- Daily - CERT.at

Tageszusammenfassung - Mittwoch 15-04-2015
by Daily end-of-shift report 15 Apr '15

15 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 14-04-2015 18:00 − Mittwoch 15-04-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Adobe Security Bulletins Posted *** --------------------------------------------- The following Security Bulletins have been posted today: APSB15-06: Security updates available for Adobe Flash Player APSB15-07: Security update: hotfixes available for ColdFusion APSB15-08: Security bulletin available .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1190 *** MSRT April: Unskal, Saluchtra, Dexter and IeEnablerCby *** --------------------------------------------- This month we added four new malware families to the Malicious Software Removal Tool: Win32/Saluchtra, Win32/Dexter, Win32/Unskal and Win32/IeEnablerCby, further protecting customers against malicious activity. IeEnablerCby is .. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/04/14/msrt-april-unskal-saluch… *** Cisco TelePresence Collaboration Desk and Room Endpoints HTML Redirect Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38350 *** Cisco Web Security Appliance Cross-Site Scripting Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38351 *** Critical Patch Update - April 2015 *** --------------------------------------------- This Critical Patch Update contains 98 new security fixes across the product families listed below. Please note that a blog entry summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is .. --------------------------------------------- http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html *** Solaris Third Party Bulletin - April 2015 *** --------------------------------------------- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.h… *** Alte Xorg-Lücke bedroht haufenweise Drittsoftware *** --------------------------------------------- Die Lücke wurde bereits 2013 gestopft. Programme, die unter der Verwendung von Headern aus verwundbaren Versionen übersetzt wurden, sind allerdings nach wie vor angreifbar. --------------------------------------------- http://heise.de/-2606536 *** What the Ridiculous Fuck, D-Link?! *** --------------------------------------------- As mentioned in an update to my post on the HNAP bug in the DIR-890L, the same bug was reported earlier this year in the DIR-645, and a patch was released. D-Link .. --------------------------------------------- http://www.devttys0.com/2015/04/what-the-ridiculous-fuck-d-link/ *** Das Imperium schlägt zurück: Hacker-Gruppen ziehen gegeneinander zu Felde *** --------------------------------------------- Zwei Cyberspionage-Gruppen kamen sich in die Quere und attackierten sich wechselseitig. Sicherheitsforscher sehen hier einen neuen Trend, bei dem sich Hacker-Gruppen gezielt gegenseitig anfeinden. --------------------------------------------- http://heise.de/-2607493 *** Microsoft Security Bulletin Summary for April 2015 *** --------------------------------------------- This bulletin summary lists security bulletins released for April 2015. For information about how to receive automatic notifications whenever Microsoft security bulletins are .. --------------------------------------------- https://technet.microsoft.com/library/security/ms15-apr

1 0

Tageszusammenfassung - Dienstag 14-04-2015
by Daily end-of-shift report 14 Apr '15

14 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 13-04-2015 18:00 − Dienstag 14-04-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Cisco Web Security Appliance Python File Processing Privilege Escalation Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38306 *** Linux 4.0 freigegeben: Sicherheitslücken im laufenden Betrieb korrigieren *** --------------------------------------------- Bei Linux 4.0 lassen sich Sicherheitslücken ohne Neustart des Systems beheben. Ein verzögertes Aktualisieren von Dateieigenschaften soll die Performance von Ext4 verbessern. --------------------------------------------- http://heise.de/-2600691 *** A Tale of Two Exploits *** --------------------------------------------- CVE-2015-0336 is a type confusion vulnerability in the AS2 NetConnection class. I reported this issue in January and soon wrote a proof-of-concept exploit for the bug. The issue was patched by Adobe in March and less than a .. --------------------------------------------- http://googleprojectzero.blogspot.com/2015/04/a-tale-of-two-exploits.html *** Bioazih RAT: How clean-file metadata can help keep you safe *** --------------------------------------------- As mentioned in our previous blog post about the Microsoft Clean-File Metadata initiative, there are a number of benefits for our partners and customers who use our clean or released-file metadata, specifically during antimalware whitelisting efforts. Using the authoritative metadata manifest .. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/04/13/bioazih-rat-how-clean-fi… *** New Trojan for Linux attacks websites *** --------------------------------------------- April 13, 2015 Doctor Web security researchers have examined a new Trojan that can infect computers with Linux operating system. This malicious program possesses the ability to scan remote websites for vulnerabilities and to attack resources with the specified HTTP protocol addresses. Criminals can .. --------------------------------------------- http://news.drweb.com/show/?i=9386&lng=en&c=9 *** IT-Sicherheit: Auch Medizintechnik lässt sich hacken *** --------------------------------------------- Überdosis nicht mehr ausgeschlossen: Der Sicherheitsforscher Billy Rios kann eine in Krankenhäusern verwendete Infusionspumpe über das Intranet manipulieren. --------------------------------------------- http://www.golem.de/news/it-sicherheit-auch-medizintechnik-laesst-sich-hack… *** As Ransomware Attacks Evolve, More Potential Victims Are at Risk *** --------------------------------------------- In early December, as most people were dealing with the stress of looking for the perfect holiday gifts and planning out their upcoming celebrations, police officers in .. --------------------------------------------- http://threatpost.com/as-ransomware-attacks-evolve-more-potential-victims-a… *** Sicherheitssoftware klemmt Windows vom IPv6-Internet ab *** --------------------------------------------- Die Sicherheitssoftware Warsaw 1.5.1 für Windows blockiert Internetserver, die sowohl über IPv6 als auch IPv4 erreichbar sind. Betroffen sind vor allem mehrere Millionen brasilianischer Windows-Geräte, deren Nutzer Homebanking betreiben. --------------------------------------------- http://heise.de/-2603192 *** TV5Monde - A (tentative) technical analysis *** --------------------------------------------- As it may appear surprising that a TV station can be forced to stop broadcasting after having its website defaced and social network accounts controlled by some hackers, I've tried to collect publicly available technical information and improve my understanding of this interesting issue. Below you .. --------------------------------------------- http://www.fixsing.com/tv5monde-a-tentative-technical-analysis/ *** Hardening IIS Security *** --------------------------------------------- Security is an essential part of a web application and should be taken into consideration from the first stage of the development process. A website couldn't ever be secure enough unless you would undertake necessary security .. --------------------------------------------- http://resources.infosecinstitute.com/hardening-iis-security/ *** Verschlüsselung: Auch Mozilla will HTTPS zum Standard machen *** --------------------------------------------- Ein Vorschlag von Mozilla sieht vor, dass der Firefox-Browser künftig bestimmte neue Features nur noch über HTTPS-Verbindungen zulässt. Langfristig wird angestrebt, dass alle Webseiten HTTPS benutzen. --------------------------------------------- http://www.golem.de/news/verschluesselung-auch-mozilla-will-https-zum-stand…

1 0

Tageszusammenfassung - Montag 13-04-2015
by Daily end-of-shift report 13 Apr '15

13 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 10-04-2015 18:00 − Montag 13-04-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Cisco Web Security Appliance Pickle Python Module Arbitrary Code Execution Vulnerability *** --------------------------------------------- A vulnerability in the status checking process of support remote access tunnels in the Cisco Web Security Appliance (WSA) could allow an authenticated, local attacker to execute arbitrary Python code on a targeted system. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38305 *** Hacking the D-Link DIR-890L *** --------------------------------------------- The past 6 months have been incredibly busy, and I haven't been keeping up with D-Link's latest shenanigans. In need of some entertainment, I went to their web page today and was greeted by this atrocity: I think the most .. --------------------------------------------- http://www.devttys0.com/2015/04/hacking-the-d-link-dir-890l/ *** Reversing Belkin's WPS Pin Algorithm *** --------------------------------------------- After finding D-Link's WPS algorithm, I was curious to see which vendors might have similar algorithms, so I grabbed some Belkin firmware and started dissecting it. This particular firmware uses the SuperTask! RTOS, and in fact uses the .. --------------------------------------------- http://www.devttys0.com/2015/04/reversing-belkins-wps-pin-algorithm/ *** Digital Certificates: Who Can You Trust? *** --------------------------------------------- Digital certificates are the backbone of the Public Key Infrastructure (PKI), which is the basis of trust online. Digital certificates are often compared to signatures; we can trust a document because it has a signature, or certificate authority (CA) by someone we trust. Simply put, .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/digital-certific… *** APT 30 and the Mechanics of a Long-Running Cyber Espionage Operation *** --------------------------------------------- Having some of the world's most active economies, Asia Pacific countries are more likely to be a target of targeted attacks than the rest of the world. In Operation Quantum Entanglement, Pacific Ring of Fire: PlugX / Kaba and other FireEye reports, we have highlighted how Northeast Asian countries have been .. --------------------------------------------- https://www.fireeye.com/blog/threat-research/2015/04/apt_30_and_the_mecha.h… *** Polizeiorganisation Interpol verstärkt Kampf gegen Cyberkriminalität *** --------------------------------------------- Zum Kampf gegen die Internetkriminalität und andere neue Bedrohungen hat die internationale Polizeiorganisation Interpol ein Forschungszentrum in Singapur eröffnet. Der Interpol-Weltkomplex für Innovation (IGCI) soll .. --------------------------------------------- http://heise.de/-2599811 *** Windows XP noch auf zehntausenden Berliner Behörden-PCs *** --------------------------------------------- Seit einem Jahr gibt es keine offiziellen Patches mehr für Windows XP. Dennoch ist das fast 14 Jahre alte Betriebssystem noch weiter verbreitet, als Sicherheitsexperten lieb ist. In der Berliner Verwaltung sollen es sogar noch zehntausende PCs sein. Der Datenschutzbeauftragte Alexander Dix fordert nun die Abschaltung aller Behördenrechner. --------------------------------------------- http://derstandard.at/2000014223975 *** Zero Access Malware *** --------------------------------------------- The Zero Access trojan (Maxx++, Sierief, Crimeware) has affected millions of computers worldwide, and it is the number one cause of cyber click fraud and Bitcoin mining on the Internet. Once the trojan has been delivered into the system, it .. --------------------------------------------- http://resources.infosecinstitute.com/zero-access-malware/ *** Microsoft partners with Interpol, industry to disrupt global malware attack affecting more than 770,000 PCs in past six months *** --------------------------------------------- Today Interpol and the Dutch National High Tech Crime Unit (DNHTCU) announced the disruption of Simda.AT, a significant malware threat affecting more than 770,000 computers in over 190 countries. The Simda.AT variant first appeared in .. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/04/12/microsoft-partners-with-… *** How to bypass Google's Santa LOCKDOWN mode *** --------------------------------------------- Santa is a binary whitelisting/blacklisting system made by Google's Macintosh Operations Team. While I refer to it as Google's Santa it is not an official Google product. It is based on a kernel extension and userland components to .. --------------------------------------------- https://reverse.put.as/2015/04/13/how-to-bypass-googles-santa-lockdown-mode/ *** Huthos VPS Provider: Totally legit, 1000% not a criminal organization - Andrew Morris *** --------------------------------------------- I observed a hacker trying to compromise one of my internet-facing Linux servers and repurpose it to sell to unknowing legitimate customers. --------------------------------------------- http://morris.guru/huthos-the-totally-100-legit-vps-provider/ *** OS X 10.10.3 soll gegen Adware helfen *** --------------------------------------------- Apple hat weitere Massnahmen gegen Adware ergriffen, die verstärkt kostenlosen Mac-Programmen beim Download beigelegt wird und unter anderem Browser-Einstellungen ändert. --------------------------------------------- http://heise.de/-2601940 *** VU#672268: Microsoft Windows NTLM automatically authenticates via SMB when following a file:// URL *** --------------------------------------------- Software running on Microsoft Windows that utilizes HTTP requests can be forwarded to a file:// protocol on a malicious server, which causes Windows to automatically attempt authentication via SMB to the malicious server in some circumstances. The .. --------------------------------------------- http://www.kb.cert.org/vuls/id/672268

1 0

Tageszusammenfassung - Freitag 10-04-2015
by Daily end-of-shift report 10 Apr '15

10 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 09-04-2015 18:00 − Freitag 10-04-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Beebone: FBI und Europol legen Wurm-Netz lahm *** --------------------------------------------- Das interessante am ausgeschalteten Beebone-Botnetz ist der Schädling dahinter: Es handelt sich um einen Downloader, der anderen Unrat nachlädt, sich selber weiter verbreitet und dabei ständig mutiert. --------------------------------------------- http://heise.de/-2598111 *** How To Create a Website Backup Strategy *** --------------------------------------------- We've all heard it million times before - backups are important. Still, the reality is that even today, backups remain one of the most overlooked and under-utilized precautions we can take to protect our vital data. Why are backups so important Put simply, a good set of backups can save your website when absolutely everythingRead More --------------------------------------------- http://feedproxy.google.com/~r/sucuri/blog/~3/II8TR_qV6OA/how-to-create-a-w… *** 122 online forums compromised to redirect visitors to Fiesta exploit kit *** --------------------------------------------- Over a hundred forum websites have been compromised and injected with code that redirects users to sites hosting the Fiesta exploit kit, Cyphort researchers have found. These are not highly popular... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/4VryRaL3aoc/malware_news.… *** Don't Be Fodder for China's "Great Cannon" *** --------------------------------------------- China has been actively diverting unencrypted Web traffic destined for its top online search service -- Baidu.com -- so that some visitors from outside of the country were unwittingly enlisted in a novel and unsettling series of denial-of-service attacks aimed at sidelining sites that distribute anti-censorship tools, according to research released this week. --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/-n1M-QyvCoA/ *** Cisco and Level 3 team up to squash brute force server hijackers *** --------------------------------------------- #DownWithSSHPsychos Cisco and service provider Level 3 have teamed up take down netblocks linked to brute-force hack kingpins SSHPsychos, severely degrading (but not destroying) the groups potential to hack servers in the process. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/04/10/sshpsychos_… *** In eigener Sache: Wartungsarbeiten 16. 4. 2015 *** --------------------------------------------- In eigener Sache: Wartungsarbeiten 16.4.2015 | 10. April 2015 | Am Donnerstag, 16. April 2015, werden wir Wartungsarbeiten an unserer Infrastruktur vornehmen. Dies kann zu kurzen Service-Ausfällen führen (jeweils im Bereich weniger Minuten). Es gehen dabei keine Daten (zb Emails) verloren, es kann sich nur die Bearbeitung etwas verzögern. In dringenden Fällen können sie uns wie gewohnt telefonisch unter +43 1 505 64 16 78 erreichen. --------------------------------------------- http://www.cert.at/services/blog/20150410112411-1466.html *** Cisco Aggregate Services Router 9000 ASR9K Security Bypass Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38292 *** Red Hat JBoss XML External Entity Expansion Flaw Lets Remote Users Obtain Potentially Sensitive Information *** --------------------------------------------- http://www.securitytracker.com/id/1032017 *** VMSA-2015-0003.1 *** --------------------------------------------- VMware product updates address critical information disclosure issue in JRE --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2015-0003.html *** f5 Security Advisories *** --------------------------------------------- *** Security Advisory: FreeType vulnerabilities CVE-2014-9656 and CVE-2014-9659 *** https://support.f5.com:443/kb/en-us/solutions/public/16000/300/sol16380.htm… *** Security Advisory: Linux kernel vulnerability CVE-2014-9683 *** https://support.f5.com:443/kb/en-us/solutions/public/16000/300/sol16381.htm… *** Security Advisory: OpenSSL vulnerability CVE-2012-2110 *** https://support.f5.com:443/kb/en-us/solutions/public/16000/200/sol16285.htm… *** Security Advisory: Linux file utility vulnerabilities CVE-2014-8116 / CVE-2014-8117 *** https://support.f5.com:443/kb/en-us/solutions/public/16000/300/sol16347.htm… *** Security Advisory: GnuPG vulnerability CVE-2013-4576 *** https://support.f5.com:443/kb/en-us/solutions/public/16000/300/sol16396.htm… *** Security Advisory: Linux RPM vulnerability CVE-2013-6435 *** https://support.f5.com:443/kb/en-us/solutions/public/16000/300/sol16383.htm… *** Security Advisory: Multiple MySQL vulnerabilities *** https://support.f5.com:443/kb/en-us/solutions/public/16000/300/sol16389.htm… *** Security Advisory: NTP vulnerability CVE-2014-9297 *** https://support.f5.com:443/kb/en-us/solutions/public/16000/300/sol16392.htm… *** Security Advisory: Python vulnerability CVE-2006-4980 *** https://support.f5.com:443/kb/en-us/solutions/public/16000/300/sol16398.htm… *** Security Advisory: Multiple MySQL vulnerabilities *** https://support.f5.com:443/kb/en-us/solutions/public/16000/300/sol16385.htm… *** Security Advisory: NTP vulnerability CVE-2014-9298 *** https://support.f5.com:443/kb/en-us/solutions/public/16000/300/sol16393.htm… *** Security Advisory: Apache Tomcat vulnerability CVE-2014-0227 *** https://support.f5.com:443/kb/en-us/solutions/public/16000/300/sol16344.htm… *** DFN-CERT-2015-0483 - F5 Networks BIG-IP Protocol Security Module (PSM), F5 Networks BIG-IP Systeme: Eine Schwachstelle ermöglicht einen Denial-of-Service-Angriff *** --------------------------------------------- 08.04.2015 --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-0483/ *** DFN-CERT-2015-0318 - IBM Java, IBM Notes, IBM Domino: Mehrere Schwachstellen ermöglichen die Übernahme der Systemkontrolle *** --------------------------------------------- 10.03.2015 --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-0318/ *** Security_Advisory-Xen Vulnerabilities on Huawei FusionSphere products *** --------------------------------------------- Apr 10, 2015 10:12 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** [2015-04-10] Unauthenticated Local File Disclosure in multiple TP-LINK products *** --------------------------------------------- Attackers can read sensitive configuration files without prior authentication on multiple TP-LINK devices. These files e.g. include the administrator credentials and the WPA passphrase. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015…

1 0

Tageszusammenfassung - Donnerstag 9-04-2015
by Daily end-of-shift report 09 Apr '15

09 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 08-04-2015 18:00 − Donnerstag 09-04-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Securing high-risk, third-party relationships *** --------------------------------------------- High-profile attacks reveal that malicious hackers target third-party vendors and supply chain partners as a backdoor into their primary target, according to CyberArk Software. Organizations in e... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/vSpu1uYwxR4/secworld.php *** AlienSpy RAT exploited to deliver the popular Citadel Trojan *** --------------------------------------------- Security experts at Fidelis firm discovered that variants of the AlienSpy remote access trojan (RAT) are currently being used in global phishing campaigns. Cyber criminals have exploited the AlienSpy RAT to deliver the popular Citadel banking Trojan and maintain the persistence inside the targeted architecture with a backdoor mechanism. Criminal crews used AlienSpy RAT to compromise systems in... --------------------------------------------- http://securityaffairs.co/wordpress/35802/cyber-crime/alienspy-rat-citadel-… *** Apple aktualisiert Safari für OS X 10.8, 10.9 und 10.10 *** --------------------------------------------- Mit den Versionen 8.0.5, 7.1.5 und 6.2.5 seines Browsers behebt Cupertino jede Menge Sicherheitslücken, darunter auch ein altes Problem im Privatmodus. --------------------------------------------- http://heise.de/-2597649 *** 44 Relevant Cyber Security Conferences around the World *** --------------------------------------------- Wherever you may be in the world, chances are there's a cyber security event happening near you this year. Cyber security conferences are important and necessary for the industry and for each of us, individually, because they help bring together the community. What's more, innovation often spurs after having a meaningful discussion with a peer or a mentor, or after being part of a conversation on your favorite topic in the field of information security. --------------------------------------------- https://heimdalsecurity.com/blog/44-relevant-cyber-security-conferences-aro… *** Polymorphic Beebone botnet sinkholed in international police operation *** --------------------------------------------- On April 8, a global operation targeted the Beebone (also known as AAEH) botnet, a polymorphic downloader bot which installs various forms of malware on victims' computers. Initial figures show tha... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/MGj0qJKKZ0I/secworld.php *** Deadly combination of Upatre and Dyre Trojans still actively targeting users *** --------------------------------------------- Upatre (or Waski) is a downloader Trojan that has lately become the malware of choice for cyber crooks to deliver additional, more dangerous malware on users computers. A few weeks ago, Swiss and ... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/IJ4tqq_YAUU/malware_news.… *** LG software disables Windows security feature, developer says *** --------------------------------------------- LG Split Screen software that comes with the companys ultra wide monitors stealthily weakens Windows users defenses by deactivating the OS User Account Control (UAC) feature, developer Christopher ... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/1t_AM7tskik/secworld.php *** Hidden backdoor API to root privileges in Apple OS X *** --------------------------------------------- The Admin framework in Apple OS X contains a hidden backdoor API to root privileges. It's been there for several years (at least since 2011), I found it in October 2014 and it can be exploited to escalate privileges to root from any user account in the system. --------------------------------------------- https://truesecdev.wordpress.com/2015/04/09/hidden-backdoor-api-to-root-pri… *** The Banking Trojan Emotet: Detailed Analysis *** --------------------------------------------- The Emotet Trojan is a highly automated and developing, territorially-targeted bank threat. Its small size, the dispersal methods used and the modular architecture, all make Emotet a very effective weapon for the cyber-criminal. --------------------------------------------- http://securelist.com/analysis/69560/the-banking-trojan-emotet-detailed-ana… *** Apple Leaves CNNIC Root in iOS, OSX Certificate Trust Lists *** --------------------------------------------- When it was revealed late last month that a Chinese certificate authority had allowed an intermediate CA to issue unauthorized certificates for some Google domains, both Google and Mozilla reacted quickly and dropped trust in CNNIC altogether, Apple has kept the root certificates in its trusted store for both iOS and OSX. Apple on Wednesday released... --------------------------------------------- http://threatpost.com/apple-leaves-cnnic-root-in-ios-osx-certificate-trust-… *** TA15-098A: AAEH *** --------------------------------------------- Original release date: April 09, 2015 Systems Affected Microsoft Windows 95, 98, Me, 2000, XP, Vista, 7, and 8Microsoft Server 2003, Server 2008, Server 2008 R2, and Server 2012 Overview AAEH is a family of polymorphic downloaders created with the primary purpose of downloading other malware, including password stealers, rootkits, fake antivirus, and ransomware.The United States Department of Homeland Security (DHS), in collaboration with Europol, the Federal Bureau of Investigation (FBI) and... --------------------------------------------- https://www.us-cert.gov/ncas/alerts/TA15-098A *** ZDI-15-119: IBM Tivoli Storage Manager FastBack CRYPTO_S_EncryptBufferToBuffer Buffer Overflow Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Storage Manager FastBack. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/OQuaNiGQOf8/ *** ZDI-15-118: IBM Tivoli Storage Manager FastBack Mount CMountDismount::GetVaultDump Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Tivoli Storage Manager FastBack. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/RumTeWThXlw/ *** DFN-CERT-2015-0484 - F5 Networks BIG-IP Protocol Security Module (PSM), F5 Networks BIG-IP Systeme: Eine Schwachstelle ermöglicht das Ausführen beliebigen Programmcodes *** --------------------------------------------- 08.04.2015 --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-0484/ *** DFN-CERT-2015-0477 - MantisBT: Mehrere Schwachstellen ermöglichen u. a. das Ausführen beliebigen Programmcodes *** --------------------------------------------- 08.04.2015 --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-0477/ *** Asterisk TLS Certificate Validation Flaw With Null Byte in Common Name Lets Remote Users Bypass Certificate Validation *** --------------------------------------------- http://www.securitytracker.com/id/1032052 *** CiviCRM private report - Moderately Critical - Cross Site Request Forgery (CSRF) - SA-CONTRIB-2015-094 *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-094Project: CiviCRM private report (third-party module)Version: 6.x, 7.xDate: 2015-April-08 Security risk: 13/25 ( Moderately Critical) AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site Request ForgeryDescriptionCiviCRM private report module enables users to create their own private copies of CiviCRM reports, which they can modify and save to meet their needs without requiring the "Administer reports" permission.The --------------------------------------------- https://www.drupal.org/node/2467697 *** [2015-04-09] Multiple XSS & XSRF vulnerabilities in Comalatech Comala Workflows *** --------------------------------------------- XSS and XSRF vulnerabilities within the Confluence plugin Comala Workflows of Comalatech enable an attacker to perform unauthorized actions in the name of another logged-in user and attack other users of the web application with JavaScript code, browser exploits or Trojan horses. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015… *** Juniper Security Advisories *** --------------------------------------------- *** JSA10679 - 2015-04 Security Bulletin: OpenSSL 8th January 2015 advisory. *** http://kb.juniper.net/index?page=content&id=JSA10679&actp=RSS *** JSA10680 - 2015-04 Security Bulletin: OpenSSL 19th March 2015 advisory *** http://kb.juniper.net/index?page=content&id=JSA10680&actp=RSS *** JSA10678 - 2015-04 Security Bulletin: Junos: Insufficient entropy on QFX3500 and QFX3600 platforms when the system boots up (CVE-2015-3006) *** http://kb.juniper.net/index?page=content&id=JSA10678&actp=RSS *** JSA10677 - 2015-04 Security Bulletin: SRX Series: Cross-Site-Scripting Vulnerability in Dynamic VPN (CVE-2015-3005). *** http://kb.juniper.net/index?page=content&id=JSA10677&actp=RSS *** JSA10676 - 2015-04 Security Bulletin: SRX Series: ISC BIND vulnerability denial of service in delegation handling (CVE-2014-8500) *** http://kb.juniper.net/index?page=content&id=JSA10676&actp=RSS *** JSA10675 - 2015-04 Security Bulletin: Junos J-Web: Clickjacking vulnerability (CVE-2015-3004) *** http://kb.juniper.net/index?page=content&id=JSA10675&actp=RSS *** JSA10674 - 2015-04 Security Bulletin: Junos: Multiple privilege escalation vulnerabilities in Junos CLI (CVE-2015-3003) *** http://kb.juniper.net/index?page=content&id=JSA10674&actp=RSS *** JSA10673 - 2015-04 Security Bulletin: IDP: Multiple vulnerabilities addressed by third party software updates. *** http://kb.juniper.net/index?page=content&id=JSA10673&actp=RSS *** JSA10672 - 2015-04 Security Bulletin: SRX Series: disconnecting from console may not automatically log out (CVE-2015-3002) *** http://kb.juniper.net/index?page=content&id=JSA10672&actp=RSS *** Apple Security Advisories *** --------------------------------------------- Apple TV 7.2 https://support.apple.com/kb/HT204662 *** iOS 8.3 *** https://support.apple.com/kb/HT204661 *** OS X Yosemite 10.10.3 and Security Update 2015-004 *** https://support.apple.com/kb/HT204659 *** Safari 8.0.5, Safari 7.1.5, and Safari 6.2.5 *** https://support.apple.com/kb/HT204658 *** OS X Yosemite 10.10.3 Combo Update *** https://support.apple.com/kb/DL1804 *** OS X Yosemite 10.10.3 Update *** https://support.apple.com/kb/DL1805 *** Security Update 2015-004 Mountain Lion *** https://support.apple.com/kb/DL1802 *** Security Update 2015-004 Mavericks *** https://support.apple.com/kb/DL1803 *** iOS 8.3 *** https://support.apple.com/kb/DL1806 *** Xcode 6.3 *** https://support.apple.com/kb/HT204663

1 0

Tageszusammenfassung - Mittwoch 8-04-2015
by Daily end-of-shift report 08 Apr '15

08 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 07-04-2015 18:00 − Mittwoch 08-04-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Gmail Problems Due to Expired Certificate (April 6, 2015) *** --------------------------------------------- Because Google allowed a servers security certificate to expire, Gmail users experienced problems for several hours on April 4....... --------------------------------------------- http://www.sans.org/newsletters/newsbites/r/17/27/302 *** Aw snap! How hideous HTML can crash Chrome tabs in one click *** --------------------------------------------- Watch out for drive-by browser bombs - for now, at least A bug in the most recent version of the Chrome allows miscreants to crash browser tabs simply by embedding a link with a malformed URL in the HTML of a page. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/04/07/chrome_awsn… *** Drive-by-login attack identified and used in lieu of spear phishing campaigns *** --------------------------------------------- A new attack, drive-by-logins, allows attackers to target specific victims on sites they trust. --------------------------------------------- http://www.scmagazine.com/high-tech-bridge-identifies-new-attack-method-pos… *** Nuclear Exploit-Kit mit Google Ads ausgeliefert *** --------------------------------------------- Googles Werbebanner lieferten für mehrere Stunden ein gefährliches Exploit-Kit aus, das die Rechner vieler nichtsahnender Opfer mit Schadcode infiziert haben könnte. --------------------------------------------- http://heise.de/-2596908 *** Most top corporates still Heartbleeding over the internet *** --------------------------------------------- Australia crowned global head-in-sand champion A depressing 76 percent of the top 2000 global organisations have public facing systems still exposed to Heartbleed, researchers say. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/04/08/still_bleed… *** Your home automation things are a security nightmare *** --------------------------------------------- Veracode tests leave lazy devs red-faced Its not just home broadband routers that have hopeless security: according to security outfit Veracode, cloudy home automation outfits also need to hang their collective heads in shame. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/04/08/your_home_a… *** Why cybersecurity is vital during the vendor selection process *** --------------------------------------------- You likely have a list of criteria to check through during the hiring process of a vendor, but if you havent added cybersecurity standards to that list, you should. --------------------------------------------- http://www.scmagazine.com/why-cybersecurity-is-vital-during-the-vendor-sele… *** l+f: Updated euer WordPress oder ISIS kommt! *** --------------------------------------------- Das FBI schlägt Alarm: Sympathisanten des Islamischen Staates hacken haufenweise WordPress-Seiten. --------------------------------------------- http://heise.de/-2596912 *** Guide outlines specifications of smart card-based PACS *** --------------------------------------------- Smart cards are increasingly accepted as the credential of choice for securely authenticating identity, determining appropriate levels of information access and controlling physical access. To furt... --------------------------------------------- http://www.net-security.org/secworld.php?id=18179 *** A flawed ransomware encryptor *** --------------------------------------------- Last autumn, we discovered the first sample of an interesting new encryptor, TorLocker. The Trojan encrypts all files with AES-256 + RSA-2048 and uses the Tor network to contact its "owners". --------------------------------------------- http://securelist.com/blog/research/69481/a-flawed-ransomware-encryptor/ *** New Tor version fixes issues that can crash hidden services and clients *** --------------------------------------------- Two new versions of the Tor anonymity software have been released on Tuesday, with fixes for two security issues that can be exploited to crash hidden services and clients visiting them. The first ... --------------------------------------------- http://www.net-security.org/secworld.php?id=18180 *** Don't judge the risk by the logo *** --------------------------------------------- It's been almost a year since the OpenSSL Heartbleed vulnerability, a flaw which started a trend of the branded vulnerability, changing the way security vulnerabilities affecting open-source software are being reported and perceived. Vulnerabilities are found and fixed all the... --------------------------------------------- https://securityblog.redhat.com/2015/04/08/dont-judge-the-risk-by-the-logo/ *** NTP Project ntpd reference implementation contains multiple vulnerabilities *** --------------------------------------------- NTP Project ntpd reference implementation accepts unauthenticated packets with symmetric key cryptography and does not protect symmetric associations against denial of service attacks. --------------------------------------------- https://www.kb.cert.org/vuls/id/374268 *** Multiple Vulnerabilities in ntpd (April 2015) Affecting Cisco Products *** --------------------------------------------- cisco-sa-20150408-ntpd --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco ASA FirePOWER Services and Cisco ASA CX Services Crafted Packets Denial of Service Vulnerability *** --------------------------------------------- cisco-sa-20150408-cxfp --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Multiple Vulnerabilities in Cisco ASA Software *** --------------------------------------------- cisco-sa-20150408-asa --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** HPSBHF03310 rev.1 - HP Thin Clients running Windows Embedded Standard 7 (WES7) or Windows Embedded Standard 2009 (WES09) with HP Easy Deploy, Remote Elevation of Privilege, Execution of Code *** --------------------------------------------- Potential security vulnerabilities have been identified with certain HP Thin Clients running Windows Embedded Standard 7 (WES7) and Windows Embedded Standard 2009 (WES09) and all versions of HP Easy Deploy. The vulnerabilities could be exploited remotely to allow elevation of privilege and execution of code. --------------------------------------------- https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04629160 *** SSA-487246 (Last Update 2015-04-08): Vulnerabilities in SIMATIC HMI Devices *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** FreeBSD IPv6 Router Advertisement Processing Flaw Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1032043 *** DSA-3214 mailman - security update *** --------------------------------------------- A path traversal vulnerability was discovered in Mailman, the mailinglist manager. Installations using a transport script (such aspostfix-to-mailman.py) to interface with their MTA instead of staticaliases were vulnerable to a path traversal attack. To successfullyexploit this, an attacker needs write access on the local file system. --------------------------------------------- https://www.debian.org/security/2015/dsa-3214

1 0

Tageszusammenfassung - Dienstag 7-04-2015
by Daily end-of-shift report 07 Apr '15

07 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 03-04-2015 18:00 − Dienstag 07-04-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** On Demand Webinar: Monitoring Linux/UNIX Privileged Users *** --------------------------------------------- On Demand Webinar - Randy Franklin Smith looks at how to audit what admins do inside Linux and UNIX with sudo's logging capabilities. Then, the BeyondTrust team will walk through how to augment sudo for complete control and auditing over UNIX and Linux user activity. --------------------------------------------- http://blog.beyondtrust.com/on-demand-webinar-monitoring-linuxunix-privileg… *** Dyre Wolf malware steals more than $1 million, bypasses 2FA protection *** --------------------------------------------- Campaign is crude and brazen, but rakes in cash anyway. --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/dSucTqiLvNI/ *** Angler Exploit Kit Utilizing 302 Cushioning and Domain Shadowing *** --------------------------------------------- Overview Angler Exploit Kit is one of the most prevalent and advanced exploit kits in use today and is continually evolving. Angler continues to utilize malvertising to push landing pages and malicious actors are still registering domains solely for serving exploits, but recently, weve noticed an increase in two new infection vectors - 302 Cushioning and Domain Shadowing. 302 Cushioning, or a --------------------------------------------- http://feedproxy.google.com/~r/zscaler/research/~3/JUMaL-rqARE/angler-explo… *** Bugs in Tor exploited to run DoS against black markets *** --------------------------------------------- A severe vulnerability in Tor network was exploited by attackers to run denial of service attacks against two underground black markets. An operator of an underground black market hosted on the Tor network revealed that hit site suffered a DoS attack that exploited a flaw in Tor architecture. The event is not isolated, a similar... --------------------------------------------- http://securityaffairs.co/wordpress/35663/hacking/bugs-in-tor-dos.html *** Bring Out Your Dead: An Update on the PCI relevance of SSLv3 *** --------------------------------------------- In October, a tidal wave of discussion surrounding SSLv3 hit the information security community with the release of the POODLE attack vector. This served to heat up existing discussions about when and how organizations would give SSLv3 the final thump... --------------------------------------------- https://www.ambiron.com/Resources/SpiderLabs-Blog/Bring-Out-Your-Dead--An-U… *** A severe arbitrary code execution in BitTorrent Sync affects various products *** --------------------------------------------- A security expert has discovered a severe vulnerability in BitTorrent Sync that can be exploited by a remote attacker to execute arbitrary code on a vulnerable machine. The security expert Andrea Micalizzi, also known as "rgod", has discovered a serious vulnerability in BitTorrent Sync (CVE-2015-2846) can be exploited by a remote attacker to execute arbitrary code. --------------------------------------------- http://securityaffairs.co/wordpress/35752/hacking/severe-flaw-bittorrent-sy… *** SS7-Schwachstellen: Firewalls sollen Angriffe mildern *** --------------------------------------------- Die Probleme im Protokoll SS7 lassen sich nicht ohne weiteres absichern, denn es wurden dafür nie entsprechende Sicherheitsmaßnahmen implementiert. Mit Firewalls können Provider Schwachstellen zumindest abmildern. --------------------------------------------- http://www.golem.de/news/ss7-schwachstellen-firewalls-sollen-angriffe-milde… *** Fuzzing: Wie man Heartbleed hätte finden können *** --------------------------------------------- Vor einem Jahr machte der Heartbleed-Bug in OpenSSL Schlagzeilen - doch solche Bugs lassen sich mit Hilfe von Fuzzing-Technologien aufspüren. Wir haben das mit den Tools American Fuzzy Lop und Address Sanitizer nachvollzogen und den Heartbleed-Bug neu entdeckt. --------------------------------------------- http://www.golem.de/news/fuzzing-wie-man-heartbleed-haette-finden-koennen-1… *** Firefox-Update: Mozilla schaltet opportunistische Verschlüsselung wieder aus *** --------------------------------------------- Nicht mal eine Woche nach Firefox 37 muss Mozilla nun Firefox 37.0.1 nachlegen. Das Sicherheits-Feature "opportunistic encryption" kann missbraucht werden, um die Sicherheit von SSL/TLS-Verbindungen zu untergraben und wurde wieder entfernt. --------------------------------------------- http://heise.de/-2596576 *** Cell Phone Opsec *** --------------------------------------------- Heres an article on making secret phone calls with cell phones. His step-by-step instructions for making a clandestine phone call are as follows: Analyze your daily movements, paying special attention to anchor points (basis of operation like home or work) and dormant periods in schedules (8-12 p.m. or when cell phones arent changing locations); Leave your daily cell phone behind... --------------------------------------------- https://www.schneier.com/blog/archives/2015/04/cell_phone_opse.html *** ZDI-15-112: ManageEngine Desktop Central MSP InventorySWMeteringServlet domain File Upload Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine Desktop Central MSP. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-112/ *** ZDI-15-113: ManageEngine OpManager MultipartRequestServlet filename File Upload Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine OpManager. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-113/ *** ZDI-15-114: ManageEngine Desktop Central MSP AndroidCheckInServlet UDID Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine Desktop Central MSP. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-114/ *** ZDI-15-115: BitTorrent Sync btsync: Protocol Command Injection Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of BitTorrent Sync. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-115/ *** ZDI-15-116: IBM Lotus Domino SSL2 Client Master Key Buffer Overflow Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Lotus Domino. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-116/ *** ZDI-15-117: IBM Lotus Domino LDAP ModifyRequest add Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Domino. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-117/ *** Security Advisory: OpenSSL vulnerability CVE-2015-0287 *** --------------------------------------------- (SOL16318) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/300/sol16318.htm… *** Security Advisory: OpenSSL vulnerability CVE-2009-5146 *** --------------------------------------------- (SOL16337) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/300/sol16337.htm… *** Security Advisory: Multiple MySQL vulnerabilities *** --------------------------------------------- (SOL16355) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/300/sol16355.htm… *** SA-CONTRIB-2015-065 - Registration codes - Multiple vulnerabilities *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-065Project: Registration codes (third-party module)Version: 6.x, 7.xDate: 2015-March-04 Security risk: 16/25 ( Critical) AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site Scripting, Cross Site Request ForgeryDescriptionRegistration codes module allows new account registrations only for users who provide a valid registration code. The module was not properly sanitizing user supplied text in some pages, thereby exposing XSS --------------------------------------------- https://www.drupal.org/node/2445955 *** OpenSSH 6.8 Insecure Functions *** --------------------------------------------- Topic: OpenSSH 6.8 Insecure Functions Risk: Low Text:-=[Advanced Information Security Corp]=- Author: Nicholas Lemonias Report Date: 2/4/2015 Email: lem.nikolas (at) gmail ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015040029 *** IDM 4.0.2 ACF2 Driver Version 4.0.0.3 Patch 1 *** --------------------------------------------- Abstract: IDM 4.0.2-4.5 Bi-Directional ACF2 Driver Version 4.0.0.3. This patch is for the Identity Manager 4.0.2 to 4.5 ACF2 Driver. Field patch for IDMLOAD.XMT, SAMPLIB.XMT, RACFEXEC.XMTDocument ID: 5206570Security Alert: YesDistribution Type: Field Test FileEntitlement Required: NoFiles:idm402acf2_4003.tar.gz (2.55 MB)Products:Identity Manager 4.0.2Identity Manager 4.5Superceded Patches: None --------------------------------------------- https://download.novell.com/Download?buildid=oJ3evaNQb2M~ *** IDM 4.0.2 RACF Driver Version 4.0.0.11 Patch 3 *** --------------------------------------------- Abstract: IDM 4.0.2-4.5 Bi-Directional RACF Driver Version 4.0.0.11. This patch is for the Identity Manager 4.0.2 to 4.5 RACF Driver. Field patch for IDMLOAD.XMT, SAMPLIB.XMT, RACFEXEC.XMTDocument ID: 5206551Security Alert: YesDistribution Type: Field Test FileEntitlement Required: NoFiles:idm402racf_40011.tar.gz (2.99 MB)Products:Identity Manager 4.0.2Identity Manager 4.5Superceded Patches:IDM 4.0.2 RACF Driver Version 4.0.0.8 Patch2 --------------------------------------------- https://download.novell.com/Download?buildid=6F0mcIA5UQs~ *** IDM 4.0.2-4.5 Top Secret Driver Version 3.6.1.10 Patch 1 *** --------------------------------------------- Abstract: IDM 4.0.2-4.5 Bi-Directional Top Secret Driver Version 3.6.1.10. Field patch for IDMLOAD.XMT, SAMPLIB.XMT, TSSEXEC.XMTDocument ID: 5206590Security Alert: YesDistribution Type: Field Test FileEntitlement Required: NoFiles:idm402topsecret_36110.tar.gz (2.66 MB)Products:Identity Manager 4.0.2Identity Manager 4.5Superceded Patches: None --------------------------------------------- https://download.novell.com/Download?buildid=_WYyICODfL8~ *** Cisco Wireless LAN Controller HTML Help Cross-Site Scripting Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38222 *** HPSBMU03296 rev.1 - HP BladeSystem c-Class Onboard Administrator running OpenSSL, Remote Denial of Service (DoS) *** --------------------------------------------- Potential security vulnerabilities have been identified with HP BladeSystem c-Class Onboard Administrator. These vulnerabilities include the SSLv3 vulnerability known as "Padding Oracle on Downgraded Legacy Encryption" or "POODLE", which could be exploited remotely to allow a Denial of Service (DoS). --------------------------------------------- https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04599440 *** HPSBGN03306 rev.1 - HP IceWall SSO MCRP, SSO Dfw, and SSO Agent running OpenSSL, Remote Denial of Service (DoS) *** --------------------------------------------- Potential security vulnerabilities have been identified with HP IceWall SSO MCRP, SSO Dfw, and SSO Agent running OpenSSL. The vulnerabilities could be exploited remotely resulting in Denial of Service (DoS). --------------------------------------------- https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04626468 *** DFN-CERT-2015-0463 - Google Chrome, Chromium, Ubuntu oxide-qt: Mehrere Schwachstellen ermöglichen u. a. das Ausführen beliebigen Programmcodes *** --------------------------------------------- 07.04.2015 --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-0463/ *** Security Advisory: Persistent XSS in WP-Super-Cache *** --------------------------------------------- Security Risk: Dangerous Exploitation level: Very Easy/Remote DREAD Score: 8/10 Vulnerability: Persistent XSS Patched Version: 1.4.4 During a routine audit for our Website Firewall (WAF), we discovered a dangerous Persistent XSS vulnerability affecting the very popular WP-Super-Cache plugin (more than a million active installs according to wordpress.org). The security issue, as well as another bug-fixRead More --------------------------------------------- http://blog.sucuri.net/2015/04/security-advisory-persistent-xss-in-wp-super…

1 0

Tageszusammenfassung - Freitag 3-04-2015
by Daily end-of-shift report 03 Apr '15

03 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 02-04-2015 18:00 − Freitag 03-04-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Website Malware - The SWF iFrame Injector Evolves *** --------------------------------------------- Last year, we released a post about a malware injector found in an Adobe Flash (.SWF) file. In that post, we showed how a .SWF file is used to inject an invisible, .. --------------------------------------------- http://blog.sucuri.net/2015/04/website-malware-the-swf-iframe-injector-evol… *** Audit Concludes No Backdoors in TrueCrypt *** --------------------------------------------- Auditors performing a cryptanalysis of TrueCrypt found four vulnerabilities, but zero backdoors in the popular open source encryption software. --------------------------------------------- http://threatpost.com/audit-concludes-no-backdoors-in-truecrypt/111994 *** Multiple vulnerabilities in Cisco products *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38194 http://tools.cisco.com/security/center/viewAlert.x?alertId=38193 http://tools.cisco.com/security/center/viewAlert.x?alertId=38210 *** The Fine Line Between Ad and Adware: A Closer Look at the MDash SDK *** --------------------------------------------- Just last month, there were reports that Google removed three apps from its Play Store as they were discovered to be adware in disguise. At the time of the discovery, the apps were said to have been downloaded into millions of devices, .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/the-fine-line-be… *** VMSA-2015-0003 *** --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2015-0003.html *** All in One SEO Pack <= 2.2.5.1 - Authentication Bypass *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7881 *** Schneider Electric VAMPSET Software Buffer Overflow Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a vulnerability in the Schneider Electric VAMPSET software. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-092-01 *** SSH Fingerprints Are Important, (Fri, Apr 3rd) *** --------------------------------------------- Some years ago, I was preparing Cisco certification exams. I connected via SSH to a new Cisco router, and was presented with this familiar dialog: This made me think: before proceeding, I wanted to obtain the fingerprint out-of-band, via a trusted channel, so that I could verify it. So I took a .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19543 *** Android Security - 2014 in Review *** --------------------------------------------- https://static.googleusercontent.com/media/source.android.com/en/us/devices…

1 0

Tageszusammenfassung - Donnerstag 2-04-2015
by Daily end-of-shift report 02 Apr '15

02 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 01-04-2015 18:00 − Donnerstag 02-04-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Multiple vulnerabilities in Cisco products *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Phishing-Mails mit Anweisungen des Chefs oft erfolgreich *** --------------------------------------------- Phishing-Mails werden immer raffinierter. So gibt es etwa getarnte Mails vom Boss an seine Mitarbeiter, Geld zu überweisen, die höchst erfolgreich sind. --------------------------------------------- http://futurezone.at/digital-life/phishing-mails-mit-anweisungen-des-chefs-… *** User Import - Moderately Critical - Cross Site Request Forgery (CSRF) - SA-CONTRIB-2015-093 *** --------------------------------------------- This module enables the import of users into Drupal, or the update of existing users, with data from a CSV file (comma separated file).Some management URLs were not properly protected. A malicious user could trick an administrator .. --------------------------------------------- https://www.drupal.org/node/2463949 *** Password Policy - Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-090 *** --------------------------------------------- The Password Policy module allows enforcing restrictions on user passwords by defining password policies.The module doesnt sufficiently sanitize usernames in some administration pages, thereby exposing a Cross Site Scripting .. --------------------------------------------- https://www.drupal.org/node/2463835 *** NewPosThings Has New PoS Things *** --------------------------------------------- Arbor Networks initially posted about a new point-of-sale (PoS) malware family named NewPosThings last September, which we detect as either TSPY_POSNEWT.SM or TSPY_POSNEWT.A. We are now .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/newposthings-has… *** Google suspends CNNIC from Chromes certificate store *** --------------------------------------------- Chinese certificate authority told to re-apply.When a web client, such as a browser, attempts to make an HTTPS connection, it needs to know that no man-in-the-middle attack is taking place. The web server therefore proves its .. --------------------------------------------- http://www.virusbtn.com/blog/2015/04_02b.xml *** Frühjahrsputz bei Chrome: Fast 200 Adware-Plug-ins fliegen raus *** --------------------------------------------- Google räumt im Chrome Web Store auf und verbannt reihenweise Adware-Erweiterungen, die Millionen von Nutzern mit Werbung genervt haben. In Zukunft sollen derartige Plagegeister erst gar nicht im Web Store landen. --------------------------------------------- http://heise.de/-2595248 *** E-Mail-Sicherheit: Gedächtnislücken und Darkmail-Ideen *** --------------------------------------------- Die Internet Engineering Task Force hat sich die Vertraulichkeit der Internetprotokolle auf die Fahnen geschrieben. Was lässt sich bei E-Mails noch machen? Zum Beispiel Metadaten verbergen. Auch gibt es Versuche, sichere E-Mail handlicher zu machen. --------------------------------------------- http://heise.de/-2595167 *** Using the docker command to root the host (totally not a security issue) *** --------------------------------------------- It is possible to do a few more things more with docker besides working with containers, such as creating a root shell on the host, overwriting system configuration files, reading restricted stuff, etc. --------------------------------------------- http://reventlov.com/advisories/using-the-docker-command-to-root-the-host *** Analysis of a Romanian Botnet *** --------------------------------------------- Recently I noticed some strange entries in our web server log files. Specifically, someone was trying to exploit our servers using the ShellShock vulnerability (CVE-2014-6271) to execute a .. --------------------------------------------- http://blog.politoinc.com/2015/04/analysis-of-a-romanian-botnet/ *** Verschlüsselung: Truecrypt-Audit findet kleinere Sicherheitsprobleme *** --------------------------------------------- Die zweite Phase des Audits für die Verschlüsselungssoftware Truecrypt ist beendet. Dabei wurden die kryptographischen Funktionen untersucht. Einige Sicherheitsprobleme wurden entdeckt, sie treten aber nur in seltenen Fällen auf. --------------------------------------------- http://www.golem.de/news/verschluesselung-truecrypt-audit-findet-kleinere-s…

1 0

Tageszusammenfassung - Mittwoch 1-04-2015
by Daily end-of-shift report 01 Apr '15

01 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 31-03-2015 18:00 − Mittwoch 01-04-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Multiple vulnerabilities in Cisco products *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38113 http://tools.cisco.com/security/center/viewAlert.x?alertId=38118 http://tools.cisco.com/security/center/viewAlert.x?alertId=38114 http://tools.cisco.com/security/center/viewAlert.x?alertId=38124 *** The Resurrection of CVE-2011-2461 *** --------------------------------------------- Security researchers Luca Carettoni and Mauro Gentile recently found during their research that even though Adobe has fixed an old vulnerability found in 2011 (CVE-2011-2461), its side effects still linger around the Internet. Your favorite .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/the-resurrection… *** OWASP/WASC Distributed Web Honeypots Project Re-Launch - Seeking Participants *** --------------------------------------------- The SpiderLabs Research Team is proud to announce that we are officially re-launching the Distributed Web Honeypots Project under the new joint OWASP/WASC project home! For those SpiderLabs Blog readers who follow our .. --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/OWASP/WASC-Distributed-… *** Intro to E-Commerce and PCI Compliance - Part I *** --------------------------------------------- Have you ever heard of the term Payment Card Industry (PCI)? Specifically, PCI compliance? If you have an e-commerce website, you probably have already heard about it. But do .. --------------------------------------------- http://blog.sucuri.net/2015/03/intro-to-e-commerce-and-pci-compliance-part-… *** Inductive Automation Ignition Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for several vulnerabilities in Inductive Automation's Ignition Software. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-090-01 *** Ecava IntegraXor DLL Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for two DLL loading vulnerabilities in Ecava's IntegraXor SCADA Server. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-090-02 *** Hospira MedNet Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for four vulnerabilities in Hospira's MedNet server software. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-090-03 *** Schneider Electric InduSoft Web Studio and InTouch Machine Edition 2014 Vulnerabilities (Update A) *** --------------------------------------------- This updated advisory is a follow-up to the original advisory titled ICSA-15-085-01 Schneider Electric InduSoft Web Studio and InTouch Machine Edition 2014 Vulnerabilities, .. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-085-01A *** Rig Exploit Kit Changes Traffic Patterns, (Wed, Apr 1st) *** --------------------------------------------- Sometime within the past month, Rig exploit kit (EK) changed URL structure." /> Notice the PHPSSESID and ?req= patterns in the above example." /> Now, we dont see the PHPSSESID and ?req= patterns. Lets take a closer look at the more .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19533 *** Multiple Xen-vulnerabilities *** --------------------------------------------- http://www.securitytracker.com/id/1031994 http://www.securitytracker.com/id/1031998 http://www.securitytracker.com/id/1031997 *** Crypto-Ransomware Sightings and Trends for 1Q 2015 *** --------------------------------------------- It seems that cybercriminals have yet to tire of creating crypto-ransomware malware. Since the start of 2015, we have spotted several variants of crypto-ransomware plague the threat landscape. In January, the Australia-New Zealand region was beset by variants of TorrentLocker. But we soon .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/crypto-ransomwar… *** Firefox 37 verbessert Browser-Sicherheit *** --------------------------------------------- Es ist wieder einmal Update-Zeit bei Mozilla: Mit Firefox 37 gibt es nun also eine neue Version des Browsers, die vor allem Sicherheitsverbesserungen verspricht. --------------------------------------------- http://derstandard.at/2000013734909 *** A timeline of mobile botnets *** --------------------------------------------- With the recent explosion in smartphone usage, malware authors have increasingly focused their attention on mobile devices, leading to a steep rise in mobile malware over the past couple of years. In this paper, Ruchna Nigam focuses on mobile botnets, drawing up an inventory of types of known mobile bot variants. --------------------------------------------- https://www.virusbtn.com/virusbulletin/archive/2015/03/vb201503-mobile-botn… *** Google: Fünf Prozent aller Nutzer haben Adware auf ihren Rechnern *** --------------------------------------------- Bei mehr als einem Drittel davon sind es sogar mehr als vier Tools, die Werbung in Webseiten injizieren --------------------------------------------- http://derstandard.at/2000013745151 *** Smartes Türschloss August war zu gastfreundlich *** --------------------------------------------- Durch eine Lücke in vernetzten Türschlossern konnten sich deren Besitzer unangemeldet untereinander besuchen. --------------------------------------------- http://heise.de/-2593822 *** JOSE - JSON Object Signing and Encryption *** --------------------------------------------- Federated Identity Management has become very widespread in past years - in addition to enterprise deployments a lot of popular web services allow users to carry their identity over multiple sites. Social networking .. --------------------------------------------- https://securityblog.redhat.com/2015/04/01/jose-json-object-signing-and-enc… *** DNS/AXFR: Nameserver verraten Geheim-URLs *** --------------------------------------------- Das DNS-Protokoll hat eine Funktion, mit der man umfangreiche Informationen zu einer Domain abfragen kann. Dieser sogenannte AXFR-Transfer ist normalerweise .. --------------------------------------------- http://www.golem.de/news/dns-axfr-nameserver-verraten-geheim-urls-1504-1132…

1 0

Tageszusammenfassung - Dienstag 31-03-2015
by Daily end-of-shift report 31 Mar '15

31 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 30-03-2015 18:00 − Dienstag 31-03-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** New reconnaissance threat Trojan.Laziok targets the energy sector *** --------------------------------------------- A new information stealer, Trojan.Laziok, acts as a reconnaissance tool allowing attackers to gather information and tailor their attack methods for each compromised .. --------------------------------------------- http://www.symantec.com/connect/blogs/new-reconnaissance-threat-trojanlazio… *** WordPress Leads 1.6.1-1.6.2 - Persistent XSS *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7871 *** Drive-by code and Phishing on Swiss websites in 2014 *** --------------------------------------------- In 2014, about 1,800 Swiss websites were cleaned from drive-by code, compared with 2,700 in 2013, a decline of 33%. At the same time, the number of phishing cases affecting .ch and .li .. --------------------------------------------- http://securityblog.switch.ch/2015/03/31/drive-by-phishing-swiss-websites-2… *** Citrix Command Center Bugs Let Remote Users Download Files and Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1031993 *** VB2015 conference programme announced *** --------------------------------------------- >From drones to elephants: an exciting range of topics will be covered in Prague.In six months time, security researchers from around the world will gather in Prague for the 25th Virus Bulletin conference. Today we are excited to reveal the conference programme.As every year, the selection committees task .. --------------------------------------------- http://www.virusbtn.com/blog/2015/03_31.xml?rss *** IoT Research - Smartbands *** --------------------------------------------- One of the big trends in sphere of health and fitness are fitness trackers such as smartbands. Tracking devices and their mobile applications from three leading vendors were inspected in this report to shed some light on the current .. --------------------------------------------- http://securelist.com/analysis/publications/69412/iot-research-smartbands/ *** Chinas Man-on-the-Side Attack on GitHub *** --------------------------------------------- We have looked closer at this attack, and can conclude that China is using their active and passive network infrastructure in order to perform a man-on-the-side attack against GitHub. See our "TTL analysis" at the end of .. --------------------------------------------- http://www.netresec.com/?page=Blog&month=2015-03&post=China%27s-Man-on-the-… *** Hacking Browsers: Are Browsers the Weakest Link of the Security Chain? *** --------------------------------------------- Current scenario The number of cyber attacks is constantly increasing, and according to security experts they grow even more sophisticated. The security firm Secunia has recently released its annual study of trends in software vulnerabilities, an interesting report that highlights the .. --------------------------------------------- http://resources.infosecinstitute.com/hacking-browsers-are-browsers-the-wea… *** The sad state of SMTP encryption *** --------------------------------------------- This is a quick recap of why Im sad about SMTP encryption. It explains how TLS certificate verification in SMTP is useless even if you force it. --------------------------------------------- https://blog.filippo.io/the-sad-state-of-smtp-encryption/

1 0

Tageszusammenfassung - Montag 30-03-2015
by Daily end-of-shift report 30 Mar '15

30 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 27-03-2015 18:00 − Montag 30-03-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** iOS, OS X Library AFNetwork Patches MiTM Vulnerability *** --------------------------------------------- Until yesterday, a popular networking library for iOS and OS X, used by several apps like Pinterest and Simple was susceptible to SSL man-in-the-middle (MiTM) attacks. --------------------------------------------- http://threatpost.com/ios-os-x-library-afnetwork-patches-mitm-vulnerability… *** Cisco Unified Call Manager Arbitrary File Retrieval Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38079 *** Privilege Escalation in TYPO3 Neos *** --------------------------------------------- http://www.typo3.org/news/article/privilege-escalation-in-typo3-neos/ *** Offenbar schwerwiegendes Datenleck bei Uber *** --------------------------------------------- Offenbar kursieren im Dark Web zurzeit Zugangsdaten zu Tausenden von Nutzerkonten des Fahrdienstes Uber. Diese werden zu Spottpreisen von mehreren Anbietern laut Motherboard verhökert. Die Datensätze enthalten demnach Benutzername, Passwort und die letzten Ziffern, sowie das Verfallsdatum der .. --------------------------------------------- http://derstandard.at/2000013594365 *** British Airways: Hacker hatten Zugriff auf Bonusmeilen *** --------------------------------------------- In einem offenbar automatisierten Angriff auf Konten des British Airways Executive Club ist es Einbrechern möglicherweise gelungen, die Bonusmeilen einiger Kunden abzugreifen. --------------------------------------------- http://www.golem.de/news/british-airways-hacker-hatten-zugriff-auf-bonusmei… *** Announcing tlscompare.org *** --------------------------------------------- As part of an ongoing project on increasing TLS security we are today announcing https://tlscompare.org This webpage is about evaluating a massive extension of the ruleset for HTTPSEverywhere, a browser extension for Chrome and Firefox which .. --------------------------------------------- https://www.sba-research.org/2015/03/30/announcing-tlscompare-org/ *** Newsletter 3.7.0 - Open Redirect *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7868 *** Projekt-Hosting: Tagelanger DDoS-Angriff auf Github *** --------------------------------------------- Seit Donnerstag läuft die grösste DDoS-Attacke auf Github seit dem Entstehen des Dienstes. Experten vermuten, der Angriff gehe von chinesische Behörden aus, bestätigt wird das durch den Projekt-Hoster aber nicht. --------------------------------------------- http://www.golem.de/news/projekt-hosting-tagelanger-ddos-angriff-auf-github… *** Security Attacks via Malicious QR Codes *** --------------------------------------------- With the increasing use of smartphones, QR codes are becoming popular. Recently, WhatsApp launched its web version, which needs QR code scanning to access the web version of WhatsApp. So, many people now know what QR code is, but still more are unaware. It is very similar to a bar code we .. --------------------------------------------- http://resources.infosecinstitute.com/security-attacks-via-malicious-qr-cod… *** OpenSSL RSA Temporary Key Cryptographic Downgrade Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=36956 *** Ad Networks Ripe for Abuse Via Malvertising *** --------------------------------------------- Criminals have found a safe haven abusing legitimate processes, such as real-time bidding, implemented by online advertising networks to move exploits and malware, and build botnets and fraud campaigns. --------------------------------------------- http://threatpost.com/ad-networks-ripe-for-abuse-via-malvertising/111840 *** WordPress Plugin - Revslider update captions CSS file critical vulnerability *** --------------------------------------------- Today being another day at work for SecureLayer7 to recover our client's defaced website, and bang I think I hit upon a nasty vulnerability of a famous plugin. Although we successfully patched the vulnerability and we fixed the undoing of the blacklisting. On further research I stumbled .. --------------------------------------------- http://blog.securelayer7.net/wordpress-plugin-revslider-update-captions-css…

1 0

Tageszusammenfassung - Freitag 27-03-2015
by Daily end-of-shift report 27 Mar '15

27 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 26-03-2015 18:00 − Freitag 27-03-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Cisco Wireless LAN Controller Task Name aaaQueueReader Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38076 *** Verschlüsselung: Kryptographen zeigen neue Angriffe gegen RC4 *** --------------------------------------------- Eine bislang wenig beachtete Schwäche von RC4 nutzt der Kryptograph Itsik Mantin für seine neue Angriffsmethode. Ein weiterer kürzlich vorgestellter Angriff betrifft IMAP-Verbindungen. --------------------------------------------- http://www.golem.de/news/verschluesselung-rc4-erneut-unter-beschuss-1503-11… *** Schneider Electric InduSoft Web Studio and InTouch Machine Edition 2014 Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for vulnerabilities in the Schneider Electric InduSoft Web Studio and InTouch Machine Edition 2014. Schneider Electric has released new patches that mitigate these vulnerabilities. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-085-01 *** Beta Bot Trojan *** --------------------------------------------- In this article, I would like to show how an analysis is performed on the Beta Bot trojan to identify its characteristics. The Beta Bot trojan, classified as Troj/Neurevt-A, is a dangerous trojan. This trojan is transferred to the victim machine through a phishing email, and the user downloads the files disguised .. --------------------------------------------- http://resources.infosecinstitute.com/beta-bot-trojan/ *** Cisco NX-OS Software DHCP Options Command Injection Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38062 *** Microsoft will Windows-Lücke nicht schliessen *** --------------------------------------------- Google entdeckt Fehler, über den sich einfache Nutzer Systemrechte verschaffen können. --------------------------------------------- http://derstandard.at/2000013551658 *** The bizarre, pre-internet history of ransomware *** --------------------------------------------- Two months ago, I wrote a short article about helping my mother deal with CryptoWall 2.0., a form of computer virus more broadly known as ransomware. Basically what happens is this: You flip open your laptop to find you have been locked out of all your files. Then a ransom note hovers into view, written .. --------------------------------------------- https://medium.com/un-hackable/the-bizarre-pre-internet-history-of-ransomwa… *** Baidu's traffic hijacked to DDoS GitHub.com *** --------------------------------------------- As a Chinese living outside of China, I frequently visit Chinese websites, many of which use advertising and visitor tracking provided by Baidu, the largest search engine available in China. As I was browsing one of the most popular .. --------------------------------------------- http://insight-labs.org/?p=1682 *** Vulnerability: CVE-2015-0932 *** --------------------------------------------- ANTLabs InnGate devices are a popular Internet gateway for visitor-based networks. They're commonly installed in hotels, convention centers and other places that provide temporary guests access to a WiFi connection. If you've ever used WiFi in a hotel, you're familiar with these types of devices as they are typically tied to a specific room number for billing purposes. --------------------------------------------- http://blog.cylance.com//spear-team-cve-2015-0932

1 0

Tageszusammenfassung - Donnerstag 26-03-2015
by Daily end-of-shift report 26 Mar '15

26 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 25-03-2015 18:00 − Donnerstag 26-03-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Pin-up on your Smartphone!, (Thu, Mar 26th) *** --------------------------------------------- Yeah, okay, I admit that headline is cheap click bait. Originally, it said Certificate Pinning on Smartphones. If you are more interested in pin-ups on your smartphone, I fear youll have to look elsewhere :). Recently, an email provider that I use changed their Internet-facing services completely. I hadnt seen any announcement that this would happen, and the provider likely thought that since the change was transparent to the customer, no announcement was needed. But Im probably a tad more... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19513&rss *** Data lurking: How to protect your company against overlooked insider threats *** --------------------------------------------- Enterprises often fear hackers as their number one security threat. However, they should be more scared of what happens internally. More often than not, data breaches come from employees or system err... --------------------------------------------- http://www.net-security.org/article.php?id=2245 *** Setting issue in Windows 7 and 8.1 could allow privilege escalation *** --------------------------------------------- Experts of the Project Zero have disclosed a proof-of-concept for the exploitation of a default setting in Windows 7, 8.1 that allow privilege escalation. A new security issue threatens users of Windows 7 and 8.1, this time experts are warning about a default setting in both OSs that could allow local users to elevate privileges... --------------------------------------------- http://securityaffairs.co/wordpress/35318/hacking/win-7-and-8-1-privilege-e… *** Security Harden CentOS 7 *** --------------------------------------------- This HowTo walks you through the steps required to security harden CentOS 7, it's based on the OpenSCAP benchmark, unfortunately the current version of OpenSCAP that ships with CentOS does not offically support CentOS CPEs. But there is a "workaround" that will allow OpenSCAP + OpenSCAP workbench to run on CentOS, I'll document this in a separate post. --------------------------------------------- http://highon.coffee/blog/security-harden-centos-7/ *** Encryption Solutions for the New World *** --------------------------------------------- Keeping personal information secure and protected remains a top priority for computer users who now rely heavily on information systems to manage a large part of their personal and business lives. One of the ways to make sure only authorized users have access to information is the use of encryption, a process that transforms data... --------------------------------------------- http://resources.infosecinstitute.com/encryption-solutions-for-the-new-worl… *** Who Is the Antidetect Author? *** --------------------------------------------- Earlier this month I wrote about Antidetect, a commercial tool designed to help thieves evade fraud detection schemes employed by many e-commerce companies. That piece walked readers through a sales video produced by the author of Antidetect showing the software being used to buy products online with stolen credit cards. Today, well take a closer look at clues to a possible real-life identity of this tools creator. --------------------------------------------- http://krebsonsecurity.com/2015/03/who-is-the-antidetect-author/ *** Hacking-Kit für Steuergeräte im Auto *** --------------------------------------------- Ein Hacking-Toolkit soll dabei helfen, IT-Sicherheitslücken bei Autos aufzudecken. Ziel ist es, die Hersteller zu mehr Sorgfalt bei diesem Thema zu bewegen. --------------------------------------------- http://heise.de/-2585225 *** Verschlüsselung: RC4 erneut unter Beschuss *** --------------------------------------------- Auf der Black Hat Asia hat der Kryptograph Itsik Mantin neue Angriffsmethoden gegen die RC4-Verschlüsselung vorgestellt. Den Grundstein dazu hatte Mantin bereits vor 13 Jahren gelegt. Davon unabhängig wurde kürzlich ein weiterer Angriff gegen RC4 vorgestellt, der IMAP-Verbindungen betrifft. --------------------------------------------- http://www.golem.de/news/verschluesselung-rc4-erneut-unter-beschuss-1503-11… *** WordPress Malware Causes Psuedo-Darkleech Infection *** --------------------------------------------- Darkleech is a nasty malware infection that infects web servers at the root level. It use malicious Apache modules to add hidden iFrames to certain responses. It's difficult to detect because the malware is only active when both server and site admins are not logged in, and the iFrame is only injected once a dayRead More --------------------------------------------- http://blog.sucuri.net/2015/03/pseudo-darkleech-server-root-infection.html *** VMSA-2015-0001.2 *** --------------------------------------------- VMware vCenter Server, ESXi, Workstation, Player, and Fusion updates address security issues --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2015-0001.html *** DFN-CERT-2015-0416 - Citrix Command Center: Zwei Schwachstellen ermöglichen die Übernahme des Systems *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-0416/ *** EMC Isilon OneFS Privilege Escalation *** --------------------------------------------- Topic: EMC Isilon OneFS Privilege Escalation Risk: Medium Text:ESA-2015-049: EMC Isilon OneFS Privilege Escalation Vulnerability EMC Identifier: ESA-2015-049 CVE Identifier: CVE-2015-... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015030182 *** Security Advisories for Drupal Third-Party Modules *** --------------------------------------------- *** Linear Case - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-084 *** https://www.drupal.org/node/2459327 *** Webform Multiple File Upload - Moderately Critical - Cross Site Request Forgery (CSRF) - SA-CONTRIB-2015-083 *** https://www.drupal.org/node/2459323 *** Crumbs - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-082 *** https://www.drupal.org/node/2459315 *** Petition - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-081 *** https://www.drupal.org/node/2459311 *** Invoice - Moderately Critical - Multiple vulnerabilities - Unsupported - SA-CONTRIB-2015-085 *** https://www.drupal.org/node/2459337 *** Ubercart Webform Checkout Pane - Moderately Critical - Cross Site Scripting (XSS) - Unsupported - SA-CONTRIB-2015-087 *** https://www.drupal.org/node/2459359 *** Decisions - Moderately Critical - Cross Site Scripting (XSS) - Unsupported - SA-CONTRIB-2015-086 *** https://www.drupal.org/node/2459349 *** Decisions - Moderately Critical - Cross Site Request Forgery (CSRF) - Unsupported - SA-CONTRIB-2015-086 *** https://www.drupal.org/node/2459349

1 0

Tageszusammenfassung - Mittwoch 25-03-2015
by Daily end-of-shift report 25 Mar '15

25 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 24-03-2015 18:00 − Mittwoch 25-03-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Patched Flash Vulnerability Now Part of Exploit Kit (March 20, 2015) *** --------------------------------------------- A vulnerability in Adobes Flash Player that was patched on March 12 has already been added to an exploit kit....... --------------------------------------------- http://www.sans.org/newsletters/newsbites/r/17/23/200 *** Macro-based Malware Increases Along with Spam Volume, Now Drops BARTALEX *** --------------------------------------------- Early this year Microsoft reported an increase in macro-related threats being used to spread malware via spam. Similarly, we've been seeing a drastic increase in spammed emails with attached Microsoft Word documents and Microsoft Excel spreadsheets that come with embedded macros. Macros are a set of commands or code that are meant to help automate... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/EHquGcibJew/ *** 15,435 vulnerabilities across 3,870 applications were recorded in 2014 *** --------------------------------------------- In 2014, 15,435 vulnerabilities were discovered according to data from Secunia Research. The vulnerabilities are spread across 3,870 applications published by 500 different vendors, and these numbers ... --------------------------------------------- http://www.net-security.org/secworld.php?id=18132 *** l+f: XXSs not dead *** --------------------------------------------- Nur weil es keine Schlagzeilen mehr macht, ist es noch lange nicht aus der Welt. Das beweist etwa eine XSS-Lücke bei Amazon. --------------------------------------------- http://heise.de/-2584311 *** Multifunctional Vawtrak malware now updated via favicons *** --------------------------------------------- The Vawtrak (aka Snifula) multifunctional malware has been around since mid-2013. Its information-stealing, backdoor and spying capabilities deservedly earned it the description as the "Swiss army kni... --------------------------------------------- http://www.net-security.org/malware_news.php?id=2997 *** Not using IPv6? Are you sure? *** --------------------------------------------- Internet Protocol version 6 (IPv6) has been around for many years and was first supported in Red Hat Enterprise Linux 6 in 2010. Designed to provide, among other things, additional address space on the ever-growing Internet, IPv6 has only recently... --------------------------------------------- https://securityblog.redhat.com/2015/03/25/security-considerations-regardin… *** PHP 5.5.23 is available, (Wed, Mar 25th) *** --------------------------------------------- >From the fine folks at php.net: The PHP development team announces the immediate availability of PHP 5.5.23. Several bugs have been fixed as well as CVE-2015-0231, CVE-2015-2305 and CVE-2015-2331. All PHP 5.5 users are encouraged to upgrade to this version. (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19507&rss *** F-Secure: FSC-2015-2: PATH TRAVERSAL VULNERABILITY, (Wed, Mar 25th) *** --------------------------------------------- F-Secure has announced a security vulnerability affecting their corporate and consumer protection products. The details are available here: https://www.f-secure.com/en/web/labs_global/fsc-2015-2 --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19509&rss *** Researcher finds backdoor opened by Dells helper app *** --------------------------------------------- A security researcher has discovered a serious bug in Dell System Detect, the software Dell users are urged to use to download the appropriate drivers for their machines. The flaw can be exploited by ... --------------------------------------------- http://www.net-security.org/secworld.php?id=18134 *** Flash in 2015 *** --------------------------------------------- In the past few years, web exploits had three main targets: Internet Explorer, Java, and Flash. In 2013, the popularity of Java exploits peaked. Bug hunters became really good at finding Java bugs, and corrupting the security manager was a convenient exploitation technique. Multiple exploit campaigns used Java zero-days, and exploit kits (EK) universally adopted these exploits. In January of 2014, however, Oracle blocked the execution of unsigned applets by default, and exploit authors largely abandoned Java. The change left Internet Explorer and Adobe Flash as the next best targets. Both IE and Flash received attention from exploit developers, but in June of 2014, Microsoft began rolling out heap corruption mitigations such as an isolated heap and delayed frees for IE. Exploit developers again, needed to shift their focus. --------------------------------------------- https://www.fireeye.com/blog/threat-research/2015/03/flash_in_2015.html *** Guest talk: "Large-scale Automated Software Diversity - Programming Language Technology to Enhance System Security" *** --------------------------------------------- 26/03/2015 - 10:00 am - 11:00 am SBA Research Favoritenstraße 16 1040 Wien --------------------------------------------- https://www.sba-research.org/events/guest-talk-large-scale-automated-softwa… *** Cisco Security Advisories *** --------------------------------------------- *** Cisco IOS XR Software DHCPv4 Server Denial of Service Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=38006 *** Cisco Mobility Service Engine Password Information Disclosure Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=38007 *** Multiple Vulnerabilities in Cisco IOS Software and IOS XE Software Autonomic Networking Infrastructure *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Multiple Vulnerabilities in Cisco IOS Software Common Industrial Protocol *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco IOS Software Virtual Routing and Forwarding ICMP Queue Wedge Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco IOS Software and IOS XE Software TCP Packet Memory Leak Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Multiple Vulnerabilities in Cisco IOS XE Software for Cisco ASR 1000 Series, Cisco ISR 4400 Series, and Cisco Cloud Services 1000v Series Routers *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco IOS Software and IOS XE Software Internet Key Exchange Version 2 Denial of Service Vulnerabilities *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco IOS Software and IOS XE Software mDNS Gateway Denial of Service Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Rational Service Tester (CVE-2014-3566, CVE-2014-6457, CVE-2014-6593, CVE-2015-0410) *** http://www.ibm.com/support/docview.wss?uid=swg21699013 *** IBM Security Bulletin: NTP vulnerabilities affect IBM SmartCloud Entry (CVE-2014-9293 CVE-2014-9294 CVE-2014-9295 CVE-2014-9296) *** http://www.ibm.com/support/docview.wss?uid=isg3T1022036 *** IBM Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Tivoli Netcool System Service Monitors/Application Service Monitors (CVE-2014-3570, CVE-2014-3571, CVE-2014-3572, CVE-2014-8275, CVE-2015-0204, CVE-2015-0206) *** http://www.ibm.com/support/docview.wss?uid=swg21697205 *** IBM Security Bulletin: IBM Cloud Manager with OpenStack Nova Vulnerability (CVE-2014-3708) *** http://www.ibm.com/support/docview.wss?uid=isg3T1022097 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime Technology Edition affect Rational Functional Tester (CVE-2014-3065, CVE-2014-3566, CVE-2014-6511) *** http://www.ibm.com/support/docview.wss?uid=swg21693297 *** IBM Security Bulletin: Vulnerabilities in GSKit affect IBM Content Collector for SAP Applications (CVE-2015-0138, CVE-2014-8730) *** http://www.ibm.com/support/docview.wss?uid=swg21699263 *** IBM Security Bulletin : Multiple vulnerabilities in IBM Java Runtime affect IBM Integration Bus and WebSphere Message Broker *** http://www.ibm.com/support/docview.wss?uid=swg21697107 *** IBM Security Bulletin: Multiple vulnerabilities in the IBM Java Runtime affect Rational DOORS Web Access (CVE-2014-6593, CVE-2015-0410, CVE-2015-0138) *** http://www.ibm.com/support/docview.wss?uid=swg21697068 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Tivoli Netcool Configuration Manager (ITNCM) (CVE-2014-6549) (CVE-2015-0408) (CVE-2015-0412) (CVE-2015-0395) (CVE-2015-0403) (CVE-2015-0406) (CVE-2015-0410) *** http://www.ibm.com/support/docview.wss?uid=swg21699907 *** DFN-CERT-2015-0399 GnuTLS: Mehrere Schwachstellen ermöglichen das Umgehen von Sicherheitsvorkehrungen *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-0399/ *** GE and MACTek HART Device DTM Vulnerability (Update A) *** --------------------------------------------- This updated advisory is a follow-up to the original advisory titled ICSA-15-036-01 GE and MACTek HART Device DTM Vulnerability that was published February 5, 2015, on the NCCIC/ICS-CERT web site. This advisory provides mitigation details for an improper input vulnerability in the HART Device Type Manager (DTM) library utilized in GE and MACTek's HART Device DTM. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-036-01A *** Random Article component for Joomla! multiple SQL injection *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/101773

1 0

Tageszusammenfassung - Dienstag 24-03-2015
by Daily end-of-shift report 24 Mar '15

24 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 23-03-2015 18:00 − Dienstag 24-03-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** DMARC and Spam: Why It Matters *** --------------------------------------------- Recently I discussed how TorrentLocker spam was using email authentication for its spam runs. At the time, I suggested that these spam runs were using email authentication to gather information about victim networks and potentially improve the ability to evade spam filters. DomainKeys Identified Mail's (DKIM) own specification mentions the possibility of messages with from "trusted sources" and with a... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/W3IX-WkypVo/ *** Why enterprise IT and security teams should talk more *** --------------------------------------------- The "It wont happen to me" mentality combined with communication gaps between the IT and security teams greatly increases enterprises risk of being breached. --------------------------------------------- http://www.scmagazine.com/why-enterprise-it-and-security-teams-should-talk-… *** Xen shows off 35-piece cloudpocalypse collection *** --------------------------------------------- The latest fixing fashions for open-source hypervisors hit the catwalk The Xen Project has fixed 35 flaws, all rated critical, for versions 4.3 and 4.4 of its flagship hypervisor. The fixes appear to correspond to flaws identified after the late February 2014 cloudpocalypse, when major cloud providers feared they would once again need to reboot substantial parts of their server fleets to keep them secure. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/03/24/xen_shows_o… *** Four advantages of an identity behavior-based approach to cybersecurity *** --------------------------------------------- With an ever-increasing number of data breaches, more money is being poured into IT security budgets. According to Gartner, the average global security budget increased 8 percent from 2013 to 2014 and... --------------------------------------------- http://www.net-security.org/article.php?id=2243 *** KNX-Schwachstellen: Spielen mit den Lichtern der anderen *** --------------------------------------------- Das aktuelle KNX-Protokoll abzusichern, halten die Entwickler nicht für nötig. Denn Angreifer brauchen physischen Zugriff auf das System. Doch den bekommen sie leichter als gedacht - und können dann sogar Türöffner und Alarmanlagen steuern. --------------------------------------------- http://www.golem.de/news/knx-schwachstellen-spielen-mit-den-lichtern-der-an… *** BlackHat talk hibernated over 0-day in SAPs Afaria mobile manager *** --------------------------------------------- Researcher has form as a gent: he held back disclosure of medical records leak Alexander Polyakov has been forced to withdraw a talk detailing dangerous vulnerabilities into SAPs mobile device management product Afaria scheduled to be given at BlackHat Asia Pacific this week. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/03/24/sap_blackha… *** Google deckt erneut Missbrauch im SSL-Zertifizierungssystem auf *** --------------------------------------------- Über das Public-Key-Pinning im Webbrowser Chrome ist Google auf gefälschte Zertifikate für Google-Domains gestoßen. Diese werden von der Root-CA CNNIC beglaubigt, der viele Betriebssysteme und Browser beim Aufbau verschlüsselter Verbindungen vertrauen. --------------------------------------------- http://heise.de/-2583414 *** The importance of standards in electronic identification and trust services providers *** --------------------------------------------- ENISA publishes a new report on the importance of standards in the area of electronic identification and trust services providers. --------------------------------------------- http://www.enisa.europa.eu/media/news-items/the-importance-of-standards-in-… *** Full, cracked version of NanoCore RAT leaked, onslaught of infection attempts expected *** --------------------------------------------- NanoCore, a lesser-known remote access Trojan (RAT), has recently been spotted being delivered to employees of energy companies in Asia and the Middle East via spear-phishing emails impersonating a le... --------------------------------------------- http://www.net-security.org/malware_news.php?id=2995 *** Android Installer Hijacking Vulnerability Could Expose Android Users to Malware *** --------------------------------------------- Executive Summary We discovered a widespread vulnerability in Google's Android OS we are calling "Android Installer Hijacking", estimated to impact 49.5 percent of all current Android users. In detail: Android Installer Hijacking allows an attacker... --------------------------------------------- http://researchcenter.paloaltonetworks.com/2015/03/android-installer-hijack… *** The average DDoS attack tripled in volume *** --------------------------------------------- The average packet volume for DDoS attacks increased 340 percent to 4.36 million packets per second (Mpps), and the average bit volume swelled 245 percent to 12.1 Gbps in the final quarter of 2014, ac... --------------------------------------------- http://www.net-security.org/secworld.php?id=18125 *** Privilege Gone Wild 2: Over 25% of Organizations Have No Privileged Access Controls *** --------------------------------------------- BeyondTrust recently conducted a survey, with over 700 respondents, to explore how organizations view the risk of misuse from privileged account misuse, as well as trends in addressing and mitigating those risks. --------------------------------------------- http://blog.beyondtrust.com/privilege-gone-wild-2-over-25-of-organizations-… *** Is Your Multi-Factor Authentication Solution the Real Thing? *** --------------------------------------------- In infosec, multi-factor authentication is often considered a positive, constructive element of layered security. However, some people have an oversimplified view. With multi-factor authentication, there are many nuances to consider. At BSides Austin I presented on this topic. When shopping for a multi-factor authentication solution, what should you look for? There are over 200 multi-factor authentication vendors, how do you evaluate the best one for your needs? You can weed out more the half --------------------------------------------- https://www.alienvault.com/blogs/security-essentials/is-your-multi-factor-a… *** Why Website Reinfections Happen *** --------------------------------------------- I joined Sucuri a little over a month ago. My job is actually as a Social Media Specialist, but we have this process where regardless of your job you have to learn what website infections look like and more importantly, how to clean them. It's this idea that regardless of you are you must always... --------------------------------------------- http://blog.sucuri.net/2015/03/why-website-reinfections-happen.html *** HP Security Bulletins *** --------------------------------------------- *** HPSBST03196 rev.1- HP StoreEver MSL6480 Tape Library running OpenSSL, Remote Code Execution *** https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04599191 *** HPSBGN03299 rev.1 - HP IceWall SSO Dfw, SSO Certd, MCRP, and Federation Agent running OpenSSL, Remote Disclosure of Information, Unauthorized Access *** https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04604357 *** HPSBHF03289 rev.1- HP ThinClient PCs running ThinPro Linux, Remote Code Execution, Denial of Service, Disclosure of information *** https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04602055 *** HPSBMU03220 rev.1 - HP Shunra Network Appliance / HP Shunra Wildcat Appliance, Remote Execution of Code *** https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04518183 *** HPSBMU03297 rev.1- HP Helion Application Lifecycle Service (ALS) for Linux, Remote Code Execution *** https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04599861 *** HPSBMU03301 rev.1 - HP BladeSystem c-Class Onboard Administrator running OpenSSL, Remote Disclosure of Information *** https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04609844 *** HPSBHF03151 rev.1 - HP Integrated Lights-Out 2 and 4 (iLO 2, iLO 4), Chassis Management (iLO CM), Remote Denial of Service, Remote Execution of Code, Elevation of Privilege *** https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04486432 *** HPSBHF03275 rev.1 - HP Integrated Lights-Out 2, 3, and 4 (iLO 2, iLO 3, iLO 4), Remote Disclosure of Information *** https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04582218 *** HPSBHF03276 rev.1 - HP Integrated Lights-Out 2, 3, and 4 (iLO 2, iLO 3, iLO 4), Remote Unauthorized Access, Denial of Service (Dos) *** https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04582368 *** HPSBMU03292 rev.1 - HP Operations Orchestration Authentication Bypass *** https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04595607 *** HPSBMU03291 rev.1 - HP Operations Orchestration running Powershell Operations, Remote Disclosure of Information *** https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04595417 *** HPSBMU03263 rev.1 - HP Insight Control running OpenSSL, Remote Disclosure of Information *** https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04574073 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: IBM InfoSphere Balanced Warehouse C3000, C4000, IBM Smart Analytics System 1050, 2050 and 5710 are affected by vulnerabilities in NTP (CVE-2014-9293, CVE-2014-9294, CVE-2014-9297, CVE-2014-9298) *** http://www.ibm.com/support/docview.wss?uid=swg21699578 *** IBM Security Bulletin: Vulnerabilities in IBM Rational ClearQuest (CVE-2014-8925) *** http://www.ibm.com/support/docview.wss?uid=swg21699148 *** IBM Security Bulletin: IBM Forms Experience Builder is affected by a Dojo Toolkit vulnerability (CVE-2014-8917) *** http://www.ibm.com/support/docview.wss?uid=swg21697448 *** IBM Security Bulletin: IBM Security Identity Manager Adapters passwords exposed in log files (CVE-2014-8923) *** http://www.ibm.com/support/docview.wss?uid=swg21699902 *** IBM Security Bulletin: Multiple vulnerabilities IBM Java SDK affect IBM Rational Connector for SAP Solution Manager (CVE-2014-3566 CVE-2014-6457) *** http://www.ibm.com/support/docview.wss?uid=swg21698921 *** IBM Security Bulletin: Vulnerability in IBM Java SDK affects IBM Sterling Connect:Direct for Microsoft Windows (CVE-2014-3065) *** http://www.ibm.com/support/docview.wss?uid=swg21696456 *** IBM Security Bulletin: Multiple vulnerabilities in Java Runtime affect XIV Management Tools (CVE-2015-0410) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005143 *** IBM Security Bulletin: Multiple vulnerabilities IBM Java SDK affect IBM Rational Connector for SAP Solution Manager (CVE-2014-6593 CVE-2015-0410) *** http://www.ibm.com/support/docview.wss?uid=swg21698695 *** IBM Security Bulletin: Vulnerability in Apache Struts affects SAN Volume Controller and Storwize Family (CVE-2014-7809) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005037 *** IBM Security Bulletin: Multiple Kerberos (krb5) vulnerabilities affect PowerKVM (Multiple CVEs) *** http://www.ibm.com/support/docview.wss?uid=isg3T1022076 *** IBM Security Bulletin: Security Bulletin: IBM i is affected by the following SAMBA vulnerabilities: CVE-2015-0240 *** http://www.ibm.com/support/docview.wss?uid=nas8N1020638 *** EMC Documentum xMS information disclosure *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/101741 *** DSA-3203 tor - security update *** --------------------------------------------- Several denial-of-service issues have been discovered in Tor, aconnection-based low-latency anonymous communication system. --------------------------------------------- https://www.debian.org/security/2015/dsa-3203 *** InBoundio Marketing Plugin <= 2.0.3 - Shell Upload *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7864

1 0

Tageszusammenfassung - Montag 23-03-2015
by Daily end-of-shift report 23 Mar '15

23 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 20-03-2015 18:00 − Montag 23-03-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Apple: Those security holes we fixed last week? Youre going to need to repatch *** --------------------------------------------- Turns out those bugs werent quite squished Apple has released a follow-up to last weeks security update after finding a pair of flaws that are still vulnerable on patched systems. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/03/20/apple_remem… *** Drupal Compromise Analysis Including Indicators of Compromise *** --------------------------------------------- I would like to thank fellow SpiderLabs Researcher Chaim Sanders and Dennis Wilson, Bryant Smith and Casey Critchfield for their help with gathering data and analyzing this attack. Analysis of a real Drupal compromise In this blog post, we will... --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/Drupal-Compromise-Analy… *** Operation Woolen Goldfish, a hacking campaign in the wild *** --------------------------------------------- Security experts at Trend micro uncovered a new hacking campaign dubbed Operation Woolen Goldfish likely run by a threat actor group known as Rocket Kitten. Security experts at Trend Micro have uncovered a new cyber espionage campaign that is targeting a number of European organisations and businesses. The attackers run a spear phishing campaign that... --------------------------------------------- http://securityaffairs.co/wordpress/35128/cyber-crime/operation-woolen-gold… *** PoSeidon the most sophisticated PoS malware until now *** --------------------------------------------- Cisco Security Team has spotted in the wild a new Point-of-Sale malware dubbed PoSeidon that is more sophisticated than previously detected PoS malware. Expert at Cisco have discovered a new Point-of-Sale (PoS) malware dubbed PoSeidon. The experts have discovered many similarities with the popular Zeus Trojan and use sophisticated methods to find card data respect other POS malware like BlackPoS, which was used... --------------------------------------------- http://securityaffairs.co/wordpress/35181/cyber-crime/poseidon-pos-malware.… *** CREEPS rejoice: Small biz Cisco phones open to eavesdrop 0-day *** --------------------------------------------- Open phones may crop up on Shodan Creeps can listen in to conversations placed over vulnerable Cisco small business phones. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/03/23/creeps_rejo… *** New Dridex malware evades detection with AutoClose function *** --------------------------------------------- Security experts at Proofpoint have discovered a new phishing campaign that exploits a Dridex variant that evades detection with AutoClose function. Criminal crews behind the Dridex banking malware are very prolific and are improving the popular malicious code. Recently we have discussed about a Dridex variant which was spread through phishing messages with Microsoft Office documents embedding malicious macros. The attackers exploited social engineering technique to lure... --------------------------------------------- http://securityaffairs.co/wordpress/35197/cyber-crime/new-dridex-malware.ht… *** Adobe CVE-2011-2461 Remains Exploitable Four Years After Patch *** --------------------------------------------- A Flash vulnerability that Adobe patched four years ago actually remains exploitable according to a presentation given by a pair of researchers at the TROOPERS security conference. --------------------------------------------- http://threatpost.com/adobe-cve-2011-2461-remains-exploitable-four-years-af… *** Watch for updated router firmware!, (Mon, Mar 23rd) *** --------------------------------------------- With the OpenSSL updates this week I am sure you are all diligently testing and deploying to all your vulnerable servers. Something you may not have though of is that most SOHO routers run some kind of *nix variant and will most likely make use of OpenSSL. Be sure to watch for new firmware for those devices as well. On Friday I chatted to two of the larger manufacturers and neither had any timeline for deploying new firmware containing the OpenSSL patches and both said to watch for --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19497&rss *** BIOS-Rootkit LightEater: In den dunklen Ecken abseits des Betriebssystems *** --------------------------------------------- Ein Rootkit, das unabhängig vom Betriebssystem operiert, sämtlichen Speicher auslesen kann und durch den Tausch der Festplatte im System nicht gestoppt wird - was klingt wie eine IT-Gruselgeschichte haben zwei Forscher nun öffentlich präsentiert. --------------------------------------------- http://heise.de/-2582782 *** VU#631788: Multiple BIOS implementations permit unsafe SMM function calls to memory locations outside of SMRAM *** --------------------------------------------- Vulnerability Note VU#631788 Multiple BIOS implementations permit unsafe SMM function calls to memory locations outside of SMRAM Original Release date: 20 Mar 2015 | Last revised: 20 Mar 2015 Overview Multiple BIOS implementations permit unsafe System Management Mode (SMM) function calls to memory locations outside of SMRAM. Description Multiple BIOS implementations permit unsafe System Management Mode (SMM) function calls to memory locations outside of SMRAM. According to Corey Kallenberg --------------------------------------------- http://www.kb.cert.org/vuls/id/631788 *** Multiple Vulnerabilities in OpenSSL (March 2015) Affecting Cisco Products *** --------------------------------------------- cisco-sa-20150320-openssl --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** DSA-3199 xerces-c - security update *** --------------------------------------------- Anton Rager and Jonathan Brossard from the Salesforce.com ProductSecurity Team and Ben Laurie of Google discovered a denial of servicevulnerability in xerces-c, a validating XML parser library for C++. Theparser mishandles certain kinds of malformed input documents, resultingin a segmentation fault during a parse operation. An unauthenticatedattacker could use this flaw to cause an application using thexerces-c library to crash. --------------------------------------------- https://www.debian.org/security/2015/dsa-3199 *** DSA-3202 mono - security update *** --------------------------------------------- Researchers at INRIA and Xamarin discovered several vulnerabilities inmono, a platform for running and developing applications based on theECMA/ISO Standards. Monos TLS stack contained several problems thathampered its capabilities: those issues could lead to clientimpersonation (via SKIP-TLS), SSLv2 fallback, and encryption weakening(via FREAK). --------------------------------------------- https://www.debian.org/security/2015/dsa-3202 *** Bugtraq: FreeBSD Security Advisory FreeBSD-SA-15:06.openssl [REVISED] *** --------------------------------------------- http://www.securityfocus.com/archive/1/534943 *** Xen Project 4.4.2 *** --------------------------------------------- We are pleased to announce the release of Xen 4.4.2. This is available immediately from its git repository http://xenbits.xen.org/gitweb/?p=xen.git;a=shortlog;h=refs/heads/stable-4.4 (tag RELEASE-4.4.2) or from this download page This fixes the following critical vulnerabilities:... --------------------------------------------- http://www.xenproject.org/downloads/xen-archives/xen-44-series/xen-442.html *** Xen Project 4.3.4 *** --------------------------------------------- We are pleased to announce the release of Xen 4.3.4. This is available immediately from its git repository http://xenbits.xen.org/gitweb/?p=xen.git;a=shortlog;h=refs/heads/stable-4.3 (tag RELEASE-4.3.4) or from this page. Note that this is expected to be the last release of the 4.3 stable series. The tree will be switched to security only maintenance mode after this release. This fixes the following critical vulnerabilities:... --------------------------------------------- http://www.xenproject.org/downloads/xen-archives/xen-43-series/xen-434.html *** SA-CONTRIB-2015-066 - Tracking Code - Cross Site Request Forgery (CSRF) *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-066Project: Tracking Code (third-party module)Version: 7.xDate: 2015-March-04Security risk: 13/25 ( Moderately Critical) AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site Request ForgeryDescriptionTracking Code module allows you to create tracking code snippets and control their visibility.The module doesnt sufficiently protect some URLs against CSRF. A malicious user can cause an administrator to disable tracking codes by getting --------------------------------------------- https://www.drupal.org/node/2445961 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect Sterling Connect:Enterprise for UNIX (CVE-2014-3569, CVE-2015-0204, CVE-2014-3570, CVE-2014-3572, CVE-2014-8275) *** http://www.ibm.com/support/docview.wss?uid=swg21699211 *** IBM Security Bulletin: TLS padding vulnerability affects IBM API Management (CVE-2014-8730) *** http://www.ibm.com/support/docview.wss?uid=swg21699160 *** IBM Security Bulletin: IBM Content Collector affected by vulnerability in IBM Dojo Toolkit (CVE-2014-8917) *** http://www.ibm.com/support/docview.wss?uid=swg21694603 *** IBM Security Bulletin: Multiple security vulnerabilities in IBM Java Runtime affect IBM Rational ClearCase (CVE-2014-3566, CVE-2014-6457) *** http://www.ibm.com/support/docview.wss?uid=swg21698748 *** IBM Security Bulletin: XML External Entity Processing in Castor might affect IBM Business Process Manager (CVE-2014-3004) *** http://www.ibm.com/support/docview.wss?uid=swg21690565 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Tivoli Storage Productivity Center July 2014 CPU *** http://www.ibm.com/support/docview.wss?uid=swg21695005 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Financial Transaction Manager for ACH Services, Check Services and Corporate Payment Services (CVE-2014-6593, CVE-2015-0410) *** http://www.ibm.com/support/docview.wss?uid=swg21698702 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Rational Performance Tester (CVE-2014-3566, CVE-2014-6457, CVE-2014-6593, CVE-2015-0410) *** http://www.ibm.com/support/docview.wss?uid=swg21699032 *** IBM Security Bulletin: IBM Forms Viewer can crash based on an embedded PNG image (CVE-2014-9495, CVE-2015-0973) *** http://www.ibm.com/support/docview.wss?uid=swg21697791

1 0

Tageszusammenfassung - Freitag 20-03-2015
by Daily end-of-shift report 20 Mar '15

20 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 19-03-2015 18:00 − Freitag 20-03-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Paper: Dylib hijacking on OS X *** --------------------------------------------- Patrick Wardle shows how OS X is also vulnerable to once common Windows attacks.A few years ago, DLL hijacking on Windows was really hot, despite the fact that the concept had been discussed by none other than the NSA as far .. --------------------------------------------- http://www.virusbtn.com/blog/2015/03_19.xml?rss *** FindPOS: New POS Malware Family Discovered *** --------------------------------------------- Unit 42 has discovered a new Point of Sale (POS) malware family, which includes multiple variants created as early as November 2014. Over the past few weeks we have been analyzing this malware family, which .. --------------------------------------------- http://researchcenter.paloaltonetworks.com/2015/03/findpos-new-pos-malware-… *** Multiple vulnerabilities in Cisco products *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=37934 http://tools.cisco.com/security/center/viewAlert.x?alertId=37947 http://tools.cisco.com/security/center/viewAlert.x?alertId=37946 *** Security Update 2015-003 *** --------------------------------------------- https://support.apple.com/kb/HT204563 *** Who Develops Code for IT Support Scareware Websites? *** --------------------------------------------- When investigating a website used as part of an IT support scam, I came across a web page that attempted to fool the visitor into thinking that the persons system was infected. The goal was to persuade the potential victim to call a Microsoft Certified Live Technician at the designated phone number .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19489&rss *** CryptoWall 3.0 Ransomware Partners With FAREIT Spyware *** --------------------------------------------- Crypto-ransomware is once again upping the ante with its routines. We came across one crypto-ransomware variant that's combined with spyware - a first for crypto-ransomware. This development just comes at the heels of the discovery that .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/cryptowall-3-0-r… *** Rockwell Automation FactoryTalk DLL Hijacking Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for multiple DLL Hijacking vulnerabilities in a software component included with Rockwell Automation's FactoryTalk View Studio product. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-062-02 *** CVE-2015-0336 (Flash up to 16.0.0.305) and Exploit Kits *** --------------------------------------------- As reported by Malwarebytes and FireEye, Nuclear Pack is now taking advantage of a vulnerability patched with the last version of Flash Player ( 17.0.0.134 ) --------------------------------------------- http://malware.dontneedcoffee.com/2015/03/cve-2015-0336-flash-up-to-1600305… *** Erhebliche Sicherheitsmängel bei Geschenkkarten *** --------------------------------------------- Geschenkkarten lassen sich erschreckend einfach manipulieren, wird in der aktuellen Ausgabe des Computermagazins c’t gewarnt. Während Geldscheine mit immer mehr Sicherheitsmerkmalen gegen Fälschungen geschützt werden, sieht das bei den beliebten Geschenkkarten völlig anders aus. "Mit simplen Tricks .. --------------------------------------------- http://derstandard.at/2000013205756 *** Android Security Symposium, co-organized by SBA Research *** --------------------------------------------- https://www.sba-research.org/events/android-security-symposium-co-organized… *** Apple: Anti-Viren-Apps für iOS "irreführend" *** --------------------------------------------- Als Begründung für den plötzlichen Rauswurf von Anti-Viren-Software aus dem App Store hat Apple einem Bericht zufolge angeführt, diese Apps könnten Nutzer glauben lassen, es gäbe Viren für iOS. --------------------------------------------- http://heise.de/-2581916

1 0

Tageszusammenfassung - Donnerstag 19-03-2015
by Daily end-of-shift report 19 Mar '15

19 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 18-03-2015 18:00 − Donnerstag 19-03-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Sicherheitsforscher: Unsichtbare Apps unter iOS 8 weiterhin möglich *** --------------------------------------------- Mit einer neuen Methode ist es möglich, für den Nutzer praktisch unsichtbare iOS-Software zu installieren und diese als Spyware einzusetzen, erklärt ein Sicherheitsforscher – dies funktioniere auch auf Jailbreak-freien iPhones. --------------------------------------------- http://heise.de/-2579429 *** Experten warnen vor Risiken vernetzter medizinischer Geräte *** --------------------------------------------- "Wenn vernetztes Gerät in menschlichen Körper implantiert wurde, sind Konsequenzen eines Cyberangriffs besonders bedrohlich" --------------------------------------------- http://derstandard.at/2000013144564 *** Drupal Core - Moderately Critical - Multiple Vulnerabilities - SA-CORE-2015-001 *** --------------------------------------------- https://www.drupal.org/SA-CORE-2015-001 *** SA-CONTRIB-2015-079 - Chaos tool suite (ctools) - Multiple vulnerabilities *** --------------------------------------------- https://www.drupal.org/node/2454909 *** SA-CONTRIB-2015-078 - Webform - Cross Site Scripting (XSS) *** --------------------------------------------- https://www.drupal.org/node/2454903 *** Introduction to GSM Security *** --------------------------------------------- Introduction The Global System for Mobile Communication or GSM is a wireless communication that uses digital technology and is widely deployed across the globe for mobile communications, such as mobile phones. This technology utilizes microwaves, and its signal transmission is divided by time, .. --------------------------------------------- http://resources.infosecinstitute.com/introduction-to-gsm-security/ *** New BIOS Implant, Vulnerability Discovery Tool to Debut at CanSecWest *** --------------------------------------------- Researchers are expected to present at CanSecWest a BIOS rootkit that automates BIOS vulnerability discovery and implants persistent malware. --------------------------------------------- http://threatpost.com/new-bios-implant-vulnerability-discovery-tool-to-debu… *** Freak-Attacke: Noch immer tausende Android- und iOS-Apps gefährdet *** --------------------------------------------- Im Vergleich zu früheren OpenSSL-Lücken wie Heartbleed sind die Auswirkungen der vor einigen Wochen aufgetauchten Freak-Attacke vergleichsweise begrenzt. Dies liegt nicht zuletzt daran, dass für einen Angriff sowohl Client als auch Server verwundbar sein müssen, und mittlerweile viele Browser-Hersteller mit Updates die entsprechende Lücke abgedichtet haben. --------------------------------------------- http://derstandard.at/2000013168279 *** Cisco will an falsche Adressen liefern, um NSA zu täuschen *** --------------------------------------------- Router und andere Hardware soll an leerstehende Wohnungen versandt werden, um Empfänger zu verschleiern --------------------------------------------- http://derstandard.at/2000013170564 *** Ransomware - should you pay? *** --------------------------------------------- The big question, usually left unanswered in technical discussions of ransomware, is, "Should you pay?" We help you make up your mind. --------------------------------------------- https://nakedsecurity.sophos.com/2015/03/19/ransomware-should-you-pay/ *** Critical Vulnerability in Microsoft Translator hub writeup *** --------------------------------------------- A month back I was hunting for Vulnerabilities in Microsoft Web services, as Microsoft has large online infrastructure, finding a vulnerability which could lead to Microsoft hall of fame for security researchers wasn't difficult. While browsing around their online services, one of their services, .. --------------------------------------------- https://haiderm.com/critical-vulnerability-in-microsoft-translator-hub-writ… *** The Impacts of a Hacked Website *** --------------------------------------------- Today, with the proliferation of open-source technologies like WordPress, Joomla! and other Content Management Systems (CMS) people around the world are able to quickly establish a virtual presence with little to no cost. In the process however, a lot is being lost in terms of what it means to own a .. --------------------------------------------- http://blog.sucuri.net/2015/03/the-impacts-of-a-hacked-website.html *** Intrusion Detection (IDS) for Analysts *** --------------------------------------------- IDS device installed? Check. IDS seeing traffic? Check. IDS generating Events? Check. Analysts investigating Events? Ummm .. Investigating IDS alerts is a process like any other; however the variable nature of Information Security often makes this process difficult to adhere to. Maintaining .. --------------------------------------------- https://www.alienvault.com/blogs/security-essentials/intrusion-detection-id… *** OpenSSL Security Advisory [19 Mar 2015] *** --------------------------------------------- https://www.openssl.org/news/secadv_20150319.txt *** Google Analytics by Yoast <= 5.3.2 - Stored Cross-Site Scripting (XSS) *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7856 *** Erschlichenes Zertifikat: Microsoft antwortet vier Jahre nicht auf Warnung *** --------------------------------------------- Zum fälschlicherweise ausgestellten Zertifikat für die Microsoft-Domain live.fi sind weitere Details bekannt. Demnach hatte sich Microsoft Wochen Zeit gelassen, um zu reagieren. In einem ähnlichen Fall ließ Microsoft sogar vier Jahre verstreichen. --------------------------------------------- http://www.golem.de/news/gefaelschtes-zertifikat-microsoft-antwortet-vier-j… *** TLS-Zertifikate: Comodo stellt fälschlicherweise Microsoft-Zertifikat aus *** --------------------------------------------- Für die Domain live.fi, die Microsoft für die finnische Version seiner Live-Services nutzt, ist ein unberechtigtes Zertifikat von Comodo ausgestellt worden. Dabei wird eine Reihe von Schwächen des Zertifikatssystems deutlich. --------------------------------------------- http://www.golem.de/news/tls-zertifikate-comodo-stellt-gefaelschtes-microso… *** Aktiver Angriff auf Shop-System xt:Commerce *** --------------------------------------------- Angreifer nutzen die Sicherheitslücke in einem Versionszweig des Online-Shop-Systems xt:Commerce aktiv aus, um an sensible Kundendaten zu gelangen. Wer den Hotfix noch nicht eingespielt hat, sollte dies jetzt schleunigst tun. --------------------------------------------- http://heise.de/-2580640 *** Cisco IOS Software Autonomic Networking Infrastructure Overwrite Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=37935 *** Linux-Entwickler erschweren Rowhammer-Angriffe *** --------------------------------------------- Momentan kann ein Programm mit einfachen Nutzerrechten beim Kernel erfragen, wo im Speicher die Daten eines Prozesses liegen. Das vereinfacht den Rowhammer-Angriff. Ab Linux .. --------------------------------------------- http://heise.de/-2580654

1 0

Tageszusammenfassung - Mittwoch 18-03-2015
by Daily end-of-shift report 18 Mar '15

18 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 17-03-2015 18:00 − Mittwoch 18-03-2015 18:00 Handler: Robert Waldner Co-Handler: n/a *** Malware Hunting with the Sysinternals Tools *** --------------------------------------------- This session provides an overview of several Sysinternals tools, including Process Monitor, Process Explorer, and Autoruns, focusing on the features useful for malware analysis and removal. These utilities enable deep inspection and control of processes, file system and registry activity, and autostart execution points. Mark Russinovich demonstrates their malware-hunting capabilities by presenting several real-world cases that used the tools to identify and clean malware, and concludes by... --------------------------------------------- http://blog.malwareresearch.institute/video/2015/03/17/malware-hunting-with… *** Pass the hash!, (Wed, Mar 18th) *** --------------------------------------------- No, this isnt about sharing a hallucinogen-laced bong for a smoke. The hash were referring to here is the one that Wikipedia aptly but unhelpfully defines as a derivation of data, notably used in cryptographic hash functions. Passing the hash is a form of login credential theft that is quite prevalent. In it, an attacker captures the encoded session password (the hash) from one computer, and then re-uses it to illicitly access another computer. On (most configurations of) the Microsoft Windows... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19479&rss *** SSL Labs unveils free open source tool, new APIs *** --------------------------------------------- Qualys SSL Labs now includes free assessment APIs, accompanied by a free open source tool that can be used for bulk and automated testing of websites. These new enhancements provide the same results a... --------------------------------------------- http://www.net-security.org/secworld.php?id=18096 *** Apple-Browser: Update für drei Safari-Versionen behebt Sicherheitslücken *** --------------------------------------------- Apple hat in der Nacht zum Mittwoch Aktualisierungen für Safari unter OS X Mountain Lion, OS X Mavericks und OS X Yosemite veröffentlicht. Damit werden teils schwerwiegende Fehler ausgebügelt. --------------------------------------------- http://www.heise.de/newsticker/meldung/Apple-Browser-Update-fuer-drei-Safar… *** Fatally flawed RC4 should just die, shout angry securobods *** --------------------------------------------- Its the Swiss Cheese of infosec and were all gazing through its holes Security researchers have banged another nail into the coffin of the ageing RC4 encryption algorithm. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/03/18/kill_rc4_sa… *** Mobile Android, iOS Apps Still Vulnerable to FREAK Attacks *** --------------------------------------------- FireEye scanned iOS and Android apps downloaded billions of times in aggregate and determined that, despite the availability of patches, because the apps still connect to vulnerable HTTPS servers, they're subject to FREAK attacks. --------------------------------------------- http://threatpost.com/mobile-android-ios-apps-still-vulnerable-to-freak-att… *** Cisco Content Services Switch (11500) Unauthenticated Port Forwarding Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=37889 *** VU#868948: HP ArcSight contains multiple vulnerabilities *** --------------------------------------------- Vulnerability Note VU#868948 HP ArcSight contains multiple vulnerabilities Original Release date: 17 Mar 2015 | Last revised: 17 Mar 2015 Overview HP ArcSight contains multiple vulnerabilities. Description CWE-434: Unrestricted Upload of File with Dangerous Type - CVE PendingHP ArcSight Logger 5.3.1.6838.0 configuration import file upload capability does not sanitize file names, which allows a remote, authenticated attacker to put arbitrary files into the document root. This vulnerability... --------------------------------------------- http://www.kb.cert.org/vuls/id/868948 *** Security Advisory - Resource Management Vulnerability in the AR1220 *** --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** Security Advisory - Directory File Deletion Vulnerability in UDS *** --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** Security Advisory - Multiple Injection Vulnerabilities in UDS *** --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** [DSA 3195-1] php5 security update *** --------------------------------------------- Multiple vulnerabilities have been discovered in the PHP language: CVE-2015-2305 - Guido Vranken discovered a heap overflow in the ereg extension (only applicable to 32 bit systems). ... CVE-2015-0231 - Stefan Esser discovered a use-after-free in the unserialisation of objects. CVE-2015-0232 - Alex Eubanks discovered incorrect memory management in the exif extension. CVE-2015-0273 - Use-after-free in the unserialisation of DateTimeZone. --------------------------------------------- https://lists.debian.org/debian-security-announce/2015/msg00080.html *** XZERES 442SR Wind Turbine Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a cross-site request forgery vulnerability in XZERES's 442SR turbine generator operating system. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-076-01 *** Honeywell XL Web Controller Directory Traversal Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a directory traversal vulnerability in Honeywell's XL Web Controller. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-076-02

1 0

Tageszusammenfassung - Dienstag 17-03-2015
by Daily end-of-shift report 17 Mar '15

17 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 16-03-2015 18:00 − Dienstag 17-03-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** 3046310 - Improperly Issued Digital Certificates Could Allow Spoofing - Version: 1.0 *** --------------------------------------------- Microsoft is aware of an improperly issued SSL certificate for the domain “live.fi” that could be used in attempts to spoof content, perform phishing attacks, or perform man-in-the-middle attacks. It cannot be used to issue other certificates, impersonate other domains, or sign code. This issue affects all supported releases of Microsoft Windows. Microsoft is not currently aware of attacks related to this issue. --------------------------------------------- https://technet.microsoft.com/en-us/library/security/3046310 *** Man who obtained Windows Live cert said his warnings went unanswered *** --------------------------------------------- "I tried, just for fun," said man who reported hole to Microsoft and authorities. --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/GS2QPGGMdJ0/ *** Forthcoming OpenSSL releases *** --------------------------------------------- The OpenSSL project team would like to announce the forthcoming release of OpenSSL versions 1.0.2a, 1.0.1m, 1.0.0r and 0.9.8zf. These releases will be made available on 19th March. They will fix a number of security defects. The highest severity defect fixed by these releases is classified as "high" severity. --------------------------------------------- https://mta.openssl.org/pipermail/openssl-users/2015-March/000778.html *** From PEiD To YARA, (Tue, Mar 17th) *** --------------------------------------------- Some time ago, Jim Clausing had a diary entry about PeID (a packer identifier) and since then he has a PEiD signature database on his handler page. Now, wouldnt it be great if we could reuse these signatures? For example as YARA rules? Thats why I wrote a Python program that converts PEiD signatures to YARA rules: peid-userdb-to-yara-rules.py Here is an example: PEiD signature: [!EP (ExE Pack) V1.0 - Elite Coding Group] signature = 60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 ep_only = true Generated... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19473&rss *** Zweifaktor-Dienst Authy ließ jeden rein *** --------------------------------------------- Zwei-Faktor-Authentifizierung ist eine sichere Sache - wenn sie denn funktioniert. Authy, das von vielen prominenten Sites eingesetzt wird, ließ sich bis vor kurzem mit dem Generalschlüssel "../sms" umgehen. --------------------------------------------- http://heise.de/-2576764 *** D-Link patches critical flaws in wireless range extender, Wi-Fi cameras firmware *** --------------------------------------------- D-Link has released new firmware for its DAP-1320 wireless range extender and the DCS-93xL family of Wi-Fi cameras in order to patch two critical vulnerabilities that can lead to device hijacking. ... --------------------------------------------- www.net-security.org/secworld.php?id=18093 *** Search for vulnerable servers unearths weak, thousands-times repeated RSA keys *** --------------------------------------------- A group of researchers from the Information Security Group from Royal Holloway, University of London, wanted to see how many TLS servers still supported the weak, export-grade (512-bit) RSA public key... --------------------------------------------- http://www.net-security.org/secworld.php?id=18094 *** Cisco Virtual TelePresence Server Serial Console Privileged Access Vulnerability *** --------------------------------------------- Cisco Virtual TelePresence Server Software contains a vulnerability that could allow an authenticated, local attacker to gain unauthorized access with elevated privileges. Updates are available. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=37869 *** DSA-3192 checkpw - security update *** --------------------------------------------- Hiroya Ito of GMO Pepabo, Inc. reported that checkpw, a passwordauthentication program, has a flaw in processing account names whichcontain double dashes. A remote attacker can use this flaw to cause adenial of service (infinite loop). --------------------------------------------- https://www.debian.org/security/2015/dsa-3192 *** Intel Network Adapter Diagnostic Driver IOCTL Handling Vulnerability *** --------------------------------------------- Topic: Intel Network Adapter Diagnostic Driver IOCTL Handling Vulnerability Risk: High Text:/* Intel Network Adapter Diagnostic Driver IOCTL Handling Vulnerability Vendor: Intel Product webpage: http://www.intel.co... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015030110 *** TYPO3 CMS 6.2.11 released *** --------------------------------------------- The TYPO3 Community announces the version 6.2.11 LTS of the TYPO3 Enterprise Content Management System. --------------------------------------------- http://www.typo3.org/news/article/typo3-cms-6211-released/ *** HPSBHF03293 rev.1 - HP Virtual Connect 8Gb 24-Port FC Module running OpenSSL and Bash, Remote Denial of Service (DoS), Code Execution, Disclosure of Information *** --------------------------------------------- Potential security vulnerabilities have been identified with HP Virtual Connect 8Gb 24-Port FC Module running OpenSSL and Bash including: The OpenSSL vulnerability known as "Heartbleed" which could be exploited remotely resulting in Denial of Service (DoS) or disclosure of information. The SSLv3 vulnerability known as "Padding Oracle on Downgraded Legacy Encryption" also known as "Poodle", which could be exploited remotely resulting in disclosure of information. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_…

1 0

Tageszusammenfassung - Montag 16-03-2015
by Daily end-of-shift report 16 Mar '15

16 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 13-03-2015 18:00 − Montag 16-03-2015 18:00 Handler: Robert Waldner Co-Handler: n/a *** ICS-CERT Monitor Quarterly Report - Phishing Reigns Supreme (March 12, 2015) *** --------------------------------------------- According to a quarterly report from the US Industrial Control System Computer Emergency Response Team (ICS-CERT), industrial control systems were targets of cyber attacks at least 245 times in the 12-month period between October 1, 2013 and September 30, 2014....... --------------------------------------------- http://www.sans.org/newsletters/newsbites/r/17/20/200 *** Security Advisory - NTPd Security Vulnerability in Multiple Huawei Products *** --------------------------------------------- Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote attackers to execute arbitrary code via a crafted packet. Multiple Huawei products have this vulnerability. ( Vulnerability ID: HWPSIRT-2014-1276) --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** TeslaCrypt ransomware attacks gamers - "all your files are belong to us!" *** --------------------------------------------- TeslaCrypt is a new ransomware that goes above and beyond CryptoLocker in the types of files it seeks out to hold for ransom, including those related to video games. SophosLabs dug in to find out what TeslaCrypt has in store for gamers, and everyone else. --------------------------------------------- https://nakedsecurity.sophos.com/2015/03/16/teslacrypt-ransomware-attacks-g… *** Safari: Alte Sicherheitslücke speichert URLs auch im Private-Browsing-Modus *** --------------------------------------------- Normalerweise sollte ein Browser alle angesurften Adressen vergessen, wenn er im 'Privatmodus' genutzt wird. Apples Safari tut das allerdings nicht - die besuchten Adressen landen in einer ungeschützten Datenbank. --------------------------------------------- http://heise.de/-2575426 *** Attacks Only Get Better: Password Recovery Attacks Against RC4 in TLS *** --------------------------------------------- We provide new attacks against RC4 in TLS that are focussed on recovering user passwords, still the pre-eminent means of user authentication on the Web today. Our attacks enhance the statistical techniques used in the previous attacks and exploit specific features of the password setting to produce attacks that are much closer to being practical. We report on extensive simulations that illustrate this. --------------------------------------------- http://www.isg.rhul.ac.uk/tls/RC4mustdie.html *** Talk at Troopers15 *** --------------------------------------------- Peter Kieseberg and Sebastian Schrittwieser give a talk about 'iAnalyze - Automated security analysis of iOS apps' at the 'Hacking Mobiles Vol. 2.1 - MMA: Mobile Malicious Apps' workshop, which is held at Troopers15 conference in Heidelberg, Germany. --------------------------------------------- https://www.sba-research.org/2015/03/16/talk-at-troopers15/ *** Cisco Security Advisories *** * Cisco AnyConnect Secure Mobility Client Arbitrary File Write Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=37863 * Cisco AnyConnect Secure Mobility Client Hostscan Path Traversal Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=37862 * Cisco AnyConnect Secure Mobility Client Arbitrary Code Execution Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=37861 * Cisco AnyConnect Secure Mobility Client Arbitrary Code Execution Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=37860

1 0

Tageszusammenfassung - Freitag 13-03-2015
by Daily end-of-shift report 13 Mar '15

13 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 12-03-2015 18:00 − Freitag 13-03-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Security updates available for Adobe Flash Player (APSB15-05) *** --------------------------------------------- A Security Bulletin (APSB15-05) has been published regarding security updates for Adobe Flash Player. These updates address critical vulnerabilities, and Adobe recommends users update their product installations to the latest versions using the instructions referenced in the security bulletin. This... --------------------------------------------- https://blogs.adobe.com/psirt/?p=1185 *** After Delays, Samsung Patches Social Media Vulnerability in Millions of Devices *** --------------------------------------------- Samsung patched a vulnerability last month in SNS Provider that if exploited could have given attackers the ability to access to any personal information users stored on Facebook, LinkedIn and Twitter. --------------------------------------------- http://threatpost.com/after-delays-samsung-patches-social-media-vulnerabili… *** Blind SQL Injection against WordPress SEO by Yoast, (Fri, Mar 13th) *** --------------------------------------------- WordPress has released an advisory for the WordPress plugin SEO by Yoast. Version up to and including 1.7.3.3 can be exploited with a blind SQL injection. According to WordPress, this plugin has more than one million downloads. A description of the SQL injection with proof of concept is described here and the latest update is available here. [1] https://wordpress.org/plugins/wordpress-seo/ [2] https://downloads.wordpress.org/plugin/wordpress-seo.1.7.4.zip [3] --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19457&rss *** Achievement Locked: New Crypto-Ransomware Pwns Video Gamers *** --------------------------------------------- Gamers may be used to paying to unlock downloadable content in their favorite games, but a new crypto-ransomware variant aims to make gamers pay to unlock what they already own. Data files for more than 20 games can be affected by the threat, increasing what is already a large target for cybercriminals. Another file type... --------------------------------------------- http://labs.bromium.com/2015/03/12/achievement-locked-new-crypto-ransomware… *** VIRLOCK Combines File Infection and Ransomware *** --------------------------------------------- Analysis by Jaaziel Carlos, Jonh Chua, and Rodwin Fuentes Ransomware has become one of the biggest problems for end users are as of late. In the past months alone, we have reported on several variants of both ransomware and crypto-ransomware, each with their own "unique" routines. We recently came across one malware family, detected as... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/eJWas-XoY6I/ *** Microsoft EMET 5.2 is available, (Fri, Mar 13th) *** --------------------------------------------- Microsoft has announced a new release of the Enhanced Mitigation Experience Toolkit (EMET) 5.2. The main the main changes and improvements as the following: Control Flow Guard:EMETs native DLLs have been compiled with Control Flow Guard(CFG). CFG is a new feature introduced in Visual Studio 2015 (and supported by Windows 8.1 and Windows 10) that helps detect and stop attempts of code hijacking. EMET native DLLs (i.e. EMET.DLL) are injected into the application process EMET protects. Since we --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19461&rss *** Adobe schließt kritische Lücken in Flash *** --------------------------------------------- Ein neues Update für den Flash-Player schließt elf Sicherheitslücken und ist für alle Plattformen verfügbar. Eine zügige Installation ist ratsam, da Angreifer im schlimmsten Fall das System übernehmen könnten. --------------------------------------------- http://heise.de/-2574278 *** Bootschleife nach SHA-2-Update für Windows 7 *** --------------------------------------------- Böse Überraschung für einige Nutzer mit Linux-Dual-Boot: Ein Windows-7-Update vom letzten Patchday stürzt den Rechner in eine Bootschleife. Das scheint allerdings nur beim Booten über das klassische BIOS aufzutreten, UEFI-Nutzer haben Glück. --------------------------------------------- http://heise.de/-2574289 *** BlackBerry has no fix for devices vulnerable to FREAK security flaw *** --------------------------------------------- Summary:The company, lauded for having the worlds most protected devices for encrypted messaging, warns that devices will be vulnerable to a serious security flaw until a patch is released. --------------------------------------------- http://www.zdnet.com/article/blackberry-slow-to-respond-to-freak-flaw-says-… *** Mozilla Releases Open Source Masche Forensics Tool *** --------------------------------------------- Mozilla has released an open source memory forensics tool that some college students designed and built during the company's recent Winter of Security event. The new tool, known as Masche, is designed specifically for investigating server memory and has the advantage of being able to scan running processes without causing any problems with the machine. --------------------------------------------- http://threatpost.com/mozilla-releases-open-source-masche-forensics-tool/11… *** Google-Panne: Inhaberdaten von 300.000 geschützten Domains einsehbar *** --------------------------------------------- Google bietet seinen Kunden die Möglichkeit, Domains zu registrieren, ohne dass dabei persönliche Daten in den Whois-Einträgen auftauchen. Durch einen Bug waren die Informationen trotzdem abrufbar. --------------------------------------------- http://heise.de/-2574423 *** Bypassing ASLR with CVE-2015-0071: An Out-of-Bounds Read Vulnerability *** --------------------------------------------- Almost every Patch Tuesday cycle contains one bulletin that (for convenience) rolls up multiple Internet Explorer vulnerabilities into a single bulletin. February's Patch Tuesday cumulative IE bulletin (MS15-009) included a fix for a particularly interesting vulnerability that could be used to bypass one of the key anti-exploit technologies in use today, address space layout randomization... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/35xufNRKED8/ *** Security Afterworks: Cybercrime - Lessons From the Field & Best Of Troopers15 *** --------------------------------------------- Cybercrime – wie reagieren nach einem Vorfall? Die Frage ist schon längst nicht mehr ob, sondern wann Sie zum Ziel werden. Andreas Tomek informiert beim Security Afterworks im April über Lessons from the field – Incident Response & Cybercrime in Österreich. Danach geht es mit den Hot Topics der Troopers15 weiter. Lassen Sie sich von uns auf den neuesten Stand bringen! Dienstag, 14. April 2015 16.30 Uhr ab 17.30 Uhr gemütlicher Ausklang SBA Research --------------------------------------------- https://www.sba-research.org/events/security-afterworks-cybercrime-lessons-… https://www.sba-research.org/wp-content/uploads/2015/03/Security-Afterworks… *** Cisco FREAKs out, starts epic OpenSSL bug-splat *** --------------------------------------------- Happy weekend, network admins Cisco admins will be watching and waiting for fixes, with the company announcing that many of its OpenSSL implementations are carrying a bunch of post-POODLE fleas. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/03/13/cisco_freak… *** Samsung SNS Provider Application For Android Access Theft *** --------------------------------------------- Topic: Samsung SNS Provider Application For Android Access Theft Risk: Low Text: Fundacion Dr. Manuel Sadosky - Programa STIC Advisory www.fundacionsadosky.org.ar *Vulnerabilities in the Samsung SNS ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015030093 *** HP Security Bulletins *** --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** DSA-3186 nss - security update *** --------------------------------------------- It was discovered that the Mozilla Network Security Service library(nss) incorrectly handled certain ASN.1 lengths. A remote attacker couldpossibly use this issue to perform a data-smuggling attack. --------------------------------------------- https://www.debian.org/security/2015/dsa-3186 *** DSA-3185 libgcrypt11 - security update *** --------------------------------------------- Multiple vulnerabilities were discovered in libgcrypt: --------------------------------------------- https://www.debian.org/security/2015/dsa-3185 *** DSA-3184 gnupg - security update *** --------------------------------------------- Multiple vulnerabilities were discovered in GnuPG, the GNU Privacy Guard: --------------------------------------------- https://www.debian.org/security/2015/dsa-3184 *** WPML Multiple Vulnerabilities (Including SQLi) *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7843 *** Schneider Electric Pelco DS-NVs Buffer Overflow Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a buffer overflow vulnerability in the Schneider Electric Pelco DS-NVs software package. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-071-01 *** Xen Multiple Flaws Let Local Guest Users Deny Service or Obtain Information From Other Guest Systems *** --------------------------------------------- http://www.securitytracker.com/id/1031806

1 0

Tageszusammenfassung - Donnerstag 12-03-2015
by Daily end-of-shift report 12 Mar '15

12 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 11-03-2015 18:00 − Donnerstag 12-03-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Cyber Security in Supply Chain Management: Part 1 *** --------------------------------------------- Introduction Cyber security is generally thought of as various types of security devices like firewalls, Web Application Firewall (WAF), IDS/IPS, SIEM, DLP etc. to safeguard network, applications and data. But what if, for example, the deployed security solutions have a bug inside? The latest example of this is exposing of a vulnerability in Lenovo notebooks. --------------------------------------------- http://resources.infosecinstitute.com/cyber-security-in-supply-chain-manage… *** Paper: Windows 10 patching process may leave enterprises vulnerable to zero-day attacks *** --------------------------------------------- Aryeh Goretsky gives advice on how to adapt to Windows 10s patching strategy.Patching is hard, especially when the code base is old and the bugs are buried deeply. This was highlighted once again this week when Microsoft released a patch for a vulnerability that was thought to have been patched almost five years ago, but which could still be exploited.In fact, six out of the last eight Patch Tuesdays have included patches that have caused problems for some Windows users.Probably in response to... --------------------------------------------- http://www.virusbtn.com/blog/2015/03_12.xml?rss *** Microsoft SHA-2 Advisory Causing "Infinite Loop" Issues *** --------------------------------------------- Windows users are having issues with a security update issued this week meant to add SHA-2 code-signing and verification support to Windows 7 and Windows Server 2008 R2 machines. --------------------------------------------- http://threatpost.com/microsoft-sha-2-advisory-causing-infinite-loop-issues… *** Schwerwiegende Sicherheitslücke im Shop-System xt:Commerce *** --------------------------------------------- Derzeit klafft eine Sicherheitslücke im aktuellen Versionszweig des verbreiteten Online-Shop-Systems xt:Commerce. Ein Patch ist bereits verfügbar. --------------------------------------------- http://heise.de/-2573755 *** Who got the bad SSL Certificate? Using tshark to analyze the SSL handshake., (Thu, Mar 12th) *** --------------------------------------------- Ever wonder if any of your users connect to sites with bad SSL certificates? I ran into this issue recently when debugging some SSL issues, and ended up with thisquick tshark and shell script trickto extract the necessary information from a packet capture. First, you may want to compare the host name your clients connect to, to the host name returned as part of the certificate. While the Host header is encrypted and not accessible, modern SSL libraries use Server Name Indication (SNI) as part... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19455&rss *** Defending Against PoS RAM Scrapers *** --------------------------------------------- Stealing payment card data has become an everyday crime that yields quick monetary gains. Attackers aim to steal the data stored in the magnetic stripe of payment cards, optionally clone the cards, and run charges on the accounts associated with them. The topic of PoS RAM scraper malware always prompts businesses and retailers to ask... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/CYPwDbRGFfc/ *** Dropbox Patches Remotely Exploitable Vulnerability in SDK *** --------------------------------------------- Developers at Dropbox recently fixed a remotely exploitable vulnerability in the Android SDK version of the app that enabled attackers to connect applications on some devices to a Dropbox account without the users consent. --------------------------------------------- http://threatpost.com/dropbox-patches-remotely-exploitable-vulnerability-in… *** Inverted WordPress Trojan *** --------------------------------------------- Trojan (or trojan horse) is software that does (or pretends to be doing) something useful but also contains a secret malicious payload that inconspicuously does something bad. In WordPress, typical trojans are plugins and themes (usually pirated) which may have backdoors, or send out spam, create doorways, inject hidden links or malware. The trojan modelRead More --------------------------------------------- http://blog.sucuri.net/2015/03/inverted-wordpress-trojan.html *** RSA Digital Certificate Manager Input Validation Flaws Permit Cross-Site Scripting and Denial of Service Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1031912 *** EMC Secure Remote Services GHOST / SQL Injection / Command Injection *** --------------------------------------------- Topic: EMC Secure Remote Services GHOST / SQL Injection / Command Injection Risk: High Text:ESA-2015-040: EMC Secure Remote Services Virtual Edition Security Update for Multiple Vulnerabilities CVE Identifier: CVE-2... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015030076 *** Google Android Integer Oveflow / Heap Corruption *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2015030079 *** phpMyAdmin Bug May Disclose CSRF Token to Remote Users *** --------------------------------------------- http://www.securitytracker.com/id/1031871 *** Elipse E3 Process Control Vulnerability (Update A) *** --------------------------------------------- This updated advisory is a follow-up to the original advisory titled ICSA-15-069-04 Elipse E3 Process Control Vulnerability that was published March 10, 2015, on the NCCIC/ICS-CERT web site. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-069-04A *** IBM Security Bulletin: Apache Tomcat request smuggling affects Algo Audit and Compliance (CVE-2014-0227) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21698437 *** IBM Security Bulletin: IBM PowerVC - Ceilometer DB2/MongoDB Backend Password Leak (CVE-2013-6384) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=nas8N1020585 *** IBM Security Bulletin: GNU C library (glibc) vulnerability affects IBM/Cisco Switches and Directors (CVE-2015-0235) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ssg1S1005122 *** IBM Security Bulletin: Multiple IBM InfoSphere Information Server components are affected by a vulnerability in the XML4C parser (CVE-2014-8901) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21696312 *** SA-CONTRIB-2015-077 - OG tabs - Cross Site Scripting (XSS) *** --------------------------------------------- https://www.drupal.org/node/2450427 *** SA-CONTRIB-2015-076 - Image Title - Cross Site Scripting (XSS) *** --------------------------------------------- https://www.drupal.org/node/2450393 *** SA-CONTRIB-2015-075 - Perfecto - Open Redirect *** --------------------------------------------- https://www.drupal.org/node/2450391 *** SA-CONTRIB-2015-074 - Site Documentation - Cross Site Scripting (XSS) *** --------------------------------------------- https://www.drupal.org/node/2450387 *** Pie Register 2.0.14 - Cross Site Scripting (XSS) *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7842

1 0

Tageszusammenfassung - Mittwoch 11-03-2015
by Daily end-of-shift report 11 Mar '15

11 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 10-03-2015 18:00 − Mittwoch 11-03-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Inside the EquationDrug Espionage Platform *** --------------------------------------------- EquationDrug represents the main espionage platform from the Equation Group. It's been in use for over 10 years, replacing EquationLaser until it was itself replaced itself by the even more sophisticated GrayFish platform. --------------------------------------------- http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage… *** DroppedIn: Remotely Exploitable Vulnerability in the Dropbox SDK for Android *** --------------------------------------------- The IBM X-Force Application Security Research Team has discovered a vulnerability in the Dropbox SDK for Android (CVE-2014-8889) which allows attackers to connect applications on mobile devices to a Dropbox account controlled by the attacker without the victim's knowledge or authorization. This is a serious flaw in the authentication mechanism within any Android app using a Dropbox SDK Version 1.5.4 through 1.6.1 (note: this vulnerability was resolved in Dropbox SDK for Android v1.6.2). --------------------------------------------- http://securityintelligence.com/droppedin-remotely-exploitable-vulnerabilit… *** Unpatched security vulnerabilities affecting Facebook *** --------------------------------------------- A web security researcher from Portugal has discovered several vulnerabilities affecting Facebook that he considers to be serious, but hasnt had much success convincing the company of that, so he sha... --------------------------------------------- http://www.net-security.org/secworld.php?id=18069 *** Reconnect tool for hacking Facebook is publicly available *** --------------------------------------------- The security expert Egor Homakov from Sakurity firm has released the Reconnect tool that allows hackers to hijack accounts on sites that use Facebook logins. The security expert Security Egor Homakov has developed a hacking tool dubbed Reconnect that exploit a flaw in Facebook to hijack accounts on sites that use Facebook logins. Homakov, with works for... --------------------------------------------- http://securityaffairs.co/wordpress/34705/hacking/reconnect-hacking-faceboo… *** DDoS on UPNP Devices *** --------------------------------------------- Denial of service (DOS) attack is an attempt to make a machine or a network resource unavailable to its users. It basically consists of methods to temporarily or indefinitely interrupt or suspend services of a host connected to the Internet, and these attacks are sent by one person or a system. One common method of... --------------------------------------------- http://resources.infosecinstitute.com/ddos-upnp-devices/ *** Full details on CVE-2015-0096 and the failed MS10-046 Stuxnet fix *** --------------------------------------------- In early January 2015, researcher Michael Heerklotz approached the Zero Day Initiative with details of a vulnerability in the Microsoft Windows operating system. We track this issue as ZDI-15-086. Unless otherwise noted, the technical details in this blog post are based on his detailed research. --------------------------------------------- http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Full-details-on-CVE-… *** Threatglass has pcap files with exploit kit activity, (Tue, Mar 10th) *** --------------------------------------------- Threatglassis a one way to find up-to-date examples of exploit kit traffic. Not all of it is exploit kit traffic, but all of it represents some sort of malicious activity. Threatglassdoesnt explain what type of traffic youre looking at from the pcaps the site provides. Letslook at a page from last week on Thursday, March 5th 2015 [1]. This one isexploit kit activity. In the image below, youll find a link to the packet capture in the lower right-hand corner" /> Download the pcap and open... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19433&rss *** n00bs CTF Labs by Infosec Institute *** --------------------------------------------- n00bs CTF (Capture the Flag) Labs is a web application presented by Infosec Institute. It has 15 mini Capture the Flag challenges intended for beginners and newbies in the information security field or for any average infosec enthusiasts who haven't attended hacker conventions yet. So what is a CTF? In hacker conventions, CTF or Capture... --------------------------------------------- http://resources.infosecinstitute.com/n00bs-ctf-labs-infosec-institute/ *** Achtung: Panda-Virenscanner zerschießt Windows, nicht Neustarten! *** --------------------------------------------- Die Antivirenschutz-Produkte von Panda Security haben wegen fehlerhaften Signaturen etliche Windows-Rechner lahm gelegt. Wer betroffen ist, soll die Füße still halten und das System nicht neu starten - da es unter Umständen nicht mehr hochfährt. --------------------------------------------- http://heise.de/-2573233 *** Panda Antivirus: Gravierender Fehler im Virenscanner löscht Systemdateien *** --------------------------------------------- Ein gravierender Fehler in Pandas Antivirensoftware kann unter Umständen zu einem vollkommen unbrauchbaren System führen. Panda bestätigt das Problem. Golem.de hat erste Hinweise erhalten, wie der Fehler zu stoppen ist. (Virenscanner, Applikationen) --------------------------------------------- http://www.golem.de/news/panda-antivirus-gravierender-fehler-im-virenscanne… *** Doctor Web: February 2015 virus activity review *** --------------------------------------------- March 4, 2015 The shortest month of the year had its share of new malware. In early February, Doctor Web security researchers finished examining a complex multi-purpose malicious program for Linux, while at month's end, they published the results of their analysis of a new version of a backdoor for Mac OS X. As before, malicious programs for Android remained active throughout the month. PRINCIPAL TRENDS IN JANUARY New Linux Trojans Virus makers are still showing an interest in Mac OS X. --------------------------------------------- http://news.drweb.com/show/?i=9316&lng=en&c=9 *** Ein Blick in die Zukunft der Handy-Malware *** --------------------------------------------- Kaspersky hat eine Analyse zu einer Android-Malware veröffentlicht, die zwar aktuell nur in Russland aktiv ist, aber einen Vorgeschmack gibt, was demnächst auch bei uns passieren könnte: Wichtige Punkte daraus: Das Teil ist inzwischen so modular und gut geschützt, wie typische Windows Malware Frameworks Es enthält Code zum Anmelden des Opfers bei diversen Premium-Services Dabei kann es automatisch... --------------------------------------------- http://www.cert.at/services/blog/20150311102554-1454.html *** DSA-3177 mod-gnutls - security update *** --------------------------------------------- Thomas Klute discovered that in mod-gnutls, an Apache module providingSSL and TLS encryption with GnuTLS, a bug caused the servers clientverify mode not to be considered at all, in case the directorysconfiguration was unset. Clients with invalid certificates were thenable to leverage this flaw in order to get access to that directory. --------------------------------------------- https://www.debian.org/security/2015/dsa-3177 *** DSA-3182 libssh2 - security update *** --------------------------------------------- Mariusz Ziulek reported that libssh2, a SSH2 client-side library, wasreading and using the SSH_MSG_KEXINIT packet without doing sufficientrange checks when negotiating a new SSH session with a remote server. Amalicious attacker could man in the middle a real server and cause aclient using the libssh2 library to crash (denial of service) orotherwise read and use unintended memory areas in this process. --------------------------------------------- https://www.debian.org/security/2015/dsa-3182 *** Manage Engine AD Audit Manager Plus Cross Site Scripting *** --------------------------------------------- Topic: Manage Engine AD Audit Manager Plus Cross Site Scripting Risk: Low Text: # Title:- Reflected cross-site scripting(XSS) Vulnerability in Manage Engine AD Audit Manager Plus Admin Panel(Bui... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015030060 *** tcpdump Denial Of Service / Code Execution *** --------------------------------------------- Topic: tcpdump Denial Of Service / Code Execution Risk: High Text:Hi, please find tcpdump 4.7.2 source code at: http://www.ca.tcpdump.org/beta/tcpdump-4.7.2.tar.gz http://www.ca.tcpdu... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015030064 *** Cisco Intrusion Prevention System MainApp Secure Socket Layer Denial of Service Vulnerability *** --------------------------------------------- cisco-sa-20150311-ips --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Multiple Vulnerabilities in Cisco TelePresence Video Communication Server, Cisco Expressway, and Cisco TelePresence Conductor *** --------------------------------------------- cisco-sa-20150311-vcs --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** IBM Security Bulletin: Multiple vulnerabilities fixed in Current Release of Liberty for Java for IBM Bluemix (CVE-2012-6153, CVE-2014-3577, CVE-2015-0178) *** --------------------------------------------- 2015-03-11T10:06:12-04:00 --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21696864 *** Citrix XenServer Multiple Security Updates *** --------------------------------------------- A number of security vulnerabilities have been identified in Citrix XenServer. These vulnerabilities could, if exploited, allow ... --------------------------------------------- http://support.citrix.com/article/CTX200484 *** HPSBNS03280 rev.1 - HP NonStop Servers running SAMBA, Remote Execution of Arbitrary Code *** --------------------------------------------- A potential security vulnerability has been identified with HP NonStop Servers running SAMBA. The vulnerability could be exploited remotely resulting in execution of arbitrary code. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** HPSBUX03281 SSRT101968 rev.1 - HP-UX running Java7, Remote Unauthorized Access, Disclosure of Information and Other Vulnerabilities *** --------------------------------------------- Potential security vulnerabilities have been identified in the Java Runtime Environment (JRE) and the Java Developer Kit (JDK) running on HP-UX. These vulnerabilities could allow remote unauthorized access, disclosure of information, and other vulnerabilities. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** USN-2524-1: eCryptfs vulnerability *** --------------------------------------------- Ubuntu Security Notice USN-2524-110th March, 2015ecryptfs-utils vulnerabilityA security issue affects these releases of Ubuntu and its derivatives: Ubuntu 14.10 Ubuntu 14.04 LTS Ubuntu 12.04 LTS Ubuntu 10.04 LTSSummarySensitive information in encrypted home and Private directories could beexposed if an attacker gained access to your files.Software description ecryptfs-utils - eCryptfs cryptographic filesystem utilities DetailsSylvain Pelissier discovered that eCryptfs did not generate a random --------------------------------------------- http://www.ubuntu.com/usn/usn-2524-1/ *** USN-2522-3: ICU vulnerabilities *** --------------------------------------------- Ubuntu Security Notice USN-2522-310th March, 2015icu vulnerabilitiesA security issue affects these releases of Ubuntu and its derivatives: Ubuntu 12.04 LTSSummaryICU could be made to crash or run programs as your login if it processedspecially crafted data. Software description icu - International Components for Unicode library DetailsUSN-2522-1 fixed vulnerabilities in ICU. On Ubuntu 12.04 LTS, the fontpatches caused a regression when using LibreOffice Calc. The patches havenow been updated --------------------------------------------- http://www.ubuntu.com/usn/usn-2522-3/ *** VU#794095: Telerik Analytics Monitor Library allows DLL hijacking *** --------------------------------------------- Vulnerability Note VU#794095 Telerik Analytics Monitor Library allows DLL hijacking Original Release date: 10 Mar 2015 | Last revised: 10 Mar 2015 Overview Telerik Analytics Monitor Library is a third-party application analytics service that collects detailed application metrics for vendors. Some versions of the Telerik library allow DLL hijacking, allowing an attacker to load malicious code in the context of the Telerik-based application. Description CWE-114: Process ControlTelerik --------------------------------------------- http://www.kb.cert.org/vuls/id/794095 *** WordPress SEO by Yoast <= 1.7.3.3 - Blind SQL Injection *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7841

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily