.com/threat-analysis/2016/07/untangling-kovter/ *** Security Best Practices for Azure App Service Web Apps, Part 5 *** --------------------------------------------- Microsoft's Azure App Service is a fully managed platform as a service for developers that provides features and frameworks to quickly and easily build apps for any platform and any device. Despite the ease of using Azure, developers need to keep security in mind because Azure will not take care of every aspect of security. In our first... --------------------------------------------- https://blogs.mcafee.com/mcafee-labs/azure-app-service-web-apps-security-be… *** Reverse engineering DUBNIUM - Stage 2 payload analysis *** --------------------------------------------- Recently, we blogged about the basic functionality and features of the DUBNIUM advanced persistent threat (APT) activity group Stage 1 binary and Adobe Flash exploit used during the December 2015 incident (Part 1, Part 2). In this blog, we will go through the overall infection chain structure and the Stage 2 executable details. Stage 2 executables... --------------------------------------------- https://blogs.technet.microsoft.com/mmpc/2016/07/14/reverse-engineering-dub… *** Oracle Critical Patch Update Pre-Release Announcement - July 2016 *** --------------------------------------------- This Critical Patch Update Pre-Release Announcement provides advance information about the Oracle Critical Patch Update for July 2016, which will be released on Tuesday, July 19, 2016. --------------------------------------------- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html *** Spähsoftware: Maxthon-Browser sendet kritische Daten nach China *** --------------------------------------------- Forscher haben entdeckt, dass der alternative Browser Maxthon sicherheitsrelevante Nutzerdaten an einen Server in Peking sendet. Die Daten ließen sich hervorragend für gezielte Angriffe nutzen. Und sie sind nur schlecht gegen Dritte abgesichert. --------------------------------------------- http://www.golem.de/news/spaehsoftware-maxthon-browser-sendet-sensible-date… *** Steueranlagen von Kraftwerken ungeschützt im Netz *** --------------------------------------------- Journalisten haben über 100 Systeme - Steuerungen von Kraftwerken, Eigenheimen und Industrieanlagen - gefunden, die ungeschützt im Netz erreichbar sind - auch in Österreich. --------------------------------------------- http://futurezone.at/digital-life/steueranlagen-von-kraftwerken-ungeschuetz… *** Neutrino EK picks up momentum in recent attacks *** --------------------------------------------- The Neutrino developers have made some changes to the landing page source code as well as integrated a new exploit. The malware campaigns that once were Anglers continue to point to Neutrino including a large malvertising attack on top adult sites we detected a few days ago.Categories: Cybercrime ExploitsTags: AnglerEKexploit kitmalvertisingneutrino(Read more...) --------------------------------------------- https://blog.malwarebytes.com/cybercrime/2016/07/neutrino-ek-picks-up-momen… *** Debian Security Advisory DSA-3618-1 - php5 security update *** --------------------------------------------- CVE ID: CVE-2016-5768 CVE-2016-5769 CVE-2016-5770 CVE-2016-5771 CVE-2016-5772 CVE-2016-5773 Several vulnerabilities were found in PHP, a general-purpose scripting language commonly used for web application development. The vulnerabilities are addressed by upgrading PHP to the new upstream version 5.6.23, which includes additional bug fixes. --------------------------------------------- https://lists.debian.org/debian-security-announce/2016/msg00196.html *** DFN-CERT-2016-1140: FortiManager, FortiAnalyzer: Eine Schwachstelle ermöglicht einen Cross-Site-Scripting-Angriff *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2016-1140/ *** F5 Security Advisories *** --------------------------------------------- *** sol53084033: OpenSSL vulnerability CVE-2016-2178 *** An attacker could trigger an exploit using a timing side-channel attack to discover a DSA private key. https://support.f5.com/kb/en-us/solutions/public/k/53/sol53084033.html?ref=… --------------------------------------------- *** sol04054286: Linux kernel TCP vulnerability CVE-2016-2070 *** Successful exploitation of this vulnerability leads to a denial-of-service (DoS) attack, due to a divide-by-zero error which causes the system to stop responding. Product/Versions known to be vulnerable: ARX 6.2.0 - 6.4.0, Traffix SDC 5.0.0, 4.0.0 - 4.4.0 https://support.f5.com/kb/en-us/solutions/public/k/04/sol04054286.html?ref=… --------------------------------------------- *** sol05125306: glibc vulnerability CVE-2016-1234 *** This vulnerability may allow a context-dependent attacker to cause a denial of service (DoS) via a long name. Product/Versions known to be vulnerable: Traffix SDC 5.0.0, 4.0.0 - 4.4.0 https://support.f5.com/kb/en-us/solutions/public/k/05/sol05125306.html?ref=… --------------------------------------------- *** sol23873366: OpenSSL vulnerability CVE-2016-2177 *** This vulnerability may allow remote attackers to cause a denial-of-service (DoS) attack. https://support.f5.com/kb/en-us/solutions/public/k/23/sol23873366.html?ref=… --------------------------------------------- *** Cisco Security Advisories *** --------------------------------------------- *** Cisco Meeting Server Persistent Cross-Site Scripting Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco WebEx Meetings Server Administrator Interface Reflected Cross-Site Scripting Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco WebEx Meetings Server Reflected Cross-Site Scripting Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco WebEx Meetings Server Administrator Interface SQL Injection Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco WebEx Meetings Server Command Injection Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: XML External Entities Injection Vulnerability in IBM Traveler (CVE-2016-3039) *** http://www-01.ibm.com/support/docview.wss?uid=swg21985858 --------------------------------------------- *** IBM Security Bulletin: Multiple security vulnerabilities have been identified in IBM JRE and WebSphere Application Server shipped with IBM Tivoli Service Automation Manager (CVE-2016-3426, CVE-2016-3427) *** http://www-01.ibm.com/support/docview.wss?uid=swg2C1000148 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli Application Dependency Discovery Manager (TADDM) - IBM Java SDK updates April 2016 *** http://www-01.ibm.com/support/docview.wss?uid=swg21985875 --------------------------------------------- *** IBM Security Bulletin: IBM Tivoli Monitoring embedded WebSphere Application Server (CVE-2016-3426, CVE-2016-3427, CVE-2016-0306, CVE-2015-0254) *** http://www-01.ibm.com/support/docview.wss?uid=swg21984732 --------------------------------------------- *** IBM Security Bulletin: A cross-site scripting vulnerability in IBM WebSphere Application Server affects IBM Security Access Manager Version 9 (CVE-2015-7417) *** http://www.ibm.com/support/docview.wss?uid=swg21987056 --------------------------------------------- *** ICS-CERT Advisories *** --------------------------------------------- *** Schneider Electric Pelco Digital Sentry Video Management System Vulnerability *** https://ics-cert.us-cert.gov/advisories/ICSA-16-196-01 --------------------------------------------- *** Moxa MGate Authentication Bypass Vulnerability *** https://ics-cert.us-cert.gov/advisories/ICSA-16-196-02 --------------------------------------------- *** Schneider Electric SoMachine HVAC Unsafe ActiveX ControL Vulnerability *** https://ics-cert.us-cert.gov/advisories/ICSA-16-196-03 --------------------------------------------- *** Philips Xper-IM Connect Vulnerabilities *** https://ics-cert.us-cert.gov/advisories/ICSMA-16-196-01 --------------------------------------------- *** Advantech WebAccess ActiveX Vulnerabilities (Update A) *** https://ics-cert.us-cert.gov/advisories/ICSA-16-173-01 ---------------------------------------------

1 0

Tageszusammenfassung - Donnerstag 14-07-2016
by Daily end-of-shift report 14 Jul '16

14 Jul '16

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 13-07-2016 18:00 − Donnerstag 14-07-2016 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Troldesh ransomware influenced by (the) Da Vinci code *** --------------------------------------------- We at the MMPC are constantly tracking new and emerging ransomware threats so we can be one step ahead of active campaigns and help protect our users. As part of these efforts, we recently came across a new variant of the Win32/Troldesh ransomware family. Ransomware, like most malware, is constantly trying to change itself in... --------------------------------------------- https://blogs.technet.microsoft.com/mmpc/2016/07/13/troldesh-ransomware-inf… *** The Power of Web Shells, (Wed, Jul 13th) *** --------------------------------------------- [Warning: this diary contains many pictures and may take some time to load on slow links] Web shellsare not new in the threats landscape. A web shell is a script (written in PHP, ASL, Perl, ... - depending on the available environment) that can be uploaded to a web server to enable remote administration. If web shells are usually installed for good purposes, many of them are installed on compromisedservers. Once in place, the web shell will allow a complete takeover of the victims server but it... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=21257&rss *** PCI for SMB - Requirement 2- Do Not Use Defaults *** --------------------------------------------- In this series of articles, we talk about PCI and how it affects SMBs (small/medium sized businesses) that are going through the compliance process using the PCI SAQ's (Self Assessment Questionaries). --------------------------------------------- https://blog.sucuri.net/2016/07/pci-for-smb-requirement-2-do-not-use-defaul… *** Beware of ws-xmlrpc library in your Java App *** --------------------------------------------- Apache XML-RPC is a XML-RPC library for Java. XML-RPC is a protocol for making remote procedure call via HTTP with the help of XML. Apache XML-RPC can be used on the client's side to make XML-RPC calls as well as on the server's side to expose some functionality via XML-RPC. Now ws-xmlrpc library is not supported by Apache. Last version is 3.1.3 which was released in 2013. However, many applications still use ws-xmlrpc library. Among them are Apache Continuum and Apache Archiva. --------------------------------------------- https://0ang3el.blogspot.co.at/2016/07/beware-of-ws-xmlrpc-library-in-your.… *** Join ENISA study on cloud security and eHealth *** --------------------------------------------- ENISA, using its prior knowledge on cloud security, launches a study on cloud and eHealth. --------------------------------------------- https://www.enisa.europa.eu/news/enisa-news/join-enisa-study-on-cloud-secur… *** DLL Hijacking Attacks Revisited *** --------------------------------------------- This article is all about different DLL hijacking attacks techniques used by malware to achieve persistence. We will be discussing DLL search order hijacking, DLL Side loading, and Phantom DLL Hijacking techniques. Also, we will see how can we detect it and prevent the DLL hijacking attack. What is DLL hijacking? DLL provide common code... --------------------------------------------- http://resources.infosecinstitute.com/dll-hijacking-attacks-revisited/ *** Github Engineering: SYN Flood Mitigation with synsanity *** --------------------------------------------- In an effort to reduce the impact of these attacks, we began work on a series of additional mitigation strategies and systems to better prepare us for a future attack of a similar nature. Today we're sharing our mitigation for one of the attacks we received: synsanity, a SYN flood DDoS mitigation module for Linux 3.x. --------------------------------------------- http://githubengineering.com/syn-flood-mitigation-with-synsanity/ *** The Value of a Hacked Company *** --------------------------------------------- Most organizations only grow in security maturity the hard way -- that is, from the intense learning that takes place in the wake of a costly data breach. That may be because so few company leaders really grasp the centrality of computer and network security to the organizations overall goals and productivity, and fewer still have taken an honest inventory of what may be at stake in the event that these assets are compromised. --------------------------------------------- http://krebsonsecurity.com/2016/07/the-value-of-a-hacked-company/ *** Warnung vor der Verschlüsselungssoftware "Cerber" *** --------------------------------------------- [...] Die Ransomware „Cerber“ wird aktuell durch gefälschte Bewerbungsschreiben verbreitet. Die Täter antworten auf Stellenangebote im Internet und versenden den Schadcode mit den beigefügten Dateien, die beispielsweise als Lebenslauf getarnt sind. Dadurch verleihen sie ihren Emails eine erhöhte Plausibilität und Glaubwürdigkeit. Beim Öffnen der Datei wird der Schadcode ausgeführt bzw. aus dem Internet nachgeladen. In weiterer Folge werden Daten auf sämtlichen im Netzwerk befindlichen Computern und Laufwerken verschlüsselt. --------------------------------------------- http://www.bmi.gv.at/cms/BK/betrug/files/C4_Newsletter_Ransomware_Cerber.pdf *** LibTIFF Buffer Index Error in TIFFReadRawStrip1() and TIFFReadRawTile1() Lets Remote Users Obtain Potentially Sensitive Information on the Target System *** --------------------------------------------- http://www.securitytracker.com/id/1036300 *** Bugtraq: [ERPSCAN-16-021] SAP xMII - Reflected XSS vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/538900 *** Bugtraq: [ERPSCAN-16-020] SAP NetWeaver AS JAVA UDDI component - XXE vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/538901 *** Bugtraq: [ERPSCAN-16-019] SAP NetWeaver Enqueue Server - DoS vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/538902 *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect StoredIQ (CVE-2016-2107) *** --------------------------------------------- OpenSSL vulnerabilities were disclosed on May 3, 2016 by the OpenSSL Project. OpenSSL is used by StoredIQ. StoredIQ has addressed the applicable CVEs. CVE(s): CVE-2016-2107 Affected product(s) and affected version(s): StoredIQ v7.6 Refer to the following reference URLs for remediation and additional vulnerability details:Source Bulletin: http://www-01.ibm.com/support/docview.wss?uid=swg21985359X-Force Database: https://exchange.xforce.ibmcloud.com/vulnerabilities/112854 --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg21985359 *** IBM Security Bulletin: A JMX component vulnerability in IBM Java SDK and IBM WebSphere Application Server affects IBM Emptoris Strategic Supply Management Suite and IBM Emptoris Services Procurement (CVE-2016-3427) *** --------------------------------------------- The IBM Emptoris Strategic Supply Management Suite and IBM Emptoris Services Procurement products are affected by a JMX component security vulnerability that exists in IBM SDK Java Technology Edition and IBM WebSphere Application Server. This issue was disclosed as part of the IBM Java SDK updates in April 2016. CVE(s): CVE-2016-3427 Affected product(s) and affected... --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg21986797 *** IBM Security Bulletin: IBM Traveler installer impacted by vulnerability in InstallAnywhere (CVE-2016-2542) *** --------------------------------------------- IBM Traveler installer utilizes a version of Flexera InstallAnywhere which could allow a local attacker to gain elevated privileges on the system. CVE(s): CVE-2016-2542 Affected product(s) and affected version(s): IBM Traveler 8.5.3 IBM Traveler 9.0 IBM Traveler 9.0.1 Refer to the following reference URLs for remediation and additional vulnerability details:Source Bulletin: http://www.ibm.com/support/docview.wss?uid=swg21984632X-Force Database: --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21984632 *** IBM Security Bulletin: Vulnerability in InstallAnywhere affects IBM License Metric Tool v7.5 & v7.2.2, IBM Tivoli Asset Discovery for Distributed and IBM Endpoint Manger for Software Use Analysis v2.2 (CVE-2016-4560) *** --------------------------------------------- A vulnerability in InstallAnywhere on Windows systems affects IBM License Metric Tool v7.5 & v7.2.2, IBM Tivoli Asset Discovery for Distributed and IBM Endpoint Manger for Software Use Analysis v2.2. CVE(s): CVE-2016-4560 Affected product(s) and affected version(s): IBM License Metric Tool v7.5 & v7.2.2 IBM Tivoli Asset Discovery for Distributed IBM Endpoint Manger for Software... --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg21983503 *** USN-3032-1: eCryptfs vulnerability *** --------------------------------------------- Ubuntu Security Notice USN-3032-114th July, 2016ecryptfs-utils vulnerabilityA security issue affects these releases of Ubuntu and its derivatives: Ubuntu 16.04 LTS Ubuntu 15.10SummaryeCryptfs could be made to expose sensitive information.Software description ecryptfs-utils - eCryptfs cryptographic filesystem utilities DetailsIt was discovered that eCryptfs incorrectly configured the encrypted swappartition for certain drive types. An attacker could use this issue to discoversensitive... --------------------------------------------- http://www.ubuntu.com/usn/usn-3032-1/ *** VU#665280: Accela Civic Platform Citizen Access portal contains multiple vulnerabilities *** --------------------------------------------- Vulnerability Note VU#665280 Accela Civic Platform Citizen Access portal contains multiple vulnerabilities Original Release date: 13 Jul 2016 | Last revised: 13 Jul 2016 Overview Accela Civic Platform Citizen Access portal contains cross-site scripting and arbitrary file upload vulnerabilities. Description CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) - CVE-2016-5660Accela Civic Platform Citizen Access portal contains a cross-site scripting (XSS) --------------------------------------------- http://www.kb.cert.org/vuls/id/665280 *** Cisco ASR 5000 Series SNMP Community String Disclosure Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco IOS XR Software Command Injection Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco IOS XR for NCS 6000 Packet Timer Leak Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** RESTWS - Highly critical - Remote code execution - SA-CONTRIB-2016-040 *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2016-040Project: RESTful Web Services (third-party module)Version: 7.xDate: 2016-July-13Security risk: 22/25 ( Highly Critical) AC:None/A:None/CI:All/II:All/E:Theoretical/TD:AllVulnerability: Arbitrary PHP code executionDescriptionThis module enables you to expose Drupal entities as RESTful web services.RESTWS alters the default page callbacks for entities to provide additional functionality.A vulnerability in this approach allows an attacker to send specially... --------------------------------------------- https://www.drupal.org/node/2765567 *** Coder - Highly Critical - Remote Code Execution - SA-CONTRIB-2016-039 *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2016-039Project: Coder (third-party module)Version: 7.xDate: 2016-July-13Security risk: 20/25 ( Highly Critical) AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:AllVulnerability: Arbitrary PHP code executionDescriptionThe Coder module checks your Drupal code against coding standards and other best practices. It can also fix coding standard violations and perform basic upgrades on modules.The module doesnt sufficiently validate user inputs in a script file that has... --------------------------------------------- https://www.drupal.org/node/2765575 *** Webform Multiple File Upload - Critical - Remote Code Execution - SA-CONTRIB-2016-038 *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2016-038Project: Webform Multiple File Upload (third-party module)Version: 7.xDate: 2016-July-13Security risk: 17/25 ( Critical) AC:Basic/A:User/CI:All/II:All/E:Theoretical/TD:DefaultVulnerability: Arbitrary PHP code executionDescriptionThe Webform Multiple File Upload module allows users to upload multiple files on a Webform.The Webform Multifile File Upload module contains a Remote Code Execution (RCE) vulnerability where form inputs will be unserialized and a... --------------------------------------------- https://www.drupal.org/node/2765573 *** sol08440897: Linux kernel vulnerability CVE-2016-0774 *** --------------------------------------------- Impact: A local unprivileged user may be able to leak kernel memory to user space or cause a denial-of-service (DoS). --------------------------------------------- https://support.f5.com/kb/en-us/solutions/public/k/08/sol08440897.html?ref=… *** sol55181425: Wget vulnerability CVE-2016-4971 *** --------------------------------------------- Impact: An attacker with local access may be able to upload arbitrary files to the system. Product/Versions known to be vulnerable: ARX 6.2.0 - 6.4.0, Traffix SDC 5.0.0, 4.0.0 - 4.4.0 --------------------------------------------- https://support.f5.com/kb/en-us/solutions/public/k/55/sol55181425.html?ref=… *** sol55922302: XSS in F5 WebSafe Dashboard vulnerability CVE-2016-5236 *** --------------------------------------------- Cross-Site-Scripting (XSS) vulnerabilities in F5 WebSafe Dashboard allow privileged authenticated user to inject arbitrary web script or HTML when creating a new user, account or signature. (CVE-2016-5236) --------------------------------------------- https://support.f5.com/kb/en-us/solutions/public/k/55/sol55922302.html?ref=… *** Juniper Security Advisories *** --------------------------------------------- *** JSA10751 - 2016-07 Security Bulletin: SRX Series: On High-End SRX-Series, ALGs applied to in-transit traffic may trigger high CP (central point) utilization leading to denial of services. (CVE-2016-1276) *** http://kb.juniper.net/index?page=content&id=JSA10751&actp=RSS --------------------------------------------- *** JSA10758 - 2016-07 Security Bulletin: Junos: Crafted UDP packet can lead to kernel crash on 64-bit platforms (CVE-2016-1263) *** http://kb.juniper.net/index?page=content&id=JSA10758&actp=RSS --------------------------------------------- *** JSA10756 - 2016-07 Security Bulletin: Junos: FreeBSD-SA-09:07.libc - Information leak in db(3) (CVE-2009-0590) *** http://kb.juniper.net/index?page=content&id=JSA10756&actp=RSS --------------------------------------------- *** JSA10755 - 2016-07 Security Bulletin: Junos: Self-signed certificate with spoofed trusted Issuer CN accepted as valid (CVE-2016-1280) *** http://kb.juniper.net/index?page=content&id=JSA10755&actp=RSS --------------------------------------------- *** JSA10754 - 2016-07 Security Bulletin: Junos J-Web: Privilege Escalation due to information leak (CVE-2016-1279) *** http://kb.juniper.net/index?page=content&id=JSA10754&actp=RSS --------------------------------------------- *** JSA10750 - 2016-07 Security Bulletin: Junos: mbuf leak when flooding new IPv6 MAC addresses received via VPLS instances (CVE-2016-1275) *** http://kb.juniper.net/index?page=content&id=JSA10750&actp=RSS --------------------------------------------- *** JSA10753 - 2016-07 Security Bulletin: SRX Series: Upgrades using partition option may allow unauthenticated root login (CVE-2016-1278) *** http://kb.juniper.net/index?page=content&id=JSA10753&actp=RSS --------------------------------------------- *** JSA10752 - 2016-07 Security Bulletin: Junos: Kernel crash with crafted ICMP packet (CVE-2016-1277) *** http://kb.juniper.net/index?page=content&id=JSA10752&actp=RSS --------------------------------------------- *** JSA10756 - 2016-07 Security Bulletin: Junos: FreeBSD-SA-09:07.libc - Information leak in db(3) (CVE-2009-1436) *** http://kb.juniper.net/index?page=content&id=JSA10756&actp=RSS ---------------------------------------------

1 0

Tageszusammenfassung - Mittwoch 13-07-2016
by Daily end-of-shift report 13 Jul '16

13 Jul '16

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 12-07-2016 18:00 − Mittwoch 13-07-2016 18:00 Handler: Robert Waldner Co-Handler: n/a *** VU#123799: libbpg contains a type confusion vulnerability that leads to out of bounds write *** --------------------------------------------- Vulnerability Note VU#123799 libbpg contains a type confusion vulnerability that leads to out of bounds write Original Release date: 12 Jul 2016 | Last revised: 12 Jul 2016 Overview libbpg is a library for the BPG graphics format. libbpg 0.9.5 through 0.9.7 may allow a crafted file to write out-of-bounds, which may lead to denial of service or arbitrary code execution. Description CWE-787: Out-of-bounds Write - CVE-2016-5637According to the reporter, improper checking of... --------------------------------------------- http://www.kb.cert.org/vuls/id/123799 *** MSRT July 2016 - Cerber ransomware *** --------------------------------------------- As part of our ongoing effort to provide better malware protection, the July 2016 release of the Microsoft Malicious Software Removal Tool (MSRT) includes detection for Win32/Cerber, a prevalent ransomware family. The inclusion in MSRT complements our Cerber-specific family detections in Windows Defender, and our ransomware-dedicated cloud protection features. We started seeing Cerber in February... --------------------------------------------- https://blogs.technet.microsoft.com/mmpc/2016/07/12/msrt-july-2016-cerber-r… *** Tollgrade Smart Grid EMS LightHouse Vulnerabilities *** --------------------------------------------- This advisory contains mitigation details for vulnerabilities in Tollgrade Communications, Inc.'s Smart Grid LightHouse Sensor Management System Software EMS. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-16-194-01 *** GE Proficy HMI SCADA CIMPLICITY Privilege Management Vulnerability *** --------------------------------------------- This advisory contains mitigation details for an improper privilege management vulnerability and recently released exploit code for the GE Proficy HMI/SCADA CIMPLICITY application. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-16-194-02 *** Hunting for Malicious Files with MISP + OSSEC, (Tue, Jul 12th) *** --------------------------------------------- A few months ago, I wrote a diary called Unity Makes Strength which was illustrated with an example of integrationbetween a malware analysis solution and a next-generation firewall. The goal is to increase the ability to block malicious traffic as soon as possible. Today, Id like to explain how to improve the detection of malware on Windows computers thanks to the integration of MISPand OSSEC. I already presented the Malware Information Sharing Platformin another diary. About OSSEC, in a few... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=21251&rss *** Patchday: Microsoft stopft Lücken in Windows, Office und SecureBoot *** --------------------------------------------- Microsoft hat elf Sicherheitsupdates für seine Produkte veröffentlicht. Die meisten davon sind als kritisch vermerkt und erlauben Angreifern aus dem Netz, eigenen Schadcode nach Belieben auszuführen. --------------------------------------------- http://heise.de/-3265524 *** Securing Smart Cars - Join ENISA study and workshop *** --------------------------------------------- ENISA is currently performing a study on cyber security measures for smart cars and earlier this year launched the ENISA CaRSEC (Cars and Roads SECurity) expert group. --------------------------------------------- https://www.enisa.europa.eu/news/enisa-news/securing-smart-cars-join-enisa-… *** Security Advisory - Input Validation Vulnerability in Huawei Routers *** --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2016/huawei-sa-20160713-… *** Security Advisory - Input Validation Vulnerability in WiFi Driver of Huawei Smart Phone *** --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2016/huawei-sa-20160713-… *** Security Advisory - Input Validation Vulnerability in Multiple Huawei Products *** --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2016/huawei-sa-20160713-… *** Drupal: Patch released today to fix a highly critical RCE in contributed modules, (Wed, Jul 13th) *** --------------------------------------------- Drupal announced that they will release today (Wed July13th 2016 16:00 UTC) a patch that will fix highly critical remote code execution vulnerabilities in contributed modules. Drupal core is not affected. The vulnerability is a PHP Arbitrary Code Execution and is rated up to 22/25 (based on risk calculation model used by Drupal - details here). The vulnerable modules are used on between 1.000 and 10.000 instances. If you maintain one or more Drupal websites, review the list of affected... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=21255&rss *** IBM Security Bulletin: IBM Personal Communications could allow a remote user to obtain sensitive information including user passwords, allowing unauthorized access. (CVE-2016-0321) *** --------------------------------------------- IBM Personal Communications is susceptible to unauthorized access vulnerability when running on a compromised system (by the victim opening a mail with a malicious attachment or visiting a malicious website). Malware could run with user privileges but not necessarily having access to the password. An attacker could retrieve user credentials by running PowerShell Script and... --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg21981692 *** Using the Java Security Manager in Enterprise Application Platform 7 *** --------------------------------------------- JBoss Enterprise Application Platform 7 allows the definition of Java Security Policies per application. The way its implemented means that well also be able to define security policies per module, in addition to define one per application. The ability to apply the Java Security Manager per application, or per module in EAP 7, makes it a versatile tool in the mitigation of serious security issues, or useful for applications with strict security requirements.The main difference between EAP 6,... --------------------------------------------- https://access.redhat.com/blogs/766093/posts/2276521

1 0

Tageszusammenfassung - Dienstag 12-07-2016
by Daily end-of-shift report 12 Jul '16

12 Jul '16

======================= = End-of-Shift report = ======================= Timeframe: Montag 11-07-2016 18:00 − Dienstag 12-07-2016 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Security updates available for Adobe Flash Player (APSB16-25) *** --------------------------------------------- Adobe has released security updates for Adobe Flash Player for Windows, Macintosh, Linux and ChromeOS. These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system. Platform: Windows, Macintosh, Linux and ChromeOS --------------------------------------------- https://helpx.adobe.com/security/products/flash-player/apsb16-25.html *** Bugtraq: Persistent Cross-Site Scripting in WP Live Chat Support plugin *** --------------------------------------------- A persistent Cross-Site Scripting (XSS) vulnerability has been found in the WP Live Chat Support plugin. By using this vulnerability an attacker can supply malicious code on behalf of a logged on WordPress user in order to perform a wide variety of actions, such as stealing victims' session tokens or login credentials, performing arbitrary actions on their behalf, and logging their keystrokes. --------------------------------------------- http://www.securityfocus.com/archive/1/538871 *** Serious flaw fixed in widely used WordPress plug-in *** --------------------------------------------- If youre running a WordPress website and you have the hugely popular All in One SEO Pack plug-in installed, its a good idea to update it as soon as possible. The latest version released Friday fixes a flaw that could be used to hijack the sites admin account.The vulnerability is in the plug-ins Bot Blocker functionality and can be exploited remotely by sending HTTP requests with specifically crafted headers to the website.The Bot Blocker feature is designed to detect and block spam bots based --------------------------------------------- http://www.csoonline.com/article/3093379/security/serious-flaw-fixed-in-wid… *** Hiding in White Text: Word Documents with Embedded Payloads, (Wed, Jul 6th) *** --------------------------------------------- This is a guest diary by Yaser Mansour. Due to the extensive use of images, please note that all the images are clickable to view them at full size. A PDF version of this diary is available here Malicious macros in Office documents are not new, and several samples have been analyzed here at the ISC Diary website. Usually, the macro script is used to drop the second stage malware either by reaching to the internet or by extracting a binary embedded in the Office document itself. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=21227&rss *** Jigsaw Ransomware Decrypted, Again *** --------------------------------------------- Jigsaw ransomware's encryption has been thwarted by Check Point researchers that discover a fatal flaw. --------------------------------------------- http://threatpost.com/jigsaw-ransomware-decrypted-again/119186/ *** [RCESEC-2016-003][CVE-2016-4469] Apache Archiva 1.3.9 Multiple Cross-Site Request Forgeries *** --------------------------------------------- The application basically offers a Cross-Site Request Forgery protection using the a Struts-based token called "token". While many administrative functionalities like adding new users are protected on this way, the following HTTP POST-based functions are missing this token and are therefore vulnerable to CSRF: --------------------------------------------- http://www.securityfocus.com/archive/1/538877 *** [security bulletin] HPSBHF03608 rev.1 - HPE iMC PLAT and other Network Products using Apache Java Commons Collection (ACC), Remote Execution of Arbitrary Code *** --------------------------------------------- Potential Security Impact: Remote Execution of Arbitrary Code VULNERABILITY SUMMARY: A vulnerability in Apache Commons Collections (ACC) for handling Java object deserialization was addressed by HPE iMC PLAT and other network products. The vulnerability could be exploited remotely to allow execution of arbitrary code. --------------------------------------------- http://www.securityfocus.com/archive/1/538880 *** SSA-301706 (Last Update 2016-07-12): GNU C Library Vulnerability in Industrial Products *** --------------------------------------------- https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-301706… *** The July 2016 issue of our SWITCH Security Report is available! *** --------------------------------------------- A new issue of our monthly SWITCH Security Report has just been released. The topics covered in this report are: * DAO-ism on the ethereal plane - hacker bags cryptocurrency worth USD 50 million * Ransomware - smart, greedy and unkillable * CANVAS ready to launch - bridging cybersecurity and ethics * US border guards want to be your Facebook friend - and other news on anti-terror measures The Security Report is available in both English and German. --------------------------------------------- https://securityblog.switch.ch/2016/07/12/july-2016-issue-switch-security-r… *** Erpressungs-Trojaner Ranscam schickt Daten unwiederbringlich ins digitale Nirwana *** --------------------------------------------- Wie jede Ransomware behauptet auch Ranscam, alle als Geiseln genommenen persönlichen Daten nach einer Lösegeldzahlung freizugeben. In diesem Fall haben das die Drahtzieher aber grundsätzlich gar nicht vorgesehen, warnen Sicherheitsforscher. --------------------------------------------- http://heise.de/-3265137 *** SFG: Furtim's Parent *** --------------------------------------------- The Labs team at SentinelOne recently discovered a sophisticated malware campaign specifically targeting at least one European energy company. --------------------------------------------- https://sentinelone.com/blogs/sfg-furtims-parent/ *** IBM Security Bulletins*** --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect IBM Flex System FC3171 8Gb SAN Switch & SAN Pass-thru Firmware (CVE-2016-2107 CVE-2016-2176) *** https://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=migr-5099429 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in icu affects IBM Flex System Chassis Management Module (CVE-2014-9654) *** https://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=migr-5099427 --------------------------------------------- *** IBM Security Bulletin: IBM Maximo Asset Management could expose sensitive information produced in log files of certain URLs (CVE-2016-0393) *** http://www-01.ibm.com/support/docview.wss?uid=swg21986053 --------------------------------------------- *** IBM Security Bulletin: Multiple Security Vulnerabilities fixed in IBM Security Privileged Identity Manager *** http://www-01.ibm.com/support/docview.wss?uid=swg21986260 ---------------------------------------------

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily