Daily

daily@lists.cert.at

1 participants
3155 discussions

Tageszusammenfassung - Mittwoch 6-11-2013
by Daily end-of-shift report 06 Nov '13

06 Nov '13

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 05-11-2013 18:00 − Mittwoch 06-11-2013 18:00 Handler: Stephan Richter Co-Handler: n/a *** Attacks on New Microsoft Zero Day Using Multi-Stage Malware *** --------------------------------------------- Attackers exploiting the Microsoft Windows and Office zero day revealed yesterday are using an exploit that includes a malicious RAR file as well as a fake Office document as the lure, and are installing a wide variety of malicious components on newly infected systems. The attacks seen thus far are mainly centered in Pakistan. The... --------------------------------------------- http://threatpost.com/attacks-on-new-microsoft-zero-day-using-multi-stage-m… *** Malicious PDF Analysis Evasion Techniques *** --------------------------------------------- In many exploit kits, malicious PDF files are some of the most common threats used to try to infect users with various malicious files. Naturally, security vendors invest in efforts to detect these files properly - and their creators invest in efforts to evade those vendors. Using feedback provided by the Smart Protection Network, we... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/XOJob_q_Zag/ *** Asus fixt schwerwiegende Sicherheitslücke in WebStorage *** --------------------------------------------- Die Client-Software WebStorage gehört zu einer Reihe von Apps, die Asus auf seinen Android-Geräten ab Werk installiert. heise netze hatte bei Routine-Kontrollen einen Implementierungsfehler aufgedeckt. --------------------------------------------- http://www.heise.de/security/meldung/Asus-fixt-schwerwiegende-Sicherheitslu… *** Google Bots Doing SQL Injection Attacks *** --------------------------------------------- One of the things we have to be very sensitive about when writing rules for our CloudProxy Website Firewall is to never block any major search engine bot (ie., Google, Bing, Yahoo, etc..). To date, we've been pretty good about this, but every now and then you come across unique scenarios like the one in this post, that make you scratch your head and think, what if a legitimate search engine bot was being used to attack the site? Should we still allow the attack to go through? --------------------------------------------- http://blog.sucuri.net/2013/11/google-bots-doing-sql-injection-attacks.html *** Security Bulletin: IBM Sterling Certificate Wizard Shared Memory Permission Vulnerability (CVE-2013-1500) *** --------------------------------------------- The IBM Sterling Certificate Wizard is susceptible to a shared memory permission vulnerability. CVE(s): CVE-2013-1500 Affected product(s) and affected version(s): IBM Sterling Certificate Wizard: 1.3, 1.4 --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_ibm… *** Security Bulletin: Potential security vulnerability exist in the IBM Java SDKs TLS implementation that is shipped with Tivoli Netcool/OMNIbus Web GUI (CVE-2012-5081) *** --------------------------------------------- The JDKs TLS implementation does not strictly check the TLS vector length as set out in the latest RFC 5246. CVE(s): CVE-2012-5081 Affected product(s) and affected version(s): Tivoli Netcool/OMNIbus Web GUI: 7.3.0, 7.3.1, 7.4.0 --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_pot… *** Security Bulletin: IBM Sterling Connect:Enterprise Secure Client Shared Memory Permission Vulnerability (CVE-2013-1500) *** --------------------------------------------- The IBM Sterling Connect:Enterprise Secure Client is susceptible to a shared memory permission vulnerability. CVE(s): CVE-2013-1500 Affected product(s) and affected version(s): IBM Sterling Secure Client: 1.3, 1.4 --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_ibm… *** Vivotek IP Cameras RTSP Authentication Bypass *** --------------------------------------------- Topic: Vivotek IP Cameras RTSP Authentication Bypass Risk: High Text:Core Security - Corelabs Advisory http://corelabs.coresecurity.com Vivotek IP Cameras RTSP Authentication Bypass 1. *A... --------------------------------------------- http://cxsecurity.com/issue/WLB-2013110038 *** Bugtraq: Open-Xchange Security Advisory 2013-11-06 *** --------------------------------------------- http://www.securityfocus.com/archive/1/529635 *** Kerberos Multi-realm KDC NULL Pointer Dereference Denial of Service Vulnerability *** --------------------------------------------- https://secunia.com/advisories/55588 *** Cisco IOS Software Session Initiation Protocol Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco WAAS Mobile Remote Code Execution Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco TelePresence VX Clinical Assistant Administrative Password Reset Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Tweetbot for Mac / for iOS Cross-Site Request Forgery Vulnerability *** --------------------------------------------- https://secunia.com/advisories/55462 *** Arbor Peakflow X Security Bypass and Cross-Site Scripting Vulnerabilities *** --------------------------------------------- https://secunia.com/advisories/55536

1 0

Tageszusammenfassung - Dienstag 5-11-2013
by Daily end-of-shift report 05 Nov '13

05 Nov '13

======================= = End-of-Shift report = ======================= Timeframe: Montag 04-11-2013 18:00 − Dienstag 05-11-2013 18:00 Handler: Stephan Richter Co-Handler: n/a *** Switzerland to set up Swiss cloud free of NSA, GCHQ snooping (it hopes) *** --------------------------------------------- Gnomes of Zurich want spook-immune system Swisscom, the Swiss telco thats majority owned by its government, will set up a "Swiss cloud" hosted entirely in the land of cuckoo clocks and fine chocolate - and try to make the service impervious to malware and uninvited spooks. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2013/11/04/switzerland… *** Is your vacuum cleaner sending spam?, (Tue, Nov 5th) *** --------------------------------------------- Past week, a story in a Saint Petersburg (the icy one, not the beach) newspaper caught quite some attention, and was picked up by The Register [1]. The story claimed that appliances like tea kettles, vacuum cleaners and iron(y|ing) irons shipped from China and sold in Russia were discovered to contain rogue, WiFi enabled chip sets. As soon as power was applied, the vacuum cleaner began trolling for open WiFi access points, and if it found one, it would hook up to a spam relay and start ... --------------------------------------------- http://isc.sans.edu/diary.html?storyid=16958 *** When attackers use your DNS to check for the sites you are visiting, (Mon, Nov 4th) *** --------------------------------------------- Nowadays, attackers are definitely interested in checking what sites you are visiting. Depending on that information, they can setup attacks like the following: Phising websites and e-mail scams targeted to specific people so they leave their private information. Network spoofing with tools like dsniff, where attackers can tell computers that the sites they want to visit are located somewhere else, therefore enabling them to interact with victims posing like the original site. --------------------------------------------- http://isc.sans.edu/diary.html?storyid=16955 *** Manifest: Bei XMPP/Jabber soll Verschlüsselung zur Pflicht werden *** --------------------------------------------- Entwickler und Betreiber von XMPP-/Jabber-Software und -Diensten, darunter auch der Jabber-Erfinder Jeremie Miller, wollen es zur Pflicht machen, die Kommunikation über XMPP in Zukunft zu verschlüsseln. --------------------------------------------- http://www.golem.de/news/manifest-bei-xmpp-jabber-soll-verschluesselung-zur… *** Biggest Risks in IPv6 Security Today *** --------------------------------------------- Although IPv6 packets have started to flow, network engineers still tread lightly because of lingering security concerns. Here are the top six security risks in IPv6 network security today as voted by gogoNET members, a community of 95,000 network professionals. --------------------------------------------- http://www.cio.com/article/742652/Biggest_Risks_in_IPv6_Security_Today *** WhatsApp-Backup speichert Klartext bei Apple *** --------------------------------------------- Die eingebaute Backup-Funktion des beliebten Messaging-Programms speichert auf dem iPhone alle Texte und Bilder bei Apples iCloud - und zwar völlig unverschlüsselt. --------------------------------------------- http://www.heise.de/security/meldung/WhatsApp-Backup-speichert-Klartext-bei… *** Cisco Security Notices *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013… *** Vuln: Cisco Prime Central for Hosted Collaboration Solution CVE-2013-5564 Denial of Service Vulnerability *** --------------------------------------------- Cisco Prime Central for Hosted Collaboration Solution CVE-2013-5564 Denial of Service Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/63490 *** Bugtraq: ESA-2013-070: EMC Documentum Cross Site Scripting Vulnerability. *** --------------------------------------------- http://www.securityfocus.com/archive/1/529620 *** Bugtraq: ESA-2013-073: EMC Documentum eRoom Multiple Cross Site Scripting Vulnerabilities. *** --------------------------------------------- http://www.securityfocus.com/archive/1/529621 *** VU#436214: Attachmate Verastream Host Integrator Vulnerable to Arbitrary File Uploads *** --------------------------------------------- Vulnerability Note VU#436214 Attachmate Verastream Host Integrator Vulnerable to Arbitrary File Uploads Original Release date: 04 Nov 2013 | Last revised: 04 Nov 2013 Overview The Attachmate Verastream Host Integrator (VHI) is vulnerable to arbitrary file uploads. --------------------------------------------- http://www.kb.cert.org/vuls/id/436214 *** GitLab Remote code execution vulnerability in the code search feature *** --------------------------------------------- Topic: GitLab Remote code execution vulnerability in the code search feature Risk: High Text:Remote code execution vulnerability in the code search feature of GitLab There is a remote code execution vulnerability in t... --------------------------------------------- http://cxsecurity.com/issue/WLB-2013110026 *** GitLab Remote code execution vulnerability in the SSH key upload *** --------------------------------------------- Topic: GitLab Remote code execution vulnerability in the SSH key upload Risk: High Text:# Remote code execution vulnerability in the SSH key upload feature of GitLab There is a remote code execution vulnerability... --------------------------------------------- http://cxsecurity.com/issue/WLB-2013110025

1 0

Tageszusammenfassung - Montag 4-11-2013
by Daily end-of-shift report 04 Nov '13

04 Nov '13

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 31-10-2013 18:00 − Montag 04-11-2013 18:00 Handler: Otmar Lendl Co-Handler: Stephan Richter *** Top three recommendations for securing your personal data using cryptography, by EU cyber security Agency ENISA in new report *** --------------------------------------------- ENISA, the European Union's "cyber security" Agency today launched a report that all authorities should better promote cryptographic measure to safeguard personal data. --------------------------------------------- http://www.enisa.europa.eu/media/press-releases/top-three-recommendations-f… *** Know Your Enemy: Tracking A Rapidly Evolving APT Actor *** --------------------------------------------- Between Oct. 24-25 FireEye detected two spear-phishing attacks attributed a threat actor we have previously dubbed admin(a)338.[1] The newly discovered attacks targeted a number of organizations and were apparently focused on gathering data related to international trade, finance and economic... --------------------------------------------- http://www.fireeye.com/blog/technical/2013/10/know-your-enemy-tracking-a-ra… *** How To Avoid CryptoLocker Ransomware *** --------------------------------------------- Over the past several weeks, a handful of frantic Microsoft Windows users have written in to ask what they might do to recover from PC infections from "CryptoLocker," the generic name for an increasingly prevalent and nasty strain of malicious software that encrypts your files until you pay a ransom. Unfortunately, the answer for these folks is usually either to pay up or suck it up. This post offers a few pointers to help readers avoid becoming the next victim. --------------------------------------------- http://krebsonsecurity.com/2013/11/how-to-avoid-cryptolocker-ransomware/ *** Why Motivated Attackers Often Get What They Want *** --------------------------------------------- Do you work for a company possessing information which could be of financial value to people outside the organization? Or, perhaps even a foreign state would find it useful to gain access to the documents youre storing on that shared network drive? Yes? Then congratulations, you may already be the target of a persistent and motivated attacker (who sometimes, but rarely, is also advanced).According to this CERT-FI presentation, even Finland has seen nearly a decade of these attacks. Nowadays, --------------------------------------------- http://www.f-secure.com/weblog/archives/00002632.html *** Google-dorks based mass Web site hacking/SQL injecting tool helps facilitate malicious online activity *** --------------------------------------------- Among the most common misconceptions regarding the exploitation (hacking) of Web sites, is that no one would exclusively target *your* Web site, given that the there are so many high profile Web sites to hack into. In reality though, thanks to the public/commercial availability of tools relying on the exploitation of remote Web application vulnerabilities, the insecurely configured Web sites/forums/blogs, as well as the millions of malware-infected hosts internationally, virtually every Web --------------------------------------------- http://www.webroot.com/blog/2013/11/01/peek-inside-google-dorks-based-mass-… *** Secunias PSI Country Report - Q3 2013, (Fri, Nov 1st) *** --------------------------------------------- On the heels of discussing Microsofts Security Intelligence Report v15 wherein the obvious takeaway is "Windows XP be gone!", Secunias just-released PSI Country Report - Q3 2013 is an interesting supplemental read. Here are the summary details: Programs Installed: 75, from 25 different vendors 40% (30 of 75) of these programs are Microsoft programs 60% (45 of 75) of these programs are from third-party vendors Users with unpatched Operating Systems: 14.6% (WinXP, Win7, Win8, --------------------------------------------- http://isc.sans.edu/diary.html?storyid=16943&rss *** July-September 2013 *** --------------------------------------------- NOTE 1: The "ICS-CERT Monitor" newsletter offers a means of promoting preparedness, information sharing, and collaboration with the 16 critical infrastructure sectors. ICS-CERT accomplishes this on a day-to-day basis through sector briefings, meetings, conferences, and information product releases. --------------------------------------------- http://ics-cert.us-cert.gov/monitors/ICS-MM201310 *** SOHO Router Horror Stories: German Webcast with Mike Messner *** --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2013/11/04/soho-rout… *** Nordex NC2 - Cross-Site Scripting Vulnerability *** --------------------------------------------- NCCIC/ICS-CERT is aware of a public report of a Cross-Site Scripting vulnerability affecting the Nordex Control 2 (NC2) application, a supervisory control and data acquisition/human-machine interface (SCADA/HMI) product. According to this report, the vulnerability is exploitable by allowing a specially crafted request that could execute arbitrary script code. This report was released without coordination with either the vendor or NCCIC/ICS-CERT. NCCIC/ICS-CERT is attempting to... --------------------------------------------- http://ics-cert.us-cert.gov/alerts/ICS-ALERT-13-304-01 *** VU#450646: Tiki Wiki CMS Groupware version 11.0 contains a cross-site scripting (XSS) vulnerability *** --------------------------------------------- Vulnerability Note VU#450646 Tiki Wiki CMS Groupware version 11.0 contains a cross-site scripting (XSS) vulnerability Original Release date: 31 Oct 2013 | Last revised: 31 Oct 2013 Overview Tiki Wiki CMS Groupware version 11.0 and possibly earlier versions contain a cross-site scripting (XSS) vulnerability (CWE-79). Description CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)Tiki Wiki CMS Groupware version 11.0 and possibly earlier versions contain a --------------------------------------------- http://www.kb.cert.org/vuls/id/450646 *** VMSA-2013-0009.2 *** --------------------------------------------- VMware vSphere, ESX and ESXi updates to third party libraries --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2013-0009.html *** TP-Link Cross Site Request Forgery Vulnerability *** --------------------------------------------- Topic: TP-Link Cross Site Request Forgery Vulnerability Risk: Medium Text:I. Introduction Today the majority of wired Internet connections is used with an embedded NAT router, which allows using ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2013100223 *** Zend Framework Proxied Request Processing IP Spoofing Weakness *** --------------------------------------------- https://secunia.com/advisories/55529 *** Novell ZENworks Configuration Management Directory Traversal Flaw Lets Remote Users Obtain Files *** --------------------------------------------- http://www.securitytracker.com/id/1029289 *** Security Bulletins for multiple HP Products *** --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** Security Bulletins for multiple IBM Products *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_ibm… https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_inf… https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_ibm… https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_ibm… https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_pot… https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_mul… http://www.securityfocus.com/bid/62018

1 0

Tageszusammenfassung - Donnerstag 31-10-2013
by Daily end-of-shift report 31 Oct '13

31 Oct '13

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 30-10-2013 18:00 − Donnerstag 31-10-2013 18:00 Handler: Matthias Fraidl Co-Handler: n/a *** VU#326830: NAS4Free version 9.1.0.1 contains a remote command execution vulnerability *** --------------------------------------------- NAS4Free version 9.1.0.1.804 and possibly earlier versions contain a remote code execution vulnerability. NAS4Free allows an authenticated user to post PHP code to an HTTP script and have the code executed remotely. By default, NAS4Free runs with root privileges. A remotely authenticated attacker can send an HTTP POST request that contains a malicious PHP file which can cause the script to run directly on the machine. --------------------------------------------- http://www.kb.cert.org/vuls/id/326830 *** Mozilla Fixes 10 Vulnerabilities with Firefox 25 *** --------------------------------------------- Mozilla released Firefox 25 yesterday, fixing 10 vulnerabilities, five of them critical. --------------------------------------------- http://threatpost.com/mozilla-fixes-10-vulnerabilities-with-firefox-25/1027… *** A New Wave of WIN32/CAPHAW Attacks - A ThreatLabZ Analysis *** --------------------------------------------- Introduction and setting the context Over the last month, the ThreatLabZ researchers have been actively monitoring a recent uptick in the numbers of Win32/Caphaw (henceforward known as Caphaw) infections that have been actively targeting users bank accounts since 2011. --------------------------------------------- http://research.zscaler.com/2013/09/a-new-wave-of-win32caphaw-attacks.html *** Silent Circle and Lavabit launch 'DarkMail Alliance' to thwart e-mail spying *** --------------------------------------------- Silent Circle CTO: "What we're getting rid of is SMTP." --------------------------------------------- http://arstechnica.com/business/2013/10/silent-circle-and-lavabit-launch-da… *** MS Security Intelligence Report Volume 15: January 2013 to June 2013 *** --------------------------------------------- The Microsoft Security Intelligence Report (SIR) analyzes the threat landscape of exploits, vulnerabilities, and malware using data from Internet services and over 600 million computers worldwide. Threat awareness can help you protect your organization, software, and people. --------------------------------------------- http://download.microsoft.com/download/5/0/3/50310CCE-8AF5-4FB4-83E2-03F1DA… *** Meet 'badBIOS', the mysterious Mac and PC malware that jumps airgaps *** --------------------------------------------- Like a super strain of bacteria, the rookkit plaguing Dragos Ruiu is omnipotent. --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/jeFXBU0x_Vc/story01… *** Compliance Checklist: Cloud Encryption Best Practices for Banks and Insurance Companies *** --------------------------------------------- For industries whose handling of sensitive consumer data renders them subject to strict regulations, the cloud is anything but a simple choice. Before you can commit to the cloud, you'll have to understand exactly what cloud information protection measures you must take to remain in regulatory compliance. --------------------------------------------- http://blog.ciphercloud.com/compliance-checklist-cloud-encryption-practices… *** Weekly Update: Exploiting (Kind of) Popular FOSS Apps *** --------------------------------------------- - Moodle Remote Command Execution - vTigerCRM v5.4.0/v5.3.0 Authenticated Remote Code Execution - Zabbix Authenticated Remote Command Execution - Mac OS X Persistent Payload Installer - Persistent Payload in Windows Volume Shadow Copy - and many more --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2013/10/30/weekly-up… *** Cisco IOS XE Multiple Bugs Let Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1029277 *** Moodle Remote Command Execution *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2013100211 *** D-Link Backdoor Czechr Exploit *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2013100219 *** ISPConfig Authenticated Arbitrary PHP Code Execution *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2013100215

1 0

Tageszusammenfassung - Mittwoch 30-10-2013
by Daily end-of-shift report 30 Oct '13

30 Oct '13

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 29-10-2013 18:00 − Mittwoch 30-10-2013 18:00 Handler: Matthias Fraidl Co-Handler: n/a *** Nuclear Exploit Pack Getting More Aggresive *** --------------------------------------------- Churning through our logs, we recently observed a significant rise in the number of transactions involving the Nuclear Exploit Pack, which has been in the news for quite some time now. In the past week, we stumbled upon thousands of transactions involving the Nuclear Exploit Pack infestation. --------------------------------------------- http://research.zscaler.com/2013/10/nuclear-exploit-pack-getting-more.html *** A Tour Through The Chinese Underground *** --------------------------------------------- The Chinese underground has played host to many cybercriminals over the years. In the research brief titled Beyond Online Gaming Cybercrime: Revisiting the Chinese Underground Market, we provide some details of the current state of the Chinese underground economy. Last year, we looked into this underground sector, and this brief is a continuation of those efforts. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/a-tour-through-t… *** Major Corporations Fail to Defend Against Social Engineering *** --------------------------------------------- Companies such as Apple and General Motors gave up crucial company information to social engineers during the annual Capture the Flag contest at Def Con. --------------------------------------------- http://threatpost.com/major-corporations-fail-to-defend-against-social-engi… *** iOS apps can be hijacked to show fraudulent content and intercept data *** --------------------------------------------- A large number of apps for iPhones and iPads are susceptible to hacks that cause them to surreptitiously send and receive data to and from malicious servers instead of the legitimate ones they were designed to connect to, security researchers said on Tuesday. --------------------------------------------- http://arstechnica.com/security/2013/10/ios-apps-can-be-hijacked-to-show-fr… *** New Injection Campaign Peddling Rogue Software Downloads *** --------------------------------------------- A mass injection campaign surfaced over the last two weeks that´s already compromised at least 40,000 web pages worldwide and is tricking victims into downloading rogue, unwanted software to their computer. --------------------------------------------- http://threatpost.com/new-injection-campaign-peddling-rogue-software-downlo… *** Defending Against CryptoLocker *** --------------------------------------------- CryptoLocker infections were found across different regions, including North America, Europe Middle East and the Asia Pacific. Almost two-thirds of the affected victims - 64% - were from the US. Other affected countries include the UK and Canada, with 11% and 6% of global victims, respectively. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/defending-agains… *** Analysis: Kaspersky Lab Report: Java under attack - the evolution of exploits in 2012-2013 *** --------------------------------------------- One of the biggest problems facing the IT security industry is the use of vulnerabilities in legitimate software to launch malware attacks. Malicious programs can use these vulnerabilities to infect a computer without attracting the attention of the user and, in some cases, without triggering an alert from security software. --------------------------------------------- http://www.securelist.com/en/analysis/204792310/Kaspersky_Lab_Report_Java_u… *** Microsoft sieht Rückgang der Virengefahr, aber steigende Infektionen *** --------------------------------------------- In fast allen großen Ländern habe die Zahl der 'Begegnungen mit Schad-Software' deutlich abgenommen, konstatiert der aktuelle Microsoft Security Intelligence Report. Für Entwarnung ist es jedoch zu früh - denn die Zahl der Infektionen nimmt trotzdem zu. --------------------------------------------- http://www.heise.de/security/meldung/Microsoft-sieht-Rueckgang-der-Virengef… *** Joomla! Media Manager allows arbitrary file upload and execution *** --------------------------------------------- A vulnerability has been discovered in older versions of the Joomla! content management software that allow an authenticated attacker to upload active content through the media manager form ('administrator/components/com_media/helpers/media.php'). Joomla! allows files with a trailing '.' to pass the upload checks. --------------------------------------------- http://www.kb.cert.org/vuls/id/639620 *** Apples Siri is helping users bypass iOS security *** --------------------------------------------- Siri was designed to be an effective personal assistant, but since the release of iOS 7, the artificial intelligence is bringing the bad with the good. --------------------------------------------- http://www.scmagazine.com/apples-siri-is-helping-users-bypass-ios-security/… *** [remote] - Apache / PHP 5.x Remote Code Execution Exploit *** --------------------------------------------- +++ Betrifft veraltete Versionen +++ Unaffected versions are patched by CVE-2012-1823. --------------------------------------------- http://www.exploit-db.com/exploits/29290 *** Vuln: Mozilla Firefox/Thunderbird/SeaMonkey CVE-2013-5599 Remote Memory Corruption Vulnerability *** --------------------------------------------- +++ Betrifft veraltete Versionen +++ --------------------------------------------- http://www.securityfocus.com/bid/63423 *** ASUS RT-N13U Backdoor Account *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2013100206 *** Vuln: XAMPP for Windows Multiple Cross Site Scripting and SQL Injection Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/bid/53979 *** Citrix XenDesktop Upgrade Feature Bug Lets Remote Authenticated Users Bypass Policy Controls *** --------------------------------------------- http://www.securitytracker.com/id/1029263 *** WordPress MoneyTheme Cross Site Scripting / Shell Upload *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2013100199 *** WordPress Curvo Shell Upload *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2013100197 *** Google Play Billing Bypass *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2013100203 *** sup Remote Command Execution *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2013100202

1 0

Tageszusammenfassung - Dienstag 29-10-2013
by Daily end-of-shift report 29 Oct '13

29 Oct '13

======================= = End-of-Shift report = ======================= Timeframe: Montag 28-10-2013 18:00 − Dienstag 29-10-2013 18:00 Handler: Matthias Fraidl Co-Handler: n/a *** Hintergrund: iOS-Virenscanner mit zweifelhaftem Nutzen *** --------------------------------------------- Avira hat eine Virenschutz-App für iOS herausgegeben, die vor schadhaften Prozessen schützen soll. Welche das sind und wie diese erkannt werden, verrät das Unternehmen nicht. --------------------------------------------- http://www.heise.de/security/artikel/iOS-Virenscanner-mit-zweifelhaftem-Nut… *** Exploit cocktail (Struts, Java, Windows) going after 3-month old vulnerabilities *** --------------------------------------------- When ISC reader Yin reported earlier today that one of their servers had been hacked via the Apache Struts remote command execution vulnerability (CVE-2013-2251), at first this was flagged as "business as usual". Said vulnerability, after all, is known since July, and weve been seeing exploit attempts since early August (diary here). --------------------------------------------- http://isc.sans.edu/diary.html?storyid=16913 *** ATM malware Ploutus updated with English-language version *** --------------------------------------------- The Spanish-language ATM malware, which allowed attackers in Mexico to force ATMs to spit out cash, now has an updated English-language version. --------------------------------------------- http://www.scmagazine.com//atm-malware-ploutus-updated-with-english-languag… *** Adobe Breach Impacted At Least 38 Million Users *** --------------------------------------------- The recent data breach at Adobe that exposed user account information and prompted a flurry of password reset emails impacted at least 38 million users, the company now says. It also appears that the already massive source code leak at Adobe is broadening to include the companys Photoshop family of graphical design products. --------------------------------------------- http://krebsonsecurity.com/2013/10/adobe-breach-impacted-at-least-38-millio… *** Analysis: Spam in September 2013 *** --------------------------------------------- In September, the proportion of world spam in mail traffic continued to decline and reached 66%. As always the spammers focused on advertising seasonal goods and services. For example, the number of offers related to energy saving and insulating buildings increased significantly. --------------------------------------------- http://www.securelist.com/en/analysis/204792309/Spam_in_September_2013 *** Routerpwn *** --------------------------------------------- Routerpwn is a web application that helps you in the exploitation of vulnerabilities in residential routers. It is a compilation of ready to run local and remote web exploits. --------------------------------------------- http://www.routerpwn.com/ *** Windows XP ist und bleibt ein hochriskantes System *** --------------------------------------------- Im aktuellen Security Intelligence Report (SIR) warnt Microsoft erneut vor Windows XP. Sicherheits-Chef Tim Rains verteidigt die Entscheidung, den Support einzustellen. --------------------------------------------- http://futurezone.at/digital-life/windows-xp-ist-und-bleibt-ein-hochriskant… *** Internet Safety - Tips for Parents *** --------------------------------------------- Internet basics can be as straightforward as pushing buttons or clicking a mouse. Understanding how youth use the Internet, however, can be an overwhelming task, especially for adults who don't spend much time online. --------------------------------------------- http://bc.rcmp-grc.gc.ca/ViewPage.action?siteNodeId=87&languageId=1&content… *** Cyber Security Assesment Netherlands *** --------------------------------------------- Cybercrime and digital espionage remain the biggest threats to both governments and the business community. The threat of disruption of online services has increased. Clearly visible in the past year has been the rise of the criminal cyber services sector. Cyber-attack tools are made commercially available through `cybercrime as a service´. --------------------------------------------- https://www.ncsc.nl/english/current-topics/news/cyber-security-assesment-ne… *** Social media and digital identity. Prevention and incident response *** --------------------------------------------- The hack of a social media account is a common incident that could have a serious impact of our digital identity. How to prevent it? What to do in case of hack? --------------------------------------------- http://securityaffairs.co/wordpress/19143/cyber-crime/social-media-security… *** Angebliches Fritzbox-Fax entpuppt sich als Trojaner *** --------------------------------------------- Schadhafte E-Mails, die sich als Fax-Benachrichtigungen einer Fritzbox tarnen, verbreiten sich momentan rapide. In dem beigefügten Zip-Archiv befindet sich nicht etwa ein Fax, sondern ein Trojaner. --------------------------------------------- http://www.heise.de/security/meldung/Angebliches-Fritzbox-Fax-entpuppt-sich… *** Facebook Android Flaws Enable Any App to Get User's Access Tokens *** --------------------------------------------- A researcher has discovered serious vulnerabilities in the main Facebook and Facebook Messenger apps for Android that enable any other app on a device to access the user's Facebook access token and take over her account. --------------------------------------------- http://threatpost.com/facebook-android-flaws-enable-any-app-to-get-users-ac… *** [webapps] - Pirelli Discus DRG A125g - Password Disclosure Vulnerability. *** --------------------------------------------- http://www.exploit-db.com/exploits/29262 *** DSA-2786 icu *** --------------------------------------------- http://www.debian.org/security/2013/dsa-2786 *** vBulletin 4.1.x / 5.x.x Administrative User Injection *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2013100192 *** MobileIron 4.5.4 Cross Site Scripting *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2013100190 *** SAP Financial Services Statutory Reporting for Insurance (FS-SR) Unspecified Flaw Lets Remote Users Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1029256

1 0

Tageszusammenfassung - Montag 28-10-2013
by Daily end-of-shift report 28 Oct '13

28 Oct '13

======================= = End-of-Shift report = ======================= Timeframe: Freitag 25-10-2013 18:00 − Montag 28-10-2013 18:00 Handler: Matthias Fraidl Co-Handler: n/a *** Email contains phishing scam, not iPhone 5S *** --------------------------------------------- A new phishing email circulating the globe is preying on Apple fans who cant wait to get their hands on the coming iPhone 5S and iPhone 5c devices. --------------------------------------------- http://www.scmagazine.com/email-contains-phishing-scam-not-iphone-5s/articl… *** Blog: Cryptolocker Wants Your Money! *** --------------------------------------------- A new ransomware Trojan is on the loose. The attackers give you roughly three days to pay them, otherwise your data is gone forever. --------------------------------------------- http://www.securelist.com/en/blog/208214109/Cryptolocker_Wants_Your_Money *** Blog-Software Wordpress 3.7 aktualisiert sich selbst *** --------------------------------------------- In der neuen Version 3.7 hält sich die Blog-Software Wordpress selbst aktuell: Sicherheitsupdates werden künftig im Hintergrund automatisch eingespielt, wenn die Konfiguration das zulässt. Weitere Neuerungen dienen ebenfalls vorrangig der Sicherheit. --------------------------------------------- http://www.heise.de/security/meldung/Blog-Software-Wordpress-3-7-aktualisie… *** Periodic Connections to Control Server Offer New Way to Detect Botnets *** --------------------------------------------- A number of recent botnets and advanced threats use HTTP as their primary communications channel with their control servers. McAfee Labs research during the last couple of years reveals that more than 60 percent of the top botnet families depend on HTTP. These numbers have increased significantly over the last few quarters. --------------------------------------------- http://blogs.mcafee.com/mcafee-labs/periodic-links-to-control-server-offer-… *** Improving Hadoop Security with Host Intrusion Detection (Part 2) *** --------------------------------------------- This is a continuation of our previous post on Hadoop security. As we mentioned in our earlier post, we can use OSSEC to monitor for the file integrity of these existing Hadoop and HBase systems. OSSEC creates logs which a system administrator can use to check for various system events. It´s worth noting that big data systems ... --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/improving-hadoop… *** Active Perl/Shellbot Trojan *** --------------------------------------------- ISC received a submission from Zach of a Perl/Shellbot.B trojan served by fallencrafts[.]info/download/himad.png. The trojan has limited detection on Virustotal and the script contains a 'hostauth' of sosick[.]net[3] and the IRC server where the compromised systems are connecting to is located at 89.248.172.144. What we have so far, it appears it is exploiting older version of Plesk. --------------------------------------------- http://isc.sans.edu/diary.html?storyid=16907&rss *** LinkedIn kann Mails mitlesen *** --------------------------------------------- Die kürzlich eingeführte Intro-Technik für iOS bringt dem Berufsnetzwerk Kritik ein: Sie sei ein Traum für Angreifer und Sicherheitsdienste. Die Firma verteidigt sich: Alles sei sicher und man respektiere die Privatsphäre der Nutzer. --------------------------------------------- http://www.heise.de/security/meldung/LinkedIn-kann-Mails-mitlesen-2034490.h… *** Einbruch bei Buffer *** --------------------------------------------- Der Social-Media-Dienst wurde gestern gehackt. Laut Unternehmensblog sollen weder Passwörter noch Kreditkarteninformationen abhanden gekommen sein. --------------------------------------------- http://www.heise.de/security/meldung/Einbruch-bei-Buffer-2034519.html *** Storewize: IBM warnt vor Sicherheitslücke in Storage-Systemen *** --------------------------------------------- In den SAN-Controllern der Serie Storewize von IBM steckt eine Lücke, mit der ein Angreifer die Konfiguration ändern und auch Daten löschen kann. Abhilfe schafft ein Firmware-Update, das schon bereitsteht. (IBM, Netzwerk) --------------------------------------------- http://www.golem.de/news/storewize-ibm-warnt-vor-sicherheitsluecke-in-stora… *** End User Devices Security and Configuration Guidance *** --------------------------------------------- UK Gov Configuration guidance for the following platforms: End User Devices Security Guidance: Windows Phone 8 End User Devices Security Guidance: Android 4.2 End User Devices Security Guidance: Windows 7 and Windows 8 End User Devices Security Guidance: Ubuntu 12.04 End User Devices Security Guidance: Windows 8 RT ... --------------------------------------------- https://www.gov.uk/government/collections/end-user-devices-security-guidanc… *** Bypassing security scanners by changing the system language *** --------------------------------------------- Luiz Eduardo and Joaquim Espinhara´s found that the majority of pentesting tools analyze specific problems in web applications - such as SQL injection - via the return messages that are provided by the application, and not by the error code that is reported by the database management system. So, what would happen if the setup language was not English, but Chinese or Portuguese? As their research showed, if the target SQL server doesnt use English by default, the scanners wont be able to --------------------------------------------- http://www.net-security.org/secworld.php?id=15832 *** Cisco Identity Services Engine contains an input validation vulnerability *** --------------------------------------------- Vulnerability Note VU#952422 Cisco Identity Services Engine contains an input validation vulnerability Original Release date: 28 Oct 2013 | Last revised: 28 Oct 2013 Overview Cisco Identity Services Engine contains an input validation vulnerability (CWE-20). Description CWE-20: Improper Input ValidationCisco Identity Services Engine (ISE) contains an input validation vulnerability. --------------------------------------------- http://www.kb.cert.org/vuls/id/952422 *** I challenged hackers to investigate me and what they found out is chilling *** --------------------------------------------- It´s my first class of the semester at New York University. I´m discussing the evils of plagiarism and falsifying sources with 11 graduate journalism students when, without warning, my computer freezes. I fruitlessly tap on the keyboard as my laptop takes on a life of its own and reboots. Seconds later the screen flashes a message. --------------------------------------------- http://pandodaily.com/2013/10/26/i-challenged-hackers-to-investigate-me-and… *** Spam-Versender. Schauen Sie doch mal bitte in Ihren Junk-Ordner *** --------------------------------------------- Werbefilter funktionieren inzwischen ziemlich zuverlässig. Das wissen auch die Spam-Versender. Deshalb schicken sie noch eine zweite Nachricht hinterher. --------------------------------------------- http://www.heise.de/security/meldung/Spam-Versender-Schauen-Sie-doch-mal-bi… *** Scan Shows 65% of ReadyNAS Boxes on Web Vulnerable to Critical Bug *** --------------------------------------------- It´s been known for some time now several months, in fact that there is a critical, remotely exploitable vulnerability in some of Netgear´s ReadyNAS storage boxes, and a patch has been available since July. However, many of the boxes exposed to the Web are still vulnerable, and a recent scan by HD Moore of Rapid7 found that ... --------------------------------------------- http://threatpost.com/scan-shows-65-of-readynas-boxes-on-web-vulnerable-to-… *** Vuln: Cisco Catalyst 3750 Series Switches Default Credentials Security Bypass Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/bid/63342 *** Bugtraq: Multiple CSRF Horde Groupware Web mail Edition 5.1.2 *** --------------------------------------------- http://www.securityfocus.com/archive/1/529466 *** Bugtraq: DD-WRT v24-sp2 Command Injection *** --------------------------------------------- http://www.securityfocus.com/archive/1/529463 *** Apache Struts2 showcase multiple XSS *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2013100185 *** DSA-2787 roundcube *** --------------------------------------------- http://www.debian.org/security/2013/dsa-2787 *** Woltlab Burning Board Regenbogenwiese 2007 Addon SQL Injection Exploit. *** --------------------------------------------- http://www.exploit-db.com/exploits/29023 *** GnuPG Side-Channel Attack Lets Local Users Recover RSA Secret Keys *** --------------------------------------------- http://www.securitytracker.com/id/1029242 *** DSA-2785 chromium-browser *** --------------------------------------------- http://www.debian.org/security/2013/dsa-2785

1 0

Tageszusammenfassung - Freitag 25-10-2013
by Daily end-of-shift report 25 Oct '13

25 Oct '13

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 24-10-2013 18:00 − Freitag 25-10-2013 18:00 Handler: Stephan Richter Co-Handler: n/a *** Periodic Links to Control Server Offer New Way to Detect Botnets *** --------------------------------------------- A number of recent botnets and advanced threats use HTTP as their primary communications channel with their control servers. McAfee Labs research during the last couple of years reveals that more than 60 percent of the top botnet families depend on HTTP. These numbers have increased significantly over the last few quarters. The following pie […] --------------------------------------------- http://blogs.mcafee.com/mcafee-labs/periodic-links-to-control-server-offer-… *** DDoS mitigation firm notes dramatic increase in reflection attack style *** --------------------------------------------- Between Q3 2012 and Q3 2013, distributed reflection denial-of-service (DrDoS) attacks increased 265 percent, a global attack report found. --------------------------------------------- http://www.scmagazine.com/ddos-mitigation-firm-notes-dramatic-increase-in-r… *** LinkedIn Intro App Equivalent to Man in the Middle Attack, Experts Say *** --------------------------------------------- LinkedIn’s release of its Intro app yesterday for Apple iOS mobile devices raised more than a few eyebrows for behaviors that are tantamount to a man-in-the-middle attack, experts said. --------------------------------------------- http://threatpost.com/linkedin-intro-app-equivalent-to-man-in-the-middle-at… *** Evasive Tactics: Terminator RAT *** --------------------------------------------- FireEye Labs has been tracking a variety of APT threat actors that have been slightly changing their tools, techniques and procedures (TTPs) in order to evade network defenses. Earlier, we documented changes to Aumlib, the malware used in the attack... --------------------------------------------- http://www.fireeye.com/blog/technical/malware-research/2013/10/evasive-tact… *** Cybercriminals release new commercially available Android/BlackBerry supporting mobile malware bot *** --------------------------------------------- Thanks to the growing adoption of mobile banking, in combination with the utilization of mobile devices to conduct financial transactions, opportunistic cybercriminals are quickly capitalizing on this emerging market segment. Made evident by the release of Android/BlackBerry compatible mobile malware bots. This site is empowering potential cybercriminals with the necessary ‘know-how’ when it comes to ‘cashing out’ compromised accounts of E-banking victims who have... --------------------------------------------- http://www.webroot.com/blog/2013/10/25/cybercriminals-release-new-commercia… *** OSX/Leverage.a Analysis *** --------------------------------------------- A few days ago, a new OSX malware was detected in the wild. It looks like a picture and behaves like it when you click on it. Everything looks fine when the clicked picture is opened on the screen, but the malware also performs some other actions. After the first look, we saw that the malware copies itself to /Users/Shared/UserEvent.app with the ditto command, and creates a LaunchAgent to load itself when the computer starts with these shell commands: mkdir ~/Library/LaunchAgents echo --------------------------------------------- http://www.alienvault.com/open-threat-exchange/blog/osx-leveragea-analysis *** PHP.net zur Verbreitung von Malware missbraucht *** --------------------------------------------- Entgegen früherer Aussagen der Administratoren wurde die Projektseite von PHP doch Opfer eines Hackerangriffs. Zwei Server wurden gekapert und zur Verteilung von Schadcode eingesetzt. --------------------------------------------- http://www.heise.de/security/meldung/PHP-net-zur-Verbreitung-von-Malware-mi… *** ProSoft Technology RadioLinx ControlScape PRNG Vulnerability *** --------------------------------------------- RadioLinx ControlScape is prone to a predictable random number generator weakness. Attackers can leverage this weakness to aid in brute-force attacks. Other attacks are also possible. --------------------------------------------- http://www.securityfocus.com/bid/62238/ http://ics-cert.us-cert.gov/advisories/ICSA-13-248-01 *** Vuln: OpenStack Keystone Tokens Validation CVE-2013-4222 Security Bypass Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/61725 *** Vuln: OpenStack Nova CVE-2013-4261 Denial of Service Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/62200 *** Vuln: OpenStack Nova CVE-2013-4278 Security Bypass Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/62016 *** CA SiteMinder Input Validation Flaw Permits Cross-Site Scripting Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1029237 *** libvirt API Access Control Flaw Lets Remote Authenticated Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1029241 *** Vuln: GnuTLS CVE-2013-4466 libdane/dane.c Remote Buffer Overflow Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/63326 *** Vuln: VICIDIAL manager_send.php CVE-2013-4468 Command Injection Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/63288 *** Security Bulletin: Tivoli Netcool/OMNIbus Web GUI - IBM WebSphere Application Server PM44303 security bypass (CVE-2012-3325) and Hash denial of service (CVE-2011-4858) *** --------------------------------------------- CVE-2012-3325: After installing an Interim Fix for PM44303 or a Fix Pack containing PM44303, there is a potential security exposure with IBM WebSphere Application Server. CVE-2011-4858: Potential Denial of Service (DoS) security exposure when using web-based applications due to Java HashTable implementation vulnerability. --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_tiv…

1 0

Tageszusammenfassung - Donnerstag 24-10-2013
by Daily end-of-shift report 24 Oct '13

24 Oct '13

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 23-10-2013 18:00 − Donnerstag 24-10-2013 18:00 Handler: Stephan Richter Co-Handler: n/a *** Neutrino: Caught in the Act *** --------------------------------------------- Last week, we got a tip from Kafeine about hacked sites serving injected iframes leading to an exploit kit. We thought it was quite interesting so we looked at one of the infected websites and found this sneaky piece of code: The deobfuscated code shows the location from where the... --------------------------------------------- http://www.f-secure.com/weblog/archives/00002626.html *** Neue und alte Router-Lücken bei Netgear, Tenda und DrayTek *** --------------------------------------------- Sicherheitsexperten haben eine Hintertür in Routern der WNDR-Reihe von Netgear gefunden, die ohne Passwort-Abfrage vollen Zugrif auf das Gerät erlaubt. Bei Modellen der Firmen Tenda und DrayTek kann man Schadcode ausführen, ohne sich einloggen zu müssen. --------------------------------------------- http://www.heise.de/security/meldung/Neue-und-alte-Router-Luecken-bei-Netge… *** Industrial software flaw could allow manipulation of energy processes *** --------------------------------------------- The vulnerability lies in industrial automation software that uses a weak encryption algorithm for user authentication, researchers at IOActive found. --------------------------------------------- http://www.scmagazine.com/industrial-software-flaw-could-allow-manipulation… *** Bugtraq: ESA-2013-067: RSA® Authentication Agent for Web for Internet Information Services (IIS) Security Controls Bypass Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/529394 *** Bugtraq: RPS/APS vulnerability in snom/yealink and others *** --------------------------------------------- http://www.securityfocus.com/archive/1/529397 *** Security Bulletin: IBM Flex System Manger expired USERID password vulnerability (CVE-2013-5424) *** --------------------------------------------- Security Bulletin: IBM Flex System Manger expired USERID password vulnerability (CVE-2013-5424) Affected product(s) and affected version(s): IBM Flex System Manager Node, Types 7955, 8731, 8734 all models, Version 1.3.0 --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_ibm… *** Cisco IOS XR Software Route Processor Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Apache Struts 2 Command Execution Vulnerability in Multiple Cisco Products *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Multiple Vulnerabilities in Cisco Identity Services Engine *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco Secure ACS Distributed Deployment Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013… *** Vuln: Multiple Cisco Appliances CVE-2013-5537 Denial of Service Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/63280 *** Vuln: Joomla! Maian15 Component name Parameter Arbitrary Shell Upload Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/63287 *** Vuln: Drupal Spaces Module Access Bypass Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/63305 *** WordPress Blue Wrench Video Widget Plugin Cross-Site Request Forgery Vulnerability *** --------------------------------------------- https://secunia.com/advisories/55456

1 0

Tageszusammenfassung - Mittwoch 23-10-2013
by Daily end-of-shift report 23 Oct '13

23 Oct '13

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 22-10-2013 18:00 − Mittwoch 23-10-2013 18:00 Handler: Stephan Richter Co-Handler: n/a *** WellinTech KingView ActiveX Vulnerabilities *** --------------------------------------------- OVERVIEW: This advisory is a follow-up to the alert titled ICS-ALERT-13-256-01 WellinTech KingView ActiveX Vulnerabilitiesa that was published September 13, 2013, on the NCCIC/ICS-CERT Web site. --------------------------------------------- http://ics-cert.us-cert.gov/advisories/ICSA-13-295-01 *** Apache Fixes Information Disclosure Vulnerability in Shindig *** --------------------------------------------- The Apache Software Foundation released a new version of Shindig, a framework for web applications, yesterday, fixing what the collective has deemed an important information disclosure vulnerability. --------------------------------------------- http://threatpost.com/apache-fixes-information-disclosure-vulnerability-in-… *** Xerox WorkCentre and ColorQube Let Remote Users Gain Unauthorized Access *** --------------------------------------------- A vulnerability was reported in Xerox WorkCentre and ColorQube. A remote user can gain unauthorized access. --------------------------------------------- http://www.securitytracker.com/id/1029224 *** Security Bulletins: Vulnerability in XenDesktop 7.0 upgrade could result in policy bypass *** --------------------------------------------- A vulnerability has been identified in Citrix XenDesktop 7.0 that could prevent policy rules from being correctly applied following an upgrade from earlier versions of Citrix XenDesktop. --------------------------------------------- http://support.citrix.com/article/CTX138627 *** MantisBT 1.2.15 XSS vulnerability *** --------------------------------------------- Topic: MantisBT 1.2.15 XSS vulnerability Risk: Low Text:Greetings Roland Becker (MantisBT developer) discovered and fixed [1] an XSS vulnerability issue affecting MantisBT releases... --------------------------------------------- http://cxsecurity.com/issue/WLB-2013100159 *** Fixes from Apple (iOS 7.0.3, OS X Mavericks v10.9, Safari 6.1, Keynote 6.0, OS X Server 3.0, Remote Desktop, iTunes 11.1.2) *** --------------------------------------------- http://prod.lists.apple.com/archives/security-announce/2013/Oct/msg00002.ht… http://prod.lists.apple.com/archives/security-announce/2013/Oct/msg00003.ht… http://prod.lists.apple.com/archives/security-announce/2013/Oct/msg00004.ht… http://prod.lists.apple.com/archives/security-announce/2013/Oct/msg00005.ht… http://prod.lists.apple.com/archives/security-announce/2013/Oct/msg00006.ht… http://prod.lists.apple.com/archives/security-announce/2013/Oct/msg00007.ht… http://prod.lists.apple.com/archives/security-announce/2013/Oct/msg00008.ht… http://prod.lists.apple.com/archives/security-announce/2013/Oct/msg00009.ht…

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily