- Daily - CERT.at

Tageszusammenfassung - 28.09.2023
by Daily end-of-shift report 28 Sep '23

28 Sep '23

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 27-09-2023 18:00 − Donnerstag 28-09-2023 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Researchers Release Details of New RCE Exploit Chain for SharePoint ∗∗∗ --------------------------------------------- One of the already-patched flaws enables elevation of privilege, while the other enables remote code execution. --------------------------------------------- https://www.darkreading.com/vulnerabilities-threats/reseachers-release-deta… ∗∗∗ Unzählige Anwendungen betroffen: Chaos bei WebP-Lücke ∗∗∗ --------------------------------------------- Anfangs ordnete Google die Lücke aber nur dem hauseigenen Webbrowser Chrome zu. Mittlerweile hat Google sich aber korrigiert und für die alte Sicherheitslücke (CVE-2023-4863 "hoch") den neuen Eintrag CVE-2023-5129 mit einer kritischen Einstufung (CVSS Score 10 von 10) eingereicht. Dieser wurde aber bereits nach sechs Stunden durch Google als ungültig erklärt. Als Grund ist angegeben, dass der neue Eintrag sich mit dem alten Eintrag doppelt. --------------------------------------------- https://www.heise.de/-9319783 ∗∗∗ SMS Security & Privacy Gaps Make It Clear Users Need a Messaging Upgrade ∗∗∗ --------------------------------------------- Like any forty-year-old technology, SMS is antiquated compared to its modern counterparts. That’s especially concerning when it comes to security. --------------------------------------------- http://security.googleblog.com/2023/09/sms-security-privacy-gaps-make-it-cl… ∗∗∗ Mit Cloudflare Cloudflare umgehen ∗∗∗ --------------------------------------------- Von Cloudflare-Kunden konfigurierte Schutzmechanismen (z. B. Firewall, DDoS-Schutz) für Webseiten können aufgrund von Lücken in den mandantenübergreifenden Schutzmaßnahmen umgangen werden, wodurch Kunden potenziell Angriffen ausgesetzt sind, welche von Cloudflare verhindert werden sollten. --------------------------------------------- https://certitude.consulting/blog/de/cloudflare-verwenden-um-cloudflare-zu-… ∗∗∗ TrendMicro veröffentlicht kritischen Patch für Apex One SP1 Build 12512 ∗∗∗ --------------------------------------------- Der kritische Patch beseitigt gleich mehrere Bugs, wovon einer verhindert, dass der Apex One-Server Virenerkennungsprotokolldaten von verwalteten Sicherheitsagenten empfangen kann. --------------------------------------------- https://www.borncity.com/blog/2023/09/28/trendmicro-verffentlicht-kritische… ∗∗∗ SSH keys stolen by stream of malicious PyPI and npm packages ∗∗∗ --------------------------------------------- A stream of malicious npm and PyPi packages have been found stealing a wide range of sensitive data from software developers on the platforms. --------------------------------------------- https://www.bleepingcomputer.com/news/security/ssh-keys-stolen-by-stream-of… ===================== = Vulnerabilities = ===================== ∗∗∗ Cisco Security Advisories 2023-09-27 ∗∗∗ --------------------------------------------- Cisco has published 15 security advisories: (1x Critical, 7x High, 6x Medium, 1x Informational) --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/Search.x?publicationTypeIDs… ∗∗∗ Hoymiles: Bedrohliche Lücken in der S-Miles-Cloud ∗∗∗ --------------------------------------------- Ein Sicherheitsforscher hat sich Hoymiles Cloudservice genauer angesehen und Lücken gefunden, über die Wechselrichter sogar zerstört werden können. --------------------------------------------- https://www.heise.de/-9319500 ∗∗∗ Mozilla: Security Vulnerability fixed in Firefox 118.0.1, Firefox ESR 115.3.1, Firefox for Android 118.1.0, and Firefox Focus for Android 118.1.0. ∗∗∗ --------------------------------------------- CVE-2023-5217: Heap buffer overflow in libvpx. Impact: critical --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2023-44/ ∗∗∗ Google Chrome 117.0.5938.132 ∗∗∗ --------------------------------------------- Google hat zum 27. September 2023 Updates des Google Chrome Browsers 117 im Stable Channel für Mac, Linux und Windows freigegeben. Es ist ein Sicherheitsupdate, das ausgerollt werden und mehrere Schwachstellen (Einstufung teilweise als "hoch") beseitigen sollen. --------------------------------------------- https://www.borncity.com/blog/2023/09/28/google-chrome-117-0-5938-132/ ∗∗∗ GStreamer Security Advisories 2023-09-20 ∗∗∗ --------------------------------------------- GStreamer has published 3 security advisories at 2023-09-20. --------------------------------------------- https://gstreamer.freedesktop.org/security/ ∗∗∗ Hancom Office 2020 HWord footerr use-after-free vulnerability ∗∗∗ --------------------------------------------- A use-after-free vulnerability exists in the footerr functionality of Hancom Office 2020 HWord 11.0.0.7520. A specially crafted .doc file can lead to a use-after-free. An attacker can trick a user into opening a malformed file to trigger this vulnerability. --------------------------------------------- https://talosintelligence.com/vulnerability_reports/TALOS-2023-1759 ∗∗∗ Accusoft ImageGear dcm_pixel_data_decode out-of-bounds write vulnerability ∗∗∗ --------------------------------------------- An out-of-bounds write vulnerability exists in the dcm_pixel_data_decode functionality of Accusoft ImageGear 20.1. A specially crafted malformed file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability. --------------------------------------------- https://talosintelligence.com/vulnerability_reports/TALOS-2023-1802 ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (ncurses), Fedora (emacs, firecracker, firefox, libkrun, python-oauthlib, and virtiofsd), Mageia (glibc and vim), Oracle (18), SUSE (bind, binutils, busybox, cni, cni-plugins, container-suseconnect, containerd, curl, exempi, ffmpeg, firefox, go1.19-openssl, go1.20-openssl, gpg2, grafana, gsl, gstreamer-plugins-bad, gstreamer-plugins-base, libpng15, libwebp, mutt, nghttp2, open-vm-tools, pmix, python-brotlipy, python3, python310, qemu, quagga, rubygem-actionview-5_1, salt, supportutils, xen, and xrdp), and Ubuntu (libwebp, minidlna, puma, and python2.7, python3.5). --------------------------------------------- https://lwn.net/Articles/945829/ ∗∗∗ WebKitGTK and WPE WebKit Security Advisory WSA-2023-0009 ∗∗∗ --------------------------------------------- Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE identifiers: CVE-2023-39928, CVE-2023-35074, CVE-2023-39434, CVE-2023-40451, CVE-2023-41074, CVE-2023-41993. --------------------------------------------- https://webkitgtk.org/security/WSA-2023-0009.html ∗∗∗ (0Day) Control Web Panel ∗∗∗ --------------------------------------------- ZDI-23-1476 - ZDI-23-1479 --------------------------------------------- https://www.zerodayinitiative.com/advisories/published/ ∗∗∗ (0Day) Exim ∗∗∗ --------------------------------------------- ZDI-23-1468 - ZDI-23-1473 --------------------------------------------- https://www.zerodayinitiative.com/advisories/published/ ∗∗∗ ZDI-23-1475: (0Day) Avast Premium Security Sandbox Protection Link Following Privilege Escalation Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-23-1475/ ∗∗∗ ZDI-23-1474: (0Day) Avast Premium Security Sandbox Protection Incorrect Authorization Privilege Escalation Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-23-1474/ ∗∗∗ Drupal: Content Moderation Notifications - Moderately critical - Information disclosure - SA-CONTRIB-2023-047 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2023-047 ∗∗∗ Drupal: Entity cache - Critical - Information disclosure - SA-CONTRIB-2023-046 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2023-046 ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ Rockwell Automation PanelView 800 ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-271-01 ∗∗∗ DEXMA DexGate ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-271-02 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 27.09.2023
by Daily end-of-shift report 27 Sep '23

27 Sep '23

===================== = End-of-Day report = ===================== Timeframe: Dienstag 26-09-2023 18:00 − Mittwoch 27-09-2023 18:00 Handler: Michael Schlagenhaufer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Unzählige Anwendungen betroffen: WebP-Schwachstelle erreicht maximalen Schweregrad ∗∗∗ --------------------------------------------- Die Schwachstelle in der WebP-Bibliothek wurde zuvor fälschlicherweise als Chrome-Bug markiert. Sie betrifft aber weitaus mehr Anwendungen. --------------------------------------------- https://www.golem.de/news/unzaehlige-anwendungen-betroffen-webp-schwachstel… ∗∗∗ Apple Releases MacOS Sonoma Including Numerous Security Patches, (Tue, Sep 26th) ∗∗∗ --------------------------------------------- As expected, Apple today released macOS Sonoma (14.0). This update, in addition to new features, provides patches for about 60 different vulnerabilities. --------------------------------------------- https://isc.sans.edu/diary/rss/30252 ∗∗∗ ShadowSyndicate: A New Cybercrime Group Linked to 7 Ransomware Families ∗∗∗ --------------------------------------------- Cybersecurity experts have shed light on a new cybercrime group known as ShadowSyndicate (formerly Infra Storm) that may have leveraged as many as seven different ransomware families over the past year. "ShadowSyndicate is a threat actor that works with various ransomware groups and affiliates of ransomware programs," Group-IB and Bridewell said in a joint technical report. --------------------------------------------- https://thehackernews.com/2023/09/shadowsyndicate-new-cybercrime-group.html ∗∗∗ Reports about Cyber Actors Hiding in Router Firmware ∗∗∗ --------------------------------------------- On September 27, 2023, a joint cybersecurity advisory (CSA) was released detailing activities of the cyber actors known as BlackTech. The CSA describes how BlackTech is able to modify router firmware without detection. [...] Cisco has reviewed the report. Cisco would like to highlight the following key facts: The most prevalent initial access vector in these attacks involves stolen or weak administrative credentials. As outlined in the report, certain configuration changes, such as disabling logging and downloading firmware, require administrative credentials. [...] --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Hacking htmx applications ∗∗∗ --------------------------------------------- With the normal flow of frontend frameworks moving from hipster to mainstream in the coming few months, during a test, you bump into this strange application that receives HTML with `hx-` attributes in responses. Congrats, you are testing your first htmx application, let me give you the building blocks to play with for testing this type of application. --------------------------------------------- https://medium.com/@matuzg/hacking-htmx-applications-f8d29665faf ∗∗∗ A Deep Dive into Brute Ratel C4 payloads – Part 2 ∗∗∗ --------------------------------------------- Brute Ratel C4 is a Red Team & Adversary Simulation software that can be considered an alternative to Cobalt Strike. In this blog post, we’re presenting a technical analysis of a Brute Ratel badger/agent that doesn’t implement all the recent features of the framework. There aren’t a lot of Brute Ratel samples available in the wild. This second part of the analysis presents the remaining commands executed by the agent. --------------------------------------------- https://cybergeeks.tech/a-deep-dive-into-brute-ratel-c4-payloads-part-2/ ∗∗∗ Fake Bitwarden installation packages delivered RAT to Windows users ∗∗∗ --------------------------------------------- Windows users looking to install the Bitwarden password manager may have inadvertently installed a remote access trojan (RAT). The ZenRAT malware A malicious website spoofing Bitwarden’s legitimate one (located at bitwariden[.]com) has been offering fake installation packages containing the ZenRAT malware. --------------------------------------------- https://www.helpnetsecurity.com/2023/09/27/windows-bitwarden-rat/ ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Oracle (libtiff), Red Hat (libtiff, nodejs:16, and nodejs:18), Slackware (mozilla), SUSE (bind, cacti, cacti-spine, ImageMagick, kernel, libwebp, netatalk, open-vm-tools, postfix, quagga, wire, and wireshark), and Ubuntu (cups, linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-hwe, linux-oracle, linux-bluefield, and linux-bluefield, linux-raspi, linux-raspi-5.4). --------------------------------------------- https://lwn.net/Articles/945700/ ∗∗∗ New GPU Side-Channel Attack Allows Malicious Websites to Steal Data ∗∗∗ --------------------------------------------- GPUs from AMD, Apple, Arm, Intel, Nvidia and Qualcomm are vulnerable to a new type of side-channel attack named GPU.zip. --------------------------------------------- https://www.securityweek.com/new-gpu-side-channel-attack-allows-malicious-w… ===================== = Vulnerabilities = ===================== ∗∗∗ VMSA-2023-0020 ∗∗∗ --------------------------------------------- VMware Aria Operations updates address local privilege escalation vulnerability. (CVE-2023-34043) --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2023-0020.html ∗∗∗ K000136909 : BIG-IP APM Clients TunnelCrack vulnerability CVE-2023-43125 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000136909 ∗∗∗ K000136907 : BIG-IP APM Clients TunnelCrack vulnerability CVE-2023-43124 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000136907 ∗∗∗ semver-6.3.0.tgz is vulnerable to CVE-2022-25883 used in IBM Maximo Application Suite - Monitor Component ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7039430 ∗∗∗ Okio GzipSource is vulnerable to CVE-2023-3635 used in IBM Maximo Application Suite - Monitor Component ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7039433 ∗∗∗ Certifi is vulnerable to CVE-2023-37920 used in IBM Maximo Application Suite - Monitor Component ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7039436 ∗∗∗ VMware Tanzu Spring for Apache Kafka is vulnerable to CVE-2023-34040 used in IBM Maximo Application Suite - Monitor Component ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7039438 ∗∗∗ A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Tivoli System Automation Application Manager (CVE-2023-35890) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7039519 ∗∗∗ Vulnerability found in Eclipse Jetty may affect IBM Enterprise Records ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7040603 ∗∗∗ Vulnerability of jython-standalone-2.7.0.jar have affected APM WebSphere Application Server Agent and APM Tomcat Agent ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7040614 ∗∗∗ IBM SOAR QRadar Plugin App is vulnerable to using components with known vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7040672 ∗∗∗ IBM Cognos Analytics is affected but not classified as vulnerable to vulnerabilities in IBM Websphere Application Server Liberty ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7040744 ∗∗∗ The Bouncy Castle Crypto Package For Java (bc-java) component is vulnerable to CVE-2023-33201 is used by IBM Maximo Application Suite ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7028107 ∗∗∗ Control Access issues in PCOMM ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7031707 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 26.09.2023
by Daily end-of-shift report 26 Sep '23

26 Sep '23

===================== = End-of-Day report = ===================== Timeframe: Montag 25-09-2023 18:00 − Dienstag 26-09-2023 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a ===================== = News = ===================== ∗∗∗ A new spin on the ZeroFont phishing technique, (Tue, Sep 26th) ∗∗∗ --------------------------------------------- Last week, I came across an interesting phishing e-mail, in which a text written in a font with zero-pixel size was used in quite a novel way. --------------------------------------------- https://isc.sans.edu/diary/rss/30248 ∗∗∗ Analysis of CVE-2023-38831 Zero-Day vulnerability in WinRAR ∗∗∗ --------------------------------------------- A remote code execution when the user attempts to view a benign file within a ZIP archive. The issue occurs because a) ZIP archive may include a benign file such as an ordinary .JPG file and also a folder that has the same name as the benign file, and the contents of the folder which may include executable content are processed during an attempt to access only the benign file. --------------------------------------------- https://blog.securelayer7.net/analysis-of-cve-2023-38831-zero-day-vulnerabi… ∗∗∗ Xenomorph Malware Strikes Again: Over 30+ US Banks Now Targeted ∗∗∗ --------------------------------------------- >From what was observed in previous cases, we were able to clearly identify a distribution campaign, using phishing webpages to trick victims into installing malicious APKs, which feature a larger list of targets compared to its previous versions. --------------------------------------------- https://www.threatfabric.com/blogs/xenomorph ∗∗∗ PGP-verschlüsselte E-Mails mit macOS 14: GPGTools warnt vor schnellem Upgrade ∗∗∗ --------------------------------------------- macOS 14 sägt Mail-Plug-ins ab, bewährte Tools wie GPG funktionieren deshalb nicht mehr. GPGTools stellt aber eine neue Extension für Apple Mail in Aussicht. --------------------------------------------- https://www.heise.de/-9318030 ∗∗∗ Vorsicht, wenn PCM Marketing anruft ∗∗∗ --------------------------------------------- Unternehmen werden im Moment häufig von der Marketing-Agentur „PCM Marketing“ angerufen und an eine Kündigung eines Abos erinnert. Bei Nichtkündigung kommt es angeblich zu hohen Kosten. Nach dem Telefonat erhalten Sie ein E-Mail mit einer ausgefüllten Vorlage, die Sie unterschreiben und zurückschicken sollen. Achtung: Unterschreiben Sie nicht, Sie werden in ein teures Abo gelockt! --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-wenn-pcm-marketing-anruft/ ∗∗∗ Fortifying your wireless network: A comprehensive guide to defend against wireless attacks ∗∗∗ --------------------------------------------- In this in-depth blog, we will delve into the technical intricacies of safeguarding your network against wireless threats. Armed with this knowledge, you can confidently defend your wireless infrastructure against potential attackers. --------------------------------------------- https://cybersecurity.att.com/blogs/security-essentials/fortifying-your-wir… ===================== = Vulnerabilities = ===================== ∗∗∗ Xen Security Advisory CVE-2023-20588 / XSA-439 ∗∗∗ --------------------------------------------- Version 1 accidentally linked to the wrong AMD bulletin. This has been corrected in v2. All other information in v1 is believed to be correct. | Impact: An attacker might be able to infer data from a different execution context on the same CPU core. --------------------------------------------- https://xenbits.xen.org/xsa/advisory-439.html ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (exempi, glib2.0, lldpd, and netatalk), Fedora (curl, libppd, and linux-firmware), Oracle (kernel), and SUSE (Cadence, frr, modsecurity, python-CairoSVG, python-GitPython, and tcpreplay). --------------------------------------------- https://lwn.net/Articles/945559/ ∗∗∗ Firefox 118 und 115.3 ESR freigegeben ∗∗∗ --------------------------------------------- Zum 26. September 2023 haben die Mozilla-Entwickler den neuen Firefox 118 sowie das Wartungsupdate des Firefox 115.3 ESR veröffentlicht. Mit den Updates wurden einige Schwachstellen geschlossen. --------------------------------------------- https://www.borncity.com/blog/2023/09/26/firefox-118-115-3-freigegeben/ ∗∗∗ Suprema BioStar 2 ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-269-01 ∗∗∗ Advantech EKI-1524-CE series ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-269-04 ∗∗∗ Hitachi Energy Asset Suite 9 ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-269-02 ∗∗∗ Baker Hughes Bently Nevada 3500 ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-269-05 ∗∗∗ Mitsubishi Electric FA Engineering Software ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-269-03 ∗∗∗ IBM Storage Protect Server is susceptible to numerous vulnerabilities due to Golang Go (CVE-2023-29402, CVE-2023-29403, CVE-2023-29404, CVE-2023-29405, CVE-2023-29406, CVE-2023-29400, CVE-2023-24540, CVE-2023-24539, X-Force 250518) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7038772 ∗∗∗ Vulnerability with kernel , OpenJDK jna-platform affect IBM Cloud Object Storage Systems (Sept2023) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7038968 ∗∗∗ Vulnerability with bcprov-jdk affect IBM Cloud Object Storage Systems (Sept2023) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7038966 ∗∗∗ Vulnerability with Python affect IBM Cloud Object Storage Systems (Sept2023v2) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7038969 ∗∗∗ IBM InfoSphere Information Server is vulnerable to OS command injection (CVE-2022-35717) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7038982 ∗∗∗ IBM Sterling Global Mailbox is vulnerable to privilege escalation attack due to Apache Cassandra ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7039222 ∗∗∗ Multiple vulnerabilities in IBM SDK for Node.js and packaged modules affect IBM Business Automation Workflow Configuration Editor ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7039262 ∗∗∗ Multiple security vulnerabilities affecting Watson Knowledge Catalog for IBM Cloud Pak for Data ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7039367 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 25.09.2023
by Daily end-of-shift report 25 Sep '23

25 Sep '23

===================== = End-of-Day report = ===================== Timeframe: Freitag 22-09-2023 18:00 − Montag 25-09-2023 18:00 Handler: Michael Schlagenhaufer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Akira Ransomware Mutates to Target Linux Systems ∗∗∗ --------------------------------------------- The newly emerged ransomware actively targets both Windows and Linux systems with a double-extortion approach. --------------------------------------------- https://www.darkreading.com/attacks-breaches/akira-ransomware-mutates-to-ta… ∗∗∗ Predator-Spyware: Staatstrojaner wurde über iOS-Schwachstellen eingeschleust ∗∗∗ --------------------------------------------- Intellexa hat die jüngst von Apple gepatchten Schwachstellen in iOS ausgenutzt, um eine Zero-Day-Exploit-Kette für iPhones zu entwickeln. --------------------------------------------- https://www.golem.de/news/predator-spyware-staatstrojaner-wurde-ueber-ios-s… ∗∗∗ Blocking Visual Studio Code embedded reverse shell before its too late ∗∗∗ --------------------------------------------- Since July 2023, Microsoft is offering the perfect reverse shell, embedded inside Visual Studio Code, a widely used development tool. With just a few clicks, any user with a github account can share their visual studio desktop on the web. VS code tunnel is almost considered a lolbin (Living Of the Land Binary). --------------------------------------------- https://ipfyx.fr/post/visual-studio-code-tunnel/ ∗∗∗ iRacing Exploit allows attackers to take control of users computer ∗∗∗ --------------------------------------------- If you have updated iRacing since 2023 Season 2 Patch 5, you’re safe. But if you have the game installed and haven’t updated it, it’s important to either update or uninstall it as soon as possible. Keep in mind this exploit is possible even if you haven’t got an active iRacing subscription, so if you were thinking about updating it later, it’s worth uninstalling it in the meanwhile. --------------------------------------------- https://blog.ss23.geek.nz/2023/09/21/iracing-electron-rce-exploit.html ∗∗∗ Außergewöhnliche Malware nimmt westeuropäische Telkos ins Visier ∗∗∗ --------------------------------------------- Lua Dream ist ein mittels Lua modular aufgebauter Schädling, der es auf Telekommunikationsunternehmen abgesehen hat – und wahrscheinlich aus Asien stammt. --------------------------------------------- https://www.heise.de/-9315204.html ∗∗∗ In-the-Wild Exploitation Expected for Critical TeamCity Flaw Allowing Server Takeover ∗∗∗ --------------------------------------------- A critical vulnerability in the TeamCity CI/CD server could allow unauthenticated attackers to execute code and take over vulnerable servers. --------------------------------------------- https://www.securityweek.com/in-the-wild-exploitation-expected-for-critical… ∗∗∗ Webinar: Manipulation durch Dark Patterns – wie kann ich mich schützen? ∗∗∗ --------------------------------------------- Dark Patterns werden im Internet eingesetzt, um uns zu Handlungen zu verleiten, die nicht in unserem Interesse liegen – und so z. B. mehr Geld auszugeben oder mehr Daten zu teilen, als wir eigentlich möchten. Dieses Webinar erklärt, wie uns Dark Patterns manipulieren und wie Sie sich davor schützen können. Nehmen Sie kostenlos teil: Dienstag 03. Oktober 2023, 18:30 - 20:00 Uhr via zoom --------------------------------------------- https://www.watchlist-internet.at/news/webinar-manipulation-durch-dark-patt… ∗∗∗ Gefälschtes Gewinnspiel für ÖBB-Geschenkkarten & iPhone 15 Pro ∗∗∗ --------------------------------------------- Uns werden aktuell betrügerische Gewinnspiele für das neue iPhone sowie ÖBB-Geschenkkarten zum Gratis-Zugfahren gemeldet. Die Gewinnspiele werden über Soziale Netzwerke, Messenger und per E-Mail verbreitet. Den Gewinn bekommen Sie angeblich, wenn Sie € 1,95 zahlen. Wer bezahlt verliert aber Geld! --------------------------------------------- https://www.watchlist-internet.at/news/gefaelschtes-gewinnspiel-fuer-oebb-g… ∗∗∗ SCCM Hierarchy Takeover ∗∗∗ --------------------------------------------- tl;dr: There is no security boundary between sites in the same hierarchy. When an administrative user is granted a security role in SCCM, such as Full Administrator or Infrastructure Administrator, in any primary site, the underlying database changes propagate upward to the central administration site (CAS) and then to other primary sites in the hierarchy. This means that if an attacker gains control of any primary site, they gain control of the entire SCCM hierarchy. --------------------------------------------- https://posts.specterops.io/sccm-hierarchy-takeover-41929c61e087 ∗∗∗ iOS 17 update secretly changed your privacy settings; here’s how to set them back ∗∗∗ --------------------------------------------- Many iPhone users who upgraded their iPhones to the recently-released iOS 17 will be alarmed to hear that they may have actually downgraded their security and privacy. --------------------------------------------- https://www.bitdefender.com/blog/hotforsecurity/ios-17-update-secretly-chan… ∗∗∗ From ScreenConnect to Hive Ransomware in 61 hours ∗∗∗ --------------------------------------------- In 2022, The DFIR Report observed an increase in the adversarial usage of Remote Management and Monitoring (RMM) tools. When compared to post-exploitation channels that heavily rely on terminals, [...] --------------------------------------------- https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-… ∗∗∗ CoinMiner Distribution Process within Infiltrated Systems (Detected by EDR) ∗∗∗ --------------------------------------------- AhnLab Security Emergency Response Center (ASEC) has identified the process through which threat actors install CoinMiners, which utilize a compromised system’s resources for cryptocurrency mining. This post will cover how the AhnLab EDR product detects the installation process of CoinMiners that use system resources for cryptocurrency mining. --------------------------------------------- https://asec.ahnlab.com/en/57222/ ∗∗∗ Kaspersky Reveals Alarming IoT Threats and Dark Web DDoS Boom ∗∗∗ --------------------------------------------- Kaspersky Unveils Alarming IoT Vulnerabilities and Dark Webs Thriving DDoS Economy. --------------------------------------------- https://www.hackread.com/iot-vulnerabilities-dark-web-ddos-economy/ ===================== = Vulnerabilities = ===================== ∗∗∗ Elasticsearch 8.9.0, 7.17.13 Security Update ∗∗∗ --------------------------------------------- An issue has been identified with how Elasticsearch handled incoming requests on the HTTP layer. An unauthenticated user could force an Elasticsearch node to exit with an OutOfMemory error by sending a moderate number of malformed HTTP requests. --------------------------------------------- https://discuss.elastic.co/t/elasticsearch-8-9-0-7-17-13-security-update/34… ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (bind9, elfutils, flac, ghostscript, libapache-mod-jk, lldpd, and roundcube), Fedora (linux-firmware, roundcubemail, and thunderbird), Mageia (curl, file, firefox/thunderbird, ghostpcl, libtommath, and nodejs), Oracle (kernel, open-vm-tools, qemu, and virt:ol and virt-devel:rhel), SUSE (bind, busybox, djvulibre, exempi, ImageMagick, libqb, libssh2_org, opera, postfix, python, python36, renderdoc, webkit2gtk3, and xrdp), and Ubuntu (accountsservice and open-vm-tools). --------------------------------------------- https://lwn.net/Articles/945503/ ∗∗∗ CISA Adds Three Known Exploited Vulnerabilities to Catalog ∗∗∗ --------------------------------------------- CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2023-41991 Apple Multiple Products Improper Certificate Validation Vulnerability CVE-2023-41992 Apple Multiple Products Kernel Privilege Escalation Vulnerability CVE-2023-41993 Apple Multiple Products WebKit Code Execution Vulnerability --------------------------------------------- https://www.cisa.gov/news-events/alerts/2023/09/25/cisa-adds-three-known-ex… ∗∗∗ RoyalTSX 6.0.1 RTSZ File Handling Heap Memory Corruption PoC ∗∗∗ --------------------------------------------- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5788.php ∗∗∗ Wago: Vulnerable WIBU-SYSTEMS Codemeter installed through e!COCKPIT and WAGO-I/O-Pro ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2023-042/ ∗∗∗ Stored Cross-Site Scripting in der mb Support broker management Solution openVIVA c2 ∗∗∗ --------------------------------------------- https://sec-consult.com/de/vulnerability-lab/advisory/stored-cross-site-scr… ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 22.09.2023
by Daily end-of-shift report 22 Sep '23

22 Sep '23

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 21-09-2023 18:00 − Freitag 22-09-2023 18:00 Handler: Michael Schlagenhaufer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Incomplete disclosures by Apple and Google create “huge blindspot” for 0-day hunters ∗∗∗ --------------------------------------------- No one mentioned that libwebp, a library found in millions of apps, was a 0-day origin. --------------------------------------------- https://arstechnica.com/?p=1970341 ∗∗∗ GitHub passkeys generally available for passwordless sign-ins ∗∗∗ --------------------------------------------- GitHub has made passkeys generally available across the platform today to secure accounts against phishing and allow passwordless logins for all users. --------------------------------------------- https://www.bleepingcomputer.com/news/security/github-passkeys-generally-av… ∗∗∗ iOS, iPad OS, Watch OS und MacOS: Apple behebt aktiv ausgenutzte Schwachstellen ∗∗∗ --------------------------------------------- Drei Zero-Day-Schwachstellen in iOS, iPad OS, Watch OS sowie Mac OS sollen bereits aktiv ausgenutzt werden. Patches stehen jetzt bereit. --------------------------------------------- https://www.golem.de/news/ios-ipad-os-watch-os-und-macos-apple-behebt-aktiv… ∗∗∗ The WebP 0day ∗∗∗ --------------------------------------------- Early last week, Google released a new stable update for Chrome. The update included a single security fix that was reported by Apples Security Engineering and Architecture (SEAR) team. The issue, CVE-2023-4863, was a heap buffer overflow in the WebP image library, and it had a familiar warning attached:"Google is aware that an exploit for CVE-2023-4863 exists in the wild." --------------------------------------------- https://blog.isosceles.com/the-webp-0day/ ∗∗∗ Proof-of-Concept-Exploit für WinRAR-Lücke bringt VenomRAT-Malware mit ∗∗∗ --------------------------------------------- Mitte August haben die Entwickler eine Zero-Day-Lücke in WinRAR ausgebessert. Dafür taucht ein gefälschter PoC auf, der Malware mitbringt. --------------------------------------------- https://www.heise.de/-9313479.html ∗∗∗ Qnap warnt vor Codeschmuggel durch Schwachstellen ∗∗∗ --------------------------------------------- Qnap warnt vor Sicherheitslücken im QTS-Betriebssystem und der Multimedia Console, durch die Angreifer Schadcode einschleusen können. --------------------------------------------- https://www.heise.de/-9313549.html ∗∗∗ Sicherheitslücke: Datenleaks auf Drupal-Websites möglich ∗∗∗ --------------------------------------------- Unter bestimmten Voraussetzungen können Angreifer mit dem Content Management System Drupal erstellte Seiten attackieren. Abgesicherte Versionen sind verfügbar. --------------------------------------------- https://www.heise.de/-9313594.html ∗∗∗ Schon einmal auf einen Fake-Shop hineingefallen? ∗∗∗ --------------------------------------------- Sie kaufen regelmäßig online ein und verwenden dabei Ihr Mobiltelefon? Sie sind schon einmal in Berührung mit Fake-Shops gekommen oder waren Opfer von Internetbetrug? Sie möchten mehr darüber erfahren, welche präventiven Maßnahmen es gibt, um den Einkauf in Fake-Shops zu verhindern? Sie möchten aktiv an der Gestaltung einer Lösung mitarbeiten? Dann nehmen Sie an unserem Workshop teil! --------------------------------------------- https://www.watchlist-internet.at/news/schon-einmal-auf-einen-fake-shop-hin… ∗∗∗ Finding Deserialization Bugs in the SolarWind Platform ∗∗∗ --------------------------------------------- It’s been a while since I have written a blog post, please accept my sincerest apologies. This is because a lot of fun stuff that I’ve recently done is going to be presented during conferences. Please treat this post as a small introduction to my upcoming Hexacon 2023 talk titled “Exploiting Hardened .NET Deserialization: New Exploitation Ideas and Abuse of Insecure Serialization”. --------------------------------------------- https://www.thezdi.com/blog/2023/9/21/finding-deserialization-bugs-in-the-s… ===================== = Vulnerabilities = ===================== ∗∗∗ ZDI-23-1449: (0Day) Intel Driver & Support Assistant Link Following Local Privilege Escalation Vulnerability ∗∗∗ --------------------------------------------- This vulnerability allows local attackers to escalate privileges on affected installations of Intel Driver & Support Assistant. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. --------------------------------------------- https://www.zerodayinitiative.com/advisories/ZDI-23-1449/ ∗∗∗ (0Day) Ashlar-Vellum Cobalt AR Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- The specific flaw exists within the parsing of AR files [...] Given the nature of the vulnerability, the only salient mitigation strategy is to restrict interaction with the application. (ZDI-23-1450 - ZDI-23-1454) --------------------------------------------- https://www.zerodayinitiative.com/advisories/published/ ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (gsl), Fedora (dotnet6.0 and dotnet7.0), Oracle (libwebp), Slackware (bind, cups, and seamonkey), SUSE (kernel and rust, rust1.72), and Ubuntu (cups, flac, gnome-shell, imagemagick, and python3.5). --------------------------------------------- https://lwn.net/Articles/945322/ ∗∗∗ Vulnerabilities in Apache HTTP Server ∗∗∗ --------------------------------------------- Multiple vulnerabilities in Apache HTTP Server have been reported to affect certain QNAP operating systems. --------------------------------------------- https://www.qnap.com/en-us/security-advisory/QSA-23-12 ∗∗∗ Vulnerability in Legacy QTS ∗∗∗ --------------------------------------------- A buffer copy without checking size of input vulnerability has been reported to affect certain legacy versions of QTS. --------------------------------------------- https://www.qnap.com/en-us/security-advisory/QSA-23-25 ∗∗∗ Vulnerability in Multimedia Console ∗∗∗ --------------------------------------------- A buffer copy without checking size of input vulnerability has been reported to affect certain versions of Multimedia Console. --------------------------------------------- https://www.qnap.com/en-us/security-advisory/QSA-23-29 ∗∗∗ Security update 1.5.4 released ∗∗∗ --------------------------------------------- We just published a security update to the LTS version 1.5 of Roundcube Webmail. It provides a fix to a recently reported XSS vulnerability: Cross-site scripting (XSS) vulnerability in handling of linkrefs in plain text messages, reported by Niraj Shivtarkar. See the full changelog in the release notes in the release notes on the Github download page. We strongly recommend to update all productive installations of Roundcube 1.5.x with this new version. --------------------------------------------- https://roundcube.net/news/2023/09/18/security-update-1.5.4-released ∗∗∗ Security update 1.4.14 released ∗∗∗ --------------------------------------------- We just published a security update to the LTS version 1.4 of Roundcube Webmail. It provides a fix to a recently reported XSS vulnerability: Cross-site scripting (XSS) vulnerability in handling of linkrefs in plain text messages, reported by Niraj Shivtarkar. See the full changelog in the release notes in the release notes on the Github download page. We strongly recommend to update all productive installations of Roundcube 1.4.x with this new version. --------------------------------------------- https://roundcube.net/news/2023/09/18/security-update-1.4.14-released ∗∗∗ Security update 1.6.3 released ∗∗∗ --------------------------------------------- We just published a security update to the version 1.6 of Roundcube Webmail. It provides a fix to a recently reported XSS vulnerability: Fix cross-site scripting (XSS) vulnerability in handling of linkrefs in plain text messages,reported by Niraj Shivtarkar. See the full changelog in the release notes in the release notes on the Github download page. We strongly recommend to update all productive installations of Roundcube 1.6.x with this new version. --------------------------------------------- https://roundcube.net/news/2023/09/15/security-update-1.6.3-released ∗∗∗ [R1] Nessus Version 10.5.5 Fixes Multiple Vulnerabilities ∗∗∗ --------------------------------------------- https://www.tenable.com/security/tns-2023-31 ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 21.09.2023
by Daily end-of-shift report 21 Sep '23

21 Sep '23

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 20-09-2023 18:00 − Donnerstag 21-09-2023 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Free Download Manager releases script to check for Linux malware ∗∗∗ --------------------------------------------- The developers of Free Download Manager (FDM) have published a script to check if a Linux device was infected through a recently reported supply chain attack. --------------------------------------------- https://www.bleepingcomputer.com/news/security/free-download-manager-releas… ∗∗∗ P2PInfect botnet activity surges 600x with stealthier malware variants ∗∗∗ --------------------------------------------- The P2PInfect botnet worm is going through a period of highly elevated activity volumes starting in late August and then picking up again in September 2023. --------------------------------------------- https://www.bleepingcomputer.com/news/security/p2pinfect-botnet-activity-su… ∗∗∗ LUCR-3: Scattered Spider Getting SaaS-y in the Cloud ∗∗∗ --------------------------------------------- LUCR-3 overlaps with groups such as Scattered Spider, Oktapus, UNC3944, and STORM-0875 and is a financially motivated attacker that leverages the Identity Provider (IDP) as initial access into an environment with the goal of stealing Intellectual Property (IP) for extortion. LUCR-3 targets Fortune 2000 companies across various sectors to include but not limited to Software, Retail, Hospitality, Manufacturing, and Telecoms. --------------------------------------------- https://permiso.io/blog/lucr-3-scattered-spider-getting-saas-y-in-the-cloud ∗∗∗ Remote Code Execution in Tutanota Desktop due to Code Flaw ∗∗∗ --------------------------------------------- In this article, we explained how an innocent-looking mistake in the code could significantly impact the security of an application. We showed how we found a Cross-Site Scripting vulnerability in Tutanota, a popular end-to-end encrypted webmail service, and explained how an attacker could have exploited the flaw to execute arbitrary code on a victims system. --------------------------------------------- https://www.sonarsource.com/blog/remote-code-execution-in-tutanota-desktop-… ===================== = Vulnerabilities = ===================== ∗∗∗ Drupal core - Critical - Cache poisoning - SA-CORE-2023-006 ∗∗∗ --------------------------------------------- This vulnerability only affects sites with the JSON:API module enabled, and can be mitigated by uninstalling JSON:API. The core REST and contributed GraphQL modules are not affected. --------------------------------------------- https://www.drupal.org/sa-core-2023-006 ∗∗∗ MOVEit Transfer: Schwachstellen ermöglichen Angreifern Datenschmuggel ∗∗∗ --------------------------------------------- Neue MOVEit Transfer-Versionen schließen teils hochriskante Sicherheitslücken. IT-Verantwortliche sollten sie zügig installieren. --------------------------------------------- https://www.heise.de/-9312162 ∗∗∗ Sicherheitsupdate: Passwort-Lücke bedroht Nagios XI ∗∗∗ --------------------------------------------- Angreifer können die Server-Monitoring-Lösung Nagios XI attackieren. Eine dagegen abgesicherte Version ist verfügbar. --------------------------------------------- https://www.heise.de/-9312331 ∗∗∗ Sicherheitsupdate: Authentifizierung von HPE OneView umgehbar ∗∗∗ --------------------------------------------- Die IT-Infrastrukturmanagementlösung OneView von HPE ist verwundbar. Der Entwickler hat zwei kritische Sicherheitslücken geschlossen. --------------------------------------------- https://www.heise.de/-9312816 ∗∗∗ Wordfence Intelligence Weekly WordPress Vulnerability Report (September 11, 2023 to September 17, 2023) ∗∗∗ --------------------------------------------- Last week, there were 55 vulnerabilities disclosed in 46 WordPress Plugins and no WordPress themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 15 Vulnerability Researchers that contributed to WordPress Security last week. --------------------------------------------- https://www.wordfence.com/blog/2023/09/wordfence-intelligence-weekly-wordpr… ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (frr and libyang), Fedora (golang-github-prometheus-exporter-toolkit, golang-github-xhit-str2duration, golang-gopkg-alecthomas-kingpin-2, libpano13, and open-vm-tools), Oracle (firefox, frr, and thunderbird), Red Hat (dmidecode, kernel, kernel-rt, kpatch-patch, libwebp: critical, linux-firmware, mariadb:10.3, ncurses, postgresql:15, and virt:rhel and virt-devel:rhel), Scientific Linux (firefox, open-vm-tools, and thunderbird), SUSE (binutils, bluez, chromium, curl, gcc7, go1.20, go1.21, grpc, protobuf, python-Deprecated, python-PyGithub, python-aiocontextvars, python-avro, python-bcrypt, python-cryptography, python- cryptography-vectors, python-google-api-core, pyt, gstreamer-plugins-good, kernel, libcares2, libxml2, mdadm, mutt, and python-brotlipy), and Ubuntu (indent, linux, linux-aws, linux-aws-5.15, linux-azure, linux-azure-5.15, linux-azure-fde, linux-azure-fde-5.15, linux-gcp, linux-gcp-5.15, linux-gke, linux-gkeop, linux-gkeop-5.15, linux-hwe-5.15, linux-ibm, linux-ibm-5.15, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp, linux-gcp-5.4, linux-gkeop, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-iot, linux-kvm, linux-oracle, linux-oracle-5.4, linux-xilinx-zynqmp, linux, linux-aws, linux-aws-6.2, linux-azure, linux-azure-6.2, linux-azure-fde-6.2, linux-gcp, linux-gcp-6.2, linux-hwe-6.2, linux-ibm, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-6.2, linux-oracle, linux-raspi, linux-starfive, linux, linux-aws, linux-kvm, linux-lts-xenial, linux-oem-6.0, linux-oem-6.1, and memcached). --------------------------------------------- https://lwn.net/Articles/945073/ ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (mutt, netatalk, and python2.7), Fedora (chromium, golang-github-prometheus-exporter-toolkit, golang-github-xhit-str2duration, and golang-gopkg-alecthomas-kingpin-2), Oracle (dmidecode, frr, libwebp, open-vm-tools, and thunderbird), Red Hat (libwebp and open-vm-tools), SUSE (cups, frr, mariadb, openvswitch3, python39, qemu, redis7, rubygem-rails-html-sanitizer, and skopeo), and Ubuntu (bind9, cups, and libppd). --------------------------------------------- https://lwn.net/Articles/945173/ ∗∗∗ Synology-SA-23:13 SRM ∗∗∗ --------------------------------------------- A vulnerability allow remote attackers to bypass security constraint via a susceptible version of Synology Router Manager (SRM). --------------------------------------------- https://www.synology.com/en-global/support/security/Synology_SA_23_13 ∗∗∗ ISC Releases Security Advisories for BIND 9 ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/alerts/2023/09/21/isc-releases-security-ad… ∗∗∗ Frauscher: Multiple Vulnerabilities in FDS101 ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2023-038/ ∗∗∗ Rockwell Automation FactoryTalk View Machine Edition ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-264-06 ∗∗∗ Rockwell Automation Connected Components Workbench ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-264-05 ∗∗∗ Rockwell Automation Select Logix Communication Modules ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-264-04 ∗∗∗ Delta Electronics DIAScreen ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-264-03 ∗∗∗ Real Time Automation 460 Series ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-264-01 ∗∗∗ IBM Security Guardium is affected by multiple vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6963075 ∗∗∗ IBM Virtualization Engine TS7700 is susceptible to a denial of service due to use of Apache Commons FileUpload (CVE-2023-24998) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7031979 ∗∗∗ Vulnerabilities in CKEditor library affects IBM Engineering Test Management (ETM) (CVE-2021-32809, CVE-2021-37695) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7037094 ∗∗∗ Multiple vulnerabilities in IBM Java SDK affects IBM Storage Scale ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7037135 ∗∗∗ IBM Events Operator is affected by a denial of service in OpenSSL (CVE-2023-0215). ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7037162 ∗∗∗ A vulnerability in Red Hat Enterprise Linux may affect IBM Robotic Process Automation for Cloud Pak and result in elevated privileges (CVE-2023-3899). ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7037164 ∗∗∗ IBM Events Operator is affected by a denial of service in OpenSSL (CVE-2022-4450). ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7037167 ∗∗∗ IBM Events Operator is vulnerable to a denial of service in OpenSSL (CVE-2023-0286) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7037165 ∗∗∗ Vulnerability in node.js package may affect IBM Storage Scale GUI (CVE-2022-25883) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7037185 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 20.09.2023
by Daily end-of-shift report 20 Sep '23

20 Sep '23

===================== = End-of-Day report = ===================== Timeframe: Dienstag 19-09-2023 18:00 − Mittwoch 20-09-2023 18:00 Handler: Michael Schlagenhaufer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Gitlab warnt vor kritischer Sicherheitslücke ∗∗∗ --------------------------------------------- Eine kritische Sicherheitslücke bedroht die Enterprise-Anwender des Repository-Diensts Gitlab. Kunden sollten unverzüglich ein Update einspielen. --------------------------------------------- https://www.heise.de/-9311249.html ∗∗∗ Atlassian stopft Sicherheitslecks in Bitbucket, Confluence und Jira ∗∗∗ --------------------------------------------- Atlassian warnt vor Sicherheitslücken in Bitbucket, Confluence und Jira. Aktualisierte Fassungen dichten sie ab. --------------------------------------------- https://www.heise.de/-9311520.html ∗∗∗ Trend Micro: Update schließt ausgenutzte, kritische Schwachstelle CVE-2023-41179 ∗∗∗ --------------------------------------------- Kurzer Hinweis für Nutzer und Administratoren von Trend Micro die Sicherheitsprodukte Apex One und Worry-Free Business Security unter Windows einsetzen. In den Produkten gibt es eine kritische Sicherheitslücke (CVE-2023-41179), die bereits in freier Wildbahn ausgenutzt wird. Der Hersteller bietet aber [...] --------------------------------------------- https://www.borncity.com/blog/2023/09/20/trend-micro-notfall-update-schliet… ∗∗∗ Analyzing a Modern In-the-wild Android Exploit ∗∗∗ --------------------------------------------- In December 2022, Google’s Threat Analysis Group (TAG) discovered an in-the-wild exploit chain targeting Samsung Android devices. TAG’s blog post covers the targeting and the actor behind the campaign. This is a technical analysis of the final stage of one of the exploit chains, specifically CVE-2023-0266 (a 0-day in the ALSA compatibility layer) and CVE-2023-26083 (a 0-day in the Mali GPU driver) as well as the techniques used by the [...] --------------------------------------------- https://googleprojectzero.blogspot.com/2023/09/analyzing-modern-in-wild-and… ∗∗∗ Fresh Wave of Malicious npm Packages Threaten Kubernetes Configs and SSH Keys ∗∗∗ --------------------------------------------- Cybersecurity researchers have discovered a fresh batch of malicious packages in the npm package registry that are designed to exfiltrate Kubernetes configurations and SSH keys from compromised machines to a remote server. Sonatype said it has discovered 14 different npm packages so far: [...] --------------------------------------------- https://thehackernews.com/2023/09/fresh-wave-of-malicious-npm-packages.html ∗∗∗ The mystery of the CVEs that are not vulnerabilities ∗∗∗ --------------------------------------------- Researchers have raised the alarm about a large set of CVE for older bugs that never were vulnerabilities. --------------------------------------------- https://www.malwarebytes.com/blog/news/2023/09/the-mystery-of-the-cves-that… ∗∗∗ Shodan Verified Vulns 2023-09-01 ∗∗∗ --------------------------------------------- Mit Stand 2023-09-01 sieht Shodan in Österreich die folgenden Schwachstellen: [...] In diesem Monat folgen die Schwachstellen in den unteren zwei Dritteln wieder dem Abwärtstrend und nähern sich der Nullmarke oder haben diese bereits erreicht. Im oberen Drittel ist im Gegensatz zu den Vormonaten ein leichter Anstieg bei FREAK (CVE-2015-0204) (+131) und Logjam (CVE-2015-4000) (+63) zu verzeichnen. --------------------------------------------- https://cert.at/de/aktuelles/2023/9/shodan-verified-vulns-2023-09-01 ∗∗∗ #StopRansomware: Snatch Ransomware ∗∗∗ --------------------------------------------- This joint Cybersecurity Advisory (CSA) is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect against ransomware. Visit stopransomware.gov to see all #StopRansomware advisories and to learn more [...] --------------------------------------------- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-263a ∗∗∗ Attacker Unleashes Stealthy Crypto Mining via Malicious Python Package ∗∗∗ --------------------------------------------- Recently, our team came across a Python package named “culturestreak”. A closer look reveals a darker purpose: unauthorized cryptocurrency mining. Let’s break down how “culturestreak” operates, its potential impact, and the broader implications for user security and ethical [...] --------------------------------------------- https://checkmarx.com/blog/attacker-unleashes-stealthy-crypto-mining-via-ma… ∗∗∗ Protect CNC Machines in Networked IT/OT Environments ∗∗∗ --------------------------------------------- Networking IT/OT environments is a bit like walking a tightrope, balancing the pursuit of intelligence and efficiency against the risks of exposing OT systems to the wider world. Trend Micro recently teamed up with global machine tool company Celada to identify specific risks associated with industrial CNC machines—and how to mitigate them. --------------------------------------------- https://www.trendmicro.com/en_us/ciso/23/i/cnc-machine-security.html ===================== = Vulnerabilities = ===================== ∗∗∗ Critical Security Flaws Exposed in Nagios XI Network Monitoring Software ∗∗∗ --------------------------------------------- Multiple security flaws have been disclosed in the Nagios XI network monitoring software that could result in privilege escalation and information disclosure. The four security vulnerabilities, tracked from CVE-2023-40931 through CVE-2023-40934, impact Nagios XI versions 5.11.1 and lower. Following responsible disclosure on August 4, 2023, They have been patched as of September 11, 2023, [...] --------------------------------------------- https://thehackernews.com/2023/09/critical-security-flaws-exposed-in.html ∗∗∗ Xen Security Advisory CVE-2023-34322 / XSA-438 ∗∗∗ --------------------------------------------- top-level shadow reference dropped too early for 64-bit PV guests | Impact: Privilege escalation, Denial of Service (DoS) affecting the entire host, and information leaks all cannot be ruled out. --------------------------------------------- https://xenbits.xen.org/xsa/advisory-438.html ∗∗∗ IBM Security Guardium is affected by several vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7007815 ∗∗∗ IBM Security Guardium is affected by an SQL Injection vulnerability (CVE-2023-33852) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7028514 ∗∗∗ IBM Security Guardium is affected by a denial of service vulnerability in MIT keb5 (CVE-2022-42898) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6981101 ∗∗∗ IBM Security Guardium is affected by multiple vulnerabilities (CVE-2023-30435, CVE-2023-30436, CVE-2023-30437) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7028506 ∗∗∗ IBM Security Guardium is affected by multiple vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7028511 ∗∗∗ IBM Security Guardium is affected by an Improper Restriction of Excessive Authentication Attempts vulnerability (CVE-2022-43904) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7028509 ∗∗∗ IBM Security Guardium is affected by an Hazardous Input Validation vulnerability (CVE-2022-43903) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030110 ∗∗∗ IBM Storage Protect is vulnerable to a remote attack due to Java ( CVE-2023-21967 ) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7034474 ∗∗∗ IBM Storage Protect is vulnerable to deserialization issues due to Java ( CVE-2022-40609 ) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7034467 ∗∗∗ Vulnerability in moment-timezone affects IBM VM Recovery Manager DR GUI ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7035336 ∗∗∗ IBM App Connect Enterprise and IBM Integration Bus are vulnerable to a denial of service due to IBM MQ (CVE-2023-28513). ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7035334 ∗∗∗ The IBM Engineering Lifecycle Engineering product using IBM WebSphere Application Server Liberty is vulnerable to Identity Spoofing (CVE-2022-22476) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7035367 ∗∗∗ A vulnerability in python-request affects IBM Robotic Process Automation for Cloud Pak and may result in an attacker obtaining sensitive information (CVE-2023-32681) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7034002 ∗∗∗ A vulnerability in gRPC may affect IBM Robotic Process Automation and result in an attacker obtaining sensitive information. (CVE-2023-32731) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7034007 ∗∗∗ A vulnerability in Apache Johnzon may affect IBM Robotic Process Automation and result in a denial of service (CVE-2023-33008) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7034006 ∗∗∗ A vulnerability in Microsoft ASP.NET Core may affect IBM Robotic Process Automation and result in an exposure of sensitive information (CVE-2023-35391). ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7034005 ∗∗∗ IBM Security Guardium is affected by a Command injection in CLI vulnerability [CVE-2023-35893] ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7027853 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 19.09.2023
by Daily end-of-shift report 19 Sep '23

19 Sep '23

===================== = End-of-Day report = ===================== Timeframe: Montag 18-09-2023 18:00 − Dienstag 19-09-2023 18:00 Handler: Michael Schlagenhaufer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Jetzt patchen! Tausende Juniper-Firewalls immer noch ohne Sicherheitsupdate ∗∗∗ --------------------------------------------- Aufgrund eines neuen Exploits sind Attacken auf Juniper-Firewalls jetzt noch einfacher. Sicherheitspatches sind verfügbar. --------------------------------------------- https://www.heise.de/news/Jetzt-patchen-Tausende-Juniper-Firewalls-immer-no… ∗∗∗ Bumblebee malware returns in new attacks abusing WebDAV folders ∗∗∗ --------------------------------------------- The malware loader Bumblebee has broken its two-month vacation with a new campaign that employs new distribution techniques that abuse 4shared WebDAV services. --------------------------------------------- https://www.bleepingcomputer.com/news/security/bumblebee-malware-returns-in… ∗∗∗ Security baseline for Microsoft Edge version 117 ∗∗∗ --------------------------------------------- Automatically open downloaded MHT or MHTML files from the web in Internet Explorer mode (Added) --------------------------------------------- https://techcommunity.microsoft.com/t5/microsoft-security-baselines/securit… ∗∗∗ Härtung des Dateitransfers: Microsoft sichert das SMB-Protokoll ab ∗∗∗ --------------------------------------------- Mit zwei Maßnahmen sichert Microsoft sowohl die SMB Client- als auch die Serverseite besser ab. Wir zeigen, worauf Administratoren achten müssen. --------------------------------------------- https://www.heise.de/news/Haertung-des-Dateitransfers-Microsoft-sichert-das… ∗∗∗ CISA Says Owl Labs Vulnerabilities Requiring Close Physical Range Exploited in Attacks ∗∗∗ --------------------------------------------- The US cybersecurity agency CISA says four vulnerabilities found last year in Owl Labs video conferencing devices — flaws that require the attacker to be in close range of the target — have been exploited in attacks. --------------------------------------------- https://www.securityweek.com/cisa-says-owl-labs-vulnerabilities-requiring-c… ∗∗∗ Fake-Shop-Trends im Herbst und Winter ∗∗∗ --------------------------------------------- Warme Jacken, Skianzüge und Regenstiefel haben wieder Saison. Auch die Nachfrage nach Pellets und Holz steigt langsam wieder. Das wissen auch Kriminelle und stellen ihre Fake-Shops auf Herbst- und Winterangebote um. Wir zeigen Ihnen, welche Fake-Shop-Trends es gerade gibt und wie Sie sich vor betrügerischen Angeboten schützen. --------------------------------------------- https://www.watchlist-internet.at/news/fake-shop-trends-im-herbst-und-winte… ∗∗∗ Fake CVE-2023-40477 Proof of Concept Leads to VenomRAT ∗∗∗ --------------------------------------------- Researchers should be aware of threat actors repurposing older proof of concept (PoC) code to quickly craft a fake PoC for a newly released vulnerability. On Aug. 17, 2023, the Zero Day Initiative publicly reported a remote code execution (RCE) vulnerability in WinRAR tracked as CVE-2023-40477. They had disclosed it to the vendor on June 8, 2023. Four days after the public reporting of CVE-2023-40477, an actor using an alias of whalersplonk committed a fake PoC script to their GitHub repository. --------------------------------------------- https://unit42.paloaltonetworks.com/fake-cve-2023-40477-poc-hides-venomrat/ ===================== = Vulnerabilities = ===================== ∗∗∗ Wind River VxWorks tarExtract directory traversal vulnerability (CVE-2023-38346) ∗∗∗ --------------------------------------------- VxWorks is a real-time operating system used in many embedded devices in high-availability environments with high safety and security requirements. This includes important industrial, medical, airospace, networking and automotive devices. For example, NASAs Curiosity rover currently deployed on planet Mars is using Wind Rivers VxWorks operating system. --------------------------------------------- https://www.pentagrid.ch/en/blog/wind-river-vxworks-tarextract-directory-tr… ∗∗∗ SolarWinds Platform 2023.3.1 Release Notes ∗∗∗ --------------------------------------------- SolarWinds Platform 2023.3.1 is a service release providing bug and security fixes for release 2023.3. For information about the 2023.3 release, including EOL notices and upgrade information, see SolarWinds Platform 2023.3 Release Notes. --------------------------------------------- https://documentation.solarwinds.com/en/success_center/orionplatform/conten… ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (chromium, flac, gnome-shell, libwebp, openjdk-11, and xrdp), Fedora (giflib), Oracle (kernel), Red Hat (busybox, dbus, firefox, frr, kpatch-patch, libwebp, open-vm-tools, and thunderbird), Slackware (netatalk), SUSE (flac, gcc12, kernel, libeconf, libwebp, libxml2, and thunderbird), and Ubuntu (binutils, c-ares, libraw, linux-intel-iotg, nodejs, python-django, and vsftpd). --------------------------------------------- https://lwn.net/Articles/944848/ ∗∗∗ Trend Micro Patches Exploited Zero-Day Vulnerability in Endpoint Security Products ∗∗∗ --------------------------------------------- Trend Micro on Tuesday released an advisory to warn customers that a critical vulnerability affecting Apex One and other endpoint security products has been exploited in the wild. --------------------------------------------- https://www.securityweek.com/trend-micro-patches-exploited-zero-day-vulnera… ∗∗∗ Spring Security 5.8.7, 6.0.7, 6.1.4, 6.2.0-M1 Released, including fixes for CVE-2023-34042 ∗∗∗ --------------------------------------------- https://spring.io/blog/2023/09/18/spring-security-5-8-7-6-0-7-6-1-4-6-2-0-m… ∗∗∗ Spring for GraphQL 1.0.5, 1.1.6, 1.2.3 released ∗∗∗ --------------------------------------------- https://spring.io/blog/2023/09/19/spring-for-graphql-1-0-5-1-1-6-1-2-3-rele… ∗∗∗ Zyxel security advisory for command injection vulnerability in EMG2926-Q10A Ethernet CPE ∗∗∗ --------------------------------------------- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-… ∗∗∗ PHOENIX CONTACT: Multiple products affected by WIBU Codemeter Vulnerabilities ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2023-030/ ∗∗∗ Omron CJ/CS/CP Series ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-262-05 ∗∗∗ Omron Engineering Software ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-262-04 ∗∗∗ Omron Engineering Software Zip-Slip ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-262-03 ∗∗∗ Vulnerabilities in Bash affect ProtecTIER (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/690049 ∗∗∗ Multiple vulnerabilities in OpenSSL affect ProtecTIER ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/691201 ∗∗∗ Multiple vulnerabilities in Samba – including Badlock – affect ProtecTIER ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/691257 ∗∗∗ Vulnerability in Linux Kernel affects ProtecTIER: Dirty COW vulnerability (CVE-2016-5195) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/696401 ∗∗∗ Vulnerability in glibc library affects ProtecTIER(CVE-2014-5119) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/690187 ∗∗∗ Vulnerability in OpenSSL affects ProtecTIER (CVE-2016-2108) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/695443 ∗∗∗ IBM Security Guardium is affected by a multiple vulnerabilities (CVE-2023-22809, CVE-2019-12490, CVE-2023-0041) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7000021 ∗∗∗ IBM Storage Protect Operations Center is vulnerable to denial of service due to Websphere Application Server Liberty ( CVE-2023-28867 ) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7034039 ∗∗∗ IBM Storage Protect Server is vulnerable to denial of service and other attacks due to Db2 ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7034037 ∗∗∗ Vulnerability in moment-timezone affects IBM VM Recovery Manager DR GUI ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7034198 ∗∗∗ Vulnerabilities in Linux kernel and Python can affect IBM Spectrum Protect Plus ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7034265 ∗∗∗ IBM App Connect Enterprise is vulnerable to a remote attack and a denial of service due to Node.js modules tough-cookie and semver (CVE-2023-26136, CVE-2022-25883). ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7031733 ∗∗∗ A vulnerability in the Administrative command line client affects IBM Storage Protect Client, IBM Storage Protect for Virtual Environments, and IBM Storage Protect for Space Management (CVE-2023-40368) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7034288 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 18.09.2023
by Daily end-of-shift report 18 Sep '23

18 Sep '23

===================== = End-of-Day report = ===================== Timeframe: Freitag 15-09-2023 18:00 − Montag 18-09-2023 18:00 Handler: Michael Schlagenhaufer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ BlackCat ransomware hits Azure Storage with Sphynx encryptor ∗∗∗ --------------------------------------------- The BlackCat (ALPHV) ransomware gang now uses stolen Microsoft accounts and the recently spotted Sphynx encryptor to encrypt targets Azure cloud storage. --------------------------------------------- https://www.bleepingcomputer.com/news/security/blackcat-ransomware-hits-azu… ∗∗∗ Microsoft leaks 38TB of private data via unsecured Azure storage ∗∗∗ --------------------------------------------- The Microsoft AI research division accidentally leaked dozens of terabytes of sensitive data starting in July 2020 while contributing open-source AI learning models to a public GitHub repository. --------------------------------------------- https://www.bleepingcomputer.com/news/microsoft/microsoft-leaks-38tb-of-pri… ∗∗∗ Retool Falls Victim to SMS-Based Phishing Attack Affecting 27 Cloud Clients ∗∗∗ --------------------------------------------- Software development company Retool has disclosed that the accounts of 27 of its cloud customers were compromised following a targeted and SMS-based social engineering attack. The San Francisco-based firm blamed a Google Account cloud synchronization feature recently introduced in April 2023 for making the breach worse, calling it a "dark pattern." "The fact that Google Authenticator syncs to the cloud is a novel attack vector," Snir Kodesh, Retool's head of engineering, said. "What we had originally implemented was multi-factor authentication. But through this Google update, what was previously multi-factor-authentication had silently (to administrators) become single-factor-authentication." --------------------------------------------- https://thehackernews.com/2023/09/retool-falls-victim-to-sms-based.html ∗∗∗ Fuzzing with multiple servers in parallel: AFL++ with Network File Systems ∗∗∗ --------------------------------------------- When fuzzing large-scale applications, using a single server (even with 4 64-core AMD Ryzen CPUs) may not be powerful enough by itself. That’s where parallelized/distributed fuzzing comes in (i.e. automatic sharing of results between fuzzing systems). In this guide, we’ll take a look at how to set up multiple servers fuzzing the same program using AFL++, linked all together with an NFS (Network File System). --------------------------------------------- https://joshua.hu/fuzzing-multiple-servers-parallel-aflplusplus-nfs ∗∗∗ donut-decryptor ∗∗∗ --------------------------------------------- donut-decryptor checks file(s) for known signatures of the donut obfuscators loader shellcode. If located, it will parse the shellcode to locate, decrypt, and extract the DONUT_INSTANCE structure embedded in the binary, and report pertinent configuration data. If a DONUT_MODULE is present in the binary it is decrypted and dumped to disk. --------------------------------------------- https://github.com/volexity/donut-decryptor ∗∗∗ CVE-2023-34040 Spring Kafka Deserialization Remote Code Execution ∗∗∗ --------------------------------------------- MEDIUM | AUGUST 23, 2023 | CVE-2023-34040: In Spring for Apache Kafka 3.0.9 and earlier and versions 2.9.10 and earlier, a possible deserialization attack vector existed, but only if unusual configuration was applied. An attacker would have to construct a malicious serialized object in one of the deserialization exception record headers [...] According to the description in security bulletin, we can simply attain some critical points resulting in the vulnerability. --------------------------------------------- https://pyn3rd.github.io/2023/09/15/CVE-2023-34040-Spring-Kafka-Deserializa… ∗∗∗ AWS’s Hidden Threat: AMBERSQUID Cloud-Native Cryptojacking Operation ∗∗∗ --------------------------------------------- The Sysdig Threat Research Team (TRT) has uncovered a novel cloud-native cryptojacking operation which they’ve named AMBERSQUID. This operation leverages AWS services not commonly used by attackers, such as AWS Amplify, AWS Fargate, and Amazon SageMaker. The uncommon nature of these services means that they are often overlooked from a security perspective, and the AMBERSQUID operation can cost victims more than $10,000/day. --------------------------------------------- https://sysdig.com/blog/ambersquid/ ∗∗∗ Fileless Remote Code Execution on Juniper Firewalls ∗∗∗ --------------------------------------------- CVE-2023-36845 is a PHP environment variable manipulation vulnerability affecting Juniper SRX firewalls and EX switches. Juniper scored the vulnerability as a medium severity issue. However, in this blog, we’ll show you how this vulnerability alone can achieve remote, unauthenticated code execution without even touching the disk. --------------------------------------------- https://vulncheck.com/blog/juniper-cve-2023-36845 ∗∗∗ Sherlock: Spyware kommt über Online-Werbung ∗∗∗ --------------------------------------------- Die israelische Firma Insanet soll eine Spähsoftware entwickelt haben, die über gezielte Werbebanner auf Windows-PCs und gängige Smartphones ausgespielt wird. --------------------------------------------- https://www.heise.de/-9308891.html ∗∗∗ CISA Releases New Identity and Access Management Guidance ∗∗∗ --------------------------------------------- CISA has released new guidance on how federal agencies can integrate identity and access management into their ICAM architecture. --------------------------------------------- https://www.securityweek.com/cisa-releases-new-identity-and-access-manageme… ∗∗∗ Verkaufen auf Vinted: Vermeintliche Käufer:innen locken auf gefälschte Zahlungsplattform ∗∗∗ --------------------------------------------- Sie verkaufen etwas auf Vinted? Vorsicht, wenn interessierte Käufer:innen nach Ihrer E-Mail-Adresse fragen. Dahinter steckt eine Betrugsmasche, die darauf abzielt, Sie auf eine gefälschte Vinted-Zahlungsplattform zu locken. Auf dieser Plattform erhalten Sie angeblich den Kaufbetrag. Tatsächlich stehlen die Kriminellen dort Ihre Bank- oder Kreditkartendaten und überzeugen Sie, Zahlungen freizugeben. --------------------------------------------- https://www.watchlist-internet.at/news/verkaufen-auf-vinted-vermeintliche-k… ∗∗∗ Vorsicht: Steam Fake Accounts und Scam-Methoden ∗∗∗ --------------------------------------------- Kurze Warnung für Leser und Leserinnen, die auf der Plattform Steam unterwegs sind. Ein Leser hat mich auf eine Betrugswelle aufmerksam gemacht, die gerade läuft und mit gefälschten Konten operiert. --------------------------------------------- https://www.borncity.com/blog/2023/09/16/vorsicht-steam-fake-accounts-und-s… ∗∗∗ 18th September – Threat Intelligence Report ∗∗∗ --------------------------------------------- For the latest discoveries in cyber research for the week of 11th September, please download our Threat_Intelligence Bulletin. --------------------------------------------- https://research.checkpoint.com/2023/18th-september-threat-intelligence-rep… ∗∗∗ Earth Lusca Employs New Linux Backdoor, Uses Cobalt Strike for Lateral Movement ∗∗∗ --------------------------------------------- While monitoring Earth Lusca, we discovered an intriguing, encrypted file on the threat actors server - a Linux-based malware, which appears to originate from the open-source Windows backdoor Trochilus, which weve dubbed SprySOCKS due to its swift behavior and SOCKS implementation. --------------------------------------------- https://www.trendmicro.com/en_us/research/23/i/earth-lusca-employs-new-linu… ∗∗∗ MidgeDropper Variant Targets Work-from-Home Employees on Windows PCs ∗∗∗ --------------------------------------------- If you are working from home, you need to be on the lookout for the new and complex variant of MidgeDropper malware. --------------------------------------------- https://www.hackread.com/midgedropper-variant-work-from-home-windows/ ===================== = Vulnerabilities = ===================== ∗∗∗ Qnap-Updates schließen hochriskante Lücke ∗∗∗ --------------------------------------------- Qnap hat aktualisierte Betriebssysteme veröffentlicht. Die neuen QTS-, QuTS-hero- und QuTScloud-Releases schließen teils hochriskante Lücken. --------------------------------------------- https://www.heise.de/-9308427.html ∗∗∗ Anonymisierendes Linux: Kritische libWebP-Lücke in Tails 5.17.1 geschlossen ∗∗∗ --------------------------------------------- Die Maintainer des anonymisierenden Linux Tails für den USB-Stick haben in Version 5.17.1 die bereits angegriffene, kritische libWebP-Lücke geschlossen. --------------------------------------------- https://www.heise.de/-9307906.html ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (firefox-esr, libwebp, and thunderbird), Fedora (chromium, curl, flac, libtommath, libwebp, matrix-synapse, python-matrix-common, redis, and rust-pythonize), Gentoo (binwalk, ghostscript, python-requests, rar, samba, and wireshark), Oracle (.NET 6.0, kernel, and kernel-container), Slackware (python3), and SUSE (firefox). --------------------------------------------- https://lwn.net/Articles/944744/ ∗∗∗ Authenticated Remote Code Execution und fehlende Authentifizierung in Atos Unify OpenScape ∗∗∗ --------------------------------------------- https://sec-consult.com/de/vulnerability-lab/advisory/authenticated-remote-… ∗∗∗ Vulnerabilities in Apache Struts library affect Tivoli Netcool\/OMNIbus WebGUI ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7033228 ∗∗∗ Vulnerabilities in Certifi, cryptography, python-requests and Tornado can affect IBM Storage Protect Plus Microsoft File Systems Backup and Restore [CVE-2023-37920, CVE-2023-38325, CVE-2023-32681, CVE-2023-28370] ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7031489 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 15.09.2023
by Daily end-of-shift report 15 Sep '23

15 Sep '23

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 14-09-2023 18:00 − Freitag 15-09-2023 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a ===================== = News = ===================== ∗∗∗ What is Secure Shell (SSH) & How to Use It: Security & Best Practices ∗∗∗ --------------------------------------------- In this blog post, we’re going to delve deeper into what Secure Shell (SSH) is, how it operates, and why it’s useful. We’ll cover everything from the basics of connecting with SSH to common commands and best practices for ensuring secure communications and file transfers. --------------------------------------------- https://blog.sucuri.net/2023/09/what-is-secure-shell-ssh-how-to-use-it-secu… ∗∗∗ A detailed analysis of the Money Message Ransomware ∗∗∗ --------------------------------------------- The threat actor group, Money Message ransomware, first appeared in March 2023, demanding million-dollar ransoms from its targets. Its configuration, which contains the services and processes to stop a ransomware attack, can be found at the end of the executable. The ransomware creates a mutex and deletes the Volume Shadow Copies using vssadmin.exe. --------------------------------------------- https://resources.securityscorecard.com/research/analysis-money-message-ran… ∗∗∗ Mehr Sicherheit für (Open-)Sourcecode: OpenSSF veröffentlicht Leitfaden ∗∗∗ --------------------------------------------- Ein Leitfaden der Open Source Security Foundation zeigt Tools und Best Practices zum Absichern von Code auf Versionsverwaltungsplattformen auf. --------------------------------------------- https://www.heise.de/-9306112.html ∗∗∗ Watch out, this LastPass email with "Important information about your account" is a phish ∗∗∗ --------------------------------------------- The consequences of last year's LastPass breach continue to be felt, with the latest insult to users coming in the form of a highly convincing phishing email. --------------------------------------------- https://www.malwarebytes.com/blog/news/2023/09/nasty-lastpass-phish ∗∗∗ Threat Group Assessment: Turla (aka Pensive Ursa) ∗∗∗ --------------------------------------------- Pensive Ursa was chosen to be the main focus for the 2023 MITRE ATT&CK evaluation. MITRE has described Turla as being “known for their targeted intrusions and innovative stealth.” The results of this evaluation, including Palo Alto Networks scoring, will be published in late September 2023. --------------------------------------------- https://unit42.paloaltonetworks.com/turla-pensive-ursa-threat-assessment/ ∗∗∗ Why Are You Texting Me? UNC3944 Leverages SMS Phishing Campaigns for SIM Swapping, Ransomware, Extortion, and Notoriety ∗∗∗ --------------------------------------------- UNC3944 is a financially motivated threat cluster that has persistently used phone-based social engineering and SMS phishing campaigns (smshing) to obtain credentials to gain and escalate access to victim organizations. At least some UNC3944 threat actors appear to operate in underground communities, such as Telegram and underground forums, which they may leverage to acquire tools, services, and/or other support to augment their operations. --------------------------------------------- https://www.mandiant.com/resources/blog/unc3944-sms-phishing-sim-swapping-r… ===================== = Vulnerabilities = ===================== ∗∗∗ Jetzt patchen! Sicherheitslösungen von Fortinet als Sicherheitsrisiko ∗∗∗ --------------------------------------------- Mehrere Produkte von Fortinet sind verwundbar. Sicherheitsupdates schaffen Abhilfe. --------------------------------------------- https://www.heise.de/-9306543.html ∗∗∗ Management-Controller Lenovo XCC: Angreifer können Passwörter manipulieren ∗∗∗ --------------------------------------------- Der Computerhersteller Lenovo hat in XClarity Controller mehrere Sicherheitslücken geschlossen. --------------------------------------------- https://www.heise.de/-9304734.html ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (c-ares and samba), Fedora (borgbackup, firefox, and libwebp), Oracle (.NET 6.0 and kernel), Slackware (libwebp), SUSE (chromium and firefox), and Ubuntu (atftp, dbus, gawk, libssh2, libwebp, modsecurity-apache, and mutt). --------------------------------------------- https://lwn.net/Articles/944581/ ∗∗∗ QRadar Pulse application add on to IBM QRadar SIEM is vulnerable to using components with known vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7032220 ∗∗∗ Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to HTTP header injection due to Go CVE-2023-29406 ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7032249 ∗∗∗ Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to bypassing security restrictions due to multiple Node.js vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7032238 ∗∗∗ IBM Virtualization Engine TS7700 is susceptible to a denial of service due to use of Apache Commons FileUpload (CVE-2023-24998) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7031979 ∗∗∗ Due to use of Golang Go, IBM Cloud Pak for Multicloud Management Monitoring is vulnerable to multiple vulnerabilities. ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7032901 ∗∗∗ Multiple vulnerabilities in jackson-databind affect IBM Application Performance Management products ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7032899 ∗∗∗ IBM Operational Decision Manager August 2023 - Multiple CVEs addressed ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7032928 ∗∗∗ Vulnerabilities in Linux Kernel might affect IBM Spectrum Copy Data Management ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7029387 ∗∗∗ CVE-2023-24539, CVE-2023-29400, CVE-2023-29403, CVE-2023-24540, CVE-2023-29402, CVE-2023-29404, CVE-2023-29405 related to Go affect IBM CICS TX Standard 11.1 ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7033006 ∗∗∗ CVE-2023-24540, CVE-2023-29402, CVE-2023-29404, CVE-2023-29405 related to Go affect IBM CICS TX Advanced 11.1 ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7033004 ∗∗∗ Vulnerabilities in Golang, openSSH and openJDK might affect IBM Spectrum Copy Data Management ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7029389 ∗∗∗ Vulnerabilities in snappy-java might affect IBM Spectrum Copy Data Management ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7029381 ∗∗∗ Vulnerabilities in cURL libcurl might affect IBM Spectrum Copy Data Management ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7029380 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 14.09.2023
by Daily end-of-shift report 14 Sep '23

14 Sep '23

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 13-09-2023 18:00 − Donnerstag 14-09-2023 18:00 Handler: Michael Schlagenhaufer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Windows 11 ‘ThemeBleed’ RCE bug gets proof-of-concept exploit ∗∗∗ --------------------------------------------- Security researcher Gabe Kirkpatrick has made a proof-of-concept (PoC) exploit available for CVE-2023-38146, aka "ThemeBleed," which enables attackers to trigger arbitrary remote code execution if the target opens a specially crafted .theme file. --------------------------------------------- https://www.bleepingcomputer.com/news/security/windows-11-themebleed-rce-bu… ∗∗∗ Top 10 Facts About MOVEit Breach ∗∗∗ --------------------------------------------- This breach exposed the vulnerabilities inherent in some of the world’s most trusted platforms and highlighted the audacity and capabilities of modern cybercriminals. Furthermore, becoming the primary attack vector for the Cl0p ransomware group, it has led to many other attacks. --------------------------------------------- https://socradar.io/top-10-facts-about-moveit-breach/ ∗∗∗ Column-Level Encryption 101: What is It, implementation & Benefits ∗∗∗ --------------------------------------------- By encrypting individual columns of data, organizations can limit access to the data, reduce the potential damage of a breach and help ensure the privacy of their customers information. In this post, we will explore the power of column-level encryption for data security. So let’s dive in. --------------------------------------------- https://www.piiano.com/blog/column-level-encryption ∗∗∗ Uncursing the ncurses: Memory corruption vulnerabilities found in library ∗∗∗ --------------------------------------------- Microsoft has discovered a set of memory corruption vulnerabilities in a library called ncurses, which provides APIs that support text-based user interfaces (TUI). Released in 1993, the ncurses library is commonly used by various programs on Portable Operating System Interface (POSIX) operating systems, including Linux, macOS, and FreeBSD. --------------------------------------------- https://www.microsoft.com/en-us/security/blog/2023/09/14/uncursing-the-ncur… ∗∗∗ PSA: Ongoing Webex malvertising campaign drops BatLoader ∗∗∗ --------------------------------------------- A new malvertising campaign is targeting corporate users who are downloading the popular web conferencing software Webex. Threat actors have bought an advert that impersonates Cisco's brand and is displayed first when performing a Google search. --------------------------------------------- https://www.malwarebytes.com/blog/threat-intelligence/2023/09/ongoing-webex… ∗∗∗ QR-Code in E-Mails von vermeintlichen Lieferanten führt zu Phishing-Seite ∗∗∗ --------------------------------------------- Aktuell ist ein besonders perfides Phishing-Mail im Umlauf: Unternehmen werden von ihnen bekannten Lieferanten kontaktiert, die ein Angebot per QR-Code übermitteln. Zumindest wird das in der Nachricht behauptet. Tatsächlich führt das Scannen des QR-Codes auf eine Phishing-Seite. Kriminelle versuchen dabei, an die Zugangsdaten für das Microsoft-Konto der Mitarbeiter:innen zu kommen. --------------------------------------------- https://www.watchlist-internet.at/news/qr-code-in-e-mails-von-vermeintliche… ∗∗∗ Vorsicht vor Phishing-E-Mails von "oesterreich.gv.at" & "a-trust.at" ∗∗∗ --------------------------------------------- Momentan befinden sich zahlreiche Phishing-Nachrichten von vermeintlich vertrauenswürdigen Absendern in Umlauf. Die Nachrichten versprechen angebliche Rückerstattungen von Oesterreich.gv.at. Klicken Sie nicht auf die Links, Ihre Daten werden gestohlen! --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-vor-phishing-e-mails-von-oe… ===================== = Vulnerabilities = ===================== ∗∗∗ FortiGuard PSIRT Advisories ∗∗∗ --------------------------------------------- Fortiguard Labs have released 12 Advisories for FortiADC, FortiAPs, FortiAP-U, FortiClient-EMS, FortiManager & FortiAnalyzer, FortiOS & FortiProxy, FortiPresence, FortiSIEM, FortiTester and FortiWeb. (Severity: 3x High, 8x Medium, 1x Low) --------------------------------------------- https://fortiguard.fortinet.com/psirt?date=2023&product=FortiWeb,FortiSIEM,… ∗∗∗ Siemens hat mit 14.09.2023 weitere 2 Security Advisories veröffentlicht ∗∗∗ --------------------------------------------- SSA-646240: Sensitive Information Disclosure in SIMATIC PCS neo Administration Console (5.5), SSA-357182: Local Privilege Escalation Vulnerability in Spectrum Power 7 (8.2) --------------------------------------------- https://www.siemens.com/global/en/products/services/cert.html#SecurityPubli… ∗∗∗ Wordfence Intelligence Weekly WordPress Vulnerability Report (September 4, 2023 to September 10, 2023) ∗∗∗ --------------------------------------------- Last week, there were 107 vulnerabilities disclosed in 89 WordPress Plugins and 5 WordPress themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 36 Vulnerability Researchers that contributed to WordPress Security last week. --------------------------------------------- https://www.wordfence.com/blog/2023/09/wordfence-intelligence-weekly-wordpr… ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (firefox-esr, libwebp, ruby-loofah, and ruby-rails-html-sanitizer), Fedora (open-vm-tools and salt), Oracle (.NET 7.0, dmidecode, flac, gcc, httpd:2.4, keylime, libcap, librsvg2, and qemu-kvm), Red Hat (.NET 6.0 and .NET 7.0), Slackware (libarchive and mozilla), SUSE (chromium and kernel), and Ubuntu (curl, firefox, ghostscript, open-vm-tools, postgresql-9.5, and thunderbird). --------------------------------------------- https://lwn.net/Articles/944481/ ∗∗∗ Drupal: Mail Login - Critical - Access bypass - SA-CONTRIB-2023-045 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2023-045 ∗∗∗ Rockwell Automation Pavilion8 ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-257-07 ∗∗∗ Palo Alto: CVE-2023-3280 Cortex XDR Agent: Local Windows User Can Disable the Agent (Severity: MEDIUM) ∗∗∗ --------------------------------------------- https://security.paloaltonetworks.com/CVE-2023-3280 ∗∗∗ Palo Alto: CVE-2023-38802 PAN-OS: Denial-of-Service (DoS) Vulnerability in BGP Software (Severity: HIGH) ∗∗∗ --------------------------------------------- https://security.paloaltonetworks.com/CVE-2023-38802 ∗∗∗ : PostgreSQL Vulnerability Affects IBM Connect:Direct Web Service (CVE-2023-39417) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7032120 ∗∗∗ CISA Adds Three Known Vulnerabilities to Catalog ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/alerts/2023/09/13/cisa-adds-three-known-vu… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 13.09.2023
by Daily end-of-shift report 13 Sep '23

13 Sep '23

===================== = End-of-Day report = ===================== Timeframe: Dienstag 12-09-2023 18:00 − Mittwoch 13-09-2023 18:00 Handler: Michael Schlagenhaufer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Patchday: Angriffe mittels präparierter PDF-Dateien auf Adobe Acrobat ∗∗∗ --------------------------------------------- Adobe hat in Acrobat und Reader, Connect und Experience Manager mehrere Sicherheitslücken geschlossen. --------------------------------------------- https://heise.de/-9303487 ∗∗∗ Notfallpatch sichert Firefox und Thunderbird gegen Attacken ab ∗∗∗ --------------------------------------------- Mozilla hat in seinen Webbrowsern und seinem Mailclient eine Sicherheitslücke geschlossen, die Angreifer bereits ausnutzen. --------------------------------------------- https://heise.de/-9303536 ∗∗∗ Microsoft Security Update Summary (12. September 2023) ∗∗∗ --------------------------------------------- Am 12. September 2023 hat Microsoft Sicherheitsupdates für Windows-Clients und -Server, für Office- sowie für weitere Produkte – veröffentlicht. Die Sicherheitsupdates beseitigen 61 CVE-Schwachstellen, zwei sind 0-day Schwachstellen. Nachfolgend findet sich ein kompakter Überblick über diese Updates [...] --------------------------------------------- https://www.borncity.com/blog/2023/09/13/microsoft-security-update-summary-… ∗∗∗ Threat landscape for industrial automation systems. Statistics for H1 2023 ∗∗∗ --------------------------------------------- In the first half of 2023, the percentage of ICS computers on which malicious objects were blocked decreased from H2 2022 by just 0.3 pp to 34%. --------------------------------------------- https://securelist.com/threat-landscape-for-industrial-automation-systems-s… ∗∗∗ Malware distributor Storm-0324 facilitates ransomware access ∗∗∗ --------------------------------------------- The threat actor that Microsoft tracks as Storm-0324 is a financially motivated group known to gain initial access using email-based initial infection vectors and then hand off access to compromised networks to other threat actors. These handoffs frequently lead to ransomware deployment. Beginning in July 2023, Storm-0324 was observed distributing payloads using an open-source tool [...] --------------------------------------------- https://www.microsoft.com/en-us/security/blog/2023/09/12/malware-distributo… ∗∗∗ Alert: New Kubernetes Vulnerabilities Enable Remote Attacks on Windows Endpoints ∗∗∗ --------------------------------------------- Three interrelated high-severity security flaws discovered in Kubernetes could be exploited to achieve remote code execution with elevated privileges on Windows endpoints within a cluster. The issues, tracked as CVE-2023-3676, CVE-2023-3893, and CVE-2023-3955, carry CVSS scores of 8.8 and impact all Kubernetes environments with Windows nodes. Fixes for the vulnerabilities were released on August 23, 2023, [...] --------------------------------------------- https://thehackernews.com/2023/09/alert-new-kubernetes-vulnerabilities.html ∗∗∗ OpenSSL 1.1.1 reaches end of life for all but the well-heeled ∗∗∗ --------------------------------------------- $50k to breathe new life into its corpse. The rest of us must move on to OpenSSL 3.0 OpenSSL 1.1.1 has reached the end of its life, making a move to a later version essential for all, bar those with extremely deep pockets. --------------------------------------------- https://go.theregister.com/feed/www.theregister.com/2023/09/12/openssl_111_… ∗∗∗ macOS Info-Stealer Malware ‘MetaStealer’ Targeting Businesses ∗∗∗ --------------------------------------------- The MetaStealer macOS information stealer has been targeting businesses to exfiltrate keychain and other valuable information. --------------------------------------------- https://www.securityweek.com/macos-info-stealer-malware-metastealer-targeti… ∗∗∗ How Next-Gen Threats Are Taking a Page From APTs ∗∗∗ --------------------------------------------- Cybercriminals are increasingly trying to find ways to get around security, detection, intelligence and controls as APTs start to merge with conventional cybercrime. --------------------------------------------- https://www.securityweek.com/how-next-gen-threats-are-taking-a-page-from-ap… ∗∗∗ How Three Letters Brought Down UK Air Traffic Control ∗∗∗ --------------------------------------------- The UK bank holiday weekend at the end of August is a national holiday in which it sometimes seems the entire country ups sticks and makes for somewhere with a beach. This year though, many of them couldn’t, because the country’s NATS air traffic system went down and stranded many to grumble in the heat of a crowded terminal. At the time it was blamed on faulty flight data, but news now emerges that the data which brought down an entire country’s air traffic control may have not been faulty at all. --------------------------------------------- https://hackaday.com/2023/09/13/how-three-letters-brought-down-uk-air-traff… ∗∗∗ 3AM: New Ransomware Family Used As Fallback in Failed LockBit Attack ∗∗∗ --------------------------------------------- Attackers resorted to new ransomware after deployment of LockBit was blocked on targeted network. --------------------------------------------- https://symantec-enterprise-blogs.security.com/threat-intelligence/3am-rans… ∗∗∗ White House urging dozens of countries to publicly commit to not pay ransoms ∗∗∗ --------------------------------------------- The U.S. National Security Council (NSC) is urging the governments of all countries participating in the International Counter Ransomware Initiative (CRI) to issue a joint statement announcing they will not pay ransoms to cybercriminals, according to three sources with knowledge of the plans. --------------------------------------------- https://therecord.media/counter-ransomware-initiative-members-ransom-paymen… ∗∗∗ September 2023 release of new Exchange Server CVEs (resolved by August 2023 Security Updates) ∗∗∗ --------------------------------------------- You may have noticed there were several new Exchange Server CVEs that were released today (a part of September 2023 ‘Patch Tuesday’). If you haven’t yet, you can go to the Security Update Guide and filter on Exchange Server under Product Family to review CVE information. The CVEs released today were actually addressed in the August 2023 Exchange Server Security Update (SU). Due to the timing of validation of those fixes and release dates, we decided to release the CVEs as a part of September 2023 ‘Patch Tuesday’ release cycle. We know that many customers are accustomed to checking for Microsoft security releases on the second Tuesday of every month, and we did not want these CVEs to go unnoticed. --------------------------------------------- https://techcommunity.microsoft.com/t5/exchange-team-blog/september-2023-re… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (e2guardian), Fedora (libeconf), Red Hat (dmidecode, kernel, kernel-rt, keylime, kpatch-patch, libcap, librsvg2, linux-firmware, and qemu-kvm), Slackware (mozilla), SUSE (chromium and shadow), and Ubuntu (cups, dotnet6, dotnet7, file, flac, and ruby-redcloth). --------------------------------------------- https://lwn.net/Articles/944354/ ∗∗∗ BSRT-2023-001 Vulnerabilities in Management Console and Self Service Impact AtHoc Server ∗∗∗ --------------------------------------------- https://support.blackberry.com/kb/articleDetail?language=en_US&articleNumbe… ∗∗∗ VU#347067: Multiple BGP implementations are vulnerable to improperly formatted BGP updates ∗∗∗ --------------------------------------------- https://kb.cert.org/vuls/id/347067 ∗∗∗ PHP Shopping Cart-4.2 Multiple-SQLi ∗∗∗ --------------------------------------------- https://cxsecurity.com/issue/WLB-2023090037 ∗∗∗ Cisco IOS XR Software Compression ACL Bypass Vulnerability ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco IOS XR Software Image Verification Vulnerability ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco IOS XR Software iPXE Boot Signature Bypass Vulnerability ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco IOS XR Software Model-Driven Programmability Behavior with AAA Authorization ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco IOS XR Software Connectivity Fault Management Denial of Service Vulnerability ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco IOS XR Software Access Control List Bypass Vulnerability ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ K000136157 : sssd vulnerability CVE-2022-4254 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000136157?utm_source=f5support&utm_medi… ∗∗∗ Trumpf: Multiple Products affected by WIBU Codemeter Vulnerability ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2023-031/ ∗∗∗ Elliptic Labs Virtual Lock Sensor Vulnerability ∗∗∗ --------------------------------------------- https://support.lenovo.com/product_security/PS500576-ELLIPTIC-LABS-VIRTUAL-… ∗∗∗ Lenovo XClarity Controller (XCC) Vulnerabilities ∗∗∗ --------------------------------------------- https://support.lenovo.com/product_security/PS500578 ∗∗∗ Intel Dynamic Tuning Technology Advisory ∗∗∗ --------------------------------------------- https://support.lenovo.com/product_security/PS500577-INTEL-DYNAMIC-TUNING-T… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 12.09.2023
by Daily end-of-shift report 12 Sep '23

12 Sep '23

===================== = End-of-Day report = ===================== Timeframe: Montag 11-09-2023 18:00 − Dienstag 12-09-2023 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a ===================== = News = ===================== ∗∗∗ New WiKI-Eve attack can steal numerical passwords over WiFi ∗∗∗ --------------------------------------------- A new attack dubbed WiKI-Eve can intercept the cleartext transmissions of smartphones connected to modern WiFi routers and deduce individual numeric keystrokes at an accuracy rate of up to 90%, allowing numerical passwords to be stolen. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-wiki-eve-attack-can-stea… ∗∗∗ Free Download Manager backdoored – a possible supply chain attack on Linux machines ∗∗∗ --------------------------------------------- Kaspersky researchers analyzed a Linux backdoor disguised as Free Download Manager software that remained under the radar for at least three years. --------------------------------------------- https://securelist.com/backdoored-free-download-manager-linux-malware/11046… ∗∗∗ Sophisticated Phishing Campaign Deploying Agent Tesla, OriginBotnet, and RedLine Clipper ∗∗∗ --------------------------------------------- "A phishing email delivers the Word document as an attachment, presenting a deliberately blurred image and a counterfeit reCAPTCHA to lure the recipient into clicking on it," Fortinet FortiGuard Labs researcher Cara Lin said. --------------------------------------------- https://thehackernews.com/2023/09/sophisticated-phishing-campaign.html ∗∗∗ Gefälschte Post-, DHL und UPS-Benachrichtigungen im Umlauf ∗∗∗ --------------------------------------------- Sie warten gerade auf ein Paket? Nehmen Sie Benachrichtigungen über den Lieferstatus genau unter die Lupe. Momentan kursieren viele betrügerische Infos. Per E-Mail oder SMS werden Sie informiert, dass noch Zollgebühren oder Versandkosten bezahlt werden müssen. Klicken Sie nicht auf den Link. Sie landen auf einer betrügerischen Seite, die Kreditkartendaten abgreift. --------------------------------------------- https://www.watchlist-internet.at/news/gefaelschte-post-dhl-und-ups-benachr… ∗∗∗ Das European Cyber Shield ∗∗∗ --------------------------------------------- Die EU will im Rahmen vom "Digital Europe Programme" mit Förderungen für die Vernetzung von SOCs die Sicherheit der EU stärken und das System über einen neuen "Cyber Solidarity Act" dauerhaft einrichten. Ich hab dazu im Rahmen des CSIRTs Network Meetings im Juni einen Vortrag gehalten, dessen Inhalt ich jetzt auf ein ausformuliertes Paper (auf Englisch) erweitert habe. --------------------------------------------- https://cert.at/de/blog/2023/9/european-cyber-shield ∗∗∗ Persistent Threat: New Exploit Puts Thousands of GitHub Repositories and Millions of Users at Risk ∗∗∗ --------------------------------------------- A new vulnerability has been discovered that could allow an attacker to exploit a race condition within GitHub's repository creation and username renaming operations. This technique could be used to perform a Repojacking attack (hijacking popular repositories to distribute malicious code). --------------------------------------------- https://checkmarx.com/blog/persistent-threat-new-exploit-puts-thousands-of-… ∗∗∗ Deleting Your Way Into SYSTEM: Why Arbitrary File Deletion Vulnerabilities Matter ∗∗∗ --------------------------------------------- Windows arbitrary file deletion vulnerabilities should no longer be considered mere annoyances or tools for Denial-of-Service (DoS) attacks. Over the past couple of years, these vulnerabilities have matured into potent threats capable of unearthing a portal to full system compromise. This transformation is exemplified in CVE-2023-27470 (an arbitrary file deletion vulnerability in N-Able’s Take Control Agent with a CVSS Base Score of 8.8) demonstrating that what might initially seem innocuous can, in fact, expose unexpected weaknesses within your system. --------------------------------------------- https://www.mandiant.com/resources/blog/arbitrary-file-deletion-vulnerabili… ===================== = Vulnerabilities = ===================== ∗∗∗ NSO-Exploit: Apple fixt auch ältere Versionen von macOS, iOS und iPadOS ∗∗∗ --------------------------------------------- Nach Notfall-Updates für aktuelle Betriebssysteme schiebt Apple nun auch Patches für ältere Versionen nach. Man sollte flott aktualisieren. --------------------------------------------- https://heise.de/-9301842 ∗∗∗ Patchday: SAP schließt kritische Datenleak-Lücke in BusinessObjects ∗∗∗ --------------------------------------------- Es sind wichtige Sicherheitsupdates für SAP-Software erschienen. Admins sollten zeitnah handeln. --------------------------------------------- https://heise.de/-9302399 ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (node-cookiejar and orthanc), Oracle (firefox, kernel, and kernel-container), Red Hat (flac and httpd:2.4), Slackware (vim), SUSE (python-Django, terraform-provider-aws, terraform-provider-helm, and terraform-provider-null), and Ubuntu (c-ares, curl, linux-azure, linux-azure-5.15, linux-azure-fde, linux-azure-fde-5.15, linux-raspi, and linux-ibm, linux-ibm-5.4). --------------------------------------------- https://lwn.net/Articles/944263/ ∗∗∗ ICS Patch Tuesday: Critical CodeMeter Vulnerability Impacts Several Siemens Products ∗∗∗ --------------------------------------------- ICS Patch Tuesday: Siemens has released 7 new advisories and Schneider Electric has released 1 new advisory. --------------------------------------------- https://www.securityweek.com/ics-patch-tuesday-critical-codemeter-vulnerabi… ∗∗∗ WebKitGTK and WPE WebKit Security Advisory WSA-2023-0008 ∗∗∗ --------------------------------------------- CVE identifiers: CVE-2023-28198, CVE-2023-32370,CVE-2023-40397. --------------------------------------------- https://webkitgtk.org/security/WSA-2023-0008.html ∗∗∗ Google Chrome 116.0.5845.187/.188 fixt kritische Schwachstelle ∗∗∗ --------------------------------------------- Google hat zum 11. September 2023 Updates des Google Chrome Browsers 116 im Stable und Extended Channel für Mac, Linux und Windows freigegeben. Es sind Sicherheitsupdates, die ausgerollt werden und eine Schwachstelle (Einstufung als "kritisch") beseitigen sollen. --------------------------------------------- https://www.borncity.com/blog/2023/09/11/google-chrome-116-0-5845-187-188-f… ∗∗∗ Fujitsu Software Infrastructure Manager ∗∗∗ --------------------------------------------- An issue was discovered in Fujitsu Software Infrastructure Manager (ISM) before 2.8.0.061. The ismsnap component (in this specific case at /var/log/fujitsu/ServerViewSuite/ism/FirmwareManagement/FirmwareManagement.log) allows insecure collection and storage of authorization credentials in cleartext. --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-255-02 ∗∗∗ Sicherheitsupdates in Foxit PDF Reader 2023.2 und Foxit PDF Editor 2023.2 verfügbar ∗∗∗ --------------------------------------------- https://www.foxit.com/de/support/security-bulletins.html ∗∗∗ Hitachi Energy Lumada APM Edge ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-255-01 ∗∗∗ Multiple vulnerabilities in OpenSSL affect AIX ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7031625 ∗∗∗ Control Access issues in PCOMM ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7031707 ∗∗∗ Multiple Security vulnerabilities in IBM Java in FileNet Content Manager ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7001699 ∗∗∗ A vulnerability in FasterXML Jackson Core may affect IBM Robotic Process Automation and result in an application crash (IBM X-Force ID: 256137). ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7031716 ∗∗∗ IBM WebSphere Application Server shipped with Jazz for Service Management (JazzSM) is vulnerable could provide weaker than expected security. ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7031051 ∗∗∗ Vulnerability in Open JDK affecting Rational Functional Tester ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7031729 ∗∗∗ IBM App Connect Enterprise is vulnerable to a remote attack and a denial of service due to Node.js modules tough-cookie and semver (CVE-2023-26136, CVE-2022-25883). ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7031733 ∗∗∗ IBM Cloud Pak for Security includes components with multiple known vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7031754 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 11.09.2023
by Daily end-of-shift report 11 Sep '23

11 Sep '23

===================== = End-of-Day report = ===================== Timeframe: Freitag 08-09-2023 18:00 − Montag 11-09-2023 18:00 Handler: Michael Schlagenhaufer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Microsoft Teams phishing attack pushes DarkGate malware ∗∗∗ --------------------------------------------- A new phishing campaign is abusing Microsoft Teams messages to send malicious attachments that install the DarkGate Loader malware. --------------------------------------------- https://www.bleepingcomputer.com/news/security/microsoft-teams-phishing-att… ∗∗∗ Facebook Messenger phishing wave targets 100K business accounts per week ∗∗∗ --------------------------------------------- Hackers use a massive network of fake and compromised Facebook accounts to send out millions of Messenger phishing messages to target Facebook business accounts with password-stealing malware. --------------------------------------------- https://www.bleepingcomputer.com/news/security/facebook-messenger-phishing-… ∗∗∗ From Caribbean shores to your devices: analyzing Cuba ransomware ∗∗∗ --------------------------------------------- The article analyzes the malicious tactics, techniques and procedures (TTP) used by the operator of the Cuba ransomware, and details a Cuba attack incident. --------------------------------------------- https://securelist.com/cuba-ransomware/110533/ ∗∗∗ New HijackLoader Modular Malware Loader Making Waves in the Cybercrime World ∗∗∗ --------------------------------------------- A new malware loader called HijackLoader is gaining traction among the cybercriminal community to deliver various payloads such as DanaBot, SystemBC, and RedLine Stealer. --------------------------------------------- https://thehackernews.com/2023/09/new-hijackloader-modular-malware-loader.h… ∗∗∗ Cybercriminals Using PowerShell to Steal NTLMv2 Hashes from Compromised Windows ∗∗∗ --------------------------------------------- A new cyber attack campaign is leveraging the PowerShell script associated with a legitimate red teaming tool to plunder NTLMv2 hashes from compromised Windows systems primarily located in Australia, Poland, and Belgium. The activity has been codenamed Steal-It by Zscaler ThreatLabz. --------------------------------------------- https://thehackernews.com/2023/09/cybercriminals-using-powershell-to.html ∗∗∗ Passwortmanager: LastPass-Hacker scheinen Kennworttresore zu knacken ∗∗∗ --------------------------------------------- Cyberkriminelle haben vergangenes Jahr LastPass-Kennworttresore kopiert. Nun scheinen sie diese zu knacken und Krypto-Wallets leerzuräumen. --------------------------------------------- https://heise.de/-9300583 ∗∗∗ From ERMAC to Hook: Investigating the technical differences between two Android malware variants ∗∗∗ --------------------------------------------- Hook and ERMAC are Android based malware families that are both advertised by the actor named “DukeEugene”. Hook is the latest variant to be released by this actor and was first announced at the start of 2023. In this announcement, the actor claims that Hook was written from scratch [1]. In our research, we have analysed two samples of Hook and two samples of ERMAC to further examine the technical differences between these malware families. --------------------------------------------- https://research.nccgroup.com/2023/09/11/from-ermac-to-hook-investigating-t… ∗∗∗ Zahlreiche unseriöse Dirndl-Shops im Umlauf ∗∗∗ --------------------------------------------- Wiesenzeit ist Dirndlzeit! Das wissen auch unseriöse Shop-Betreiber:innen. Damit möglichst viele potenzielle Opfer davon erfahren, wird auf Werbung via Facebook und Instagram gesetzt. Versprochen werden hochwertige Dirndl zu einem unschlagbar günstigen Preis. Erfahrungsberichte zeigen jedoch, dass nur minderwertige Kleidung bei den Konsument:innen ankommt. --------------------------------------------- https://www.watchlist-internet.at/news/zahlreiche-unserioese-dirndl-shops-i… ∗∗∗ A classification of CTI Data feeds ∗∗∗ --------------------------------------------- We at CERT.at process and share a wide selection of cyber threat intelligence (CTI) as part of our core mission as Austria’s hub for IT security information. Right now, we are involved in two projects that involve the purchase of commercial CTI. I encountered some varying views on what CTI is and what one should do with the indicators of compromise (IoCs) that are part of a CTI feed. This blog post describes my view on this topic. --------------------------------------------- https://cert.at/en/blog/2023/9/cti-data-feeds ===================== = Vulnerabilities = ===================== ∗∗∗ Pyramid vulnerable to directory traversal ∗∗∗ --------------------------------------------- Pyramid provided by Pylons Project contains a directory traversal vulnerability. --------------------------------------------- https://jvn.jp/en/jp/JVN41113329/ ∗∗∗ HPE OneView: Kritische Lücke erlaubt Umgehung von Authentifizierung ∗∗∗ --------------------------------------------- HPE warnt vor mehreren Sicherheitslücken in OneView, einer Infrastrukurverwaltungssoftware. Angreifer könnten etwa die Anmeldung umgehen. --------------------------------------------- https://heise.de/-9301047 ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (frr, kernel, libraw, mutt, and open-vm-tools), Fedora (cjose, pypy, vim, wireshark, and xrdp), Gentoo (apache), Mageia (chromium-browser-stable, clamav, ghostscript, librsvg, libtiff, openssl, poppler, postgresql, python-pypdf2, and unrar), Red Hat (flac), SUSE (firefox, geoipupdate, icu73_2, libssh2_org, rekor, skopeo, and webkit2gtk3), and Ubuntu (linux-azure, linux-azure-4.15, linux-azure-5.4, linux-gcp-5.4, linux-gkeop, linux-raspi, linux-raspi-5.4, linux-xilinx-zynqmp, linux-gcp, linux-gcp-6.2, linux-ibm, linux-oracle, linux-starfive, linux-gcp-5.15, linux-gkeop-5.15, and opendmarc). --------------------------------------------- https://lwn.net/Articles/944190/ ∗∗∗ Security updates available in PDF-XChange Editor/Tools 10.1.0.380 ∗∗∗ --------------------------------------------- https://www.tracker-software.com/support/security-bulletins.html ∗∗∗ Mattermost security updates 8.1.2 (ESR) / 8.0.3 / 7.8.11 (ESR) released ∗∗∗ --------------------------------------------- https://mattermost.com/blog/mattermost-security-updates-8-1-2-esr-8-0-3-7-8… ∗∗∗ AIX is vulnerable to arbitrary command execution (CVE-2023-26286) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6983236 ∗∗∗ IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in TensorFlow ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7031271 ∗∗∗ Vulnerability in BIND affects IBM Integrated Analytics System (Sailfish)[CVE-2023-2828] ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7031294 ∗∗∗ Vulnerability in OpenSSH affects IBM Integrated Analytics System (Sailfish)[CVE-2023-38408] ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7031293 ∗∗∗ Vulnerabilities in IBM Websphere Application Server affects IBM Application Performance Management. ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7031576 ∗∗∗ Due to use of, IBM Application Performance Management is vulnerable to a local authenticated attacker to obtain sensitive information. ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7031614 ∗∗∗ A vulnerability in Microsoft .NET may affect IBM Robotic Process Automation allowing an attacker to conduct spoofing attacks (CVE-2022-34716) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7031620 ∗∗∗ A vulnerability in Microsoft .NET Core may affect IBM Robotic Process Automation and result in a remote attacker obtaining sensitive information (CVE-2018-8292). ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7029529 ∗∗∗ A vulnerability in Microsoft .NET Framework may affect IBM Robotic Process Automation and result in an exposure of sensitive information (CVE-2022-41064) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7031621 ∗∗∗ IBM Robotic Process Automation could disclose sensitive information from access to RPA scripts, workflows and related data (CVE-2023-38718) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7031619 ∗∗∗ IBM App Connect Enterprise is vulnerable to a remote attack and a denial of service due to Node.js modules protobuf.js, vm2 and word-wrap [CVE-2023-36665, CVE-2023-37903, CVE-2023-37466 and CVE-2023-26115] ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7031624 ∗∗∗ A vulnerability in Newtonsoft.Json may affect IBM Robotic Process Automation and result in a denial of service (IBM X-Force ID: 234366). ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7031623 ∗∗∗ IBM Cognos Command Center is affected by multiple vulnerabilities (CVE-2023-21939, CVE-2023-21967, CVE-2022-29117, XFID: 234366) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7012455 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 08.09.2023
by Daily end-of-shift report 08 Sep '23

08 Sep '23

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 07-09-2023 18:00 − Freitag 08-09-2023 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Post-Quantum Cryptography ∗∗∗ --------------------------------------------- Das Aufkommen von fähigen Quantencomputern hat massive Seiteneffekte auf die Sicherheit diverser kryptografischer Grundoperationen. Diese sind in den letzten Jahren zu essentiellen Bausteinen unserer IT Architektur – insbesondere in vernetzten Systemen – geworden. Noch funktioniert alles, aber wenn wir nicht bald anfangen, uns auf die diese kommende Gefahr vorzubereiten, dann wird die Transition zu „post-quantum cryptography“ eine Schmerzhafte werden. [..] Ich darf nächste Woche bei einer Veranstaltung dazu am Podium sitzen. Und wenn ich mich schon darauf vorbereite, dann teile ich doch gleich meine Quellen und Schlussfolgerungen. --------------------------------------------- https://cert.at/de/blog/2023/9/post-quantum-cryptography ∗∗∗ CISA warns of critical Apache RocketMQ bug exploited in attacks ∗∗∗ --------------------------------------------- The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added to its catalog of known exploited vulnerabilities (KEV) a critical-severity issue tracked as CVE-2023-33246 that affects Apaches RocketMQ distributed messaging and streaming platform. --------------------------------------------- https://www.bleepingcomputer.com/news/security/cisa-warns-of-critical-apach… ∗∗∗ Paranoids Vulnerability Research: Ivanti Issues Security Alert ∗∗∗ --------------------------------------------- The vulnerability allowed for remote code execution — giving a bad actor a method to distribute malicious software through a tool that sends out security updates. And, as part of the research process, we confirmed the feasibility of this by developing an end-to-end exploit that showcases how malware can be distributed to managed endpoints (demo). --------------------------------------------- https://www.yahooinc.com/paranoids/paranoids-vulnerability-research-ivanti-… ∗∗∗ Malvertising-Kampagne will Mac-Nutzern Atomic Stealer unterjubeln ∗∗∗ --------------------------------------------- IT-Forscher beobachten eine Malvertising-Kampagne, deren Urheber Mac-Nutzern den Atomic Stealer unterschieben wollen. Der klaut etwa Krypto-Währungen. --------------------------------------------- https://heise.de/-9298637 ∗∗∗ Emsisoft Tells Users to Update Products, Reboot Systems Due to Certificate Mishap ∗∗∗ --------------------------------------------- The problem, the company says, affects its Extended Validation (EV) code signing certificate that was renewed on August 23 and used to sign all program files compiled after that date, including the latest software version, released on September 4. --------------------------------------------- https://www.securityweek.com/emsisoft-tells-users-to-update-products-reboot… ∗∗∗ New Phishing Campaign Launched via Google Looker Studio ∗∗∗ --------------------------------------------- Cybersecurity firm Check Point is warning of a new type of phishing attacks that abuse Google Looker Studio to bypass protections. --------------------------------------------- https://www.securityweek.com/new-phishing-campaign-launched-via-google-look… ∗∗∗ MAR-10454006.r5.v1 SUBMARINE, SKIPJACK, SEASPRAY, WHIRLPOOL, and SALTWATER Backdoors ∗∗∗ --------------------------------------------- CISA obtained five malware samples - including artifacts related to SUBMARINE, SKIPJACK, SEASPRAY, WHIRLPOOL, and SALTWATER backdoors. The device was compromised by threat actors exploiting CVE-2023-2868, a former zero-day vulnerability affecting versions 5.1.3.001-9.2.0.006 of Barracuda Email Security Gateway (ESG). --------------------------------------------- https://www.cisa.gov/news-events/analysis-reports/ar23-250a-0 ∗∗∗ W3LL-Phishing Kit kann Multifaktor-Authentifizierung aushebeln; Tausende von Microsoft 365-Konten gekapert ∗∗∗ --------------------------------------------- Der in Singapur angesiedelte Sicherheitsanbieter Group-IB hat die Tage einen Sicherheits-Report veröffentlicht, der auf spezielle Aktivitäten einer W3LL genannten Gruppe von Cyberkriminellen hinweist. Die Cybergang hat ein spezielles Phishing-Kit entwickelt, um Microsoft 365-Konten zu kapern und bietet diese Dienstleistung mindestens 500 anderen Cybergangs über einen geheimen W3LL Store an. --------------------------------------------- https://www.borncity.com/blog/2023/09/08/w3ll-phishing-kit-kann-multifaktor… ∗∗∗ A Deep Dive into 70 Layers of Obfuscated Info-Stealer Malware ∗∗∗ --------------------------------------------- In the battle of hackers against defenders, we consistently find hackers trying to disguise their true intent. We have analyzed an interesting sample that was armed with multiple layers of obfuscation. These packages were quite the challenge. --------------------------------------------- https://checkmarx.com/blog/a-deep-dive-into-70-layers-of-obfuscated-info-st… ===================== = Vulnerabilities = ===================== ∗∗∗ Sicherheitsupdates für macOS, iOS/iPadOS schließen zwei 0-Days der NSO-Group (Pegasus Spyware) ∗∗∗ --------------------------------------------- Apple hat zum 7. September 2023 wieder einen Schwung Sicherheitsupdates für seine Betriebssysteme macOS, iOS/iPadOS und auch WatchOS veröffentlicht. Mit diesen Updates werden zwei 0-Day-Schwachstellen geschlossen, die von der Pegasus Spyware der NSO-Group für die Überwachung von Mobilgeräten missbraucht wurden. --------------------------------------------- https://www.borncity.com/blog/2023/09/08/sicherheitsupdates-fr-macos-ios-ip… ∗∗∗ OpenSSL Security Advisory [8th September 2023] ∗∗∗ --------------------------------------------- POLY1305 MAC implementation corrupts XMM registers on Windows (CVE-2023-4807). Severity: Low --------------------------------------------- https://www.openssl.org/news/secadv/20230908.txt ∗∗∗ QNAP Security Advisories 2023-09-08 ∗∗∗ --------------------------------------------- QNAP has released 4 security advisories: (1x High, 3x Medium) --------------------------------------------- https://www.qnap.com/en-us/security-advisories?ref=security_advisory_details ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (chromium, libssh2, memcached, and python-django), Fedora (netconsd), Oracle (firefox and thunderbird), Scientific Linux (firefox), SUSE (open-vm-tools), and Ubuntu (grub2-signed, grub2-unsigned, shim, and shim-signed, plib, and python2.7, python3.5). --------------------------------------------- https://lwn.net/Articles/943990/ ∗∗∗ Notepad++ v8.5.7 fixt Schwachstellen ∗∗∗ --------------------------------------------- Mitte August 2023 hatte Sicherheitsforscher Jaroslav Lobacevski vier Schwachstellen (CVE-2023-40031, CVE-2023-40036, CVE-2023-40164, CVE-2023-40166) im Editor Notepad ++ für Windows öffentlich gemacht. Die Einstufung der Schwachstellen reicht von mittel bis hoch. Der Entwickler hat diese Schwachstellen, nachdem ihm diese seit Monaten bekannt sind, nun mit dem Update auf Notepad++ v8.5.7 beseitigt. --------------------------------------------- https://www.borncity.com/blog/2023/09/08/notepad-v8-5-7-fixt-schwachstellen/ ∗∗∗ PHOENIX CONTACT: Multiple vulnerabilities in WP 6xxx Web panels ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2023-018/ ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 07.09.2023
by Daily end-of-shift report 07 Sep '23

07 Sep '23

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 06-09-2023 18:00 − Donnerstag 07-09-2023 18:00 Handler: Michael Schlagenhaufer Co-Handler: Robert Waldner ===================== = News = ===================== ∗∗∗ Next-Generation Context Aware Password Cracking ∗∗∗ --------------------------------------------- TLDR; Using ChatGPT, an attacker can generate a list of password guesses based on the context of the target such as a company’s description or social media accounts. --------------------------------------------- https://medium.com/@doctoreww/next-generation-context-aware-password-cracki… ∗∗∗ Cisco warnt vor teils kritischen Lücken und liefert Updates für mehrere Produkte ∗∗∗ --------------------------------------------- In mehreren Cisco-Produkten lauern Sicherheitslücken, die Updates schließen sollen. Eine gilt sogar als kritisch. --------------------------------------------- https://heise.de/-9297182 ∗∗∗ FreeWorld ransomware attacks MSSQL—get your databases off the Internet ∗∗∗ --------------------------------------------- When we think of ransomware and brute force password guessing attacks, we normally think of RDP, but recent research from Securonix reminds us that anything secured with a password and exposed to the internet is of interest to cybercriminals. --------------------------------------------- https://www.malwarebytes.com/blog/news/2023/09/freeworld-ransomware-attacks… ∗∗∗ Ozempic, Wegovy & Co: Vorsicht vor Fake-Shops mit „Schlankheitsmitteln“ ∗∗∗ --------------------------------------------- Diabetes-Medikamente wie Ozempic, Saxenda oder Metformin sind seit einiger Zeit von Lieferengpässen betroffen. Der Grund: Elon Musk, Kim Kardashian und andere Prominente nutzen diese und ähnliche Medikamente zum Abnehmen, der Hype dieser „Abnehmspritzen“ ließ nicht lange auf sich warten. Ein Trend, den sich auch Kriminelle zunutze machen. Sie bieten die eigentlich verschreibungspflichtigen Medikamente in Fake-Shops als Schlankheitsmittel an. --------------------------------------------- https://www.watchlist-internet.at/news/ozempic-wegovy-co-vorsicht-vor-fake-… ∗∗∗ A classification of CTI Data feeds ∗∗∗ --------------------------------------------- We at CERT.at process and share a wide selection of cyber threat intelligence (CTI) as part of our core mission as Austria’s hub for IT security information. Right now, we are involved in two projects that involve the purchase of commercial CTI. I encountered some varying views on what CTI is and what one should do with the indicators of compromise (IoCs) that are part of a CTI feed. This blog post describes my view on this topic. --------------------------------------------- https://cert.at/en/blog/2023/9/cti-data-feeds ∗∗∗ Cybercriminals target graphic designers with GPU miners ∗∗∗ --------------------------------------------- Cybercriminals are abusing Advanced Installer, a legitimate Windows tool used for creating software packages, to drop cryptocurrency-mining malware including PhoenixMiner and lolMiner on infected machines. --------------------------------------------- https://blog.talosintelligence.com/cybercriminals-target-graphic-designers-… ∗∗∗ CISA Releases Update to Threat Actors Exploiting Citrix CVE-2023-3519 to Implant Webshells ∗∗∗ --------------------------------------------- This Cybersecurity Advisory has been updated with new tactics, techniques, and procedures (TTPs) as well as indicators of compromise (IOCs) received from an additional victim and trusted third parties. --------------------------------------------- https://www.cisa.gov/news-events/alerts/2023/09/06/cisa-releases-update-thr… ∗∗∗ MAR-10430311-1.v1 Multiple Nation-State Threat Actors Exploit CVE-2022-47966 and CVE-2022-42475 ∗∗∗ --------------------------------------------- CISA received 4 files for analysis from an incident response engagement conducted at an Aeronautical Sector organization [..] CISA has provided indicators of compromise (IOCs) and YARA rules for detection within this Malware Analysis Report (MAR). --------------------------------------------- https://www.cisa.gov/news-events/analysis-reports/ar23-250a ===================== = Vulnerabilities = ===================== ∗∗∗ Aruba-Controller und -Gateways mit hochriskanten Sicherheitslücken ∗∗∗ --------------------------------------------- Für Aruba-Controller und -Gateways der Serien 9000 und 9200 gibt es Updates, die hochriskante Sicherheitslücken schließen. --------------------------------------------- https://heise.de/-9297925 ∗∗∗ Cisco Security Advisories 2023-09-06 - 2023-09-06 ∗∗∗ --------------------------------------------- Cisco has released 6 security advisories: (1x Critical, 1x High, 4x Medium) --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/Search.x?publicationTypeIDs… ∗∗∗ Sicherheitsupdates: Unbefugte Zugriffe auf TP-Link-Router möglich ∗∗∗ --------------------------------------------- Angreifer können verschiedene Router von TP-Link attackieren und im schlimmsten Fall eigene Befehle auf Geräten ausführen. --------------------------------------------- https://heise.de/-9297306 ∗∗∗ 2023-08 Out-of-Cycle Security Bulletin: Junos OS: SRX Series and EX Series: Multiple vulnerabilities in J-Web can be combined to allow a preAuth Remote Code Execution ∗∗∗ --------------------------------------------- Update - September 5th 2023: A new variant of the SRX upload vulnerability has been published by external researchers (CVE-2023-36851). All fixes listed under Solution below break the RCE chain --------------------------------------------- https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-B… ∗∗∗ Wordfence Intelligence Weekly WordPress Vulnerability Report (August 28, 2023 to September 3, 2023) ∗∗∗ --------------------------------------------- Last week, there were 64 vulnerabilities disclosed in 61 WordPress Plugins and 2 WordPress themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 32 Vulnerability Researchers that contributed to WordPress Security last week. --------------------------------------------- https://www.wordfence.com/blog/2023/09/wordfence-intelligence-weekly-wordpr… ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Fedora (erofs-utils, htmltest, indent, libeconf, netconsd, php-phpmailer6, tinyexr, and vim), Red Hat (firefox), and Ubuntu (linux-aws, linux-aws-5.15, linux-ibm-5.15, linux-oracle, linux-oracle-5.15, linux-azure, linux-azure-fde-5.15, linux-gke, linux-gkeop, linux-intel-iotg-5.15, linux-raspi, linux-oem-6.1, linux-raspi, linux-raspi-5.4, shiro, and sox). --------------------------------------------- https://lwn.net/Articles/943856/ ∗∗∗ CVE-2023-4528: Java Deserialization Vulnerability in JSCAPE MFT (Fixed) ∗∗∗ --------------------------------------------- CVE-2023-4528 affects all versions of JSCAPE MFT Server prior to version 2023.1.9 on all platforms (Windows, Linux, and MacOS). See the JSCAPE advisory for more information [..] CVE-2023-4528 has been addressed in JSCAPE version 2023.1.9 which is now available for customer deployment. --------------------------------------------- https://www.rapid7.com/blog/post/2023/09/07/cve-2023-4528-java-deserializat… ∗∗∗ CISA Releases Four Industrial Control Systems Advisories ∗∗∗ --------------------------------------------- ICSA-23-250-01 Dover Fueling Solutions MAGLINK LX Console (CVSS v3 9.1), ICSA-23-250-02 Phoenix Contact TC ROUTER and TC CLOUD CLIENT (CVSS v3 9.6), ICSA-23-250-03 Socomec MOD3GP-SY-120K (CVSS v3 10.0), ICSA-23-157-01 Delta Electronics CNCSoft-B DOPSoft (Update) (CVSS v3 7.8) --------------------------------------------- https://www.cisa.gov/news-events/alerts/2023/09/07/cisa-releases-four-indus… ∗∗∗ Drupal: WebProfiler - Moderately critical - Cross Site Scripting - SA-CONTRIB-2023-044 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2023-044 ∗∗∗ Drupal: highlight.php - Moderately critical - Cross Site Scripting - SA-CONTRIB-2023-043 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2023-043 ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 06.09.2023
by Daily end-of-shift report 06 Sep '23

06 Sep '23

===================== = End-of-Day report = ===================== Timeframe: Dienstag 05-09-2023 18:00 − Mittwoch 06-09-2023 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Patchday: Schadcode-Attacken auf Android 11, 12, 13 möglich ∗∗∗ --------------------------------------------- Google und weitere Hersteller von Android-Geräten haben wichtige Sicherheitsupdates veröffentlicht. --------------------------------------------- https://heise.de/-9296497 ∗∗∗ Microsoft überarbeitet Downfall-Empfehlungen; MSI liefert BIOS-Update für UNSUPPORTED_PROCESSOR-Problem ∗∗∗ --------------------------------------------- Im August war die sogenannte Downfall-Schwachstelle in Prozessoren bekannt geworden, die ein Abfließen von Informationen ermöglicht. Nun hat Microsoft seinen Support-Beitrag mit Hinweisen zur Downfall-Schwachstelle unter Windows aktualisiert und Informationen zum Deaktivieren der Schutzmaßnahmen entfernt. Weiterhin gab es nach Installation [..] --------------------------------------------- https://www.borncity.com/blog/2023/09/06/microsoft-berarbeitet-downfall-emp… ∗∗∗ Pandoras box is now open: the well-known Mirai trojan arrives in a new disguise to Android-based TV sets and TV boxes ∗∗∗ --------------------------------------------- Doctor Web has identified a family of Android.Pandora trojans that compromise Android devices, either during firmware updates or when applications for viewing pirated video content are installed. This backdoor inherited its advanced DDoS-attack capabilities from its ancestor, the well-known Linux.Mirai trojan. --------------------------------------------- https://news.drweb.com/show/?i=14743 ∗∗∗ Security Relevant DNS Records, (Wed, Sep 6th) ∗∗∗ --------------------------------------------- DNS has a big security impact. DNS is in part responsible for your traffic reaching the correct host on the internet. But there is more to DNS then name resolution. I am going to mention a few security relevant record types here, in no particular order: [..] --------------------------------------------- https://isc.sans.edu/diary/rss/30194 ∗∗∗ Bogus URL Shorteners Go Mobile-Only in AdSense Fraud Campaign ∗∗∗ --------------------------------------------- Since September 2022, our team has been tracking a bogus URL shortener redirect campaign that started with just a single domain: ois[.]is. By the beginning of 2023, this malware campaign had expanded to over a hundred domain names to redirect traffic to low quality Q&A sites and monetize traffic via Google AdSense. In fact, since the beginning of this year alone, Sucuri’s remote website scanner has detected various strains of this malware on over 24,000 websites. --------------------------------------------- https://blog.sucuri.net/2023/09/bogus-url-shorteners-go-mobile-only-in-adse… ∗∗∗ Alert: Phishing Campaigns Deliver New SideTwist Backdoor and Agent Tesla Variant ∗∗∗ --------------------------------------------- The Iranian threat actor tracked as APT34 has been linked to a new phishing attack that leads to the deployment of a variant of a backdoor called SideTwist. “APT34 has a high level of attack technology, can design different intrusion methods for different types of targets, and has supply chain attack capability,” NSFOCUS Security Labs said in a report published last week. --------------------------------------------- https://thehackernews.com/2023/09/alert-phishing-campaigns-deliver-new.html ∗∗∗ Lord Of The Ring0 - Part 5 ∗∗∗ --------------------------------------------- In this blog post, I’ll explain two common hooking methods (IRP Hooking and SSDT Hooking) and two different injection techniques from the kernel to the user mode for both shellcode and DLL (APC and CreateThread) with code snippets and examples from Nidhogg. --------------------------------------------- https://idov31.github.io/2023/07/19/lord-of-the-ring0-p5.html ∗∗∗ A review of SolarWinds attack on Orion platform using persistent threat agents and techniques for gaining unauthorized access ∗∗∗ --------------------------------------------- This paper of work examines the SolarWinds attack, designed on Orion Platform security incident. It analyses the persistent threats agents and potential technical attack techniques to gain unauthorized access. [..] It concludes with necessary remediation actions on cyber hygiene countermeasures, common vulnerabilities and exposure analysis and solutions. --------------------------------------------- https://arxiv.org/abs/2308.10294 ∗∗∗ What is ISO 27002:2022 Control 8.9? A Quick Look at the Essentials ∗∗∗ --------------------------------------------- Configuration management is now presented as a new control in the new, revised edition of ISO 27002:2022 (Control 8.9). It is a crucial component of an organizations security management. This blog will guide you through the essentials of Control 8.9. --------------------------------------------- https://www.tripwire.com/state-of-security/what-iso-270022022-control-89-qu… ∗∗∗ Peeking under the bonnet of the Litter Robot 3 ∗∗∗ --------------------------------------------- I began to wonder what interesting things I may find when doing a small tear down of the Litter Robot’s components including the PCB, firmware, and mobile application. [..] So, please follow me on my journey to understanding the extraction and analysis of an ESP32 IOT device, reverse engineering a Flutter mobile application, and capturing and analysing the network traffic between the device, the mobile app and the internet. --------------------------------------------- https://www.elttam.com/blog/re-of-lr3/ ∗∗∗ Experts Fear Crooks are Cracking Keys Stolen in LastPass Breach ∗∗∗ --------------------------------------------- [..] Palant said while LastPass indeed improved its master password defaults in 2018, it did not force all existing customers who had master passwords of lesser lengths to pick new credentials [..] Palant believes LastPass also failed to upgrade many older, original customers to more secure encryption protections [..] According to MetaMask’s Monahan, users who stored any important passwords with LastPass [..] should change those credentials immediately --------------------------------------------- https://krebsonsecurity.com/2023/09/experts-fear-crooks-are-cracking-keys-s… ∗∗∗ Android 14 blocks all modification of system certificates, even as root ∗∗∗ --------------------------------------------- If youre an Android developer, tester, reverse engineer, or anybody else interested in directly controlling who your device trusts, this is going to create some new challenges. Before we get into the finer details, first I want to talk a little about the context around Android CA management and how we got here [..] --------------------------------------------- https://httptoolkit.com/blog/android-14-breaks-system-certificate-installat… ∗∗∗ You patched yet? Years-old Microsoft security holes still hot targets for cyber-crooks ∗∗∗ --------------------------------------------- And so we can believe it when Qualys yesterday said 15 of the 20 most-exploited software vulnerabilities it has observed are in Microsofts code. [..] The No. 1 flaw on the list was patched in November 2017, a code execution hole in Microsoft Offices Equation Editor wed have hoped had been mostly mitigated by now. --------------------------------------------- https://www.theregister.com/2023/09/05/qualys_top_20_vulnerabilities/ ∗∗∗ Code Vulnerabilities Leak Emails in Proton Mail ∗∗∗ --------------------------------------------- In this blog post, we first present the technical details of the vulnerabilities we found in Proton Mail. We show how an innocent-looking piece of code led to a Cross-Site Scripting issue that made it possible for attackers to steal unencrypted emails and impersonate victims. As part of a 3-post series, we will cover other severe vulnerabilities we found in Skiff and Tutanota Desktop in the coming weeks. --------------------------------------------- https://www.sonarsource.com/blog/code-vulnerabilities-leak-emails-in-proton… ∗∗∗ 4,500 of the Top 1 Million Websites Leaked Source Code, Secrets ∗∗∗ --------------------------------------------- We scanned the Alexa Top 1 Million Websites for leaked secrets. We found thousands of exposed source code repositories and hundreds of live API keys. These are our top 5 takeaways --------------------------------------------- https://trufflesecurity.com/blog/4500-of-the-top-1-million-websites-leaked-… ∗∗∗ Apache Superset Part II: RCE, Credential Harvesting and More ∗∗∗ --------------------------------------------- In this post, we disclose all the issues we’ve reported to Superset, including two new high severity vulnerabilities, CVE-2023-39265 and CVE-2023-37941, that are fixed in the just released 2.1.1 version of Superset. We strongly recommend that all Superset users upgrade to this version. --------------------------------------------- https://www.horizon3.ai/apache-superset-part-ii-rce-credential-harvesting-a… ∗∗∗ New phishing tool hijacked thousands of Microsoft business email accounts ∗∗∗ --------------------------------------------- Researchers have uncovered a hidden “phishing empire” targeting businesses in Europe, Australia and the U.S. with a sophisticated new tool. A hacking group called W3LL, which has been active since at least 2017, has created an English-language underground marketplace to sell a phishing kit that can bypass multi-factor authentication, according to a report [..] --------------------------------------------- https://therecord.media/w3ll-phishing-toolkit-bec-microsoft-365-accounts ∗∗∗ Distribution of Backdoor via Malicious LNK: RedEyes (ScarCruft) ∗∗∗ --------------------------------------------- AhnLab Security Emergency response Center (ASEC) has confirmed that malware [1], which was previously distributed in CHM format, is now being distributed in LNK format. This malware executes additional scripts located at a specific URL through the mshta process. It then receives commands from the threat actor’s server to carry out additional malicious behaviors. --------------------------------------------- https://asec.ahnlab.com/en/56756/ ∗∗∗ SapphireStealer: Open-source information stealer enables credential and data theft ∗∗∗ --------------------------------------------- SapphireStealer appears to be delivered as part of a multi-stage infection process, with threat actors leveraging open-source malware downloaders like FUD-Loader to deliver SapphireStealer to potential victims. --------------------------------------------- https://blog.talosintelligence.com/sapphirestealer-goes-open-source/ ∗∗∗ Threat Actor Continues to Plague the Open-Source Ecosystem with Sophisticated Info-Stealing Malware ∗∗∗ --------------------------------------------- In May, we sounded the alarm about PYTA31, an advanced persistent threat actor distributing the “WhiteSnake” malware. Since then, we’ve been rigorously monitoring this group, which has been active from April through mid-August, distributing malicious PyPI packages laced with “WhiteSnake Malware.” --------------------------------------------- https://checkmarx.com/blog/threat-actor-continues-to-plague-the-open-source… ===================== = Vulnerabilities = ===================== ∗∗∗ Sicherheitsupdates: Angreifer können Kontrolle über Asus-Router erlangen ∗∗∗ --------------------------------------------- Mehrere Sicherheitslücken gefährden verschiedene Router-Modelle von Asus. Patches sichern Geräte ab. --------------------------------------------- https://heise.de/-9296210 ∗∗∗ Webbrowser: Hochriskante Schwachstellen in Google Chrome geschlossen ∗∗∗ --------------------------------------------- Google stopft mit aktualisiertern Chrome-Versionen vier als hochriskant eingestufte Sicherheitslücken. --------------------------------------------- https://heise.de/-9295977 ∗∗∗ Researchers Discover Critical Vulnerability in PHPFusion CMS ∗∗∗ --------------------------------------------- No patch is available yet for the bug, which can enable remote code execution under the correct circumstances. --------------------------------------------- https://www.darkreading.com/application-security/researchers-discover-criti… ∗∗∗ Forthcoming OpenSSL Release ∗∗∗ --------------------------------------------- The OpenSSL project team would like to announce the forthcoming release of OpenSSL version 1.1.1w. This release will be made available on Monday 11th September 2023 between 1300-1700 UTC. This is a security-fix release. The highest severity issue fixed in this release is Low --------------------------------------------- https://mta.openssl.org/pipermail/openssl-announce/2023-September/000271.ht… ∗∗∗ 2023-08 Out-of-Cycle Security Bulletin: Junos OS: SRX Series and EX Series: Multiple vulnerabilities in J-Web can be combined to allow a preAuth Remote Code Execution ∗∗∗ --------------------------------------------- 2023-09-05: Important update for SRX customers --------------------------------------------- https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-B… ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (aom and php7.3), Fedora (freeimage and mingw-freeimage), Scientific Linux (thunderbird), SUSE (amazon-ssm-agent, chromium, container-suseconnect, docker, glib2, php7, python-Django1, and rubygem-rails-html-sanitizer), and Ubuntu (kernel, linux, linux-aws, linux-aws-5.4, linux-gcp, linux-hwe-5.4, linux-ibm, linux-iot, linux-kvm, linux-oracle, linux-oracle-5.4, linux, linux-aws, linux-aws-6.2, linux-hwe-6.2, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-6.2, linux-raspi, linux, linux-aws, linux-aws-hwe, linux-gcp, linux-gcp-4.15, linux-hwe, linux-kvm, linux-oracle, and linux, linux-gcp, linux-hwe-5.15, linux-ibm, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia). --------------------------------------------- https://lwn.net/Articles/943679/ ∗∗∗ VU#304455: Authentication Bypass in Tenda N300 Wireless N VDSL2 Modem Router ∗∗∗ --------------------------------------------- https://kb.cert.org/vuls/id/304455 ∗∗∗ Stored Cross-Site Scripting Vulnerability Patched in Newsletter WordPress Plugin ∗∗∗ --------------------------------------------- https://www.wordfence.com/blog/2023/09/stored-cross-site-scripting-vulnerab… ∗∗∗ AtlasVPN to Patch IP Leak Vulnerability After Public Disclosure ∗∗∗ --------------------------------------------- https://www.securityweek.com/atlasvpn-to-patch-ip-leak-vulnerability-after-… ∗∗∗ Dozens of Unpatched Flaws Expose Security Cameras Made by Defunct Company Zavio ∗∗∗ --------------------------------------------- https://www.securityweek.com/dozens-of-unpatched-flaws-expose-security-came… ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 05.09.2023
by Daily end-of-shift report 05 Sep '23

05 Sep '23

===================== = End-of-Day report = ===================== Timeframe: Montag 04-09-2023 18:00 − Dienstag 05-09-2023 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Hackers exploit MinIO storage system to breach corporate networks ∗∗∗ --------------------------------------------- Hackers are exploiting two recent MinIO vulnerabilities to breach object storage systems and access private information, execute arbitrary code, and potentially take over servers. --------------------------------------------- https://www.bleepingcomputer.com/news/security/hackers-exploit-minio-storag… ∗∗∗ DarkGate Malware Activity Spikes as Developer Rents Out Malware to Affiliates ∗∗∗ --------------------------------------------- A new malspam campaign has been observed deploying an off-the-shelf malware called DarkGate."The current spike in DarkGate malware activity is plausible given the fact that the developer of the malware has recently started to rent out the malware to a limited number of affiliates," Telekom Security said in a report published last week. --------------------------------------------- https://thehackernews.com/2023/08/darkgate-malware-activity-spikes-as.html ∗∗∗ New Python Variant of Chaes Malware Targets Banking and Logistics Industries ∗∗∗ --------------------------------------------- Banking and logistics industries are under the onslaught of a reworked variant of a malware called Chaes."It has undergone major overhauls: from being rewritten entirely in Python, which resulted in lower detection rates by traditional defense systems, to a comprehensive redesign and an enhanced communication protocol," Morphisec said in a new detailed technical write-up [..] --------------------------------------------- https://thehackernews.com/2023/09/new-python-variant-of-chaes-malware.html ∗∗∗ New BLISTER Malware Update Fuelling Stealthy Network Infiltration ∗∗∗ --------------------------------------------- An updated version of a malware loader known as BLISTER is being used as part of SocGholish infection chains to distribute an open-source command-and-control (C2) framework called Mythic.“New BLISTER update includes keying feature that allows for precise targeting of victim networks and lowers exposure within VM/sandbox environments,” Elastic Security Labs researchers [..] --------------------------------------------- https://thehackernews.com/2023/09/new-blister-malware-update-fuelling.html ∗∗∗ Nascent Malware Campaign Targets npm, PyPI, and RubyGems Developers ∗∗∗ --------------------------------------------- Python Malware: On the morning of September 3, 2023, our automated platform notified us of the first package in this campaign: kwxiaodian [..] This follows a common pattern we see across many early campaigns and one we witnessed a few weeks back [..] Obfuscated Javascript Packages: At roughly the same time, we received notifications about malicious package publications on npm. Rubygems Package: The Rubygems package follows similar patterns to both the PyPI and npm packages. --------------------------------------------- https://blog.phylum.io/malware-campaign-targets-npm-pypi-and-rubygems-devel… ∗∗∗ Common usernames submitted to honeypots ∗∗∗ --------------------------------------------- Based on reader feedback, I decided to take a look at usernames submitted to honeypots. The usernames that are seen on a daily basis look very familiar. [..] I exported the username data from my honeypot, which is a little over 16 months of data --------------------------------------------- https://isc.sans.edu/diary/rss/30188 ∗∗∗ Uncovering Web Cache Deception: A Missed Vulnerability in the Most Unexpected Places ∗∗∗ --------------------------------------------- During the assessment of the target application, it was observed that the server had implemented restrictions to prevent Web Cache Deception attacks on API/Web endpoints that had session tokens or data in the response. Unfortunately, the same precautions were not implemented on the /404 page or any /nonexistingurl. We discovered that the response for any endpoint that doesnt exist contained PII information without any cache controls in place. --------------------------------------------- https://blog.agilehunt.com/blogs/security/web-cache-deception-attack-on-404… ∗∗∗ Whats in a name? [..] The .kids TLD is not alright ∗∗∗ --------------------------------------------- Cisco Talos successfully registered the domain name: your-dns-needs-immediate-attention.kids. Talos set up an internet server to log all activity related to this name, and immediately we received a barrage of HTTP requests from systems running Microsoft’s “System Center Configuration Manager.” [..] we were able to masquerade as a trusted system. Networks using .kids names could be tricked into trusting our system to relay internal mail, dictate configuration management settings, and more. --------------------------------------------- https://blog.talosintelligence.com/whats-in-a-name/ ∗∗∗ Inconsistencies in the Common Vulnerability Scoring System (CVSS) ∗∗∗ --------------------------------------------- The goal of CVSS is to provide comparable scores across different evaluators. However, previous works indicate that CVSS might not reach this goal: If a vulnerability is evaluated by several analysts, their scores often differ. This raises the following questions: Are CVSS evaluations consistent? Which factors influence CVSS assessments? We systematically investigate these questions in an online survey with 196 CVSS users. --------------------------------------------- https://www.schneier.com/blog/archives/2023/09/inconsistencies-in-the-commo… ∗∗∗ CVE-2023-4634 - Tricky Unauthenticated RCE on Wordpress Media Library Assistant Plugin using a good old Imagick ∗∗∗ --------------------------------------------- As discussed in many of our articles, you already know that WordPress and related plugins are taking up a large space in the global attack surface [..] The vulnerability described below is a perfect example --------------------------------------------- https://patrowl.io/blog-wordpress-media-library-rce-cve-2023-4634/ ∗∗∗ When URL parsers disagree (CVE-2023-38633) ∗∗∗ --------------------------------------------- Discovery and walkthrough of CVE-2023-38633 in librsvg, when two URL parser implementations (Rust and Glib) disagree on file scheme parsing leading to path traversal. --------------------------------------------- https://www.canva.dev/blog/engineering/when-url-parsers-disagree-cve-2023-3… ∗∗∗ Vorsicht vor betrügerischen PayPal-Anrufen ∗∗∗ --------------------------------------------- Ihr Telefon klingelt. Sie heben ab und eine Tonbandstimme meldet sich: „Hallo, hier ist PayPal. Sie haben soeben 738 Euro überwiesen. Um den Zahlvorgang abzubrechen, drücken Sie die 1.“ Drücken Sie keinesfalls die 1, hierbei handelt es sich um eine Betrugsmasche. Legen Sie auf! --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-vor-betruegerischen-paypal-… ===================== = Vulnerabilities = ===================== ∗∗∗ ASUS routers vulnerable to critical remote code execution flaws ∗∗∗ --------------------------------------------- Three critical-severity remote code execution vulnerabilities impact ASUS RT-AX55, RT-AX56U_V2, and RT-AC86U routers, potentially allowing threat actors to hijack devices if security updates are not installed. --------------------------------------------- https://www.bleepingcomputer.com/news/security/asus-routers-vulnerable-to-c… ∗∗∗ Multiple vulnerabilities in F-RevoCRM ∗∗∗ --------------------------------------------- * An attacker who can access the product may execute an arbitrary OS command on the server where the product is running - CVE-2023-41149 * An arbitrary script may be executed on the web browser of the user who is using the product - CVE-2023-41150 --------------------------------------------- https://jvn.jp/en/jp/JVN78113802/ ∗∗∗ Festo: MSE6-C2M/D2M/E2M Incomplete User Documentation of Remote Accessible Functions (CVE-2023-3634) ∗∗∗ --------------------------------------------- Festo developed the products according to the respective state of the art. As a result, the protocols used no longer fully meet todays security requirements. The products are designed and developed for use in sealed-off (industrial) networks. If the network is not adequately sealed off, unauthorized access to the product can cause damage or malfunctions, particularly Denial of Service (DoS) or loss of integrity. Remediation: Update of user documentation in next product version. --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2023-020/ ∗∗∗ 9 Vulnerabilities Patched in SEL Power System Management Products ∗∗∗ --------------------------------------------- Researchers at industrial cybersecurity firm Nozomi Networks have analyzed the company’s SEL-5030 acSELerator QuickSet and SEL-5037 Grid Configurator, software products designed to allow engineers and technicians to configure and manage devices for power system protection, control, metering and monitoring, and to create and deploy settings for SEL power system devices. Nozomi researchers discovered a total of nine vulnerabilities, including four that have been assigned a ‘high severity’ rating --------------------------------------------- https://www.securityweek.com/9-vulnerabilities-patched-in-sel-power-system-… ∗∗∗ CISA Releases Two Industrial Control Systems Advisories ∗∗∗ --------------------------------------------- * ICSA-23-248-01 Fujitsu Limited Real-time Video Transmission Gear IP series: CVE-2023-38433 * ICSMA-23-248-01 Softneta MedDream PACS Premium: CVE-2023-40150, CVE-2023-39227 --------------------------------------------- https://www.cisa.gov/news-events/alerts/2023/09/05/cisa-releases-two-indust… ∗∗∗ AVM: Fritzbox-Firmware 7.57 und 7.31 stopfen Sicherheitsleck ∗∗∗ --------------------------------------------- AVM hat für zahlreiche Fritzboxen die Firmware 7.57 und 7.31 veröffentlicht. Es handelt sich um ein Stabilitäts- und Sicherheitsupdate. --------------------------------------------- https://heise.de/-9294758 ∗∗∗ Xen XSA-437: arm32: The cache may not be properly cleaned/invalidated ∗∗∗ --------------------------------------------- A malicious guest may be able to read sensitive data from memory that previously belonged to another guest. CVE ID: CVE-2023-34321 --------------------------------------------- https://xenbits.xen.org/xsa/advisory-437.html ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (file and thunderbird), Fedora (exercism, libtommath, moby-engine, and python-pyramid), Oracle (cups and kernel), Red Hat (firefox, kernel, kernel-rt, kpatch-patch, and thunderbird), SUSE (amazon-ecs-init, buildah, busybox, djvulibre, exempi, firefox, gsl, keylime, kubernetes1.18, php7, and sccache), and Ubuntu (docker-registry and linux-azure-5.4). --------------------------------------------- https://lwn.net/Articles/943584/ ∗∗∗ IBM UrbanCode Build is vulnerable to CVE-2023-24998 ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030594 ∗∗∗ IBM UrbanCode Build is vulnerable to CVE-2023-28708 ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030596 ∗∗∗ Vulnerabilities found in batik-all-1.7.jar, batik-dom-1.7.jar which is shipped with IBM Intelligent Operations Center(CVE-2018-8013, CVE-2017-5662, CVE-2015-0250) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030598 ∗∗∗ Due to use of FasterXML Jackson-databind, IBM Cloud Pak for Multicloud Management Monitoring is vulnerable to a denial of service. ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030601 ∗∗∗ Due to use of Kafka, IBM Cloud Pak for Multicloud Management Monitoring could allow a remote attacker to obtain sensitive information. ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030604 ∗∗∗ Due to use of Spark from Hadoop, IBM Cloud Pak for Multicloud Management Monitoring could allow a remote attacker to traverse directories on the system. ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030603 ∗∗∗ Due to use of Apache Cassandra , IBM Cloud Pak for Multicloud Management Monitoring is vulnerable to an authenticated attacker to gaining elevated privileges. ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030602 ∗∗∗ Due to use of IBM WebSphere Application Server Liberty, IBM Cloud Pak for Multicloud Management Monitoring is vulnerable to multiple vulnerabilities. ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030610 ∗∗∗ Multiple vulnerabilities in IBM Java SDK affect WebSphere Service Registry and Repository due to July 2023 CPU ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030605 ∗∗∗ Due to use of NodeJS, IBM Cloud Pak for Multicloud Management Monitoring is vulnerable to multiple security vulnerabilities. ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030612 ∗∗∗ A security vulnerability has been identified in IBM SDK, Java Technology Edition shipped with IBM Tivoli Business Service Manager (CVE-2022-40609) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030613 ∗∗∗ Vulnerabilities in IBM Java SDK and IBM Java Runtime affect Rational Performance Tester ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030614 ∗∗∗ Vulnerabilities in IBM Java SDK and IBM Java Runtime affect Rational Service Tester ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030615 ∗∗∗ Vulnerability found in commons-io-1.3.1.jar which is shipped with IBM Intelligent Operations Center(CVE-2021-29425) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030617 ∗∗∗ Vulnerabilities found in poi-ooxml-3.9.jar which is shipped with IBM Intelligent Operations Center(CVE-2017-5644, CVE-2019-12415, CVE-2014-3574, CVE-2014-3529) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030627 ∗∗∗ Vulnerability found in pdfbox-1.8.1.jar which is shipped with IBM Intelligent Operations Center(220742, CVE-2018-11797, CVE-2016-2175) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030626 ∗∗∗ Vulnerabilities found in poi-3.9.jar, poi-scratchpad-3.9.jar which is shipped with IBM Intelligent Operations Center(CVE-2017-12626, CVE-2014-9527) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030629 ∗∗∗ Vulnerabilities found in jackson-mapper-asl-1.9.13.jar which is shipped with IBM Intelligent Operations Center(CVE-2019-10202, CVE-2019-10172) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030623 ∗∗∗ Multiple Vulnerabilities found in Turf.js which is shipped with IBM Intelligent Operations Center(CVE-2020-15168, CVE-2022-0235) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030624 ∗∗∗ Vulnerability found in fontbox-1.8.1.jarr which is shipped with IBM Intelligent Operations Center(CVE-2018-8036) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030622 ∗∗∗ Vulnerabilities found in cxf-rt-transports-http-3.0.3.jar which is shipped with IBM Intelligent Operations Center(CVE-2016-6812, CVE-2018-8039, CVE-2020-13954) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030618 ∗∗∗ Vulnerability found in fop-1.1.jar which is shipped with IBM Intelligent Operations Center(CVE-2017-5661) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030621 ∗∗∗ Multiple Vulnerabilities found in Turf.js which is shipped with IBM Intelligent Operations Center(CVE-2021-44906, CVE-2020-7598) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030625 ∗∗∗ Vulnerability found in dom4j-1.6.1.jar which is shipped with IBM Intelligent Operations Center(CVE-2018-1000632) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030619 ∗∗∗ Vulnerability found in commons-codec-1.5.jar which is shipped with IBM Intelligent Operations Center(177835) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030616 ∗∗∗ IBM MQ is affected by a denial of service vulnerability in OpenSSL (CVE-2023-2650) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7027922 ∗∗∗ Multiple vulnerabilities found in IBM Java which is shipped with IBM Intelligent Operations Center(CVE-2022-21628, CVE-2022-21626, CVE-2022-21624, CVE-2022-21619) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030632 ∗∗∗ A Vulnerability found in IBM Java which is shipped with IBM Intelligent Operations Center(CVE-2022-3676) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030634 ∗∗∗ Vulnerability found in dom4j-1.6.1.jar which is shipped with IBM Intelligent Operations Center(CVE-2020-10683) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030636 ∗∗∗ Vulnerability found in xmlgraphics-commons-1.5.jar which is shipped with IBM Intelligent Operations Center(CVE-2020-11988) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030630 ∗∗∗ Multiple Vulnerabilities found in IBM DB2 which is shipped with IBM Intelligent Operations Center(CVE-2022-43929, CVE-2022-43927, CVE-2014-3577, CVE-2022-43930) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030638 ∗∗∗ Vulnerabilities found in batik-bridge-1.7.jar which is shipped with IBM Intelligent Operations Center(CVE-2022-40146, CVE-2022-38648, CVE-2022-38398) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030631 ∗∗∗ Vulnerability found in cxf-core-3.5.4.jar which is shipped with IBM Intelligent Operations Center(CVE-2022-46364) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030633 ∗∗∗ Vulnerability found in cxf-rt-transports-http-3.5.3.jar which is shipped with IBM Intelligent Operations Center(CVE-2022-46363) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030635 ∗∗∗ Vulnerability found in commons-net-1.4.1.jar which is shipped with IBM Intelligent Operations Center(CVE-2021-37533) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030637 ∗∗∗ A vulnerability found in IBM Java which is shipped with IBM Intelligent Operations Center(CVE-2022-21426) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030641 ∗∗∗ Vulnerabilities found in jackson-mapper-asl which is shipped with IBM Intelligent Operations Center(CVE-2019-10172, CVE-2019-10202) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030639 ∗∗∗ Multiple vulnerabilities found in IBM Java which is shipped with IBM Intelligent Operations Center(CVE-2023-21830, CVE-2023-21843) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030640 ∗∗∗ A vulnerability found in IBM WebSphere Application Server Liberty which is shipped with IBM Intelligent Operations Center(CVE-2023-24998) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030642 ∗∗∗ A vulnerability found in IBM Java which is shipped with IBM Intelligent Operations Center(CVE-2023-30441) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030643 ∗∗∗ A vulnerability found in IBM Java which is shipped with IBM Intelligent Operations Center(CVE-2022-40609) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030644 ∗∗∗ Multiple Angular vulnerabilities affects IBM Tivoli Business Service Manager (CVE-2023-26116, CVE-2023-26117, CVE-2023-26118, CVE-2022-25869, CVE-2022-25844) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030667 ∗∗∗ IBM SDK, Java Technology Edition, Security Update August 2023 ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030664 ∗∗∗ Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli Business Service Manager (CVE-2023-22045, CVE-2023-22049) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030666 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 04.09.2023
by Daily end-of-shift report 04 Sep '23

04 Sep '23

===================== = End-of-Day report = ===================== Timeframe: Freitag 01-09-2023 18:00 − Montag 04-09-2023 18:00 Handler: Robert Waldner Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Chrome extensions can steal plaintext passwords from websites ∗∗∗ --------------------------------------------- A team of researchers from the University of Wisconsin-Madison has uploaded to the Chrome Web Store a proof-of-concept extension that can steal plaintext passwords from a websites source code. --------------------------------------------- https://www.bleepingcomputer.com/news/security/chrome-extensions-can-steal-… ∗∗∗ New ‘YouPorn’ sextortion scam threatens to leak your sex tape ∗∗∗ --------------------------------------------- A new sextortion scam is making the rounds that pretends to be an email from the adult site YouPorn, warning that a sexually explicit video of you was uploaded to the site and suggesting you pay to have it taken down. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-youporn-sextortion-scam-… ∗∗∗ Yes, theres an npm package called @(-.-)/env and some others like it ∗∗∗ --------------------------------------------- Strangely named npm packages like -, @!-!/-, @(-.-)/env, and --hepl continue to exist on the internets largest software registry. While not all of these may necessarily pose an obvious security risk, some were named before npm enforced naming guidelines and could potentially break tooling. --------------------------------------------- https://www.bleepingcomputer.com/news/technology/yes-theres-an-npm-package-… ∗∗∗ PoC Exploit Released for Critical VMware Arias SSH Auth Bypass Vulnerability ∗∗∗ --------------------------------------------- Proof-of-concept (PoC) exploit code has been made available for a recently disclosed and patched critical flaw impacting VMware Aria Operations for Networks (formerly vRealize Network Insight). The flaw, tracked as CVE-2023-34039, is rated 9.8 out of a maximum of 10 for severity and has been described as a case of authentication bypass due to a lack of unique cryptographic key generation. --------------------------------------------- https://thehackernews.com/2023/09/poc-exploit-released-for-critical.html ∗∗∗ Webinar: Betrugsfallen im Internet erkennen ∗∗∗ --------------------------------------------- Wie schütze ich mich vor Internetkriminalität? Wie kann ich einen Fake Shop von einem seriösen Online-Shop unterscheiden? Wo lauern die dreistesten Abo-Fallen? Wie verschaffen sich Kriminelle Zugang zu meinen Daten? Das Webinar informiert über gängige Betrugsfallen im Internet und hilft, diese zu erkennen. Nehmen Sie kostenlos teil: Dienstag 12. September 2023, 18:30 - 20:00 Uhr via zoom --------------------------------------------- https://www.watchlist-internet.at/news/webinar-betrugsfallen-im-internet-er… ∗∗∗ Neue Phishing-Mails im Namen der ÖGK und des Finanzamtes unterwegs ∗∗∗ --------------------------------------------- Aktuell sind zwei neue Phishing-Mails im Umlauf. In der einen geben sich Kriminelle als Österreichische Gesundheitskasse (ÖGK) aus und behaupten, dass Sie eine Erstattung erhalten. Im anderen Mail wird Ihnen im Namen von FinanzOnline eine Erhöhung der Rente versprochen. Beide Mails fordern Sie auf, auf einen Link zu klicken. Ignorieren Sie diese Mails. Kriminelle stehlen damit Ihre Bankdaten. --------------------------------------------- https://www.watchlist-internet.at/news/neue-phishing-mails-im-namen-der-oeg… ∗∗∗ Decryptor für Key Group Ransomware verfügbar ∗∗∗ --------------------------------------------- Sicherheitsforscher von ElectricIQ haben in den Routinen der Key Group Ransomware eine Schwachstelle entdeckt, die es ermöglichte, Entschlüsselungs-Tools zur Wiederherstellung verschlüsselter Dateien zu entwickeln. --------------------------------------------- https://www.borncity.com/blog/2023/09/03/decryptor-fr-key-group-ransomware-… ∗∗∗ Firmware-Updates: Surface Laptop 4 und Surface Duo ∗∗∗ --------------------------------------------- Microsoft hat zum 31. August 2023 ein Firmware-Update für seinen Surface Laptop 4 veröffentlicht, welches Sicherheitsprobleme und ein Lade-Problem beheben soll. Zudem gibt es wohl das (vermutlich) letzte Firmware-Update für das Smartphone Surface Duo. --------------------------------------------- https://www.borncity.com/blog/2023/09/03/firmware-updates-surface-laptop-4-… ===================== = Vulnerabilities = ===================== ∗∗∗ Tinycontrol LAN Controller v3 (LK3) Remote Admin Password Change ∗∗∗ --------------------------------------------- The application suffers from an insecure access control allowing an unauthenticated attacker to change accounts passwords and bypass authentication gaining panel control access. --------------------------------------------- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5787.php ∗∗∗ Tinycontrol LAN Controller v3 (LK3) Remote Credentials Extraction PoC ∗∗∗ --------------------------------------------- An unauthenticated attacker can retrieve the controllers configuration backup file and extract sensitive information that can allow him/her/them to bypass security controls and penetrate the system in its entirety. --------------------------------------------- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5786.php ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (thunderbird), Fedora (firefox, kernel, kubernetes, and mediawiki), Mageia (openldap), SUSE (terraform), and Ubuntu (atftp, busybox, and thunderbird). --------------------------------------------- https://lwn.net/Articles/943492/ ∗∗∗ Mattermost security updates 8.1.1 (ESR) / 8.0.2 / 7.8.10 (ESR) released ∗∗∗ --------------------------------------------- We’re informing you about a Mattermost security update, which addresses low- to medium-level severity vulnerabilities. We highly recommend that you apply the update. The security update is available for Mattermost dot releases 8.1.1 (Extended Support Release), 8.0.2, and 7.8.10 (Extended Support Release), for both Team Edition and Enterprise Edition. --------------------------------------------- https://mattermost.com/blog/mattermost-security-updates-8-1-1-esr-8-0-2-7-8… ∗∗∗ Sicherheitslücken (CVE-2023-40481, CVE-2023-31102) in 7-ZIP; Fix in Version 23.00 (August 2023) ∗∗∗ --------------------------------------------- Kurzer Nachtrag vom Ende August 2023. Im Programm 7-Zip, welches zum Packen und Entpacken von ZIP-Archivdateien eingesetzt wird, haben Sicherheitsforscher gleich zwei Schwachstellen gefunden. Die Schwachstellen CVE-2023-40481 und CVE-2023-31102 werden vom Sicherheitsaspekt als hoch riskant eingestuft [..] Beide Schwachstellen wurden am 21. November 2022 an die 7-ZIP-Entwickler gemeldet und laut der Zero-Day-Initiative vom 23. August 2023 mit einem Update der Software auf die Version 23.00 (damals noch Beta) geschlossen. --------------------------------------------- https://www.borncity.com/blog/2023/09/03/sicherheitslcken-cve-2023-40481-cv… ∗∗∗ IBM MQ Explorer is affected by vulnerabilities in Eclipse Jetty (CVE-2023-26048, CVE-2023-26049) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7027923 ∗∗∗ IBM MQ is affected by a denial of service vulnerability in OpenSSL (CVE-2023-2650) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7027922 ∗∗∗ Google Guava component is vulnerable to CVE-2023-2976 is used by IBM Maximo Application Suite ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030429 ∗∗∗ IBM Security Verify Information Queue has multiple information exposure vulnerabilities (CVE-2023-33833, CVE-2023-33834, CVE-2023-33835) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7029584 ∗∗∗ IBM Sterling Connect:Direct Browser User Interface vulnerable to remote code execution due to IBM Java (CVE-2022-40609) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030442 ∗∗∗ IBM Sterling Connect:Direct Web Services is vulnerable to remote code execution due to IBM Java (CVE-2022-40609) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030443 ∗∗∗ The IBM Engineering Lifecycle Engineering product using IBM WebSphere Application Server traditional is vulnerable to spoofing when using Web Server Plug-ins (CVE-2022-39161) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030450 ∗∗∗ The IBM Engineering Lifecycle Engineering product using WebSphere Application Server Liberty is vulnerable to denial of service (CVE-2023-38737) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030449 ∗∗∗ The IBM Engineering Lifecycle Engineering product using IBM\u00ae SDK, Java\u2122 Technology Edition is affected by multiple vulnerabilities (CVE-2023-22045, CVE-2023-22049) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030448 ∗∗∗ IBM Event Endpoint Management is vulnerable to a denial of service in Netty (CVE-2023-34462) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030456 ∗∗∗ A vulnerability has been identified in IBM WebSphere Application Server Liberty profile shipped with IBM Business Automation Workflow CVE-2023-38737) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030458 ∗∗∗ A vulnerability found in IBM WebSphere Application Server Liberty which is shipped with IBM\u00ae Intelligent Operations Center(CVE-2022-34165) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030460 ∗∗∗ IBM Cloud Pak for Network Automation 2.6 addresses multiple security vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030469 ∗∗∗ Multiple CVEs may affect Operating System packages shipped with IBM CICS TX Advanced 10.1 ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030462 ∗∗∗ Multiple CVEs may affect Operating System packages shipped with IBM CICS TX Advanced 10.1 ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030461 ∗∗∗ IBM Cloud Pak for Network Automation 2.6.1 fixes multiple security vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030470 ∗∗∗ Multiple vulnerabilities may affect IBM SDK, Java\u2122 Technology Edition for Content Collector for Email, Content Collector for File Systems and Content Collector for Microsoft SharePoint ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030463 ∗∗∗ CVE-2022-40609 may affect Java Technology Edition used by Content Collector for Email, Content Collector for File Systems and Content Collector for Microsoft SharePoint ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030466 ∗∗∗ CVE-2023-34149 may affect Apache Struts used by Content Collector for Email, Content Collector for File Systems and Content Collector for Microsoft SharePoint ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030464 ∗∗∗ CVE-2023-34396 may affect Apache Struts used by Content Collector for Email, Content Collector for File Systems and Content Collector for Microsoft SharePoint. ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030465 ∗∗∗ IBM Java SDK update forJava deserialization filters (JEP 290) ignored during IBM ORB deserialization ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030522 ∗∗∗ The Transformation Advisor Tool in IBM App Connect Enterprise is vulnerable to a denial of service due to Apache Johnzon (CVE-2023-33008) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030531 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 01.09.2023
by Daily end-of-shift report 01 Sep '23

01 Sep '23

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 31-08-2023 18:00 − Freitag 01-09-2023 18:00 Handler: Michael Schlagenhaufer Co-Handler: Robert Waldner ===================== = News = ===================== ∗∗∗ Monitoring aus der Cloud: Kundensysteme dank schwacher Standardpasswörter gehackt ∗∗∗ --------------------------------------------- Hacker haben offenbar aufgrund schwacher Standardpasswörter eine Ransomware auf lokalen Systemen von Logicmonitor-Kunden verbreitet. --------------------------------------------- https://www.golem.de/news/monitoring-aus-der-cloud-kundensysteme-dank-schwa… ∗∗∗ WordPress Vulnerability & Patch Roundup August 2023 ∗∗∗ --------------------------------------------- To help educate website owners on emerging threats to their environments, we’ve compiled a list of important security updates and vulnerability patches for the WordPress ecosystem this past month. --------------------------------------------- https://blog.sucuri.net/2023/08/wordpress-vulnerability-patch-roundup-augus… ∗∗∗ Potential Weaponizing of Honeypot Logs ∗∗∗ --------------------------------------------- Escape sequences have long been used to create ASCII art on screens and allow for customization of a user’s terminal. Because most terminals support some kind of escape sequences, it could be possible to manipulate the analyst’s terminal, and hypothetically allow for remote code execution on the analysist’s system. --------------------------------------------- https://isc.sans.edu/diary/rss/30178 ∗∗∗ MONDEO: Multistage Botnet Detection ∗∗∗ --------------------------------------------- MONDEO is a multistage mechanism with a flexible design to detect DNS-based botnet malware. MONDEO is lightweight and can be deployed without requiring the deployment of software, agents, or configuration in mobile devices, allowing easy integration in core networks. MONDEO comprises four detection stages: Blacklisting/Whitelisting, Query rate analysis, DGA analysis, and Machine learning evaluation. [..] The implementation is available at github. --------------------------------------------- https://arxiv.org/abs/2308.16570 ∗∗∗ Mashing Enter to bypass full disk encryption with TPM, Clevis, dracut and systemd ∗∗∗ --------------------------------------------- Using the vulnerability described in this advisory an attacker may take control of an encrypted Linux computer during the early boot process, manually unlock TPM-based disk encryption and either modify or read sensitive information stored on the computer’s disk. This blog post runs through how this vulnerability was identified and exploited - no tiny soldering required. --------------------------------------------- https://pulsesecurity.co.nz/advisories/tpm-luks-bypass ∗∗∗ BitLocker, TPM and Pluton | What Are They and How Do They Work ∗∗∗ --------------------------------------------- The optimal kind of security measure is imperceptible to the user during deployment and usage. Whenever there is a potential delay or difficulty due to a security feature, there is a high probability that users will attempt to circumvent security. This situation is particularly prevalent for data protection, and that is a scenario that organizations need to prevent. --------------------------------------------- https://github.com/HotCakeX/Harden-Windows-Security/wiki/BitLocker,-TPM-and… ∗∗∗ NetNTLMv1 Downgrade to compromise ∗∗∗ --------------------------------------------- In this blogpost I’m going to blow your mind with some easy to understand NetNTLMv1 downgrade and relaying stuff. I will keep this blogpost simple, so that everyone can follow these steps, but I will link further resources for those who want to get the bigger picture at the end of this post. --------------------------------------------- https://www.r-tec.net/r-tec-blog-netntlmv1-downgrade-to-compromise.html ∗∗∗ Free Decryptor Available for ‘Key Group’ Ransomware ∗∗∗ --------------------------------------------- EclecticIQ has released a free decryption tool to help victims of the Key Group ransomware recover their data without paying a ransom. --------------------------------------------- https://www.securityweek.com/free-decryptor-available-for-key-group-ransomw… ∗∗∗ How companies can get a grip on ‘business email compromise’ ∗∗∗ --------------------------------------------- The delivery methods vary but the most exploited vector is email as a vehicle for a credential harvesting phishing campaign. Phishing, in general, has grown in scale and sophistication in recent years, with the most damaging form of phishing from a financial perspective being “business email compromise” (BEC). According to Check Point Research, credential harvesting makes up about 15% of all email-based attacks but is the most financially damaging category. --------------------------------------------- https://blog.checkpoint.com/security/how-companies-can-get-a-grip-on-busine… ===================== = Vulnerabilities = ===================== ∗∗∗ Multiple vulnerabilities in i-PRO VI Web Client ∗∗∗ --------------------------------------------- VI Web Client provided by i-PRO Co., Ltd. contains multiple vulnerabilities. Update the software to the latest version according to the information provided by the developer. These vulnerabilities have been addressed in VI Web Client 7.9.6. --------------------------------------------- https://jvn.jp/en/jp/JVN60140221/ ∗∗∗ Tinycontrol LAN Controller v3 (LK3) Remote Denial Of Service ∗∗∗ --------------------------------------------- The controller suffers from an unauthenticated remote denial of service vulnerability. An attacker can issue direct requests to the stm.cgi page to reboot and also reset factory settings on the device. --------------------------------------------- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5785.php ∗∗∗ Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software ∗∗∗ --------------------------------------------- Autodesk AutoCAD and certain AutoCAD-based products have been affected by Out-of-Bounds Write, Heap-based Buffer Overflow, Untrusted Pointer Dereference, and Memory Corruption vulnerabilities. CVE IDs: CVE-2023-29073, CVE-2023-29074, CVE-2023-29075, CVE-2023-29076, CVE-2023-41139, CVE-2023-41140 --------------------------------------------- https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0018 ∗∗∗ Acronis: Updates dichten Sicherheitslecks in mehreren Produkten ab ∗∗∗ --------------------------------------------- Acronis hat Sicherheitsmeldungen zu insgesamt zwölf Schwachstellen in mehreren Produkten herausgegeben. Updates stehen länger bereit. --------------------------------------------- https://heise.de/-9291446 ∗∗∗ Kritische Lücke in VPN von Securepoint ∗∗∗ --------------------------------------------- Updates sollen eine kritische Sicherheitslücke in der VPN-Software von Securepoint schließen, durch die Angreifer ihre Rechte ausweiten können. --------------------------------------------- https://heise.de/-9291723 ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (chromium, firefox-esr, and gst-plugins-ugly1.0), Fedora (firefox, libeconf, libwebsockets, mosquitto, and rust-rustls-webpki), SUSE (amazon-ssm-agent, open-vm-tools, and terraform-provider-helm), and Ubuntu (linux-azure, linux-azure, linux-azure-5.15, linux-azure-fde, linux-gcp-5.15, linux-gcp-5.4, linux-oracle-5.4, linux-gkeop, linux-gkeop-5.15, linux-intel-iotg, linux-kvm, linux-oracle, and python-git). --------------------------------------------- https://lwn.net/Articles/943302/ ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 31.08.2023
by Daily end-of-shift report 31 Aug '23

31 Aug '23

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 30-08-2023 18:00 − Donnerstag 31-08-2023 18:00 Handler: Michael Schlagenhaufer Co-Handler: Robert Waldner ===================== = News = ===================== ∗∗∗ MMRat Android Trojan Executes Remote Financial Fraud Through Accessibility Feature ∗∗∗ --------------------------------------------- A previously undocumented Android banking trojan dubbed MMRat has been observed targeting mobile users in Southeast Asia since late June 2023 to remotely commandeer the devices and perform financial fraud."The malware, named after its distinctive package name com.mm.user, can capture user input and screen content, and can also remotely control victim devices through various techniques [..] --------------------------------------------- https://thehackernews.com/2023/08/mmrat-android-trojan-executes-remote.html ∗∗∗ North Korean Hackers Deploy New Malicious Python Packages in PyPI Repository ∗∗∗ --------------------------------------------- Three additional malicious Python packages have been discovered in the Package Index (PyPI) repository as part of an ongoing malicious software supply chain campaign called VMConnect, with signs pointing to the involvement of North Korean state-sponsored threat actors.The findings come from ReversingLabs, which detected the packages tablediter, request-plus, and requestspro. --------------------------------------------- https://thehackernews.com/2023/08/north-korean-hackers-deploy-new.html ∗∗∗ CISA and FBI Publish Joint Advisory on QakBot Infrastructure ∗∗∗ --------------------------------------------- CISA and FBI urge organizations to implement the recommendations contained within the joint CSA to reduce the likelihood of QakBot-related activity and promote identification of QakBot-facilitated ransomware and malware infections. --------------------------------------------- https://www.cisa.gov/news-events/alerts/2023/08/30/cisa-and-fbi-publish-joi… ∗∗∗ Converting Tokens to Session Cookies for Outlook Web Application ∗∗∗ --------------------------------------------- More and more organizations are adopting cloud-based solutions and federating with various identity providers. As these deployments increase in complexity, ensuring that Conditional Access Policies (CAPs) always act as expected can become a challenge. Today, we will share a technique weve been using to gain access to Outlook Web Application (OWA) in a browser by utilizing Bearer and Refresh tokens for the outlook.office365.com or outlook.office.com endpoints. --------------------------------------------- https://labs.lares.com/owa-cap-bypass/ ∗∗∗ Contain Yourself: Staying Undetected Using the Windows Container Isolation Framework ∗∗∗ --------------------------------------------- Starting with Windows Server 2016, Microsoft released its own version of this solution, Windows Containers, which offers process and Hyper-V isolation modes. The presentation covered the basics of Windows containers, broke down its file system isolation framework, reverse-engineered its main mini-filter driver, and detailed how it can be utilized and manipulated by a bad actor to bypass EDR products in multiple domains. --------------------------------------------- https://www.deepinstinct.com/blog/contain-yourself-staying-undetected-using… ∗∗∗ NosyMonkey: API hooking and code injection made easy ∗∗∗ --------------------------------------------- As a researcher I often run into situations in which I need to make a compiled binary do things that it wouldn’t normally do or change the way it works in some way. [..] Enter, NosyMonkey: a library to inject code and place hooks that does almost everything for you. No need to write complicated ASM shellcode, or even think about allocating code, hot patching and other dirty business. --------------------------------------------- https://www.anvilsecure.com/blog/nosymonkey.html ∗∗∗ Bypassing Defender’s LSASS dump detection and PPL protection In Go ∗∗∗ --------------------------------------------- This blog reviews the technique that can be used to bypass Protected Process Light protection for any Windows process using theProcess Explorer driver and explores methods to bypass Windows Defender’s signature-based mechanisms for process dump detection. The tool introduced in this blog (PPLBlade), is written entirely in GO and can be used as a POC for the techniques overviewed below. --------------------------------------------- https://tastypepperoni.medium.com/bypassing-defenders-lsass-dump-detection-… ∗∗∗ Unpinnable Actions: How Malicious Code Can Sneak into Your GitHub Actions Workflows ∗∗∗ --------------------------------------------- In today’s post, we look at action pinning, one of the profound mitigations against supply chain attacks in the GitHub Actions ecosystem. It turns out, though, that action pinning comes with a downside — a pitfall we call "unpinnable actions" that allows attackers to execute code in GitHub Actions workflows. --------------------------------------------- https://www.paloaltonetworks.com/blog/prisma-cloud/unpinnable-actions-githu… ∗∗∗ Trojanized Signal, Telegram apps found on Google Play, Samsung Galaxy Store ∗∗∗ --------------------------------------------- ESET researchers have identified two active campaigns targeting Android users, where the threat actors behind the tools for Telegram and Signal are attributed to the China-aligned APT group GREF. Most likely active since July 2020 and since July 2022, respectively for each malicious app, the campaigns have distributed the Android BadBazaar espionage code through the Google Play store, Samsung Galaxy Store, and dedicated websites posing as legitimate encrypted chat applications [..] --------------------------------------------- https://www.helpnetsecurity.com/2023/08/31/fake-signal-telegram-apps/ ∗∗∗ Infamous Chisel Malware Analysis Report ∗∗∗ --------------------------------------------- Infamous Chisel is a collection of components targeting Android devices.This malware is associated with Sandworm activity.It performs periodic scanning of files and network information for exfiltration.System and application configuration files are exfiltrated from an infected device. --------------------------------------------- https://www.cisa.gov/news-events/analysis-reports/ar23-243a ∗∗∗ A Deep Dive into Brute Ratel C4 payloads ∗∗∗ --------------------------------------------- Summary Brute Ratel C4 is a Red Team & Adversary Simulation software that can be considered an alternative to Cobalt Strike. In this blog post, we’re presenting a technical analysis of a Brute Ratel badger/agent that doesn’t implement all the recent features of the framework. --------------------------------------------- https://cybergeeks.tech/a-deep-dive-into-brute-ratel-c4-payloads/ ===================== = Vulnerabilities = ===================== ∗∗∗ WordPress migration add-on flaw could lead to data breaches ∗∗∗ --------------------------------------------- All-in-One WP Migration, a popular data migration plugin for WordPress sites that has 5 million active installations, suffers from unauthenticated access token manipulation that could allow attackers to access sensitive site information. --------------------------------------------- https://www.bleepingcomputer.com/news/security/wordpress-migration-add-on-f… ∗∗∗ Wordpress: Cloud-Extensions für Migrationstool ermöglichen Datenklau ∗∗∗ --------------------------------------------- Die Box-, Google-Drive-, Onedrive- und Dropbox-Erweiterungen für ein weitverbreitetes Wordpress-Migrations-Plug-in sind anfällig für Datenklau. --------------------------------------------- https://www.golem.de/news/wordpress-cloud-extensions-fuer-migrationstool-er… ∗∗∗ Drupal: Unified Twig Extensions - Moderately critical - Cross Site Scripting - SA-CONTRIB-2023-041 ∗∗∗ --------------------------------------------- This module makes PatternLab's custom Twig functions available to Drupal theming. The module's included examples don't sufficiently filter data. This vulnerability is mitigated by the fact that the included examples must have been copied to a site's theme. --------------------------------------------- https://www.drupal.org/sa-contrib-2023-041 ∗∗∗ Drupal: Obfuscate Email - Less critical - Cross Site Scripting - SA-CONTRIB-2023-042 ∗∗∗ --------------------------------------------- This module enables you to hide email addresses from bots and site scrapers by using the rot13 strategy. The module doesnt sufficiently escape the data attribute under the scenario a user has access to manipulate that value. This vulnerability is mitigated by the fact that an attacker must have a role with permissions to allow data attributes in content on a site. --------------------------------------------- https://www.drupal.org/sa-contrib-2023-042 ∗∗∗ CISA Releases Four Industrial Control Systems Advisories ∗∗∗ --------------------------------------------- * ICSA-23-243-01 ARDEREG Sistemas SCADA, CVE-2023-4485 * ICSA-23-243-02 GE Digital CIMPLICITY, CVE-2023-4487 * ICSA-23-243-03 PTC Kepware KepServerEX, CVE-2023-29444, CVE-2023-29445, CVE-2023-29446, CVE-2023-29447 * ICSA-23-243-04 Digi RealPort Protocol, CVE-2023-4299 --------------------------------------------- https://www.cisa.gov/news-events/alerts/2023/08/31/cisa-releases-four-indus… ∗∗∗ Sicherheitsupdates: Schadcode-Attacken auf Aruba-Switches möglich ∗∗∗ --------------------------------------------- Verschiedene Switch-Modelle von Aruba sind verwundbar. Abgesicherte Ausgaben von ArubaOS schaffen Abhilfe. --------------------------------------------- https://heise.de/-9290375 ∗∗∗ Big Data: Splunk dichtet hochriskante Lücken ab ∗∗∗ --------------------------------------------- Die Big-Data-Experten von Splunk haben aktualisierte Software bereitgestellt, die teils hochriskante Schwachstellen in der Analysesoftware ausbessert. --------------------------------------------- https://heise.de/-9290325 ∗∗∗ VMware Tools: Schwachstelle ermöglicht Angreifern unbefugte Aktionen in Gästen ∗∗∗ --------------------------------------------- VMware warnt vor einer Sicherheitslücke in VMware Tools. Sie ermöglicht eine Man-in-the-Middle-Attacke auf Gastsysteme. --------------------------------------------- https://heise.de/-9290783 ∗∗∗ Wordfence Intelligence Weekly WordPress Vulnerability Report (August 21, 2023 to August 27, 2023) ∗∗∗ --------------------------------------------- Last week, there were 43 vulnerabilities disclosed in 38 WordPress Plugins and no WordPress themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 23 Vulnerability Researchers that contributed to WordPress Security last week. --------------------------------------------- https://www.wordfence.com/blog/2023/08/wordfence-intelligence-weekly-wordpr… ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (firefox-esr, json-c, opendmarc, and otrs2), Red Hat (java-1.8.0-ibm and kpatch-patch), Scientific Linux (kernel), Slackware (mozilla), SUSE (haproxy, php7, vim, and xen), and Ubuntu (elfutils, frr, and linux-gcp, linux-starfive). --------------------------------------------- https://lwn.net/Articles/943192/ ∗∗∗ Mozilla Releases Security Updates for Firefox and Firefox ESR ∗∗∗ --------------------------------------------- Mozilla has released security updates to address vulnerabilities for Firefox 117, Firefox ESR 115.2, and Firefox ESR 102.15. A cyber threat actor can exploit some of these vulnerabilities to take control of an affected system. --------------------------------------------- https://www.cisa.gov/news-events/alerts/2023/08/30/mozilla-releases-securit… ∗∗∗ Weitere Windows-Rechteausweitung über Razer Synapse (SYSS-2023-002) ∗∗∗ --------------------------------------------- In Razer Synapse kann über eine Time-of-check Time-of-use Race Condition die Überprüfung fremder Bibliotheken durch den Dienst überlistet werden. --------------------------------------------- https://www.syss.de/pentest-blog/weitere-windows-rechteausweitung-ueber-raz… ∗∗∗ Cisco Unified Communications Products Privilege Escalation Vulnerability ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Multiple vulnerabilities in IBM Storage Defender Data Protect ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7029861 ∗∗∗ Security Vulnerability in the IBM Java Runtime Environment (JRE) affect the 3592 Enterprise Tape Controller ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/691223 ∗∗∗ Vulnerability in SSLv3 affects IBM System Storage Tape Controller 3592 Model C07 (CVE-2014-3566) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/690117 ∗∗∗ IBM Java Runtime (JRE) security vulnerabilities CVE-2022-21426 in FileNet Content Manager ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6983442 ∗∗∗ Security vulnerability in IBM Java Object Request Broker (ORB) in FileNet Content Manager ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7027874 ∗∗∗ IBM Java Runtime (JRE) security vulnerabilities CVE-2023-21830, CVE-2023-21843 in FileNet Content Manager ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6983440 ∗∗∗ Multiple Security vulnerabilities in IBM Java in FileNet Content Manager ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7001699 ∗∗∗ IBM QRadar User Behavior Analytics is vulnerable to components with known vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7029864 ∗∗∗ TADDM affected by vulnerability due to IBM Java and its runtime ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7029984 ∗∗∗ Due to use of Mozilla Firefox, IBM Cloud Pak for Multicloud Management Monitoring is vulnerable to multiple vulnerabilities. ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7029986 ∗∗∗ Multiple Vulnerabilities in IBM Java SDK affect IBM WebSphere Application Server and IBM WebSphere Application Server Liberty, which are used in IBM Security Guardium Key Lifecycle Manager ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7006475 ∗∗∗ A vulnerability in Microsoft ASP.NET affects IBM Robotic Process Automation and may result in a denial of service (CVE-2022-29117) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7029527 ∗∗∗ A vulnerability in Microsoft Azure SDK for .NET affects IBM Robotic Process Automation and could allow a remote authenticated attacker to obtain sensitive information (CVE-2022-26907). ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7029524 ∗∗∗ Multiple security vulnerabilities affect IBM Robotic Process Automation ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7026754 ∗∗∗ A vulnerability in MicrosoftAspNetCore.Identity affects IBM Robotic Process Automation and may result in allowing an attacker to bypass secrity restrictions (CVE-2023-33170). ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7029540 ∗∗∗ Multiple security vulnerabilities in Java affect IBM Robotic Process Automation ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7026758 ∗∗∗ IBM Security Guardium is affected by an Hazardous Input Validation vulnerability (CVE-2022-43903) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030110 ∗∗∗ IBM MQ is affected by OpenSSL vulnerability (CVE-2023-2650) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030100 ∗∗∗ IBM MQ is affected by a sensitive information disclosure vulnerability (CVE-2023-28514) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030101 ∗∗∗ IBM MQ is affected by a denial of service vulnerability (CVE-2023-28513) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030102 ∗∗∗ IBM MQ is vulnerable to a denial of service attack (CVE-2023-26285) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030103 ∗∗∗ IBM Edge Application Manager 4.5.2 addresses the security vulnerabilities listed in the CVEs below. ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030159 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 30.08.2023
by Daily end-of-shift report 30 Aug '23

30 Aug '23

===================== = End-of-Day report = ===================== Timeframe: Dienstag 29-08-2023 18:00 − Mittwoch 30-08-2023 18:00 Handler: Michael Schlagenhaufer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Border Gateway Protocol: Der Klebstoff des Internets hat eine Schwachstelle ∗∗∗ --------------------------------------------- Durch eine neu entdeckte Schwachstelle im Border Gateway Protocol können Angreifer potenziell Teile des Internets abschotten. --------------------------------------------- https://www.golem.de/news/border-gateway-protocol-der-klebstoff-des-interne… ∗∗∗ Kritische Sicherheitslücke in VMware Aria Operations for Networks ∗∗∗ --------------------------------------------- VMware schließt Sicherheitslücken in Aria Operations for Networks. Eine gilt als kritisch und erlaubt den Zugriff ohne Anmeldung. --------------------------------------------- https://heise.de/-9288934 ∗∗∗ Botnet: Internationale Strafverfolger deinstallieren 700.000 Qakbot-Drohnen ∗∗∗ --------------------------------------------- Zusammen mit internationalen Strafverfolgern hat das FBI das Qakbot-Botnetz vorerst außer Gefecht gesetzt. Von 700.000 Systemen entfernten sie die Malware. --------------------------------------------- https://heise.de/-9289070 ∗∗∗ Cisco warnt vor Ransomware-Angriffen auf VPNs ohne Mehrfaktorauthentifizierung ∗∗∗ --------------------------------------------- Cisco warnt vor Angriffen mit der Akira-Ransomware, die auf VPNs des Herstellers zielt. Bei nicht genutzter Mehrfaktorauthentifizierung gelingen Einbrüche. --------------------------------------------- https://heise.de/-9289242 ∗∗∗ Vorsicht vor Jobs auf zalandoovip.vip und remote-rpo-at.com! ∗∗∗ --------------------------------------------- Auf remote-rpo-at.com wird Ihnen ein lukratives Job-Angebot präsentiert. „Seien Sie Ihr Eigener Chef Und Verdienen Sie Bis zu €1260 Pro Woche!“, heißt es da auf der Startseite. Sie sollen im weiteren Verlauf auf der betrügerischen Website zalandoovip.vip für Zalando Produktbewertungen abgeben und so angeblich Verkäufe steigern. Sobald Sie Ihr verdientes Geld auszahlen lassen wollen, folgt die böse Überraschung: [...] --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-vor-jobs-auf-zalandoovipvip… ∗∗∗ Tausende Organisationen verwundbar auf Subdomain Hijacking ∗∗∗ --------------------------------------------- Subdomain-Hijacking stellt ein besorgniserregendes Szenario dar, bei dem Angreifer die Kontrolle über Websites übernehmen, die auf Subdomains seriöser Organisationen gehostet werden. Dies ermöglicht Angreifern zum Beispiel die Verbreitung von Schadsoftware und Desinformationen oder die Durchführung Phishing-Angriffen. --------------------------------------------- https://certitude.consulting/blog/de/subdomain-hijacking-2/ ∗∗∗ Trojanized Signal and Telegram apps on Google Play delivered spyware ∗∗∗ --------------------------------------------- Trojanized Signal and Telegram apps containing the BadBazaar spyware were uploaded onto Google Play and Samsung Galaxy Store by a Chinese APT hacking group known as GREF. --------------------------------------------- https://www.bleepingcomputer.com/news/security/trojanized-signal-and-telegr… ∗∗∗ Getting into AWS cloud security research as a n00bcake ∗∗∗ --------------------------------------------- Today, AWS security research can feel impenetrable, like understanding the latest meme that’s already gone through three ironic revivals. But if I’m being honest, I might suggest AWS security research is far more accessible than the other insane research in our industry. That’s why I attempt it. I’m just too dumb to write shellcode or disassemble a binary. So don’t be scared, let’s do it together! --------------------------------------------- https://dagrz.com/writing/aws-security/getting-into-aws-security-research/ ∗∗∗ CISA Releases IOCs Associated with Malicious Barracuda Activity ∗∗∗ --------------------------------------------- CISA has released additional indicators of compromise (IOCs) associated with exploitation of CVE-2023-2868. CVE-2023-2868 is a remote command injection vulnerability affecting Barracuda Email Security Gateway (ESG) Appliance, versions 5.1.3.001-9.2.0.006. --------------------------------------------- https://www.cisa.gov/news-events/alerts/2023/08/29/cisa-releases-iocs-assoc… ∗∗∗ Diving Deep into UNC4841 Operations Following Barracuda ESG Zero-Day Remediation (CVE-2023-2868) ∗∗∗ --------------------------------------------- On June 15, 2023, Mandiant released a blog post detailing an 8-month-long global espionage campaign conducted by a Chinese-nexus threat group tracked as UNC4841. In this follow-up blog post, we will detail additional tactics, techniques, and procedures (TTPs) employed by UNC4841 that have since been uncovered through Mandiant’s incident response engagements, as well as through collaborative efforts with Barracuda Networks and our International Government partners. Over the course of this --------------------------------------------- https://www.mandiant.com/resources/blog/unc4841-post-barracuda-zero-day-rem… ∗∗∗ Pay our ransom instead of a GDPR fine, cybercrime gang tells its targets ∗∗∗ --------------------------------------------- Researchers are tracking a new cybercrime group that uses a never-seen-before extortion tactic. The gang, which operates through a blog called Ransomed, tells victims that if they don’t pay to protect stolen files, they will face fines under data protection laws like the EU’s GDPR, according to a new report by cybersecurity firm Flashpoint. --------------------------------------------- https://therecord.media/ransomed-cybercrime-group-extortion-gdpr ===================== = Vulnerabilities = ===================== ∗∗∗ Netgear: Security Advisory for Post-authentication Command Injection on the Prosafe® Network Management System, PSV-2023-0037 ∗∗∗ --------------------------------------------- NETGEAR is aware of a post-authentication command injection security vulnerability on NMS300 and strongly recommends that you download the latest version of NMS300 as soon as possible. --------------------------------------------- https://kb.netgear.com/000065705/Security-Advisory-for-Post-authentication-… ∗∗∗ Netgear: Security Advisory for Authentication Bypass on the RBR760, PSV-2023-0052 ∗∗∗ --------------------------------------------- NETGEAR is aware of an authentication bypass security vulnerability on the RBR760. This vulnerability requires an attacker to have your WiFi password or an Ethernet connection to a device on your network to be exploited. --------------------------------------------- https://kb.netgear.com/000065734/Security-Advisory-for-Authentication-Bypas… ∗∗∗ Webbrowser: Google-Chrome-Update stopft hochriskante Sicherheitslücke ∗∗∗ --------------------------------------------- Google bessert im Webbrowser Chrome eine als hochriskant eingestufte Schwachstelle aus. --------------------------------------------- https://heise.de/-9288903 ∗∗∗ Entwickler von Notepad++ ignoriert offensichtlich Sicherheitslücken ∗∗∗ --------------------------------------------- Mehrere Sicherheitslücken gefährden den Texteditor Notepad++. Trotz Informationen zu den Lücken und möglichen Fixes steht ein Sicherheitsupdate noch aus. --------------------------------------------- https://heise.de/-9289124 ∗∗∗ VMSA-2023-0018 ∗∗∗ --------------------------------------------- Synopsis: VMware Aria Operations for Networks updates address multiple vulnerabilities. --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2023-0018.html ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (qpdf, ring, and tryton-server), Fedora (mingw-qt5-qtbase and moby-engine), Red Hat (cups, kernel, kernel-rt, kpatch-patch, librsvg2, and virt:rhel and virt-devel:rhel), and Ubuntu (amd64-microcode, firefox, linux, linux-aws, linux-aws-5.15, linux-gcp, linux-gke, linux-gkeop, linux-hwe-5.15, linux-ibm, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, linux-oracle, linux-oracle-5.15, linux, linux-aws, linux-aws-5.4, linux-gcp, linux-hwe-5.4, linux-kvm, linux-oracle, linux-xilinx-zynqmp, linux, linux-aws, linux-aws-6.2, linux-azure, linux-hwe-6.2, linux-ibm, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-6.2, linux-raspi, linux-bluefield, linux-ibm, linux-oem-6.1, and openjdk-lts, openjdk-17). --------------------------------------------- https://lwn.net/Articles/943087/ ∗∗∗ Remote Code Execution in RTS VLink Virtual Matrix ∗∗∗ --------------------------------------------- BOSCH-SA-893251-BT: A security vulnerability has been uncovered in the admin interface of the RTS VLink Virtual Matrix Software. The vulnerability will allow a Remote Code Execution (RCE) attack. --------------------------------------------- https://psirt.bosch.com/security-advisories/bosch-sa-893251-bt.html ∗∗∗ 2023-08-29 Out-of-Cycle Security Bulletin: Junos OS and Junos OS Evolved: A crafted BGP UPDATE message allows a remote attacker to de-peer (reset) BGP sessions (CVE-2023-4481) ∗∗∗ --------------------------------------------- https://supportportal.juniper.net/s/article/2023-08-29-Out-of-Cycle-Securit… ∗∗∗ [R1] Nessus Version 10.6.0 Fixes Multiple Vulnerabilities ∗∗∗ --------------------------------------------- https://www.tenable.com/security/tns-2023-29 ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 29.08.2023
by Daily end-of-shift report 29 Aug '23

29 Aug '23

===================== = End-of-Day report = ===================== Timeframe: Montag 28-08-2023 18:00 − Dienstag 29-08-2023 18:00 Handler: Michael Schlagenhaufer Co-Handler: Robert Waldner ===================== = News = ===================== ∗∗∗ Malware loader lowdown: The big 3 responsible for 80% of attacks so far this year ∗∗∗ --------------------------------------------- Three malware loaders — QBot, SocGholish, and Raspberry Robin — are responsible for 80 percent of observed attacks on computers and networks so far this year. --------------------------------------------- https://go.theregister.com/feed/www.theregister.com/2023/08/28/top_malware_… ∗∗∗ Leaking File Contents with a Blind File Oracle in Flarum ∗∗∗ --------------------------------------------- Flarum is a free, open source PHP-based forum software used for everything from gaming hobbyist sites to cryptocurrency discussion. [..] Through our research we were able to leak the contents of arbitrary local files in Flarum through a blind oracle, and conduct blind SSRF attacks with only a basic user account. --------------------------------------------- https://blog.assetnote.io/2023/08/28/leaking-file-contents-with-a-blind-fil… ∗∗∗ Compromised OpenCart Payment Module Steals Credit Card Information ∗∗∗ --------------------------------------------- It seems that the attackers had manually modified one of the key files responsible for the processing of payment information on their OpenCart website; this is very similar to another credit card skimmer that we recently wrote about. --------------------------------------------- https://blog.sucuri.net/2023/08/opencart-payment-module-steals-credit-card-… ∗∗∗ Jetzt patchen! Exploitcode legt Attacken auf Juniper-Firewalls nahe ∗∗∗ --------------------------------------------- Sicherheitsforscher haben Schwachstellen in Juniper Firewalls und Switches dokumentiert. Das können Angreifer nun missbrauchen. --------------------------------------------- https://heise.de/-9287740 ∗∗∗ Zoho ManageEngine: Schwachstelle erlaubt Umgehen von Mehrfaktorauthentifizierung ∗∗∗ --------------------------------------------- Zahlreiche ManageEninge-Produkte von Zoho sind von Schwachstellen betroffen, die die Umgehung der Mehrfaktorauthentifizierung (MFA) ermöglichen. Während aktualisierte Softwarepakete offenbar seit Ende Juni bereitstehen, wurde erst jetzt die CVE-Meldung dazu bekannt. --------------------------------------------- https://heise.de/-9287917 ∗∗∗ MalDoc in PDF: Japanisches CERT warnt vor in PDFs versteckten Malware-Dokumenten ∗∗∗ --------------------------------------------- Cyberkriminelle finden immer neue Wege, Malware vor der Erkennung zu verstecken. Das japanische CERT hat jetzt bösartige Word-Dokumente in PDFs gefunden. --------------------------------------------- https://heise.de/-9288262 ∗∗∗ Gefälschte Beschwerdemails an Hotels führen zu Schadsoftware ∗∗∗ --------------------------------------------- Derzeit kursieren gefälschte E-Mails mit angeblichen Gästebeschwerden. Bisher sind uns zwei Versionen bekannt. In einem E-Mail beklagt sich ein vermeintlicher Gast über die Sauberkeit der Zimmer, in einer anderen Version, wirft man dem Personal vor, Wertgegenstände aus dem Zimmer gestohlen zu haben. Als Beweis finden Sie im E-Mail einen Link zu Fotos. Wir vermuten Schadsoftware, klicken Sie nicht auf den Link! --------------------------------------------- https://www.watchlist-internet.at/news/gefaelschte-beschwerdemails-an-hotel… ∗∗∗ Ungefixter Skype-Bug ermöglicht Angreifern die IP-Adresse der Opfer abzufragen (August 2023) ∗∗∗ --------------------------------------------- Ein Sicherheitsforscher ist auf eine Möglichkeit gestoßen, die IP-Adresse eines Skype-Benutzers zu ermitteln, ohne dass die Zielperson überhaupt auf einen Link klicken muss. --------------------------------------------- https://www.borncity.com/blog/2023/08/29/ungefixter-skype-bug-ermglicht-ang… ===================== = Vulnerabilities = ===================== ∗∗∗ Multiple Vulnerabilities found in Techview LA-5570 Wireless Gateway Home Automation Controller ∗∗∗ --------------------------------------------- The Security Team at [exploitsecurity.io] uncovered multiple vulnerabilities in the Techview LA-5570 Wireless Home Automation Controller [Firmware Version 1.0.19_T53]. These vulnerabilities can be used to to gain full control of the affected device. CVE IDs: CVE-2023-34723, CVE-2023-34724, CVE-2023-34725 --------------------------------------------- https://www.exploitsecurity.io/post/cve-2023-34723-cve-2023-34724-cve-2023-… ∗∗∗ Webbrowser: Firefox 117, ESR 115.2 und ESR 102.15 dichten Sicherheitslecks ab ∗∗∗ --------------------------------------------- Die Mozilla-Entwickler haben die Firefox-Versionen 117, ESR 115.2 und ESR 102.15 herausgegeben, die mehrere teils hochriskante Sicherheitslücken schließen. --------------------------------------------- https://heise.de/-9288483 ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (flask-security and opendmarc), Fedora (qemu), Oracle (rust and rust-toolset:ol8), Red Hat (cups and libxml2), Scientific Linux (cups), SUSE (ca-certificates-mozilla, chromium, clamav, freetype2, haproxy, nodejs12, procps, and vim), and Ubuntu (faad2, json-c, libqb, linux, linux-aws, linux-lts-xenial, linux-gcp-5.15, linux-gke, linux-gke-5.15, linux-gkeop, linux-gkeop-5.15, and linux-gke, linux-ibm-5.4). --------------------------------------------- https://lwn.net/Articles/943006/ ∗∗∗ Unauthenticated OS Command Injection im Patton SN200 VoIP-Gateway (SYSS-2023-019) ∗∗∗ --------------------------------------------- Durch verschiedene Schwachstellen können unangemeldete Angreifende Sytembefehle auf dem Patton SN200 VoIP-Gateway ausführen. --------------------------------------------- https://www.syss.de/pentest-blog/unauthenticated-os-command-injection-im-pa… ∗∗∗ Festo Didactic: Cross-Site-Scripting (XSS) vulnerability in LX-Appliance ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2023-040/ ∗∗∗ Reflected Cross-Site Scripting (XSS) Schwachstelle in Codebeamer (ALM Solution) von PTC ∗∗∗ --------------------------------------------- https://sec-consult.com/de/vulnerability-lab/advisory/reflected-cross-site-… ∗∗∗ IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in scikit-learn ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7029479 ∗∗∗ A CVE-2023-21967 vulnerability in IBM Java Runtime affects IBM Process Designer 8.5.7 shipped with IBM Business Automation Workflow ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7029615 ∗∗∗ The IBM Engineering Lifecycle Engineering product using IBM SDK, Java Technology Edition Quarterly CPU - Apr 2023 - Includes Oracle April 2023 CPU is vulnerable to (CVE-2023-2597) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7029634 ∗∗∗ IBM Event Streams is vulnerable to denial of service attacks due to snappy-java (CVE-2023-34453, CVE-2023-34455, CVE-2023-34454) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7029640 ∗∗∗ IBM Event Streams is vulnerable to a denial of service attack due to Golang Go (CVE-2023-29409) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7029639 ∗∗∗ Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to code injection and privilege escalation due to multiple vulnerabilities in Go ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7029646 ∗∗∗ Operations Dashboard is vulnerable to remote code execution, privilege escalation, and denial of service due to multiple Go vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7029648 ∗∗∗ IBM Cloud Transformation Advisor is vulnerable to multiple vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7029656 ∗∗∗ Vulnerabilities in IBM Java included with IBM Tivoli Monitoring. ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7029662 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 28.08.2023
by Daily end-of-shift report 28 Aug '23

28 Aug '23

===================== = End-of-Day report = ===================== Timeframe: Freitag 25-08-2023 18:00 − Montag 28-08-2023 18:00 Handler: Michael Schlagenhaufer Co-Handler: Robert Waldner ===================== = News = ===================== ∗∗∗ Update korrigiert Verschlüsselung von Qnap-Betriebssystemen ∗∗∗ --------------------------------------------- Qnap hat aktualisierte Versionen der QTS- und QuTS hero-Betriebssysteme veröffentlicht. Sie korrigieren unter anderem zu schwache Verschlüsselung. --------------------------------------------- https://heise.de/-9286394 ∗∗∗ Stalker-Malware: Whiffy Recon schnüffelt Standort alle 60 Sekunden aus ∗∗∗ --------------------------------------------- Eine Malware namens Whiffy Recon überprüft alle 60 Sekunden den Standort des infizierten Geräts. Es bleibt unklar, wozu. --------------------------------------------- https://heise.de/-9286754 ∗∗∗ Auch Antivirensoftware: Winrar-Schwachstelle betrifft womöglich weitere Programme ∗∗∗ --------------------------------------------- Nachtrag vom 28. August 2023, 17:28 Uhr: Herr Marx wies die Redaktion im Nachhinein darauf hin, dass eine mögliche Ausnutzung von CVE-2023-40477 für die einzelnen Anwendungen individuell beurteilt werden muss. Nicht jedes Programm, das die gefährdete DLL verwendet, macht automatisch Gebrauch von dem problematischen Code. --------------------------------------------- https://www.golem.de/news/auch-antivirensoftware-winrar-schwachstelle-betri… ∗∗∗ Duolingo: Leck mit 2,6 Millionen Nutzerdatensätze, Prüfung auf Have I been Pwned möglich ∗∗∗ --------------------------------------------- Bei der Sprachlern-App Duolingo bzw. bei deren Anbieter ermöglichten Schwachstellen Benutzerdaten abzuziehen. Jetzt hat Troy Hunt einen Datensatz mit den Informationen zu 2,6 Millionen Duolingo Nutzern in seine Plattform Have I been Pwned integriert. --------------------------------------------- https://www.borncity.com/blog/2023/08/24/duolingo-leck-mit-26-millionen-nut… ∗∗∗ Antworten von Microsoft zum Hack der Microsoft Azure-Cloud durch Storm-0588 – Teil 1 ∗∗∗ --------------------------------------------- Ich hatte nach dem Hack der Microsoft Azure Cloud-Infrastruktur durch die mutmaßlich chinesische Gruppe Storm-0588 bei Microsoft Irland konkret nachgefragt, ob persönliche Daten eines meiner Microsoft Konten betroffen seien. Und ich hatte an den Bundesdatenschutzbeauftragten (BfDI), Ulrich Kelber, [...] --------------------------------------------- https://www.borncity.com/blog/2023/08/26/antworten-von-microsoft-zum-hack-d… ∗∗∗ Antworten des Bundesdatenschutzbeauftragten, Ulrich Kelber, zum Hack der Microsoft Azure-Cloud durch Storm-0588 – Teil 2 ∗∗∗ --------------------------------------------- In Teil 1 dieser Artikelreihe hatte die die Antworten Microsofts auf meine konkreten Fragen zum Hack der Microsoft Azure Cloud-Infrastruktur durch die mutmaßlich chinesische Gruppe Storm-0588 wiedergegeben. Ich hatte aber auch einige Fragen an die Presseabteilung des Bundesdatenschutzbeauftragten (BfDI) [...] --------------------------------------------- https://www.borncity.com/blog/2023/08/26/antworten-des-bundesdatenschutzbea… ∗∗∗ PoC for no-auth RCE on Juniper firewalls released ∗∗∗ --------------------------------------------- Researchers have released additional details about the recently patched four vulnerabilities affecting Juniper Networks’ SRX firewalls and EX switches that could allow remote code execution (RCE), as well as a proof-of-concept (PoC) exploit. --------------------------------------------- https://www.helpnetsecurity.com/2023/08/28/poc-rce-juniper-firewalls/ ∗∗∗ Beware the Azure Guest User: How to Detect When a Guest User Account Is Being Exploited ∗∗∗ --------------------------------------------- In Azure environments, guest users are the go-to option when giving access to a user from a different tenant. Often, little effort is invested in keeping guest users safe. However, this could prove to be a costly mistake. It’s actually very important to monitor the third-party applications and identities that have access to your environment, [...] --------------------------------------------- https://orca.security/resources/blog/detect-guest-user-account-exploited/ ∗∗∗ Reply URL Flaw Allowed Unauthorized MS Power Platform API Access ∗∗∗ --------------------------------------------- Cybersecurity experts from Secureworks have revealed a critical vulnerability within Microsoft’s Power Platform, now known as Entra ID. The vulnerability, discovered early this year, involved an abandoned reply URL within the Azure Active Directory (AD) environment, granting unauthorized access to elevated permissions and control within an organization. --------------------------------------------- https://www.hackread.com/reply-url-flaw-ms-power-platform-api-access/ ∗∗∗ KmsdBot Malware Gets an Upgrade: Now Targets IoT Devices with Enhanced Capabilities ∗∗∗ --------------------------------------------- An updated version of a botnet malware called KmsdBot is now targeting Internet of Things (IoT) devices, simultaneously branching out its capabilities and the attack surface. "The binary now includes support for Telnet scanning and support for more CPU architectures," Akamai security researcher Larry W. Cashdollar said in an analysis published this month. --------------------------------------------- https://thehackernews.com/2023/08/kmsdbot-malware-gets-upgrade-now.html ===================== = Vulnerabilities = ===================== ∗∗∗ D-Link DAP-2622: Various Security Vulnerabilities Reported ∗∗∗ --------------------------------------------- Affected Models: DAP-2622 Hardware Revision: All A Series Hardware Revisions Region: Non-US/CA Affected FW: v1.00 & Below Fixed FW: v1.10B03R022 Beta-Hotfix --------------------------------------------- https://supportannouncement.us.dlink.com/announcement/publication.aspx?name… ∗∗∗ Busybox cpio directory traversal vulnerability (CVE-2023-39810) ∗∗∗ --------------------------------------------- When extracting cpio archives with BusyBox cpio, the cpio archiving tools may write files outside the destination directory and there is no option to prevent this. --------------------------------------------- https://www.pentagrid.ch/en/blog/busybox-cpio-directory-traversal-vulnerabi… ∗∗∗ Sicherheitsupdates: Drupal-Plug-ins mit Schadcode-Lücken ∗∗∗ --------------------------------------------- Wenn bestimmte Plug-ins zum Einsatz kommen, sind mit dem CMS Drupal erstellte Websites attackierbar. --------------------------------------------- https://heise.de/-9286388 ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (chromium, clamav, librsvg, rar, and unrar-nonfree), Fedora (caddy, chromium, and xen), and SUSE (ca-certificates-mozilla, gawk, ghostscript, java-1_8_0-ibm, java-1_8_0-openjdk, php7, qemu, and xen). --------------------------------------------- https://lwn.net/Articles/942922/ ∗∗∗ Sicherheitsschwachstellen im tef-Händlerportal (SYSS-2023-020/-021) ∗∗∗ --------------------------------------------- Im tef-Händlerportal kann über eine Persistent Cross-Site Scripting-Schwachstelle beliebiger Code im Kontext des Benutzers ausgeführt werden. --------------------------------------------- https://www.syss.de/pentest-blog/sicherheitsschwachstellen-im-tef-haendlerp… ∗∗∗ VU#757109: Groupnotes Inc. Videostream Mac client allows for privilege escalation to root account ∗∗∗ --------------------------------------------- https://kb.cert.org/vuls/id/757109 ∗∗∗ Vulnerabilities in IBM Java Runtime affect z/Transaction Processing Facility ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7028975 ∗∗∗ IBM Java SDK and IBM Java Runtime for IBM i are vulnerable to arbitrary code execution due to an unsafe deserialization flaw (CVE-2022-40609). ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7029160 ∗∗∗ IBM MQ Operator and Queue manager container images are vulnerable to multiple vulnerabilities from systemd, libcap, openssl-libs, libxml2, go-toolset, and prometheus-operator ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7029356 ∗∗∗ Security vulnerabilities have been identified in IBM DB2 shipped with IBM License Metric Tool v9. ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7029359 ∗∗∗ A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Rational ClearCase (CVE-2023-35890) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7029364 ∗∗∗ A security vulnerability has been identified in IBM HTTP Server shipped with IBM Rational ClearCase [CVE-2023-32342] ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7029362 ∗∗∗ A security vulnerability has been identified in IBM WebSphere Application Server shipped with Tivoli Netcool/OMNIbus WebGUI (CVE-2022-40609) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7029361 ∗∗∗ Multiple security vulnerabilities has been identified in IBM WebSphere Application Server shipped with Tivoli Netcool/OMNIbus WebGUI - July 2023 CPU ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7029360 ∗∗∗ GNU C library (glibc) vulnerability affects (CVE-2015-7547) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/650093 ∗∗∗ ISC DHCP vulnerability affects TS4500 Tape Library (CVE-2018-5732) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/650877 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 25.08.2023
by Daily end-of-shift report 25 Aug '23

25 Aug '23

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 24-08-2023 18:00 − Freitag 25-08-2023 18:00 Handler: Michael Schlagenhaufer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Auch Antivirensoftware: Winrar-Schwachstelle betrifft Hunderte weitere Programme ∗∗∗ --------------------------------------------- Nicht nur alte Winrar-Versionen sind für eine jüngst gepatchte Sicherheitslücke anfällig, sondern auch zahlreiche weitere Anwendungen. --------------------------------------------- https://www.golem.de/news/auch-antivirensoftware-winrar-schwachstelle-betri… ∗∗∗ FBI-Warnung: Barracuda ESG-Appliances noch immer bedroht, umgehend entfernen ∗∗∗ --------------------------------------------- Das FBI warnt vor den Barracuda-ESG-Schwachstellen, die Ende Mai bekannt wurden. Es geht davon aus, dass alle Geräte kompromittiert seien. --------------------------------------------- https://heise.de/-9284695 ∗∗∗ „Mammutjagd“ auf Online-Marktplätze ∗∗∗ --------------------------------------------- Mit dem Toolset "Telekopye" können auch technisch wenig versierte Hacker auf Online-Marktplätzen Jagd auf ahnungslose Käufer – im Gauner-Slang "Mammut" - machen. --------------------------------------------- https://www.zdnet.de/88411400/mammutjagd-auf-online-marktplaetze/ ∗∗∗ Jupiter X Core WordPress plugin could let hackers hijack sites ∗∗∗ --------------------------------------------- Two vulnerabilities affecting some version of Jupiter X Core, a premium plugin for setting up WordPress and WooCommerce websites, allow hijacking accounts and uploading files without authentication. --------------------------------------------- https://www.bleepingcomputer.com/news/security/jupiter-x-core-wordpress-plu… ∗∗∗ Python Malware Using Postgresql for C2 Communications, (Fri, Aug 25th) ∗∗∗ --------------------------------------------- For modern malware, having access to its C2 (Command and control) is a crucial point. There are many ways to connect to a C2 server using tons of protocols, but today, HTTP remains very common because HTTP is allowed on most networks... --------------------------------------------- https://isc.sans.edu/diary/rss/30158 ∗∗∗ Playing Dominos with Moodles Security (1/2) ∗∗∗ --------------------------------------------- This is the first blog in a two-part series where we will present our findings on a Moodle security audit we conducted. We were drawn to researching the security aspect of the framework due to its popularity, with the goal of contributing to a safer internet. In this first article, we demonstrate how an unauthenticated attacker can leverage a vulnerability with a supposedly low impact to gain full control over the Moodle instance. --------------------------------------------- https://www.sonarsource.com/blog/playing-dominos-with-moodles-security-1/ ∗∗∗ A broken marriage. Abusing mixed vendor Kerberos stacks ∗∗∗ --------------------------------------------- *nix based servers and services can be joined to Active Directory networks in the same way as their Windows counterparts. This is usually facilitated through the MIT or Heimdal Kerberos stacks. Kerberos is designed as an authentication-based protocol therefore authorisation decisions are implemented independently to the Kerberos protocol itself. Due to this, different vendor stacks behave differently on how authorisation decisions are made. --------------------------------------------- https://www.pentestpartners.com/security-blog/a-broken-marriage-abusing-mix… ∗∗∗ A Beginner’s Guide to Adversary Emulation with Caldera ∗∗∗ --------------------------------------------- The target audience for this blog post is individuals who have a basic understanding of cybersecurity concepts and terminology and looking to expand their knowledge on adversary emulation. This post delves into the details of adversary emulation with the Caldera framework exploring the benefits it offers. --------------------------------------------- https://blog.nviso.eu/2023/08/25/a-beginners-guide-to-adversary-emulation-w… ∗∗∗ Analysis of MS-SQL Server Proxyjacking Cases ∗∗∗ --------------------------------------------- AhnLab Security Emergency response Center (ASEC) has recently discovered cases of proxyjacking targeting poorly managed MS-SQL servers. Publicly accessible MS-SQL servers with simple passwords are one of the main attack vectors used when targeting Windows systems. Typically, threat actors target poorly managed MS-SQL servers and attempt to gain access through brute force or dictionary attacks. If successful, they install malware on the infected system. --------------------------------------------- https://asec.ahnlab.com/en/56350/ ∗∗∗ Stories from the SOC - Unveiling the stealthy tactics of Aukill malware ∗∗∗ --------------------------------------------- On April 21st, 2023, AT&T Managed Extended Detection and Response (Managed XDR) investigated an attempted ransomware attack on one of our clients, a home improvement business. The investigation revealed the attacker used AuKill malware on the clients print server to disable the servers installed endpoint detection and response (EDR) solution by brute-forcing an administrator account and downgrading a driver to a vulnerable version. --------------------------------------------- https://cybersecurity.att.com/blogs/security-essentials/stories-from-the-so… ===================== = Vulnerabilities = ===================== ∗∗∗ Maxon Cinema 4D SKP File Parsing vulnerabilities ∗∗∗ --------------------------------------------- CVSS Score: 7.8 CVE-2023-40482, CVE-2023-40483, CVE-2023-40486, CVE-2023-40485, CVE-2023-40484, CVE-2023-40488, CVE-2023-4049[0], CVE-2023-40491, CVE-2023-40487, CVE-2023-40489 Mitigation: Given the nature of the [vulnerabilities], the only salient mitigation strategy is to restrict interaction with the application. --------------------------------------------- https://www.zerodayinitiative.com/advisories/published/ ∗∗∗ (0Day) LG Simple Editor vulnerabilities ∗∗∗ --------------------------------------------- CVSS Scores: 6.5-9.8 CVE-2023-40502, CVE-2023-40513, CVE-2023-40514, CVE-2023-40515, CVE-2023-40492, CVE-2023-40493, CVE-2023-40494, CVE-2023-40495, CVE-2023-40496, CVE-2023-40497, CVE-2023-40498, CVE-2023-40499, CVE-2023-40500, CVE-2023-40503, CVE-2023-40503, CVE-2023-40504, CVE-2023-40505, CVE-2023-40506, CVE-2023-40507, CVE-2023-40508, CVE-2023-40509, CVE-2023-40510, CVE-2023-40511, CVE-2023-40512, CVE-2023-40501, CVE-2023-40516 [...] they do not have plans to fix the [vulnerabilities] --------------------------------------------- https://www.zerodayinitiative.com/advisories/published/ ∗∗∗ (0Day) LG SuperSign Media Editor vulnerabilities ∗∗∗ --------------------------------------------- CVSS Scores: 5.3-7.5 CVE-2023-40517, CVE-2023-41181 The vendor states that they do not have plans to fix the [vulnerabilities] now or in the future. [...] Given the nature of the [vulnerabilities], the only salient mitigation strategy is to restrict interaction with the application. --------------------------------------------- https://www.zerodayinitiative.com/advisories/published/ ∗∗∗ QNap: [Vulnerabilities] in QTS and QuTS hero ∗∗∗ --------------------------------------------- CVE-2023-34971, CVE-2023-34973, CVE-2023-34972 Affected products: QTS 5.1.0, 5.0.1, 4.5.4; QuTS hero h5.1.0, h4.5.4 We have already fixed the [vulnerabilities] in the following operating system versions: * QTS 5.1.0.2444 build 20230629 and later * QTS 5.0.1.2425 build 20230609 and later * QTS 4.5.4.2467 build 20230718 and later * QuTS hero h5.1.0.2424 build 20230609 and later * QuTS hero h4.5.4.2476 build 20230728 and later --------------------------------------------- https://www.qnap.com/en-us/security-advisories?ref=security_advisory_details ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (tryton-server), Fedora (youtube-dl), SUSE (clamav and krb5), and Ubuntu (cjose and fastdds). --------------------------------------------- https://lwn.net/Articles/942766/ ∗∗∗ ZDI-23-1224: LG LED Assistant updateFile Directory Traversal Information Disclosure Vulnerability ∗∗∗ --------------------------------------------- https://www.zerodayinitiative.com/advisories/ZDI-23-1224/ ∗∗∗ ZDI-23-1223: LG LED Assistant thumbnail Directory Traversal Information Disclosure Vulnerability ∗∗∗ --------------------------------------------- https://www.zerodayinitiative.com/advisories/ZDI-23-1223/ ∗∗∗ ZDI-23-1222: LG LED Assistant setThumbnailRc Directory Traversal Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- https://www.zerodayinitiative.com/advisories/ZDI-23-1222/ ∗∗∗ ZDI-23-1221: LG LED Assistant upload Directory Traversal Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- https://www.zerodayinitiative.com/advisories/ZDI-23-1221/ ∗∗∗ IBM Security Guardium is affected by multiple vulnerabilities (CVE-2023-30435, CVE-2023-30436, CVE-2023-30437) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7028506 ∗∗∗ ISC BIND on IBM i is vulnerable to denial of service due to a memory usage flaw (CVE-2023-2828) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7017974 ∗∗∗ Multiple vulnerabilities found in IBM Java which is shipped with IBM Intelligent Operations Center(CVE-2022-21541, CVE-2022-21540) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7028934 ∗∗∗ IBM App Connect Enterprise Certified Container operands are vulnerable to denial of service due to [CVE-2023-26115] ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7028936 ∗∗∗ IBM Spectrum Copy Data Management uses weaker than expected cryptographic algorithms ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7028841 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily