Daily

daily@lists.cert.at

3157 discussions

Tageszusammenfassung - 22.09.2021
by Daily end-of-shift report 22 Sep '21

22 Sep '21

===================== = End-of-Day report = ===================== Timeframe: Dienstag 21-09-2021 18:00 − Mittwoch 22-09-2021 18:00 Handler: Dimitri Robl Co-Handler: Robert Waldner ===================== = News = ===================== ∗∗∗ Apple users warned: Clicking this attachment will take over your macOS ∗∗∗ --------------------------------------------- A code execution bug in Apple's macOS allows remote attackers to run arbitrary commands on your device. And the worst part is, Apple hasn't fully patched it yet, as tested by Ars. --------------------------------------------- https://arstechnica.com/?p=1797268 ∗∗∗ Datenanalyse: Steigende Zahl automatisierter Cyberangriffe ∗∗∗ --------------------------------------------- Automatisierung ist seit Jahren ein wichtiges Thema. Auch Online-Kriminelle haben laut eine Analyse die Vorteile für sich entdeckt. Kriminelle Hacker setzen nach einer neuen Datenanalyse bei Cyberangriffen immer häufiger auf automatisierte Massenattacken. Seltener werden dagegen gezielte Angriffe, bei denen Hacker noch persönlich am Computer sitzen... --------------------------------------------- https://heise.de/-6198205 ∗∗∗ Recently Patched Vulnerabilities in Ninja Forms Plugin Affect Over 1 Million Site Owners ∗∗∗ --------------------------------------------- We strongly recommend updating immediately to the latest patched version of Ninja Forms to patch these security issues, which is version 3.5.8.2 of Ninja Forms at the time of this publication. --------------------------------------------- https://www.wordfence.com/blog/2021/09/recently-patched-vulnerabilities-in-… ∗∗∗ Bei diesen Investitionsplattformen verlieren Sie Ihr Geld ∗∗∗ --------------------------------------------- Im Internet findet man unzählige Möglichkeiten, Geld einfach und unkompliziert zu investieren. Auf Trading-Plattformen wie infinitycapitalg.com, suntonfx.com oder windsorglobalaustria.com werden hohe Gewinnchancen, auch ohne großes Finanzwissen versprochen. Klingt zwar sehr verlockend, führt in Wahrheit aber zu sehr hohen Verlusten! Unser Tipp: Checken Sie die Investorenwarnungen der Finanzmarktaufsicht. --------------------------------------------- https://www.watchlist-internet.at/news/bei-diesen-investitionsplattformen-v… ∗∗∗ Microsoft Exchange Autodiscover-Designfehler ermöglicht Abgriff von Zugangsdaten ∗∗∗ --------------------------------------------- Sicherheitsforscher von Guardicore sind in Microsoft Exchange auf einen Designfehler gestoßen, der es Angreifern ermöglicht, über externe Autodiscover-Domains die Anmeldedaten von Domains abzugreifen. Möglich wird dies, weil sich Autodiscover-Domains außerhalb der Domäne des Nutzers (aber noch in derselben TLD) missbrauchen lassen. --------------------------------------------- https://www.borncity.com/blog/2021/09/22/microsoft-exchange-autodiscover-de… ===================== = Vulnerabilities = ===================== ∗∗∗ ZDI-21-1104: McAfee Endpoint Security Incorrect Permission Assignment Privilege Escalation Vulnerability ∗∗∗ --------------------------------------------- This vulnerability allows local attackers to escalate privileges on affected installations of McAfee Endpoint Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-21-1104/ ∗∗∗ Patch now! Insecure Hikvision security cameras can be taken over remotely ∗∗∗ --------------------------------------------- The vulnerability found by Watchfull_IP is listed under CVE-2021-36260 and could allow an unauthenticated attacker to gain full access to the device and possibly perform lateral movement into internal networks.. --------------------------------------------- https://blog.malwarebytes.com/exploits-and-vulnerabilities/2021/09/patch-no… ∗∗∗ September 22, 2021 TNS-2021-16 [R1] Stand-alone Security Patch Available for Tenable.sc versions 5.16.0 to 5.19.1 ∗∗∗ --------------------------------------------- One of the third-party components (OpenSSL) was found to contain vulnerabilities, and updated versions have been made available by the providers. Out of caution, and in line with best practice, Tenable opted to upgrade the bundled OpenSSL components to address the potential impact of these issues. Tenable.sc patch SC-202109.1 updates OpenSSL to version 1.1.1l to address the identified vulnerabilities. --------------------------------------------- http://www.tenable.com/security/tns-2021-16 ∗∗∗ VMSA-2021-0020 ∗∗∗ --------------------------------------------- Multiple vulnerabilities in VMware vCenter Server were privately reported to VMware. Updates are available to remediate these vulnerabilities in affected VMware products. CVSSv3 Range: 4.3-9.8 CVE(s): CVE-2021-21991, CVE-2021-21992, CVE-2021-21993, CVE-2021-22005, CVE-2021-22006, CVE-2021-22007, CVE-2021-22008, CVE-2021-22009, CVE-2021-22010, CVE-2021-22011, CVE-2021-22012, CVE-2021-22013, CVE-2021-22014, CVE-2021-22015, CVE-2021-22016, CVE-2021-22017, CVE-2021-22018, CVE-2021-22019, CVE-2021-22020 --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2021-0020.html ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (grilo), Fedora (curl, firefox, mingw-python-pillow, python-pillow, python2-pillow, and webkit2gtk3), openSUSE (chromium, grafana-piechart-panel, kernel, libcroco, php-composer, and xen), Oracle (curl, kernel, and nss and nspr), Red Hat (nodejs:12), Slackware (alpine), SUSE (ghostscript, grafana-piechart-panel, kernel, and xen), and Ubuntu (linux, linux-hwe, linux-hwe-5.11, linux-hwe-5.4, linux-raspi, linux-raspi-5.4, and linux-raspi2). --------------------------------------------- https://lwn.net/Articles/870002/ ∗∗∗ Apple iTunes: Mehrere Schwachstellen ermöglichen Ausführen von beliebigem Programmcode mit den Rechten des Dienstes ∗∗∗ --------------------------------------------- Ein entfernter Angreifer kann mehrere Schwachstellen in Apple iTunes ausnutzen, um beliebigen Programmcode mit den Rechten des Dienstes auszuführen. --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K21-0997 ∗∗∗ Apple Safari: Mehrere Schwachstellen ermöglichen Ausführen von beliebigem Programmcode mit den Rechten des Dienstes ∗∗∗ --------------------------------------------- Ein entfernter Angreifer kann mehrere Schwachstellen in Apple Safari ausnutzen, um beliebigen Programmcode mit den Rechten des Dienstes auszuführen. --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K21-0996 ∗∗∗ Apple macOS: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- Ein entfernter, anonymer oder lokaler Angreifer kann mehrere Schwachstellen in Apple macOS ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen, beliebigen Programmcode auszuführen, Informationen offenzulegen, seine Privilegien zu erhöhen, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuführen. --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K21-0994 ∗∗∗ Apple macOS: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit Benutzerrechten ∗∗∗ --------------------------------------------- Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Apple macOS ausnutzen, um beliebigen Programmcode mit Benutzerrechten auszuführen. --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K21-1000 ∗∗∗ Security Advisory - Server-Side Request Forgery Vulnerability in Huawei Product ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2021/huawei-sa-20210922-… ∗∗∗ Security Advisory - Improper File Upload Control Vulnerability in Huawei FusionCompute Product ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2021/huawei-sa-20210922-… ∗∗∗ Security Advisory - Command Injection Vulnerability in Huawei FusionCompute Product ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2021/huawei-sa-20210922-… ∗∗∗ Security Bulletin: IBM® Java™ SDK Technology Edition affects IBM Security Verify Governance, Identity Manager virtual appliance component (ISVG IMVA) (CVE-2020-14781,CVE-2020-14782) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-java-sdk-technology-e… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by multiple vulnerabilities (CVE-2021-20377, CVE-2020-4690) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Security Bulletin: IBM QRadar Azure marketplace images include Open Management Infrastructure RPM, which is vulnerable to Remote Code Execution (CVE-2021-38647) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-qradar-azure-marketpl… ∗∗∗ Security Bulletin: IBM Jazz for Service Management is vulnerable to stored cross-site scripting (CVE-2021-29800) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-jazz-for-service-mana… ∗∗∗ Security Bulletin: IBM Security Guardium Insights is affected by multiple vulnerabilities (CVE-2021-3538, CVE-2021-33502, CVE-2021-3450, CVE-2021-3449) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-ins… ∗∗∗ Security Bulletin: App Connect Professional is affected by Apache Tomcat vulnerabilities. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-app-connect-professional-… ∗∗∗ Security Bulletin: Publicly disclosed vulnerabilities from Bind affect IBM Netezza Host Management ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-publicly-disclosed-vulner… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM MessageGateway ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: OpenSSL publicly disclosed vulnerability affects MessageGateway (CVE-2021-3712) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-openssl-publicly-disclose… ∗∗∗ Security Bulletin: Vulnerabilities in Node.js affect IBM App Connect Enterprise v11, v12 (CVE-2020-7608) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-node-j… ∗∗∗ Security Bulletin: Multiple security vulnerabilities have been fixed in IBM Security Verify Governance, Identity Manager virtual appliance component (ISVG IMVA) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnera… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 21.09.2021
by Daily end-of-shift report 21 Sep '21

21 Sep '21

===================== = End-of-Day report = ===================== Timeframe: Montag 20-09-2021 18:00 − Dienstag 21-09-2021 18:00 Handler: Dimitri Robl Co-Handler: Robert Waldner ===================== = News = ===================== ∗∗∗ A guide to combatting human-operated ransomware: Part 1 ∗∗∗ --------------------------------------------- As human-operated ransomware is on the rise, Microsoft’s Detection and Response Team (DART) shares how they investigate these attacks and what to consider when faced with a similar event in your organization. --------------------------------------------- https://www.microsoft.com/security/blog/2021/09/20/a-guide-to-combatting-hu… ∗∗∗ Mama Always Told Me Not to Trust Strangers without Certificates (Moar Netgear Pwnage) ∗∗∗ --------------------------------------------- This blog post details a vulnerability, the exploitation of which results in Remote Code Execution (RCE) as root, that impacts many modern Netgear Small Offices/Home Offices (SOHO) devices. The vulnerability isn’t your typical router vulnerability, in that the source of the vulnerability is located within a third-party component included in the firmware of many Netgear devices. This code is part of Circle, which adds parental control features to these devices. --------------------------------------------- https://blog.grimm-co.com/2021/09/mama-always-told-me-not-to-trust.html ∗∗∗ Does Your Organization Have a Security.txt File? ∗∗∗ --------------------------------------------- It happens all the time: Organizations get hacked because there isnt an obvious way for security researchers to let them know about security vulnerabilities or data leaks. Or maybe it isnt entirely clear who should get the report when remote access to an organizations internal network is being sold in the cybercrime underground. In a bid to minimize these scenarios, a growing number of major companies are adopting "Security.txt," a proposed new Internet standard... --------------------------------------------- https://krebsonsecurity.com/2021/09/does-your-organization-have-a-security-… ∗∗∗ TinyTurla - Turla deploys new malware to keep a secret backdoor on victim machines ∗∗∗ --------------------------------------------- Cisco Talos found a previously undiscovered backdoor from the Turla APT that we are seeing in the wild. This simple backdoor is likely used as a second-chance backdoor to maintain access to the system, even if the primary malware is removed. It could also be used as a second-stage dropper to infect the system with additional malware. --------------------------------------------- https://blog.talosintelligence.com/2021/09/tinyturla.html ∗∗∗ OpenOffice Vulnerability Exposes Users to Code Execution Attacks ∗∗∗ --------------------------------------------- A buffer overflow vulnerability in Apache OpenOffice could be exploited to execute arbitrary code on target machines using malicious documents. Tracked as CVE-2021-33035 and discovered by security researcher Eugene Lim, the bug affects OpenOffice versions up to 4.1.10, with patches deployed in the 4.1.11 beta only, meaning that most installations out there are likely vulnerable. --------------------------------------------- https://www.securityweek.com/openoffice-vulnerability-exposes-users-code-ex… ∗∗∗ Vorsicht beim Welpen-Kauf im Internet! ∗∗∗ --------------------------------------------- Wollen Sie online einen Hundewelpen kaufen? Wenn ja, dann stoßen Sie möglicherweise auf unseriöse Angebote. Der Watchlist Internet werden derzeit zahlreiche Seiten gemeldet, die angeben Rasse-Hundewelpen zu verkaufen und das meist zu einem günstigen Preis. Nicht nur die Preise, sondern auch liebevolle Fotos und Beschreibungen verlocken dazu, einen Kauf zu tätigen. --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-beim-welpen-kauf-im-interne… ∗∗∗ Russian security firm sinkholes part of the dangerous Meris DDoS botnet ∗∗∗ --------------------------------------------- Rostelecom-Solar, the cybersecurity division of Russian telecom giant Rostelecom, said on Monday that it sinkholed a part of the Meris DDoS botnet after identifying a mistake from the malwares creators. --------------------------------------------- https://therecord.media/russian-security-firm-sinkholes-part-of-the-dangero… ===================== = Vulnerabilities = ===================== ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- IBM hat 21 Security Bulletins veröffentlicht. --------------------------------------------- https://www.ibm.com/blogs/psirt/ ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (webkit2gtk, wpewebkit, and xen), Oracle (kernel), Red Hat (curl, go-toolset:rhel8, krb5, mysql:8.0, nodejs:12, and nss and nspr), and Ubuntu (curl and tiff). --------------------------------------------- https://lwn.net/Articles/869923/ ∗∗∗ Apple iOS & iPadOS: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- iOS 15 und iPadOS 15 sowie iOS 14.8 und iPadOS 14.8 veröffentlicht. --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K21-0993 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 20.09.2021
by Daily end-of-shift report 20 Sep '21

20 Sep '21

===================== = End-of-Day report = ===================== Timeframe: Freitag 17-09-2021 18:00 − Montag 20-09-2021 18:00 Handler: Dimitri Robl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Jetzt patchen! Krypto-Miner schlüpft durch OMIGOD-Lücken auf Azure-Server ∗∗∗ --------------------------------------------- Angreifer attackieren derzeit Azure-Kunden mit virtuellen Linux-PCs. Admins sollten jetzt handeln und die verfügbaren Sicherheitsupdates installieren. --------------------------------------------- https://heise.de/-6195928 ∗∗∗ Epik data breach impacts 15 million users, including non-customers ∗∗∗ --------------------------------------------- Scraped WHOIS data of NON-Epik customers also exposed in the 180 GB leak. --------------------------------------------- https://arstechnica.com/?p=1796568 ∗∗∗ Bring Your APIs Out of the Shadows to Protect Your Business ∗∗∗ --------------------------------------------- APIs are immensely more complex to secure. Shadow APIs - those unknown or forgotten API endpoints that escape the attention and protection of IT - present a real risk to your business. Learn how to identify shadow APIs and take control of them before attackers do. --------------------------------------------- https://threatpost.com/apis-out-of-shadows-protect-your-business/169334/ ∗∗∗ Video: Simple Analysis Of A CVE-2021-40444 .docx Document, (Sun, Sep 19th) ∗∗∗ --------------------------------------------- I created a video for the analysis I described in my last diary entry "Simple Analysis Of A CVE-2021-40444 .docx Document". --------------------------------------------- https://isc.sans.edu/diary/rss/27850 ∗∗∗ EventBuilder Exposed Information of Over 100,000 Event Registrants ∗∗∗ --------------------------------------------- Event management company EventBuilder exposed files containing the personal information of at least 100,000 users who registered for events on its platform. --------------------------------------------- https://www.securityweek.com/eventbuilder-exposed-information-over-100000-e… ∗∗∗ Network Security Trends: May-July 2021 ∗∗∗ --------------------------------------------- Network security trends, May-July 2021: We analyze how vulnerabilities are being exploited in the wild and rank the most common types of attacks. --------------------------------------------- https://unit42.paloaltonetworks.com/network-security-trends/ ∗∗∗ Threat landscape for industrial automation systems. Statistics for H1 2021 ∗∗∗ --------------------------------------------- In H1 2021, the percentage of ICS computers on which malicious objects were blocked was 33.8%, which was 0.4 p.p. more than in H2 2020. --------------------------------------------- https://ics-cert.kaspersky.com/reports/2021/09/09/threat-landscape-for-indu… ∗∗∗ ‘Yes, we are breaking the law:’ An interview with the operator of a marketplace for stolen data ∗∗∗ --------------------------------------------- A website called Marketo emerged earlier this year, billing itself as a marketplace where people can buy leaked data. Although Marketo isn’t a ransomware group, it appears to borrow key strategies from those types of threat actors. --------------------------------------------- https://therecord.media/yes-we-are-breaking-the-law-an-interview-with-the-o… ===================== = Vulnerabilities = ===================== ∗∗∗ #OMIGOD Exploits Captured in the Wild. Researchers responsible for half of scans for related ports., (Mon, Sep 20th) ∗∗∗ --------------------------------------------- After the "OMIGOD" vulnerability details were made public, and it became obvious that exploiting vulnerable hosts would be trivial, researchers and attackers started pretty much immediately to scan for vulnerable hosts. We saw a quick rise of scans, particularly against port:1270. --------------------------------------------- https://isc.sans.edu/diary/rss/27852 ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (gnutls28, nettle, nextcloud-desktop, and openssl1.0), Fedora (dovecot-fts-xapian, drupal7, ghostscript, haproxy, libtpms, lynx, wordpress, and xen), openSUSE (xen), Red Hat (rh-ruby27-ruby), and SUSE (openssl, openssl1, and xen). --------------------------------------------- https://lwn.net/Articles/869863/ ∗∗∗ Researchers put together a list of vulnerabilities abused by Ransomware - Look for these immediately ∗∗∗ --------------------------------------------- LINK To make it easy, I pulled it and created a simple txt list you can use. These are the some of the initial access methods. --------------------------------------------- https://securitythreatnews.com/2021/09/20/researchers-put-together-a-list-o… ∗∗∗ McAfee Endpoint Security: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K21-0991 ∗∗∗ Security Bulletin: IBM Aspera Webapps are vulnerable to cross-site scripting (CVE-2020-11022, CVE-2020-11023). ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-aspera-webapps-are-vu… ∗∗∗ Security Bulletin: IBM SDK, Java Tech Edition Quarterly CPU – Apr 2021 + Oracle Apr 2021; Jul 2021 + Oracle 2021 CPU ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sdk-java-tech-edition… ∗∗∗ Security Bulletin: Aspera Web Applications (Shares, Console) are affected by OpenSSL Vulnerabilities (CVE-2021-23839, CVE-2021-23840, CVE-2021-23841) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-aspera-web-applications-s… ∗∗∗ Security Bulletin: IBM Data Replication Java SDK Update ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-data-replication-java… ∗∗∗ Security Bulletin: IBM Data Replication Java SDK Update ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-data-replication-java… ∗∗∗ Security Bulletin: ISC DHCP for IBM i is affected by CVE-2021-25217 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-isc-dhcp-for-ibm-i-is-aff… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM WebSphere Cast Iron Solution & App Connect Professional ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: IBM Data Replication Java SDK Update ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-data-replication-java… ∗∗∗ Security Bulletin: IBM Cloud Pak for Data could allow a local user with special privileges to obtain highly sensitive information ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cloud-pak-for-data-co… ∗∗∗ Security Bulletin: IBM Aspera Webapps products (Shares, Console) are affected by OpenSSL Vulnerability (CVE-2021-3712) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-aspera-webapps-produc… ∗∗∗ Security Bulletin: IBM Aspera Webapps (Shares, Console) are vulnerable to an OpenSSL Vunerability (CVE-2020-7656). ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-aspera-webapps-shares… ∗∗∗ Security Bulletin: IBM SDK, Java Tech Edition Quarterly CPU Apr 2021 + Oracle APR 2021; Jul 2021 + Oracle Jul 2021 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sdk-java-tech-edition… ∗∗∗ Security Bulletin: Aspera Web Applications (Shares, Console) are affected by an OpenSSL Vulnerability (CVE-2020-1971) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-aspera-web-applications-s… ∗∗∗ Security Bulletin: Multiple vulnerabilities in Apache Commons* affect Tivoli Netcool/OMNIbus WebGUI (CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple vulnerabilities is affecting Tivoli Netcool/OMNIbus WebGUI ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 17.09.2021
by Daily end-of-shift report 17 Sep '21

17 Sep '21

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 16-09-2021 18:00 − Freitag 17-09-2021 18:00 Handler: Dimitri Robl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ OMIGOD: Microsoft lässt Azure-Admins mit Linux-Lücke allein ∗∗∗ --------------------------------------------- Kritische Lücken in der Microsoft-Cloud ermöglichen Root-Angriffe auf Linux-VMs. Microsoft weist die Verantwortung für wichtige Updates allerdings von sich. --------------------------------------------- https://heise.de/-6194618 ∗∗∗ US-Heimatschutz warnt vor weitreichenden Angriffen über Zoho ADSelfService Plus ∗∗∗ --------------------------------------------- Über eine kritische Sicherheitslücke haben sich APT-Gruppen Zugang zu den Netzwerken mehrerer Organisationen verschafft. --------------------------------------------- https://heise.de/-6194780 ∗∗∗ Exploitation of the CVE-2021-40444 vulnerability in MSHTML ∗∗∗ --------------------------------------------- Last week, Microsoft reported the RCE vulnerability CVE-2021-40444 in the MSHTML browser engine. Kaspersky is aware of targeted attacks using this vulnerability, and our products protect against attacks leveraging it. --------------------------------------------- https://securelist.com/exploitation-of-the-cve-2021-40444-vulnerability-in-… ∗∗∗ Malicious Calendar Subscriptions Are Back?, (Fri, Sep 17th) ∗∗∗ --------------------------------------------- Did this threat really disappear? This isnt a brand new technique to deliver malicious content to mobile devices but it seems that attackers started new waves of spam campaigns based on malicious calendar subscriptions. --------------------------------------------- https://isc.sans.edu/diary/rss/27846 ∗∗∗ A Cheat-Sheet on Internet Cookies – (Who, What, When, Why & How) ∗∗∗ --------------------------------------------- What are internet cookies, how should you feel about them? Are they helpful, harmless, dangerous? Cookies are key to our modern online experience with targeted website ads and predictive search text that seems to read our minds. Cookies help us gain a customized online experience, but what do we lose? Are we being manipulated by our own data? --------------------------------------------- https://blog.sucuri.net/2021/09/a-cheat-sheet-on-internet-cookies-who-what-… ∗∗∗ AMD Chipset Driver Vulnerability Can Allow Hackers to Obtain Sensitive Data ∗∗∗ --------------------------------------------- Chipmaker AMD has patched a driver vulnerability that could allow an attacker to obtain sensitive information from the targeted system. --------------------------------------------- https://www.securityweek.com/amd-chipset-driver-vulnerability-can-allow-hac… ∗∗∗ DDoS botnets, cryptominers target Azure systems after OMIGOD exploit goes public ∗∗∗ --------------------------------------------- Threat actors are attacking Azure Linux-based servers using a recently disclosed security flaw named OMIGOD in order to hijack vulnerable systems into DDoS or crypto-mining botnets. --------------------------------------------- https://therecord.media/ddos-botnets-cryptominers-target-azure-systems-afte… ===================== = Vulnerabilities = ===================== ∗∗∗ Analysis of CVE-2021-30860 ∗∗∗ --------------------------------------------- In this guest blog post, the security researcher Tom McGuire details the flaw and fix of CVE-2021-30860, a zero-click vulnerability, exploited in the wild. --------------------------------------------- https://objective-see.com/blog/blog_0x67.html ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by CentOS (firefox and thunderbird), Fedora (haproxy, wordpress, and xen), openSUSE (apache2-mod_auth_openidc, fail2ban, ghostscript, haserl, libcroco, nextcloud, and wireshark), Oracle (kernel and kernel-container), Slackware (httpd), SUSE (crmsh, gtk-vnc, libcroco, Mesa, postgresql12, postgresql13, and transfig), and Ubuntu (libgcrypt20, linux-gcp, linux-gcp-4.15, linux-hwe-5.4, linux-oem-5.13, python3.4, python3.5, and qtbase-opensource-src). --------------------------------------------- https://lwn.net/Articles/869521/ ∗∗∗ Siemens RUGGEDCOM ROX ∗∗∗ --------------------------------------------- This advisory contains mitigations for Exposure of Sensitive Information to an Unauthorized Actor, Execution with Unnecessary Privileges, and Improper Handling of Insufficient Permissions or Privileges vulnerabilities in Siemens RUGGEDCOM ROX devices. --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-259-01 ∗∗∗ Schneider Electric EcoStruxure and SCADAPack ∗∗∗ --------------------------------------------- This advisory contains mitigations for a Path Traversal vulnerability in Schneider Electric EcoStruxure Control Expert, EcoStruxure Process Expert, SCADAPack RemoteConnect software designed for the x70 SCADAPack system. --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-259-02 ∗∗∗ Siemens Teamcenter ∗∗∗ --------------------------------------------- This advisory contains mitigations for Privilege Defined with Unsafe Actions, Authorization Bypass Through User-Controlled Key, and Improper Restriction of XML External Entity Reference vulnerabilities in the Siemens Teamcenter virtualization platform. --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-257-08 ∗∗∗ Security Bulletin: A security vulnerability in NGINX ffects IBM Cloud Automation Manager ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: A security vulnerability in Node.js pac-resolver module affects IBM Cloud Automation Manager ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: A security vulnerability in Golang GO affects IBM Cloud Automation Manager ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: A security vulnerability in Golang Go affects IBM Cloud Automation Manager ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: IBM® Db2® could allow a local user to read and write specific files due to weak file permissions (CVE-2020-4976) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-db2-could-allow-a-loc… ∗∗∗ Security Bulletin: IBM API Connect is impacted by multiple vulnerabilities in IBM Http server ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-api-connect-is-impact… ∗∗∗ Security Bulletin: A security vulnerability in Node.js xmlhttprequest-ssl module affects IBM Cloud Automation Manager ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: A security vulnerability in Node.js affects IBM Cloud Automation Manager ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: September 2021 :Multiple vulnerabilities in IBM Java Runtime affect CICS Transaction Gateway ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-september-2021-multiple-v… ∗∗∗ Security Bulletin: A security vulnerability in Node.js xmlhttprequest-ssl module affects IBM Cloud Automation Manager ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: September 2021 : A vulnerability in IBM Java Runtime affects CICS Transaction Gateway ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-september-2021-a-vulnerab… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 16.09.2021
by Daily end-of-shift report 16 Sep '21

16 Sep '21

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 15-09-2021 18:00 − Donnerstag 16-09-2021 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Phishing 101: why depend on one suspicious message subject when you can use many?, (Thu, Sep 16th) ∗∗∗ --------------------------------------------- There are many e-mail subjects that people tend to associate with phishing due to their overuse in this area. Among the more traditional and common phishing subjects, that most people have probably seen at some point, are variations on the [...] --------------------------------------------- https://isc.sans.edu/diary/rss/27842 ∗∗∗ Third Critical Bug Affects Netgear Smart Switches — Details and PoC Released ∗∗∗ --------------------------------------------- New details have been revealed about a recently remediated critical vulnerability in Netgear smart switches that could be leveraged by an attacker to potentially execute malicious code and take control of vulnerable devices. The flaw — dubbed "Seventh Inferno" (CVSS score: 9.8) — is part of a trio of security weaknesses, called Demons Cries (CVSS score: 9.8) and Draconian Fear (CVSS score: 7.8) --------------------------------------------- https://thehackernews.com/2021/09/third-critical-bug-affects-netgear.html ∗∗∗ PetitPotam – NTLM Relay to AD CS ∗∗∗ --------------------------------------------- Deployment of an Active Directory Certificate Services (AD CS) on a corporate environment could allow system administrators to utilize it for establishing trust between different directory objects. However, it could allow red team operators to conduct an NTLM relay attack towards the web interface of an AD CS in order to compromise the network. --------------------------------------------- https://pentestlab.blog/2021/09/14/petitpotam-ntlm-relay-to-ad-cs/ ∗∗∗ Hunderttausende MikroTik-Router sind seit 2018 angreifbar ∗∗∗ --------------------------------------------- Ein auf die Geräte spezialisiertes Botnetz hat in den vergangenen Monaten großangelegte Angriffe auf Cloudflare und Yandex zu verantworten. --------------------------------------------- https://heise.de/-6193825 ∗∗∗ Operation Layover: How we tracked an attack on the aviation industry to five years of compromise ∗∗∗ --------------------------------------------- Cisco Talos linked the recent aviation targeting campaigns to an actor who has been targeting the aviation industry for two years. The same actor has been running successful malware campaigns for more than five years. --------------------------------------------- https://blog.talosintelligence.com/2021/09/operation-layover-how-we-tracked… ∗∗∗ Vorsicht vor unseriösen Shops auf Pinterest ∗∗∗ --------------------------------------------- Günstige Modeangebote auf Pinterest entpuppen sich im Nachhinein als Kostenfalle. Oft kommt es zu hohen Lieferkosten, Zollkosten oder Rücksendekosten – Falls Retouren überhaupt akzeptiert werden. --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-vor-unserioesen-shops-auf-p… ∗∗∗ Untangling the Spider Web: The Curious Connection Between WIZARD SPIDER’s Ransomware Infrastructure and a Windows Zero-Day Exploit ∗∗∗ --------------------------------------------- RiskIQ’s Team Atlas assesses with high confidence that the network infrastructure supporting the exploitation of a Windows zero-day vulnerability disclosed by Microsoft on September 7, CVE-2021-40444, shares historical connections with that of a ransomware syndicate known as WIZARD SPIDER. This group, also tracked separately under the names UNC1878 and RYUK, deploys several different ransomware families in targeted Big-Game Hunting campaigns. --------------------------------------------- https://www.riskiq.com/blog/external-threat-management/wizard-spider-window… ∗∗∗ Dangling Domains: Security Threats, Detection and Prevalence ∗∗∗ --------------------------------------------- Dangling domains are a largely overlooked threat in DNS, but they can be exploited for domain hijacking and are important to detect. --------------------------------------------- https://unit42.paloaltonetworks.com/dangling-domains/ ∗∗∗ New Go malware Capoae targets WordPress installs, Linux systems ∗∗∗ --------------------------------------------- Capoae highlights the increase of cyberattacks designed to deploy cryptocurrency-mining payloads. --------------------------------------------- https://www.zdnet.com/article/new-go-malware-capoae-targets-wordpress-insta… ∗∗∗ Malware samples found trying to hack Windows from its Linux subsystem ∗∗∗ --------------------------------------------- Security researchers at Lumens Black Lotus Labs have found a series of malware samples that were configured to infect the Windows Subsystem for Linux and then pivot to its native Windows environment. --------------------------------------------- https://therecord.media/malware-samples-found-trying-to-hack-windows-from-i… ∗∗∗ Universal decryptor released for past REvil ransomware victims ∗∗∗ --------------------------------------------- Romanian cybersecurity firm Bitdefender has published today a universal decryption utility that will be able to help past victims of the REvil (Sodinokibi) ransomware gang recover their encrypted files — if they still have them. --------------------------------------------- https://therecord.media/universal-decryptor-released-for-past-revil-ransomw… ===================== = Vulnerabilities = ===================== ∗∗∗ Kritische Sicherheitslücke ohne Patch gefährdet ältere IBM-System-X-Server ∗∗∗ --------------------------------------------- Die Server werden seit 2020 nicht mehr mit Updates versorgt. Angreifer können sie nun über eine Lücke in der Firmware der Admin-Schnittstelle IMM kapern. --------------------------------------------- https://heise.de/-6193718 ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (sssd), Fedora (libtpms and vim), openSUSE (kernel and php7-pear), Oracle (kernel), Slackware (curl), and Ubuntu (libgcrypt20 and squashfs-tools). --------------------------------------------- https://lwn.net/Articles/869380/ ∗∗∗ Several Access Bypass, CSRF Vulnerabilities Patched in Drupal ∗∗∗ --------------------------------------------- Drupal developers on Wednesday informed users that updates released for Drupal 8.9, 9.1 and 9.2 patch five vulnerabilities that can be exploited for cross-site request forgery (CSRF) and access bypass. --------------------------------------------- https://www.securityweek.com/several-access-bypass-csrf-vulnerabilities-pat… ∗∗∗ iTunes U 3.8.3 ∗∗∗ --------------------------------------------- https://support.apple.com/kb/HT212809 ∗∗∗ Security Bulletin: WebSphere Application Server is vulnerable to Information Disclosure (CVE-2021-29842) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-websphere-application-ser… ∗∗∗ Security Bulletin: IBM Aspera Webapps are vulnerable to cross-site scripting (CVE-2020-7656). ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-aspera-webapps-are-vu… ∗∗∗ Security Bulletin: A vulnerability in IBM Java Runtime affects TXSeries for Multiplatforms ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-ibm-ja… ∗∗∗ Security Bulletin: libXml2 used by IBM InfoSphere Identity Insight has a potential vulnerability (CVE-2021-3518) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-libxml2-used-by-ibm-infos… ∗∗∗ Security Bulletin: Multiple Vulnerabilities in Apache Commons Compress affect WebSphere Application Server Liberty (CVE-2021-33517, CVE-2021-36090) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: IBM® Db2® could allow a local user to read and write specific files due to weak file permissions (CVE-2020-4976) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-db2-could-allow-a-loc… ∗∗∗ Security Bulletin: IBM® Db2® is vulnerable to an information disclosure, exposing remote storage credentials to privileged users under specific conditions.(CVE-2021-29752) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-db2-is-vulnerable-to-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect AIX ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: A vulnerability in Bouncy Castle affect IBM Watson Machine Learning Accelerator ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-bouncy… ∗∗∗ Security Bulletin: IBM® Db2® could disclose sensitive information when using ADMIN_CMD with LOAD or BACKUP. (CVE-2021-29825) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-db2-could-disclose-se… ∗∗∗ Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU – Apr 2021 – Includes Oracle Apr 2021 CPU minus CVE-2021-2163 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sdk-java-technology-e… ∗∗∗ Security Bulletin: IBM® Db2® under very specific conditions, could allow a local user to keep running a procedure that could cause the system to run out of memory.and cause a denial of service. (CVE-2021-29763) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-db2-under-very-specif… ∗∗∗ OpenSSH: Schwachstelle ermöglicht Offenlegung von Informationen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K21-0979 ∗∗∗ Kubernetes: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K21-0977 ∗∗∗ Fluent Bit: Schwachstelle ermöglicht Darstellen falscher Informationen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K21-0985 ∗∗∗ Atlassian Jira Software: Schwachstelle ermöglicht Codeausführung ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K21-0980 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 15.09.2021
by Daily end-of-shift report 15 Sep '21

15 Sep '21

===================== = End-of-Day report = ===================== Timeframe: Dienstag 14-09-2021 18:00 − Mittwoch 15-09-2021 18:00 Handler: Dimitri Robl Co-Handler: Robert Waldner ===================== = News = ===================== ∗∗∗ Phishing-Alarm: Kriminelle behaupten Ihr Amazon-Konto sei gesperrt! ∗∗∗ --------------------------------------------- BetrügerInnen verschicken derzeit ein vermeintliches E-Mail von Amazon. Darin behaupten sie, dass Ihr Amazon-Konto und alle ausstehenden Bestellungen gesperrt wurden. Wer gerade etwas bestellt hat, ärgert sich natürlich über diese E-Mail. Doch es besteht kein Grund zur Sorge. Kriminelle versuchen nur an Ihre Zugangsdaten zu kommen. --------------------------------------------- https://www.watchlist-internet.at/news/phishing-alarm-kriminelle-behaupten-… ∗∗∗ The September 2021 Security Update Review ∗∗∗ --------------------------------------------- It’s the second Tuesday of the month, and that means the latest security updates from Adobe and Microsoft have been released. Apple and Google Chrome also released updates yesterday to fix bugs under active attack. Take a break from your regularly scheduled activities and join us as we review the details for their latest security offerings. --------------------------------------------- https://www.thezdi.com/blog/2021/9/14/the-september-2021-security-update-re… ===================== = Vulnerabilities = ===================== ∗∗∗ ZDI-21-1066: (0Day) Parallels Desktop virtio-net Memory Corruption Privilege Escalation Vulnerability ∗∗∗ --------------------------------------------- This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-21-1066/ ∗∗∗ Cisco IOS XR Software IP Service Level Agreements and Two-Way Active Measurement Protocol Denial of Service Vulnerability ∗∗∗ --------------------------------------------- A vulnerability in the IP Service Level Agreements (IP SLA) responder and Two-Way Active Measurement Protocol (TWAMP) features of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause device packet memory to become exhausted or cause the IP SLA process to crash, resulting in a denial of service (DoS) condition. Version 1.1: Added additional SMUs. --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Vulnerabilities in the Autodesk FBX Review software ∗∗∗ --------------------------------------------- Applications and Services that utilize the Autodesk FBX Review have been affected by Use-After-Free, Memory Corruption, Out-Of-Bounds Read, Untrusted Pointer Dereference, Out-Of-Bounds Write, and Directory Traversal vulnerabilities. Exploitation of these vulnerabilities could lead to remote code execution and/or denial-of-service. --------------------------------------------- https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0001 ∗∗∗ Patchday: Microsoft schließt von Angreifern ausgenutzte Lücke in Windows ∗∗∗ --------------------------------------------- Seit Anfang September haben Angreifer eine Windows-Lücke im Visier. Nun gibt es Sicherheitsupdates. Auch PrintNightmare spielt am Patchday nochmal eine Rolle. --------------------------------------------- https://heise.de/-6192327 ∗∗∗ SAP schließt ungewohnt viele kritische Sicherheitslücken zum Patchday ∗∗∗ --------------------------------------------- Admins aufgepasst: SAPs Security Advisory zum Patchday im September beinhaltet gleich fünf Hinweise zu kritischen Lücken in NetWeaver und weiteren Produkten. --------------------------------------------- https://heise.de/-6192352 ∗∗∗ Patchday: Adobe schließt Schadcode-Lücken in Photoshop & Co. ∗∗∗ --------------------------------------------- Es sind wichtige Sicherheitsupdates für verschiedene Anwendungen von Adobe erschienen. Der Softwarehersteller stuft viele Schwachstellen als kritisch ein. --------------------------------------------- https://heise.de/-6192382 ∗∗∗ Mozilla NSS vulnerability CVE-2020-12413 ∗∗∗ --------------------------------------------- This can lead to an attacker being able to compute the pre-master secret in connections that have used a Diffie-Hellman (DH)-based cipher suite. In such a case, this would result in the attacker being able to eavesdrop on all encrypted communications sent over that TLS connection. The highest threat from this vulnerability is to data confidentiality. Affected products: F5OS, Traffix SDC --------------------------------------------- https://support.f5.com/csp/article/K28409184 ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (chromium, element-desktop, element-web, firefox, ghostscript, and hedgedoc), Fedora (kernel and openssl), openSUSE (ghostscript, htmldoc, and openssl-1_0_0), Oracle (libtirpc), Red Hat (cyrus-imapd, kernel, and kernel-rt), SUSE (ghostscript), and Ubuntu (apport, curl, and squashfs-tools). --------------------------------------------- https://lwn.net/Articles/869301/ ∗∗∗ Linux Kernel: Schwachstelle ermöglicht Denial of Service ∗∗∗ --------------------------------------------- Ein lokaler Angreifer kann eine Schwachstelle im Linux Kernel ausnutzen, um einen Denial of Service Angriff durchzuführen. --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K21-0970 ∗∗∗ cURL: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in cURL ausnutzen, um einen Denial of Service Angriff durchzuführen oder die Kryptographie zu umgehen. --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K21-0969 ∗∗∗ Internet Systems Consortium BIND: Schwachstelle ermöglicht Denial of Service ∗∗∗ --------------------------------------------- Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Internet Systems Consortium BIND ausnutzen, um einen Denial of Service Angriff durchzuführen. --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K21-0968 ∗∗∗ AMD Prozessoren und Chipsätze: Schwachstelle ermöglicht Offenlegung von Informationen ∗∗∗ --------------------------------------------- Ein lokaler Angreifer kann eine Schwachstelle im AMD Prozessoren und Chipsätzen ausnutzen, um Informationen offenzulegen. --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K21-0967 ∗∗∗ SYSS-2021-040: TechRadar for Confluence Server 5.6 - 7.13.0 – Persistent Cross-Site Scripting (XSS) in Feld "Title" (CVE-2021-37412) ∗∗∗ --------------------------------------------- Das Atlassian Confluence Plug-in “TechRadar” verwendet bis Version 1.1 keine ausreichende Eingabevalidierung. Dadurch sind Persistent XSS-Angriffe möglich. --------------------------------------------- https://www.syss.de/pentest-blog/syss-2021-040-techradar-for-confluence-ser… ∗∗∗ Microsoft Azure-Schwachstelle OMIGOD in Linux VMs patchen ∗∗∗ --------------------------------------------- Wer unter Microsoft Azure für Linux-VMs verantwortlich ist, muss dringend reagieren. Dort wurden stillschweigen einen Verwaltungsagenten installiert, der RCE- und LPE-Schwachstellen aufweisen. Die OMIGOD genannte Sicherheitslücke muss manuell gepatcht werden, da kein Azure-update-Mechanismus existiert. --------------------------------------------- https://www.borncity.com/blog/2021/09/15/microsoft-azure-schwachstelle-omig… ∗∗∗ Security Bulletin: Vulnerabilities in IBM Java Runtime affect IBM Integration Bus and IBM App Connect Enterpise v11, V12 (CVE-2021-2161) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-ibm-ja… ∗∗∗ Security Bulletin: Multiple security vulnerabilities in IBM Java SDK affects IBM Voice Gateway ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnera… ∗∗∗ Security Bulletin: Security Vulnerabilities in IBM® Java SDK July 2021 CPU affect multiple IBM Continuous Engineering products based on IBM Jazz Technology ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-security-vulnerabilities-… ∗∗∗ Security Bulletin: IBM App Connect Enterprise Certified Container may be vulnerable to Denial of Service via CVE-2021-34558 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-app-connect-enterpris… ∗∗∗ Security Bulletin: IBM App Connect Enterprise Certified Container may be vulnerable to Denial of Service via CVE-2021-33198 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-app-connect-enterpris… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by the following vulnerabilities ( CVE-2021-29773, CVE-2021-2161) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Security Bulletin: IBM QRadar SIEM is vulnerable to using weaker than expected cryptographic algorithms (CVE-2021-29750) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-qradar-siem-is-vulner… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by an Information Exposure vulnerability ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Security Bulletin: IBM App Connect Enterprise Certified Container may be vulnerable to Denial of Service via CVE-2021-33196 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-app-connect-enterpris… ∗∗∗ Digi PortServer TS 16 ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-257-01 ∗∗∗ Johnson Controls Sensormatic Electronics KT-1 ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-257-02-0 ∗∗∗ Schneider Electric Struxureware Data Center Expert ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-257-03 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 14.09.2021
by Daily end-of-shift report 14 Sep '21

14 Sep '21

===================== = End-of-Day report = ===================== Timeframe: Montag 13-09-2021 18:00 − Dienstag 14-09-2021 18:00 Handler: Dimitri Robl Co-Handler: Robert Waldner ===================== = News = ===================== ∗∗∗ New Zloader attacks disable Windows Defender to evade detection ∗∗∗ --------------------------------------------- An ongoing Zloader campaign uses a new infection chain to disable Microsoft Defender Antivirus (formerly Windows Defender) on victims computers to evade detection. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-zloader-attacks-disable-… ∗∗∗ Vermilion Strike: Linux and Windows Re-implementation of Cobalt Strike ∗∗∗ --------------------------------------------- In August 2021, we at Intezer discovered a fully undetected ELF implementation of Cobalt Strike’s beacon, which we named Vermilion Strike. The stealthy sample uses Cobalt Strike’s Command and Control (C2) protocol when communicating to the C2 server and has Remote Access capabilities such as uploading files, running shell commands and writing to files. The malware is fully undetected in VirusTotal at the time of this writing and was uploaded from Malaysia. --------------------------------------------- https://www.intezer.com/blog/malware-analysis/vermilionstrike-reimplementat… ∗∗∗ Lücken im Matrix-Protokoll gefährden Ende-zu-Ende-Verschlüsselung von Messengern ∗∗∗ --------------------------------------------- Aufgrund von kritischen Lücken in verschiedenen Matrix-Clients könnten Angreifer eigentlich verschlüsselte Nachrichten mitlesen. --------------------------------------------- https://heise.de/-6191625 ∗∗∗ Apple releases emergency update: Patch, but don’t panic ∗∗∗ --------------------------------------------- Spyware developed by the company NSO Group is back in the news today after Apple released an emergency fix for iPhones, iPads, Macs, and Apple Watches. The update fixes a vulnerability silently exploited by software called Pegasus, which is often used in high-level surveillance campaigns by governments. --------------------------------------------- https://blog.malwarebytes.com/privacy-2/2021/09/apple-releases-emergency-up… ∗∗∗ Facebook: Cineplexx-Gewinnspiel für "James Bond"-Tickets ist Fake ∗∗∗ --------------------------------------------- Auf Facebook kursiert gerade ein Fake-Gewinnspiel der Seite „Cineplexx Österreich“. Dort werden angeblich 2 „VIP-Spionage-Tickets“ für den neuen James Bond Film verlost. Die Teilnahme funktioniert ganz einfach: Man muss lediglich den Beitrag kommentieren. In weiterer Folge erhalten TeilnehmerInnen dann über den Facebook-Messenger eine Gewinnbenachrichtigung und werden gebeten, auf einen Link zu klicken. Vorsicht: Die Facebook-Seite „Cineplexx Österreich“ ist Fake, Sie tappen in eine Abo-Falle! --------------------------------------------- https://www.watchlist-internet.at/news/facebook-cineplexx-gewinnspiel-fuer-… ∗∗∗ Benutzt hier jemand Travis CI? Stellt sich raus: Keine gute Idee ∗∗∗ --------------------------------------------- Ich sage euch, die Leichtigkeit, mit der die Leute ihren Kram in die Cloud schieben, ist immer wieder atemberaubend. Als ob das nicht dein Problem ist, wenn bei denen dann was kaputt geht!? --------------------------------------------- http://blog.fefe.de/?ts=9fbe5059 ===================== = Vulnerabilities = ===================== ∗∗∗ Citrix ShareFile Storage Zones Controller Security Update ∗∗∗ --------------------------------------------- A security issue has been identified in Citrix ShareFile storage zones controller which, if exploited, would allow an unauthenticated attacker to remotely compromise the storage zones controller. --------------------------------------------- https://support.citrix.com/article/CTX328123 ∗∗∗ Siemens Advisories/Bulletins ∗∗∗ --------------------------------------------- Siemens hat am 14.9.2021 21 neue und 25 aktualisierte Advisories/Bulletins veröffentlicht. --------------------------------------------- https://new.siemens.com/global/en/products/services/cert.html ∗∗∗ SAP Security Patch Day - September 2021 ∗∗∗ --------------------------------------------- On 14th of September 2021, SAP Security Patch Day saw the release of 17 Security Notes. There were 2 updates to previously released Patch Day Security Note. --------------------------------------------- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405 ∗∗∗ Nitro PDF Pro: Security-Update verhindert Codeausführung über präparierte PDFs ∗∗∗ --------------------------------------------- Die Software Nitro PDF Pro war unter anderem mittels schädlicher PDF-Dateien angreifbar. Die neueste Version umfasst zwei wichtige Sicherheitslücken-Fixes. --------------------------------------------- https://heise.de/-6191199 ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by openSUSE (libaom and nextcloud), Oracle (cyrus-imapd, firefox, and thunderbird), Red Hat (kernel and kpatch-patch), Scientific Linux (firefox and thunderbird), and Ubuntu (apport). --------------------------------------------- https://lwn.net/Articles/869221/ ∗∗∗ Atlassian Jira Software: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- Jira ist eine Webanwendung zur Softwareentwicklung. Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Atlassian Jira Software ausnutzen, um Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen und einen Denial of Service Zustand herbeizuführen. --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K21-0961 ∗∗∗ ImageMagick: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen ∗∗∗ --------------------------------------------- ImageMagick ist eine Sammlung von Programmbibliotheken und Werkzeugen, die Grafiken in zahlreichen Formaten verarbeiten kann. Ein entfernter, anonymer Angreifer kann eine Schwachstelle in ImageMagick ausnutzen, um Sicherheitsvorkehrungen zu umgehen. --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K21-0962 ∗∗∗ Sicherheitslücke in HP OMEN Gaming Hub ∗∗∗ --------------------------------------------- Sicherheitsforscher von SentinelOne haben jetzt eine schwerwiegende Sicherheitslücke im HP OMEN Gaming Hub gefunden. Die Sicherheitslücke im Treiber der Gamingsoftware von HP OMEN erlaubt Angreifern Systemrechte zu erlangen. Dies ermöglicht Systemeingriffe und das Einschleusen von Malware für nichtprivilegierte Nutzer. --------------------------------------------- https://www.borncity.com/blog/2021/09/14/sicherheitslcke-in-hp-omen-gaming-… ∗∗∗ ZDI-21-1065: (0Day) Autodesk Navisworks DWG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-21-1065/ ∗∗∗ ZDI-21-1064: (0Day) Autodesk Navisworks PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-21-1064/ ∗∗∗ ZDI-21-1063: (0Day) Autodesk Navisworks PDF File Parsing Memory Corruption Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-21-1063/ ∗∗∗ ZDI-21-1062: (0Day) Autodesk Navisworks DWG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-21-1062/ ∗∗∗ ZDI-21-1061: (0Day) Autodesk Navisworks PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-21-1061/ ∗∗∗ ZDI-21-1060: (0Day) Autodesk Navisworks DWG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-21-1060/ ∗∗∗ Security Bulletin: CVE-2021-2341 may affect IBM® SDK, Java™ Technology Edition ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-cve-2021-2341-may-affect-… ∗∗∗ Security Bulletin: IBM Maximo Asset Management is vulnerable to cross-site scripting (CVE-2021-29744) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-maximo-asset-manageme… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by multiple vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Security Bulletin: Cross-site scripting vulnerability in IBM Financial Transaction Manager for SWIFT Services ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-cross-site-scripting-vuln… ∗∗∗ Security Bulletin: Multiple vulnerabilities may affect IBM® SDK, Java™ Technology Edition ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Security Guardium ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by a Spring Framework vulnerability ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Security Bulletin: IBM Maximo Asset Management is vulnerable to Stored Cross-site Scripting (CVE-2021-29743) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-maximo-asset-manageme… ∗∗∗ Security Bulletin: Multiple Vulnerabilities Have Been Identified In IBM Security Verify Privilege Vault ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM DB2 affect the IBM Intelligent Operations Center (CVE-2020-4701, CVE-2020-4739) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 13.09.2021
by Daily end-of-shift report 13 Sep '21

13 Sep '21

===================== = End-of-Day report = ===================== Timeframe: Freitag 10-09-2021 18:00 − Montag 13-09-2021 18:00 Handler: Dimitri Robl Co-Handler: Robert Waldner ===================== = News = ===================== ∗∗∗ Warten auf Windows-Patches: Selbstbau-Anleitung für MSHTML-Exploit in Umlauf ∗∗∗ --------------------------------------------- Sicherheitsforscher warnen, wie Angreifer Microsofts Schutzmaßnahmen vor Windows-Attacken umgehen könnten. Außerdem ist ein Exploit-Baukasten verfügbar. --------------------------------------------- https://heise.de/-6190319 ∗∗∗ SOVA, Worryingly Sophisticated Android Trojan, Takes Flight ∗∗∗ --------------------------------------------- The malware appeared in August with an ambitious roadmap (think ransomware, DDoS) that could make it the most feature-rich Android malware on the market. --------------------------------------------- https://threatpost.com/sova-sophisticated-android-trojan/169366/ ∗∗∗ Shipping to Elasticsearch Microsoft DNS Logs, (Sat, Sep 11th) ∗∗∗ --------------------------------------------- This parser takes the logs from a Windows 2012R2 and/or 2019 server (C:\DNSLogs\windns.log) and parses them into usable metatada which can be monitored and queried via an ELK dashboard. The logs have been mapped using DNS ECS field meta here [1]. --------------------------------------------- https://isc.sans.edu/diary/rss/27828 ∗∗∗ New SpookJS Attack Bypasses Google Chrome’s Site Isolation Protection ∗∗∗ --------------------------------------------- A newly discovered side-channel attack demonstrated on modern processors can be weaponized to successfully overcome Site Isolation protections weaved into Google Chrome and Chromium browsers and leak sensitive data in a Spectre-style speculative execution attack. Dubbed "Spook.js" by academics from the University of Michigan, University of Adelaide, Georgia Institute of Technology, and Tel Aviv [...] --------------------------------------------- https://thehackernews.com/2021/09/new-spookjs-attack-bypasses-google.html ∗∗∗ REvil: Ransomware-Gang in neuer Aufstellung wieder aktiv ∗∗∗ --------------------------------------------- Neue Forenbeiträge und "Happy Blog"-Inhalte belegen, dass die Erpresserbande um REvil zurück ist - und dass ihre Auszeit wohl nicht freiwillig war. --------------------------------------------- https://heise.de/-6190537 ∗∗∗ BazarLoader to Conti Ransomware in 32 Hours ∗∗∗ --------------------------------------------- Conti is a top player in the ransomware ecosystem, being listed as 2nd overall in the Q2 2021 Coveware ransomware report. The groups deploying this RaaS have only grown [...] --------------------------------------------- https://thedfirreport.com/2021/09/13/bazarloader-to-conti-ransomware-in-32-… ∗∗∗ Incident response analyst report 2020 ∗∗∗ --------------------------------------------- We deliver a range of services: incident response, digital forensics and malware analysis. Data in the report comes from our daily practices with organizations seeking assistance with full-blown incident response or complementary expert activities for their internal incident response teams. --------------------------------------------- https://securelist.com/incident-response-analyst-report-2020/104080/ ===================== = Vulnerabilities = ===================== ∗∗∗ Vulnerability Spotlight: Code execution vulnerability in Nitro Pro PDF ∗∗∗ --------------------------------------------- Cisco Talos recently discovered a vulnerability in the Nitro Pro PDF reader that could allow an attacker to execute code in the context of the application. --------------------------------------------- https://blog.talosintelligence.com/2021/09/nitro-pro-code-execution.html ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (qemu and thunderbird), Fedora (chromium, firefox, and mosquitto), openSUSE (apache2-mod_auth_openidc, gifsicle, openssl-1_1, php7-pear, and wireshark), Oracle (oswatcher), Red Hat (cyrus-imapd, firefox, and thunderbird), SUSE (apache2-mod_auth_openidc, compat-openssl098, php7-pear, and wireshark), and Ubuntu (git and linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-dell300x, linux-hwe, linux-kvm, linux-oracle, linux-snapdragon). --------------------------------------------- https://lwn.net/Articles/869103/ ∗∗∗ Update - Kritische Sicherheitslücke in der Microsoft MSHTML Komponente - Workarounds verfügbar, Exploits veröffentlicht ∗∗∗ --------------------------------------------- Update: 13. September 2021 / Beschreibung Microsoft hat außerhalb des üblichen Patch-Zyklus eine Warnung über eine Sicherheitslücke in der MSHTML Komponente veröffentlicht. Diese kann von Angreifer:innen durch entsprechend präparierte Microsoft Office-Dokumente ausgenutzt werden - laut Microsoft sind solche Dokumente bereits im Umlauf. --------------------------------------------- https://cert.at/de/warnungen/2021/9/kritische-sicherheitslucke-in-der-micro… ∗∗∗ Security Bulletin: IBM Maximo Asset Management is vulnerable to CSV Injection (CVE-2021-20509) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-maximo-asset-manageme… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK affects WebSphere Application Server July 2021 CPU that is bundled with IBM WebSphere Application Server Patterns ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in ICU libraries used in IBM DataPower Gateway ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Vulnerabilities in the AIX kernel (CVE-2021-29727, CVE-2021-29801, CVE-2021-29862) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-the-ai… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Content Collector for Email, Content Collector for File Systems, Content Collector for Microsoft SharePoint and Content Collector for IBM Connections ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect IBM Security SOAR (CVE-2021-2341, CVE-2021-2369) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple vulnerabilities may affect IBM® SDK, Java™ Technology Edition ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Content Collector for Email, Content Collector for File Systems, Content Collector for Microsoft SharePoint and Content Collector for IBM Connections ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Content Collector for Email, Content Collector for File Systems, Content Collector for Microsoft SharePoint and Content Collector for IBM Connections ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Content Collector for Email, Content Collector for File Systems, Content Collector for Microsoft SharePoint and Content Collector for IBM Connections ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple security vulnerabilities affect Liberty for Java for IBM Cloud ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnera… ∗∗∗ Security Bulletin: Input Validation Vulnerability in Apache Commons Codec Affects IBM Sterling Connect:Direct for UNIX ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-input-validation-vulnerab… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 10.09.2021
by Daily end-of-shift report 10 Sep '21

10 Sep '21

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 09-09-2021 18:00 − Freitag 10-09-2021 18:00 Handler: Dimitri Robl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ MSHTML-Schwachstelle CVE-2021-40444 kritischer als bekannt ∗∗∗ --------------------------------------------- Vor einigen Tagen hat Microsoft einen Sicherheitshinweis zur Schwachstelle CVE-2021-40444 in der in Windows enthaltenen MSHTML-Komponente offen gelegt. Es hieß, es gebe den Versuch, die Schwachstelle in freier Wildbahn über präparierte Office-Dokumente auszunutzen. Aber Office-Nutzer seien eigentlich durch die geschützte Ansicht vor dieser Bedrohung geschützt. Nun wird bekannt, dass dieser Schutz löchrig ist und oft nicht wirkt. --------------------------------------------- https://www.borncity.com/blog/2021/09/10/mshtml-schwachstelle-cve-2021-4044… ∗∗∗ A Look at iMessage in iOS 14 ∗∗∗ --------------------------------------------- [...] Given that it is also now almost exactly one year ago since we published the Remote iPhone Exploitation blog post series, in which we described how an iMessage 0-click exploit can work in practice and gave a number of suggestions on how similar attacks could be prevented in the future, now seemed like a great time to dig into the security improvements in iOS 14 in more detail and explore how Apple has hardened their platform against 0-click attacks. --------------------------------------------- https://googleprojectzero.blogspot.com/2021/01/a-look-at-imessage-in-ios-14… ∗∗∗ August 2021’s Most Wanted Malware: Formbook Climbs into First Place ∗∗∗ --------------------------------------------- Check Point Research reports that the infostealer, Formbook, is the most prevalent malware while the banking trojan, Qbot, has dropped from the list all together. Our latest Global Threat Index for August 2021 has revealed that Formbook is now the most prevalent malware, taking over Trickbot, which has fallen into second following a three-month long [...] --------------------------------------------- https://blog.checkpoint.com/2021/09/10/august-2021s-most-wanted-malware-for… ∗∗∗ Meet Meris, the new 250,000-strong DDoS botnet terrorizing the internet ∗∗∗ --------------------------------------------- A new botnet consisting of an estimated 250,000 malware-infected devices has been behind some of the biggest DDoS attacks over the summer, breaking the record for the largest volumetric DDoS attack twice, once in June and again this month. --------------------------------------------- https://therecord.media/meet-meris-the-new-250000-strong-ddos-botnet-terror… ===================== = Vulnerabilities = ===================== ∗∗∗ Sicherheitspatch: WordPress-Entwickler raten zu zügigem Update ∗∗∗ --------------------------------------------- Das Content Management System WordPress ist über mehrere Sicherheitslücken angreifbar. --------------------------------------------- https://heise.de/-6188735 ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (firefox-esr, ghostscript, ntfs-3g, and postorius), Fedora (java-1.8.0-openjdk-aarch32, libtpms, and salt), openSUSE (libaom, libtpms, and openssl-1_0_0), Red Hat (openstack-neutron), SUSE (grilo, java-1_7_0-openjdk, libaom, libtpms, mariadb, openssl-1_0_0, openssl-1_1, and php74-pear), and Ubuntu (firefox and ghostscript). --------------------------------------------- https://lwn.net/Articles/868863/ ∗∗∗ AVEVA PCS Portal ∗∗∗ --------------------------------------------- This advisory contains mitigations for an Uncontrolled Search Path Element vulnerability in AVEVA PCS Portal sofware. --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-252-01 ∗∗∗ Delta Electronics DOPSoft 2 ∗∗∗ --------------------------------------------- This advisory contains mitigations for Stack-based Buffer Overflow, Out-of-Bounds Write, and Heap-based Buffer Overflow vulnerabilities in Delta Electronics DOPSoft 2 HMI editing software. --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-252-02 ∗∗∗ Mitsubishi Electric Europe B.V. smartRTU and INEA ME-RTU ∗∗∗ --------------------------------------------- This advisory is a follow-up to a CISA product update titled ICS-ALERT-19-225-01 Mitsubishi Electric Europe B.V. smartRTU and INEA ME-RTU (Update A) published September 10, 2019, on the ICS webpage on us-cert.cisa.gov. This advisory contains mitigations for OS Command Injection, Improper Access Control, Cross-site Scripting, Use of Hard-coded Credentials, Unprotected Storage of Credentials, and Incorrect Default Permissions vulnerabilities in select Mitsubishi Electric firmware. --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-252-03 ∗∗∗ Security Bulletin: OpenSSL Vulnerability Affects IBM Sterling Connect:Express for UNIX (CVE-2021-3712) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-openssl-vulnerability-aff… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Rational Directory Server (Tivoli) & Rational Directory Administrator ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: OpenSSL Vulnerability Affects IBM Sterling Connect:Express for UNIX (CVE-2021-3711) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-openssl-vulnerability-aff… ∗∗∗ Stack Buffer Overflow Vulnerabilities in QTS, QuTS hero, and QuTScloud ∗∗∗ --------------------------------------------- https://www.qnap.com/en-us/security-advisory/QSA-21-33 ∗∗∗ Stack Buffer Overflow Vulnerability in QUSBCam2 ∗∗∗ --------------------------------------------- https://www.qnap.com/en-us/security-advisory/QSA-21-34 ∗∗∗ Stack-Based Buffer Overflow Vulnerabilities in NVR Storage Expansion ∗∗∗ --------------------------------------------- https://www.qnap.com/en-us/security-advisory/QSA-21-36 ∗∗∗ Insufficiently Protected Credentials in QSW-M2116P-2T2S and QuNetSwitch ∗∗∗ --------------------------------------------- https://www.qnap.com/en-us/security-advisory/QSA-21-37 ∗∗∗ Insufficient HTTP Security Headers in QTS, QuTS hero, and QuTScloud ∗∗∗ --------------------------------------------- https://www.qnap.com/en-us/security-advisory/QSA-21-03 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 09.09.2021
by Daily end-of-shift report 09 Sep '21

09 Sep '21

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 08-09-2021 18:00 − Donnerstag 09-09-2021 18:00 Handler: Dimitri Robl Co-Handler: Robert Waldner ===================== = News = ===================== ∗∗∗ Ransomware: Erpressungs-Website der "REvil"-Gang plötzlich wieder online ∗∗∗ --------------------------------------------- Die Gang, deren Kaseya-Lieferkettenangriff Schlagzeilen machte, war Mitte Juli von der Bildfläche verschwunden - nun ist ihre Tor-Onion-Leak-Site wieder aktiv. --------------------------------------------- https://heise.de/-6187682 ∗∗∗ Betrügerische Streaming-Plattformen verschicken ungerechtfertigte Zahlungsaufforderungen! ∗∗∗ --------------------------------------------- Zahlreiche InternetnutzerInnen stolpern bei der Suche nach Hollywood-Blockbustern auf Webseiten wie kinox.su, justhdfilme.com oder kinox-deutsch.com. Wer auf einer solchen Seite versucht einen Film zu schauen, wird auf weitere betrügerische Websites wie luguplay.de, playnate.de oder rubuplay.de weitergeleitet. Nach einer angeblich kostenlosen Anmeldung auf diesen Seiten, können Sie sich keinen Film ansehen - stattdessen erhalten Sie Rechnungen und Mahnungen. Zahlen Sie auf keinen Fall! --------------------------------------------- https://www.watchlist-internet.at/news/betruegerische-streaming-plattformen… ∗∗∗ Fortinet warns customers after hackers leak passwords for 87,000 VPNs ∗∗∗ --------------------------------------------- Networking equipment vendor Fortinet has notified customers today that a cybercriminal gang has assembled a collection of access credentials for more than 87,000 FortiGate SSL-VPN devices. "This incident is related to an old vulnerability resolved in May 2019," the company said in a blog post following an inquiry from The Record sent on Tuesday, when a small portion of this larger list was published on a private cybercrime forum hosted on the dark web, and later on the website of a ransomware gang, [...] --------------------------------------------- https://therecord.media/fortinet-warns-customers-after-hackers-leak-passwor… ∗∗∗ Microsoft fixes bug letting hackers take over Azure containers ∗∗∗ --------------------------------------------- Microsoft has fixed a vulnerability in Azure Container Instances called Azurescape that allowed a malicious container to take over containers belonging to other customers on the platform. --------------------------------------------- https://www.bleepingcomputer.com/news/security/microsoft-fixes-bug-letting-… ∗∗∗ Updates to Our Datafeeds/API, (Thu, Sep 9th) ∗∗∗ --------------------------------------------- Most of the data we are collecting is freely available via our API. For quick documentation, see https://isc.sans.edu/api. One particular popular feed is our list of "Researcher IPs." These are IP addresses connected to commercial and academic projects that scan the internet. These scans can account for a large percentage of your unsolicited inbound activity. One use of this feed is to add "color to your logs" by enriching your log data from this feed. --------------------------------------------- https://isc.sans.edu/diary/rss/27824 ∗∗∗ Multistage WordPress Redirect Kit ∗∗∗ --------------------------------------------- Recently, one of our analysts @kpetku came across a series of semi-randomised malware injections in multiple WordPress environments. Typical of spam redirect infections, the malware redirects visitors by calling malicious files hosted on third party infected websites. Interestingly, the infection stores itself as encoded content in the database and is called through random functions littered throughout plugin files using a very common wordpress function “get_option”. --------------------------------------------- https://blog.sucuri.net/2021/09/multistage-wordpress-redirect-kit.html ∗∗∗ Get Ready for PYSA Ransomware Attacks Against Linux Systems ∗∗∗ --------------------------------------------- Linux is increasingly targeted by ransomware. Researchers have now detected indications that the PYSA ransomware, often also known as Mespinoza, is also being readied for Linux targets. read more --------------------------------------------- https://www.securityweek.com/get-ready-pysa-ransomware-attacks-against-linu… ∗∗∗ Analysis of a Parallels Desktop Stack Clash Vulnerability and Variant Hunting using Binary Ninja ∗∗∗ --------------------------------------------- Parallels Desktop uses a paravirtual PCI device called the “Parallels ToolGate” for communication between guest and host OS. This device is identified by Vendor ID 0x1AB8 and Device ID 0x4000 in a Parallels guest. The guest driver provided as part of Parallels Tools and the host virtual device communicate using a ToolGate messaging protocol. To provide a summary, the guest driver prepares a message and writes the physical address of the message to [...] --------------------------------------------- https://www.thezdi.com/blog/2021/9/9/analysis-of-a-parallels-desktop-stack-… ∗∗∗ When the Cyberthreat Comes from the Inside ∗∗∗ --------------------------------------------- Would you like to earn millions of dollars? The LockBit 2.0 ransomware are now trying to recruit insiders – and there is no reason to believe that your company wouldn’t be targeted. The global competitive framework has changed significantly: hybrid warfare with methods like infiltration and espionage will be an imminent threat against the strategic environment for the foreseeable future. --------------------------------------------- https://blog.truesec.com/2021/09/08/when-the-cyberthreat-comes-from-the-ins… ===================== = Vulnerabilities = ===================== ∗∗∗ OpenVPN for Linux and FreeBSD: Schwachstelle ermöglicht Umgehung von Sicherheitsvorkehrungen ∗∗∗ --------------------------------------------- Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Linux und OpenVPN ausnutzen, um einen Denial of Service zu verursachen oder Sicherheitsvorkehrungen zu umgehen --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K21-0944 ∗∗∗ Cisco Security Advisories ∗∗∗ --------------------------------------------- Cisco hat zehn Security Advisories veröffentlicht. Keine der darin behobenen Schwachstellen wird als "critical" eingestuft, vier als "high". --------------------------------------------- https://tools.cisco.com/security/center/Search.x?publicationTypeIDs=1&first… ∗∗∗ ABB: EIBPORT several CVEs ABBVREP0049_R9120 ∗∗∗ --------------------------------------------- ABB is aware of vulnerabilities in the product versions listed above. A firmware update is available that resolves these privately reported vulnerabilities in the product versions listed above. An attacker who successfully exploited these vulnerabilities could access sensitive information stored inside the device and can access the device with root privileges. CVE-IDs: CVE-2021-28909, CVE-2021-28910, CVE-2021-28911, CVE-2021-28912, CVE-2021-28913, CVE-2021-28914 --------------------------------------------- https://search.abb.com/library/Download.aspx?DocumentID=9AKK107992A7304&Lan… ∗∗∗ GitHub entdeckt sieben Sicherheitslücken in Node.js Packages ∗∗∗ --------------------------------------------- In einem Rahmen Bug-Bounty-Programm hat GitHub Schwachstellen aufgedeckt und bietet Handlungsanweisungen für betroffene Nutzer. --------------------------------------------- https://heise.de/-6187785 ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Fedora (lynx, matrix-synapse, and proftpd), openSUSE (ntfs-3g_ntfsprogs), Oracle (kernel), Red Hat (RHV-H), Scientific Linux (kernel), and Ubuntu (libapache2-mod-auth-mellon, linux, linux-aws, linux-aws-5.11, linux-azure, linux-azure-5.11, linux-gcp, linux-hwe-5.11, linux-kvm, linux-oracle, linux-oracle-5.11, linux-raspi, linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp, linux-gcp-5.4, linux-gke, linux-gke-5.4, linux-gkeop, [...] --------------------------------------------- https://lwn.net/Articles/868743/ ∗∗∗ Intel processor vulnerabilities CVE-2021-0086 and CVE-2021-0089 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K41043270?utm_source=f5support&utm_mediu… ∗∗∗ SaltStack Salt: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K21-0946 ∗∗∗ WordPress: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K21-0948 ∗∗∗ Security Advisory - Improper Authorization Vulnerability in Some Huawei Products ∗∗∗ --------------------------------------------- https://www.huawei.com/en/psirt/security-advisories/2021/huawei-sa-20210908… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by an Improper Restriction of Excessive Authentication Attempts vulnerability (CVE-2021-20427) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Security Bulletin: Security vulnerabilitiy has been fixed in IBM Security Identity Manager (CVE-2021-29692) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-security-vulnerabilitiy-h… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by an OpenLDAP vulnerability (CVE-2020-25692) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Security Bulletin: Security vulnerabilities have been identified in IBM® Java SDK that affect IBM Security Directory (CVE-2021-2161) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-security-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Security Guardium ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Vulnerability in NX-OS Firmware used by IBM c-type SAN directors and switches. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-nx-os-fi… ∗∗∗ Security Bulletin: Security vulnerabilitiy has been identified in IBM® Java SDK that affect IBM Security Directory Suite (CVE-2021-2161) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-security-vulnerabilitiy-h… ∗∗∗ Security Bulletin: Container Environment Vulnerabilities Affect IBM Secure Proxy (CVE-2020-14298, CVE-2020-14300) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-container-environment-vul… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by a kernel vulnerability (CVE-2020-25705, CVE-2020-28374) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by a Reliance on Untrusted Inputs in Security Descision ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by a Weak Password Policy vulnerability (CVE-2021-20418) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by a Oracle MySQL vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily