- Daily - CERT.at

Tageszusammenfassung - Montag 24-03-2014
by Daily end-of-shift report 24 Mar '14

24 Mar '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 21-03-2014 18:00 − Montag 24-03-2014 18:00 Handler: Robert Waldner Co-Handler: n/a *** NSA Targets Sys Admins to Infiltrate Networks *** --------------------------------------------- The latest Snowden documents show how the National Security Agency targets system administrators, in particular their personal email and social media accounts, in order to access target networks. --------------------------------------------- http://threatpost.com/nsa-targets-sys-admins-to-infiltrate-networks/104953 *** IBM Security Bulletin: IBM Security Directory Server can be affected by a vulnerability in IBM WebSphere Application Server (CVE-2014-0411) *** --------------------------------------------- The IBM WebSphere Application Server component provided with IBM Security Directory Server is vulnerable to a transport layer security (TLS) timing attack. --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** BlackOS software package automates website hacking, costs $3,800 a year *** --------------------------------------------- An updated version of a malicious software package designed to automate the process of hacking websites is being offered up on underground markets for $3,800 a year, according to a blog by Trend Micro. --------------------------------------------- http://feedproxy.google.com/~r/SCMagazineHome/~3/yw9wyT8CoMQ/ *** WPA2 Wireless Security Crackable WIth "Relative Ease" *** --------------------------------------------- An anonymous reader writes "Achilleas Tsitroulis of Brunel University, UK, Dimitris Lampoudis of the University of Macedonia, Greece and Emmanuel Tsekleves of Lancaster University, UK, have investigated the vulnerabilities in WPA2 and present its weakness. They say that this wireless security system might now be breached with relative ease [original, paywalled paper] by a malicious attack on a network. --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/GNlVmrhVOM4/story01.htm *** Android update process gives malware a leg-up to evil: Indiana U *** --------------------------------------------- Old apps get access to privileges that didnt exist when they were written Researchers from Indiana University Bloomington have tagged a vulnerability in the way Android handles updates, which they say puts practically every Android device at risk of malicious software.… --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/03/23/android_upd… *** AWS urges developers to scrub GitHub of secret keys *** --------------------------------------------- Devs hit with unexpected bills after leaving secret keys exposed. Amazon Web Services (AWS) is urging developers using the code sharing site GitHub to check their posts to ensure they havent inadvertently exposed their log-in credentials. --------------------------------------------- http://www.itnews.com.au/News/375785,aws-urges-developers-to-scrub-github-o… *** D-Link DIR-600L Cross-Site Request Forgery Vulnerability *** --------------------------------------------- A vulnerability has been reported in D-Link DIR-600L, which can be exploited by malicious people to conduct cross-site request forgery attacks. The application allows users to perform certain actions via HTTP requests without performing proper validity checks to verify the requests. This can be exploited to e.g. change administrative credentials when a logged-in user visits a specially crafted web page. --------------------------------------------- https://secunia.com/advisories/57392 *** Array Networks vxAG / vAPV Undocumented Accounts Security Issues *** --------------------------------------------- Some security issues have been reported in Array Networks vxAG and vAPV, which can be exploited by malicious people to bypass certain security restrictions. The security issues are caused due to the device using certain undocumented user accounts with default credentials, which can be exploited to gain otherwise restricted access to the device. --------------------------------------------- https://secunia.com/advisories/57442 *** PayPal for Android SSL Certificate Validation Security Issue *** --------------------------------------------- MWR InfoSecurity has reported a security issue in PayPal for Android, which can be exploited by malicious people to conduct spoofing attacks. The security issue is caused due to an error when verifying server SSL certificate within the WebHybridClient class and can be exploited to spoof a HTTPS connection and e.g. conduct Man-in-the-Middle (MitM) attacks. --------------------------------------------- https://secunia.com/advisories/57351 *** php-font-lib "name" Cross-Site Scripting Vulnerability *** --------------------------------------------- Daniel C. Marques has reported a vulnerability in php-font-lib, which can be exploited by malicious people to conduct cross-site scripting attacks. Input passed via the "name" GET parameter to www/make_subset.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. --------------------------------------------- https://secunia.com/advisories/57558

1 0

Tageszusammenfassung - Freitag 21-03-2014
by Daily end-of-shift report 21 Mar '14

21 Mar '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 20-03-2014 18:00 − Freitag 21-03-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Taken in phishing attack, Microsoft's unmentionables aired by hacktivists *** --------------------------------------------- If Microsoft and eBay arent safe from social engineering attacks, who is? --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/B9IE0Uei57U/ *** Kaspersky Internet Security Regular Expression Patterns Processing Denial of Service Vulnerability *** --------------------------------------------- CXsecurity has discovered a vulnerability in Kaspersky Internet Security, which can be exploited by malicious people to cause a DoS (Denial of Service). The vulnerability is caused due to an error when processing regular expression patterns and can be exploited to exhaust CPU resources and render the system unusable. --------------------------------------------- https://secunia.com/advisories/57316 *** DotNetNuke Unspecified Script Insertion Vulnerability *** --------------------------------------------- A vulnerability has been reported in DotNetNuke, which can be exploited by malicious users to conduct script insertion attacks. Certain unspecified input is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed. --------------------------------------------- https://secunia.com/advisories/57429 *** WordPress WP-Filebase Download Manager Plugin Arbitrary Code Execution Vulnerability *** --------------------------------------------- A vulnerability has been reported in the WP-Filebase Download Manager plugin for WordPress, which can be exploited by malicious users to compromise a vulnerable system. ... Successful exploitation of this vulnerability requires access rights to upload files (e.g. "Editor" access rights). The vulnerability is reported in version 0.3.0.03. Prior versions may also be affected. --------------------------------------------- https://secunia.com/advisories/57456 *** Zeus variant blocks user activity with full-screen pop-ups *** --------------------------------------------- Infected users are forced to contend with open windows, which are actually legitimate sites being displayed on their desktops. --------------------------------------------- http://feedproxy.google.com/~r/SCMagazineHome/~3/KHHSZFOdcH0/ *** A peek inside a modular, Tor C&C enabled, Bitcoin mining malware bot *** --------------------------------------------- Cybercriminals continue to maliciously 'innovate', further confirming the TTP (tactics, techniques and procedure) observations we made in our Cybercrime Trends 2013 assessment back in December, 2013, namely, that the diverse cybercrime ecosystem is poised for exponential growth. Standardizing the very basics of fraudulent and malicious operations, throughout the years, cybercriminals have successfully achieved a state of malicious economies of scale... --------------------------------------------- http://feedproxy.google.com/~r/WebrootThreatBlog/~3/V6XSH_U-eoU/ *** Siemens SIMATIC S7-1200 Improper Input Validation Vulnerabilities *** --------------------------------------------- OVERVIEWSiemens has reported two improper input validation vulnerabilities discovered separately by Prof. Dr. Hartmut Pohl of softScheck GmbH and Arne Vidström of Swedish Defence Research Agency (FOI) in Siemens' SIMATIC S7-1200 PLC. Siemens has produced a new version that mitigates these vulnerabilities.These vulnerabilities could be exploited remotely.AFFECTED PRODUCTSThe following SIMATIC S7-1200 PLC versions are affected: --------------------------------------------- http://ics-cert.us-cert.gov/advisories/ICSA-14-079-01 *** Siemens SIMATIC S7-1200 Vulnerabilities *** --------------------------------------------- OVERVIEWSiemens, Ralf Spenneberg of OpenSource Training, Lucian Cojocar of EURECOM, Sascha Zinke from the FU Berlin's work team SCADACS, and Positive Technologies' researchers (Alexey Osipov, and Alex Timorin) have identified six vulnerabilities in the Siemens SIMATIC S7-1200 CPU family. Siemens has produced a new product release that mitigates these vulnerabilities.These vulnerabilities could be exploited remotely. --------------------------------------------- http://ics-cert.us-cert.gov/advisories/ICSA-14-079-02 *** Cisco AsyncOS Patch , (Fri, Mar 21st) *** --------------------------------------------- Cisco released a patch for AsyncOS, the operating system used in its E-Mail Security Appliance (ESA) and Security Management Appliance (SMA). The vulnerability is exploited by an authenticated attacker uploading a crafted blocklist file. The file has to be uploaded via FTP, so this vulnerability is only exploitable if the FTP service is enabled. Once the blacklist is pared, arbitrary commands are executed. This sounds like an OS command injection vulnerability. The parameters (assumed to be --------------------------------------------- http://isc.sans.edu/diary.html?storyid=17839&rss *** Linux Kernel Netfilter DCCP Processing Flaw Lets Remote Users Execute Arbitrary Code *** --------------------------------------------- Description: A vulnerability was reported in the Linux Kernel. A remote user can execute arbitrary code on the target system. A remote user can send specially crafted DCCP data to trigger a memory corruption flaw in 'nf_conntrack_proto_dccp.c' and execute arbitrary code on the target system. --------------------------------------------- http://www.securitytracker.com/id/1029945 *** Horde Framework Unserialize PHP Code Execution *** --------------------------------------------- Topic: Horde Framework Unserialize PHP Code Execution Risk: High Text:## # This module requires Metasploit --------------------------------------------- http://cxsecurity.com/issue/WLB-2014030175 *** Monitoring for unusual network traffic key to banking botnet detection *** --------------------------------------------- Malware authors have had great success targeting financial institutions in recent years, and in turn those organizations have a vested interest in improving their banking botnet detection capabilities. However, one expert says financial firms are failing because they ignore unusual network traffic. --------------------------------------------- http://searchsecurity.techtarget.com/news/2240216637/Monitoring-for-unusual… *** Nokia X Android smartphone security features detailed *** --------------------------------------------- ... the Nokia X comes with the required security features to protect the data stored on the device without downloading third-party security apps. The three main ways to protect the data on the Nokia X smartphone is the screen security, encryption, and SIM card lock. --------------------------------------------- http://gadgets.ndtv.com/mobiles/news/nokia-x-android-smartphone-security-fe… *** Linux Worm Darlloz Infects over 31,000 Devices in Four Months *** --------------------------------------------- The worm is designed to infect computers running Intel x86 architectures, but it's also capable of infecting devices running MIPS, ARM, PowerPC architectures. Routers, set-top boxes and other devices usually have this kind of architecture. Based on its investigation, Symantec has determined that the main goal of Darlloz is to abuse infected devices for crypto-currency mining. Once it's installed on a computer, the worm installs open source mining software (cpuminer). --------------------------------------------- http://news.softpedia.com/news/Linux-Worm-Darlloz-Infects-over-31-000-Devic… *** Mass-Produced ATM Skimmers, Rogue PoS Terminals via 3D Printing? *** --------------------------------------------- On several underground forums, a cybercriminal named gripper is selling ATM skimmers and fake POS terminals, and is making some very bold claims doing so: Figure 1. Underground advertisement. The cybercriminal claims that he can mass-produce VeriFone VerixV point-of-sale (PoS) devices. (Verifone is a US-based provider of POS terminals.) Some specific VeriFone products such as the Vx510... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/YmksHI4j1OM/ *** Spotlight on Java SE 8 Security *** --------------------------------------------- March 18, 2014 was the long anticipated release of Java SE 8. I though I would spotlight some of the key security features of Java 8 for readers. First, many are not aware of security improvements made to Java 7. Let's begin with a quick review the Java SE 7 security features that were rolled into Java SE 8. --------------------------------------------- http://www.securitycurmudgeon.com/2014/03/20/spotlight-on-java-se-8-securit… *** IBM Security Bulletin: IBM WebSphere MQ Internet Pass-Thru - Potential denial of service on the command port listener (CVE-2013-5401) *** --------------------------------------------- A denial of service vulnerability exists and could be exploited by a remotely connected user to stop the remote administration service. CVE(s): CVE-2013-5401 Affected product(s) and affected version(s): WebSphere MQIPT 2.1.0.0 WebSphere MQIPT 2.0.x Refer to the following reference URLs for remediation and additional vulnerability details: Source Bulletin: http://www-01.ibm.com/support/docview.wss?uid=swg21666863 X-Force Database: http://xforce.iss.net/xforce/xfdb/87297 --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** OpenSSL ECDSA Nonces Recovery Weakness *** --------------------------------------------- Yuval Yarom and Naomi Benger have reported a weakness in OpenSSL, which can be exploited by malicious, local users to disclose certain sensitive information. --------------------------------------------- https://secunia.com/advisories/57091 *** OpenSSH "child_set_env()" Security Bypass Security Issue *** --------------------------------------------- The security issue is caused due to an error within the "child_set_env()" function (usr.bin/ssh/session.c) and can be exploited to bypass intended environment restrictions by using a substring before a wildcard character. --------------------------------------------- https://secunia.com/advisories/57488 *** Oracle VirtualBox 3D Acceleration Multiple Privilege Escalation Vulnerabilities *** --------------------------------------------- Core Security has reported multiple vulnerabilities in Oracle VirtualBox, which can be exploited by malicious, local users in a guest virtual machine to gain escalated privileges. --------------------------------------------- https://secunia.com/advisories/57384 *** Cisco Hosted Collaboration Solution Packet Processing Denial of Service Vulnerability *** --------------------------------------------- A vulnerability has been reported in Cisco Hosted Collaboration Solution, which can be exploited by malicious people to cause a DoS (Denial of Service). --------------------------------------------- https://secunia.com/advisories/57496 *** Video zeigt Jailbreak von iOS 7.1 *** --------------------------------------------- Ein Entwickler hat seine Arbeit an einem Jailbreak von iOS 7.1 demonstriert. Apple hatte mit dem jüngsten iOS-Update die Schwachstellen geschlossen, die für den letzten Jailbreak zum Einsatz kamen. --------------------------------------------- http://www.heise.de/newsticker/meldung/Video-zeigt-Jailbreak-von-iOS-7-1-21…

1 0

Tageszusammenfassung - Donnerstag 20-03-2014
by Daily end-of-shift report 20 Mar '14

20 Mar '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 19-03-2014 18:00 − Donnerstag 20-03-2014 18:00 Handler: Alexander Riepl Co-Handler: Stephan Richter *** ZBOT Adds Clickbot Routine To Arsenal *** --------------------------------------------- The ZeuS/ZBOT malware family is probably one of the most well-known malware families today . It is normally known for stealing credentials associated with online banking accounts. However, ZBOT is no one-trick pony. Some ZBOT variants perform other routines like downloading or dropping other threats like ransomware. We recently came across one variant detected as TROJ_ZCLICK.A,... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/rrelQiGbzao/ *** New BlackOS Software Package Sold In Underground Forums *** --------------------------------------------- We recently came across this particular post in an underground forum: Figure 1. Underground forum post This particular post in Russian was advertising a new product, known as "BlackOS". Contrary to the name, it is not an operating system. However, it is definitely "black", or malicious: it is used to manage and redirect Internet traffic... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/mA8O58qz-TQ/ *** Phishing: Gehackter EA-Server hostet falsche Apple-Webseite *** --------------------------------------------- Kriminelle Hacker haben auf Servern des Spieleherstellers Electronic Arts eine gefälschte Webseite untergebracht, die Apple-IDs samt Passwörtern und Kreditkarteninformationen verlangt. Wie viele Nutzer ihre Daten dort eingegeben haben, ist nicht bekannt. --------------------------------------------- http://www.golem.de/news/phishing-gehackter-ea-server-hostet-falsche-apple-… *** "goto fail": Apple drängt Nutzer zum Update *** --------------------------------------------- Der Mac-Hersteller fordert inzwischen dazu auf, das Update auf OS X 10.9.2 alsbald möglich zu installieren - falls noch nicht geschehen. Ältere Versionen von OS X Mavericks und iOS weisen eine gravierende SSL-Schwachstelle auf. --------------------------------------------- http://www.heise.de/security/meldung/goto-fail-Apple-draengt-Nutzer-zum-Upd… *** Android: Sicherheitslücken wegen fehlender Updates bleiben Problem *** --------------------------------------------- 70 Prozent aller Android-Geräte weltweit besitzen eine Browser-Lücke, glaubt ein Forscher. Der simple Aufruf einer Website reicht, um sie auszunutzen. --------------------------------------------- http://www.heise.de/newsticker/meldung/Android-Sicherheitsluecken-wegen-feh… *** Analysis: Spam report: February 2014 *** --------------------------------------------- The share of spam in global email traffic decreased by 7.6 percentage points and averaged 65.7% in January. As forecasted, the drop in the share of spam was due to a lull early in January when there is less business activity and a large number of botnets are turned off. --------------------------------------------- http://www.securelist.com/en/analysis/204792328/Spam_report_February_2014 *** Protokollanalyse: Mogeln im Quizduell *** --------------------------------------------- Entwickler verlassen sich zu sehr auf HTTPS und verzichten auf grundlegende Sicherheitsmaßnahmen. Über eine Man-in-the-Middle-Attacke konnten Security-Forscher in den Datenverkehr zwischen App-Server und Apps hineinsehen - und entdeckten Sonderbares. --------------------------------------------- http://www.golem.de/news/protokollanalyse-mogeln-im-quizduell-1403-105276-r… *** Cisco IronPort AsyncOS Software for ESA and SMA File Validation Flaw Lets Remote Authenticated Users Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1029937 *** SA-CONTRIB-2014-033 - Nivo Slider - Cross Site Scripting *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2014-033Project: Nivo Slider (third-party module)Version: 7.xDate: 2014-March-19Security risk: Moderately criticalExploitable from: RemoteVulnerability: Cross Site ScriptingDescriptionNivo Slider provides a way to showcase featured content. Nivo Slider gives administrators a simple method of adding slides to the slideshow, an administration interface to configure slideshow settings, and simple slider positioning using the Drupal block system.The module doesnt... --------------------------------------------- https://drupal.org/node/2221481

1 0

Tageszusammenfassung - Mittwoch 19-03-2014
by Daily end-of-shift report 19 Mar '14

19 Mar '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 18-03-2014 18:00 − Mittwoch 19-03-2014 18:00 Handler: Alexander Riepl Co-Handler: Stephan Richter *** Apache Update Resolves Security Vulnerabilities *** --------------------------------------------- Apache has released version 2.4.9 of its ubiquitous HTTP web server (HTTPD), resolving two security vulnerabilities and a number of other bugs in the process. --------------------------------------------- http://threatpost.com/apache-update-resolves-security-vulnerabilities/104849 *** Ebury-Rootkit: Zombie-Server greifen täglich eine halbe Million Rechner an *** --------------------------------------------- Zu den Opfern der Malware-Kampagne "Operation Windigo" gehören unter anderem kernel.org und cPanel. Die mit dem Ebury-Rootkit infizierten Server versenden Spam und attackieren Besucher der kompromittierten Webseiten. --------------------------------------------- http://www.heise.de/security/meldung/Ebury-Rootkit-Zombie-Server-greifen-ta… *** Wide Gap Between Attackers, BIOS Forensics Research *** --------------------------------------------- Advanced attackers are ahead of researchers when it comes to understanding firmware vulnerabilities and BIOS forensics, experts from MITRE and Intel said during last weeks CanSecWest. --------------------------------------------- http://threatpost.com/wide-gap-between-attackers-bios-forensics-research/10… *** Avast-Toolbar mit Shopping-Spion *** --------------------------------------------- Die Browser-Toolbar, die unter anderem mit der Antivirensoftware auf den Rechner gelangt, schaut dem Nutzer beim Einkaufen über die Schulter und baut Konkurrenzangebot in die Shop-Seiten ein. --------------------------------------------- http://www.heise.de/security/meldung/Avast-Toolbar-mit-Shopping-Spion-21496… *** Data suggests Android malware threat greatly overhyped *** --------------------------------------------- Its no secret that many in the security industry perceive Google Inc.s Android mobile platform to be plagued by malware, but Android security team lead Adrian Ludwig has made it his mission to eradicate the disingenuous meme of the burgeoning Android malware apocalypse. --------------------------------------------- http://searchsecurity.techtarget.com/news/2240216335/Data-suggests-Android-… *** Mailingliste Full Disclosure macht dicht *** --------------------------------------------- Die bekannte Sicherheits-Mailingliste wurde von ihrem Betreiber bis auf weiteres geschlossen. Full Disclosure war in der Vergangenheit immer wieder Schauplatz der Enthüllung wichtiger Sicherheitslücken. --------------------------------------------- http://www.heise.de/security/meldung/Mailingliste-Full-Disclosure-macht-dic… *** 10 Years of Mobile Malware: How Secure Are You? *** --------------------------------------------- Believe it or not, but it has been 10 years since the first mobile malware was created! On the infographic below, you can see a brief overview of the most important malware events in the past 10 years, with a short description of each of them. --------------------------------------------- https://www.linkedin.com/today/post/article/20140316112657-67886711-10-year… *** New Exploits Arrive for Old PHP Vulnerability *** --------------------------------------------- New exploits for a two-year-old PHP vulnerability popped up in October that allow hackers to run code on websites running vulnerable versions of the web development framework. --------------------------------------------- http://threatpost.com/new-exploits-arrive-for-old-php-vulnerability/104881 *** Fake Tor browser for iOS laced with adware, spyware, members warn *** --------------------------------------------- Title available since November raises questions about App Store vetting process. --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/qB_-ioinSh4/ *** WordPress Subscribe To Comments Reloaded Plugin Cross-Site Request Forgery Vulnerability *** --------------------------------------------- https://secunia.com/advisories/57015 *** Moodle Multiple Security Issues and Multiple Vulnerabilities *** --------------------------------------------- https://secunia.com/advisories/57331 *** Samba smbcacls security bypass *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/91849

1 0

Tageszusammenfassung - Dienstag 18-03-2014
by Daily end-of-shift report 18 Mar '14

18 Mar '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 17-03-2014 18:00 − Dienstag 18-03-2014 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Google's Public DNS Hijacked for 22 Minutes *** --------------------------------------------- The attackers hijacked the 8.8.8.8/32 DNS server for approximately 22 minutes. According to BGPmon, networks in Brazil and Venezuela were impacted. A screenshot published by the company shows that the traffic was redirected to BT Latin America's networks. --------------------------------------------- http://news.softpedia.com/news/Google-s-Public-DNS-Hijacked-for-22-Minutes-… *** Anonymisierung: Sniper-Angriff legt Tor-Nodes lahm *** --------------------------------------------- Mit einer sogenannten Sniper-Attacke können Angreifer nicht nur gezielt einzelne Tor-Knoten außer Gefecht setzen, sondern innerhalb von wenige Minuten das gesamte Netzwerk lahmlegen. Ein Patch wurde bereits erarbeitet. --------------------------------------------- http://www.golem.de/news/anonymisierung-sniper-angriff-legt-tor-nodes-lahm-… *** Scans for FCKEditor File Manager, (Mon, Mar 17th) *** --------------------------------------------- FCKEditor (now known as CKEditor [1]) is a popular full featured GUI editor many web sites use. For example, you frequently find it with blog systems like WordPress or as part of commenting/forum systems. As an additional feature, a filemanager can be added to allow users to upload images or other files. Sadly, while a very nice and functional plugin, this features if frequently not well secured and can be used to upload malicious files. We have seen some scans probing specifically... --------------------------------------------- http://isc.sans.edu/diary.html?storyid=17821&rss *** Hintergründe des Typo3-Hacks weiter im Dunkeln *** --------------------------------------------- Die Typo3 Association hat keine Informationen zu der Schwachstelle hinter dem Casino-Spam-Hack, der viele Typo3-Webseiten betrifft, und vermutet, dass der Hack andere Ursachen hat. Seiten ohne Typo-Installation sollen ebenfalls betroffen sein. --------------------------------------------- http://www.heise.de/newsticker/meldung/Hintergruende-des-Typo3-Hacks-weiter… *** Hidden Windigo UNIX ZOMBIES are EVERYWHERE *** --------------------------------------------- Check and wipe: The la-la-la-its-not-happening plan is no good Hackers using a Trojan seized control of over 25,000 Unix servers worldwide to create a potent spam and malware distribution platform. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/03/18/windigo_uni… *** Threatglass Tool Gives Deep Look Inside Compromised Sites *** --------------------------------------------- Trying to enumerate the compromised sites on the Internet is a Sisyphian task. Luckily, it's not a task that anyone really needs to perform any longer, especially now that Barracuda Labs has released its new Threatglass tool, a Web-based frontend that allows users to query a massive database of compromised sites to get detailed information... --------------------------------------------- http://threatpost.com/threatglass-tool-gives-deep-look-inside-compromised-s… *** March 2014 Security Bulletin Webcast and Q&A *** --------------------------------------------- Today we published the March 2014 Security Bulletin Webcast Questions & Answers page. We answered eight questions in total, with the majority focusing on the updates for Windows (MS14-016) and Internet Explorer (MS14-012). One question that was not answered on air has been included on the Q&A page. --------------------------------------------- http://blogs.technet.com/b/msrc/archive/2014/03/17/march-2014-security-bull… *** When ASLR makes the difference *** --------------------------------------------- We wrote several times in this blog about the importance of enabling Address Space Layout Randomization mitigation (ASLR) in modern software because it's a very important defense mechanism that can increase the cost of writing exploits for attackers and in some cases prevent reliable exploitation. In today's blog, we'll go through ASLR one more time to show in practice how it can be valuable to mitigate two real exploits seen in the wild and to suggest solutions for programs... --------------------------------------------- https://blogs.technet.com/b/srd/archive/2014/03/12/when-aslr-makes-the-diff… *** Red Hat plans unified security management for Fedora 21 *** --------------------------------------------- One crypto policy to bind them Red Hat is planning a significant change to how its Fedora Linux distribution handles crypto policy, to ship with the due-in-late-2014 Fedora 21 release. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/03/18/red_hat_pla… *** Open-Xchange AppSuite 7.4.1 / 7.4.2 Cross Site Scripting *** --------------------------------------------- Topic: Open-Xchange AppSuite 7.4.1 / 7.4.2 Cross Site Scripting Risk: Low Text:Product: Open-Xchange AppSuite Vendor: Open-Xchange GmbH Internal reference: 31065 Vulnerability type: Cross Site Scriptin... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014030134 *** Security Advisory-Y.1731 Vulnerability on Some Huawei Switches *** --------------------------------------------- Y.1731 is an ITU-T recommendation for OAM features on Ethernet-based networks. Y.1731 provides connectivity detection, diagnosis, and performance monitoring for VLAN/VSI services on MANs. Some Huawei switches support Y.1731 and therefore, has the Y.1731 vulnerability in processing special packets. The vulnerability causes the restart of switches (Vulnerability ID: HWPSIRT-2013-1165). --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** OpenSSH AcceptEnv Wildcard Processing Flaw May Let Remote Authenticated Users Bypass Environment Restrictions *** --------------------------------------------- http://www.securitytracker.com/id/1029925 *** DSA-2880 python2.7 *** --------------------------------------------- security update --------------------------------------------- http://www.debian.org/security/2014/dsa-2880 *** Bugtraq: 2014 World Conference on IST - Madeira Island, April 15-17 *** --------------------------------------------- The 2014 World Conference on Information Systems and Technologies --------------------------------------------- http://www.securityfocus.com/archive/1/531513

1 0

Tageszusammenfassung - Montag 17-03-2014
by Daily end-of-shift report 17 Mar '14

17 Mar '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 14-03-2014 18:00 − Montag 17-03-2014 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Security Exploit Patched on vBulletin - PHP Object Injection *** --------------------------------------------- The vBulletin team just issued a warning, and released patches for a security exploit that affected all versions of vBulletin including 3.5, 3.6, 3.7, 3.8, 4.X, 5.X. They recommend that anyone using vBulletin apply these patches as soon as possible. Here is part of their announcement: A security issue has been found that affects all... --------------------------------------------- http://blog.sucuri.net/2014/03/security-exploit-patched-on-vbulletin-php-ob… *** Pwn2Own results for Wednesday (Day One) *** --------------------------------------------- At Pwn4Fun, Google delivered a very impressive exploit against Apple Safari launching Calculator as root on Mac OS X. ZDI presented a multi-stage exploit, including an adaptable sandbox bypass, against Microsoft Internet Explorer, launching Scientific Calculator (running in medium integrity) with continuation. --------------------------------------------- http://www.pwn2own.com/2014/03/pwn2own-results-for-wednesday-day-one/ *** Pwn2Own results for Thursday (Day Two) *** --------------------------------------------- ... Vulnerabilities were successfully presented on Thursday in the Pwn2Own competition ... against Google Chrome, Microsoft Internet Explorer, Apple Safari, Mozilla Firefox, Adobe Flash. --------------------------------------------- http://www.pwn2own.com/2014/03/pwn2own-results-thursday-day-two/ *** Verschlüsselung: Caesar-Wettbewerb sucht authentifizierte Verschlüsselung *** --------------------------------------------- Die erste Runde des Caesar-Wettbewerbs hat begonnen. Das Ziel: Kryptografen suchen bessere Algorithmen für authentifizierte Verschlüsselung. --------------------------------------------- http://www.golem.de/news/verschluesselung-caesar-wettbewerb-sucht-authentif… *** The Long Tail of ColdFusion Fail *** --------------------------------------------- Earlier this month, I published a story about a criminal hacking gang using Adobe ColdFusion vulnerabilities to build a botnet of hacked e-commerce sites that were milked for customer credit card data. Todays post examines the impact that this botnet has had on several businesses, as well as the important and costly lessons these companies learned from the intrusions. --------------------------------------------- http://krebsonsecurity.com/2014/03/the-long-tail-of-coldfusion-fail/ *** Webstorage-App von Asus schwächelt erneut bei SSL *** --------------------------------------------- Eine eigentlich behobene SSL-Lücke in der Android-App für den Asus-Onlinespeicher Webstorage ist auferstanden: Die aktuelle App-Version überpüft nicht das vom Onlinespeicher übermittelte Serverzertifikat. --------------------------------------------- http://www.heise.de/security/meldung/Webstorage-App-von-Asus-schwaechelt-er… *** iOS 7 has weak random number generator *** --------------------------------------------- Trivial to break, says researcher In an effort to improve iDevice security, Apple replaced its internal random number generator between iOS 6 and iOS 7 - but a security researcher believes Cupertino inadvertently downgraded security. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/03/16/ios_7_has_w… *** VU#381692: Webmin contains a cross-site scripting vulnerability *** --------------------------------------------- Vulnerability Note VU#381692 Webmin contains a cross-site scripting vulnerability Original Release date: 14 Mar 2014 | Last revised: 14 Mar 2014 Overview Webmin 1.670, and possibly earlier versions, contains a cross-site scripting vulnerability. Description CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Webmin 1.670, and possibly earlier versions, contains a cross-site scripting vulnerability in the "search" parameter of the view.cgi... --------------------------------------------- http://www.kb.cert.org/vuls/id/381692 *** Siemens SIMATIC S7-1500 CPU Firmware Vulnerabilities *** --------------------------------------------- Siemens and Positive Technology researchers (Yury Goltsev, Llya Karpov, Alexey Osipov, Dmitry Serebryannikov and Alex Timorin) have identified nine firmware vulnerabilities in the Siemens SIMATIC S7-1500 CPU Firmware. Siemens has produced a patch that mitigates these vulnerabilities.These vulnerabilities could be exploited remotely. --------------------------------------------- http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01 *** OpenX 2.8.11 Cross Site Request Forgery *** --------------------------------------------- Topic: OpenX 2.8.11 Cross Site Request Forgery Risk: Low Text: Hello, Multiple cross-site request forgery (CSRF) vulnerabilities in OpenX 2.8.11and earlier allows remote attackers to ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014030121 *** iOS 7 Arbitrary Code Execution *** --------------------------------------------- When a specific value is supplied in USB Endpoint descriptor for a HID device the Apple device kernel panics and reboots --------------------------------------------- http://cxsecurity.com/issue/WLB-2014030126 *** GNU Readline Insecure usage of temporary files *** --------------------------------------------- Topic: GNU Readline Insecure usage of temporary files Risk: Medium Text: Whilst auditing some code for insecure uses of temporary files I spotted a potential area of concern in GNU readline. (... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014030129 *** HPSBNS02969 rev.1 - HP NonStop Servers running Java 7, Multiple Remote Vulnerabilities affecting Confidentiality, Integrity and Availability *** --------------------------------------------- Potential vulnerabilities have been identified with HP NonStop Servers running Java 7. The vulnerabilities could be exploited remotely affecting confidentiality, integrity and availability. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_…

1 0

Tageszusammenfassung - Freitag 14-03-2014
by Daily end-of-shift report 14 Mar '14

14 Mar '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 13-03-2014 18:00 − Freitag 14-03-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Bugtraq: [ MDVSA-2014:057 ] mediawiki *** --------------------------------------------- Updated mediawiki packages fix multiple vulnerabilities: --------------------------------------------- http://www.securityfocus.com/archive/1/531452 *** Vuln: Mutt Mailreader mutt_copy_hdr() Function Heap Based Buffer Overflow Vulnerability *** --------------------------------------------- Mutt mailreader is prone to a heap-based buffer-overflow vulnerability. Successful exploitation of this issue allow an attacker to execute arbitrary code in the context of the application, failed attempts lead to denial-of-service. Mutt prior to 1.5.23 are vulnerable. --------------------------------------------- http://www.securityfocus.com/bid/66165 *** Schneider Electric StruxureWare SCADA Expert ClearSCADA Parsing Vulnerability *** --------------------------------------------- OVERVIEW Andrew Brooks identified and reported to The Zero Day Initiative (ZDI) a File Parsing Vulnerability: Schneider Electric StruxureWare SCADA Expert ClearSCADA ServerMain.exe OPF File Parsing Vulnerability. Schneider Electric has prepared workarounds and helped develop security upgrades for a third‑party component that is affected.AFFECTED PRODUCTSThe following SCADA Expert ClearSCADA versions are affected: --------------------------------------------- http://ics-cert.us-cert.gov/advisories/ICSA-14-072-01 *** VU#807134: WatchGuard Fireware XTM devices contain a cross-site scripting vulnerability *** --------------------------------------------- Vulnerability Note VU#807134 WatchGuard Fireware XTM devices contain a cross-site scripting vulnerability ... Overview WatchGuard Fireware XTM 11.8.1, and possibly earlier versions, contains a cross-site scripting vulnerability. --------------------------------------------- http://www.kb.cert.org/vuls/id/807134 *** Squid Flaw in SSL-Bump Lets Remote Users Deny Service *** --------------------------------------------- A remote user can send HTTPS requests to trigger a flaw in SSL-Bump and cause the target service to crash. Specially crafted requests are not required to trigger this vulnerability. --------------------------------------------- http://www.securitytracker.com/id/1029908 *** Wireshark NFS/M3UA/RLC Dissector Bugs Let Remote Users Deny Service and MPEG Buffer Overflow Lets Remote Users Execute Arbitrary Code *** --------------------------------------------- Several vulnerabilities were reported in Wireshark. A remote user can cause arbitrary code to be executed on the target user's system. A remote user can cause denial of service conditions. --------------------------------------------- http://www.securitytracker.com/id/1029907 *** Blogs of War: Don’t Be Cannon Fodder *** --------------------------------------------- On Wednesday, KrebsOnSecurity was hit with a fairly large attack which leveraged a feature in more than 42,000 blogs running the popular WordPress content management system (this blog runs on WordPress). This post is an effort to spread the word to other WordPress users to ensure their blogs arent used in attacks going forward. --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/TMHH3NsEOxo/ *** Cisco Cloud Portal Discloses Cryptographic Material That Lets Remote Users Decrypt Data *** --------------------------------------------- A vulnerability was reported in Cisco Cloud Portal. A local user can obtain cryptographic material. A remote user with access to the cryptographic material can then decrypt data. The Cisco Intelligent Automation for Cloud (Cisco IAC) binaries include fixed cryptographic material. A remote user that can access encrypted data from the target Cisco IAC installation can decrypt the data. --------------------------------------------- http://www.securitytracker.com/id/1029915 *** Google Docs Users Targeted by Sophisticated Phishing Scam *** --------------------------------------------- We see millions of phishing messages every day, but recently, one stood out: a sophisticated scam targeting Google Docs and Google Drive users.The scam uses a simple subject of "Documents" and urges the recipient to view an important document on Google Docs by clicking on the included link.read more --------------------------------------------- http://www.symantec.com/connect/blogs/google-docs-users-targeted-sophistica… *** McAfee Email Gateway Input Validation Flaws Let Remote Authenticated Users Inject SQL and Operating System Commands *** --------------------------------------------- Several vulnerabilities were reported in McAfee Email Gateway. A remote authenticated user can execute arbitrary operating system commands on the target system. A remote authenticated user can inject SQL commands. --------------------------------------------- http://www.securitytracker.com/id/1029916 *** Firefox Exec Shellcode From Privileged Javascript Shell *** --------------------------------------------- Topic: Firefox Exec Shellcode From Privileged Javascript Shell Risk: Medium --------------------------------------------- http://cxsecurity.com/issue/WLB-2014030113 *** A decade of securing Europe’s cyber future. The EU’s cyber security Agency ENISA is turning ten, and is looking at future challenges. *** --------------------------------------------- In the “eternal marathon” against cyber criminals, there is a “constant, increasing need for ENISA”. --------------------------------------------- http://www.enisa.europa.eu/media/press-releases/a-decade-of-securing-europe… *** lighttpd Directory Traversal and SQL Injection Vulnerabilities *** --------------------------------------------- Two vulnerabilities have been reported in lighttpd, which can be exploited by malicious people to disclose potentially sensitive information and conduct SQL injection attacks. ... Successful exploitation requires mod_evhost and/or mod_simple_vhost modules to be enabled. --------------------------------------------- https://secunia.com/advisories/57333 *** Samsung Backdoor May Not Be as Wide Open as Initially Thought *** --------------------------------------------- ... As demonstrated in a proof-of-concept attack, this allowed certain baseband code to gain access to a device’s storage under a specific set of circumstances. But upon closer inspection, this backdoor is most likely not as bad as it was initially made out to be. --------------------------------------------- http://www.xda-developers.com/android/samsung-backdoor-may-not-be-as-wide-o… *** EU-Parlament stimmt für Meldepflicht von Cyberangriffen *** --------------------------------------------- Die Abgeordneten haben mit großer Mehrheit, aber einigen Änderungen einen Richtlinienentwurf der EU-Kommission zur Netz- und Informationssicherheit beschlossen. Mitgliedsländer sollen ihre Kooperationen stärken. --------------------------------------------- http://www.heise.de/newsticker/meldung/EU-Parlament-stimmt-fuer-Meldepflich… *** Gameover ZeuS Jumps on the Bitcoin Bandwagon *** --------------------------------------------- Were always asking our analysts the following question: seen anything interesting? And yesterday, the answer to our query was this: Gameover ZeuS has some additional strings.Very interesting, indeed.Heres a screenshot of the decrypted strings: • aBitcoinQt_exe • aBitcoind_exe • aWallet_dat • aBitcoinWallet • aBitcoinWalle_0Bitcoin wallet stealing has really moved up from the bush leagues. Gameover ZeuS is a pro.Analysis is ongoing.Heres the SHA1: --------------------------------------------- http://www.f-secure.com/weblog/archives/00002685.html *** Target staff IGNORED security alerts as hackers slurped 40m customers card details *** --------------------------------------------- Reports say staff dithered while hackers went to town Staff at US retailer Target failed to stop the theft of 40 million credit card records last December despite an escalating series of alarms from the companys security systems.… --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/03/14/target_fail… *** Debian Security Advisory DSA-2879-1 libssh -- security update *** --------------------------------------------- It was discovered that libssh, a tiny C SSH library, did not reset the state of the PRNG after accepting a connection. A server mode application that forks itself to handle incoming connections could see its children sharing the same PRNG state, resulting in a cryptographic weakness and possibly the recovery of the private key. --------------------------------------------- http://www.debian.org/security/2014/dsa-2879 *** Sophos UTM TCP Stack Memory Leak Denial of Service Vulnerability *** --------------------------------------------- A vulnerability has been reported in Sophos UTM, which can be exploited by malicious people to cause a DoS (Denial of Service). The vulnerability is caused due to an error within TCP stack and can be exploited to cause a memory leak. The vulnerability is reported in versions prior to 9.109. --------------------------------------------- https://secunia.com/advisories/57344 *** Blog: Analysis of, Malware from the MtGox leak archive *** --------------------------------------------- A few days ago the personal blog and Reddit account of MTgox CEO, Mark Karpeles, were hacked. Attackers used them to post a file, MtGox2014Leak.zip, which they claim contains valuable database dumps and specialized software for remote access to MtGox data. But this application is actually malware created to search and steal Bitcoin wallet files from their victims. It seems that the whole leak was invented to infect computers with Bitcoin-stealer malware that takes advantage of people keen interest in the MtGox topic. --------------------------------------------- http://www.securelist.com/en/blog/8196/Analysis_of_Malware_from_the_MtGox_l…

1 0

Tageszusammenfassung - Donnerstag 13-03-2014
by Daily end-of-shift report 13 Mar '14

13 Mar '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 12-03-2014 18:00 − Donnerstag 13-03-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Decoding Domain Generation Algorithms (DGAs) Part III - ZeusBot DGA Reproduction *** --------------------------------------------- At this point, you can go ahead and close the two parent processes (since we are not interested in their functionality, for the sake of simply finding the DGA). So we know that we are interested in discovering how this traffic is generated. So let's try to find out where it originates. Earlier, using API Monitor, we saw that explorer was using several functions within WinINet.dll:... --------------------------------------------- http://vrt-blog.snort.org/2014/03/decoding-domain-generation-algorithms.html *** F-Secure im Interview: "Wir erkennen Staatstrojaner und wollen das nicht ändern" *** --------------------------------------------- Von Regierungen erstellte Malware muss nicht immer so schlecht sein wie 0zapftis, der bayerische Staatstrojaner. Für F-Secures Virenforscher Mikko Hypponen ist entscheidend, dass Anti-Malwareunternehmen auch künftig uneingeschränkt arbeiten können, wie er im Gespräch mit Golem.de sagte. --------------------------------------------- http://www.golem.de/news/f-secure-im-interview-wir-erkennen-staatstrojaner-… *** WordPress XML-RPC PingBack Vulnerability Analysis *** --------------------------------------------- There were news stories this week outlining how attackers are abusing the XML-PRC "pingback" feature of WordPress blog sites to launch DDoS attacks on other sites. This blog post will provide some analysis on this attack and additional information for websites to protect themselves. Not A New Vulnerabilty The vulnerability in WordPresss XML-RPC API is not new. Here is data from the WordPress bug tracker from 7 years ago. While the vulnerability itself is not new,... --------------------------------------------- http://feedproxy.google.com/~r/SpiderlabsAnterior/~3/MklfK5l9jYY/wordpress-… *** A Detailed Examination of the Siesta Campaign *** --------------------------------------------- Executive Summary FireEye recently looked deeper into the activity discussed in TrendMicro's blog and dubbed the "Siesta" campaign. The tools, modus operandi, and infrastructure used in the campaign present two possibilities: either the Chinese cyber-espionage unit APT1 is perpetrating this... --------------------------------------------- http://www.fireeye.com/blog/technical/targeted-attack/2014/03/a-detailed-ex… *** LightsOut EK Targets Energy Sector *** --------------------------------------------- Late last year, the story broke that threat actors were targeting the energy sector with Remote Access Tools and Intelligence gathering malware. It would seem that the attackers responsible for this threat are back for more. This particular APT struck late February between 2/24-2/26. The attack began as a compromise of a third party law firm which includes an energy law practice known as --------------------------------------------- http://feedproxy.google.com/~r/zscaler/research/~3/S2HhvPupa_0/lightsout-ek… *** Trojan.Skimer.19 threatens banks *** --------------------------------------------- March 4, 2014 Malware infecting the electronic innards of ATMs is not exactly a common phenomenon, so whenever such new kinds of programs emerge, they inevitably draw the attention of security specialists. Doctor Webs virus analysts got hold of a sample of Trojan.Skimer.19 which can infect ATMs. According to Doctor Web, banking system attacks involving Trojan.Skimer.19 persist to this day. Similar to its predecessors, the Trojan has its main payload incorporated into a dynamic link library... --------------------------------------------- http://news.drweb.com/show/?i=4267&lng=en&c=9 *** Trojan.Rbrute hacks Wi-Fi routers *** --------------------------------------------- March 5, 2014 Doctor Webs security researchers examined Trojan.Rbrute malware, which is designed to crack Wi-Fi router access passwords using brute force and change the DNS server addresses specified in the configuration of these devices. Criminals use this malicious program to spread the file infector known as Win32.Sector. When launched on a Windows computer, Trojan.Rbrute establishes a connection with the remote server and stands by for instructions. One of them provides the Trojan with a... --------------------------------------------- http://news.drweb.com/show/?i=4271&lng=en&c=9 *** Anatomy of a Control Panel Malware Attack, Part 1 *** --------------------------------------------- Recently we've discussed how Control Panel (CPL) malware has been spreading in Latin America. In the past, we've analyzed in some detail how CPL malware works as well as the overall picture of how this threat spreads. In this post, we shall examine in detail how they spread, and how they relate with other malicious sites. --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/v3D2zLGXolU/ *** Ethical hacker backer hacked, warns of email ransack *** --------------------------------------------- Switches registrars, tightens security after upsetting incident The IT security certification body that runs the Certified Ethical Hacker programme has itself been hacked. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/03/13/ethical_hac… *** Samsung: Galaxy-Geräte haben eine Backdoor im Modem-Prozessor *** --------------------------------------------- In mehreren Smartphones und Tablets aus Samsungs Galaxy-Modellreihe wurde eine Backdoor im Modem-Prozessor entdeckt. Diese könnte von Angreifern dazu verwendet werden, auf die Daten auf dem Smartphone oder Tablet zuzugreifen oder auch Daten zu verändern, um so Schadsoftware zu verbreiten. (Smartphone, Samsung) --------------------------------------------- http://www.golem.de/news/samsung-galaxy-geraete-haben-eine-backdoor-im-mode… *** Google hackt Mac OS X für den guten Zweck *** --------------------------------------------- Das Sicherheitsteam des Suchmaschinen-Riesen hat einen brisanten Angriff auf Mac OS X demonstriert: Beim Aufruf einer Webseite mit Safari wurde Code als root ausgeführt. Das Schau-Hacken fand in einer neuen Kategorie des Wettbewerbs Pwn2Own statt. --------------------------------------------- http://www.heise.de/security/meldung/Google-hackt-Mac-OS-X-fuer-den-guten-Z… *** Metasploit Weekly Update: Theres a Bug In Your Brain *** --------------------------------------------- The most fun module this week, in my humble opinion, is from Rapid7's own Javascript Dementer, Joe Vennix. Joe wrote up this crafty implementation of a Safari User-Assisted Download and Run Attack, which is not technically a vulnerability or a bug or anything -- it's a feature that ends up being a kind of a huge risk. Here's how it goes:... --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2014/03/13/metasploi… *** TCIPG Seminar: Dynamic Data Attacks on Real-Time Power System Operations *** --------------------------------------------- With increasing dependence on modern information and communication technology, a future smart grid is potentially more vulnerable to coordinated cyber attacks launched by an adversary. In this talk, we consider several possible attack mechanisms aimed at disrupting real-time operations of a power grid. In particular, we are interested in dynamic attack strategies on the power system state estimation that lead to infeasible real-time dispatch and disrupt the real-time market operation. --------------------------------------------- http://tcipg.org/news/TCIPG-Seminar-2014-Mar-7-Tong *** Security update available for Adobe Shockwave Player *** --------------------------------------------- Adobe has released a security update for Adobe Shockwave Player 12.0.9.149 and earlier versions on the Windows and Macintosh operating systems. This update addresses a critical vulnerability that could potentially allow an attacker to remotely take control of the affected system. --------------------------------------------- http://helpx.adobe.com/security/products/shockwave/apsb14-10.html *** Security Bulletin: Multiple security vulnerabilities exist in IBM InfoSphere Information Server (CVE-2013-4057, CVE-2013-4058 and CVE-2013-4059) *** --------------------------------------------- Security vulnerabilities exist in various versions of IBM InfoSphere Information Server or constituent products. See the individual descriptions for details. CVE(s): CVE-2013-4057, CVE-2013-4058, and CVE-2013-4059 Affected product(s) and affected version(s): IBM InfoSphere Information Server Versions 8.0, 8.1, 8.5, 8.7, and 9.1 running on all platforms --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_mul… *** Bugtraq: PowerArchiver: Uses insecure legacy PKZIP encryption when AES is selected (CVE-2014-2319) *** --------------------------------------------- http://www.securityfocus.com/archive/1/531440 *** SA-CONTRIB-2014-031 - Webform Template - Access Bypass *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2014-031Project: Webform Template (third-party module)Version: 7.xDate: 2014-March-12Security risk: Less criticalExploitable from: RemoteVulnerability: Access BypassDescriptionThis module enables you to copy webform config from one node to another.The module doesnt respect node access when providing possible nodes to copy from. As a result, a user may be disclosed the titles of nodes he does not have view access to and as such he may be able to copy the webform... --------------------------------------------- https://drupal.org/node/2216607 *** SA-CONTRIB-2014-030 - SexyBookmarks - Information Disclosure *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2014-030Project: SexyBookmarks (third-party module)Version: 6.xDate: 2014-March-12Security risk: Moderately criticalExploitable from: RemoteVulnerability: Information DisclosureDescriptionThe SexyBookmarks module is a port of the WordPress SexyBookmarks plug-in. The module adds social bookmarking using the Shareaholic service.The module discloses the private files location when Drupal 6 is configured to use private files.This vulnerability is mitigated by the fact... --------------------------------------------- https://drupal.org/node/2216269 *** Mitsubishi Electric Automation MC-WorX Suite Unsecure ActiveX Control *** --------------------------------------------- This advisory is a follow-up to the original alert, titled ICS-ALERT-13-259-01 Mitsubishi MC-WorX Suite Unsecure ActiveX Control,a published September 16, 2013, on the NCCIC/ICS‑CERT web site (this was originally incorrectly identified as MC-WorkX, the correct product name is MC-WorX). --------------------------------------------- http://ics-cert.us-cert.gov/advisories/ICSA-14-051-02 *** Cisco Intelligent Automation for Cloud Cryptographic Implementation Issues *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** GNUpanel 0.3.5_R4 Cross Site Request Forgery / Cross Site Scripting *** --------------------------------------------- Topic: GNUpanel 0.3.5_R4 Cross Site Request Forgery / Cross Site Scripting Risk: Medium Text:# Exploit Title :GNUpanel 0.3.5_R4 - Multiple Vulnerabilities # Vendor Homepage :http://wp.geeklab.com.ar/gl-en/gnupanel... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014030098 *** Proxmox Mail Gateway 3.1 Cross Site Scripting *** --------------------------------------------- Topic: Proxmox Mail Gateway 3.1 Cross Site Scripting Risk: Low Text:I. VULNERABILITY - Multiplus XSS in Proxmox Mail Gateway 3.1 II. BACKGROUND - Proxmox Mail G... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014030097

1 0

Tageszusammenfassung - Mittwoch 12-03-2014
by Daily end-of-shift report 12 Mar '14

12 Mar '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 11-03-2014 18:00 − Mittwoch 12-03-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** When ASLR makes the difference *** --------------------------------------------- We wrote several times in this blog about the importance of enabling Address Space Layout Randomization mitigation (ASLR) in modern software because it's a very important defense mechanism that can increase the cost of writing exploits for attackers and in some cases prevent reliable exploitation. In today's blog, we'll go through ASLR one more time to show in practice how it can be valuable to mitigate two real exploits seen in the wild and to suggest solutions for programs... --------------------------------------------- http://blogs.technet.com/b/srd/archive/2014/03/11/when-aslr-makes-the-diffe… *** Zeus-in-the-mobile variant uses security firms name to gain victims trust *** --------------------------------------------- Android users are tricked into installing a spurious "security" app, which allows fraudsters to bypass one-time password authentication for online banking. --------------------------------------------- http://feedproxy.google.com/~r/SCMagazineHome/~3/uCKACIRIxoI/ *** BB10s dated crypto lets snoops squeeze the juice from your BlackBerry *** --------------------------------------------- BEAST will attack your sensitive web traffic, warns poster BlackBerry BB10 OS uses dated protocols that leave users at risk to known cryptographic attacks, according to a security researcher. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/03/12/bb10_dated_… *** WhatsApp erweitert Einstellungen zur Privatsphäre und bleibt trotzdem unsicher *** --------------------------------------------- Der Schutz der Privatsphäre bleibt in WhatsApp löchrig: Zwar können andere Nutzer durch das neueste Update nicht mehr sehen, wann man zuletzt im Chat online war, aber die Chats können wohl komplett durch andere Android-Apps ausgelesen werden. --------------------------------------------- http://www.heise.de/security/meldung/WhatsApp-erweitert-Einstellungen-zur-P… *** iOS 7.1: Innenraumortung iBeacon schwerer abzustellen *** --------------------------------------------- Nach dem Update auf Apples jüngsten Mobilbetriebssystem reicht es nicht aus, eine Anwendung, die das Indoor-Tracking nutzt, zu schließen - selbst nach einem Geräteneustart funkt iBeacon fleißig weiter. --------------------------------------------- http://www.heise.de/security/meldung/iOS-7-1-Innenraumortung-iBeacon-schwer… *** Is it the ISPs Fault if Your Home Broadband Router Gets Hacked? *** --------------------------------------------- As consumers we have a right to be huffy at our ISPs when something goes wrong. But is the Internet provider still to blame if, as in the recent cases of AAISP and now PlusNet, your home broadband router ends up being hijacked by a DNS redirection exploit? --------------------------------------------- http://www.ispreview.co.uk/index.php/2014/03/isps-fault-home-broadband-rout… *** Blog: Agent.btz: a source of inspiration? *** --------------------------------------------- The past few days has seen an extensive discussion within the IT security industry about a cyberespionage campaign called Turla, aka Snake and Uroburos, which, according to G-DATA experts, may have been created by Russian special services. --------------------------------------------- http://www.securelist.com/en/blog/8191/Agent_btz_a_source_of_inspiration *** Yokogawa CENTUM CS 3000 Vulnerabilities *** --------------------------------------------- Juan Vazquez of Rapid7 Inc.,a and independent researcher Julian Vilas Diaz have identified several buffer overflow vulnerabilities and released proof-of-concept (exploit) code for the Yokogawa CENTUM CS 3000 application. CERT/CC, NCCIC/ICS-CERT, and JPCERT have coordinated with Rapid7 and Yokogawa to mitigate these vulnerabilities. --------------------------------------------- http://ics-cert.us-cert.gov/advisories/ICSA-14-070-01 *** SSA-456423 (Last Update 2014-03-12): Vulnerabilities in SIMATIC S7-1500 CPU *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** VMSA-2014-0002 *** --------------------------------------------- VMware vSphere updates to third party libraries --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2014-0002.html *** Apple Safari OSX code execution *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/91654 *** WordPress WP SlimStat Plugin URL Script Insertion Vulnerability *** --------------------------------------------- https://secunia.com/advisories/57305 *** Bugtraq: CORE-2014-0002 - Oracle VirtualBox 3D Acceleration Multiple Memory Corruption Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/archive/1/531418 *** Vuln: MediaWiki text Prameter HTML Injection Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/65906 *** Vuln: MediaWiki CVE-2014-2242 Cross Site Scripting Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/65910 *** [webapps] - ZyXEL Router P-660HN-T1A - Login Bypass *** --------------------------------------------- http://www.exploit-db.com/exploits/32204

1 0

Tageszusammenfassung - Dienstag 11-03-2014
by Daily end-of-shift report 11 Mar '14

11 Mar '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 10-03-2014 18:00 − Dienstag 11-03-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** A clear-eyed guide to Mac OSs actual security risks *** --------------------------------------------- Apple has improved its security in recent years, but is it enough? --------------------------------------------- http://www.csoonline.com/article/749495/a-clear-eyed-guide-to-mac-os-s-actu… *** CanSecWest Presenter Self-Censors Risky Critical Infrastructure Talk *** --------------------------------------------- Researcher Eric Filiol withdrew his presentation from this weeks CanSecWest conference because of concerns the information could be used to attack critical infrastructure worldwide. --------------------------------------------- http://threatpost.com/cansecwest-presenter-self-censors-risky-critical-infr… *** More Than 162,000 WordPress Sites Used for Distributed Denial of Service Attack *** --------------------------------------------- Distributed Denial of Service (DDOS) attacks are becoming a common trend on our blog lately, and that's OK because it's a very serious issue for every website owner. Today I want to talk about a large DDOS attack that leveraged thousands of unsuspecting WordPress websites as indirect amplification vectors. Any WordPress site with XML-RPC enabled... --------------------------------------------- http://blog.sucuri.net/2014/03/more-than-162000-wordpress-sites-used-for-di… *** Can this $70 dongle stem the epidemic of password breaches? *** --------------------------------------------- Maybe not, but its approach could improve the security of password databases. --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/TIJ7a8DsSVY/ *** Careto and OS X Obfuscation *** --------------------------------------------- Last month, security researchers released a report about a targeted attack operation which they named Careto, or Mask in Spanish. The attack was noted for encoding its configuration data and encrypting its network traffic, making analysis more difficult. However, the capabilities of the Mac malware used in Careto was not as sophisticated as its Windows... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/tLQMNa8HgFc/ *** Saboteurs slip Dendroid RAT into Google Play *** --------------------------------------------- Google quickly removed the malware, which was reportedly disguised as a legitimate parental control app, from its marketplace. --------------------------------------------- http://www.scmagazine.com/saboteurs-slip-dendroid-rat-into-google-play/arti… *** Ein Drittel aller Zertifikats-Herausgeber nur Security-Ballast *** --------------------------------------------- Bei einer Untersuchung von 48 Millionen SSL-Zertifikaten stellten Forscher fest, dass jeder dritte Herausgeber kein einziges HTTPS-Zertifikat ausgestellt hat. Diese Schläfer-CAs sind ein beträchtliches Sicherheitsrisiko, das man leicht entschärfen könnte. --------------------------------------------- http://www.heise.de/security/meldung/Ein-Drittel-aller-Zertifikats-Herausge… *** Download: Threat Report *** --------------------------------------------- Our Threat Report covering the second half of 2013 (with some forecasting of 2014) was released last week.Youll find it, and all of our previous reports in the Labs section of f-secure.com. On 10/03/14 At 06:24 PM --------------------------------------------- http://www.f-secure.com/weblog/archives/00002681.html *** Verschlüsselung: Snowden empfiehlt Textsecure und Redphone *** --------------------------------------------- Edward Snowden lobt in der Diskussion auf der SXSW Openwhispersystems und dessen Entwickler Moxie Marlinspike für die Veröffentlichung einfach zu nutzender Verschlüsselungstools. --------------------------------------------- http://www.golem.de/news/verschluesselung-snowden-empfiehlt-textsecure-und-… *** iOS 7.1: Apple stopft zahlreiche Sicherheitslücken *** --------------------------------------------- Mit dem jüngsten Update behebt Apple über zwei Dutzend teils kritische Fehler in seinem Mobilbetriebssystem. Ein Jailbreak ist nun nicht mehr möglich. --------------------------------------------- http://www.heise.de/security/meldung/iOS-7-1-Apple-stopft-zahlreiche-Sicher… *** Team Cymrus SOHO Pharming Whitepaper *** --------------------------------------------- UPDATE: Here is the video for our SOHO Pharming Update of March 11, 2014. This update discusses the results of our SOHO Pharming Whitepaper release as well as further developments on that topic. If youve navigated to this site from an external source and are seeking the download of the SOHO Pharming Whitepaper, please scroll down on this page. Thanks for watching and feel free to share with your colleagues and friends! --------------------------------------------- https://www.team-cymru.com/ReadingRoom/Whitepapers/SOHOPharming.html *** Microsoft Security Bulletin Summary for March 2014 *** --------------------------------------------- This bulletin summary lists security bulletins released for March 2014. With the release of the security bulletins for March 2014, this bulletin summary replaces the bulletin advance notification originally issued March 6, 2014. --------------------------------------------- http://technet.microsoft.com/en-us/security/bulletin/ms14-mar *** Security updates available for Adobe Flash Player *** --------------------------------------------- Adobe has released security updates for Adobe Flash Player 12.0.0.70 and earlier versions for Windows and Macintosh and Adobe Flash Player 11.2.202.341 and earlier versions for Linux. These updates address important vulnerabilities, and Adobe recommends users update their product installations to the latest versions: ... --------------------------------------------- http://helpx.adobe.com/security/products/flash-player/apsb14-08.html *** TA14-069A: Microsoft Ending Support for Windows XP and Office 2003 *** --------------------------------------------- Original release date: March 10, 2014 Systems Affected Microsoft Windows XP with Service Pack 3 (SP3) Operating SystemMicrosoft Office 2003 Products Overview Microsoft is ending support for the Windows XP operating system and Office 2003 product line on April 8, 2014. [1] After this date, these products will no longer receive:Security patches which help protect PCs from harmful viruses, spyware, and other malicious softwareAssisted technical support from MicrosoftSoftware and content updates... --------------------------------------------- https://www.us-cert.gov/ncas/alerts/TA14-069A-0 *** Asterisk - Multiple Vulnerabilities *** --------------------------------------------- Asterisk PJSIP Channel Drive Bug Lets Remote Users Deny Service Asterisk chan_sip File Descriptor Flaw Lets Remote Authenticated Users Deny Service Asterisk HTTP Header Cookie Processing Overflow Lets Remote Users Deny Service Asterisk PJSIP Channel Driver Subscription Handling Bug Lets Remote Users Deny Service --------------------------------------------- http://www.securitytracker.com/id/1029892 http://www.securitytracker.com/id/1029891 http://www.securitytracker.com/id/1029890 http://www.securitytracker.com/id/1029893 *** FreeType Buffer Overflow in CFF Driver Lets Remote Users Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1029895 *** D-Link DIR-600 Cross-Site Request Forgery Vulnerability *** --------------------------------------------- https://secunia.com/advisories/57304 *** D-Link DSL-2640U Cross-Site Request Forgery Vulnerability *** --------------------------------------------- https://secunia.com/advisories/57269 *** Bugtraq: Android Vulnerability: Install App Without User Explicit Consent *** --------------------------------------------- http://www.securityfocus.com/archive/1/531394 *** IBM Security Bulletin: IBM SPSS SamplePower vsflex8l ActiveX Control ComboList Property Remote Code Execution Vulnerability (CVE-2014-0895) *** --------------------------------------------- There is security vulnerability with an ActiveX control shipped by IBM SPSS SamplePower Version 3.0.1. This is corrected in the IBM SPSS SamplePower product Interim Fix. CVE(s): CVE-2014-0895 Affected product(s) and affected version(s): IBM SPSS SamplePower for Windows V3.0.1 Refer to the following reference URLs for remediation and additional vulnerability details: Source Bulletin: http://www-01.ibm.com/support/docview.wss?uid=swg21666790 X-Force Database: --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletin: Download of Code Without Integrity Check vulnerability in IBM Security AppScan Standard (CVE-2014-0904) *** --------------------------------------------- IBM Security AppScan Standard can be affected a vulnerability in the update process that could allow remote code injection. CVE(s): CVE-2014-0904 Affected product(s) and affected version(s): IBM Security AppScan Standard 8.8 IBM Security AppScan Standard 8.7 IBM Security AppScan Standard 8.6 IBM Rational AppScan Standard 8.5 IBM Rational AppScan Standard 8.0 IBM Rational AppScan Standard 7.9 Refer to the following reference URLs for remediation and additional vulnerability details: --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** HPSBGN02970 rev.1 - HP Rapid Deployment Pack (RDP) or HP Insight Control Server Deployment, Multiple Remote Vulnerabilities affecting Confidentiality, Integrity and Availability *** --------------------------------------------- Potential vulnerabilities have been identified with HP Rapid Deployment Pack (RDP) or HP Insight Control Server Deployment. The vulnerabilities could be exploited remotely affecting confidentiality, integrity and availability. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** HPSBMU02947 rev.1 - HP System Management Homepage (SMH) Running on Linux and Windows, Remote Disclosure of Information and Cross-Site Request Forgery (CSRF) *** --------------------------------------------- Potential security vulnerabilities have been identified with HP System Management Homepage (SMH) running on Linux and Windows. The vulnerabilities could be exploited remotely resulting in disclosure of information or cross-site request forgery (CSRF). --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** HPSBMU02948 rev.1 - HP Systems Insight Manager (SIM) Running on Linux and Windows, Remote Execution of Arbitrary Code, Denial of Service (DoS), Disclosure of Information *** --------------------------------------------- Potential security vulnerabilities have been identified with HP Systems Insight Manager (SIM) running on Linux and Windows. The vulnerabilities could be exploited remotely resulting in execution of arbitrary code, Denial of Service (DoS), or disclosure of information. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** HPSBUX02976 SSRT101236 rev.1 - HP-UX Running NFS rpc.lockd, Remote Denial of Service (DoS) *** --------------------------------------------- A potential security vulnerability has been identified with HP-UX running NFS rpc.lockd. The vulnerability could be exploited remotely to create a Denial of Service (DoS). --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_…

1 0

Tageszusammenfassung - Montag 10-03-2014
by Daily end-of-shift report 10 Mar '14

10 Mar '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 07-03-2014 18:00 − Montag 10-03-2014 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Experts analyze Snake, Uroburos malware samples dating back to 2006 *** --------------------------------------------- Researchers with BAE Systems Applied Intelligence have determined that a possibly Russian-fueled malware campaign known as Snake, or Uroburos, may actually date back as far as 2006. --------------------------------------------- http://www.scmagazine.com/experts-analyze-snake-uroburos-malware-samples-da… *** SSL-Verschlüsselung auch in iOS-Apps problematisch *** --------------------------------------------- Nicht nur bei Android-Apps - auch im iPhone-Universum erweisen sich die Datenverbindungen von Apps recht oft als angreifbar. Rund 14 Prozent der iOS-Apps, die SSL einsetzen konnte ein Forscherteam austricksen. --------------------------------------------- http://www.heise.de/newsticker/meldung/SSL-Verschluesselung-auch-in-iOS-App… *** iOS Security *** --------------------------------------------- iOS is designed with comprehensive security that offers enterprise-grade protection of corporate data. Learn more about the advanced security features of iOS in this security guide. --------------------------------------------- https://ssl.apple.com/iphone/business/docs/iOS_Security_Feb14.pdf *** ETH40G: Verschlüsselung mit 40 Gigabit pro Sekunde *** --------------------------------------------- Mit dem ETH40G aus der SITLine-Reihe verspricht Rohde & Schwarz einen hohen verschlüsselten Datendurchsatz mit 40 Gigabit pro Sekunde in breitbandigen Netzen. --------------------------------------------- http://www.golem.de/news/eth40g-verschluesselung-mit-40-gigabit-pro-sekunde… *** Linux kernel IPv6 crash due to router advertisement flooding *** --------------------------------------------- Topic: Linux kernel IPv6 crash due to router advertisement flooding Risk: Medium Text:The Linux kernel is vulnerable to a crash on hosts that accept router advertisements. An unlimited number of routes can be cre... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014030061 *** OpenVZ update for kernel *** --------------------------------------------- OpenVZ has issued an update for the kernel. This fixes a weakness and a vulnerability, which can be exploited by malicious, local users in a guest virtual machine to potentially disclose sensitive information and by malicious, local users to cause a DoS (Denial of Service). --------------------------------------------- https://secunia.com/advisories/57300 *** FFmpeg Multiple Vulnerabilities *** --------------------------------------------- Some vulnerabilities have been reported in FFmpeg, which can be exploited by malicious people to cause a DoS (Denial of Service) and compromise an application using the library. --------------------------------------------- https://secunia.com/advisories/56866 *** Multiple vulnerabilities in current releases of the IBM SDK, Java Technology Edition. *** --------------------------------------------- Multiple vulnerabilities in current releases of the IBM SDK, Java Technology Edition. CVE(s): CVE-2014-0428, CVE-2014-0422, CVE-2013-5907, CVE-2014-0415, CVE-2014-0410, CVE-2013-5889, CVE-2014-0417, CVE-2014-0387, CVE-2014-0424, CVE-2013-5878, CVE-2014-0373, CVE-2014-0375, CVE-2014-0403, CVE-2014-0423, CVE-2014-0376, CVE-2013-5910, CVE-2013-5884, CVE-2013-5896, CVE-2013-5899, CVE-2014-0416, CVE-2013-5887, CVE-2014-0368, CVE-2013-5888, CVE-2013-5898 and CVE-2014-0411 Affected product(s) --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/multiple_vulnerabilit… *** Vuln: PHP Fileinfo Component Out of Bounds Memory Corruption Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/66002

1 0

Tageszusammenfassung - Freitag 7-03-2014
by Daily end-of-shift report 07 Mar '14

07 Mar '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 06-03-2014 18:00 − Freitag 07-03-2014 18:00 Handler: Robert Waldner Co-Handler: n/a *** The Snake Campaign *** --------------------------------------------- This new report from BAE Systems Applied Intelligence today provides further details on how the recently disclosed ‘Snake’ cyber espionage toolkit operates. Timelines of the malware development show this to be much bigger campaign than previously known. Specifically it reveals that the malware has actually been in development since at least 2005. From the complexity of the malware, and the range of variants and techniques used to support its operation, the research also suggests that --------------------------------------------- http://www.baesystems.com/what-we-do-rai/the-snake-campaign *** Diffie-Hellman: Unsinnige Krypto-Parameter *** --------------------------------------------- Ein kurzer Schlüsselaustausch bringt Chrome zum Absturz, andere Browser akzeptieren völlig unsinnige Parameter für einen Diffie-Hellman-Schlüsselaustausch. Im Zusammenhang mit den jüngst gefundenen TLS-Problemen könnte das ein Sicherheitsrisiko sein. (Opera, Firefox) --------------------------------------------- http://www.golem.de/news/diffie-hellman-unsinnige-krypto-parameter-1403-104… *** Shedding New Light on Tor-Based Malware *** --------------------------------------------- Researchers at Kaspersky Lab and Microsoft have shared new insight into how malware campaigns operate over the Tor anonymity network, as well as other darknets. --------------------------------------------- http://threatpost.com/shedding-new-light-on-tor-based-malware/104651 *** EMC Documentum TaskSpace privilege escalation *** --------------------------------------------- EMC Documentum TaskSpace could allow a remote attacker to gain elevated privileges on the system, caused by an error related to the way dm_world group users were added to the dm_superusers_dynamic group. An attacker could exploit this vulnerability to gain elevated privileges on the system. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/91600 *** Multiple Cisco Wireless LAN Controllers WebAuth denial of service *** --------------------------------------------- Multiple Cisco Wireless LAN Controllers are vulnerable to a denial of service, caused by the failure to deallocate memory used during the processing of a WebAuth login. By creating an overly large number of WebAuth requests, an attacker could exploit this vulnerability to cause the device to reboot. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/91602 *** New Tool Makes Android Malware Easier To Create *** --------------------------------------------- itwbennett writes "A new commercial tool designed to allow cybercriminals to easily transform legitimate Android applications into malicious software has hit the underground market, paving the way for cheap and easy development of sophisticated Android malware. Security researchers from Symantec said Wednesday in a blog post that the tool, called Dendroid, is marketed by its creators as an Android remote administration tool (RAT) and is being sold for $300." Read more of this story --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/lUI1_mGPycM/story01.htm *** The Siesta Campaign: A New Targeted Attack Awakens *** --------------------------------------------- In the past few weeks, we have received several reports of targeted attacks that exploited various application vulnerabilities to infiltrate various organizations. Similar to the Safe Campaign, the campaigns we noted went seemingly unnoticed and under the radar. The attackers orchestrating the campaign we call the Siesta Campaign used multicomponent malware to target certain institutions that […]Post from: Trendlabs Security Intelligence Blog - by Trend MicroThe Siesta Campaign: A New --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/-rYSWuRUzdQ/ *** Gameover trojan uses rootkit to remain stealthy, tougher to remove *** --------------------------------------------- Researchers have discovered a Gameover variant of the Zeus trojan that has been modified to include the Necurs rootkit, which makes the malware tougher to detect and remove by protecting files on the disk and memory. --------------------------------------------- http://feedproxy.google.com/~r/SCMagazineHome/~3/F6bJXyUofvI/ *** Apache Struts Bugs Let Remote Users Deny Service and Manipulate the ClassLoader *** --------------------------------------------- A remote user can supply specially crafted 'class' parameter values to the ParametersInterceptor class to manipulate the ClassLoader [CVE-2014-0094]. A remote user can send a multipart request with a specially crafted Content-Type header to to trigger a flaw in the Apache Commons FileUpload component and cause denial of service conditions [CVE-2014-0050]. --------------------------------------------- http://www.securitytracker.com/id/1029876 *** Linux Memory Dump with Rekall, (Fri, Mar 7th) *** --------------------------------------------- Memory dumping for incident response is nothing new, but ever since they locked down access to direct memory (/dev/mem) on Linux, I’ve had bad experiences dumping memory. I usually end up crashing the server about 60 percent of the time while collecting data with Fmem. A new version of Linux memory dumping utility rekall (previous called Winpmem) has recently came out. I’ve been testing it on the latest versions of Ubuntu and Redhat EL 5 and have not run into any issues with --------------------------------------------- http://isc.sans.edu/diary.html?storyid=17775&rss *** Citrix NetScaler Application Delivery Controller Multiple Flaws Let Users Gain Elevated Privileges and Deny Service *** --------------------------------------------- Several vulnerabilities were reported in Citrix NetScaler Application Delivery Controller. A local user can obtain passwords. A user can gain elevated privileges. A remote user can conduct cross-site scripting and cross-site request forgery attacks. A user can cause denial of service conditions. --------------------------------------------- http://www.securitytracker.com/id/1029880 *** February 2014 virus activity review from Doctor Web *** --------------------------------------------- February 28, 2014 Although it’s the years shortest month, February proved to be quite eventful in terms of information security. In particular, Doctor Webs security researchers discovered several Trojans that replace browser window banners and steal confidential information. Also identified were new malignant programs targeting Android. Viruses According to statistics collected in February 2014 by Dr.Web CureIt!, Trojan.Packed.24524, which spreads in the guise of legitimate software, was --------------------------------------------- http://news.drweb.com/show/?i=4262&lng=en&c=9 *** ownCloud 4.0.x / 4.5.x Remote Code Execution *** --------------------------------------------- Topic: ownCloud 4.0.x / 4.5.x Remote Code Execution Risk: High Text:Vulnerability title: Remote Code Execution in ownCloud CVE: CVE-2014-2044 Vendor: ownCloud Product: ownCloud Affected versi... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014030055 *** WordPress Premium Gallery Manager Shell Upload *** --------------------------------------------- Topic: WordPress Premium Gallery Manager Shell Upload Risk: High Text: Wordpress Plugins Premium Gallery Manager Arbitrary File Upload ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014030053 *** [2014-03-07] Unauthenticated access & manipulation of settings in Huawei E5331 MiFi mobile hotspot *** --------------------------------------------- Unauhenticated attackers are able to gain access to sensitive configuration (e.g. WLAN passwords in clear text or IMEI information of the SIM card) and even manipulate all settings in the web administration interface! This can even be exploited remotely via Internet depending on the mobile operator setup or via CSRF attacks. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2014… *** HP-UX m4(1) Command Flaw Lets Local Users Gain Elevated Privileges *** --------------------------------------------- A vulnerability was reported in HP-UX. A local user can obtain elevated privileges on the target system. A local user can exploit an unspecified flaw in the HP-UX m4(1) command to gain elevated privileges. --------------------------------------------- http://www.securitytracker.com/id/1029881 *** Hack gegen AVM-Router: Fritzbox-Lücke offengelegt, Millionen Router in Gefahr *** --------------------------------------------- Die Schonfrist ist abgelaufen: Im Netz kursieren Details, wie man die kritische Schwachstelle in den Fritzboxen ausnutzt. Das bedeutet akute Gefahr, da nach Erkenntnissen von heise Security noch immer sehr viele AVM-Router verwundbar sind. --------------------------------------------- http://www.heise.de/security/meldung/Hack-gegen-AVM-Router-Fritzbox-Luecke-… *** ComiXology gehackt: User müssen Passwort ändern *** --------------------------------------------- Die größte digitale Comics-Plattform ComiXology wurde Opfer eines unerlaubten Zugriffs auf Datenbanken mit Usernamen, E-Mailinfos und verschlüsselten Passwörtern. --------------------------------------------- http://futurezone.at/digital-life/comixology-gehackt-user-muessen-passwort-… *** Via Drucker ins Netz: PDF-Trojaner verwandelt IP-Telefone in Wanzen *** --------------------------------------------- Ausschließlich durch Missbrauch von Lücken in Geräten wie Netzwerkdruckern oder VoIP-Telefonen können Angreifer ein Netzwerk attackieren. Demonstriert wurde, wie sich die Telefone in Wanzen verwandeln lassen. --------------------------------------------- http://www.heise.de/newsticker/meldung/Via-Drucker-ins-Netz-PDF-Trojaner-ve… *** Microsoft Security Bulletin Advance Notification for March 2014 *** --------------------------------------------- * Remote Code Execution Microsoft Windows,Internet Explorer * Remote Code Execution Microsoft Windows * Elevation of Privilege Microsoft Windows * Security Feature Bypass Microsoft Windows * Security Feature Bypass Microsoft Silverlight --------------------------------------------- http://technet.microsoft.com/en-us/security/bulletin/ms14-mar *** PHP 5.4.26 and 5.5.10 available. Several Security Fixes @ : http://www.php.net/downloads.php, (Fri, Mar 7th) *** --------------------------------------------- PHP 5.4.26 and 5.5.10 available. Several Security Fixes @ : http://www.php.net/downloads.php -- Tom Webb (c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. --------------------------------------------- http://isc.sans.edu/diary.html?storyid=17777&rss *** Windows XP: Bundesregierung sorgt sich um Sicherheit von Geldautomaten *** --------------------------------------------- Zum 8. April läuft Microsofts Support für Windows XP aus. Darum hält es das BSI laut Innenministerium für geboten, aktuelle Betriebssysteme einzusetzen, die mit Sicherheitsupdates versorgt werden. --------------------------------------------- http://www.heise.de/newsticker/meldung/Windows-XP-Bundesregierung-sorgt-sic… *** New Attacks on HTTPS Traffic Reveal Plenty About Your Web Surfing *** --------------------------------------------- Researchers at UC Berkeley have developed new attacks that analyze HTTPS traffic and can accurately determine what pages youve visited during an encrypted session. --------------------------------------------- http://threatpost.com/new-attacks-on-https-traffic-reveal-plenty-about-your… *** Open-Source-CMS: Sicherheitsupdate für Joomla *** --------------------------------------------- Das Joomla-Entwicklerteam hat ein Sicherheitsupdate für die beiden aktuell unterstützten Versionszweige des Open-Source-CMS veröffentlicht. Joomla 2.5.19 und Joomla 3.2.3 sollen kürzlich entdeckte Schwachstellen des Content Management Systems stopfen. --------------------------------------------- http://www.heise.de/newsticker/meldung/Open-Source-CMS-Sicherheitsupdate-fu… *** FFmpeg Multiple Vulnerabilities *** --------------------------------------------- Multiple vulnerabilities have been reported in FFmpeg, which can be exploited by malicious people to cause a DoS (Denial of Service) in an application using the library. --------------------------------------------- https://secunia.com/advisories/57282 *** Security Bulletin: Multiple vulnerabilities in IBM QRadar SIEM (CVE-2014-0838, CVE-2014-0835, CVE-2014-0836, CVE-2014-0837) *** --------------------------------------------- Multiple vulnerabilities exist in the AutoUpdate settings page and the AutoUpdate process within the IBM QRadar SIEM that when used together could result in remote code execution. CVE(s): CVE-2014-0835, CVE-2014-0836, CVE-2014-0837, and CVE-2014-0838 Affected product(s) and affected version(s): IBM QRadar Security Information and Event Manager (SIEM) 7.2 MR1 and earlier Refer to the following reference URLs for remediation and additional vulnerability details: Source Bulletin: --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_mul… *** Security Bulletin: Information regarding security vulnerability in IBM SDK Java™ Technology Edition that is shipped with IBM WebSphere Application Server and addressed by Oracle CPU January 2014 *** --------------------------------------------- Multiple security vulnerabilities exist in the IBM SDK Java Technology Edition that is shipped with IBM WebSphere Application Server and included in the products that are listed in this document. CVE(s): CVE-2014-0411 Affected product(s) and affected version(s): WebSphere Process Server V6.1.2, 6.2.x, 7.0.x WebSphere Process Server on z/OS V6.2.x, 7.0.x WebSphere Process Server Hypervisor Edition for Red Hat Enterprise Linux Server for x86 (32-bit) V7.0.0 WebSphere Process Server Hypervisor --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_inf…

1 0

Tageszusammenfassung - Donnerstag 6-03-2014
by Daily end-of-shift report 06 Mar '14

06 Mar '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 05-03-2014 18:00 − Donnerstag 06-03-2014 18:00 Handler: Alexander Riepl Co-Handler: Stephan Richter *** Apple OpenSSL Verification Surprises *** --------------------------------------------- Apple ships a patched version of OpenSSL with OS X. If no precautions are taken, their changes rob you of the power to choose your trusted CAs, and break the semantics of a callback that can be used for custom checks and verifications in client software. --------------------------------------------- https://hynek.me/articles/apple-openssl-verification-surprises/ *** Sefnit's Tor botnet C&C details *** --------------------------------------------- We have talked about the impact that resulted from the Sefnit botnet Tor hazard as well as the clean-up effort that went into that threat. In this post we'd like to introduce some of the details regarding the Tor component's configuration and its communication with the Tor service. Specifically, we'll talk about how Trojan:Win32/Sefnit.AT communicates with the Tor network, what domains it tries to contact, and where it keeps its configuration data. After Sefnit... --------------------------------------------- https://blogs.technet.com/b/mmpc/archive/2014/03/05/sefnit-s-tor-botnet-c-a… *** Cisco-Router mit Passwörtern im Quellcode des Web-Interfaces *** --------------------------------------------- In zwei Routern und einer Firewall von Cisco klafft eine Sicherheitslücke, die es Angreifern erlaubt, sich mit Administratorrechnern anzumelden. Die Geräte geben die Passwörter im Quelltext des Anmeldefensters preis. --------------------------------------------- http://www.heise.de/security/meldung/Cisco-Router-mit-Passwoertern-im-Quell… *** Akute Angriffsserie auf D-Link-Modems *** --------------------------------------------- Tausende Internetanschlüsse sind aufgrund einer Sicherheitslücke in DSL-Modems von D-Link akut gefährdet - allein in Deutschland. Die Schwachstelle wird bereits systematisch für Angriffe missbraucht. Wer betroffene Geräte betreibt, muss umgehend handeln. --------------------------------------------- http://www.heise.de/security/meldung/Akute-Angriffsserie-auf-D-Link-Modems-… *** Joomla! Core - Multiple Vulnerabilities *** --------------------------------------------- http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/xcttKR2_t_4/578-20140301-c… http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/-FMP5B4UydI/579-20140302-c… http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/3SC6NBuk13g/580-20140303-c… http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/oiSyKvvYgXA/581-20140304-c… *** SA-CONTRIB-2014-028 - Masquerade - Access bypass *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2014-028Project: Masquerade (third-party module)Version: 6.x, 7.xDate: 2014-March-05Security risk: Highly criticalExploitable from: RemoteVulnerability: Access bypassDescriptionThis module allows a user with the right permissions to switch users. When a user has been limited to only masquerading as certain users via the "Enter the users this user is able to masquerade as" user profile field, they can still masquerade as any user on the site by using the... --------------------------------------------- https://drupal.org/node/2211401 *** Security Bulletins: Citrix NetScaler Application Delivery Controller Multiple Security Vulnerabilities *** --------------------------------------------- A number of security vulnerabilities have been identified in Citrix NetScaler Application Delivery Controller (ADC). --------------------------------------------- http://support.citrix.com/article/CTX139049 *** HP Data Protector Backup Client Service Remote Code Execution *** --------------------------------------------- Topic: HP Data Protector Backup Client Service Remote Code Execution Risk: High Text:## # This module requires Metasploit: http//metasploit.com/download # Current source: https://github.com/rapid7/metasploit-fr... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014030052 *** PHP date() is evil (XSS'able) *** --------------------------------------------- Topic: PHP date() is evil (XSS'able) Risk: Low Text:I was playing with PHP (As usual) and i was thinking about date() It's a PHP function that displays date in different ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014030046

1 0

Tageszusammenfassung - Mittwoch 5-03-2014
by Daily end-of-shift report 05 Mar '14

05 Mar '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 04-03-2014 18:00 − Mittwoch 05-03-2014 18:00 Handler: Alexander Riepl Co-Handler: Christian Wojner *** Windows XP: Microsoft drängt mit Popup zum Umstieg *** --------------------------------------------- Microsoft will XP-Nutzer direkter darauf hinweisen, dass der Support für das Betriebssystem endet. Zusätzlich soll die bislang kostenpflichtige Migrationshilfe PCmover Express umsonst bereit - das Angebot hat aber einen Pferdefuss. --------------------------------------------- http://www.heise.de/security/meldung/Windows-XP-Microsoft-draengt-mit-Popup… *** 69 Prozent der beliebtesten Android Apps funken im Klartext *** --------------------------------------------- Bei einer Untersuchung von 10,000 Android-Apps haben Forscher herausgefunden, dass die Mehrzahl ihre Datenverbindungen gar nicht verschlüsselt und weitere 26 Prozent SSL so einsetzen, dass die Verbindung angreifbar ist. --------------------------------------------- http://www.heise.de/security/meldung/69-Prozent-der-beliebtesten-Android-Ap… *** Geld her oder Seite weg: Erpressung mit DDoS-Angriff *** --------------------------------------------- Angreifer fordern Geld, um Attacken auf Seiten zu stoppen --------------------------------------------- http://derstandard.at/1392687169264 *** Blog: Tor hidden services - a safe haven for cybercriminals *** --------------------------------------------- http://www.securelist.com/en/blog/8187/Tor_hidden_services_a_safe_haven_for… *** Malware nutzt iTunes als Lockmittel *** --------------------------------------------- Nachgebaute iTunes-Seiten locken zur Installation der vermeintlichen Apple-Software - stattdessen erhält der Nutzer Malware. Prominent platzierte Suchmaschinenwerbung zum Begriff "iTunes" dient als Zubringer. --------------------------------------------- http://www.heise.de/security/meldung/Malware-nutzt-iTunes-als-Lockmittel-21… *** Apache Shiro 1.2.2 LDAP Authentication Bypass *** --------------------------------------------- Topic: Apache Shiro 1.2.2 LDAP Authentication Bypass Risk: High Text:Dear Apache Shiro Community, The Apache Shiro team has released Apache Shiro version 1.2.3. This is the third bug fix point... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014030034 *** Windows Escalate UAC Protection Bypass (In Memory Injection) *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2014030039 *** HPSBHF02965 rev.1 - HP Security Management System, Remote Execution of Arbitrary Code *** --------------------------------------------- A potential security vulnerability has been identified with HP Security Management System. The vulnerability could be remotely exploited to allow remote execution of arbitrary code. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** HPSBUX02973 SSRT101455 rev.1 - HP-UX Running Java6/7, Remote Unauthorized Access, Disclosure of Information, and Other Vulnerabilities *** --------------------------------------------- Potential security vulnerabilities have been identified in the Java Runtime Environment (JRE) and the Java Developer Kit (JDK) running on HP-UX. These vulnerabilities could allow remote unauthorized access, disclosure of information, and other vulnerabilities. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** WordPress Relevanssi Plugin "category_name" SQL Injection Vulnerability *** --------------------------------------------- https://secunia.com/advisories/56641 *** Java OpenID Server 1.2.1 XSS / Session Fixation *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2014030037 *** VU#823452: Serena Dimensions CM 12.2 Build 7.199.0 web client vulnerabilities *** --------------------------------------------- Serena Dimensions CM 12.2 Build 7.199.0 web client and possibly earlier versions contains multiple cross-site scripting vulnerabilities.CWE-79: Improper Neutralization of Input --------------------------------------------- http://www.kb.cert.org/vuls/id/823452

1 0

Tageszusammenfassung - Dienstag 4-03-2014
by Daily end-of-shift report 04 Mar '14

04 Mar '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 03-03-2014 18:00 − Dienstag 04-03-2014 18:00 Handler: Alexander Riepl Co-Handler: Stephan Richter *** TLS: Sicherheitslücke bei Client-Authentifizierung *** --------------------------------------------- Erneut gibt es Probleme mit dem TLS-Protokoll. Mit der Triple Handshake-Attacke kann ein bösartiger HTTPS-Server einem weiteren Server vorgaukeln, er hätte das Zertifikat eines Nutzers. Die meisten Anwender sind von dem Angriff vermutlich nicht betroffen. --------------------------------------------- http://www.golem.de/news/tls-sicherheitsluecke-bei-client-authentifizierung… *** Webspace: Sicherheitsrisiko FTP *** --------------------------------------------- Wer eine eigene Webseite betreibt, überträgt sie meist per FTP zum Webhoster. Dabei kommt häufig keine Verschlüsselung zum Einsatz. Kein einziger großer Provider weist seine Kunden auf diese Risiken adäquat hin; bei manchen Providern ist eine verschlüsselte Verbindung überhaupt nicht möglich. --------------------------------------------- http://www.golem.de/news/webspace-sicherheitsrisiko-ftp-1403-104889-rss.html *** Großangriff auf Router: DNS-Einstellungen manipuliert *** --------------------------------------------- Forscher entdeckten einen Großangriff auf Router: Bei über 300.000 Routern, die im Privat- oder Büroeinsatz sind, wurden angeblich die DNS-Einstellungen manipuliert. Die Angreifer hätten dadurch jederzeit den Datenverkehr der Geräte umleiten können. --------------------------------------------- http://www.heise.de/security/meldung/Grossangriff-auf-Router-DNS-Einstellun… *** Sicherheitslücke: GnuTLS jetzt mit "goto fail" *** --------------------------------------------- Auch die Open-Source-Bibliothek für gesicherte Verbindungen weist einen schwerwiegenden Fehler beim überprüfen von Zertifikaten auf. Aktuelle Patches sollen ihn beheben. --------------------------------------------- http://www.heise.de/security/meldung/Sicherheitsluecke-GnuTLS-jetzt-mit-got… *** GNUTLS-SA-2014-2 - Certificate Verification Issue *** --------------------------------------------- A vulnerability was discovered that affects the certificate verification functions of all gnutls versions. A specially crafted certificate could bypass certificate validation checks. --------------------------------------------- http://gnutls.org/security.html#GNUTLS-SA-2014-2 *** WordPress plugin Google Analytics MU 2.3 CSRF *** --------------------------------------------- Topic: WordPress plugin Google Analytics MU 2.3 CSRF Risk: Low Text:Details = Software: Google Analytics MU Version: 2.3 Homepage: http://wordpress.org/plugins/google-analytics-mu/ CVSS... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014030018 *** Joomla 3.2.2 Cross Site Scripting *** --------------------------------------------- Topic: Joomla 3.2.2 Cross Site Scripting Risk: Low Text:# == # Title ...| Persistent pre-auth XSS in Joomla # Version .| Joomla 3.2.2 # Date ....| 3.03.2014 #... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014030030

1 0

Tageszusammenfassung - Montag 3-03-2014
by Daily end-of-shift report 03 Mar '14

03 Mar '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 28-02-2014 18:00 − Montag 03-03-2014 18:00 Handler: Alexander Riepl Co-Handler: Christian Wojner *** Komplexe Spionagesoftware namens Uroburos entdeckt *** --------------------------------------------- Sicherheitsexperten von G Data haben eine mutmaßliche Geheimdienstsoftware entdeckt, die offenbar darauf abzielt, hochsensible und geheime Informationen von staatlichen Einrichtungen, Nachrichtendiensten und Großunternehmen zu stehlen. --------------------------------------------- http://www.heise.de/security/meldung/Komplexe-Spionagesoftware-namens-Urobu… Multiple vulnerabilities in Oracle Demantra 12.2.1 --------------------------------------------- http://cxsecurity.com/issue/WLB-2014030004 http://cxsecurity.com/issue/WLB-2014030007 http://cxsecurity.com/issue/WLB-2014030006 http://cxsecurity.com/issue/WLB-2014030005 *** Wo-möglich-Verschlüsselung für mehr Sicherheit *** --------------------------------------------- Harte Verschlüsselung oder nur Wo-möglich-Verschlüsselung gegen NSA und Konsorten? Darüber diskutierte der STRINT-Workshop der IETF und des W3C am Wochenende in London. --------------------------------------------- http://www.heise.de/security/meldung/Wo-moeglich-Verschluesselung-fuer-mehr… *** DSA-2868 php5 *** --------------------------------------------- denial of service --------------------------------------------- http://www.debian.org/security/2014/dsa-2868 *** WordPress VideoWhisper Live Streaming Plugin Multiple Cross-Site Scripting Vulnerabilities *** --------------------------------------------- https://secunia.com/advisories/57202 *** Apache Camel XSLT XML External Entities and Arbitrary Code Execution Vulnerabilities *** --------------------------------------------- https://secunia.com/advisories/57125 *** Hintergrund: VM-Erkennung in Malware *** --------------------------------------------- Die rote oder die blaue Pille? Immer mehr Schädlinge wollen wissen, ob ihre Umgebung echt oder nur virtuell ist. --------------------------------------------- http://www.heise.de/security/artikel/VM-Erkennung-in-Malware-2131459.html *** The Mobile Cybercriminal Underground Market in China *** --------------------------------------------- The availability of affordable mobile Internet access has changed the computing landscape everywhere. More and more people are using mobile devices both for work and for entertainment. China is no exception. According to a report published by the China Internet Network Information Center (CNNIC), 81% of Chinese Internet users went online using their mobile phone .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/the-mobile-cyber…

1 0

Tageszusammenfassung - Freitag 28-02-2014
by Daily end-of-shift report 28 Feb '14

28 Feb '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 27-02-2014 18:00 − Freitag 28-02-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Are Automated Update Services the Next Surveillance Frontier? *** --------------------------------------------- Automated update services that provide users with security patches and feature enhancements are also a potential hunting ground for intelligence agencies and law enforcement surveillance activity. --------------------------------------------- http://threatpost.com/are-automated-update-services-the-next-surveillance-f… *** DDoS and BCP 38, (Thu, Feb 27th) *** --------------------------------------------- Quite often on many lists we will hear the term Best Current Practice (BCP) 38 bandied about and further recommendations to implement [1] [2][3][4] (See NANOG Mailing list archive) . Some will say "it will aid in DDoS mitigation" and even others will even state "All Internet Service Providers (ISP) should implement this." Now before the philosophical discussions ensue in the comments, it might be a good idea to discuss, technically, what it is? And perhaps what it can do? --------------------------------------------- http://isc.sans.edu/diary.html?storyid=17735&rss *** Oversharing, (Fri, Feb 28th) *** --------------------------------------------- When ISC reader Michael contacted us about "odd UDP traffic from all over" that he was suddenly seeing in his firewall log, we at first assumed that his Internet connection had "inherited" a dynamic IP address that had before been used by a rampant file sharing user, and that Michael was now seeing the "after glow". We still asked for a PCAP (tcpdump) file though, and when we looked at what Michael sent back, we saw to our surprise... --------------------------------------------- http://isc.sans.edu/diary.html?storyid=17737&rss *** Highly Effective Joomla Backdoor with Small Profile *** --------------------------------------------- It feels like every day we're finding gems, or what appear to be gems to us. We try to balance the use of the term, but I can't lie, these are truly gems. The things they are doing, and by they I mean the attackers, are in some instance ingenious. I think you'll agree that... --------------------------------------------- http://blog.sucuri.net/2014/02/highly-effective-joomla-backdoor-with-small-… *** Tilon/SpyEye2 intelligence report *** --------------------------------------------- Tilon, son of Silon, or... SpyEye2 evolution of SpyEye? The malware family commonly known as Tilon has been around for several years now. While several public analysis reports have described the malware; no one has thus far linked it with the well-known SpyEye malware family. In light of the recent news of the guilty plea... --------------------------------------------- http://blog.fox-it.com/2014/02/25/tilonspyeye2-intelligence-report/ *** Malicious Proxy Auto-Config redirection *** --------------------------------------------- Internet banking credentials are a desired target for cybercriminals. They can be targeted with man-in-the-middle attacks or through password stealing trojans such as Fareit, Zbot or Banker. A less known, yet commonly found in South America and to a lesser extent in Russia, method to gain unauthorized access to a user's banking credentials is through malicious Proxy Auto-Config (PAC) files. Normally, PAC files offer similar functionality to the hosts file, allowing IP/website redirection,... --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2014/02/28/malicious-proxy-auto-con… *** Notorious "Gameover" malware gets itself a kernel-mode rootkit... *** --------------------------------------------- Zeus, also known as Zbot, is a malware family that we have written about many times on Naked Security... --------------------------------------------- http://nakedsecurity.sophos.com/2014/02/27/notorious-gameover-malware-gets-… *** [2014-02-28] Authentication bypass (SSRF) and local file disclosure in Plex Media Server *** --------------------------------------------- The Plex Media Server proxy functionality fails to properly validate pre-authentication user requests. This allows unauthenticated attackers to make the Plex Media Server execute arbitrary HTTP requests and hence bypass all authentication and execute commands with administrative privileges. Furthermore, because of insufficient input validation, arbitrary local files can be disclosed without prior authentication including passwords and other sensitive information. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2014… *** [2014-02-28] Privilege escalation vulnerability in MICROSENS Profi Line Modular Industrial Switch Web Manager *** --------------------------------------------- Attackers are able to elevate privileges during login from read-only user rights to full read/write or debug access rights by simply changing result values of the affected CGI script. This allows attackers to reconfigure the device. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2014… *** VU#534284: Synology DiskStation Manager VPN module hard-coded password vulnerability *** --------------------------------------------- Synology DiskStation Manager 4.3-3810 update 1 and possibly earlier versions contain a VPN server module which contains a hard-coded password which cannot be changed. According to the original forum post... --------------------------------------------- http://www.kb.cert.org/vuls/id/534284 *** Moodle 2.6.1 Cross Site Scripting *** --------------------------------------------- Topic: Moodle 2.6.1 Cross Site Scripting Risk: Low Text:# == # Title ...| Moodle 2.6.1 # Version .| (Feb 27 2014) moodle-latest-26.zip # Date ....| 27.02.2014... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014020247 *** Cisco IPS MainApp SNMP Denial of Service Vulnerability *** --------------------------------------------- A vulnerability in the SNMP code of Cisco Intrusion Prevention System (IPS) Software could allow an unauthenticated, remote attacker to cause the MainApp process to become unresponsive. This creates a denial of service (DoS) condition because the Cisco IPS sensor is not able to execute several critical tasks including alert notification, event store management, and sensor authentication. The Cisco IPS web server will also be unavailable while the MainApp process is unresponsive. Additionally, due to this general system failure, other processes such as the Analysis Engine may not function properly. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco Unified Communications Domain Manager Cross-Site Scripting Vulnerability *** --------------------------------------------- A vulnerability in the web framework of Cisco Unified Communications Domain Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface on the affected system. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Schneider Electric Floating License Manager Vulnerability *** --------------------------------------------- Schneider Electric had become aware of an "unquoted service path" vulnerability in the Schneider Electric Floating License Manager, produced a patch that mitigates this vulnerability, and notified NCCIC/ICS-CERT. --------------------------------------------- http://ics-cert.us-cert.gov/advisories/ICSA-14-058-01 *** Schneider Electric OFS Buffer Overflow Vulnerability *** --------------------------------------------- Schneider Electric has reported to NCCIC/ICS-CERT a Stack Buffer Overflow vulnerability supplied with the Schneider Electric OPC Factory Server (OSF). --------------------------------------------- http://ics-cert.us-cert.gov/advisories/ICSA-14-058-02

1 0

Tageszusammenfassung - Donnerstag 27-02-2014
by Daily end-of-shift report 27 Feb '14

27 Feb '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 26-02-2014 18:00 − Donnerstag 27-02-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Avaya to Patch Zero Days That Turn IP Phone into Radio Transmitters *** --------------------------------------------- Avaya is expected to patch zero-day vulnerabilities in its latest one-X IP phones. The vulnerabilities and an exploit will be demonstrated this week at RSA Conference 2014. --------------------------------------------- http://threatpost.com/avaya-to-patch-zero-days-that-turn-ip-phone-in-radio-… *** Detecting malware on Mac OS X with USM and MIDAS *** --------------------------------------------- Let's briefly review what we accomplished in the first post: Understood the capabilities and design of MIDAS Deployed MIDAS on a Mac OS X endpoint installed the MIDAS plugin in AlienVault USM Verified the integration by running MIDAS and confirming the events in the SIEM. How does this make us safer? More generally, what does this mean? To answer these questions we need to understand what plists and kexts mean from a security perspective. PlistsProperty list files contain configuration data... --------------------------------------------- http://www.alienvault.com/open-threat-exchange/blog/detecting-malware-on-ma… *** Ongoing NTP Amplification Attacks, (Wed, Feb 26th) *** --------------------------------------------- Brett, who alerted us earlier this month regarding the mass exploit against Linksys devices has surfaced a current issue hes facing with ongoing NTP amplification attacks. A good US-CERT summary of the attack is here: https://www.us-cert.gov/ncas/alerts/TA14-013A. Brett indicates that: "We are seeing massive attacks on our NTP servers, attempting to exploit the traffic amplification vulnerability reported last month. Our IPs are being probed by an address in the Netherlands, and a couple... --------------------------------------------- http://isc.sans.edu/diary.html?storyid=17723&rss *** Yes, You Too Can Be An Evil Network Overlord - On The Cheap With OpenBSD, pflow And nfsen *** --------------------------------------------- Have you ever wanted to know whats really going on in your network? Some free tools with surprising origins can help you to an almost frightening degree.One question I get a lot (or variants that end up being very close) is, "How do you keep up with whats happening in your network?". A close cousin is "how much do you actually know about your users?".The exact answer to both can have legal implications, so before I proceed to the tech content, Ill ask you to make sure you... --------------------------------------------- http://bsdly.blogspot.com/2014/02/yes-you-too-can-be-evil-network.html *** Weekly Metasploit Update: Encoding-Fu, New Powershell Payload, Bug Fixes *** --------------------------------------------- In this week's Metasploit weekly update, we begin with OJ TheColonial Reeves' new optimized sub encoding module (opt_sub.rb). As the name implies, this encoder takes advantage of the SUB assembly instruction to encode a payload with printable characters that are file path friendly. Encoders like this are incredibly useful for developing a memory corruption exploit... --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2014/02/26/weekly-me… *** Security: Cisco öffnet Snort-Schnittstelle *** --------------------------------------------- Wenige Wochen nach der Übernahme des Snort-Entwicklers Sourcefire hat Cisco die Schnittstelle zu dem Intrusion Detection System unter dem Namen OpenAppID öffentlich gemacht. Zudem wurde der Malware-Schutz des aufgekauften Unternehmens in Ciscos Sicherheitsportfolio integriert. --------------------------------------------- http://www.golem.de/news/security-cisco-oeffnet-snort-schnittstelle-1402-10… *** Mac OS X 10.6 Snow Leopard: Apple aktualisiert nicht mehr *** --------------------------------------------- Die letzten zwei größeren Sicherheitsupdates von Apple standen nur noch für Mavericks, Mountain Lion und Lion bereit. Dabei ist OS X 10.6 noch relativ weit verbreitet. --------------------------------------------- http://www.heise.de/security/meldung/Mac-OS-X-10-6-Snow-Leopard-Apple-aktua… *** Was the iOS SSL Flaw Deliberate? *** --------------------------------------------- Last October, I speculated on the best ways to go about designing and implementing a software backdoor. I suggested three characteristics of a good backdoor: low chance of discovery, high deniability if discovered, and minimal conspiracy to implement. The critical iOS vulnerability that Apple patched last week is an excellent example. Look at the code. What caused the vulnerability is... --------------------------------------------- https://www.schneier.com/blog/archives/2014/02/was_the_ios_ssl.html *** Android & iOS: Gratis-Werkzeuge zur Malware-Analyse *** --------------------------------------------- Die Linux-Distribution Santoku bringt alle Werkzeuge mit, um Malware und andere Apps für iOS und Android professionell unter die Lupe zu nehmen. Eine Kombination aus einer App und einem Webdienst analysiert unter anderem Datenströme von Apps. --------------------------------------------- http://www.heise.de/security/meldung/Android-iOS-Gratis-Werkzeuge-zur-Malwa… *** Atlassian - Security Bypass Vulnerabilities in various Products *** --------------------------------------------- Security Bypass Vulnerabilities in Atlassian Bamboo, Confluence, FishEye, JIRA, Crucible and Stash --------------------------------------------- https://secunia.com/advisories/57086 https://secunia.com/advisories/57088 https://secunia.com/advisories/57095 https://secunia.com/advisories/57105 https://secunia.com/advisories/56842 https://secunia.com/advisories/56936 *** [2014-02-27] Local Buffer Overflow vulnerability in SAS for Windows *** --------------------------------------------- Attackers are able to completely compromise SAS clients when a malicious SAS program gets executed as the software "SAS for Windows" is affected by a local buffer overflow vulnerability. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2014… *** Drupal - Vulnerabilities in third-party Modules and Themes *** --------------------------------------------- Vulnerabilities in Open Omega (third-party theme), Content locking (anti-concurrent editing) (third-party module), Project Issue File Review (third-party module) and Mime Mail (third-party module) --------------------------------------------- https://drupal.org/node/2205877 https://drupal.org/node/2205807 https://drupal.org/node/2205767 https://drupal.org/node/2205991 *** Schneider Electric CitectSCADA Products Exception Handler Vulnerability (Update A) *** --------------------------------------------- This updated advisory is a follow-up to the original advisory titled ICSA-13-350-01 Schneider Electric SCADA Products Exception Handler Vulnerability that was published February 25, 2014, on the NCCIC/ICS-CERT web site. This advisory was originally posted to the US-CERT secure Portal library on December 16, 2013. Schneider Electric requested the title change to reduce confusion. --------------------------------------------- http://ics-cert.us-cert.gov/advisories/ICSA-13-350-01A

1 0

Tageszusammenfassung - Mittwoch 26-02-2014
by Daily end-of-shift report 26 Feb '14

26 Feb '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 25-02-2014 18:00 − Mittwoch 26-02-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Chameleon: Forschungsvirus verbreitet sich von WLAN zu WLAN *** --------------------------------------------- Britische Wissenschaftler haben unter dem Namen "Chameleon" einen vollständigen Router-Wurm geschaffen, der das Internet nicht braucht. Die Malware kopiert sich von einem Router zum anderen per WLAN und kann sich so epidemieartig ausbreiten. Aber auch Wege zur Abwehr solcher Gefahren sind absehbar. (WLAN, Virus) --------------------------------------------- http://www.golem.de/news/chameleon-forschungs-virus-verbreitet-sich-von-wla… *** DDoSing a Cell Phone Network *** --------------------------------------------- Interesting research: Abstract: The HLR/AuC is considered to be one of the most important network elements of a 3G network. It can serve up to five million subscribers and at least one transaction with HLR/AuC is required for every single phone call or data session. This paper presents experimental results and observations that can be exploited to perform a novel... --------------------------------------------- https://www.schneier.com/blog/archives/2014/02/ddosing_a_cell.html *** IE Zero-day Exploit Being Used in Widespread Attacks *** --------------------------------------------- The number of attacks exploiting a yet-to-be-patched vulnerability in Internet Explorer has increased dramatically over the past few days, indicating the exploit is no longer used just in targeted attacks against particular groups of people. --------------------------------------------- http://www.cio.com/article/748778/IE_Zero_day_Exploit_Being_Used_in_Widespr… *** QuickTime 7.7.5 für Windows behebt diverse Sicherheitslücken *** --------------------------------------------- Apples Multimediaumgebung enthält unter Windows eine ganze Reihe von sicherheitsrelevanten Bugs. Version 7.7.5 soll sie beheben - ein schnelles Update ist angeraten. --------------------------------------------- http://www.heise.de/security/meldung/QuickTime-7-7-5-fuer-Windows-behebt-di… *** Announcing EMET 5.0 Technical Preview *** --------------------------------------------- Today, we are thrilled to announce a preview release of the next version of the Enhanced Mitigation Experience Toolkit, better known as EMET. You can download EMET 5.0 Technical Preview here. This Technical Preview introduces new features and enhancements that we expect to be key components of the final EMET 5.0 release. We are releasing this technical preview to gather customer feedback about the new features and enhancements. Your feedback will affect the final EMET 5.0 technical --------------------------------------------- https://blogs.technet.com/b/srd/archive/2014/02/25/announcing-emet-5-0-tech… *** VU#684412: libpng denial-of-service vulnerability *** --------------------------------------------- Vulnerability Note VU#684412 libpng denial-of-service vulnerability Original Release date: 25 Feb 2014 | Last revised: 25 Feb 2014 Overview libpng versions 1.6.0 through 1.6.9 contain a denial-of-service vulnerability. Description CWE-835: Loop with Unreachable Exit Condition (Infinite Loop) - CVE-2014-0333Glenn Randers Pehrson of the PNG Development Group reports:The progressive decoder in libpng16 enters an infinite loop, thus hanging the application, when it encounters a zero-length IDAT... --------------------------------------------- http://www.kb.cert.org/vuls/id/684412 *** Schneider Electric SCADA Products Exception Handler Vulnerability *** --------------------------------------------- Researcher Carsten Eiram of Risk Based Security has identified an exception handling vulnerability in Schneider Electric’s CitectSCADA application. The original vulnerability reported by Mr. Eiram had already been fixed in CitectSCADA v7.20SP2. While investigating this vulnerability report, Schneider Electric discovered additional related vulnerabilities and has produced a patch that mitigates them in SCADA Expert Vijeo Citect, CitectSCADA, and PowerSCADA Expert. --------------------------------------------- http://ics-cert.us-cert.gov/advisories/ICSA-13-350-01 *** IBM AIX OpenSSL Multiple Denial of Service Vulnerabilities *** --------------------------------------------- https://secunia.com/advisories/57041 *** Python Buffer Overflow in socket.recvfrom_into() Lets Remote Users Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1029831 *** Cisco Unified Communications Manager CAPF Unauthenticated Device Information Update Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco Unified Communications Manager OS Administration CSRF Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco Unified Contact Center Express CCMConfig Sensitive Information Disclosure Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco Unified Contact Center Express Serviceability Page CSRF Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014…

1 0

Tageszusammenfassung - Dienstag 25-02-2014
by Daily end-of-shift report 25 Feb '14

25 Feb '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 24-02-2014 18:00 − Dienstag 25-02-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Android users under attack through malicious ads in Facebook *** --------------------------------------------- Cyber-criminals are always trying to attract people's attention in order to carry out their crimes. So it should be no surprise that they have now found a combined way of using Facebook (the world's largest social network), WhatsApp (the leading text messaging program for smartphones, recently bought by Facebook) and Android (the most popular operating... --------------------------------------------- http://pandalabs.pandasecurity.com/android-users-under-attack-through-malic… *** New attack completely bypasses Microsoft zero-day protection app *** --------------------------------------------- Whitehats ability to sidestep EMET strongly suggest criminal hackers can, too. --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/aCb9-4Ke6D8/ *** Poisoned YouTube ads serve Caphaw banking trojan *** --------------------------------------------- YouTubes ad network was compromised to host the Styx exploit kit, researchers found. --------------------------------------------- http://www.scmagazine.com/poisoned-youtube-ads-serve-caphaw-banking-trojan/… *** Blog: The first Tor Trojan for Android *** --------------------------------------------- Virus writers of Android Trojans have traditionally used Windows malware functionality as a template. Now, yet another technique from Windows Trojans has been implemented in malware for Android: for the first time we have detected an Android Trojan that uses a domain in the .onion pseudo zone as a C&C. The Trojan uses the anonymous Tor network built on a network of proxy servers. As well as providing users with anonymity,... --------------------------------------------- http://www.securelist.com/en/blog/8184/The_first_Tor_Trojan_for_Android *** Touchlogger: iOS im Lauscheinsatz *** --------------------------------------------- Die Sicherheitsexperten von Fireeye Labs haben eine iOS-App entwickelt, mit der sich alle Eingaben auf der Touchscreen-Oberfläche im Hintergrund mitschneiden und an einen Server übermitteln lassen. --------------------------------------------- http://www.golem.de/news/touchlogger-ios-im-lauscheinsatz-1402-104776-rss.h… *** The Tenth Anniversary of Mobile Malware *** --------------------------------------------- 2014 marks the tenth anniversary of mobile malware. It all began in 2004, when the first variant of SymbOS.Cabir was submitted to security researchers. The analysis revealed that this worm targeted Symbian OS, which was a very popular mobile operating system at the time. Infected phones would search for nearby Bluetooth devices that... --------------------------------------------- http://www.symantec.com/connect/blogs/tenth-anniversary-mobile-malware *** Best Practices in Computer Network Defense *** --------------------------------------------- This article was published in the book in Computer Network Defense: Incident Detection and Response. Edited by Melissa E. Hathaway, NATO Science for Peace and Security Series, 2014. The article is about the Dutch approach, the importance of intertnational cooperation and the role of the Dutch Cyber Security Council. --------------------------------------------- http://www.ncsc.nl/english/current-topics/news/best-practices-in-computer-n… *** "goto fail": Demo-Exploit für SSL-Schwachstelle in iOS und OS X *** --------------------------------------------- Der Sicherheitsforscher Aldo Cortesi hat sein Tool mitmproxy angepasst, um den verschlüsselten Datenverkehr von ungepatchten iOS-Geräten und Macs mit OS X 10.9 Mavericks mitzuschneiden. Fast alles lasse sich mitlesen, so Cortesi. --------------------------------------------- http://www.heise.de/security/meldung/goto-fail-Demo-Exploit-fuer-SSL-Schwac… *** HPSBST02937 rev.1 - HP StoreVirtual 4000 and StoreVirtual VSA Software dbd_manager, Remote Execution of Arbitrary Code *** --------------------------------------------- A potential security vulnerability has been identified with HP StoreVirtual 4000 and StoreVirtual VSA Software (formerly known as HP LeftHand Virtual SAN Appliance) dbd_manager. The vulnerability could be remotely exploited resulting in execution of arbitrary code. --------------------------------------------- http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDispl… *** HPSBMU02971 rev.1 - HP Application Information Optimizer, Remote Execution of Code, Information Disclosure *** --------------------------------------------- A potential security vulnerability has been identified in the Web Console component of HP Application Information Optimizer (formerly HP Database Archiving). The vulnerability could be exploited to allow remote execution of code and information disclosure. --------------------------------------------- http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDispl… *** Bugtraq: WiFiles HD v1.3 iOS - File Include Web Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/531236 *** MYBB 1.6.12 search.php Sql injection *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2014020202 *** GitHub RCE by Environment variable injection Bug Bounty *** --------------------------------------------- Topic: GitHub RCE by Environment variable injection Bug Bounty Risk: High Text:GitHub RCE by Environment variable injection Bug Bounty writeup Disclaimer: Ill keep this really short but I hope youll g... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014020209 *** TYPO3 6.1.7 XSS / Disclosure / Shell Upload *** --------------------------------------------- Topic: TYPO3 6.1.7 XSS / Disclosure / Shell Upload Risk: High Text:# == # Title ...| Multiple vulnerabilities in Typo3 CMS # Version .| introductionpackage-6.1.7 # Date ..... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014020208 *** FreePBX 2.x Remote Command Execution *** --------------------------------------------- Topic: FreePBX 2.x Remote Command Execution Risk: High Text:App : Freepbx 2.x Download : schmoozecom.net Auther : i-Hmx Mail : n0p1337(a)gmail.com Home : security arrays inc. , sec4ever... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014020206 *** Zen Cart E-Commerce 1.5.1 Multiple vulnerabilities *** --------------------------------------------- Topic: Zen Cart E-Commerce 1.5.1 Multiple vulnerabilities Risk: High Text:# == # Title ...| Multiple vulnerabilities in Zen Cart e-commerce # Version .| zen-cart-v1.5.1-full-file... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014020203 *** WordPress Search Everything Plugin SQL Injection Vulnerability *** --------------------------------------------- https://secunia.com/advisories/56820 *** AutoCAD Insecure Library and FAS File Loading Vulnerabilities *** --------------------------------------------- https://secunia.com/advisories/57002 *** OATH Toolkit libpam-oath replay *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/91316

1 0

Tageszusammenfassung - Montag 24-02-2014
by Daily end-of-shift report 24 Feb '14

24 Feb '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 21-02-2014 18:00 − Montag 24-02-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Researchers Develop Complete Microsoft EMET Bypass *** --------------------------------------------- Researchers at Bromium Labs are expected to deliver a paper today that explains how they were able to bypass all of the memory protection mitigations in Microsofts Enhanced Mitigation Experience Toolkit --------------------------------------------- http://threatpost.com/researchers-develop-complete-microsoft-emet-bypass/10… *** Apples SSL/TLS bug (22 Feb 2014) *** --------------------------------------------- Yesterday, Apple pushed a rather spooky security update for iOS that suggested that something was horribly wrong with SSL/TLS in iOS but gave no details. Since the answer is at the top of the Hacker News thread, I guess the cats out of the bag already and were into the misinformation-quashing stage now. --------------------------------------------- https://www.imperialviolet.org/2014/02/22/applebug.html *** An In-depth Analysis of Linux/Ebury *** --------------------------------------------- ESET has been analyzing and tracking an OpenSSH backdoor and credential stealer named Linux/Ebury. The result of this work on the Linux/Ebury malware family is part of a joint research effort with CERT‑Bund, the Swedish National Infrastructure for Computing, the European Organization for Nuclear Research (CERN) and other organizations forming an international Working Group. --------------------------------------------- http://www.welivesecurity.com/2014/02/21/an-in-depth-analysis-of-linuxebury/ *** Microsoft Windows Crash Reports Reveal New APT, POS Attacks *** --------------------------------------------- You never know what youll glean from a Windows crash report: security researchers recently unearthed a previously unknown advanced persistent threat campaign as well as a new point-of-sale system attack by perusing and analyzing those crash reports also known as Dr. Watson. --------------------------------------------- http://www.darkreading.com/attacks-breaches/microsoft-windows-crash-reports… *** NIST Unveils Crypto Standards Proposal *** --------------------------------------------- Because of concerns of possible National Security Agency meddling with its cryptographic standards, the National Institute of Standards and Technology has issued a draft report proposing revisions in how it develops cryptographic standards. --------------------------------------------- http://www.govinfosecurity.com/nist-unveils-crypto-standards-proposal-a-6519 *** Freier Zugriff auf Fernsteuerungen für Industrieanlagen *** --------------------------------------------- Ein Projekt der FU Berlin dokumentiert, dass weltweit tausende Industrieanlagen über das Internet erreichbar, aber nur unzureichend geschützt sind. Es entstand eine interaktive Karte, auf der potenziell angreifbare Anlagen eingezeichnet sind. --------------------------------------------- http://www.heise.de/security/meldung/Freier-Zugriff-auf-Fernsteuerungen-fue… *** Security vulnerabilities found in 80% of best-selling SOHO wireless routers *** --------------------------------------------- Tripwire has analyzed the security provided by the most popular wireless routers used in many small and home offices and found that 80 percent of Amazon's top 25 best-selling SOHO wireless router models have security vulnerabilities. --------------------------------------------- http://www.net-security.org/secworld.php?id=16399 *** eGroupWare Multiple PHP Object Injection Vulnerabilities *** --------------------------------------------- https://secunia.com/advisories/57047 *** JBoss RichFaces Malformed Push Request Denial of Service Vulnerability *** --------------------------------------------- https://secunia.com/advisories/57053 *** Barracuda Firewall Exception Handling Cross Site Scripting *** --------------------------------------------- Topic: Barracuda Firewall Exception Handling Cross Site Scripting Risk: Low Text:Document Title: Barracuda Bug Bounty #36 Firewall - Client Side Exception Handling Web Vulnerability References ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014020186 *** DSA-2866 gnutls26 *** --------------------------------------------- certificate verification flaw --------------------------------------------- http://www.debian.org/security/2014/dsa-2866 *** ICONICS GENESIS32 Insecure ActiveX Control *** --------------------------------------------- NCCIC/ICS-CERT discovered a vulnerability in the ICONICS GENESIS32 application during resolution of unrelated products. ICONICS has produced a patch for all vulnerable versions of its GENESIS32 product. ICONICS GENESIS32 Version 9.0 and newer are not vulnerable to this ActiveX vulnerability. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-14-051-01 *** HPSBMU02964 rev.1 - HP Service Manager, Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), Remote Denial of Service (DoS), Execution of Arbitrary Code, Unauthorized Access, Disclosure of Information and Authentication Issues *** --------------------------------------------- Potential security vulnerabilities have been identified with HP Service Manager. The vulnerabilities could be remotely exploited resulting in Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), Denial of Service (DoS), execution of arbitrary code, unauthorized access, disclosure of Information, and authentication issues. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** ASUS router drive-by code execution via XSS and authentication bypass *** --------------------------------------------- Several ASUS routers include reflected Cross-Site Scripting (CWE-79) and authentication bypass (CWE-592) vulnerabilities. An attacker who can lure a victim to browse to a web site containing a specially crafted JavaScript payload can execute arbitrary commands on the router as administrator (root). No user interaction is required. --------------------------------------------- https://sintonen.fi/advisories/asus-router-auth-bypass.txt

1 0

Tageszusammenfassung - Freitag 21-02-2014
by Daily end-of-shift report 21 Feb '14

21 Feb '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 20-02-2014 18:00 − Freitag 21-02-2014 18:00 Handler: Alexander Riepl Co-Handler: Stephan Richter *** Adobe Flash: Zero-Day-Exploit wird aktiv ausgenutzt *** --------------------------------------------- Adobe hat diesen Monat erneut einen Sicherheitspatch für den Flash Player veröffentlicht. Dieser sollte schleunigst eingespielt werden. Derzeit laufen Attacken auf den Flash Player, bei dem ein Sicherheitsloch aktiv ausgenutzt wird. (Adobe, Server) --------------------------------------------- http://www.golem.de/news/adobe-flash-zero-day-exploit-wird-aktiv-ausgenutzt… http://blogs.adobe.com/psirt/?p=1059 http://helpx.adobe.com/security/products/flash-player/apsb14-07.html *** Sicherheitsupdate für freie Datenbank PostgreSQL *** --------------------------------------------- Die Entwickler schließen mehrere Sicherheitslücken, die Anwendern eine Veränderung ihrer Rechte erlaubten. Außerdem warnen sie vor einem noch nicht behobenen Fehler, der das Kapern eines System-Accounts ermöglicht. --------------------------------------------- http://www.heise.de/security/meldung/Sicherheitsupdate-fuer-freie-Datenbank… http://www.postgresql.org/about/news/1506/ *** Spamvertised "You received a new message from Skype voicemail service" themed emails lead to Angler exploit kit *** --------------------------------------------- We've just intercepted a currently circulating malicious spam campaign that's attempting to trick potential botnet victims into thinking that they've received a legitimate Voice Message Notification from Skype. In reality though, once socially engineered users click on the malicious link found in the bogus emails, they're automatically exposed to the client-side exploits served by the Angler exploit kit. --------------------------------------------- http://www.webroot.com/blog/2014/02/20/spamvertised-received-new-message-sk… *** Erpressungs-Trojaner Bitcrypt geknackt *** --------------------------------------------- Der Erpressungs-Trojaner Bitcrypt verschlüsselt Dateien des Anwenders und rückt die Daten nur gegen Zahlung von Lösegeld wieder raus. Sicherheitsexperten gelang es jedoch, die Verschlüsselung zu knacken. --------------------------------------------- http://www.heise.de/security/meldung/Erpressungs-Trojaner-Bitcrypt-geknackt… *** Google Fixes 28 Security Flaws in Chrome 33 *** --------------------------------------------- Google Chrome 33 is out, and the new version of the browser includes fixes for 28 security vulnerabilities, including a number of high-severity bugs. The company paid out more than $13,000 in rewards to researchers who reported vulnerabilities that were fixed in this release. --------------------------------------------- https://threatpost.com/google-fixes-28-security-flaws-in-chrome-33/104391 *** HP Service Manager Bugs Let Remote Users Execute Arbitrary Code and Deny Service and Conduct Cross-Site Scripting and Cross-Site Requset Forgery Attacks *** --------------------------------------------- CVE Reference: CVE-2013-6202 Date: Feb 21 2014 Impact: Denial of service via network, Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information, User access via network --------------------------------------------- http://www.securitytracker.com/id/1029803 http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDispl… *** AdRotate 3.9.4 SQL Injection *** --------------------------------------------- Topic: AdRotate 3.9.4 SQL Injection Risk: Medium Text:Advisory ID: HTB23201 Product: AdRotate Vendor: AJdG Solutions Vulnerable Version(s): 3.9.4 and probably prior Tested Versi... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014020178

1 0

Tageszusammenfassung - Donnerstag 20-02-2014
by Daily end-of-shift report 20 Feb '14

20 Feb '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 19-02-2014 18:00 − Donnerstag 20-02-2014 18:00 Handler: Alexander Riepl Co-Handler: Christian Wojner *** Malicious iFrame Injections Host Payload on Tumblr *** --------------------------------------------- It's always fun to watch malware developers using different techniques to code their creations. Sometimes it's a matter of obfuscation, placement, injection, but this time it's how they code it to be dynamic. I believe this is not the first one that uses this service, but it's the first time I'm seeing .. --------------------------------------------- http://blog.sucuri.net/2014/02/malicious-iframe-injections-host-payload-on-… *** Health Care Systems Poorly Protected, Many Already Compromised *** --------------------------------------------- New report shows that health care industry intellectual property, payment information, and patient data are poorly protected and, in many cases, already compromised. --------------------------------------------- http://threatpost.com/health-care-systems-poorly-protected-many-already-com… *** Microsoft release FixIt for IE9/IE10 Zero Day, (Thu, Feb 20th) *** --------------------------------------------- Microsoft has published a TechNet article detailing the availability of a "FixIt" for the current IE9/IE10 zero day which has been doing the rounds. Corporate users will presumably have to wait until the availability of the patch which Microsoft say will be released during the monthly patching cycle.. --------------------------------------------- http://isc.sans.edu/diary.html?storyid=17684&rss *** Microsoft Security Advisory (2934088) *** --------------------------------------------- Microsoft is aware of limited, targeted attacks that attempt to exploit a vulnerability in Internet Explorer 10. Only Internet Explorer 9 and Internet Explorer 10 are affected by this vulnerability. Other supported versions of Internet Explorer are not affected. Applying the Microsoft Fix it solution, "MSHTML Shim Workaround," prevents .. --------------------------------------------- https://technet.microsoft.com/en-us/security/advisory/2934088 *** Fritzbox-Lücke: Jetzt auch bei WLAN-Repeatern *** --------------------------------------------- Auf den Routern haben zwar längst noch nicht alle Nutzer die Sicherheitslücke gestopft, aber zumindest stehen Firmware-Updates bereit. Nun bessert AVM auch die Software anderer Produkte mit WLAN-Schnittstelle aus. --------------------------------------------- http://www.heise.de/security/meldung/Fritzbox-Luecke-Jetzt-auch-bei-WLAN-Re… *** Datenbank-Leck in Leoben, Hack-Angriff auf Energie Steiermark *** --------------------------------------------- Zusammenhang beider Vorfälle möglich - Zugriff auf Gas-Kundendaten bei Energie Steiermark --------------------------------------------- http://derstandard.at/1392685633659 *** eXtplorer Joomla! Authentication Bypass Security Issue *** --------------------------------------------- https://secunia.com/advisories/57022 *** SA-CONTRIB-2014-022 - Slickgrid - Access bypass *** --------------------------------------------- The module doesnt check access sufficiently, allowing users to .. --------------------------------------------- https://drupal.org/node/2200491 *** Drupal Maestro 7.x Cross Site Scripting *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2014020165 *** [remote] - MediaWiki Thumb.php Remote Command Execution *** --------------------------------------------- http://www.exploit-db.com/exploits/31767

1 0

Tageszusammenfassung - Mittwoch 19-02-2014
by Daily end-of-shift report 19 Feb '14

19 Feb '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 18-02-2014 18:00 − Mittwoch 19-02-2014 18:00 Handler: Alexander Riepl Co-Handler: Christian Wojner *** Time to Harden Your Hardware? *** --------------------------------------------- Most Internet users are familiar with the concept of updating software that resides on their computers. But this past week has seen alerts about an unusual number of vulnerabilities and attacks against some important and ubiquitous hardware devices, from consumer-grade Internet routers, data storage and home automation products to enterprise-class security solutions. --------------------------------------------- http://krebsonsecurity.com/2014/02/time-to-harden-your-hardware/ *** 2013 DataBreach Report By Risk Based Security *** --------------------------------------------- Today Riskbasedsecurity.com has announced a report that covers the 2013 period for databreaches of all kinds. --------------------------------------------- http://www.cyberwarnews.info/2014/02/19/2013-databreach-report-by-risk-base… *** Lets Talk About Your Security Breach with Metasploit. Literally. In Real Time. *** --------------------------------------------- During a recent business trip in Boston, Tod and I sat down in a bar with the rest of the Metasploit team, and shared our own random alcohol-driven ideas on Metasploit hacking. At one point we started talking about hacking webcams. At that time Metasploit could only list webcams, take a snapshot, stream (without sound), or record audio using a meterpreter... --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2014/02/18/lets-talk… *** 300,000 Usernames, Passwords Posted to Pastebin *** --------------------------------------------- More than 300,000 credentials were posted on the clipboard website Pastebin.com in the year 2013 alone according to a recent analysis by a Swiss security firm. --------------------------------------------- http://threatpost.com/300000-usernames-passwords-posted-to-pastebin/104333 *** Smartphones und Tablets: Exploit-Code für 14 Monate altes Android-Sicherheitsloch *** --------------------------------------------- Für eine seit 14 Monaten bekannte Sicherheitslücke in Android ist Exploit-Code für das Framework Metasploit veröffentlicht worden. Ein Sicherheitsforscher kritisiert, dass die meisten im Umlauf befindlichen Android-Geräte die Sicherheitslücke aufweisen. --------------------------------------------- http://www.golem.de/news/smartphones-und-tablets-exploit-code-fuer-14-monat… *** Detected new Zeus variant which makes use of steganography *** --------------------------------------------- Security experts at Malwarebytes detected a new of the popular Zeus banking trojan variant which makes use of steganography to hide the configuration file. --------------------------------------------- http://securityaffairs.co/wordpress/22334/malware/zeus-banking-malware-nest… *** Hack gegen AVM-Router: AVM veröffentlicht Liste betroffener Fritzboxen *** --------------------------------------------- Nach langem Hin und Her hat AVM jetzt eine Liste aller Fritzboxen veröffentlicht, die deren genauen Sicherheitsstatus dokumentiert. Für zwei der betroffenen Geräte steht noch kein Update bereit und einige Fragen bleiben weiterhin offen. --------------------------------------------- http://www.heise.de/security/meldung/Hack-gegen-AVM-Router-AVM-veroeffentli… *** Admin rights key to mitigating vulnerabilities, study shows *** --------------------------------------------- Its been best-practice for a very long time: all users and processes should run with the fewest privileges necessary. This limits the damage that can be done by an attacker if the user or process is compromised. --------------------------------------------- http://www.zdnet.com/admin-rights-key-to-mitigating-vulnerabilities-study-s… *** Second Group Seen Using IE 10 Zero Day *** --------------------------------------------- There are at least two different groups running attacks exploiting the recently published zero day vulnerability in Internet Explorer 10, and researchers say one of the groups used the bug to impersonate a French aerospace manufacturer and compromise victims visiting the spoofed Web page. The attackers also used a special feature of .. --------------------------------------------- http://threatpost.com/second-group-seen-using-ie-10-zero-day/104344 *** Security Bulletins: SSL Certificate Validation Vulnerability in the Citrix ShareFile Mobile Application for Android and the Citrix ShareFile Mobile for Tablets Application for Android *** --------------------------------------------- --------------------------------------------- http://support.citrix.com/article/CTX140303 *** MediaWiki Thumb.php Remote Command Execution *** --------------------------------------------- Topic: MediaWiki Thumb.php Remote Command Execution --------------------------------------------- http://cxsecurity.com/issue/WLB-2014020153 *** Ruby on Rails Multiple Vulnerabilities *** --------------------------------------------- Ruby on Rails Multiple Vulnerabilities --------------------------------------------- https://secunia.com/advisories/56964

1 0

Tageszusammenfassung - Dienstag 18-02-2014
by Daily end-of-shift report 18 Feb '14

18 Feb '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 17-02-2014 18:00 − Dienstag 18-02-2014 18:00 Handler: Alexander Riepl Co-Handler: Robert Waldner *** Wait a minute... that's not a real JPG! *** --------------------------------------------- When attackers compromise a website and want to harvest credit cards, they need to either find where the data is stored or capture the data in transit. This blog post shows how identifying files with false file signatures can uncover malicious activity on a server. I recently discovered credit card data hidden behind a .jpg extension that lead me to the work of an attacker capturing credit cards from customers using an online checkout page. --------------------------------------------- http://feedproxy.google.com/~r/SpiderlabsAnterior/~3/3m5-LV3n59k/wait-a-min… *** [2014-02-18] Critical vulnerabilities in Symantec Endpoint Protection *** --------------------------------------------- Attackers are able to completely compromise the Symantec Endpoint Protection Manager server as they can gain access at the system and database level because of critical XXE and SQL injection vulnerabilities. Furthermore attackers can manage all endpoints and possibly deploy attacker-controlled code on clients. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2014… *** Scanning for Symantec Endpoint Manager, (Mon, Feb 17th) *** --------------------------------------------- Last week, we mentioned a new vulnerability in Symantec Endpoint Protection Management. According to Symantecs advisory, this product listens on port 9090 and 8443/TCP. Both ports are scanned regularly for various vulnerabilities, in particular 8443, being that it is frequently used by web servers as an alternative to 443. However, on February 7th, we detected a notable increase in scans for both ports. --------------------------------------------- http://isc.sans.edu/diary.html?storyid=17657&rss *** GE Proficy Vulnerabilities *** --------------------------------------------- OVERVIEW Researchers amisto0x07 and Z0mb1E of Zero Day Initiative (ZDI) have identified two vulnerabilities in the General Electric (GE) Proficy human-machine interface/supervisory control and data acquisition (HMI/SCADA) - CIMPLICITY application. GE has released security advisories, GEIP13-05 and GEIP13-06, to inform customers about these vulnerabilities.These vulnerabilities could be exploited remotely. --------------------------------------------- http://ics-cert.us-cert.gov/advisories/ICSA-14-023-01 *** PHP Backdoors: Hidden With Clever Use of Extract Function *** --------------------------------------------- When a site gets compromised, one thing we know for sure is that attackers love to leave malware that allows them access back to the site; this type of malware is called a backdoor. --------------------------------------------- http://feedproxy.google.com/~r/sucuri/blog/~3/kPCRBZwe1mQ/php-backdoors-hid… *** A journey to CVE-2014-0497 exploit *** --------------------------------------------- Last week we published a blog post about a CVE-2013-5330 exploit. We've also recently seen a new, similar attack targeting a patched Adobe Flash Player vulnerability (CVE-2014-0497). The vulnerability related to this malware was addressed with a patch released by Adobe on February 4, 2014. Flash Player versions 12.0.0.43 and earlier are vulnerable. We analyzed how these attacks work and found the following details. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2014/02/17/a-journey-to-cve-2014-04… *** WordPress two-factor login plugin bug, er, bypasses 2-factor login *** --------------------------------------------- Cross-site vulnerability exposes bloggers The maker of a popular plugin that provides two-factor authentication for WordPress bloggers is preparing an update - after finding a vulnerability in its system. It advises that anyone using two-factor plugins from any vendor need to check their security strength. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/02/18/wordpress_2… *** VU#656302: Belkin Wemo Home Automation devices contain multiple vulnerabilities *** --------------------------------------------- Vulnerability Note VU#656302 Belkin Wemo Home Automation devices contain multiple vulnerabilities Original Release date: 18 Feb 2014 | Last revised: 18 Feb 2014 Overview Belkin Wemo Home Automation devices contain multiple vulnerabilities. Description CWE-321: Use of Hard-coded Cryptographic Key - CVE-2013-6952Belkin Wemo Home Automation firmware contains a hard-coded cryptographic key and password. An attacker may be able to extract the key and password to sign a malicious firmware --------------------------------------------- http://www.kb.cert.org/vuls/id/656302 *** SSA-892342 (Last Update 2014-02-18): Denial-of-Service Vulnerability in RuggedCom ROS-based Devices *** --------------------------------------------- Summary: A potential vulnerability might allow attackers to perform a Denial-of-Service attack over the network without authentication on RuggedCom products running ROS. RuggedCom and Siemens address this issue by a firmware update. AFFECTED PRODUCTS All RuggedCom ROS-based devices with: All ROS versions before 3.11 ROS 3.11 (for RS950G): all versions ROS 3.12: all versions < ROS v3.12.4 ROS 4.0 (for RSG2488) --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** Exploit Released for Vulnerability Targeted By Linksys Router Worm *** --------------------------------------------- Technical details about a vulnerability in Linksys routers thats being exploited by a new worm have been released Sunday along with a proof-of-concept exploit and a larger than earlier expected list of potentially vulnerable device models. --------------------------------------------- http://www.cio.com/article/748352/Exploit_Released_for_Vulnerability_Target…

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily