- Daily - CERT.at

Tageszusammenfassung - Mittwoch 5-06-2013
by Daily end-of-shift report 05 Jun '13

05 Jun '13

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 04-06-2013 18:00 − Mittwoch 05-06-2013 18:00 Handler: Stephan Richter Co-Handler: n/a *** Get Set Null Java Security *** --------------------------------------------- Java, being widely used by the applications, has also been actively targeted by malware authors. One of the most common techniques to exploit Java applications, is to disable the security manager. This blog provides widely used logic used by malware authors... --------------------------------------------- http://www.fireeye.com/blog/technical/2013/06/get-set-null-java-security.ht… *** Schneider Electric Quantum Ethernet Module Hard-Coded Credentials *** --------------------------------------------- This updated advisory is a follow-up to the original advisory titled ICSA-12-018-01 Schneider Electric Quantum Ethernet Module Hard-Coded Credentials that was published on January 17, 2012, on the ICS-CERT Web page --------------------------------------------- http://ics-cert.us-cert.gov/advisories/ICSA-12-018-01A *** Schneider Electric PLCs Multiple Vulnerabilities *** --------------------------------------------- This updated advisory is a follow-up to the updated advisory titled ICSA-13-077-01A Schneider Electric PLCS Multiple Vulnerabilities (Update A) that was published March 20, 2013, on the ICS-CERT Web page. --------------------------------------------- http://ics-cert.us-cert.gov/advisories/ICSA-13-077-01B *** Windows Sysinternals Updated http://technet.microsoft.com/en-us/sysinternals/default.aspx, (Wed, Jun 5th) *** --------------------------------------------- Richard Porter --- ISC Handler on Duty (c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. --------------------------------------------- http://isc.sans.edu/diary.html?storyid=15932&rss *** IBM AIX inet IPv6 Bug Lets Remote Users Deny Service *** --------------------------------------------- On systems configured with IPv6, a remote user can send a specially crafted IPv6 packet to cause the target system to hang. --------------------------------------------- http://www.securitytracker.com/id/1028626 *** Mac OSX Server DirectoryService Buffer Overflow *** --------------------------------------------- Topic: Mac OSX Server DirectoryService Buffer Overflow Risk: High Text:Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ Mac OSX Server DirectoryService buffer overflow 1.... --------------------------------------------- http://cxsecurity.com/issue/WLB-2013060040 *** NetGear DGN1000 and NetGear DGN2200 security bypass *** --------------------------------------------- NetGear DGN1000 and NetGear DGN2200 could allow a remote attacker to bypass security restrictions, caused by an error in the interface when handling requests containing the currentsetting.htm substring. An attacker could exploit this vulnerability to gain unauthorized access to restricted functionality. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/84662 *** [2013-06-05] Critical vulnerabilities in CTERA portal *** --------------------------------------------- CTERA portal contains multiple and partly critical security issues such as XML External Entity injection that allows unauthenticated attackers to fully take over the affected server. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2013… *** Apple Mac OS X Multiple Vulnerabilities *** --------------------------------------------- Apple has issued a security update for Mac OS X, which fixes multiple vulnerabilities. --------------------------------------------- https://secunia.com/advisories/53684 *** PRTG Network Monitor login.htm cross-site scripting *** --------------------------------------------- PRTG Network Monitor is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the login.htm script. A remote attacker could exploit this vulnerability using the errormsg... --------------------------------------------- http://xforce.iss.net/xforce/xfdb/84686 *** Apache Struts OGNL Expression Injection Vulnerabilities *** --------------------------------------------- Security Research Laboratory has reported some vulnerabilities in Apache Struts, which can be exploited by malicious people to bypass certain security restrictions. --------------------------------------------- https://secunia.com/advisories/53693 *** Monkey HTTP Daemon "mk_request_header_process()" Signedness Error Buffer Overflow Vulnerability *** --------------------------------------------- A vulnerability has been discovered in Monkey HTTP Daemon, which can be exploited by malicious people to compromise a vulnerable system. --------------------------------------------- https://secunia.com/advisories/53697 *** CVE-2013-3919: A recursive resolver can be crashed by a query for a malformed zone *** --------------------------------------------- A bug has been discovered in the most recent releases of BIND 9 which has the potential for deliberate exploitation as a denial-of-service attack. By sending a recursive resolver a query for a record in a specially malformed zone, an attacker can cause BIND 9 to exit with a fatal "RUNTIME_CHECK" error in resolver.c --------------------------------------------- https://kb.isc.org/article/AA-00967

1 0

Tageszusammenfassung - Dienstag 4-06-2013
by Daily end-of-shift report 04 Jun '13

04 Jun '13

======================= = End-of-Shift report = ======================= Timeframe: Montag 03-06-2013 18:00 − Dienstag 04-06-2013 18:00 Handler: Stephan Richter Co-Handler: Robert Waldner *** Microsoft VC++ 2005 RTM runtime libraries installed with MSE *** --------------------------------------------- Topic: Microsoft VC++ 2005 RTM runtime libraries installed with MSE Risk: High Text:this is part 2 of "Defense in depth -- the Microsoft way", see On Windo... --------------------------------------------- http://cxsecurity.com/issue/WLB-2013060020 *** Bugtraq: Open-Xchange Security Advisory 2013-06-03 *** --------------------------------------------- Multiple security issues for Open-Xchange Server 6 and OX AppSuite have been discovered and fixed. --------------------------------------------- http://www.securityfocus.com/archive/1/526785 *** Imperva SecureSphere Operations Manager Command Execution *** --------------------------------------------- Topic: Imperva SecureSphere Operations Manager Command Execution Risk: High Text:Original: http://www.digitalsec.net/stuff/explt+advs/Imperva-SecureSphere.OptMgr.txt = ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2013060023 *** DS3 Authentication Server Command Execution *** --------------------------------------------- Topic: DS3 Authentication Server Command Execution Risk: High Text:Original: http://www.digitalsec.net/stuff/explt+advs/DS3.AuthServer.txt = - Advi... --------------------------------------------- http://cxsecurity.com/issue/WLB-2013060022 *** Vuln: MongoDB CVE-2013-2132 NULL Pointer Dereference Remote Denial of Service Vulnerability *** --------------------------------------------- MongoDB is prone to a denial-of-service vulnerability. Successfully exploiting this issue will allow an attacker to crash the affected application, denying service to legitimate users. --------------------------------------------- http://www.securityfocus.com/bid/60252 *** Google-Forscher ver�ffentlicht Zero-Day-Exploit f�r Windows *** --------------------------------------------- Durch eine Schwachstelle in s�mtlichen Windows-Versionen kommt ein gew�hnlicher Nutzer an Systemrechte. Entdeckt hat die L�cke Tavis Ormandy von Google, der seinen Fund ohne Microsoft zu informieren ins Netz stellte. --------------------------------------------- http://www.heise.de/security/meldung/Google-Forscher-veroeffentlicht-Zero-D… *** HPSBMU02883 SSRT101227 rev.1 - HP Data Protector, Remote Increase of Privilege, Denial of Service (DoS), Execution of Arbitrary Code *** --------------------------------------------- Potential security vulnerabilities have been identified with HP Data Protector. These vulnerabilities could be remotely exploited to allow an increase of privilege, create a Denial of Service (DoS), or execute arbitrary code. --------------------------------------------- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c037… *** Blog: "NetTraveler is Running!" � Red Star APT Attacks Compromise High-Profile Victims *** --------------------------------------------- Over the last few years, we have been monitoring a cyber-espionage campaign that has successfully compromised more than 350 high profile victims in 40 countries. The main tool used by the threat actors during these attacks is NetTraveler, a malicious program used for covert computer surveillance... --------------------------------------------- http://www.securelist.com/en/blog/8105/NetTraveler_is_Running_Red_Star_APT_… *** Novell ZENworks Configuration Management Control Center Multiple Vulnerabilities *** --------------------------------------------- A weakness and some vulnerabilities have been reported in Novell ZENworks Configuration Management, which can be exploited by malicious people to conduct spoofing and cross-site scripting attacks. --------------------------------------------- https://secunia.com/advisories/53648 *** 3COM NBX V3000 Networked Telephony Solution Information Disclosure *** --------------------------------------------- Topic: 3COM NBX V3000 Networked Telephony Solution Information Disclosure Risk: Medium Text:*Known Affected Versions: *R5_0_31 (Created March 1st, 2007) *Date Discovered: *November 13, 2012 Obviously not anything ne... --------------------------------------------- http://cxsecurity.com/issue/WLB-2013060027

1 0

Tageszusammenfassung - Montag 3-06-2013
by Daily end-of-shift report 03 Jun '13

03 Jun '13

======================= = End-of-Shift report = ======================= Timeframe: Freitag 31-05-2013 18:00 − Montag 03-06-2013 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** WordPress Plugin Feedweb 1.8.8 Cross-site Scripting vulnerability *** --------------------------------------------- Topic: WordPress Plugin Feedweb 1.8.8 Cross-site Scripting vulnerability Risk: Low Text:Advisory: WordPress Plugin Feedweb 1.8.8 Cross-site Scripting vulnerability Advisory ID: SSCHADV2013-004 Author: Stefan... --------------------------------------------- http://cxsecurity.com/issue/WLB-2013060001 *** ModSecurity 2.7.3 NULL pointer dereference PoC *** --------------------------------------------- Topic: ModSecurity 2.7.3 NULL pointer dereference PoC Risk: High Text:#!/usr/bin/env python3 #-*- coding: utf-8 -*- # # Created on Mar 29, 2013 # # @author: Younes JAAIDI <yjaaidi(a)shookalabs.c... --------------------------------------------- http://cxsecurity.com/issue/WLB-2013060006 *** Security Bulletin: Multiple security vulnerabilities in IBM Sales Center for WebSphere Commerce (CVE-2008-7271, CVE-2010-4647, CVE-2012-0186, CVE-2012-0191, CVE-2012-2159, CVE-2012-2161) *** --------------------------------------------- Multiple security vulnerabilities have been identified in IBM Sales Center for WebSphere Commerce V6.0 and V7.0 CVEID: CVE-2008-7271 CVE-2010-4647 CVE-2012-0186 CVE-2012-0191 CVE-2012-2159 CVE-2012-2161 Affected product(s) and affected version(s): IBM Sales Center for WebSphere Commerce V6.0 (CVE-2008-7271, CVE-2010-4647, CVE-2012-0186, CVE-2012-2159, CVE-2012-2161) IBM Sales Center for WebSphere Commerce V7.0 (CVE-2008-7271, CVE-2010-4647, CVE-2012-0186, CVE-2012-2159, --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_mul… *** Besonders tückisches PayPal-Phishing *** --------------------------------------------- Aufgepasst: Mit persönlicher Anrede und einer eigens registrierten .de-Domain greifen Cyber-Kriminelle derzeit nach den Kreditkartendaten von PayPal-Kunden. Der Schwindel fällt bestenfalls auf den zweiten Blick auf. --------------------------------------------- http://www.heise.de/newsticker/meldung/Besonders-tueckisches-PayPal-Phishin… *** Security Bulletin: Potential Security Exposure in IBM HTTP Server CVE-2013-0169 *** --------------------------------------------- Potential Security Exposure with IBM HTTP Server for WebSphere Application Server. CVEID: CVE-2013-0169 AFFECTED VERSIONS: This problem affects the IBM HTTP Server component in all editions of WebSphere Application Server and bundling products: · Version 8.5 · Version 8 · Version 7 · Version 6.1 Refer to the following reference URLs for remediation and additional vulnerability details. Source Bulletin: http://www-01.ibm.com/support/docview.wss?uid=swg21635988 --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_pot… *** WordPress AntiVirus FPD and Security bypass vulnerabilities *** --------------------------------------------- Topic: WordPress AntiVirus FPD and Security bypass vulnerabilities Risk: Low Text:These are Full path disclosure and Security bypass vulnerabilities in AntiVirus for WordPress. This is security plugin for dete... --------------------------------------------- http://cxsecurity.com/issue/WLB-2013060010 *** Compromised FTP/SSH account privilege-escalating mass iFrame embedding platform released on the underground marketplace *** --------------------------------------------- By Dancho Danchev Utilizing the very best in ‘malicious economies of scale’ concepts, cybercriminals have recently released a privilege-escalating Web-controlled mass iFrame embedding platform that’s not just relying on compromised FTP/SSH accounts, but also automatically gains root access on the affected servers in an attempt to target each and every site hosted there. Similar to […] --------------------------------------------- http://blog.webroot.com/2013/06/03/compromised-ftpssh-account-privilege-esc… *** IBM Tivoli Netcool/System Service Monitor Multiple OpenSSL Vulnerabilities *** --------------------------------------------- IBM Tivoli Netcool/System Service Monitor Multiple OpenSSL Vulnerabilities --------------------------------------------- https://secunia.com/advisories/53720 *** Apache Subversion Hook Scripts Arbitrary Command Injection Vulnerability *** --------------------------------------------- Apache Subversion Hook Scripts Arbitrary Command Injection Vulnerability --------------------------------------------- https://secunia.com/advisories/53727 *** Apache Subversion svnserve and FSFS Repositories Denial of Service Vulnerabilities *** --------------------------------------------- Apache Subversion svnserve and FSFS Repositories Denial of Service Vulnerabilities --------------------------------------------- https://secunia.com/advisories/53692 *** Researchers Infect iOS Devices With Malware Via Malicious Charger *** --------------------------------------------- Sparrowvsrevolution writes "At the upcoming Black Hat security conference in late July, three researchers at the Georgia Institute of Technology plan to show off a proof-of-concept charger that they say can be used to invisibly install malware on a device running the latest version of Apples iOS. A description of their talk posted to the conference website describes how they were able to install whatever malware they wished on an Apple device within a minute of the user plugging it into... --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/3xY6_Bverd0/story01.htm *** Multiple vulnerabilities in Typo3 extensions *** --------------------------------------------- SQL Injection vulnerability in extension Multishop: http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-e… Several vulnerabilities in third party extensions: http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-e… Security Bypass Vulnerability in extension powermail: http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-e… --------------------------------------------- http://typo3.org/teams/security/security-bulletins/ *** Erneut Sicherheitslücke bei ClickandBuy *** --------------------------------------------- Die neue Schwachstelle lauerte auf der Hilfe-Seite für Kunden. Schon einmal hatte der Online-Bezahldienstleister ClickandBuy mit einer XSS-Lücke zu kämpfen. --------------------------------------------- http://www.heise.de/newsticker/meldung/Erneut-Sicherheitsluecke-bei-Clickan… *** IBM DB2 / DB2 Connect Global Security Toolkit SSL Information Disclosure Weakness *** --------------------------------------------- IBM DB2 / DB2 Connect Global Security Toolkit SSL Information Disclosure Weakness --------------------------------------------- https://secunia.com/advisories/53696 *** IBM DB2 / DB2 Connect db2aud Privilege Escalation Vulnerability *** --------------------------------------------- IBM DB2 / DB2 Connect db2aud Privilege Escalation Vulnerability --------------------------------------------- https://secunia.com/advisories/52663 *** TYPO3 jQuery Autocomplete for indexed_search Extension SQL Injection Vulnerability *** --------------------------------------------- TYPO3 jQuery Autocomplete for indexed_search Extension SQL Injection Vulnerability --------------------------------------------- https://secunia.com/advisories/53633

1 0

Tageszusammenfassung - Freitag 31-05-2013
by Daily end-of-shift report 31 May '13

31 May '13

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 29-05-2013 18:00 − Freitag 31-05-2013 18:00 Handler: Matthias Fraidl Co-Handler: Otmar Lendl *** Carna Botnet Analysis Renders Scary Numbers on Vulnerable Devices *** --------------------------------------------- An analysis of the data rendered by the Carna botnet reveals a shocking number of vulnerable devices reachable online with default credentials. --------------------------------------------- http://threatpost.com/carna-botnet-analysis-renders-scary-numbers-on-vulner… *** PayPal-Schwachstelle endlich geschlossen *** --------------------------------------------- Fast zwei Wochen hat sich der Zahungsabwickler mit dem Schließen einer kritischen Lücke Zeit gelassen. Fünf Tage davon waren die PayPal-Nutzer einem hohen Angriffsrisiko ausgesetzt. --------------------------------------------- http://www.heise.de/newsticker/meldung/PayPal-Schwachstelle-endlich-geschlo… *** Zavio IP Cameras multiple vulnerabilities *** --------------------------------------------- Zavio IP Cameras default account Zavio IP Cameras command execution --------------------------------------------- http://xforce.iss.net/xforce/xfdb/84568 http://xforce.iss.net/xforce/xfdb/84569 *** Debian Security Advisory DSA-2697 gnutls26 *** --------------------------------------------- out-of-bounds array read --------------------------------------------- http://www.debian.org/security/2013/dsa-2697 *** Apache-Server durch Log-Files angreifbar *** --------------------------------------------- In Apache klafft ein Sicherheitsloch, durch das Angreifer Befehle im Log platzieren können, die ausgeführt werden, sobald der Admin die Datei öffnet. --------------------------------------------- http://www.heise.de/security/meldung/Apache-Server-durch-Log-Files-angreifb… *** RSA Authentication Manager Information Disclosure and PostgreSQL Vulnerabilities *** --------------------------------------------- RSA Authentication Manager Information Disclosure and PostgreSQL Vulnerabilities --------------------------------------------- https://secunia.com/advisories/53641 *** Siemens SCALANCE Privilege Escalation Vulnerabilities *** --------------------------------------------- --------------------------------------------- http://ics-cert.us-cert.gov/advisories/ICSA-13-149-01 *** P2P-Botnetze viel größer als vermutet *** --------------------------------------------- Mit eingeschleusten Sensoren hat ein internationales Forscherteam große Botnetze mit Peer-to-Peer-Infrastruktur vermessen. Sie fanden zum Teil über vierzig Mal mehr infizierte Systeme als mit herkömmlicher Zählweise. --------------------------------------------- http://www.heise.de/newsticker/meldung/P2P-Botnetze-viel-groesser-als-vermu… *** Monkey HTTPD 1.1.1 Denial of Service Vulnerability *** --------------------------------------------- Topic: Monkey HTTPD 1.1.1 Denial of Service Vulnerability Risk: Low Text:Title: Monkey HTTPD 1.1.1 - Denial of Service Vulnerability Date: == 2013-05-28 References: == http://bugs... --------------------------------------------- http://cxsecurity.com/issue/WLB-2013050217 *** Mobile Device Security: The Problems of Remotely Disabling Stolen Phones *** --------------------------------------------- The problem of mobile device theft has become sufficiently severe that legislators have decided to file bills discussing it. Last week, US Senator Charles Schumer re-filed Mobile Device Theft Deterrence Act of 2013, which makes modifying a device's International Mobile Equipment Identity (IMEI) number a crime punishable by up to five years in federal prison. --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/FxukunuZ9f0/ *** iCloud users take note: Apple two-step protection won't protect your data *** --------------------------------------------- Limitations could leave users open to the type of hack that hit Wireds Matt Honan. --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/VFgQ6tJje98/ *** Weekly Update: The Nginx Exploit and Continuous Testing *** --------------------------------------------- Weekly Update: The Nginx Exploit and Continuous Testing --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2013/05/30/weekly-up… *** Ruckus SSH Server Tunneling Issue *** --------------------------------------------- Topic: Ruckus SSH Server Tunneling Issue --------------------------------------------- http://cxsecurity.com/issue/WLB-2013050219 *** Vuln: Cisco Nexus 1000 Series Switches NX-OS CVE-2013-1209 Remote Authentication Bypass Vulnerability *** --------------------------------------------- Cisco Nexus 1000 Series Switches NX-OS CVE-2013-1209 Remote Authentication Bypass Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/60224 *** VMware Security Advirsory VMSA-2013-0007 *** --------------------------------------------- VMware ESX third party update for Service Console package sudo --------------------------------------------- https://www.vmware.com/support/support-resources/advisories/VMSA-2013-0007.… *** Phishing und verseuchter Spam - Betrug fast ohne Makel *** --------------------------------------------- Neue Woche, neue Kuriositäten. Diese Woche haben wir zwei interessante E-Mailbetrugversuche aus dem Zauberhut Internet gezogen. Dabei sind eine perfekt gestaltete Mastercard-Phishing-Seite und Trojaner-Mails im Namen der Firmen Otto und Görtz. --------------------------------------------- http://www.heise.de/security/meldung/Phishing-und-verseuchter-Spam-Betrug-f…

1 0

Tageszusammenfassung - Mittwoch 29-05-2013
by Daily end-of-shift report 29 May '13

29 May '13

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 28-05-2013 18:00 − Mittwoch 29-05-2013 18:00 Handler: Matthias Fraidl Co-Handler: Robert Waldner *** How Targeted Attacks And Cybercrime Go Together *** --------------------------------------------- For cybercriminals everywhere, it's still business as usual. The recent global ATM heist that stole a total of $45M showed that orchestrated targeted attacks continues to plague organizations globally. Legacy approaches to identifying threats are not keeping up with the tactics being used to exfiltrate precious assets and corporate secrets. --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/J7IrBLritF0/ *** Microsoft loads botnet-crushing data into Azure *** --------------------------------------------- C-TIP gives ISPs near-realtime access to MARS data Microsoft is plugging its security intelligence systems into Azure so that service providers and local authorities can get near-realtime information on botnets and malware detected by Redmond. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2013/05/28/microsoft_a… *** Critical Ruby on Rails bug exploited in wild, hacked servers join botnet *** --------------------------------------------- Attackers success shows many servers still arent patched. Is yours? --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/gjidr1iHpyo/ *** Child-Porn Suspect Ordered to Decrypt His Own Data *** --------------------------------------------- federal magistrate is reversing course and ordering a Wisconsin man suspected of possessing child pornography to decrypt hard drives the authorities seized from his residence. Decryption orders are rare, but are likely to become more commonplace as the public ... --------------------------------------------- http://www.wired.com/threatlevel/2013/05/decryption-order/ *** Raspberry Pi puts holes in Chinas Great Firewall *** --------------------------------------------- RPi plus WiFi hotspot plus VPN equals portable censorship destroyer A tech-savvy China-based Redditor has spotted a hassle-free way of ensuring he or she is always able to bypass the Great Firewall, even when out and about, using the Raspberry Pi to connect to a virtual private network (VPN). --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2013/05/29/raspberry_p… *** Secunia Broadcasts Zero-day Vulnerability via Email *** --------------------------------------------- SecurityWeek has learned that Secunia, a Danish vulnerability management firm, disclosed an unpatched vulnerability within an image viewing application used by organizations in both the private and the defense sectors to a public mailing list. --------------------------------------------- https://www.securityweek.com/secunia-broadcasts-zero-day-vulnerability-email *** Release me from a botnet *** --------------------------------------------- At the beginning of August 2012, an outbreak of the Dorifel virus was observed. This outbreak primarily infected systems in the Netherlands. The virus is being spread through the Citadel botnet. This factsheet will take a closer look at the relationship between Dorifel and Citadel, describe the impact of an infection and recommend steps to take if you are infected. We conclude with providing a number of tips to avoid infection. --------------------------------------------- http://www.ncsc.nl/english/services/expertise-advice/knowledge-sharing/fact… *** IBM WebSphere Portal HTTP Response Splitting Vulnerability *** --------------------------------------------- IBM WebSphere Portal HTTP Response Splitting Vulnerability --------------------------------------------- https://secunia.com/advisories/53627 *** Vuln: socat CVE-2013-3571 Remote Denial of Service Vulnerability *** --------------------------------------------- socat CVE-2013-3571 Remote Denial of Service Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/60170 *** Yahoo! Browser for Android spoofing *** --------------------------------------------- Yahoo! Browser for Android spoofing --------------------------------------------- http://xforce.iss.net/xforce/xfdb/84541 *** Siemens Solid Edge ST5 ActiveX control code execution *** --------------------------------------------- Siemens Solid Edge ST5 ActiveX control code execution --------------------------------------------- http://xforce.iss.net/xforce/xfdb/84530 *** TP-Link IP Cameras multiple vulnerabilities *** --------------------------------------------- Core Security - Corelabs Advisory http://corelabs.coresecurity.com TP-Link IP Cameras Multiple Vulnerabilities --------------------------------------------- http://cxsecurity.com/issue/WLB-2013050202

1 0

Tageszusammenfassung - Dienstag 28-05-2013
by Daily end-of-shift report 28 May '13

28 May '13

======================= = End-of-Shift report = ======================= Timeframe: Montag 27-05-2013 18:00 − Dienstag 28-05-2013 18:00 Handler: Matthias Fraidl Co-Handler: Christian Wojner *** Anatomy of a hack: How crackers ransack passwords like 'qeadzcwrsfxv1331' *** --------------------------------------------- For Ars, three crackers have at 16,000+ hashed passcodes with 90 percent success. --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/yG2GKDkgLMo/ *** Security boffins say music could trigger mobile malware *** --------------------------------------------- Justin Bieber really evil virus theory just got more credible Security researchers have discovered that specific music, lighting, vibrations or magnetic fields could all be used as infection channels to trigger the activation of mobile malware on a massive scale. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2013/05/28/light_sound… *** HP-UX Directory Server Discloses Passwords to Remote Authenticated and Local Users *** --------------------------------------------- HP-UX Directory Server Discloses Passwords to Remote Authenticated and Local Users --------------------------------------------- http://www.securitytracker.com/id/1028593 *** Sicherheitslücke in Telekom-Router Speedport LTE II *** --------------------------------------------- Der DSL-Router Speedport LTE II der Telekom soll von außen manipulierbar sein. Stellt ein Angreifer Anfragen an den Router, wird die zur Verfügung stehende Bandbreite gedrosselt. Ein Update soll die Lücke schließen. --------------------------------------------- http://www.heise.de/security/meldung/Sicherheitsluecke-in-Telekom-Router-Sp… *** How to hash windows files against known good set *** --------------------------------------------- Required Tools: md5deep, nsrlquery You'll also need a server to query against. Luckily Kyrus has provided a nsrlserver (beta), known as the Kyrus NSRL Lookup Service! --------------------------------------------- http://brakertech.com/hash-windows-files-against-known-good-set/ *** Serious Privacy Flaw In Facebook Pages Manager For Android Exposes Private Pictures For Everyone To See *** --------------------------------------------- Facebook has a privacy hole that exposes private information to the public. And its a serious one, this time in Facebook Pages Manager for Android, which has been installed over 5 million times since January of this year. --------------------------------------------- http://www.androidpolice.com/2013/05/26/serious-privacy-flaw-in-facebook-pa… *** BANKER Malware Hosted In Compromised Brazilian Government Sites *** --------------------------------------------- Two Brazilian government websites have been compromised and used to serve malware since April 24. We spotted a total of 11 unique malware files being distributed from these sites, with filenames that usually include 'update', 'upgrade', 'Adobe', 'FlashPlayer' or combinations thereof. Besides the different filenames, these samples also have different domains where they can connect to --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/PCxIa2XQtdo/ *** ATM and Point-of-Sale Terminals Malware: The Bad Guys Just Never Stop! *** --------------------------------------------- If you use your debit or credit card to buy groceries or get cash out of an ATM you might want to know that the bad guys could have a piece of it. --------------------------------------------- http://blog.malwarebytes.org/intelligence/2013/05/atm-and-point-of-sale-ter… *** How to keep your Apple computer free from malicious programs and viruses *** --------------------------------------------- - Apple computers are not safe from viruses - Fewer than half of Mac users run anti-virus software - Mac users "will be targeted more and more easily" --------------------------------------------- http://www.news.com.au/technology/techknow/how-to-keep-your-apple-computer-… *** The Team Cymru Malware Hash Registry (MHR) project *** --------------------------------------------- The Malware Hash Registry (MHR) project is a look-up service similar to the Team Cymru IP address to ASN mapping project. This project differs however, in that you can query our service for a computed MD5 or SHA-1 hash of a file and, if it is malware and we know about it, we return the last time weve seen it along with an approximate anti-virus detection percentage. --------------------------------------------- https://www.team-cymru.org/Services/MHR/ *** DoS-Lücke in ModSecurity gestopft *** --------------------------------------------- Angreifer können die Web Application Firewall über speziell präparierte HTTP-Request aus der Ferne lahm legen. --------------------------------------------- http://www.heise.de/security/meldung/DoS-Luecke-in-ModSecurity-gestopft-187… *** Wordpress Export To Text Plugin "download" Remote File Inclusion Vulnerability *** --------------------------------------------- Wordpress Export To Text Plugin "download" Remote File Inclusion Vulnerability --------------------------------------------- https://secunia.com/advisories/51348 *** Nitro Pro / Reader PDF Parsing Vulnerability *** --------------------------------------------- Nitro Pro / Reader PDF Parsing Vulnerability --------------------------------------------- https://secunia.com/advisories/53473 *** SRWare Iron Multiple Vulnerabilities *** --------------------------------------------- SRWare Iron Multiple Vulnerabilities --------------------------------------------- https://secunia.com/advisories/53586 *** Vuln: SPIP Security Bypass Vulnerability *** --------------------------------------------- SPIP Security Bypass Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/60163

1 0

Tageszusammenfassung - Montag 27-05-2013
by Daily end-of-shift report 27 May '13

27 May '13

======================= = End-of-Shift report = ======================= Timeframe: Freitag 24-05-2013 18:00 − Montag 27-05-2013 18:00 Handler: Matthias Fraidl Co-Handler: Christian Wojner *** Worm Creates Copies in Password-Protected Archived Files *** --------------------------------------------- Typically users archive file to lump several files together into a single file for convenience or to simply save storage space. However, we uncovered a worm that creates copies of itself even on password-protected archived files. We acquired a sample of a worm (detected as WORM_PIZZER.A) that propagates using a particular WINRAR command line --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/PRaGXwQeGIY/ *** WordPress ProPlayer Plugin 4.7.9.1 - SQL Injection *** --------------------------------------------- WordPress ProPlayer Plugin 4.7.9.1 - SQL Injection --------------------------------------------- http://www.exploit-db.com/exploits/25605 *** Compromised Indian government Web site leads to Black Hole Exploit Kit *** --------------------------------------------- By Dancho Danchev Our sensors recently picked up a Web site infection, affecting the Web site of the Ministry of Micro And Medium Enterprises (MSME DI Jaipur). And although the Black Hole Exploit Kit serving URL is currently not accepting any connections, it's known to have been used in previous client-side exploit serving campaigns. --------------------------------------------- http://blog.webroot.com/2013/05/24/compromised-indian-government-web-site-l… *** Skype Beta Plugs IP Resolver Privacy Leak *** --------------------------------------------- A few months ago, I warned readers that a glaring privacy weakness in voice-over-IP telephony service Skype allows anyone using the network to quickly learn the Internet address of any other Skype user. A new beta version of the popular Microsoft program appears to have nixed that privacy leak with a setting that restricts this capability to connections in your Skype contacts only. --------------------------------------------- http://krebsonsecurity.com/2013/05/skype-beta-plugs-ip-resolver-privacy-leak *** PandaLabs Quarterly Report Q1 2013 *** --------------------------------------------- We have just published our Quarterly Report for Q1 2013, analyzing the IT security events and incidents from January through March 2013. If you want to be aware of the latest security trends, the latest cyber-war cases don't wait any longer, you can download our latest report from our Press Center --------------------------------------------- http://pandalabs.pandasecurity.com/pandalabs-quarterly-report-q1-2013/ *** WordPress milano Theme Cross Site Scripting *** --------------------------------------------- Topic: WordPress milano Theme Cross Site Scripting Risk: Low Text: ## # Exploit Title : Wordpress milano Theme Cross Site Scripting # # Exploit Author : Ashiyane Digital Security Team ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2013050184 *** LG Optimus G command injection (as system user) vulnerability *** --------------------------------------------- Topic: LG Optimus G command injection (as system user) vulnerability *youtube Risk: High Text:Device: LG Optimus G E973 (Others affected) Firmware: Android 4.1.2 JZO54k (Others affected) Evidence: http://youtu.be/ZfbDIp... --------------------------------------------- http://cxsecurity.com/issue/WLB-2013050188 *** AVE.CMS <= 2.09 (index.php, module param) - Blind SQL Injection Exploit *** --------------------------------------------- AVE.CMS <= 2.09 (index.php, module param) - Blind SQL Injection Exploit --------------------------------------------- http://www.exploit-db.com/exploits/25716 *** PayPal wieder durch Cross-Site-Scripting angreifbar *** --------------------------------------------- Der eBay gehörende Internetbezahldienst prüft Sucheingaben nicht und erlaubt Angreifern so beliebigen JavaScript-Codes in den Browser des Benutzers einzuschleusen. Dadurch lassen sich Zugangsdaten entwenden. --------------------------------------------- http://www.heise.de/security/meldung/PayPal-wieder-durch-Cross-Site-Scripti… *** Finding Malware by DNS Cache Snooping or by Comparing BRO and PassiveDNS logs *** --------------------------------------------- We can actively look for the presence of malware on a network by examining its nameserver's cache. Since known pieces of malware make requests to specific domains, we're able to check a DNS server's cache for their existence. --------------------------------------------- https://sickbits.net/finding-malware-by-dns-cache-snooping/ *** New Trojan targets Facebook, Twitter and Google Plus *** --------------------------------------------- May 16, 2013 Russian anti-virus company Doctor Web has discovered previously unknown features in the new malware for Facebook that has been widely discussed in the mediadoesnt simply change a user's status, join groups and leave comments on the users behalf, but it can also send spam on Twitter and Google Plus. --------------------------------------------- http://news.drweb.com/show/?i=3527&lng=en&c=9 *** WordPress WP CleanFix Cross-Site Request Forgery Vulnerability *** --------------------------------------------- WordPress WP CleanFix Cross-Site Request Forgery Vulnerability --------------------------------------------- https://secunia.com/advisories/53395 *** Barracuda SSL VPN 680 2.2.2.203 Redirect Web Vulnerability *** --------------------------------------------- Topic: Barracuda SSL VPN 680 2.2.2.203 Redirect Web Vulnerability Risk: Low Text:Title: Barracuda SSL VPN 680 2.2.2.203 - Redirect Web Vulnerability Date: == 2013-05-25 References: == h... --------------------------------------------- http://cxsecurity.com/issue/WLB-2013050193 *** Twitters Zwei-Faktor-Authentifizierung schon ausgehebelt *** --------------------------------------------- Es hätte ja so schön sein können: Doch die Zwei-Faktor-Authentifizierung, die Twitter erst vor wenigen Tagen eingeführt hat, lässt sich mittels SMS-Spoofing relativ leicht aushebeln. --------------------------------------------- http://www.heise.de/security/meldung/Twitters-Zwei-Faktor-Authentifizierung…

1 0

Tageszusammenfassung - Freitag 24-05-2013
by Daily end-of-shift report 24 May '13

24 May '13

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 23-05-2013 18:00 − Freitag 24-05-2013 18:00 Handler: Stephan Richter Co-Handler: n/a *** HPSBUX02881 SSRT101189 rev.1 - HP-UX Directory Server, Remote Disclosure of Information *** --------------------------------------------- A potential security vulnerability has been identified in HP-UX Directory Server. The vulnerability could be exploited remotely resulting in information disclosure. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** Cisco NX-OS igmp_snoop_orib_fill_source_update() Function Remote Denial of Service Vulnerability *** --------------------------------------------- Cisco NX-OS contains a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service condition on a targeted device. Updates are available. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=26613 *** X.Org Security Advisory: May 23, 2013 - Protocol handling issues in X Window System client libraries *** --------------------------------------------- Ilja van Sprundel, a security researcher with IOActive, has discovered a large number of issues in the way various X client libraries handle the responses they receive from servers, and has worked with X.Orgs security team to analyze, confirm, and fix these issues. --------------------------------------------- http://www.x.org/wiki/Development/Security/Advisory-2013-05-23 *** Cisco WebEx for iOS Certificate Verification Security Issue *** --------------------------------------------- Charlie Eriksen has discovered a security issue in Cisco WebEx for iOS, which can be exploited by malicious people to conduct spoofing attacks. --------------------------------------------- https://secunia.com/advisories/51412 *** New Rmnet malware disables anti-virus programs *** --------------------------------------------- May 23, 2013 Russian anti-virus company Doctor Web is warning users about new malicious modules found in the malware that is used to create and maintain the Rmnet bot network. One of them allows attackers to disable the anti-virus software installed on the infected computers. Doctor Webs analysts also managed to hijack a Rmnet subnetwork whose bots contain these harmful components. Doctor Web already warned users about the wide distribution of Win32.Rmnet.12 andWin32.Rmnet.16 programs that... --------------------------------------------- http://news.drweb.com/show/?i=3551&lng=en&c=9 *** Google erneuert SSL-Zertifikate *** --------------------------------------------- Ab August spendiert Google seinen Diensten neue Zertifikate. Vor allem sollen die mit alten 1024-Bit-RSA-Keys ausrangiert und gegen solche mit 2048 Bit ersetzt werden. --------------------------------------------- http://www.heise.de/security/meldung/Google-erneuert-SSL-Zertifikate-186915… *** Malware dont need Coffee *** --------------------------------------------- On the 10th of may was advertised on underground forum by bomba_service a new Ransomware in Affiliate mode. --------------------------------------------- http://malware.dontneedcoffee.com/2013/05/unveiling-locker-bomba-aka-lucky-… *** 0-Days in Novell Client für Windows *** --------------------------------------------- Wer noch Novell Client für Windows einsetzt, sollte sich nach Alternativen umsehen. --------------------------------------------- http://www.heise.de/security/meldung/0-Days-in-Novell-Client-fuer-Windows-1… *** Vuln: MediaWiki Arbitrary File Upload Vulnerability *** --------------------------------------------- MediaWiki is prone to a vulnerability that lets attackers upload arbitrary files. An attacker may leverage this issue to upload arbitrary files to the affected computer. Note that this issue could be exploited to execute arbitrary code, however, this has not been confirmed. --------------------------------------------- http://www.securityfocus.com/bid/60077

1 0

Tageszusammenfassung - Donnerstag 23-05-2013
by Daily end-of-shift report 23 May '13

23 May '13

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 22-05-2013 18:00 − Donnerstag 23-05-2013 18:00 Handler: Stephan Richter Co-Handler: n/a *** New Trojan steals short messages *** --------------------------------------------- May 22, 2013 Russian anti-virus company Doctor Web is warning users about a new Trojan for Android that can intercept inbound short messages and forward them to criminals. Android.Pincer.2.origin poses a serious threat because stolen messages can contain sensitive information such as mTAN codes which are used to confirm online banking transactions. The Trojan, discovered by Doctor Webs analysts several days ago, is a second representative of the Android.Pincer malware family. Like its... --------------------------------------------- http://news.drweb.com/show/?i=3549&lng=en&c=9 *** CODESYS–Gateway Use After Free *** --------------------------------------------- This advisory provides mitigation details for a vulnerability that impacts the 3S CODESYS Gateway application --------------------------------------------- http://ics-cert.us-cert.gov/advisories/ICSA-13-142-01 *** IBM Tivoli Monitoring cross-site scripting *** --------------------------------------------- IBM Tivoli Monitoring is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using Tivoli Enterprise Portal browser client to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/83328 *** Antwortbegrenzung *** --------------------------------------------- Angesichts zunehmender DNS-Attacken denkt das Denic an eine Begrenzung Antworten auf Domainanfragen. --------------------------------------------- http://www.heise.de/newsticker/meldung/DNS-Attacken-Denic-schliesst-das-Kap… *** Apple QuickTime Multiple Vulnerabilities *** --------------------------------------------- Multiple vulnerabilities have been reported in Appe QuickTime, which can be exploited by malicious people to compromise a user's system. --------------------------------------------- https://secunia.com/advisories/53520 *** Flagallery-Skins plugin for WordPress gallery.php SQL injection *** --------------------------------------------- Flagallery-Skins plugin for WordPress is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements to the gallery.php script using the playlist parameter, which could allow the attacker to view, add, modify or delete information in the back-end database. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/84445 *** Oracle Java ist verbreitetste Sicherheitslücke *** --------------------------------------------- Laut einer aktuellen Quartalsanalyse des Virenschutzherstellers Kaspersky stieg die Zahl der Bedrohungen über das Internet gegenüber dem Vorquartal um 1,5 Prozentpunkte. Den Spitzenplatz unter den Ländern, von denen Schadprogramme ausgehen, gab Russland wieder an die USA ab. Bei den Sicherheitslücken ist Oracle Java weiter führend. --------------------------------------------- http://futurezone.at/digitallife/16038-oracle-java-ist-verbreitetste-sicher… *** IT security vendors seen as clueless on industrial control systems *** --------------------------------------------- Even the most innocuous security processes used for traditional IT systems could spell disaster in an ICS --------------------------------------------- http://www.csoonline.com/article/733873/it-security-vendors-seen-as-clueles… *** Mac Spyware Bait: Lebenslauf für Praktitkum *** --------------------------------------------- As a follow up to yesterdays Kumar in the Mac post… have you received e-mail attachments such as this?Attachments: • Christmas_Card.app.zip • Content_for_Article.app.zip • Content_of_article_for_[NAME REMOVED].app.zip • Interview_Venue_and_Questions.zip • Lebenslauf_für_Praktitkum.zipIf so, you may be the target of a spear phishing campaign designed to install a spyware on your Mac.Heres a list of binaries signed by Apple Developer "Rajinder... --------------------------------------------- http://www.f-secure.com/weblog/archives/00002559.html

1 0

Tageszusammenfassung - Mittwoch 22-05-2013
by Daily end-of-shift report 22 May '13

22 May '13

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 21-05-2013 18:00 − Mittwoch 22-05-2013 18:00 Handler: Stephan Richter Co-Handler: Robert Waldner *** Researchers find critical vulnerabilities in popular game engines *** --------------------------------------------- Attackers could exploit the flaws to compromise game clients and servers, researchers from ReVuln said --------------------------------------------- http://www.csoonline.com/article/733773/researchers-find-critical-vulnerabi… *** WordPress Events Manager Plugin Multiple Cross-Site Scripting Vulnerabilities *** --------------------------------------------- Multiple vulnerabilities have been discovered in the Events Manager plugin for WordPress, which can be exploited by malicious people to conduct cross-site scripting attacks. --------------------------------------------- https://secunia.com/advisories/53478 *** Bugtraq: Multiple Vulnerabilities in Wordpress Plugins *** --------------------------------------------- [waraxe-2013-SA#104] - Multiple Vulnerabilities in Spider Event Calendar Wordpress Plugin [waraxe-2013-SA#105] - Multiple Vulnerabilities in Spider Catalog Wordpress Plugin --------------------------------------------- http://www.securityfocus.com/archive/1/526660 http://www.securityfocus.com/archive/1/526661 *** The Top 10 Internet Resources to Use After Suffering a Cyber Breach *** --------------------------------------------- Most cyber breaches into your online presence will be directed at your website server and its accompanying databases or accounts. And, if you’ve been the victim of a server hack, it probably occurred through one of two different means. The first would be an attack at some sort of weakness in third party web applications, or... --------------------------------------------- http://resources.infosecinstitute.com/the-top-10-internet-resources-to-use-… *** Oracle Solaris Multiple Vulnerabilities *** --------------------------------------------- https://secunia.com/advisories/53462 https://secunia.com/advisories/53468 *** Bugtraq: Trend Micro DirectPass 1.5.0.1060 - Multiple Vulnerabilities *** --------------------------------------------- The Vulnerability Laboratory Research Team discovered multiple software vulnerabilities in the official Trend Micro DirectPass v1.5.0.1060 Software. --------------------------------------------- http://www.securityfocus.com/archive/1/526658 *** Apache Struts "ParameterInterceptor" Security Bypass Vulnerability *** --------------------------------------------- A vulnerability has been reported in Apache Struts, which can be exploited by malicious people to bypass certain security restrictions. --------------------------------------------- https://secunia.com/advisories/53495 *** IBM Eclipse Help System information disclosure *** --------------------------------------------- Multiple IBM products could allow a remote attacker to obtain sensitive information, caused by an error in the IBM Eclipse Help System. A specially-crafted URL could cause an error message to be returned in the browser that may contain sensitive information. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/83613 *** DHS to Share Zero-Day Intelligence *** --------------------------------------------- The U.S. Department of Homeland Security (DHS) is developing a system that will enable classified vulnerability data to be shared with the private sector. The information, primarily Zero-Day vulnerability data, will be sold via a select group of service providers. Siehe auch: http://www.dhs.gov/enhanced-cybersecurity-services Siehe auch: http://www.csoonline.com/article/733557/experts-ding-dhs-vulnerability-shar… --------------------------------------------- http://www.securityweek.com/dhs-share-zero-day-intelligence

1 0

Tageszusammenfassung - Dienstag 21-05-2013
by Daily end-of-shift report 21 May '13

21 May '13

======================= = End-of-Shift report = ======================= Timeframe: Freitag 17-05-2013 18:00 − Dienstag 21-05-2013 18:00 Handler: Stephan Richter Co-Handler: Robert Waldner *** Suchmaschine für Internet Census 2012 *** --------------------------------------------- Die gewaltigen Datenmengen, die bei einem Portscan des gesamten Internets aufgelaufen sind, kann man jetzt auch komfortabel online durchsuchen. --------------------------------------------- http://www.heise.de/security/meldung/Suchmaschine-fuer-Internet-Census-2012… *** SSL: Another reason not to ignore IPv6, (Fri, May 17th) *** --------------------------------------------- Currently, many public web sites that allow access via IPv6 do so via proxies. This is seen as the "quick fix", as it requires minimum changes to the site itself. As far as the web application is concerned, all incoming traffic is IPv4. The most obvious issue here is logging, in that the application only "sees" the proxies IP address, unless it inspects headers added by the proxy, which will no point to (unreadable?) IPv6 addresses. But there is another issue: SSL --------------------------------------------- http://isc.sans.edu/diary.html?storyid=15833&rss *** CKEditor comment or content post cross-site scripting *** --------------------------------------------- CKEditor is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using the comment or content post field to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site,... --------------------------------------------- http://xforce.iss.net/xforce/xfdb/84356 *** Vuln: WordPress Mail On Update Plugin Cross Site Request Forgery Vulnerability *** --------------------------------------------- The Mail On Update plugin for WordPress is prone to a cross-site request-forgery vulnerability. Exploiting this issue may allow a remote attacker to perform certain unauthorized actions in the context of the affected application. Other attacks are also possible. --------------------------------------------- http://www.securityfocus.com/bid/59932 *** Hitachi JP1/Automatic Operation unspecified cross-site scripting *** --------------------------------------------- Hitachi JP1/Automatic Operation is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site,... --------------------------------------------- http://xforce.iss.net/xforce/xfdb/84365 *** Remote Code Injection Vulnerabilities Discovered in iOS Apps *** --------------------------------------------- Multiple vulnerabilities have been discovered in both File Lite and File Pro, two file management applications created by Perception Systems for iOS, currently available on Apple’s App Store. --------------------------------------------- http://threatpost.com/remote-code-injection-vulnerabilities-discovered-in-i… *** Security Update: URL Manipulation Vulnerability in IBM WebSphere Portal versions *** --------------------------------------------- URL manipulation security vulnerabilities for IBM WebSphere Portal may allow a remote attacker to traverse directories on the system and view information contained in files. These vulnerabilities are susceptible to an exploit in the wild. Please review the updated security bulletins (see links below). CVE(s): CVE-2012-2181 and CVE-2012-4834 Affected product(s): IBM WebSphere Portal Affected version(s): 7.0.0.x and 8.0 Refer to the following reference URLs for remediation and additional... --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_update_url_m… *** IBM WebSphere DataPower Appliance echo web service cross-site scripting *** --------------------------------------------- IBM WebSphere DataPower Appliance is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site,... --------------------------------------------- http://xforce.iss.net/xforce/xfdb/82221 *** Mitsubishi MX Component V3 ActiveX Vulnerability *** --------------------------------------------- This advisory recommends upgrading to MX Component 4.03 that is not affected by this vulnerability. --------------------------------------------- http://ics-cert.us-cert.gov/advisories/ICSA-13-140-01 *** Moodle Multiple Vulns *** --------------------------------------------- Topic: Moodle Multiple Vulns Risk: Medium Text:The following security notifications are now public. Thanks to OSS members for their cooperation. =... --------------------------------------------- http://cxsecurity.com/issue/WLB-2013050156 *** [remote] - Linksys WRT160nv2 apply.cgi Remote Command Injection *** --------------------------------------------- Some Linksys Routers are vulnerable to an authenticated OS command injection on their web interface where default credentials are admin/admin or admin/password. Since it is a blind OS command injection vulnerability, there is no output for the executed command when using the cmd generic payload. --------------------------------------------- http://www.exploit-db.com/exploits/25608 *** Safeguarding ISPs from DDoS Attacks *** --------------------------------------------- A distributed-denial-of-service attack in Europe highlights the need for Internet service providers to implement security best practices to prevent future incidents, ENISAs Thomas Haeberlen says. --------------------------------------------- http://www.databreachtoday.asia/safeguarding-isps-from-ddos-attacks-a-5773 *** National Cyber Security Strategies in the World *** --------------------------------------------- A free and open Internet is at the heart of the new Cyber Security Strategy by the European Union High Representative Catherine Ashton and the European Commission. The new Communication is the first comprehensive policy document that the European Union has produced in this area. It comprises internal market, justice and home affairs and the foreign policy aspects of cyberspace issues. ENISA has listed all the documents of National Cyber Security Strategies in the EU but also in the world. --------------------------------------------- https://www.enisa.europa.eu/activities/Resilience-and-CIIP/national-cyber-s… *** Dovecot IMAP "APPEND" Parameters Processing Denial of Service Vulnerability *** --------------------------------------------- A vulnerability has been reported in Dovecot, which can be exploited by malicious users to cause a DoS (Denial of Service). The vulnerability is caused due to an error within IMAP functionality when processing the "APPEND" parameters and can be exploited to cause a hang. --------------------------------------------- https://secunia.com/advisories/53492 *** IBM Maximo Asset Management Products Java Multiple Vulnerabilities *** --------------------------------------------- IBM has acknowledged multiple vulnerabilities in IBM Maximo Asset Management products, which can be exploited by malicious, local users to disclose certain sensitive information and gain escalated privileges and by malicious people to disclose certain sensitive information, manipulate certain data, bypass certain security restrictions, cause a DoS (Denial of Service), and compromise a vulnerable system. --------------------------------------------- https://secunia.com/advisories/53451 *** SAProuter NI Route Message Handling Vulnerability *** --------------------------------------------- ERPScan has reported a vulnerability in SAProuter, which can be exploited by malicious people to potentially compromise a vulnerable system. --------------------------------------------- https://secunia.com/advisories/53436 *** Bugtraq: Revision of "IPv6 Stable Privacy Addresses" (Fwd: I-D Action: draft-ietf-6man-stable-privacy-addresses-07.txt) *** --------------------------------------------- We have published a revision of our IETF I-D "A method for Generating Stable Privacy-Enhanced Addresses with IPv6 Stateless Address Autoconfiguration (SLAAC)". --------------------------------------------- http://www.securityfocus.com/archive/1/526646 *** Security Bulletin: IBM TS3310 Tape Library update for security vulnerabilities in OpenSSL (CVE-2013-0169) *** --------------------------------------------- Download an update to the TS3310 Tape Library, which contains a newer version of OpenSSL that fixes certain security vulnerabilities that were present in older versions of OpenSSL. CVEID: CVE-2013-0169 Affected product(s) and affected version(s): All TS3310 tape libraries with firmware versions lower than 636G Refer to the following reference URLs for remediation and additional vulnerability details. Source Bulletin: http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004345 X-Force --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_ibm…

1 0

Tageszusammenfassung - Freitag 17-05-2013
by Daily end-of-shift report 17 May '13

17 May '13

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 16-05-2013 18:00 − Freitag 17-05-2013 18:00 Handler: Matthias Fraidl Co-Handler: Robert Waldner *** Android.RoidSec: This app is an info stealing 'sync-hole'! *** --------------------------------------------- By Nathan Collier Android.RoidSec has the package name 'cn.phoneSync', but an application name of 'wifi signal Fix'. From a Malware 101′ standpoint, you would think the creators would have a descriptive package name that matches the application name. Not so, in this case. --------------------------------------------- http://blog.webroot.com/2013/05/16/android-roidsec-this-app-is-a-info-steal… *** vBulletin Input Validation Flaw Lets Remote Users Inject SQL Commands *** --------------------------------------------- The 'index.php/ajax/api/reputation/vote' script does not properly validate user-supplied input in the 'nodeid' parameter. A remote user can supply a specially crafted parameter value to execute SQL commands on the underlying database. --------------------------------------------- http://www.securitytracker.com/id/1028543 *** Bank Account Logins for Sale, Courtesy of Citadel Botnet *** --------------------------------------------- Financial theft is one of the most lucrative forms of cybercrime. Malware authors continue to deliver sophisticated tools and techniques to unlock online bank accounts. Attackers design and develop botnets to perform financial fraud, targeting banks and other institutions for profit. --------------------------------------------- http://blogs.mcafee.com/mcafee-labs/bank-account-logins-for-sale-courtesy-o… *** Apple iTunes Multiple Vulnerabilities *** --------------------------------------------- Multiple vulnerabilities have been reported in Apple iTunes, which can be exploited by malicious people to conduct spoofing attacks and compromise a user's system. --------------------------------------------- https://secunia.com/advisories/53471 *** In a sea of malware, viruses make a small comeback *** --------------------------------------------- Microsoft has noticed a small uptick in viruses that infect files --------------------------------------------- http://www.csoonline.com/article/733558/in-a-sea-of-malware-viruses-make-a-… *** Trying to kill undead Pushdo zombies? Hard luck, Trojan is EVOLVING *** --------------------------------------------- Malware remains undead, adds double-sneaky stealth mode The crooks behind the Pushdo botnet agent have developed variants of the malware that are more resistant to take-down attempts or hijacking by rival hackers. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2013/05/17/pushdo_extr… *** Hintergrund: Mehr Fakten und Spekulationen zu Skypes ominösen Link-Checks *** --------------------------------------------- Zu Beginn der Woche berichtete heise Security, dass Links, die in privaten Skype-Chat-Sitzungen verschickt werden, kurze Zeit später von einem System von Microsoft besucht werden. Wir beobachteten ausschließlich Zugriffe auf https-URLs. --------------------------------------------- http://www.heise.de/security/artikel/Mehr-Fakten-und-Spekulationen-zu-Skype… *** Targeted information stealing attacks in South Asia use email, signed binaries *** --------------------------------------------- In the past few months, we have analyzed a targeted campaign that tries to steal sensitive information from different organizations throughout the world, but particularly in Pakistan. During the course of our investigations we uncovered several leads that indicate this threat has its origin in India and has been going on for at least two years. --------------------------------------------- http://www.welivesecurity.com/2013/05/16/targeted-threat-pakistan-india/ *** Fake YouTube page targets Chrome users *** --------------------------------------------- Fake YouTube pages are one of the favored ways attackers leverage to get users to click on malicious content. --------------------------------------------- http://research.zscaler.com/2013/05/fake-youtube-page-targets-chrome-users.… *** CSRF vulnerability in LinkedIn 2013 *** --------------------------------------------- A security company has found an CSRF vulnerability in LinkedIn and they have uploaded an POC on Youtube to show the impact. The Cross Site Request Forgery attack allows the attacker to access information from an contact without the consent/knowledge of the affected user. --------------------------------------------- http://cyberwarzone.com/csrf-vulnerability-linkedin-2013? *** Blog: Malicious PACs and Bitcoins *** --------------------------------------------- Malicious PACs used by Brazilian bad guys aiming to steal bitcoins --------------------------------------------- http://www.securelist.com/en/blog/208195033/Malicious_PACs_and_Bitcoins *** April 2013 virus activity review from Doctor Web *** --------------------------------------------- May 13, 2013 IT security experts will remember April 2013 for several remarkable events. At the beginning of the month, Doctor Webs analysts hijacked a rapidly growing botnet comprised of computers infected with BackDoor.Bulknet.739. The middle of April saw the discovery of a new Trojan of the most common family 'Trojan.Mayachok' and an upsurge of spam containing subject matter related to the terrorist acts that occurred in Boston. --------------------------------------------- http://news.drweb.com/show/?i=3516&lng=en&c=9

1 0

Tageszusammenfassung - Donnerstag 16-05-2013
by Daily end-of-shift report 16 May '13

16 May '13

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 15-05-2013 18:00 − Donnerstag 16-05-2013 18:00 Handler: Matthias Fraidl Co-Handler: Robert Waldner *** HP-UX Running XNTP, Remote Denial of Service (DoS) and Execution of Arbitrary Code *** --------------------------------------------- [security bulletin] HPSBUX02859 SSRT101144 rev.3 - HP-UX Running XNTP, Remote Denial of Service (DoS) and Execution of Arbitrary Code --------------------------------------------- http://www.securityfocus.com/archive/1/526607 *** python backports ssl_match_hostname Resource Exhaustion 0day *** --------------------------------------------- Topic: python backports ssl_match_hostname Resource Exhaustion 0day Risk: Medium Text:A denial of service flaw was found in the way python-backports-ssl_match_hostname, an implementation that brings the ssl.match... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/P8TEFx3kOnQ/WLB-20… *** Exploit für lokalen Linux-Kernel-Bug im Umlauf *** --------------------------------------------- Ein bereits im April im Entwickler-Kernel-Zweig gefixter Fehler wurde nicht als sicherheitsrelevant erkannt und lässt sich deshalb auf vielen Systemen immer noch ausnutzen. --------------------------------------------- http://www.heise.de/security/meldung/Exploit-fuer-lokalen-Linux-Kernel-Bug-… *** New versatile and remote-controlled 'Android.MouaBot' malware found in the wild *** --------------------------------------------- By Cameron Palan and Nathan Collier Recently, we discovered a new malicious Android application called Android.MouaBot. This malicious software is a bot contained within another basic app; in this case, a Chinese calculator application. Behind the scenes, it automatically sends an SMS message to an auto-reply number which replies back to the phone ... --------------------------------------------- http://blog.webroot.com/2013/05/15/new-versatile-and-remote-controlled-andr… *** Download: Mobile Threat Report Q1 2013 *** --------------------------------------------- Our Mobile Threat Report Q1 2013 is now publicly available.All of our past reports are also available in the "Labs" section of f-secure.com. On 15/05/13 At 12:45 PM --------------------------------------------- http://www.f-secure.com/weblog/archives/00002553.html *** PushDo Malware Resurfaces with DGA Capabilities *** --------------------------------------------- The PushDo malware family is back, this time with a domain generation algorithm that helps it avoid detection and add resiliency to its capabilities. --------------------------------------------- http://threatpost.com/pushdo-malware-resurfaces-with-dga-capabilities/ *** zPanel themes remote command execution as root *** --------------------------------------------- Topic: zPanel themes remote command execution as root Risk: High Text:So I saw this earlier today: http://www.reddit.com/r/netsec/comments/1ee0eg/zpanel_support_team_calls_fo… ... --------------------------------------------- http://cxsecurity.com/wlb/WLB-2013050133 *** Drupal 6.x/7.x Google Authenticator login Access Bypass *** --------------------------------------------- Topic: Drupal 6.x/7.x Google Authenticator login Access Bypass Risk: High Text:View online: http://drupal.org/node/1995706 * Advisory ID: DRUPAL-SA-CONTRIB-2013-047 * Project: Google Authenticator l... --------------------------------------------- http://cxsecurity.com/wlb/WLB-2013050134 *** Analysis of Malicious Document Files Spammed by Cutwail *** --------------------------------------------- Over the past week, the Cutwail botnet has been sending out spam containing malicious documents of the aforementioned vulnerability, CVE-2012-0158. The use of a loaded RTF attachment is a departure from normal for Cutwail, usually it distributes executable attachments or links to exploit kits. --------------------------------------------- http://blog.spiderlabs.com/2013/05/malicious-document-files-spammed-by-cutw… *** RIPE: Angriffe auf das Domain Name System nehmen zu *** --------------------------------------------- Auf dem Treffen der IP-Adressverwaltung RIPE wurde darüber debattiert, die schwarze Scharfe dazu gebracht werden können, überfällige Sicherungen vorzunehmen. --------------------------------------------- http://www.heise.de/security/meldung/RIPE-Angriffe-auf-das-Domain-Name-Syst… *** Mac Spyware Found at Oslo Freedom Forum *** --------------------------------------------- The Oslo Freedom Forum is an annual event "exploring how best to challenge authoritarianism and promote free and open societies." This years conference (which took place May 13-15) had a workshop for freedom of speech activists on how to secure their devices against government monitoring. During the workshop, Jacob Appelbaum actually discovered a new and previously unknown backdoor on an African activists Mac.Our Mac analyst (Brod) is currently investigating the sample.Its signed with --------------------------------------------- http://www.f-secure.com/weblog/archives/00002554.html

1 0

Tageszusammenfassung - Mittwoch 15-05-2013
by Daily end-of-shift report 15 May '13

15 May '13

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 14-05-2013 18:00 − Mittwoch 15-05-2013 18:00 Handler: Stephan Richter Co-Handler: Robert Waldner *** Microsoft Customer Protections for May 2013 *** --------------------------------------------- Today, we are releasing 10 bulletins, addressing 33 vulnerabilities in Microsoft products. Before we get into the details, we wanted to first let our enterprise customers know about a change in how we’re communicating technical details within our security advisories. Starting today, customers will be able to clearly identify key security updates within advisories. For further details, please visit Knowledge Base article 2849195. Let’s talk about the updates that we released today. --------------------------------------------- http://blogs.technet.com/b/msrc/archive/2013/05/14/microsoft-customer-prote… *** Apache mod_rewrite Input Validation Flaw Lets Remote Users Execute Arbitrary Commands *** --------------------------------------------- A vulnerability was reported in Apache mod_rewrite. A remote user can cause arbitrary commands to be executed on the target user's system. --------------------------------------------- http://www.securitytracker.com/id/1028540 *** Cisco Unified Communications Manager Authentication Denial of Service *** --------------------------------------------- A vulnerability in device authentication of Cisco Unified Communications Manager (CUCM) could allow an unauthenticated, remote attacker to impact application response. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013… *** Security Bulletin: IBM Security Virtual Server Protection for VMware System can be affected by vulnerabilities in OpenSSL *** --------------------------------------------- IBM Security Virtual Server Protection for VMware System can be affected by several vulnerabilities in OpenSSL. These vulnerabilities include obtaining sensitive information and denial of service vulnerabilities that could be exploited remotely by an attacker. --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg21636105 *** ownCloud Multiple Vulnerabilities *** --------------------------------------------- A weakness and multiple vulnerabilities have been reported in ownCloud, which can be exploited by malicious users to disclose sensitive information, bypass certain security restrictions, conduct SQL injection attacks, and compromise a vulnerable system and by malicious people to conduct spoofing and cross-site scripting and request forgery attacks. --------------------------------------------- https://secunia.com/advisories/53392 *** Adobe Security Bulletins Posted *** --------------------------------------------- Adobe published the following Security Bulletins today: APSB13-13 – Security update: Hotfix available for ColdFusion APSB13-14 – Security updates available for Adobe Flash Player APSB13-15 – Security updates available for Adobe Reader and Acrobat Customers of the affected products should... --------------------------------------------- http://blogs.adobe.com/psirt/2013/05/adobe-security-bulletins-posted-7.html *** New 1day Exploits: Mutiny Vulnerabilities *** --------------------------------------------- The Mutiny Appliance provides a Web Frontend, where the users can configure the system and monitor the data collected by the appliance. The Frontend provides four access roles: “Super Admin”, “Administrator”, “Engineer” and “View only”. All the roles allow the user to access to the “Documents” section, where multiple weaknesses have been detected... --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2013/05/15/new-1day-… *** WordPress 1player Plugin VideoJS Cross-Site Scripting Vulnerability *** --------------------------------------------- https://secunia.com/advisories/53445 *** WordPress S3 Video Plugin VideoJS Cross-Site Scripting Vulnerability *** --------------------------------------------- https://secunia.com/advisories/53437 *** WordPress Video Embed & Thumbnail Generator Plugin VideoJS Cross-Site Scripting Vulnerability *** --------------------------------------------- https://secunia.com/advisories/53426 *** WordPress External "Video for Everybody" Plugin VideoJS Cross-Site Scripting Vulnerability *** --------------------------------------------- https://secunia.com/advisories/53396 *** Ruby DL and Fiddle Tained Object Handling Vulnerability *** --------------------------------------------- A vulnerability has been reported in Ruby, which can be exploited by malicious people to bypass certain security restrictions. --------------------------------------------- https://secunia.com/advisories/53432

1 0

Tageszusammenfassung - Dienstag 14-05-2013
by Daily end-of-shift report 14 May '13

14 May '13

======================= = End-of-Shift report = ======================= Timeframe: Montag 13-05-2013 18:00 − Dienstag 14-05-2013 18:00 Handler: Matthias Fraidl Co-Handler: Robert Waldner *** It's official: Password strength meters aren't security theater *** --------------------------------------------- Does your password go up to 11? Probably not. But one day it could. --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/fbIJ27hOPLI/ *** Kerberos kpasswd UDP ping-pong vulnerability *** --------------------------------------------- Topic: Kerberos kpasswd UDP ping-pong vulnerability Risk: High Text:This flaw has commonly been referred to as CVE-1999-0103 because that CVE also describes a UDP ping-pong attack. The same typ... --------------------------------------------- http://cxsecurity.com/wlb/WLB-2013050118 *** Vuln: Apache HTTP Server Terminal Escape Sequence in Logs Command Injection Vulnerability *** --------------------------------------------- Apache HTTP Server Terminal Escape Sequence in Logs Command Injection Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/59826 *** Telekom lanciert Cloud-Service zum Aufspüren von Sicherheitslücken *** --------------------------------------------- Mit dem Developer Garden Code Analyzer bietet die Deutsche Telekom eine Cloud-basierte statische Code-Analyse zum Finden von Sicherheitslücken in Web-Anwendungen und mobilen Apps. --------------------------------------------- http://www.heise.de/security/meldung/Telekom-lanciert-Cloud-Service-zum-Auf… *** Travnet Botnet Controls Victims With Remote Admin Tool *** --------------------------------------------- The malicious binary behind the Travnet botnet has been updated. The new code has a new compression algorithm, steals the list of running processes, adds new file extensions to its list of files to steal, and has improved its control commands. Also, after the malware has uploaded the stolen files on its remote server, the Read more... --------------------------------------------- http://blogs.mcafee.com/mcafee-labs/travnet-botnet-controls-victims-with-re… *** Vorsicht beim Skypen - Microsoft liest mit *** --------------------------------------------- Wer glaubt, ein Skype-Chat wäre privat, unterliegt einem unter Umständen folgenschweren Irrtum. Wie heise Security feststellten musste, wertet Skype beziehungsweise Microsoft alle verschickten Daten aus. --------------------------------------------- http://www.heise.de/security/meldung/Vorsicht-beim-Skypen-Microsoft-liest-m… *** WordPress Related Posts Plugin Cross-Site Request Forgery Vulnerability *** --------------------------------------------- Charlie Eriksen has discovered a vulnerability in the Related Posts plugin for WordPress, which can be exploited by malicious people to conduct cross-site request forgery attacks. --------------------------------------------- https://secunia.com/advisories/53122 *** AV-Software beseitigt Unrat des BKA-Trojaners *** --------------------------------------------- Nach einem Stupser durch heise Security und das BSI erkennen und entfernen Antiviren-Programme nun auch die nachgeladenen kinderpornographischen Bilder des BKA-Trojaners. --------------------------------------------- http://www.heise.de/security/meldung/AV-Software-beseitigt-Unrat-des-BKA-Tr… *** Back to skule: One Pad, Two Pad, Me Pad, You Pad - Cryptanalysis for beginners *** --------------------------------------------- A couple of weeks ago, Kev Sheldrake from Head Hacking gave a fascinating talk on NLP and Social Engineering at Londons DEFCON group, DC4420 (called "Social Engineering Lies!"). Afterwards, over drinks, he told me about a free cryptography course that Stanford was running, and how much fun he and his workmates were having competing with each other to solve the homework problems that were set each week... --------------------------------------------- http://adamsblog.aperturelabs.com/2013/05/back-to-skule-one-pad-two-pad-me-… *** Beta-Bot ergaunert sich Admin-Rechte und killt Virenscanner *** --------------------------------------------- Mit einem perfiden Trick versucht der Bot, sein Opfer dazu zu bringen, einen UAC-Dialog abzunicken. Die Admin-Rechte benötigt er, um anschließend den Virenscanner abzuschießen. --------------------------------------------- http://www.heise.de/security/meldung/Beta-Bot-ergaunert-sich-Admin-Rechte-u… *** WiFi Album application for iPad and iPhone command execution *** --------------------------------------------- WiFi Album application for iPad and iPhone could allow a local attacker to execute arbitrary commands on the system, caused by an error in the index module when processing to load the unique ipad or iphone photo album folder names. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/84162 *** Debian Security Advisory DSA-2667 mysql-5.5 *** --------------------------------------------- several vulnerabilities --------------------------------------------- http://www.debian.org/security/2013/dsa-2667 *** Debian Security Advisory DSA-2666 xen *** --------------------------------------------- several vulnerabilities --------------------------------------------- http://www.debian.org/security/2013/dsa-2666

1 0

Tageszusammenfassung - Montag 13-05-2013
by Daily end-of-shift report 13 May '13

13 May '13

======================= = End-of-Shift report = ======================= Timeframe: Freitag 10-05-2013 18:00 − Montag 13-05-2013 18:00 Handler: Matthias Fraidl Co-Handler: L. Aaron Kaplan *** Android.TechnoReaper Downloader Found on Google Play *** --------------------------------------------- By Nathan Collier We have found a new threat we are calling Android.TechnoReaper. This malware has two parts: a downloader available on the Google Play Market and the spyware app it downloads. The downloaders are disguised as font installing apps, as seen below: Once you install the app, it looks like a nice app used --------------------------------------------- http://blog.webroot.com/2013/05/10/android-technoreaper-downloader-found-on… *** Google Has Aggressive Plans for Strong Authentication *** --------------------------------------------- Google has a long-term plan for strong authentication that ties log-ins to the operating system and hardware, and puts up barriers against man in the middle attacks and weak passwords. --------------------------------------------- http://threatpost.com/google-has-aggressive-plans-for-strong-authentication/ *** Samsung Officeserv Read the users/passwords *** --------------------------------------------- Topic: Samsung Officeserv Read the users/passwords Risk: Medium Text:# Title:samsung officeserv Read the users/passwords # Author: MaDo Mokhtar # Contact: codezeroooo[at]yahoo[dot]com # Vendo... --------------------------------------------- http://cxsecurity.com/wlb/WLB-2013050087 *** RSA Authentication Agent cross-site scripting *** --------------------------------------------- RSA Authentication Agent cross-site scripting --------------------------------------------- http://xforce.iss.net/xforce/xfdb/84155 *** Cybercriminals offer HTTP-based keylogger for sale, accept Bitcoin *** --------------------------------------------- By Dancho Danchev In 2013, Liberty Reserve and Web Money remain the payment method of choice for the majority of Russian/Eastern European cybercriminals. Cybercrime-as-a-Service underground market propositions, malware crypters, R.A.Ts (Remote Access Trojans), brute-forcing tools etc. virtually every underground market product/service is available for purchase through the use of these ubiquitous virtual currencies. What's the situation on the international underground --------------------------------------------- http://blog.webroot.com/2013/05/10/cybercriminals-offer-http-based-keylogge… *** WordPress Securimage-WP Plugin v3.2.4 URI-based XSS Vulnerability *** --------------------------------------------- Topic: WordPress Securimage-WP Plugin v3.2.4 URI-based XSS Vulnerability Risk: Low Text:Wordpress Securimage-WP Plugin v3.2.4 URI-based XSS Vulnerability Vendor: Securimage PHP CAPTCHA Product web page: https:... --------------------------------------------- http://cxsecurity.com/wlb/WLB-2013050098 *** WordPress Search and Share plugin vulnerabilities *** --------------------------------------------- Topic: WordPress Search and Share plugin vulnerabilities Risk: Low Text:I want to inform you about vulnerabilities in Search and Share plugin for WordPress. These are Cross-Site Scripting and Ful... --------------------------------------------- http://cxsecurity.com/wlb/WLB-2013050103 *** DDoS Services Advertise Openly, Take PayPal *** --------------------------------------------- The past few years have brought a proliferation of online services that can be hired to knock Web sites and individual Internet users offline. Once only found advertised in shadowy underground forums, many of todays so-called "booter" or "stresser" services are operated by U.S. citizens who openly advertise their services while hiding behind legally dubious disclaimers. Oh, and they nearly all rely on Paypal to receive payments.Related Posts:Privacy 101: Skype Leaks Your --------------------------------------------- https://krebsonsecurity.com/2013/05/ddos-services-advertise-openly-take-pay… *** Dangerous Trojan substitutes web pages *** --------------------------------------------- May 7, 2013 Specialists from the Russian anti-virus company Doctor Web have studied one of the most widespread threats in April 2013, the Trojan Trojan.Mods.1, formerly known as Trojan.Redirect.140. According to statistics compiled by the curing utility Dr.Web CureIt!, the number of infections with this Trojan represent 3.07% of the total number of detected threats. A summary of the study can be found below. The Trojan has two components: the dropper and the dynamic link library which stores --------------------------------------------- http://news.drweb.com/show/?i=3511&lng=en&c=9 *** Newly launched E-shop for hacked PCs charges based on malware 'executions' *** --------------------------------------------- By Dancho Danchev On the majority of occasions, Cybercrime-as-a-Service vendors will sell access to malware-infected hosts to virtually anyone who pays for them, without bothering to know what happens once the transaction takes place. A newly launched E-shop for malware-infected hosts, however, has introduced a novel approach for calculating the going rate for the hacked PCs. --------------------------------------------- http://blog.webroot.com/2013/05/13/newly-launched-e-shop-for-hacked-pcs-cha… *** Blog: Telecom fraud - phishing and Trojans combined *** --------------------------------------------- In China telecom fraud has become an increasingly common crime. --------------------------------------------- http://www.securelist.com/en/blog/877/Telecom_fraud_phishing_and_Trojans_co… *** Trojaner kapert Facebook-Accounts *** --------------------------------------------- Eine bösartige Browsererweiterung befüllt Googles Chrome und Mozillas Firefox. Sie hat es auf Facebook-Konten abgesehen. --------------------------------------------- http://www.heise.de/security/meldung/Trojaner-kapert-Facebook-Accounts-1861… *** Researchers uncovered new malware used by Chinese cyber criminals *** --------------------------------------------- Trend Micro researchers have uncovered a new backdoor pieces of malware from the Winnti family, which are mainly used by a Chinese cyber criminal group to target South East Asian organizations from the video gaming sector. --------------------------------------------- http://thehackernews.com/2013/05/researchers-uncovered-new-malware-used.html *** AWS EC2 Security Vulnerability and Pinterest Hacked *** --------------------------------------------- Well, almost hacked. This is rather embarassing (for Pinterest, and maybe AWS?), in that I was able to access what seemed to be their admin page. Furthermore, I discovered through this interface that it seems they do not store passwords encrypted or salted. --------------------------------------------- http://www.jontsai.com/2013/05/11/aws-ec2-security-vulnerability-and-pinter… *** Introducing Conpot *** --------------------------------------------- We proudly announce the first release of our Industrial Control System honeypot named Conpot. Until now setting up an ICS honeypot required substantial manual work, real systems which are usually either inaccessible or expensive and lecture of quite tedious protocol specifications. --------------------------------------------- http://www.honeynet.org/node/1047 *** Attackers Target Older Java Bugs *** --------------------------------------------- It's no secret that Java has moved to the top of the target list for many attackers. It has all the ingredients they love: ubiquity, cross-platform support and, best of all, lots of vulnerabilities. Malware targeting Java flaws has become a major problem, and new statistics show that this epidemic is following much the same [...] --------------------------------------------- http://threatpost.com/attackers-target-older-java-bugs/

1 0

Tageszusammenfassung - Freitag 10-05-2013
by Daily end-of-shift report 10 May '13

10 May '13

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 09-05-2013 18:00 − Freitag 10-05-2013 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Microsoft Fix It Available for IE 8 Zero Day Used Against Labor Website *** --------------------------------------------- Microsoft released a Fix It temporary mitigation for a zero-day vulnerability in Internet Explorer 8 that was used in a watering hole attack against the U.S. Department of Labors website. --------------------------------------------- http://threatpost.com/microsoft-fix-it-available-for-ie-8-zero-day-used-aga… *** Advance Notification Service for the May 2013 Security Bulletin Release *** --------------------------------------------- Today we’re providing Advance Notification of 10 bulletins for release on Tuesday, May 14, 2013. This release brings two Critical and eight Important-class bulletins, which address 34 unique vulnerabilities. The Critical-rated bulletins address issues in Microsoft Windows and Internet Explorer. Of note, we are working to have the Internet Explorer Security Update address the issue described in Security Advisory 2847140, supplementing the currently available Fix it. The Important-rated... --------------------------------------------- http://blogs.technet.com/b/msrc/archive/2013/05/09/advance-notification-ser… *** Name.com Breached, Users Asked to Reset Passwords *** --------------------------------------------- Domain registrar Name.com is asking its customers to reset their passwords following a data breach. --------------------------------------------- http://threatpost.com/name-com-breached-users-asked-to-reset-passwords/ *** Microsoft EMET 4.0 Enables Certificate Pinning to Defeat MITM Attacks *** --------------------------------------------- Microsoft later this month will release a new version of its EMET protection tool, and this iteration will include a certificate pinning feature that will enable users to associate a specific certificate with a given certificate authority. The feature is designed a defense against man-in-the-middle attacks that use forged certificates to redirect users or intercept [...] --------------------------------------------- http://threatpost.com/microsoft-emet-4-0-enables-certificate-pinning-to-def… *** Bugtraq: [security bulletin] HPSBMU02786 SSRT100877 rev.2 - HP System Management Homepage (SMH) Running on Linux, Windows, and VMware ESX, Remote Unauthorized Access, Disclosure of Information, Data Modification, Denial of Service (DoS), Execution *** --------------------------------------------- Potential Security Impact: Remote unauthorized access, disclosure of information, data modification, Denial of Service (DoS), execution of arbitrary code --------------------------------------------- http://www.securityfocus.com/archive/1/526566 *** Bugtraq: ESA-2013-021: EMC Documentum Multiple Vulnerabilities *** --------------------------------------------- Vulnerabilities exist in several EMC Documentum products that could potentially be exploited by a malicious user. --------------------------------------------- http://www.securityfocus.com/archive/1/526570 *** Prenotification: Upcoming Security Updates for Adobe Reader and Acrobat (APSB13-15) *** --------------------------------------------- A prenotification Security Advisory has been posted in regards to upcoming Adobe Reader and Acrobat updates scheduled for Tuesday, May 14, 2013. We will continue to provide updates on the upcoming release via the Security Advisory section of the Adobe... --------------------------------------------- http://blogs.adobe.com/psirt/2013/05/prenotification-upcoming-security-upda… *** Security Advisory for ColdFusion (APSA13-03) *** --------------------------------------------- A Security Advisory (APSA13-03) has been posted in regards to a critical issue in ColdFusion 10, 9.0.2, 9.0.1 and 9.0 and earlier versions for Windows, Macintosh and UNIX. Adobe is aware of reports that exploit code for the vulnerability is... --------------------------------------------- http://blogs.adobe.com/psirt/2013/05/security-advisory-for-coldfusion-apsa1… *** WordPress xili-language Plugin "lang" Cross-Site Scripting Vulnerability *** --------------------------------------------- A vulnerability has been discovered in the xili-language plugin for WordPress, which can be exploited by malicious people to conduct cross-site scripting attacks. --------------------------------------------- https://secunia.com/advisories/53364 *** CSRF-Lücke im OpenVPN Access Server geschlossen *** --------------------------------------------- Durch eine Schwachstelle können sich Angreifer potenziell VPN-Zugänge erschleichen. --------------------------------------------- http://www.heise.de/security/meldung/CSRF-Luecke-im-OpenVPN-Access-Server-g…

1 0

Tageszusammenfassung - Mittwoch 8-05-2013
by Daily end-of-shift report 08 May '13

08 May '13

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 07-05-2013 18:00 − Mittwoch 08-05-2013 18:00 Handler: Stephan Richter Co-Handler: Robert Waldner *** A short introduction to TPMs *** --------------------------------------------- Ive been working on TPMs lately. It turns out that theyre moderately awful, but whats significantly more awful is basically all the existing documentation. So heres some of what Ive learned, presented in the hope that it saves someone else some amount of misery.What is a TPM?TPMs are devices that adhere to the Trusted Computing Groups Trusted Platform Module specification. Theyre typically microcontrollers[1] with a small amount of flash, and attached via either i2c (on embedded devices) or... --------------------------------------------- http://mjg59.dreamwidth.org/24818.html *** IBM WebSphere DataPower XC10 security bypass *** --------------------------------------------- Description: IBM WebSphere DataPower XC10 could allow a remote attacker to send administrative operations without providing authentication credentials. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/83617 *** Brother MFC-9970CDW Firmware 0D Cross Site Scripting *** --------------------------------------------- Topic: Brother MFC-9970CDW Firmware 0D Cross Site Scripting Risk: Low Text: == Brother MFC-9970CDW Firmware 0D Date: Jan. 13, 2013 URL: http://www.cloudscan.me/2013/05/xss-javascri... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/daraqfRQFuQ/WLB-20… *** Inside RDPxTerm (panel 5.1 - bot 4.4.2) aka Neshta C&C - Botnet control panel *** --------------------------------------------- http://malware.dontneedcoffee.com/2013/05/inside-rdpxterm-bot-442-panel-51-… *** mTAN-Trojaner via SMS und Google Play *** --------------------------------------------- Mehrere Leser berichten von SMS-Nachrichten, die zur Installation einer angeblichen Zertifikats-App auffordern. Der AV-Hersteller Lookout hat einen dieser mTAN-Trojaner unterdessen auch in Googles Play Store entdeckt. --------------------------------------------- http://www.heise.de/security/meldung/mTAN-Trojaner-via-SMS-und-Google-Play-… *** [webapps] - ColdFusion 9-10 - Remote Root Exploit *** --------------------------------------------- http://www.exploit-db.com/exploits/25305 *** [webapps] - MoinMoin - Arbitrary Command Execution *** --------------------------------------------- http://www.exploit-db.com/exploits/25304 *** WordPress WP-PostViews Plugin Cross-Site Request Forgery Vulnerability *** --------------------------------------------- https://secunia.com/advisories/53127 *** IBM OpenPages GRC Platform Multiple Java Vulnerabilities *** --------------------------------------------- https://secunia.com/advisories/53357 *** WordPress GRAND FlAGallery Plugin "gid" SQL Injection Vulnerability *** --------------------------------------------- https://secunia.com/advisories/53356 *** Webserver-Rootkit befällt auch lighttpd und nginx *** --------------------------------------------- Die Virenforscher von Eset haben Linux/Cdorked.A auf weiteren Servertypen entdeckt. Der Schädling leitet Webseitenbesucher auf gefährliche Seiten um, die versuchen, das System durch Sicherheitslücken mit Schadcode zu infizieren. --------------------------------------------- http://www.heise.de/security/meldung/Webserver-Rootkit-befaellt-auch-lightt… *** Hacked DNS Servers Used in Linux/Cdorked Malware Campaign *** --------------------------------------------- The attack that employed compromised Apache Web server binaries is turning out to be more complex than originally thought, as researchers now have found that the attackers also are using Trojaned Nginx and Lighttpd binaries as part of the campaign. More concerning, though, is the possibility that the attacks also have compromised a number of [...] --------------------------------------------- http://threatpost.com/hacked-dns-servers-used-in-linuxcdorked-malware-campa… *** Basic Use of Maltego for Network Intelligence Gathering *** --------------------------------------------- https://www.youtube.com/watch?&v=e33NSUkyEg0 --------------------------------------------- http://www.frontlinesentinel.com/2013/05/basic-use-of-maltego-for-network.h… Next End-of-Shift report on 2013-05-10

1 0

Tageszusammenfassung - Dienstag 7-05-2013
by Daily end-of-shift report 07 May '13

07 May '13

======================= = End-of-Shift report = ======================= Timeframe: Montag 06-05-2013 18:00 − Dienstag 07-05-2013 18:00 Handler: Stephan Richter Co-Handler: Robert Waldner *** Bugtraq: ESA-2013-015: RSA Archer® GRC Multiple Vulnerabilities *** --------------------------------------------- ESA-2013-015: RSA Archer® GRC Multiple Vulnerabilities --------------------------------------------- http://www.securityfocus.com/archive/1/526542 *** Is there an epidemic of typo squatting?, (Tue, May 7th) *** --------------------------------------------- One of our readers, Jim, wrote in earlier today to say he has noticed an increase in "working" typo squatting over the last 2 months or so. That is, hes seen users accidently surfing to them or being redirected there by some sort of malicious javascript trickery. His question for us (and the rest of you) is, is this a local phenomenon or are the bad guys making more use of this tactic? Im not currently setup to monitor this type of activity, so I figured Id ask our loyal readers. Do... --------------------------------------------- http://isc.sans.edu/diary.html?storyid=15740&rss *** Security Bulletin: IBM Content Collector affected by vulnerabilities in IBM Java SDK *** --------------------------------------------- Multiple security vulnerabilities exist in the IBM Java SDK that is shipped with IBM Content Collector. --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg21634236 *** Security Bulletin: IBM Notes PNG integer overflow (CVE-2013-2977) *** --------------------------------------------- IBM Notes has an integer overflow vulnerability which may be triggered by viewing a malformed PNG image. --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg21635878 *** Security Bulletin: Multiple security vulnerabilities addressed in IBM Sterling Secure Proxy *** --------------------------------------------- IBM Sterling Secure Proxy is vulnerable to spoofing and information disclosure attacks. --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg21636369 *** MyBB Game Section Plugin "des" and "s" Cross-Site Scripting Vulnerabilities *** --------------------------------------------- https://secunia.com/advisories/53296 *** Hacker verschafften sich Zugriff auf alle .edu-Domains *** --------------------------------------------- Die Hackergruppe "Hack The Planet" veröffentlicht Informationen zu Lücken in MoinMoin und ColdFusion, über die sie sich unter anderem Zugriff auf alle .edu-Domains, die Website des Sicherheitstools Nmap sowie andere prominente Websites verschaffte. --------------------------------------------- http://www.heise.de/security/meldung/Hacker-verschafften-sich-Zugriff-auf-a… *** Wonderware Information Server Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for multiple vulnerabilities that impact the Invensys Wonderware Information Server (WIS) software. --------------------------------------------- http://ics-cert.us-cert.gov/advisories/ICSA-13-113-01 *** Bugtraq: SEC Consult SA-20130507-0 :: Multiple vulnerabilities in NetApp OnCommand System Manager *** --------------------------------------------- http://www.securityfocus.com/archive/1/526552 *** Honeywords sollen Passwortdiebe in die Falle locken *** --------------------------------------------- Zwei Krypto-Forscher schlagen vor, Datendiebe mit Köder-Passwörten zu überführen. Loggt sich jemand mit einem der sogenannten Honeywords ein, ist ziemlich sicher etwas faul. --------------------------------------------- http://www.heise.de/security/meldung/Honeywords-sollen-Passwortdiebe-in-die… *** nginx "ngx_http_parse_chunked()" Buffer Overflow Vulnerability *** --------------------------------------------- nginx "ngx_http_parse_chunked()" Buffer Overflow Vulnerability --------------------------------------------- https://secunia.com/advisories/53248 *** XSS, LFI in Cisco, Linksys E4200 Firmware *** --------------------------------------------- Reflected XSS + LFI Bugs in the Cisco, Linksys E4200 Wireless Router Firmware Version: 1.0.05 build 7 were discovered by our Researchers in January 2013 and finally acknowledged by Linksys in April 2013. The Vendor is unable to Patch the Vulnerability in a reasonable timeframe. --------------------------------------------- http://www.cloudscan.me/2013/05/xss-lfi-linksys-e4200-firmware-0d.html

1 0

Tageszusammenfassung - Montag 6-05-2013
by Daily end-of-shift report 06 May '13

06 May '13

======================= = End-of-Shift report = ======================= Timeframe: Freitag 03-05-2013 18:00 − Montag 06-05-2013 18:00 Handler: Stephan Richter Co-Handler: Robert Waldner *** What’s a known source of malware doing in an iOS app? Ars investigates *** --------------------------------------------- Trojans, false positives, and the case of accidental cross contamination. --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/suyRCkbyIFE/ *** gpsd AIS driver packet parser denial of service *** --------------------------------------------- gpsd AIS driver packet parser denial of service --------------------------------------------- http://xforce.iss.net/xforce/xfdb/83982 *** EMC Avamar Client Certificate Validation Flaw Lets Remote Users Spoof the System *** --------------------------------------------- http://www.securitytracker.com/id/1028511 *** EMC Avamar Authorization Flaw Lets Remote Authenticated Users Access Files *** --------------------------------------------- http://www.securitytracker.com/id/1028510 *** Microsoft Releases Security Advisory 2847140 *** --------------------------------------------- Today, we released Security Advisory 2847140 regarding an issue that impacts Internet Explorer 8. Internet Explorer 6, 7, 9 and 10 are not affected by the vulnerability. This issue allows remote code execution if users browse to a malicious website with an affected browser. This would typically occur by an attacker convincing someone to click a link in an email or instant message. Internet Explorer 9 and 10 are not affected by this issue, so upgrading to these versions will help protect you... --------------------------------------------- http://blogs.technet.com/b/msrc/archive/2013/05/03/microsoft-releases-secur… *** Department of Labor IE 0-day Exploit (CVE-2013-1347) Now Available at Metasploit *** --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2013/05/05/departmen… *** New version of DIY Google Dorks based mass website hacking tool spotted in the wild *** --------------------------------------------- By Dancho Danchev Need a compelling reason to perform search engine reconnaissance on your website, for the purpose of securing it against eventual compromise? We’re about to give you a good one. A new version of a well known mass website hacking tool has been recently released, empowering virtually anyone who buys it with the capability to [...] --------------------------------------------- http://feedproxy.google.com/~r/WebrootThreatBlog/~3/8hoG6XIwk8s/ *** Vuln: WordPress Advanced XML Reader Plugin XML External Entity Information Disclosure Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/59618 *** Cisco WebEx Cache Directory Read Vulnerability *** --------------------------------------------- A vulnerability in HTTP processing in multiple Cisco WebEx products could allow an unauthenticated, remote attacker to read files from the cache directory. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013… *** Cisco WebEx Uninitialized Memory Read Vulnerability *** --------------------------------------------- A vulnerability in HTTP processing in multiple Cisco WebEx products could allow an unauthenticated, remote attacker to read uninitialized memory. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013… *** Bugtraq: VULNERABLE and COMPLETELY outdated 3rd-party libraries/components used in 3CX Phone 6 *** --------------------------------------------- http://www.securityfocus.com/archive/1/526541 *** Bugtraq: [SE-2012-01] New security vulnerabilities and broken fixes in IBM Java *** --------------------------------------------- http://www.securityfocus.com/archive/1/526540

1 0

Tageszusammenfassung - Freitag 3-05-2013
by Daily end-of-shift report 03 May '13

03 May '13

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 02-05-2013 18:00 − Freitag 03-05-2013 18:00 Handler: Matthias Fraidl Co-Handler: Stephan Richter *** Weekly Update: WordPress Total Cache and Mimikatz *** --------------------------------------------- Someone once described PHP as a "web API for remote code execution," and it's true that PHP is definitely web programming without guardrails. This week's security news was dominated by a RCE vulnerability in a pair of wildly popular WordPress plugins, W3 Total Cache and WP Super Cache, which are written in (wait for it) PHP. --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2013/05/02/weekly-up… *** A peek inside a CVE-2013-0422 exploiting DIY malicious Java applet generating tool *** --------------------------------------------- On a regular basis we profile various DIY (do it yourself) releases offered for sale on the underground marketplace with the idea to highlight the re-emergence of this concept which allows virtually anyone obtaining the leaked tools, or purchasing them, to launch targeted malware attacks. Can DIY exploit generating tools be considered [...] --------------------------------------------- http://blog.webroot.com/2013/05/02/a-peek-inside-a-cve-2013-0422-exploiting… *** Android-Virenscanner sind leicht auszutricksen *** --------------------------------------------- Forscher haben versucht, bekannte Android-Schädlinge an zehn Virenschutzprogramme vorbei zu schleusen und hatten damit zehn Mal Erfolg. Oft genügten minimale Veränderungen an der Malware. --------------------------------------------- http://www.heise.de/security/meldung/Android-Virenscanner-sind-leicht-auszu… *** Oracle 11g TNS listener remote Null Pointer Dereference (pre-auth) *** --------------------------------------------- Topic: Oracle 11g TNS listener remote Null Pointer Dereference (pre-auth) Risk: High Text:High Risk Vulnerability in Oracle Database 11g 1 May 2013 Andy Davis of NCC Group has discovered a High risk vulnerability... --------------------------------------------- http://cxsecurity.com/wlb/WLB-2013050020 *** New IRC/HTTP based DDoS bot wipes out competing malware *** --------------------------------------------- Everyday, new vendors offering malicious software enter the underground marketplace. And although many will fail to differentiate their underground market proposition in market crowded with reputable, trusted and verified sellers, others will quickly build their reputation on the basis of their 'innovative' work, potentially stealing some market share and becoming rich by offering the [...] --------------------------------------------- http://blog.webroot.com/2013/05/03/new-irchttp-based-ddos-bot-wipes-out-com… *** Multi-Stage Exploit Attacks for More Effective Malware Delivery *** --------------------------------------------- Most drive-by exploit kits use a minimal exploit shellcode that downloads and runs the final payload. This is akin to a two-stage ICBM (InterContinental Ballistic Missile) where the first stage, the exploit, puts the rocket in its trajectory and the second stage, the payload, inflicts the damage. --------------------------------------------- http://www.trusteer.com/blog/multi-stage-exploit-attacks-for-more-effective… *** Fast digital forensics sniff out accomplices *** --------------------------------------------- Software that rapidly analyses digital devices and builds a list of a suspects known associates could be a powerful tool for solving crimes. --------------------------------------------- http://www.newscientist.com/article/mg21829156.200-fast-digital-forensics-s… *** Adobe to Patch Reader Information Leak Bug *** --------------------------------------------- Adobe is planning to patch a fairly low severity security vulnerability in all of the current versions of Reader and Acrobat that could enable an attacker to track which users have opened a certain PDF document. The vulnerability can't be used for code execution, but researchers say it could be used as part of a [...] --------------------------------------------- http://threatpost.com/adobe-to-patch-reader-information-leak-bug/

1 0

Tageszusammenfassung - Donnerstag 2-05-2013
by Daily end-of-shift report 02 May '13

02 May '13

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 30-04-2013 18:00 − Donnerstag 02-05-2013 18:00 Handler: Matthias Fraidl Co-Handler: Robert Waldner *** Shamoon/DistTrack Malware (Update A) *** --------------------------------------------- OverviewW32.DistTrack, also known as "Shamoon," is an information-stealing malware that also includes a destructive module. Shamoon renders infected systems useless by overwriting the Master Boot Record (MBR), the partition tables, and most of the files with random data. Once overwritten, the data are not recoverable. Based on initial reporting and analysis of the malware, no evidence exists that Shamoon specifically targets industrial control systems (ICSs) components or U.S. --------------------------------------------- http://ics-cert.us-cert.gov/jsar/JSAR-12-241-01A *** More Malware Showing Up on Fake SourceForge Web Sites *** --------------------------------------------- Malware developers continue to clone SourceForge Web sites that appear to offer the source code for popular gaming software but are actually peddling malicious code tied to the ZeroAccess Trojan. Julien Sobrier, a security researcher for San Jose-based cloud security provider Zscaler, on Tuesday outlined several more malicious versions of the popular file-sharing sites, some [...] --------------------------------------------- http://threatpost.com/more-malware-showing-up-on-fake-sourceforge-web-sites/ *** [webapps] - D-Link IP Cameras Multiple Vulnerabilities *** --------------------------------------------- D-Link IP Cameras Multiple Vulnerabilities --------------------------------------------- http://www.exploit-db.com/exploits/25138 *** DSA-2665 strongswan *** --------------------------------------------- authentication bypass --------------------------------------------- http://www.debian.org/security/2013/dsa-2665 *** MediaWiki 1.20.5 and 1.19.6 Multiple Vulns *** --------------------------------------------- Topic: MediaWiki 1.20.5 and 1.19.6 Multiple Vulns Risk: Medium Text:I would like to announce the release of MediaWiki 1.20.5 and 1.19.6. These releases fix 2 security related issues that could a... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/-pvFzkoA-H4/WLB-20… *** FortiClient VPN Client Discloses Password to Remote Users in Certain Cases *** --------------------------------------------- FortiClient VPN Client Discloses Password to Remote Users in Certain Cases --------------------------------------------- http://www.securitytracker.com/id/1028501 *** Java applets run wild inside Notes *** --------------------------------------------- Full compromise possible Attackers with a desire to rummage around inside the PCs of Notes users can do so merely by sending HTML emails containing a Java applet or JavaScript, IBM has admitted in a security advisory.… --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2013/05/02/java_runs_i… *** Kritische Schwachstelle in hunderten Industrieanlagen *** --------------------------------------------- heise Security hat etliche deutsche Industrieanlagen entdeckt, die leichtsinnig mit dem Internet verbunden sind. Doch damit nicht genug: Durch eine Schwachstelle kann quasi jeder die Kontrolle über Heizkraftwerke, Rechenzentren oder Brauereien übernehmen. --------------------------------------------- http://www.heise.de/security/meldung/Kritische-Schwachstelle-in-hunderten-I… *** Niederlande: Gesetzentwurf über Entschlüsselungsbefehl *** --------------------------------------------- Verdächtige sollen gezwungen werden können, das Passwort für verschlüsselte Datenträger herauszugeben. Begründung: Die Festplattenverschlüsselung Truecrypt werde regelmäßig zur Verschleierung von Kinderporno-Besitz genutzt. --------------------------------------------- http://www.heise.de/security/meldung/Niederlande-Gesetzentwurf-ueber-Entsch… *** Red Hat update for JBoss Enterprise Application Platform and JBoss Enterprise Web Platform *** --------------------------------------------- Red Hat update for JBoss Enterprise Application Platform and JBoss Enterprise Web Platform --------------------------------------------- https://secunia.com/advisories/53208 *** Malicious PDFs On The Rise *** --------------------------------------------- Throughout 2012, we saw a wide variety of APT campaigns leverage an exploit in Microsoft Word (CVE-2012-0158). This represented a shift, as previously CVE-2010-3333 was the most commonly used Word vulnerability. While we continue to see CVE-2012-0158 in heavy use, we have noticed increasing use of an exploit for Adobe Reader (CVE-2013-0640) that was made infamous by the “MiniDuke” campaign. The malware dropped by these malicious PDFs is not associated with MiniDuke, but it is --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/malicious-pdfs-o…

1 0

Tageszusammenfassung - Dienstag 30-04-2013
by Daily end-of-shift report 30 Apr '13

30 Apr '13

======================= = End-of-Shift report = ======================= Timeframe: Montag 29-04-2013 18:00 − Dienstag 30-04-2013 18:00 Handler: Stephan Richter *** Yahoo! Browser for Android Address Bar Spoofing Weakness *** --------------------------------------------- https://secunia.com/advisories/53214 *** Ruggedcom ROS Hard-Coded RSA SSL Private Key Update *** --------------------------------------------- OverviewThis Updated Advisory is a follow-up to the original advisory titled ICSA-12-354-01 RuggedCom ROS Hard-Coded RSA SSL Private Key that was published December 18, 2012, on the ICS-CERT Web page.Independent researcher Justin W. Clarke of Cylance Inc., has identified the use of hard-coded RSA SSL private key in RuggedCom's Rugged Operating System (ROS). RuggedCom, an independent subsidiary of Siemens, has produced a new version of the ROS that mitigates this vulnerability. --------------------------------------------- http://ics-cert.us-cert.gov/advisories/ICSA-12-354-01A *** Admin beware: Attack hitting Apache websites is invisible to the naked eye *** --------------------------------------------- Newly discovered Linux/Cdorked evades detection by running in shared memory. --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/MpO11h_pn5M/ *** Apache attack drives traffic to malware *** --------------------------------------------- Blackhole redirect served by modified daemon binary A security researcher is warning that an attack on the Apache Web server is increasingly showing up in the wild, and has published a free Python tool to check their configurations. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2013/04/30/apache_dcor… *** TinyMCE Ajax File Manager Remote Code Execution *youtube *** --------------------------------------------- http://cxsecurity.com/wlb/WLB-2013040207 *** phpMyAdmin 3.5.8 Authenticated Remote Code Execution Exploit *** --------------------------------------------- http://cxsecurity.com/wlb/WLB-2013040203 *** WordPress Easy AdSense Lite Plugin Cross-Site Request Forgery Vulnerability *** --------------------------------------------- https://secunia.com/advisories/52953 *** FreeBSD NFS Server Input Validation Bug May Let Remote Users Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1028491 *** HP Service Manager Multiple Vulnerabilities *** --------------------------------------------- https://secunia.com/advisories/53260 *** [TYPO3-announce] [TYPO3-dev] Announcing TYPO3 CMS 6.1.0 Final Release *** --------------------------------------------- http://typo3.org/download/release-notes/typo3-61-release-notes/ Next End-of-Shift report on 2013-05-02

1 0

Tageszusammenfassung - Montag 29-04-2013
by Daily end-of-shift report 29 Apr '13

29 Apr '13

======================= = End-of-Shift report = ======================= Timeframe: Freitag 26-04-2013 18:00 − Montag 29-04-2013 18:00 Handler: Matthias Fraidl Co-Handler: Christian Wojner *** Dutchman Arrested in Spamhaus DDoS *** --------------------------------------------- A 35-year-old Dutchman thought to be responsible for launching whats been called "the largest publicly announced online attack in the history of the Internet" was arrested in Barcelona on Thursday by Spanish authorities. The man, identified by Dutch prosecutors only as "SK," was being held after a European warrant was issued for his arrest in connection with a series of massive online attacks last month against Spamhaus, an anti-spam organization ... --------------------------------------------- http://krebsonsecurity.com/2013/04/dutchman-arrested-in-spamhaus-ddos/ *** McAfee ePolicy Orchestrator Input Validation Flaw Lets Remote Users Inject SQL Commands, Execute Arbitrary Code, and Upload Files *** --------------------------------------------- McAfee ePolicy Orchestrator Input Validation Flaw Lets Remote Users Inject SQL Commands, Execute Arbitrary Code, and Upload Files --------------------------------------------- http://www.securitytracker.com/id/1028479 *** Tracking PDF Usage Poses a Security Problem *** --------------------------------------------- Looking back this year's RSA Conference, you might have the feeling that the current threat landscape is primarily a series of advanced attacks. This concept includes well-known advanced persistent threats (APTs) and zero-day vulnerability exploits. To respond to this trend in threats, McAfee Labs has launched several innovative projects, one of which we call the advanced exploit detection system (AEDS). --------------------------------------------- http://blogs.mcafee.com/mcafee-labs/tracking-pdf-usage-poses-a-security-pro… *** VMware security updates for vCenter Server VMSA-2013-0006 *** --------------------------------------------- VMware security updates for vCenter Server --------------------------------------------- https://www.vmware.com/support/support-resources/advisories/VMSA-2013-0006.… *** Hacker klauen Daten von 50 Millionen LivingSocial-Kunden *** --------------------------------------------- Aller Voraussicht nach sind Hacker in Besitz der auf den LivingSocial-Servern hinterlegten persönlichen Kundendaten gelangt. --------------------------------------------- http://www.heise.de/security/meldung/Hacker-klauen-Daten-von-50-Millionen-L… *** The Importance of Strong Passwords on Social Media *** --------------------------------------------- Last Tuesday, April 23, the Twitter account of the Associated Press news agency was hacked and sent out a hoax tweet reporting that President Barack Obama had been injured by an explosion in the White House. Within seconds, Wall Street was in panic mode and US stock plunged. Situations like this illustrate once again the ... --------------------------------------------- http://pandalabs.pandasecurity.com/the-importance-of-strong-passwords-on-so… *** Manipulierte Apache-Binaries laden Schadcode *** --------------------------------------------- Sicherheitsunternehmen haben nach eigenen Angaben Hunderte von manipulierten Apache-Servern gefunden, die sich von Angreifern steuern lassen. Sie leiten Requests auf Malware- und Porno-Seiten um. --------------------------------------------- http://www.heise.de/security/meldung/Manipulierte-Apache-Binaries-laden-Sch… *** BOINC Multiple vulnerabilities *** --------------------------------------------- Topic: BOINC Multiple vulnerabilities Risk: Medium Text:There have been various recent(-ish) vulnerabilities found in the BOINC software for desktop grid computing. The major project... --------------------------------------------- http://cxsecurity.com/wlb/WLB-2013040196 *** D-Link DIR-635 change password security bypass *** --------------------------------------------- D-Link DIR-635 change password security bypass --------------------------------------------- http://xforce.iss.net/xforce/xfdb/83832 *** Gegen selbst-aktualisierende Apps: Googles Play Store schafft eine "Lex Facebook" *** --------------------------------------------- Im März brachte Facebook erste Updates für seine Android-App heraus, die am Play Store vorbei geschleust wurden. Jetzt hat der Play Store seine Entwickler-Richtlinien geändert. Updates sind nur über den Play Store legitim. --------------------------------------------- http://www.heise.de/security/meldung/Gegen-selbst-aktualisierende-Apps-Goog… *** Library of Malware Traffic Patterns *** --------------------------------------------- Traffic analysis has been the primary method of malware identification and thousands of IDS signatures developed are the daily proof. Signatures definitely help but ability to visually recognize malware traffic patterns and see the trends when they change has been always an important skill for anyone tasked with network defense. --------------------------------------------- http://www.deependresearch.org/2013/04/library-of-malware-traffic-patterns.… *** C&C Servers Reconfigured to Make Them More Advanced *** --------------------------------------------- FireEye, which recently released a report The Advanced Cyber Attack Landscape describes cyber-criminals as doing better in bypassing identification by constantly changing the configurations of their central C&C structures so foremost malware is able to establish communication with localized C&C infrastructures, meaning the identical nation-based infrastructures where the newly-contaminated computers are situated, ... --------------------------------------------- http://www.spamfighter.com/News-18322-CC-Servers-Reconfigured-to-Make-Them-… *** The Security Risks of Unlocking Your Android Phone's Bootloader *** --------------------------------------------- ndroid geeks often unlock their bootloaders to root their devices and install custom ROMs. But there's a reason devices come with locked bootloaders unlocking your bootloader creates security risks. --------------------------------------------- http://www.howtogeek.com/142502/htg-explains-the-security-risks-of-unlockin… *** The Latest Java Exploit with Security Prompt/Warning Bypass (CVE-2013-2423) *** --------------------------------------------- >From Java SE 7 update 11 oracle has introduced a new security features called security warning that prompts a window every time an applet request for execution. --------------------------------------------- http://security-obscurity.blogspot.co.at/2013/04/the-latest-java-exploit-wi…

1 0

Tageszusammenfassung - Freitag 26-04-2013
by Daily end-of-shift report 26 Apr '13

26 Apr '13

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 25-04-2013 18:00 − Freitag 26-04-2013 18:00 Handler: Stephan Richter Co-Handler: L. Aaron Kaplan *** Bugtraq: Nginx ngx_http_close_connection function integer overflow *** --------------------------------------------- http://www.securityfocus.com/archive/1/526439 *** Anti-Phishing Workgroup Publishes 2012 Global Phishing Report. Download here: http://docs.apwg.org/reports/APWG_GlobalPhishingSurvey_2H2012.pdf, (Thu, Apr 25th) *** --------------------------------------------- -- John Bambenek bambenek \at\ gmail /dot/ com Bambenek Consulting (c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. --------------------------------------------- http://isc.sans.edu/diary.html?storyid=15683&rss *** Vulnerability in Citrix NetScaler Access Gateway Enterprise Edition Could Result in Unauthorized Access to Network Resources *** --------------------------------------------- A vulnerability has been identified in NetScaler Access Gateway Enterprise Edition that could allow a remote attacker to gain unauthorized access to internal network resources. --------------------------------------------- http://support.citrix.com/article/ctx137238 *** HPSBPI02868 SSRT101017 rev.1 - HP Managed Printing Administration (MPA), Remote Cross Site Scripting (XSS) *** --------------------------------------------- A potential security vulnerability has been identified with HP Managed Printing Administration (MPA). The vulnerability could be exploited remotely resulting in cross site scripting (XSS). --------------------------------------------- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c037… *** Multiple HP LaserJet products unauthorized access *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/83817 *** VMSA-2013-0006 VMware security updates for vCenter Server *** --------------------------------------------- VMware has updated vCenter Server Appliance (vCSA) and vCenter Server running on Windows to address multiple security vulnerabilities. --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2013-0006.html *** IBM Security Bulletin: Vulnerabilities in AppScan Standard *** --------------------------------------------- The IBM Security AppScan Standard 8.6 (previously known as IBM Rational AppScan Standard Edition) release includes fixes to two security vulnerabilities. --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg21609022 *** Security Bulletin: Vulnerability in Sametime Links (CVE-2013-0533) *** --------------------------------------------- Sametime Links can be exploited to create a DOM-based XSS vulnerability. A fix is provided. CVE(s): CVE-2013-0533 Affected product(s) and affected version(s): Sametime Links 8.0.2, 8.5, 8.5.1, 8.5.1.1, 8.5.1.2, 8.5.2, 8.5.2.1 server on any platform. Refer to the following reference URLs for remediation and additional vulnerability details. --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_vul… *** Possible Exploit Vector for DarkLeech Compromises *** --------------------------------------------- Often it is quite surprising how long old, well-known vulnerabilities continue to be exploited. Recently, a friend sent me an example of a malicious script used in an attempted attack against their server:... --------------------------------------------- http://blogs.cisco.com/security/possible-exploit-vector-for-darkleech-compr…

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily