- Daily - CERT.at

Tageszusammenfassung - 17.10.2023
by Daily end-of-shift report 17 Oct '23

17 Oct '23

===================== = End-of-Day report = ===================== Timeframe: Montag 16-10-2023 18:00 − Dienstag 17-10-2023 18:00 Handler: Thomas Pribitzer Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Discord still a hotbed of malware activity — Now APTs join the fun ∗∗∗ --------------------------------------------- Discord continues to be a breeding ground for malicious activity by hackers and now APT groups, with it commonly used to distribute malware, exfiltrate data, and targeted by threat actors to steal authentication tokens. --------------------------------------------- https://www.bleepingcomputer.com/news/security/discord-still-a-hotbed-of-ma… ∗∗∗ A hack in hand is worth two in the bush ∗∗∗ --------------------------------------------- We analyzed the data published by Cyber Av3ngers and found it to be sourced from older leaks by another hacktivist group called Moses Staff. --------------------------------------------- https://securelist.com/a-hack-in-hand-is-worth-two-in-the-bush/110794/ ∗∗∗ Android Mobile Root Detection – Snake Oil or Silver Bullet? ∗∗∗ --------------------------------------------- Android is one of the most widely used mobile operating systems in the world. However, with its widespread use, it is also susceptible to security threats. --------------------------------------------- https://sec-consult.com/blog/detail/android-mobile-root-detection-snake-oil… ∗∗∗ NSA Publishes ICS/OT Intrusion Detection Signatures and Analytics ∗∗∗ --------------------------------------------- NSA has released Elitewolf, a repository of intrusion detection signatures and analytics for OT environments. --------------------------------------------- https://www.securityweek.com/nsa-publishes-ics-ot-intrusion-detection-signa… ∗∗∗ Betrügerische Spendenorganisationen sammeln Geld für Israel ∗∗∗ --------------------------------------------- Kriminelle wissen, dass die Spendenbereitschaft in Krisensituationen besonders hoch ist. Nur wenige Tage nach dem Anschlag in Israel tauchen im Netz betrügerische Spenden-Websiten für Israel auf. --------------------------------------------- https://www.watchlist-internet.at/news/betruegerische-spendenorganisationen… ∗∗∗ Snapshot fuzzing direct composition with WTF ∗∗∗ --------------------------------------------- Although there is public research on Direct Composition, only a few discuss fuzzing this feature, and none, to our knowledge, that covers snapshot fuzzing. --------------------------------------------- https://blog.talosintelligence.com/snapshot-fuzzing-direct-composition-with… ∗∗∗ Principles for ransomware-resistant cloud backups ∗∗∗ --------------------------------------------- Helping to make cloud backups resistant to the effects of destructive ransomware. --------------------------------------------- https://www.ncsc.gov.uk/guidance/principles-for-ransomware-resistant-cloud-… ===================== = Vulnerabilities = ===================== ∗∗∗ Critical Vulnerabilities Uncovered in Open Source CasaOS Cloud Software ∗∗∗ --------------------------------------------- Two critical security flaws discovered in the open-source CasaOS personal cloud software could be successfully exploited by attackers to achieve arbitrary code execution and take over susceptible systems. --------------------------------------------- https://thehackernews.com/2023/10/critical-vulnerabilities-uncovered-in.html ∗∗∗ Cisco: Schwere Sicherheitslücke in IOS XE ermöglicht Netzwerk-Übernahme ∗∗∗ --------------------------------------------- Geräte mit IOS XE und Web-UI können von Angreifern ohne Weiteres aus der Ferne übernommen werden. Cisco hat keine Patches, aber Empfehlungen für Betroffene. --------------------------------------------- https://www.heise.de/news/Cisco-Schwere-Sicherheitsluecke-in-IOS-XE-erlaubt… ∗∗∗ SonicOS: Angreifer können Sonicwalls abstürzen lassen ∗∗∗ --------------------------------------------- Sonicwall hat Updates für SonicOS veröffentlicht, die Sicherheitslücken schließen. Die Lecks erlauben Angreifern, verwundbare Geräte lahmzulegen. --------------------------------------------- https://www.heise.de/news/SonicOS-Angreifer-koennen-Sonicwalls-abstuerzen-l… ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (axis, nghttp2, node-babel7, and tomcat9), Fedora (curl and ghostscript), Oracle (bind, kernel-container, mariadb:10.5, and python3.11), Red Hat (.NET 7.0, go-toolset, golang, and go-toolset:rhel8), SUSE (kernel, libcue, libxml2, python-Django, and python-gevent), and Ubuntu (curl, ghostscript, iperf3, libcue, python2.7, quagga, and samba). --------------------------------------------- https://lwn.net/Articles/948010/ ∗∗∗ K000137211 : cURL vulnerabilities CVE-2023-38546 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000137211 ∗∗∗ Festo: Vulnerable Siemens TIA-Portal in multiple Festo Didactic products ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2023-047/ ∗∗∗ WAGO: Multiple products vulnerable to local file inclusion ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2023-046/ ∗∗∗ Schneider Electric EcoStruxure Power Monitoring Expert and Power Operation Products ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-290-01 ∗∗∗ Rockwell Automation FactoryTalk Linx ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-290-02 ∗∗∗ Vulnerability CVE-2023-35116 affects CICS Transaction Gateway for Multiplatforms and CICS Transaction Gateway Desktop Edition. ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7052938 ∗∗∗ IBM Personal Communications could allow a remote user to obtain sensitive information including user passwords, allowing unauthorized access. (CVE-2016-0321) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/276845 ∗∗∗ IBM Db2 is vulnerable to denial of service via a specially crafted query on certain databases. (CVE-2023-30987) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7047560 ∗∗∗ Vulnerability in pycrypto-2.6.1.tar.gz affects IBM Integrated Analytics System [CVE-2013-7459, CVE-2018-6594] ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7053417 ∗∗∗ Multiple vulnerabilities in OpenSSL affect IBM Observability with Instana (Agent container image) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7053623 ∗∗∗ Remote code execution/denial of service attack is possible in IBM Observability with Instana (Self-hosted on Docker) due to use of Apache Kafka ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7053643 ∗∗∗ Due to use of Apache Commons FileUpload and Tomcat, IBM UrbanCode Release is vulnerable to a denial of service. ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7053627 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 16.10.2023
by Daily end-of-shift report 16 Oct '23

16 Oct '23

===================== = End-of-Day report = ===================== Timeframe: Freitag 13-10-2023 18:00 − Montag 16-10-2023 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ DarkGate malware spreads through compromised Skype accounts ∗∗∗ --------------------------------------------- Between July and September, DarkGate malware attacks have used compromised Skype accounts to infect targets through messages containing VBA loader script attachments. --------------------------------------------- https://www.bleepingcomputer.com/news/security/darkgate-malware-spreads-thr… ∗∗∗ Scanning evasion issue in Cisco Secure Email Gateway ∗∗∗ --------------------------------------------- Cisco Secure Email Gateway provided by Cisco Systems may fail to detect specially crafted files. --------------------------------------------- https://jvn.jp/en/jp/JVN58574030/ ∗∗∗ Security review for Microsoft Edge version 118 ∗∗∗ --------------------------------------------- We are pleased to announce the security review for Microsoft Edge, version 118! We have reviewed the new settings in Microsoft Edge version 118 and determined that there are no additional security settings that require enforcement. The Microsoft Edge version 117 security baseline continues to be our recommended configuration which can be downloaded from the Microsoft Security Compliance Toolkit. --------------------------------------------- https://techcommunity.microsoft.com/t5/microsoft-security-baselines/securit… ∗∗∗ SpyNote: Beware of This Android Trojan that Records Audio and Phone Calls ∗∗∗ --------------------------------------------- The Android banking trojan known as SpyNote has been dissected to reveal its diverse information-gathering features.Typically spread via SMS phishing campaigns, attack chains involving the spyware trick potential victims into installing the app by clicking on the embedded link, according to F-Secure. --------------------------------------------- https://thehackernews.com/2023/10/spynote-beware-of-this-android-trojan.html ∗∗∗ Pro-Russian Hackers Exploiting Recent WinRAR Vulnerability in New Campaign ∗∗∗ --------------------------------------------- Pro-Russian hacking groups have exploited a recently disclosed security vulnerability in the WinRAR archiving utility as part of a phishing campaign designed to harvest credentials from compromised systems."The attack involves the use of malicious archive files that exploit the recently discovered vulnerability affecting the WinRAR compression software versions prior to 6.23 [..] --------------------------------------------- https://thehackernews.com/2023/10/pro-russian-hackers-exploiting-recent.html ∗∗∗ Signal says there is no evidence rumored zero-day bug is real ∗∗∗ --------------------------------------------- As this is an ongoing investigation, and the mitigation is to simply disable the Link Previews feature, users may want to turn this setting off for the time being until its fully confirmed not to be real. --------------------------------------------- https://www.bleepingcomputer.com/news/security/signal-says-there-is-no-evid… ∗∗∗ “EtherHiding” — Hiding Web2 Malicious Code in Web3 Smart Contracts ∗∗∗ --------------------------------------------- Over the last two months, leveraging a vast array of hijacked WordPress sites, this threat actor has misled users into downloading malicious fake “browser updates”. While their initial method of hosting code on abused Cloudflare Worker hosts was taken down, they’ve quickly pivoted to take advantage of the decentralized, anonymous, and public nature of blockchain. This campaign is up and harder than ever to detect and take down. --------------------------------------------- https://labs.guard.io/etherhiding-hiding-web2-malicious-code-in-web3-smart-… ∗∗∗ Blocking Dedicated Attacking Hosts Is Not Enough: In-Depth Analysis of a Worldwide Linux XorDDoS Campaign ∗∗∗ --------------------------------------------- We provide a comprehensive analysis of the XorDDoS Trojans attacking behaviors. Subsequently, we unveil the intricate network infrastructure orchestrating the campaigns botnet. Lastly, we introduce the advanced signatures derived from the key attacking hotspots, including hostnames, URLs and IP addresses. These signatures effectively identified over 1,000 XorDDoS C2 traffic sessions in August 2023 alone. --------------------------------------------- https://unit42.paloaltonetworks.com/new-linux-xorddos-trojan-campaign-deliv… ∗∗∗ WS_FTP: Ransomware-Attacken auf ungepatchte Server ∗∗∗ --------------------------------------------- In WS_FTP hat Hersteller Progress kürzlich teils kritische Sicherheitslücken geschlossen. Inzwischen sieht Sophos Ransomware-Angriffe darauf. --------------------------------------------- https://www.heise.de/news/WS-FTP-Ransomware-Attacken-auf-ungepatchte-Server… ∗∗∗ Milesight Industrial Router Vulnerability Possibly Exploited in Attacks ∗∗∗ --------------------------------------------- A vulnerability affecting Milesight industrial routers, tracked as CVE-2023-4326, may have been exploited in attacks. --------------------------------------------- https://www.securityweek.com/milesight-industrial-router-vulnerability-poss… ∗∗∗ Sie verkaufen auf Willhaben? Diese Betrugsmasche sollten Sie kennen! ∗∗∗ --------------------------------------------- Auf Willhaben und anderen Verkaufsplattformen begegnen Ihnen sicherlich auch mal Betrüger:innen. Besonders vorsichtig sollten Sie sein, wenn Sie zum ersten Mal verkaufen und Sie den Ablauf eines Verkaufs noch nicht so gut kennen. Wir zeigen Ihnen eine gängige Betrugsmasche und wie Sie sich davor schützen! --------------------------------------------- https://www.watchlist-internet.at/news/sie-verkaufen-auf-willhaben-diese-be… ∗∗∗ curl-Schwachstelle durch Microsoft ungepatcht ∗∗∗ --------------------------------------------- In der Bibliothek und im Tool curl gibt es in älteren Versionen eine Schwachstelle, die vom Projekt am 11. Oktober 2023 mit der Version 8.4.0 geschlossen wurde. Microsoft liefert curl mit Windows aus, und es stellte sich die Frage, ob curl zum Patchday, 10. Oktober 2023, ebenfalls aktualisiert wurde. Mein Stand ist, dass in Windows auch nach den Oktober 2023-Updates die veraltete curl-Version enthalten ist. --------------------------------------------- https://www.borncity.com/blog/2023/10/14/curl-schwachstelle-durch-microsoft… ∗∗∗ Active exploitation of Cisco IOS XE Software Web Management User Interface vulnerability ∗∗∗ --------------------------------------------- Cisco has identified active exploitation of a previously unknown vulnerability in the Web User Interface (Web UI) feature of Cisco IOS XE software (CVE-2023-20198) when exposed to the internet or untrusted networks. --------------------------------------------- https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-soft… ∗∗∗ Threat Actors Exploit Atlassian Confluence CVE-2023-22515 for Initial Access to Networks ∗∗∗ --------------------------------------------- The Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), and Multi-State Information Sharing and Analysis Center (MS-ISAC) are releasing this joint Cybersecurity Advisory (CSA) in response to the active exploitation of CVE-2023-22515. This recently disclosed vulnerability affects certain versions of Atlassian Confluence Data Center and Server, enabling malicious cyber threat actors to obtain initial access to Confluence instances by creating unauthorized Confluence administrator accounts. --------------------------------------------- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-289a ===================== = Vulnerabilities = ===================== ∗∗∗ Exim bugs ∗∗∗ --------------------------------------------- Fixed in 4.96.2/4.97: - CVE-2023-42117: Improper Neutralization of Special Elements - CVE-2023-42119: dnsdb Out-Of-Bounds Read libspf2 Integer Underflow: - CVE-2023-42118: Mitigation: Do not use the `spf` condition in your ACL --------------------------------------------- https://exim.org/static/doc/security/CVE-2023-zdi.txt ∗∗∗ Wordpress: Übernahme durch Lücke in Royal Elementor Addons and Template ∗∗∗ --------------------------------------------- Im Wordpress-Plug-in Royal Elementor Addons and Template missbrauchen Cyberkriminelle eine kritische Lücke. Sie nutzen sie zur Übernahme von Instanzen. --------------------------------------------- https://www.heise.de/news/Wordpress-Uebernahme-durch-Luecke-in-Royal-Elemen… ∗∗∗ Samba: Neue Versionen beheben mehrere Sicherheitslücken ∗∗∗ --------------------------------------------- Durch verschiedene Programmierfehler konnten Angreifer auf geheime Informationen bis hin zum Kerberos-TGT-Passwort zugreifen. Aktualisierungen stehen bereit. --------------------------------------------- https://www.heise.de/news/Samba-Neue-Versionen-beheben-mehrere-Sicherheitsl… ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (batik, poppler, and tomcat9), Fedora (chromium, composer, curl, emacs, ghostscript, libwebp, libXpm, netatalk, nghttp2, python-asgiref, python-django, and webkitgtk), Mageia (curl and libX11), Oracle (bind, busybox, firefox, and kernel), Red Hat (curl, dotnet6.0, dotnet7.0, and nginx), SUSE (chromium, cni, cni-plugins, grub2, netatalk, opensc, opera, and wireshark), and Ubuntu (iperf3). --------------------------------------------- https://lwn.net/Articles/947891/ ∗∗∗ Vulnerabilities in Video Station ∗∗∗ --------------------------------------------- Three vulnerabilities have been reported to affect Video Station: - CVE-2023-34975 and CVE-2023-34976: SQL injection vulnerabilities - CVE-2023-34977: Cross-site scripting (XSS) vulnerability If exploited, these vulnerabilities could allow authenticated users to inject malicious code via a network. --------------------------------------------- https://www.qnap.com/en-us/security-advisory/QSA-23-52 ∗∗∗ Vulnerabilities in QTS, QuTS hero, and QuTScloud ∗∗∗ --------------------------------------------- Two vulnerabilities have been reported to affect several QNAP operating system versions: - CVE-2023-32970: If exploited, the null pointer dereference vulnerability could allow authenticated administrators to launch a denial-of-service (DoS) attack via a network. - CVE-2023-32973: If exploited, the buffer copy without checking size of input vulnerability could allow authenticated administrators to execute code via a network. --------------------------------------------- https://www.qnap.com/en-us/security-advisory/QSA-23-41 ∗∗∗ Vulnerability in QTS, QuTS hero, and QuTScloud ∗∗∗ --------------------------------------------- A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to read and expose sensitive data via a network. --------------------------------------------- https://www.qnap.com/en-us/security-advisory/QSA-23-42 ∗∗∗ Vulnerability in Container Station ∗∗∗ --------------------------------------------- An OS command injection vulnerability has been reported to affect Container Station. If exploited, the vulnerability could allow authenticated administrators to execute arbitrary commands via a network. --------------------------------------------- https://www.qnap.com/en-us/security-advisory/QSA-23-44 ∗∗∗ web2py vulnerable to OS command injection ∗∗∗ --------------------------------------------- https://jvn.jp/en/jp/JVN80476432/ ∗∗∗ cURL and libcurl Vulnerability Affecting Cisco Products: October 2023 ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco IOS XE Software Web UI Privilege Escalation Vulnerability ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ FortiSandbox - XSS on delete endpoint ∗∗∗ --------------------------------------------- https://fortiguard.fortinet.com/psirt/FG-IR-23-311 ∗∗∗ FortiSandbox - Reflected Cross Site Scripting (XSS) on download progress endpoint ∗∗∗ --------------------------------------------- https://fortiguard.fortinet.com/psirt/FG-IR-23-215 ∗∗∗ FortiSandbox - Arbitrary file delete ∗∗∗ --------------------------------------------- https://fortiguard.fortinet.com/psirt/FG-IR-23-280 ∗∗∗ Red Lion Europe: Vulnerability allows access to non-critical information in mbCONNECT24 and mymbCONNECT24 ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2023-041/ ∗∗∗ Helmholz: Vulnerability allows access to non-critical information in myREX24 and myREX24.virtual ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2023-043/ ∗∗∗ 2023-10 Security Bulletin: Junos OS and Junos OS Evolved: High CPU load due to specific NETCONF command (CVE-2023-44184) ∗∗∗ --------------------------------------------- https://supportportal.juniper.net/s/article/2023-10-Security-Bulletin-Junos… ∗∗∗ IBM Security Verify Access Appliance has multiple security vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7009735 ∗∗∗ Security Vulnerabilities have been identifed in the IBM WebSphere Liberty product as shipped with the IBM Security Verify Access products. ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6953617 ∗∗∗ Security Vulnerabilities fixed in IBM Security Verify Access (CVE-2022-40303) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7009741 ∗∗∗ IBM Security Verify Access OpenID Connect Provider container has fixed multiple vulnerabilities (CVE-2022-43868, CVE-2022-43739, CVE-2022-43740) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7028513 ∗∗∗ IBM Security Verify Access product is vulnerable to Open Redirects (AAC module ) (CVE-2023-30433) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7012613 ∗∗∗ Postgresql JDBC drivers shipped with IBM Security Verify Access have a vulnerability (CVE-2022-41946) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7014261 ∗∗∗ IBM GSKit as shipped with IBM Security Verify Access has fixed a reported vulnerability (CVE-2023-32342) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7014259 ∗∗∗ Security vulnerabilities have been identified in IBM DB2 shipped with IBM License Metric Tool v9. ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7052776 ∗∗∗ Multiple Vulnerabilities of Apache HttpClient have affected IBM Jazz Reporting Service ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7052811 ∗∗∗ Google Guava component is vulnerable to CVE-2023-2976 is used by IBM Jazz Reporting Services. ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7052810 ∗∗∗ IBM Jazz Reporting Service is vulnerable to a denial of service (CVE-2023-35116) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7052809 ∗∗∗ Vulnerability with snappy-java affect IBM Cloud Object Storage Systems (Oc2023v1) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7052829 ∗∗∗ Require strict cookies for image proxy requests ∗∗∗ --------------------------------------------- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8… ∗∗∗ OAuth2 client_secret stored in plain text in the database ∗∗∗ --------------------------------------------- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h… ∗∗∗ Inviting excessive long email addresses to a calendar event makes the server unresponsive ∗∗∗ --------------------------------------------- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-r… ∗∗∗ Password of talk conversations can be bruteforced ∗∗∗ --------------------------------------------- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-7… ∗∗∗ Rate limiter not working reliable when Memcached is installed ∗∗∗ --------------------------------------------- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x… ∗∗∗ Security updates 1.5.5 and 1.4.15 released ∗∗∗ --------------------------------------------- https://roundcube.net/news/2023/10/16/security-updates-1.5.5-and-1.4.15 ∗∗∗ Security update 1.6.4 released ∗∗∗ --------------------------------------------- https://roundcube.net/news/2023/10/16/security-update-1.6.4-released -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 13.10.2023
by Daily end-of-shift report 13 Oct '23

13 Oct '23

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 12-10-2023 18:00 − Freitag 13-10-2023 18:00 Handler: Thomas Pribitzer Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Ransomware attacks now target unpatched WS_FTP servers ∗∗∗ --------------------------------------------- Internet-exposed WS_FTP servers unpatched against a maximum severity vulnerability are now targeted in ransomware attacks. --------------------------------------------- https://www.bleepingcomputer.com/news/security/ransomware-attacks-now-targe… ∗∗∗ FBI shares AvosLocker ransomware technical details, defense tips ∗∗∗ --------------------------------------------- The U.S. government has updated the list of tools AvosLocker ransomware affiliates use in attacks to include open-source utilities along with custom PowerShell, and batch scripts. --------------------------------------------- https://www.bleepingcomputer.com/news/security/fbi-shares-avoslocker-ransom… ∗∗∗ An analysis of an in-the-wild iOS Safari WebContent to GPU Process exploit ∗∗∗ --------------------------------------------- In April this year Google's Threat Analysis Group, in collaboration with Amnesty International, discovered an in-the-wild iPhone zero-day exploit chain being used in targeted attacks delivered via malicious link. --------------------------------------------- https://googleprojectzero.blogspot.com/2023/10/an-analysis-of-an-in-the-wil… ∗∗∗ DarkGate Malware Spreading via Messaging Services Posing as PDF Files ∗∗∗ --------------------------------------------- A piece of malware known as DarkGate has been observed being spread via instant messaging platforms such as Skype and Microsoft Teams. In these attacks, the messaging apps are used to deliver a Visual Basic for Applications (VBA) loader script that masquerades as a PDF document, which, when opened, triggers the download and execution of an AutoIt script designed to launch the malware. --------------------------------------------- https://thehackernews.com/2023/10/darkgate-malware-spreading-via.html ∗∗∗ GNOME what Im sayin? - GNOME libcue 0-click vulnerability ∗∗∗ --------------------------------------------- Am 10. Oktober wurde CVE-2023-43641 veröffentlicht, eine 0-click out-of-bounds array access Schwachstelle in libcue. GNOME verwendet diese Library zum Parsen von cuesheets beim Indizieren von Dateien für die Suchfunktion. Wie schlimm ist es? --------------------------------------------- https://cert.at/de/blog/2023/10/gnome-what-im-sayin-gnome-libcue-0-click-vu… ∗∗∗ WordPress 6.3.2 Security Release – What You Need to Know ∗∗∗ --------------------------------------------- WordPress Core 6.3.2 was released today, on October 12, 2023. It includes a number of security fixes and additional hardening against commonly exploited vulnerabilities. --------------------------------------------- https://www.wordfence.com/blog/2023/10/wordpress-6-3-2-security-release-wha… ∗∗∗ Analysis Report on Lazarus Threat Group’s Volgmer and Scout Malwares ∗∗∗ --------------------------------------------- Because the Lazarus threat group has been active since a long time ago, there are many attack cases and various malware strains are used in each case. In particular, there is also a wide variety of backdoors used for controlling the infected system after initial access. AhnLab Security Emergency response Center (ASEC) is continuously tracking and analyzing attacks by the Lazarus group, and in this post, we will analyze Volgmer and Scout, the two major malware strains used in their attacks. --------------------------------------------- https://asec.ahnlab.com/en/57685/ ===================== = Vulnerabilities = ===================== ∗∗∗ Apple fixes iOS Kernel zero-day vulnerability on older iPhones ∗∗∗ --------------------------------------------- Apple has published security updates for older iPhones and iPads to backport patches released one week ago, addressing two zero-day vulnerabilities exploited in attacks. --------------------------------------------- https://www.bleepingcomputer.com/news/security/apple-fixes-ios-kernel-zero-… ∗∗∗ Caching-Proxy: 35 Schwachstellen in Squid schon mehr als 2 Jahre ungepatcht ∗∗∗ --------------------------------------------- Anfang 2021 hatte ein Sicherheitsforscher 55 Schwachstellen an das Entwicklerteam von Squid gemeldet. Ein Großteil ist noch offen. --------------------------------------------- https://www.golem.de/news/caching-proxy-35-schwachstellen-in-squid-schon-me… ∗∗∗ Schwere Sicherheitslücken in Monitoring-Software Zabbix behoben ∗∗∗ --------------------------------------------- In verschiedenen Komponenten der Monitoringsoftware Zabbix klafften kritische Sicherheitslücken, die Angreifern die Ausführung eigenen Codes ermöglichen. --------------------------------------------- https://www.heise.de/news/Schwere-Sicherheitsluecken-in-Monitoring-Software… ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (chromium, tomcat9, and webkit2gtk), Fedora (cacti, cacti-spine, grafana-pcp, libcue, mbedtls, samba, and vim), Oracle (kernel, libvpx, and thunderbird), Red Hat (bind and galera, mariadb), SUSE (exiv2, go1.20, go1.21, and kernel), and Ubuntu (ffmpeg). --------------------------------------------- https://lwn.net/Articles/947710/ ∗∗∗ cURL and libcurl Vulnerability Affecting Cisco Products: October 2023 ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ Nextcloud Security Advisory: Improper restriction of excessive authentication attempts on WebDAV endpoint ∗∗∗ --------------------------------------------- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2… ∗∗∗ K000137229 : BIND vulnerability CVE-2022-38178 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000137229 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 12.10.2023
by Daily end-of-shift report 12 Oct '23

12 Oct '23

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 11-10-2023 18:00 − Donnerstag 12-10-2023 18:00 Handler: Thomas Pribitzer Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Well, this SOCKS - curl SOCKS 5 Heap Buffer Overflow (CVE-2023-38545) ∗∗∗ --------------------------------------------- Nachdem letzte Woche ein Advisory zu "der schlimmsten Schwachstelle in curl seit Langem" angekündigt wurde, konnten verängstigte, verschlafene und chronisch unterkoffeinierte Admins und Security-Spezialisten nach der gestrigen Veröffentlichung den Schaden begutachten. Die gute Nachricht: Die Apokalypse ist an uns vorüber gegangen. Die schlechte Nachricht: Mit dem CVSS(v2) Score lässt sich die Schwere einer Schwachstelle nicht immer ausreichend abbilden. --------------------------------------------- https://cert.at/de/blog/2023/10/well-this-socks-curl-socks-5-heap-buffer-ov… ∗∗∗ ToddyCat: Keep calm and check logs ∗∗∗ --------------------------------------------- In this article, we’ll describe ToddyCat new toolset, the malware used to steal and exfiltrate data, and the techniques used by this group to move laterally and conduct espionage operations. --------------------------------------------- https://securelist.com/toddycat-keep-calm-and-check-logs/110696/ ∗∗∗ Malicious NuGet Package Targeting .NET Developers with SeroXen RAT ∗∗∗ --------------------------------------------- A malicious package hosted on the NuGet package manager for the .NET Framework has been found to deliver a remote access trojan called SeroXen RAT. The package, named Pathoschild.Stardew.Mod.Build.Config and published by a user named Disti, is a typosquat of a legitimate package called Pathoschild.Stardew.ModBuildConfig, software supply chain security firm Phylum said in a report today. While the real package has received nearly 79,000 downloads to date, the malicious variant is said to have artificially inflated its download count after being published on October 6, 2023, to surpass 100,000 downloads. --------------------------------------------- https://thehackernews.com/2023/10/malicious-nuget-package-targeting-net.html ∗∗∗ New paper: Nexus Android banking botnet – compromising C&C panels and dissecting mobile AppInjects ∗∗∗ --------------------------------------------- In a new paper, researchers Aditya K Sood and Rohit Bansal provide details of a security vulnerability in the Nexus Android botnet C&C panel that was exploited in order to gather threat intelligence, and present a model of mobile AppInjects. --------------------------------------------- https://www.virusbulletin.com/blog/2023/10/new-paper-nexus-android-banking-… ∗∗∗ Backdoor Malware Found on WordPress Website Disguised as Legitimate Plugin ∗∗∗ --------------------------------------------- A backdoor deployed on a compromised WordPress website poses as a legitimate plugin to hide its presence. --------------------------------------------- https://www.securityweek.com/backdoor-malware-found-on-wordpress-website-di… ∗∗∗ Using Velociraptor for large-scale endpoint visibility and rapid threat hunting ∗∗∗ --------------------------------------------- In this post we give on overview of some of the capabilities of Velociraptor, and also how we have leveraged them to conduct some real-time threat hunting shedding light on how it can equip security teams to proactively safeguard digital environments. --------------------------------------------- https://www.pentestpartners.com/security-blog/using-velociraptor-for-large-… ∗∗∗ Angebliche Branchenbücher und Firmenverzeichnisse locken in teure Abo-Falle! ∗∗∗ --------------------------------------------- Aktuell werden uns zahlreiche unseriöse Branchen-, Adressen- und Firmenverzeichnisse gemeldet, die versuchen Unternehmen das Geld aus der Tasche zu ziehen. Per E-Mail, Telefon oder Fax werden Unternehmen dazu überredet, sich in ein nutzloses und oft gar nicht existierendes Branchenbuch einzutragen. Wer auf das Angebot eingeht, schließt ein überteuertes Abo ab, das nur schwer zu kündigen ist. Betroffen von dieser Abzocke sind vor allem kleine und mittlere Unternehmen. --------------------------------------------- https://www.watchlist-internet.at/news/angebliche-branchenbuecher-und-firme… ∗∗∗ XOR Known-Plaintext Attacks ∗∗∗ --------------------------------------------- In this blog post, we show in detail how a known-plaintext attack on XOR encoding works, and automate it with custom tools to decrypt and extract the configuration of a Cobalt Strike beacon. If you are not interested in the theory, just in the tools, go straight to the conclusion. --------------------------------------------- https://blog.nviso.eu/2023/10/12/xor-known-plaintext-attacks/ ===================== = Vulnerabilities = ===================== ∗∗∗ An analysis of PoS/ cashIT! cash registers ∗∗∗ --------------------------------------------- This report summarizes our findings about vulnerabilities in cashIT!, a cash register system implementing the Austrian cash registers security regulation (RKSV). Besides lack of encryption, outdated software components and low-entropy passwords, these weaknesses include a bypass of origin checks (CVE-2023-3654), unauthenticated remote database exfiltration (CVE-2023-3655), and unauthenticated remote code with administrative privileges on the cash register host machines (CVE-2023-3656). Based on our analysis result, these vulnerabilities affect over 200 cash register installations in Austrian restaurants that are accessible over the Internet. --------------------------------------------- https://epub.jku.at/obvulioa/content/titleinfo/9142358 ∗∗∗ Sicherheitsupdates: Backdoor-Lücke bedroht Netzwerkgeräte von Juniper ∗∗∗ --------------------------------------------- Schwachstellen im Netzwerkbetriebssystem Junos OS bedrohen Routing-, Switching- und Sicherheitsgeräte von Juniper. --------------------------------------------- https://www.heise.de/-9332169 ∗∗∗ 10 zero-day vulnerabilities in industrial cell router could lead to code execution, buffer overflows ∗∗∗ --------------------------------------------- Attackers could exploit these vulnerabilities in the Yifan YF325 to carry out a variety of attacks, in some cases gaining the ability to execute arbitrary shell commands on the targeted device [..] All these vulnerabilities also have a severity score of 9.8. Talos is disclosing these vulnerabilities despite no official patch from Yifan, all in adherence to Cisco’s third-party vendor vulnerability disclosure policy. --------------------------------------------- https://blog.talosintelligence.com/vulnerability-roundup-webkit-and-yifan-r… ∗∗∗ 40 Schwachstellen in IBM-Sicherheitslösung QRadar SIEM geschlossen ∗∗∗ --------------------------------------------- Mehrere Komponenten in IBM QRadar SIEM weisen Sicherheitslücken auf und gefährden das Security-Information-and-Event-Management-System. --------------------------------------------- https://www.heise.de/-9332542 ∗∗∗ Wordfence Intelligence Weekly WordPress Vulnerability Report (October 2, 2023 to October 8, 2023) ∗∗∗ --------------------------------------------- Last week, there were 92 vulnerabilities disclosed in 88 WordPress Plugins and no WordPress themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 37 Vulnerability Researchers that contributed to WordPress Security last week. --------------------------------------------- https://www.wordfence.com/blog/2023/10/wordfence-intelligence-weekly-wordpr… ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (libcue, org-mode, python3.7, and samba), Fedora (libcue, oneVPL, oneVPL-intel-gpu, and xen), Mageia (glibc), Oracle (glibc, kernel, libssh2, libvpx, nodejs, and python-reportlab), Slackware (libcaca), SUSE (gsl, ImageMagick, kernel, opensc, python-urllib3, qemu, rage-encryption, samba, and xen), and Ubuntu (curl and samba). --------------------------------------------- https://lwn.net/Articles/947570/ ∗∗∗ Weintek cMT3000 HMI Web CGI ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-285-12 ∗∗∗ Advantech WebAccess ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-285-15 ∗∗∗ Santesoft Sante FFT Imaging ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-285-02 ∗∗∗ Santesoft Sante DICOM Viewer Pro ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-285-01 ∗∗∗ Mitsubishi Electric MELSEC-F Series ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-285-13 ∗∗∗ Hikvision Access Control and Intercom Products ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-285-14 ∗∗∗ PILZ : WIBU Vulnerabilities in multiple Products ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2023-033/ ∗∗∗ Schneider Electric IGSS ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-285-16 ∗∗∗ Hikvision Access Control and Intercom Products ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-285-14 ∗∗∗ CVE-2023-3281 Cortex XSOAR: Cleartext Exposure of Client Certificate Key in Kafka v3 Integration (Severity: MEDIUM) ∗∗∗ --------------------------------------------- https://security.paloaltonetworks.com/CVE-2023-3281 ∗∗∗ IBM Aspera Faspex has addressed an IP address restriction bypass vulnerability ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7048851 ∗∗∗ Vulnerability of okio-1.13.0.jar is affecting APM WebSphere Application Server Agent, APM Tomcat Agent, APM SAP NetWeaver Java Stack Agent, APM WebLogic Agent and APM Data Collector for J2SE ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7051173 ∗∗∗ IBM App Connect Enterprise is vulnerable to a potential information disclosure ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7051204 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 11.10.2023
by Daily end-of-shift report 11 Oct '23

11 Oct '23

===================== = End-of-Day report = ===================== Timeframe: Dienstag 10-10-2023 18:00 − Mittwoch 11-10-2023 18:00 Handler: Thomas Pribitzer Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Microsoft to kill off VBScript in Windows to block malware delivery ∗∗∗ --------------------------------------------- Microsoft is planning to phase out VBScript in future Windows releases after 30 years of use, making it an on-demand feature until it is removed. --------------------------------------------- https://www.bleepingcomputer.com/news/security/microsoft-to-kill-off-vbscri… ∗∗∗ Microsoft warns of incorrect BitLocker encryption errors ∗∗∗ --------------------------------------------- Microsoft warned customers this week of incorrect BitLocker drive encryption errors being shown in some managed Windows environments. --------------------------------------------- https://www.bleepingcomputer.com/news/microsoft/microsoft-warns-of-incorrec… ∗∗∗ LinkedIn Smart Links attacks return to target Microsoft accounts ∗∗∗ --------------------------------------------- Hackers are once again abusing LinkedIn Smart Links in phishing attacks to bypass protection measures and evade detection in attempts to steal Microsoft account credentials. --------------------------------------------- https://www.bleepingcomputer.com/news/security/linkedin-smart-links-attacks… ∗∗∗ Support-Ende für Windows Server 2012 R2: Warum Sie das nicht ignorieren dürfen ∗∗∗ --------------------------------------------- Ab sofort steht der Windows Server 2012 R2 komplett ohne Support dar. Doch aufgrund seiner Beliebtheit kommt er noch immer zum Einsatz – das muss sich ändern. --------------------------------------------- https://www.heise.de/news/Support-Ende-fuer-Windows-Server-2012-R2-Warum-Si… ∗∗∗ Wireshark Tutorial: Identifying Hosts and Users ∗∗∗ --------------------------------------------- When a host is infected or otherwise compromised, security professionals need to quickly review packet captures of suspicious network traffic to identify affected hosts and users. --------------------------------------------- https://unit42.paloaltonetworks.com/using-wireshark-identifying-hosts-and-u… ∗∗∗ Distribution of Magniber Ransomware Stops (Since August 25th) ∗∗∗ --------------------------------------------- Through a continuous monitoring process, AhnLab Security Emergency response Center (ASEC) is swiftly responding to Magniber, the main malware that is actively being distributed using the typosquatting method which abuses typos in domain addresses. --------------------------------------------- https://asec.ahnlab.com/en/57592/ ∗∗∗ The Risks of Exposing DICOM Data to the Internet ∗∗∗ --------------------------------------------- DICOM has revolutionized the medical imaging industry. However, it also presents potential vulnerabilities when exposed to the open internet. --------------------------------------------- https://www.rapid7.com/blog/post/2023/10/11/the-risks-of-exposing-dicom-dat… ===================== = Vulnerabilities = ===================== ∗∗∗ CVE-2023-38545: curl SOCKS5 oversized hostname vulnerability. How bad is it?, (Wed, Oct 11th) ∗∗∗ --------------------------------------------- Today, we got the promised fix for CVE-2023-38545. So here is a quick overview of how severe it is. --------------------------------------------- https://isc.sans.edu/diary/rss/30304 ∗∗∗ Patchday Microsoft: Attacken auf Skype for Business und WordPad ∗∗∗ --------------------------------------------- Microsoft hat wichtige Sicherheitsupdates für etwa Azure, Office und Windows veröffentlicht. --------------------------------------------- https://www.heise.de/news/Patchday-Microsoft-Attacken-auf-Skype-for-Busines… ∗∗∗ Patchday Adobe: Schadcode-Attacken auf Magento-Shops und Photoshop möglich ∗∗∗ --------------------------------------------- Die Entwickler von Adobe haben in Bridge, Commerce, Magento Open Source und Photoshop mehrere Sicherheitslücken geschlossen. --------------------------------------------- https://www.heise.de/news/Patchday-Adobe-Schadcode-Attacken-auf-Magento-Sho… ∗∗∗ Webbrowser: Google-Chrome-Update schließt kritische Sicherheitslücke ∗∗∗ --------------------------------------------- Google hat das wöchentliche Chrome-Update herausgegeben. Es schließt 20 Sicherheitslücken, von denen mindestens eine als kritisch gilt. --------------------------------------------- https://www.heise.de/news/Webbrowser-Google-Chrome-Update-schliesst-kritisc… ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (curl, mediawiki, tomcat10, and tomcat9), Fedora (libcaca, oneVPL, oneVPL-intel-gpu, and tracker-miners), Gentoo (curl), Mageia (cups and firefox, thunderbird), Red Hat (curl, kernel, kernel-rt, kpatch-patch, libqb, libssh2, linux-firmware, python-reportlab, tar, and the virt:rhel module), Slackware (curl, libcue, libnotify, nghttp2, and samba), SUSE (conmon, curl, glibc, kernel, php-composer2, python-reportlab, samba, and shadow), [...] --------------------------------------------- https://lwn.net/Articles/947409/ ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ Sicherheitsupdates Fortinet: Angreifer können Passwörter im Klartext einsehen ∗∗∗ --------------------------------------------- https://www.heise.de/news/Sicherheitsupdates-Fortinet-Angreifer-koennen-Pas… ∗∗∗ K000137202 : Intel BIOS vulnerability CVE-2022-38083 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000137202 ∗∗∗ Lenovo System Update Vulnerability ∗∗∗ --------------------------------------------- http://support.lenovo.com/product_security/PS500581-LENOVO-SYSTEM-UPDATE-VU… ∗∗∗ Lenovo View Denial of Service Vulnerability ∗∗∗ --------------------------------------------- http://support.lenovo.com/product_security/PS500580-LENOVO-VIEW-DENIAL-OF-S… ∗∗∗ Multi-vendor BIOS Security Vulnerabilities (October 2023) ∗∗∗ --------------------------------------------- http://support.lenovo.com/product_security/PS500582-MULTI-VENDOR-BIOS-SECUR… ∗∗∗ Lenovo Preload Directory Vulnerability ∗∗∗ --------------------------------------------- http://support.lenovo.com/product_security/PS500579-LENOVO-PRELOAD-DIRECTOR… ∗∗∗ [R1] Security Center Version 6.2.0 Fixes Multiple Vulnerabilities ∗∗∗ --------------------------------------------- https://www.tenable.com/security/tns-2023-32 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 10.10.2023
by Daily end-of-shift report 10 Oct '23

10 Oct '23

===================== = End-of-Day report = ===================== Timeframe: Montag 09-10-2023 18:00 − Dienstag 10-10-2023 18:00 Handler: Michael Schlagenhaufer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Patch Now: Massive RCE Campaign Wrangles Routers Into Botnet ∗∗∗ --------------------------------------------- Thousands of devices, including D-Link and Zyxel gear, remain vulnerable to takeover despite the availability of patches for the several bugs being exploited by IZ1H9 campaign. --------------------------------------------- https://www.darkreading.com/cloud/patch-now-massive-rce-campaign-d-link-zyx… ∗∗∗ Over 17,000 WordPress sites hacked in Balada Injector attacks last month ∗∗∗ --------------------------------------------- Multiple Balada Injector campaigns have compromised and infected over 17,000 WordPress sites using known flaws in premium theme plugins. --------------------------------------------- https://www.bleepingcomputer.com/news/security/over-17-000-wordpress-sites-… ∗∗∗ The Art of Concealment: A New Magecart Campaign That’s Abusing 404 Pages ∗∗∗ --------------------------------------------- A new, sophisticated, and covert Magecart web skimming campaign has been targeting Magento and WooCommerce websites. --------------------------------------------- https://www.akamai.com/blog/security-research/magecart-new-technique-404-pa… ∗∗∗ Inzwischen vorhanden: Details zu gefixten Lücken in iOS 17 und Co. ∗∗∗ --------------------------------------------- Als iOS 17, iPadOS 17, watchOS 10 und tvOS 17 erschienen, machte Apple keine Angaben zu enthaltenen Sicherheitspatches. Mittlerweile lassen sie sich einsehen. --------------------------------------------- https://www.heise.de/-9319162 ∗∗∗ ‘HTTP/2 Rapid Reset’ Zero-Day Exploited to Launch Largest DDoS Attacks in History ∗∗∗ --------------------------------------------- Cloudflare, Google and AWS revealed on Tuesday that a new zero-day vulnerability named ‘HTTP/2 Rapid Reset’ has been exploited by malicious actors to launch the largest distributed denial-of-service (DDoS) attacks in internet history. --------------------------------------------- https://www.securityweek.com/rapid-reset-zero-day-exploited-to-launch-large… ∗∗∗ Take a note of SpyNote! ∗∗∗ --------------------------------------------- Among noteworthy spyware, one that has been in the limelight recently is SpyNote. This spyware app spreads via smishing (i.e. malicious SMS messages) by urging the victims to install the app from provided links. Naturally, the hosting and downloading happen outside of the official Play Store app, to prevent the security evaluation done by Google Play Store from thwarting the spread of this spyware. --------------------------------------------- https://blog.f-secure.com/take-a-note-of-spynote/ ∗∗∗ Android-Geräte ab Werk mit Malware infiziert ∗∗∗ --------------------------------------------- Settop-Boxen mit bestimmten Chipsätzen von Allwinner und Rockchip enthalten den Trojaner Badbox. Der zeigt unterwünschte Werbung an und verbreitet schädliche Apps. --------------------------------------------- https://www.zdnet.de/88412275/android-geraete-ab-werk-mit-malware-infiziert/ ∗∗∗ Infostealer with Abnormal Certificate Being Distributed ∗∗∗ --------------------------------------------- Recently, there has been a high distribution rate of malware using abnormal certificates. Malware often disguise themselves with normal certificates. However, in this case, the malware entered the certificate information randomly, with the Subject Name and Issuer Name fields having unusually long strings. As a result, the certificate information is not visible in Windows operating systems, and a specific tool or infrastructure is required to inspect the structure of these certificates. --------------------------------------------- https://asec.ahnlab.com/en/57553/ ∗∗∗ CISA, Government, and Industry Partners Publish Fact Sheet for Organizations Using Open Source Software ∗∗∗ --------------------------------------------- This guidance is intended to assist both senior leadership and operations personnel at OT/ICS vendors and critical infrastructure entities with better management of risk from OSS use in OT/ICS products, to include software supply chain, and increase resilience using available resources. --------------------------------------------- https://www.cisa.gov/news-events/news/cisa-government-and-industry-partners… ===================== = Vulnerabilities = ===================== ∗∗∗ Per SSID: Schwachstelle in D-Link-Repeater erlaubt Codeausführung ∗∗∗ --------------------------------------------- Beim Netzwerk-Scan des D-Link DAP-X1860 kann es zu einer unerwünschten Codeausführung kommen. Über spezielle SSIDs sind Angriffe möglich. --------------------------------------------- https://www.golem.de/news/per-ssid-schwachstelle-in-d-link-repeater-erlaubt… ∗∗∗ Siemens Security Advisories 2023-10-10 ∗∗∗ --------------------------------------------- SSA-843070: SCALANCE W1750D, SSA-829656: Xpedition Layout Browser, SSA-784849: SIMATIC CP Devices, SSA-770890: SICAM A8000 Devices, SSA-647455: RUGGEDCOM APE1808 devices, SSA-594373: SINEMA Server V14, SSA-524778: Tecnomatix Plant Simulation, SSA-386812: Simcenter Amesim before V2021.1, SSA-295483: Mendix, SSA-160243: SINEC NMS before V2.0, SSA-134651: SICAM A8000 Devices, SSA-035466: SICAM PAS/PQS --------------------------------------------- https://www.siemens.com/global/en/products/services/cert.html#SecurityPubli… ∗∗∗ Backup: Acronis schließt Sicherheitslücken im Agent für Linux, Mac und Windows ∗∗∗ --------------------------------------------- Acronis hat eine Aktualisierung des Agent für Linux, Mac und Windows veröffentlicht. Sie dichtet unter anderem ein Leck mit hohem Risiko ab. --------------------------------------------- https://www.heise.de/-9329516 ∗∗∗ Sicherheitsupdates: Schadcode- und Root-Lücken bedrohen IBM-Software ∗∗∗ --------------------------------------------- IBM hat unter anderem im Datenbankmanagementsystem Db2 schwerwiegende Schwachstellen geschlossen. --------------------------------------------- https://www.heise.de/-9329404 ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Fedora (chromium, firefox, and kernel), Gentoo (less and libcue), Red Hat (bind, libvpx, nodejs, and python3), Scientific Linux (firefox and thunderbird), SUSE (conmon, go1.20, go1.21, shadow, and thunderbird), and Ubuntu (libcue, ring, and ruby-kramdown). --------------------------------------------- https://lwn.net/Articles/947233/ ∗∗∗ One-Click GNOME Exploit Could Pose Serious Threat to Linux Systems ∗∗∗ --------------------------------------------- A one-click exploit targeting the Libcue component of the GNOME desktop environment could pose a serious threat to Linux systems. --------------------------------------------- https://www.securityweek.com/one-click-gnome-exploit-could-pose-serious-thr… ∗∗∗ SAP Releases 7 New Notes on October 2023 Patch Day ∗∗∗ --------------------------------------------- SAP has released seven new notes as part of its October 2023 Security Patch Day, all rated ‘medium severity’. --------------------------------------------- https://www.securityweek.com/sap-releases-7-new-notes-on-october-2023-patch… ∗∗∗ Unverschlüsselte Bluetoothverbindung bei Smartwatch Amazfit Bip U (SYSS-2023-022) ∗∗∗ --------------------------------------------- Die Smartwatch Amazfit Bip U kommuniziert unverschlüsselt mit dem verbundenen Smartphone. Alle Nachrichten können daher von Angreifenden abgehört werden. --------------------------------------------- https://www.syss.de/pentest-blog/unverschluesselte-bluetoothverbindung-bei-… ∗∗∗ Ivanti Endpoint Manager new vulnerabilities ∗∗∗ --------------------------------------------- There are two vulnerabilities we have recently discovered that impact Ivanti Endpoint Manager (EPM) versions 2022 and below. They both have CVSS scores in the ‘Moderate’ range. We are reporting them as CVE-2023-35083 and CVE-2023-35084. --------------------------------------------- https://www.ivanti.com/blog/ivanti-endpoint-manager-new-vulnerabilities ∗∗∗ F5 BIG-IP Security Advisories 2023-10-10 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/new-updated-articles#sort=%40f5_updated_publishe… ∗∗∗ Xen Security Advisories ∗∗∗ --------------------------------------------- https://xenbits.xen.org/xsa/ ∗∗∗ Citrix NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2023-4966 and CVE-2023-4967 ∗∗∗ --------------------------------------------- https://support.citrix.com/article/CTX579459/netscaler-adc-and-netscaler-ga… ∗∗∗ Citrix Hypervisor Multiple Security Updates ∗∗∗ --------------------------------------------- https://support.citrix.com/article/CTX575089/citrix-hypervisor-multiple-sec… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 09.10.2023
by Daily end-of-shift report 09 Oct '23

09 Oct '23

===================== = End-of-Day report = ===================== Timeframe: Freitag 06-10-2023 18:00 − Montag 09-10-2023 18:00 Handler: Thomas Pribitzer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ HelloKitty ransomware source code leaked on hacking forum ∗∗∗ --------------------------------------------- A threat actor has leaked the complete source code for the first version of the HelloKitty ransomware on a Russian-speaking hacking forum, claiming to be developing a new, more powerful encryptor. --------------------------------------------- https://www.bleepingcomputer.com/news/security/hellokitty-ransomware-source… ∗∗∗ High-Severity Flaws in ConnectedIOs 3G/4G Routers Raise Concerns for IoT Security ∗∗∗ --------------------------------------------- Multiple high-severity security vulnerabilities have been disclosed in ConnectedIOs ER2000 edge routers and the cloud-based management platform that could be exploited by malicious actors to execute malicious code and access sensitive data. --------------------------------------------- https://thehackernews.com/2023/10/high-severity-flaws-in-connectedios.html ∗∗∗ Turn OFF This WatchGuard Feature - GuardLapse ∗∗∗ --------------------------------------------- Picture this: a feature from a security appliance that willingly dispatches its password hashes to any device on the network. That is precisely what WatchGuards SSO does under certain circumstances. --------------------------------------------- https://projectblack.io/blog/turn-off-this-watchguard-feature-guardlapse/ ∗∗∗ Amazon Prime email scammer snatches defeat from the jaws of victory ∗∗∗ --------------------------------------------- A very convincing Amazon Prime scam landed in our mail server today and...went straight to spam. Heres why. --------------------------------------------- https://www.malwarebytes.com/blog/news/2023/10/amazon-prime ∗∗∗ Credential Harvesting Campaign Targets Unpatched NetScaler Instances ∗∗∗ --------------------------------------------- Threat actors are targeting Citrix NetScaler instances unpatched against CVE-2023-3519 to steal user credentials. --------------------------------------------- https://www.securityweek.com/credential-harvesting-campaign-targets-unpatch… ∗∗∗ The reality of Apple watch pen testing ∗∗∗ --------------------------------------------- We were approached to do an Apple Watch application test. It seems this isn’t a standard service offered by most companies (including us, although we’ve done plenty of work [...] --------------------------------------------- https://www.pentestpartners.com/security-blog/the-reality-of-apple-watch-pe… ∗∗∗ Immer wieder Abo-Fallen bei IQ-Tests wie auf iq-fast.com/de! ∗∗∗ --------------------------------------------- Wer einen IQ-Test durchführen möchte, findet im Internet unzählige Angebote dafür. Auch iq-fast.com/de lockt mit einem entsprechenden Test auf die eigene Website. Abgesehen von der minderwertigen Qualität des dort angebotenen Tests, der lediglich aus 20 Fragen besteht, führt eine Eingabe der Kreditkartendaten nicht zum Erhalt sinnvoller Ergebnisse, sondern in eine Abo-Falle! --------------------------------------------- https://www.watchlist-internet.at/news/immer-wieder-abo-fallen-bei-iq-tests… ∗∗∗ Fake friends and followers on social media – and how to spot them ∗∗∗ --------------------------------------------- One of the biggest threats to watch out for on social media is fraud perpetrated by people who aren’t who they claim to be. Here’s how to recognize them. --------------------------------------------- https://www.welivesecurity.com/en/social-media/fake-friends-followers-socia… ∗∗∗ Android TV Boxes Infected with Backdoors, Compromising Home Networks ∗∗∗ --------------------------------------------- The Android TV box you recently purchased may be riddled with harmful backdoors. --------------------------------------------- https://www.hackread.com/android-tv-boxes-backdoors-home-networks/ ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (freerdp2, gnome-boxes, grub2, inetutils, lemonldap-ng, prometheus-alertmanager, python-urllib3, thunderbird, and vinagre), Fedora (freeimage, fwupd, libspf2, mingw-freeimage, thunderbird, and vim), Gentoo (c-ares, dav1d, Heimdal, man-db, and Oracle VirtualBox), Oracle (bind, bind9.16, firefox, ghostscript, glibc, ImageMagick, and thunderbird), Slackware (netatalk), SUSE (ImageMagick, nghttp2, poppler, python, python-gevent, and yq), and Ubuntu (bind9 and vim). --------------------------------------------- https://lwn.net/Articles/947117/ ∗∗∗ Vulnerabilities in Music Station ∗∗∗ --------------------------------------------- Two path traversal vulnerabilities have been reported to affect Music Station. --------------------------------------------- https://www.qnap.com/en-us/security-advisory/QSA-23-28 ∗∗∗ Vulnerabilities in ClamAV ∗∗∗ --------------------------------------------- Multiple vulnerabilities have been reported in ClamAV. --------------------------------------------- https://www.qnap.com/en-us/security-advisory/QSA-23-26 ∗∗∗ Vulnerability in QTS, QuTS hero, and QuTScloud ∗∗∗ --------------------------------------------- A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating systems. --------------------------------------------- https://www.qnap.com/en-us/security-advisory/QSA-23-37 ∗∗∗ Vulnerability in QVPN Device Client for Windows ∗∗∗ --------------------------------------------- An insufficiently protected credentials vulnerability has been reported to affect QVPN Device Client for Windows. --------------------------------------------- https://www.qnap.com/en-us/security-advisory/QSA-23-36 ∗∗∗ Vulnerability in QVPN Device Client for Windows ∗∗∗ --------------------------------------------- A cleartext transmission of sensitive information vulnerability has been reported to affect QVPN Device Client for Windows. --------------------------------------------- https://www.qnap.com/en-us/security-advisory/QSA-23-39 ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 06.10.2023
by Daily end-of-shift report 06 Oct '23

06 Oct '23

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 05-10-2023 18:00 − Freitag 06-10-2023 18:00 Handler: Stephan Richter Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Exploits released for Linux flaw giving root on major distros ∗∗∗ --------------------------------------------- Proof-of-concept exploits have already surfaced online for a high-severity flaw in GNU C Librarys dynamic loader, allowing local attackers to gain root privileges on major Linux distributions. --------------------------------------------- https://www.bleepingcomputer.com/news/security/exploits-released-for-linux-… ∗∗∗ Jetzt patchen! Exploits für glibc-Lücke öffentlich verfügbar ∗∗∗ --------------------------------------------- Nachdem der Bug in der Linux-Bibliothek glibc am vergangenen Dienstag bekannt wurde, sind nun zuverlässig funktionierende Exploits aufgetaucht. --------------------------------------------- https://www.heise.de/-9326518 ∗∗∗ Finanzbetrug per Telefon: Ignorieren Sie Anrufer:innen, die Sie zu Investitionen überreden wollen ∗∗∗ --------------------------------------------- Finanzbetrug ist ein lukratives Geschäft. Der finanzielle Schaden für die Betroffenen ist oft enorm. Gleichzeitig ist der Finanzmarkt streng reguliert, um Betrug in diesem Bereich zu erschweren. Das ist mit ein Grund, wieso Betrüger:innen immer wieder neue Wege finden, um an ihre Opfer zu kommen. Aktuell berichten unsere Leser:innen vermehrt davon, dass sie von Kriminellen angerufen und direkt am Telefon zu Investments überredet werden. --------------------------------------------- https://www.watchlist-internet.at/news/finanzbetrug-per-telefon-ignorieren-… ∗∗∗ Leveraging a Hooking Framework to Expand Malware Detection Coverage on the Android Platform ∗∗∗ --------------------------------------------- In this article, we will discuss this issue of how malware authors use obfuscation to make analyzing their Android malware more challenging. We will review two such case studies to illustrate those obfuscation techniques in action. Finally, we’ll cover some overall techniques researchers can use to address these obstacles. --------------------------------------------- https://unit42.paloaltonetworks.com/hooking-framework-in-sandbox-to-analyze… ∗∗∗ Microsoft: Human-operated ransomware attacks tripled over past year ∗∗∗ --------------------------------------------- Human-operated ransomware attacks are up more than 200% since September 2022, according to researchers from Microsoft, who warned that it could represent a shift in the cybercrime underground. --------------------------------------------- https://therecord.media/human-operated-ransomware-attacks-report-microsoft ∗∗∗ New tool: le-hex-to-ip.py, (Thu, Oct 5th) ∗∗∗ --------------------------------------------- So, this week it is my privilege to be TA-ing for Taz Wake for the beta run of his new class FOR577: Linux Incident Response and Threat Hunting. We were looking in the linux /proc filesystem and were noticing in the /proc//net/{tcp/udp/icmp/...} that the IP addresses were listed in hex, but little-endian. I immediately remembered Didier's Handler's Diary from last week about the IPs in the event logs that were in decimal and little endian. --------------------------------------------- https://isc.sans.edu/diary/rss/30284 ∗∗∗ NSA and CISA Red and Blue Teams Share Top Ten Cybersecurity Misconfigurations ∗∗∗ --------------------------------------------- The National Security Agency (NSA) and Cybersecurity and Infrastructure Security Agency (CISA) are releasing this joint cybersecurity advisory (CSA) to highlight the most common cybersecurity misconfigurations in large organizations, and detail the tactics, techniques, and procedures (TTPs) actors use to exploit these misconfigurations. --------------------------------------------- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-278a ===================== = Vulnerabilities = ===================== ∗∗∗ Sicherheitsupdate: Root-Lücke bedroht Dell SmartFabric Storage Software ∗∗∗ --------------------------------------------- Dell hat mehrere gefährliche Sicherheitslücken in SmartFabric Storage Software geschlossen. --------------------------------------------- https://www.heise.de/-9326738 ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (grub2, libvpx, libx11, libxpm, and qemu), Fedora (firefox, matrix-synapse, tacacs, thunderbird, and xrdp), Oracle (glibc), Red Hat (bind, bind9.16, firefox, frr, ghostscript, glibc, ImageMagick, libeconf, python3.11, python3.9, and thunderbird), Scientific Linux (ImageMagick), SUSE (kernel, libX11, and tomcat), and Ubuntu (linux-hwe-5.15, linux-oracle-5.15). --------------------------------------------- https://lwn.net/Articles/946848/ ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 05.10.2023
by Daily end-of-shift report 05 Oct '23

05 Oct '23

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 04-10-2023 18:00 − Donnerstag 05-10-2023 18:00 Handler: Thomas Pribitzer Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Curl 8.4.0 is to be released on October 11th ... ∗∗∗ --------------------------------------------- ... containing a fix for "the worst security problem found in curl in a long time". The associated CVE is expected to be published shortly after. Use the time to check where you have #curl & #libcurl in your environment. --------------------------------------------- https://twitter.com/pyotam2/status/1709305830573473987 ∗∗∗ Jetzt patchen! Confluence Data Center: Angreifer machen sich zu Admins ∗∗∗ --------------------------------------------- Atlassian hat eine kritische Sicherheitslücke in Confluence Data Center und Server geschlossen. --------------------------------------------- https://www.heise.de/-9325414 ∗∗∗ Lorenz ransomware crew bungles blackmail blueprint by leaking two years of contacts ∗∗∗ --------------------------------------------- A security researcher noticed Lorenz's dark web victim blog was leaking backend code, pulled the data from the site, and uploaded to it a public GitHub repository. The data includes names, email addresses, and the subject line entered into the ransomware group's limited online form to request information from Lorenz. --------------------------------------------- https://go.theregister.com/feed/www.theregister.com/2023/10/05/lorenz_ranso… ∗∗∗ The discovery of Gatekeeper bypass CVE-2023-27943 ∗∗∗ --------------------------------------------- Looking for vulnerabilities is not my usual daily routine. I am a software developer for Endpoint Security software. I implement new features, improve existing functionality, fixing bugs. So, the discovery of this vulnerability was a surprise. And it made me scared that a macOS update broke our product. In the end, it turned out to be quite a severe vulnerability on macOS. --------------------------------------------- https://blog.f-secure.com/discovery-of-gatekeeper-bypass-cve-2023-27943/ ∗∗∗ H1 2023 – a brief overview of main incidents in industrial cybersecurity ∗∗∗ --------------------------------------------- In this overview, we discuss cybercriminal and hacktivist attacks on industrial organizations. --------------------------------------------- https://ics-cert.kaspersky.com/publications/h1-2023-a-brief-overview-of-mai… ∗∗∗ Looking at the Attack Surface of the Sony XAV-AX5500 Head Unit ∗∗∗ --------------------------------------------- In this post, we look at the attack surface of another target in a different category. The Sony XAV-AX5500 is a popular aftermarket head unit that interacts with different systems within a vehicle. It also offers attackers a potential foothold into an automobile. --------------------------------------------- https://www.thezdi.com/blog/2023/10/5/looking-at-the-attack-surface-of-the-… ∗∗∗ Exposing Infection Techniques Across Supply Chains and Codebases ∗∗∗ --------------------------------------------- This entry delves into threat actors intricate methods to implant malicious payloads within seemingly legitimate applications and codebases. --------------------------------------------- https://www.trendmicro.com/en_us/research/23/j/infection-techniques-across-… ∗∗∗ Your printer is not your printer ! - Hacking Printers at Pwn2Own Part I ∗∗∗ --------------------------------------------- At 2021, we found Pre-auth RCE vulnerabilities(CVE-2022-24673 and CVE-2022-3942) in Canon and HP printers, and vulnerabilty(CVE-2021-44734) in Lexmark. We used these vulnerabilities to exploit Canon ImageCLASS MF644Cdw, HP Color LaserJet Pro MFP M283fdw and Lexmark MC3224i in Pwn2Own Austin 2021. Following we will describe the details of the Canon and HP vulnerabilities and exploitation. --------------------------------------------- https://devco.re/blog/2023/10/05/your-printer-is-not-your-printer-hacking-p… ∗∗∗ EvilProxy Phishing Kit Targets Microsoft Users via Indeed.com Vulnerability ∗∗∗ --------------------------------------------- Threat actors are exploiting the open redirection vulnerability on Indeed.com to launch EvilProxy phishing attacks against high-ranking executives. --------------------------------------------- https://www.hackread.com/evilproxy-phishing-kit-microsoft-indeed-vulnerabil… ∗∗∗ CISA and NSA Release New Guidance on Identity and Access Management ∗∗∗ --------------------------------------------- Today, CISA and the National Security Agency (NSA) published Identity and Access Management: Developer and Vendor Challenges, authored by the Enduring Security Framework (ESF), a CISA- and NSA-led working panel that includes a public-private cross-sector partnership. ESF aims to address risks that threaten critical infrastructure and national security systems. --------------------------------------------- https://www.cisa.gov/news-events/alerts/2023/10/04/cisa-and-nsa-release-new… ∗∗∗ Notruf-Tool Cisco Emergency Responder mit statischen Zugangsdaten ∗∗∗ --------------------------------------------- Der Netzwerkausrüster Cisco hat für mehrere Produkte wichtige Sicherheitsupdates veröffentlicht. --------------------------------------------- https://www.heise.de/-9325669 ===================== = Vulnerabilities = ===================== ∗∗∗ Cisco Security Advisories 2023-10-04 ∗∗∗ --------------------------------------------- Cisco has published 3 Security Advisories (1 Critical, 1 High, 1 Medium Severity) --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/Search.x?publicationTypeIDs… ∗∗∗ (0Day) D-Link ∗∗∗ --------------------------------------------- ZDI-23-1501 - ZDI-23-1525: Multiple Routers, DIR-X3260, DAP-2622, DAP-1325 and D-View --------------------------------------------- https://www.zerodayinitiative.com/advisories/published/ ∗∗∗ Wieder Exploit-Update für iOS und iPadOS – das wohl auch Hitzeproblem fixt ∗∗∗ --------------------------------------------- Apple hat in der Nacht zum Donnerstag erneut wichtige Fixes für sein iPhone- und iPad-Betriebssystem vorgelegt. Es geht um Sicherheit und Überhitzung. --------------------------------------------- https://www.heise.de/-9325367 ∗∗∗ Malware-Schutz: Schwachstellen in Watchguard EPDR und AD360 geschlossen ∗∗∗ --------------------------------------------- In den Malware-Schutzlösungen Watchguard EPDR und AD360 klaffen teils Sicherheitslücken mit hohem Risiko. Aktualisierungen stehen bereit. --------------------------------------------- https://www.heise.de/-9326078 ∗∗∗ Wordfence Intelligence Weekly WordPress Vulnerability Report (September 25, 2023 to October 1, 2023) ∗∗∗ --------------------------------------------- Last week, there were 90 vulnerabilities disclosed in 68 WordPress Plugins and no WordPress themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 31 Vulnerability Researchers that contributed to WordPress Security last week. --------------------------------------------- https://www.wordfence.com/blog/2023/10/wordfence-intelligence-weekly-wordpr… ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (chromium, libx11, and libxpm), Fedora (ckeditor, drupal7, glibc, golang-github-cncf-xds, golang-github-envoyproxy-control-plane, golang-github-hashicorp-msgpack, golang-github-minio-highwayhash, golang-github-nats-io, golang-github-nats-io-jwt-2, golang-github-nats-io-nkeys, golang-github-nats-io-streaming-server, golang-github-protobuf, golang-google-protobuf, nats-server, and pgadmin4), Red Hat (firefox and thunderbird), SUSE (chromium, exim, ghostscript, kernel, poppler, python-gevent, and python-reportlab), and Ubuntu (binutils, exim4, jqueryui, linux, linux-aws, linux-aws-5.15, linux-azure, linux-azure-5.15, linux-azure-fde, linux-azure-fde-5.15, linux-gcp, linux-gcp-5.15, linux-gke, linux-gkeop, linux-gkeop-5.15, linux-ibm, linux-ibm-5.15, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, linux-oracle, linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-bluefield, linux-gcp, linux-gcp-5.4, linux-gkeop, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-iot, linux-kvm, linux-oracle, linux-oracle-5.4, linux-raspi, linux-raspi-5.4, linux-xilinx-zynqmp, linux, linux-aws, linux-aws-6.2, linux-azure, linux-azure-6.2, linux-azure-fde-6.2, linux-gcp, linux-gcp-6.2, linux-hwe-6.2, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-6.2, linux-oracle, linux-raspi, linux-starfive, linux-kvm, linux-oem-6.1, nodejs, and python-django). --------------------------------------------- https://lwn.net/Articles/946698/ ∗∗∗ ZDI-23-1498: Ansys SpaceClaim X_B File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-23-1498/ ∗∗∗ Open Redirect in SAP® BSP Test Application it00 (Bypass for CVE-2020-6215 Patch) ∗∗∗ --------------------------------------------- https://sec-consult.com/vulnerability-lab/advisory/open-redirect-in-bsp-tes… ∗∗∗ Qognify NiceVision ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-278-02 ∗∗∗ Mitsubishi Electric CC-Link IE TSN Industrial Managed Switch ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-278-03 ∗∗∗ Hitachi Energy AFS65x, AFF66x, AFS67x, and AFR67x Series Products ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-278-01 ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 04.10.2023
by Daily end-of-shift report 04 Oct '23

04 Oct '23

===================== = End-of-Day report = ===================== Timeframe: Dienstag 03-10-2023 18:00 − Mittwoch 04-10-2023 18:00 Handler: Thomas Pribitzer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Sicherheitswarnung: Schwachstellen in Qualcomm-Treibern werden aktiv ausgenutzt ∗∗∗ --------------------------------------------- Mehrere Schwachstellen in Qualcomm-Treibern gefährden Smartphones und Tablets weltweit. Patches sind vorhanden - zumindest bei den Herstellern. --------------------------------------------- https://www.golem.de/news/sicherheitswarnung-schwachstellen-in-qualcomm-tre… ∗∗∗ Looney Tunables: Schwachstelle in C-Bibliothek gefährdet Linux-Systeme ∗∗∗ --------------------------------------------- Eine Pufferüberlauf-Schwachstelle im dynamischen Lader von glibc ermöglicht es Angreifern, auf Linux-Systemen Root-Rechte zu erlangen. --------------------------------------------- https://www.golem.de/news/looney-tunables-schwachstelle-in-c-bibliothek-gef… ∗∗∗ Defending new vectors: Threat actors attempt SQL Server to cloud lateral movement ∗∗∗ --------------------------------------------- Microsoft security researchers recently identified an attack where attackers attempted to move laterally to a cloud environment through a SQL Server instance. The attackers initially exploited a SQL injection vulnerability in an application within the target’s environment to gain access and elevated permissions to a Microsoft SQL Server instance deployed in an Azure Virtual Machine (VM). --------------------------------------------- https://www.microsoft.com/en-us/security/blog/2023/10/03/defending-new-vect… ∗∗∗ Optimizing WordPress: Security Beyond Default Configurations ∗∗∗ --------------------------------------------- Default configurations in software are not always the most secure. For example, you might buy a network-attached home security camera from your friendly neighborhood electronics store. While these are handy to keep an eye on your property from the comfort of your phone, they also typically come shipped with a default username and password. And since they are connected to the web, they can be accessed from anywhere. Attackers know this, [...] --------------------------------------------- https://blog.sucuri.net/2023/10/optimizing-wordpress-security-beyond-defaul… ∗∗∗ Warning: PyTorch Models Vulnerable to Remote Code Execution via ShellTorch ∗∗∗ --------------------------------------------- Cybersecurity researchers have disclosed multiple critical security flaws in the TorchServe tool for serving and scaling PyTorch models that could be chained to achieve remote code execution on affected systems. Israel-based runtime application security company Oligo, which made the discovery, has coined the vulnerabilities ShellTorch. "These vulnerabilities [...] can lead to a full chain Remote Code Execution (RCE), leaving countless thousands of services and end-users — including some of the world's largest companies — open to unauthorized access and insertion of malicious AI models, and potentially a full server takeover," [...] --------------------------------------------- https://thehackernews.com/2023/10/warning-pytorch-models-vulnerable-to.html ∗∗∗ Patchday: Attacken auf Android 11, 12 und 13 beobachtet ∗∗∗ --------------------------------------------- Unter anderem Google hat wichtige Sicherheitsupdates für Android-Geräte veröffentlicht. Zwei Lücken haben Angreifer bereits im Visier. --------------------------------------------- https://www.heise.de/-9324125.html ∗∗∗ Linux tries to dump Windows notoriously insecure RNDIS protocol ∗∗∗ --------------------------------------------- Here we go again. Linux developers are trying, once more, to rid Linux of Microsofts Remote Network Driver Interface Specification. Heres why its complicated. --------------------------------------------- https://www.zdnet.com/home-and-office/networking/linux-tries-to-dump-window… ∗∗∗ Five Misconfigurations Threatening Your AWS Environment Today ∗∗∗ --------------------------------------------- In the ever-expanding realm of AWS, with over 200 services at your disposal, securing your cloud account configurations and mastering complex environments can feel like an overwhelming challenge. To help you prioritize and root them out, we’ve put together a guide for AWS configurations that are most commonly overlooked. Here are five of the top misconfigurations that could be lurking in your AWS environment right now. --------------------------------------------- https://blog.aquasec.com/five-misconfigurations-threatening-your-aws-enviro… ===================== = Vulnerabilities = ===================== ∗∗∗ CVE-2023-22515 - Privilege Escalation Vulnerability in Confluence Data Center and Server ∗∗∗ --------------------------------------------- Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances. --------------------------------------------- https://confluence.atlassian.com/security/cve-2023-22515-privilege-escalati… ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (glibc, postgresql-11, and thunderbird), Fedora (openmpi, pmix, prrte, and slurm), Gentoo (glibc and libvpx), Oracle (kernel), Red Hat (kernel), Slackware (libX11 and libXpm), SUSE (firefox, kernel, libeconf, libqb, libraw, libvpx, libX11, libXpm, mdadm, openssl-1_1, poppler, postfix, python311, rubygem-puma, runc, and vim), and Ubuntu (freerdp2, glibc, grub2-signed, grub2-unsigned, libx11, libxpm, linux-intel-iotg, linux-intel-iotg-5.15, linux-oracle, linux-oracle-5.15, and mozjs102). --------------------------------------------- https://lwn.net/Articles/946496/ ∗∗∗ New Supermicro BMC Vulnerabilities Could Expose Many Servers to Remote Attacks ∗∗∗ --------------------------------------------- Supermicro has released BMC IPMI firmware updates to address multiple vulnerabilities impacting select motherboard models. --------------------------------------------- https://www.securityweek.com/new-supermicro-bmc-vulnerabilities-could-expos… ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 03.10.2023
by Daily end-of-shift report 03 Oct '23

03 Oct '23

===================== = End-of-Day report = ===================== Timeframe: Montag 02-10-2023 18:00 − Dienstag 03-10-2023 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ AVM: Fritzbox-Schwachstelle wohl ohne Fernzugriff ausnutzbar ∗∗∗ --------------------------------------------- Seit Anfang September verteilt AVM Sicherheitsupdates für die Fritzbox. Inzwischen gibt es weitere Informationen zur gepatchten Schwachstelle. --------------------------------------------- https://www.golem.de/news/avm-fritzbox-schwachstelle-wohl-ohne-fernzugriff-… ∗∗∗ Exclusive: Lighting the Exfiltration Infrastructure of a LockBit Affiliate (and more) ∗∗∗ --------------------------------------------- Researchers have identified the exfiltration infrastructure of a LockBit affiliate while investigating a LockBit extortion incident that occurred in Q3 2023. --------------------------------------------- https://securityaffairs.com/151862/breaking-news/exfiltration-infrastructur… ∗∗∗ BunnyLoader, a new Malware-as-a-Service advertised in cybercrime forums ∗∗∗ --------------------------------------------- Zscaler ThreatLabz researchers discovered a new malware-as-a-service (MaaS) that is called BunnyLoader, which has been advertised for sale in multiple cybercrime forums since September 4, 2023. --------------------------------------------- https://securityaffairs.com/151869/malware/bunnyloader-maas.html ∗∗∗ Security researchers believe mass exploitation attempts against WS_FTP have begun ∗∗∗ --------------------------------------------- Security researchers have spotted what they believe to be a "possible mass exploitation" of vulnerabilities in Progress Softwares WS_FTP Server. --------------------------------------------- https://go.theregister.com/feed/www.theregister.com/2023/10/02/ws_ftp_updat… ∗∗∗ Cloudflare Protection Bypass Vulnerability on Threat Actors’ Radar ∗∗∗ --------------------------------------------- Researchers have identified two mechanisms that hinge on the assumption that traffic originating from Cloudflare towards the origin server is inherently trustworthy, while traffic from other origins should be blocked. --------------------------------------------- https://socradar.io/cloudflare-protection-bypass-vulnerability-on-threat-ac… ∗∗∗ Drei Fragen und Antworten: Der beste Schutz für das Active Directory ∗∗∗ --------------------------------------------- Bis zu 90 Prozent aller Angriffe bedienen sich Microsofts Active Directory – es ist der Hebel, um die eigene Sicherheit zu verbessern. Wir zeigen, wie das geht. --------------------------------------------- https://www.heise.de/news/Drei-Fragen-und-Antworten-Der-beste-Schutz-fuer-d… ∗∗∗ Exim-Lücke: Erste Patches laufen ein ∗∗∗ --------------------------------------------- Nach verschiedenen Kommunikationspannen hat das Exim-Team kritische Sicherheitslücken im beliebten Mailserver behoben. Debian verteilt bereits Updates. --------------------------------------------- https://www.heise.de/news/Exim-Luecke-Erste-Patches-laufen-ein-9323709.html… ∗∗∗ Angriffe auf ältere Android-Geräte: Lücke in Mali-GPU nur teilweise geschlossen ∗∗∗ --------------------------------------------- Aufgrund mehrerer Schwachstellen im Treiber der Grafikeinheit Mali sind unter anderem Smartphone-Modelle von Samsung und Xiaomi verwundbar. --------------------------------------------- https://www.heise.de/news/Angriffe-auf-aeltere-Android-Geraete-Luecke-in-Ma… ∗∗∗ Booking.com: Achtung bei „fehlgeschlagener Zahlung“ oder „Verifikation Ihrer Zahlungsinfos“ ∗∗∗ --------------------------------------------- Fälle, in denen Unterkünfte über booking.com gebucht wurden und Buchende anschließend zur Verifikation ihrer Zahlungen oder zu einer neuerlichen Zahlung aufgefordert werden, häufen sich aktuell. Vorsicht ist geboten, denn die Aufforderungen stammen von Kriminellen, die sich Zugang zu den Buchungsdaten verschaffen konnten und es nun auf das Geld der Hotelgäste abgesehen haben! --------------------------------------------- https://www.watchlist-internet.at/news/bookingcom-achtung-bei-fehlgeschlage… ∗∗∗ Fortinet Labs Uncovers Series of Malicious NPM Packages Stealing Data ∗∗∗ --------------------------------------------- FortiGuard Labs has uncovered a series of malicious packages concealed within NPM (Node Package Manager), the primary software repository for JavaScript developers. The researchers utilized a dedicated system designed to detect nefarious open-source packages across multiple ecosystems, including PyPI and NPM. --------------------------------------------- https://www.hackread.com/fortinet-labs-malicious-npm-packages-steal-data/ ===================== = Vulnerabilities = ===================== ∗∗∗ Microsoft Edge, Teams get fixes for zero-days in open-source libraries ∗∗∗ --------------------------------------------- Microsoft released emergency security updates for Edge, Teams, and Skype to patch two zero-day vulnerabilities in open-source libraries used by the three products. [...] --------------------------------------------- https://www.bleepingcomputer.com/news/microsoft/microsoft-edge-teams-get-fi… ∗∗∗ Qualcomm says hackers exploit 3 zero-days in its GPU, DSP drivers ∗∗∗ --------------------------------------------- Qualcomm is warning of three zero-day vulnerabilities in its GPU and Compute DSP drivers that hackers are actively exploiting in attacks. --------------------------------------------- https://www.bleepingcomputer.com/news/security/qualcomm-says-hackers-exploi… ∗∗∗ Jetzt patchen! Ransomware schlüpft durch kritische TeamCity-Lücke ∗∗∗ --------------------------------------------- Angreifer nutzen eine Sicherheitslücke des Software-Distributionssystems TeamCity aus, das weltweit über 30.000 Firmen wie Citibank, HP und Nike einsetzen. --------------------------------------------- https://www.heise.de/news/Jetzt-patchen-Ransomware-schluepft-durch-kritisch… ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (exim4), Fedora (firecracker, rust-aes-gcm, rust-axum, rust-tokio-tungstenite, rust-tungstenite, and rust-warp), Gentoo (nvidia-drivers), Mageia (chromium-browser-stable, glibc, and libwebp), Red Hat (kernel), SUSE (ghostscript and python3), and Ubuntu (firefox, libtommath, libvpx, and thunderbird). --------------------------------------------- https://lwn.net/Articles/946313/ ∗∗∗ Mattermost security updates Desktop app v5.5.1 and Mobile app v2.8.1 released ∗∗∗ --------------------------------------------- We’re informing you about a Mattermost security update, which addresses the vulnerability CVE-2023-4863 of the third-party library libwebp which was affecting the Desktop app and the Mobile iOS app. We highly recommend that you apply the update. The security update is available for Mattermost dot releases Desktop app v5.5.1 and Mobile app v2.8.1. --------------------------------------------- https://mattermost.com/blog/mattermost-security-updates-desktop-app-v5-5-1-… ∗∗∗ K000137090 : Node.js vulnerabilities CVE-2018-12121, CVE-2018-12122, and CVE-2018-12123 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000137090?utm_source=f5support&utm_medi… ∗∗∗ K000137093 : Node.js vulnerabilities CVE-2018-7167, CVE-2018-12115, and CVE-2018-12116 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000137093?utm_source=f5support&utm_medi… ∗∗∗ The IBM App Connect Enterprise Toolkit and the IBM Integration Bus Toolkit are vulnerable to a server-side request forgery due to Apache Batik (CVE-2022-44730, CVE-2022-44729) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7043490 ∗∗∗ Vulnerabilities in Node.js affect IBM Voice Gateway ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7043727 ∗∗∗ IBM App Connect Enterprise is vulnerable to a denial of service due to Google Protocol Buffer protobuf-cpp (CVE-2022-1941) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7045071 ∗∗∗ Multiple vulnerabilities in OpenSSL affects IBM Rational ClearCase. ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7035373 ∗∗∗ Multiple vulnerabilities in OpenSSL affects IBM Rational ClearCase ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7035370 ∗∗∗ Multiple vulnerabilities in the IBM Java Runtime affects IBM Rational ClearCase. ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7035371 ∗∗∗ A vulnerability in libcURL affect IBM Rational ClearCase. ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7035382 ∗∗∗ IBM Spectrum Symphony openssl 1.1.1 End of Life ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7045753 ∗∗∗ IBM\u00ae Db2\u00ae is vulnerable to information disclosure due to improper privilege management when certain federation features are used. (CVE-2023-29256) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7010573 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 02.10.2023
by Daily end-of-shift report 02 Oct '23

02 Oct '23

===================== = End-of-Day report = ===================== Timeframe: Freitag 29-09-2023 18:00 − Montag 02-10-2023 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Meet LostTrust ransomware — A likely rebrand of the MetaEncryptor gang ∗∗∗ --------------------------------------------- The LostTrust ransomware operation is believed to be a rebrand of MetaEncryptor, utilizing almost identical data leak sites and encryptors. --------------------------------------------- https://www.bleepingcomputer.com/news/security/meet-losttrust-ransomware-a-… ∗∗∗ New Marvin attack revives 25-year-old decryption flaw in RSA ∗∗∗ --------------------------------------------- A flaw related to the PKCS #1 v1.5 padding in SSL servers discovered in 1998 and believed to have been resolved still impacts several widely-used projects today. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-marvin-attack-revives-25… ∗∗∗ The Silent Threat of APIs: What the New Data Reveals About Unknown Risk ∗∗∗ --------------------------------------------- The rapid growth of APIs creates a widening attack surface and increasing unknown cybersecurity risks. --------------------------------------------- https://www.darkreading.com/attacks-breaches/silent-threat-of-apis-what-new… ∗∗∗ Jetzt patchen: Exploit für kritische Sharepoint-Schwachstelle aufgetaucht ∗∗∗ --------------------------------------------- Er ist Teil einer sehr effektiven Exploit-Kette zur Schadcodeausführung auf Sharepoint-Servern, die ein Forscher kürzlich offenlegte. --------------------------------------------- https://www.golem.de/news/jetzt-patchen-exploit-fuer-kritische-sharepoint-s… ∗∗∗ Cybercriminals Using New ASMCrypt Malware Loader to Fly Under the Radar ∗∗∗ --------------------------------------------- Threat actors are selling a new crypter and loader called ASMCrypt, which has been described as an "evolved version" of another loader malware known as DoubleFinger. "The idea behind this type of malware is to load the final payload without the loading process or the payload itself being detected by AV/EDR, etc.," Kaspersky said in an analysis published this week. --------------------------------------------- https://thehackernews.com/2023/09/cybercriminals-using-new-asmcrypt.html ∗∗∗ BunnyLoader: New Malware-as-a-Service Threat Emerges in the Cybercrime Underground ∗∗∗ --------------------------------------------- Cybersecurity experts have discovered yet another malware-as-a-service (MaaS) threat called BunnyLoader thats being advertised for sale on the cybercrime underground. "BunnyLoader provides various functionalities such as downloading and executing a second-stage payload, stealing browser credentials and system information, and much more," [...] --------------------------------------------- https://thehackernews.com/2023/10/bunnyloader-new-malware-as-service.html ∗∗∗ Security researchers believe mass exploitation attempts against WS_FTP have begun ∗∗∗ --------------------------------------------- Early signs emerge after Progress Software said there were no active attempts last week Security researchers have spotted what they believe to be a "possible mass exploitation" of vulnerabilities in Progress Softwares WS_FTP Server. --------------------------------------------- https://go.theregister.com/feed/www.theregister.com/2023/10/02/ws_ftp_updat… ∗∗∗ Temporary suspension of automatic snap registration following security incident ∗∗∗ --------------------------------------------- On September 28, 2023, the Snap Store team was notified of a potential security incident. A number of snap users reported several recently published and potentially malicious snaps. As a consequence of these reports, the Snap Store team has immediately taken down these snaps, and they can no longer be searched or installed. Furthermore, the Snap Store team has placed a temporary manual review requirement on all new snap registrations, effectively immediately. --------------------------------------------- https://forum.snapcraft.io/t/temporary-suspension-of-automatic-snap-registr… ∗∗∗ The Hitchhikers Guide to Malicious Third-Party Dependencies ∗∗∗ --------------------------------------------- The increasing popularity of certain programming languages has spurred the creation of ecosystem-specific package repositories and package managers. Such repositories (e.g., NPM, PyPI) serve as public databases that users can query to retrieve packages for various functionalities, [...] In this work, we show how attackers can [...] achieve arbitrary code execution on victim machines, thereby realizing open-source software supply chain chain attacks. --------------------------------------------- https://arxiv.org/abs/2307.09087 ∗∗∗ Fritzbox-Sicherheitsleck analysiert: Risiko sogar bei deaktiviertem Fernzugriff ∗∗∗ --------------------------------------------- AVM schließt bei vielen Fritzboxen eine Sicherheitslücke. Unserer Analyse zufolge lässt sie sich aus der Ferne ausnutzen – sogar mit abgeschaltetem Fernzugriff. --------------------------------------------- https://www.heise.de/-9323225.html ∗∗∗ BSI-Umfrage: Kritische Infrastrukturen haben Nachholbedarf bei IT-Sicherheit ∗∗∗ --------------------------------------------- Vor allem bei der Umsetzung organisatorischer Sicherheitsmaßnahmen hapert es noch bei Betreibern kritischer Infrastrukturen. Gründe: Personal- und Geldmangel. --------------------------------------------- https://www.heise.de/-9323606.html ∗∗∗ Don’t Let Zombie Zoom Links Drag You Down ∗∗∗ --------------------------------------------- Many organizations — including quite a few Fortune 500 firms — have exposed web links that allow anyone to initiate a Zoom video conference meeting as a valid employee. These company-specific Zoom links, which include a permanent user ID number and an embedded passcode, can work indefinitely and expose an organization’s employees, customers or partners to phishing and other social engineering attacks. --------------------------------------------- https://krebsonsecurity.com/2023/10/dont-let-zombie-zoom-links-drag-you-dow… ∗∗∗ Silverfort Open Sources Lateral Movement Detection Tool ∗∗∗ --------------------------------------------- Silverfort has released the source code for its lateral movement detection tool LATMA, to help identify and analyze intrusions. --------------------------------------------- https://www.securityweek.com/silverfort-open-sources-lateral-movement-detec… ∗∗∗ Die Österreichische Post AG verkauft keine Zufallspakete für 2 Euro! ∗∗∗ --------------------------------------------- Betrügerische Werbeschaltungen auf Facebook spielen vor, dass die Post AG nicht zustellbare Pakete für nur 2 Euro verkauft. Angeblich haben Sie so die Möglichkeit, mit tollen Gegenständen wie Tablets, Kaffeemaschinen oder Büchern überrascht zu werden. Achtung: Es handelt sich um reinen Betrug. Werbung und Profile stammen nicht von der Post und die Pakete existieren nicht. Sie landen hier in einer Abo-Falle oder geben Ihr Zahlungsmittel unbeabsichtigt für Zahlungen durch Kriminelle frei. --------------------------------------------- https://www.watchlist-internet.at/news/die-oesterreichische-post-ag-verkauf… ∗∗∗ Keine Warnung zu den aktuellen Exim Schwachstellen (CVE-2023-42114, CVE-2023-42115, CVE-2023-42116, CVE-2023-42117, CVE-2023-42118, CVE-2023-42119) ∗∗∗ --------------------------------------------- Am Mittwoch 27. September wurden durch die Zero Day Initiative sechs Schwachstellen (CVE-2023-42114, CVE-2023-42115, CVE-2023-42116, CVE-2023-42117, CVE-2023-42118, CVE-2023-42119) im Mail Transfer Agent (MTA) Exim veröffentlicht.[1][2][3][4][5][6] Nach interner Analyse und im Austausch mit Experten sind wir zu ähnlichen Schlüssen, wie nun auf der offiziellen Mailingliste des Projekts veröffentlicht[7], gekommen. --------------------------------------------- https://cert.at/de/aktuelles/2023/10/keine-warnung-zu-den-aktuellen-exim-sc… ∗∗∗ E-Mail-Angriff via Dropbox ∗∗∗ --------------------------------------------- BEC 3.0-Angriffe häufen sich und sind noch schwieriger zu erkennen, weil Hacker Links über legitime Dienste versenden. --------------------------------------------- https://www.zdnet.de/88412118/e-mail-angriff-via-dropbox/ ∗∗∗ Kritische Sicherheitsupdates: Chrome, Edge, Firefox, Thunderbird,Tor ∗∗∗ --------------------------------------------- Ende September 2023 gab es Sicherheitsupdates für diverse Software, die kritische Schwachstellen (0-Days) schließen sollen. Bei den Chromium-Browsern wurde eine Sicherheitslücke im V8 Encoder geschlossen (betrifft Google Chrome und beim Edge). Die Mozilla Entwickler haben ebenfalls Notfall-Updates für den Firefox und den Thunderbird herausgebracht. Und Tor wurde diesbezüglich ebenfalls aktualisiert. Ich fasse mal die Updates in diesem Sammelbeitrag zusammen. --------------------------------------------- https://www.borncity.com/blog/2023/10/02/kritische-sicherheitsupdates-chrom… ∗∗∗ Bitsight identifies nearly 100,000 exposed industrial control systems ∗∗∗ --------------------------------------------- Bitsight has identified nearly 100,000 exposed industrial control systems (ICS) potentially allowing an attacker to access and control physical infrastructure. --------------------------------------------- https://www.bitsight.com/blog/bitsight-identifies-nearly-100000-exposed-ind… ===================== = Vulnerabilities = ===================== ∗∗∗ JetBrains TeamCity Unauthenticated Remote Code Execution ∗∗∗ --------------------------------------------- Topic: JetBrains TeamCity Unauthenticated Remote Code Execution Risk: High Text:## # This module requires Metasploit [...] --------------------------------------------- https://cxsecurity.com/issue/WLB-2023100003 ∗∗∗ OpenRefines Zip Slip Vulnerability Could Let Attackers Execute Malicious Code ∗∗∗ --------------------------------------------- A high-severity security flaw has been disclosed in the open-source OpenRefine data cleanup and transformation tool that could result in arbitrary code execution on affected systems. Tracked as CVE-2023-37476 (CVSS score: 7.8), the vulnerability is a Zip Slip vulnerability that could have adverse impacts when importing a specially crafted project in versions 3.7.3 and below. --------------------------------------------- https://thehackernews.com/2023/10/openrefines-zip-slip-vulnerability.html ∗∗∗ Security updates available in PDF-XChange Editor/Tools 10.1.1.381 ∗∗∗ --------------------------------------------- Released version 10.1.1.381, which addresses potential security and stability issues. --------------------------------------------- https://www.tracker-software.com/support/security-bulletins.html ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (chromium, cups, firefox-esr, firmware-nonfree, gerbv, jetty9, libvpx, mosquitto, open-vm-tools, python-git, python-reportlab, and trafficserver), Fedora (firefox, giflib, libvpx, libwebp, webkitgtk, and xen), Gentoo (Chromium, Google Chrome, Microsoft Edge, ClamAV, GNU Binutils, and wpa_supplicant, hostapd), Mageia (flac, giflib, indent, iperf, java, libvpx, libxml2, quictls, wireshark, and xrdp), Oracle (kernel), Slackware (libvpx and mozilla), and SUSE (bind, python, python-bugzilla, roundcubemail, seamonkey, and xen). --------------------------------------------- https://lwn.net/Articles/946186/ ∗∗∗ Suprema BioStar 2 ∗∗∗ --------------------------------------------- Successful exploitation of this vulnerability could allow an attacker to perform a SQL injection to execute arbitrary commands. --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-269-01 ∗∗∗ Multiple Vulnerabilities in Electrolink FM/DAB/TV Transmitter ∗∗∗ --------------------------------------------- https://www.zeroscience.mk/en/vulnerabilities/ ∗∗∗ K000137058 : Linux kernel vulnerability CVE-2022-4269 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000137058 ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 29.09.2023
by Daily end-of-shift report 29 Sep '23

29 Sep '23

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 28-09-2023 18:00 − Freitag 29-09-2023 18:00 Handler: Michael Schlagenhaufer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Version 1.0: Ungepatchte Schwachstellen im Mail Transfer Agent Exim ∗∗∗ --------------------------------------------- Der Open Source Mail Transfer Agent (MTA) Exim weist mehrere schwerwiegende ungepatchte Schwachstellen auf. Besonders kritisch ist eine Buffer Overflow Schwachstelle in der SMTP-Implementierung, CVE-2023-42115, die einer entfernten, unauthorisierten angreifenden Person gegebenenfalls das Ausführen von Code mit Rechten des Service Accounts, mit dem Exim betrieben wird, ermöglicht. Sie erreicht daher eine CVSS-Bewertung von 9.8 ("kritisch"). --------------------------------------------- https://www.bsi.bund.de/SharedDocs/Cybersicherheitswarnungen/DE/2023/2023-2… ∗∗∗ Betrifft unzählige Anwendungen: Zero-Day-Schwachstelle in VP8-Videokodierung ∗∗∗ --------------------------------------------- Google hat mal wieder eine Zero-Day-Schwachstelle in Chrome gepatcht. Neben gängigen Webbrowsern sind aber auch viele andere Apps betroffen. --------------------------------------------- https://www.golem.de/news/betrifft-unzaehlige-anwendungen-zero-day-schwachs… ∗∗∗ Dringend patchen: Schwachstelle mit maximalem Schweregrad in WS_FTP ∗∗∗ --------------------------------------------- Der Entwickler der Datentransfersoftware Moveit hat erneut kritische Schwachstellen behoben - dieses Mal in der Serveranwendung WS_FTP. --------------------------------------------- https://www.golem.de/news/dringend-patchen-schwachstelle-mit-maximalem-schw… ∗∗∗ Important release of LibreOffice 7.6.2 Community and LibreOffice 7.5.7 Community with key security fix ∗∗∗ --------------------------------------------- The Document Foundation is releasing LibreOffice 7.6.2 Community and LibreOffice 7.5.7 Community ahead of schedule to address a security issue known as CVE 2023-4863, which originates in a widely used code library known as libwebp, created by Google more than a decade ago to render the then-new WebP graphics format. --------------------------------------------- https://blog.documentfoundation.org/blog/2023/09/26/lo-762-and-lo-757/ ∗∗∗ Jetzt patchen! Angreifer haben Netzwerkgeräte von Cisco im Visier ∗∗∗ --------------------------------------------- Cisco hat unter anderem eine kritische Lücke in Catalyst SD-WAN geschlossen. Außerdem gibt es Sicherheitsupdates für weitere Produkte. --------------------------------------------- https://www.heise.de/-9320947.html ∗∗∗ Balkonkraftwerke: Hoymiles schließt Sicherheitslücken ∗∗∗ --------------------------------------------- Der Wechselrichterhersteller hat die Lücken in der API geschlossen – das haben wir verifiziert. Im Gespräch gelobte Hoymiles Besserung. --------------------------------------------- https://www.heise.de/-9321291.html ∗∗∗ Malicious ad served inside Bings AI chatbot ∗∗∗ --------------------------------------------- Users looking for software downloads may be tricked into visiting malicious websites via their interaction with Bing Chat. --------------------------------------------- https://www.malwarebytes.com/blog/threat-intelligence/2023/09/malicious-ad-… ∗∗∗ Hackers Set Sights on Apache NiFi Flaw That Exposes Many Organizations to Attacks ∗∗∗ --------------------------------------------- Hackers have set their sights on CVE-2023-34468, an RCE vulnerability in Apache NiFi that impacts thousands of organizations. --------------------------------------------- https://www.securityweek.com/hackers-set-sights-on-apache-nifi-flaw-that-ex… ∗∗∗ Oktober ist Cyber Security Month: Tipps und Veranstaltungen ∗∗∗ --------------------------------------------- Im Oktober dreht sich alles um Cyber-Sicherheit. Machen auch Sie mit und nutzen Sie das vielfältige Angebot. Wir zeigen Ihnen, wie Sie Ihre Kenntnisse zu Phishing, Randsomeware und Co. verbessern. --------------------------------------------- https://www.watchlist-internet.at/news/oktober-ist-cyber-security-month-tip… ∗∗∗ Betrügerisches EP-Gewinnspiel wird massenhaft per SMS verschickt ∗∗∗ --------------------------------------------- „Gratulation an die EP Electronic Gewinner”. Dieser Text steht in einer SMS, die derzeit massenhaft von Kriminellen verschickt wird. Besonders perfid: In der SMS werden auch die Namen der angeblichen Gewinner:innen genannt. Selbst wenn Ihr Name in der SMS auftaucht, sollten Sie nicht auf den mitgeschickten Link klicken! Betrüger:innen versuchen Sie in die Abo-Falle zu locken. --------------------------------------------- https://www.watchlist-internet.at/news/betruegerisches-ep-gewinnspiel-wird-… ∗∗∗ CL0P Seeds ^_- Gotta Catch Em All! ∗∗∗ --------------------------------------------- CL0P is distributing ransomware data via torrents. We investigate this new method, including seeds we’ve tracked — disguising victims with Pokemon. Catch them all! --------------------------------------------- https://unit42.paloaltonetworks.com/cl0p-group-distributes-ransomware-data-… ∗∗∗ Phishing via Dropbox ∗∗∗ --------------------------------------------- A burgeoning attack involving Dropbox is making the rounds. In the first two weeks of September, we saw 5,440 of these attacks. Hackers are using Dropbox to create fake login pages that eventually lead to a credential harvesting page. It’s yet another example of how hackers are utilizing legitimate services in what we call BEC 3.0 attacks. Business Email Compromise 3.0 attacks refer to the usage of legitimate sites—like Dropbox—to send and host phishing material. --------------------------------------------- https://blog.checkpoint.com/harmony-email/phishing-via-dropbox/ ∗∗∗ Analysis of Time-to-Exploit Trends: 2021-2022 ∗∗∗ --------------------------------------------- Mandiant Intelligence analyzed 246 vulnerabilities that were exploited between 2021 and 2022. Sixty-two percent (153) of the vulnerabilities were first exploited as zero-day vulnerabilities. The number of exploited vulnerabilities each year continues to increase, while the overall times-to-exploit (TTEs) we are seeing are decreasing. Exploitation of a vulnerability is most likely to occur before the end of the first month following the release of a patch. --------------------------------------------- https://www.mandiant.com/resources/blog/time-to-exploit-trends-2021-2022 ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (firefox-esr, jetty9, and vim), Gentoo (Fish, GMP, libarchive, libsndfile, Pacemaker, and sudo), Oracle (nodejs:16 and nodejs:18), Red Hat (virt:av and virt-devel:av), Slackware (mozilla), SUSE (chromium, firefox, Golang Prometheus, iperf, libqb, and xen), and Ubuntu (linux-raspi). --------------------------------------------- https://lwn.net/Articles/945965/ ∗∗∗ Security Vulnerability fixed in Firefox 118.0.1, Firefox ESR 115.3.1, Firefox for Android 118.1.0, Firefox Focus for Android 118.1.0, and Thunderbird 115.3.1. ∗∗∗ --------------------------------------------- CVE-2023-5217: Heap buffer overflow in libvpx Specific handling of an attacker-controlled VP8 media stream could lead to a heap buffer overflow in the content process. We are aware of this issue being exploited in other products in the wild. --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2023-44/ ∗∗∗ Vulnerabilities in node.js affect Cloud Pak Sytem [CVE-2023-28154, CVE-2022-46175, CVE-2022-3517] ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7038776 ∗∗∗ IBM Instana Observability is vulnerable to arbitrary code execution ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7041863 ∗∗∗ IBM MQ Operator and Queue manager container images are vulnerable to multiple vulnerabilities from go-toolset and amicontained ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7039373 ∗∗∗ Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to denial of service due to Go CVE-2023-29409 ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7032246 ∗∗∗ Vulnerabilities in XStream library affects IBM Engineering Test Management (ETM) (CVE-2022-40151) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7042166 ∗∗∗ Vulnerabilities in xercesImpl library affects IBM Engineering Test Management (ETM) (CVE-2022-23437) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7042167 ∗∗∗ The IBM\u00ae Engineering Lifecycle Engineering product is affected as Java deserialization filters (JEP 290) ignored during IBM ORB deserialization (CVE-2022-40609) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7042172 ∗∗∗ Vulnerabilities in batik-all library affects IBM Engineering Test Management (ETM) (CVE-2022-44730, CVE-2022-44729) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7042170 ∗∗∗ Multiple vulnerabilities in IBM Storage Defender \u2013 Data Protect ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7040913 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 28.09.2023
by Daily end-of-shift report 28 Sep '23

28 Sep '23

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 27-09-2023 18:00 − Donnerstag 28-09-2023 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Researchers Release Details of New RCE Exploit Chain for SharePoint ∗∗∗ --------------------------------------------- One of the already-patched flaws enables elevation of privilege, while the other enables remote code execution. --------------------------------------------- https://www.darkreading.com/vulnerabilities-threats/reseachers-release-deta… ∗∗∗ Unzählige Anwendungen betroffen: Chaos bei WebP-Lücke ∗∗∗ --------------------------------------------- Anfangs ordnete Google die Lücke aber nur dem hauseigenen Webbrowser Chrome zu. Mittlerweile hat Google sich aber korrigiert und für die alte Sicherheitslücke (CVE-2023-4863 "hoch") den neuen Eintrag CVE-2023-5129 mit einer kritischen Einstufung (CVSS Score 10 von 10) eingereicht. Dieser wurde aber bereits nach sechs Stunden durch Google als ungültig erklärt. Als Grund ist angegeben, dass der neue Eintrag sich mit dem alten Eintrag doppelt. --------------------------------------------- https://www.heise.de/-9319783 ∗∗∗ SMS Security & Privacy Gaps Make It Clear Users Need a Messaging Upgrade ∗∗∗ --------------------------------------------- Like any forty-year-old technology, SMS is antiquated compared to its modern counterparts. That’s especially concerning when it comes to security. --------------------------------------------- http://security.googleblog.com/2023/09/sms-security-privacy-gaps-make-it-cl… ∗∗∗ Mit Cloudflare Cloudflare umgehen ∗∗∗ --------------------------------------------- Von Cloudflare-Kunden konfigurierte Schutzmechanismen (z. B. Firewall, DDoS-Schutz) für Webseiten können aufgrund von Lücken in den mandantenübergreifenden Schutzmaßnahmen umgangen werden, wodurch Kunden potenziell Angriffen ausgesetzt sind, welche von Cloudflare verhindert werden sollten. --------------------------------------------- https://certitude.consulting/blog/de/cloudflare-verwenden-um-cloudflare-zu-… ∗∗∗ TrendMicro veröffentlicht kritischen Patch für Apex One SP1 Build 12512 ∗∗∗ --------------------------------------------- Der kritische Patch beseitigt gleich mehrere Bugs, wovon einer verhindert, dass der Apex One-Server Virenerkennungsprotokolldaten von verwalteten Sicherheitsagenten empfangen kann. --------------------------------------------- https://www.borncity.com/blog/2023/09/28/trendmicro-verffentlicht-kritische… ∗∗∗ SSH keys stolen by stream of malicious PyPI and npm packages ∗∗∗ --------------------------------------------- A stream of malicious npm and PyPi packages have been found stealing a wide range of sensitive data from software developers on the platforms. --------------------------------------------- https://www.bleepingcomputer.com/news/security/ssh-keys-stolen-by-stream-of… ===================== = Vulnerabilities = ===================== ∗∗∗ Cisco Security Advisories 2023-09-27 ∗∗∗ --------------------------------------------- Cisco has published 15 security advisories: (1x Critical, 7x High, 6x Medium, 1x Informational) --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/Search.x?publicationTypeIDs… ∗∗∗ Hoymiles: Bedrohliche Lücken in der S-Miles-Cloud ∗∗∗ --------------------------------------------- Ein Sicherheitsforscher hat sich Hoymiles Cloudservice genauer angesehen und Lücken gefunden, über die Wechselrichter sogar zerstört werden können. --------------------------------------------- https://www.heise.de/-9319500 ∗∗∗ Mozilla: Security Vulnerability fixed in Firefox 118.0.1, Firefox ESR 115.3.1, Firefox for Android 118.1.0, and Firefox Focus for Android 118.1.0. ∗∗∗ --------------------------------------------- CVE-2023-5217: Heap buffer overflow in libvpx. Impact: critical --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2023-44/ ∗∗∗ Google Chrome 117.0.5938.132 ∗∗∗ --------------------------------------------- Google hat zum 27. September 2023 Updates des Google Chrome Browsers 117 im Stable Channel für Mac, Linux und Windows freigegeben. Es ist ein Sicherheitsupdate, das ausgerollt werden und mehrere Schwachstellen (Einstufung teilweise als "hoch") beseitigen sollen. --------------------------------------------- https://www.borncity.com/blog/2023/09/28/google-chrome-117-0-5938-132/ ∗∗∗ GStreamer Security Advisories 2023-09-20 ∗∗∗ --------------------------------------------- GStreamer has published 3 security advisories at 2023-09-20. --------------------------------------------- https://gstreamer.freedesktop.org/security/ ∗∗∗ Hancom Office 2020 HWord footerr use-after-free vulnerability ∗∗∗ --------------------------------------------- A use-after-free vulnerability exists in the footerr functionality of Hancom Office 2020 HWord 11.0.0.7520. A specially crafted .doc file can lead to a use-after-free. An attacker can trick a user into opening a malformed file to trigger this vulnerability. --------------------------------------------- https://talosintelligence.com/vulnerability_reports/TALOS-2023-1759 ∗∗∗ Accusoft ImageGear dcm_pixel_data_decode out-of-bounds write vulnerability ∗∗∗ --------------------------------------------- An out-of-bounds write vulnerability exists in the dcm_pixel_data_decode functionality of Accusoft ImageGear 20.1. A specially crafted malformed file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability. --------------------------------------------- https://talosintelligence.com/vulnerability_reports/TALOS-2023-1802 ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (ncurses), Fedora (emacs, firecracker, firefox, libkrun, python-oauthlib, and virtiofsd), Mageia (glibc and vim), Oracle (18), SUSE (bind, binutils, busybox, cni, cni-plugins, container-suseconnect, containerd, curl, exempi, ffmpeg, firefox, go1.19-openssl, go1.20-openssl, gpg2, grafana, gsl, gstreamer-plugins-bad, gstreamer-plugins-base, libpng15, libwebp, mutt, nghttp2, open-vm-tools, pmix, python-brotlipy, python3, python310, qemu, quagga, rubygem-actionview-5_1, salt, supportutils, xen, and xrdp), and Ubuntu (libwebp, minidlna, puma, and python2.7, python3.5). --------------------------------------------- https://lwn.net/Articles/945829/ ∗∗∗ WebKitGTK and WPE WebKit Security Advisory WSA-2023-0009 ∗∗∗ --------------------------------------------- Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE identifiers: CVE-2023-39928, CVE-2023-35074, CVE-2023-39434, CVE-2023-40451, CVE-2023-41074, CVE-2023-41993. --------------------------------------------- https://webkitgtk.org/security/WSA-2023-0009.html ∗∗∗ (0Day) Control Web Panel ∗∗∗ --------------------------------------------- ZDI-23-1476 - ZDI-23-1479 --------------------------------------------- https://www.zerodayinitiative.com/advisories/published/ ∗∗∗ (0Day) Exim ∗∗∗ --------------------------------------------- ZDI-23-1468 - ZDI-23-1473 --------------------------------------------- https://www.zerodayinitiative.com/advisories/published/ ∗∗∗ ZDI-23-1475: (0Day) Avast Premium Security Sandbox Protection Link Following Privilege Escalation Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-23-1475/ ∗∗∗ ZDI-23-1474: (0Day) Avast Premium Security Sandbox Protection Incorrect Authorization Privilege Escalation Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-23-1474/ ∗∗∗ Drupal: Content Moderation Notifications - Moderately critical - Information disclosure - SA-CONTRIB-2023-047 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2023-047 ∗∗∗ Drupal: Entity cache - Critical - Information disclosure - SA-CONTRIB-2023-046 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2023-046 ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ Rockwell Automation PanelView 800 ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-271-01 ∗∗∗ DEXMA DexGate ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-271-02 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 27.09.2023
by Daily end-of-shift report 27 Sep '23

27 Sep '23

===================== = End-of-Day report = ===================== Timeframe: Dienstag 26-09-2023 18:00 − Mittwoch 27-09-2023 18:00 Handler: Michael Schlagenhaufer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Unzählige Anwendungen betroffen: WebP-Schwachstelle erreicht maximalen Schweregrad ∗∗∗ --------------------------------------------- Die Schwachstelle in der WebP-Bibliothek wurde zuvor fälschlicherweise als Chrome-Bug markiert. Sie betrifft aber weitaus mehr Anwendungen. --------------------------------------------- https://www.golem.de/news/unzaehlige-anwendungen-betroffen-webp-schwachstel… ∗∗∗ Apple Releases MacOS Sonoma Including Numerous Security Patches, (Tue, Sep 26th) ∗∗∗ --------------------------------------------- As expected, Apple today released macOS Sonoma (14.0). This update, in addition to new features, provides patches for about 60 different vulnerabilities. --------------------------------------------- https://isc.sans.edu/diary/rss/30252 ∗∗∗ ShadowSyndicate: A New Cybercrime Group Linked to 7 Ransomware Families ∗∗∗ --------------------------------------------- Cybersecurity experts have shed light on a new cybercrime group known as ShadowSyndicate (formerly Infra Storm) that may have leveraged as many as seven different ransomware families over the past year. "ShadowSyndicate is a threat actor that works with various ransomware groups and affiliates of ransomware programs," Group-IB and Bridewell said in a joint technical report. --------------------------------------------- https://thehackernews.com/2023/09/shadowsyndicate-new-cybercrime-group.html ∗∗∗ Reports about Cyber Actors Hiding in Router Firmware ∗∗∗ --------------------------------------------- On September 27, 2023, a joint cybersecurity advisory (CSA) was released detailing activities of the cyber actors known as BlackTech. The CSA describes how BlackTech is able to modify router firmware without detection. [...] Cisco has reviewed the report. Cisco would like to highlight the following key facts: The most prevalent initial access vector in these attacks involves stolen or weak administrative credentials. As outlined in the report, certain configuration changes, such as disabling logging and downloading firmware, require administrative credentials. [...] --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Hacking htmx applications ∗∗∗ --------------------------------------------- With the normal flow of frontend frameworks moving from hipster to mainstream in the coming few months, during a test, you bump into this strange application that receives HTML with `hx-` attributes in responses. Congrats, you are testing your first htmx application, let me give you the building blocks to play with for testing this type of application. --------------------------------------------- https://medium.com/@matuzg/hacking-htmx-applications-f8d29665faf ∗∗∗ A Deep Dive into Brute Ratel C4 payloads – Part 2 ∗∗∗ --------------------------------------------- Brute Ratel C4 is a Red Team & Adversary Simulation software that can be considered an alternative to Cobalt Strike. In this blog post, we’re presenting a technical analysis of a Brute Ratel badger/agent that doesn’t implement all the recent features of the framework. There aren’t a lot of Brute Ratel samples available in the wild. This second part of the analysis presents the remaining commands executed by the agent. --------------------------------------------- https://cybergeeks.tech/a-deep-dive-into-brute-ratel-c4-payloads-part-2/ ∗∗∗ Fake Bitwarden installation packages delivered RAT to Windows users ∗∗∗ --------------------------------------------- Windows users looking to install the Bitwarden password manager may have inadvertently installed a remote access trojan (RAT). The ZenRAT malware A malicious website spoofing Bitwarden’s legitimate one (located at bitwariden[.]com) has been offering fake installation packages containing the ZenRAT malware. --------------------------------------------- https://www.helpnetsecurity.com/2023/09/27/windows-bitwarden-rat/ ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Oracle (libtiff), Red Hat (libtiff, nodejs:16, and nodejs:18), Slackware (mozilla), SUSE (bind, cacti, cacti-spine, ImageMagick, kernel, libwebp, netatalk, open-vm-tools, postfix, quagga, wire, and wireshark), and Ubuntu (cups, linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-hwe, linux-oracle, linux-bluefield, and linux-bluefield, linux-raspi, linux-raspi-5.4). --------------------------------------------- https://lwn.net/Articles/945700/ ∗∗∗ New GPU Side-Channel Attack Allows Malicious Websites to Steal Data ∗∗∗ --------------------------------------------- GPUs from AMD, Apple, Arm, Intel, Nvidia and Qualcomm are vulnerable to a new type of side-channel attack named GPU.zip. --------------------------------------------- https://www.securityweek.com/new-gpu-side-channel-attack-allows-malicious-w… ===================== = Vulnerabilities = ===================== ∗∗∗ VMSA-2023-0020 ∗∗∗ --------------------------------------------- VMware Aria Operations updates address local privilege escalation vulnerability. (CVE-2023-34043) --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2023-0020.html ∗∗∗ K000136909 : BIG-IP APM Clients TunnelCrack vulnerability CVE-2023-43125 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000136909 ∗∗∗ K000136907 : BIG-IP APM Clients TunnelCrack vulnerability CVE-2023-43124 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000136907 ∗∗∗ semver-6.3.0.tgz is vulnerable to CVE-2022-25883 used in IBM Maximo Application Suite - Monitor Component ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7039430 ∗∗∗ Okio GzipSource is vulnerable to CVE-2023-3635 used in IBM Maximo Application Suite - Monitor Component ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7039433 ∗∗∗ Certifi is vulnerable to CVE-2023-37920 used in IBM Maximo Application Suite - Monitor Component ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7039436 ∗∗∗ VMware Tanzu Spring for Apache Kafka is vulnerable to CVE-2023-34040 used in IBM Maximo Application Suite - Monitor Component ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7039438 ∗∗∗ A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Tivoli System Automation Application Manager (CVE-2023-35890) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7039519 ∗∗∗ Vulnerability found in Eclipse Jetty may affect IBM Enterprise Records ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7040603 ∗∗∗ Vulnerability of jython-standalone-2.7.0.jar have affected APM WebSphere Application Server Agent and APM Tomcat Agent ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7040614 ∗∗∗ IBM SOAR QRadar Plugin App is vulnerable to using components with known vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7040672 ∗∗∗ IBM Cognos Analytics is affected but not classified as vulnerable to vulnerabilities in IBM Websphere Application Server Liberty ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7040744 ∗∗∗ The Bouncy Castle Crypto Package For Java (bc-java) component is vulnerable to CVE-2023-33201 is used by IBM Maximo Application Suite ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7028107 ∗∗∗ Control Access issues in PCOMM ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7031707 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 26.09.2023
by Daily end-of-shift report 26 Sep '23

26 Sep '23

===================== = End-of-Day report = ===================== Timeframe: Montag 25-09-2023 18:00 − Dienstag 26-09-2023 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a ===================== = News = ===================== ∗∗∗ A new spin on the ZeroFont phishing technique, (Tue, Sep 26th) ∗∗∗ --------------------------------------------- Last week, I came across an interesting phishing e-mail, in which a text written in a font with zero-pixel size was used in quite a novel way. --------------------------------------------- https://isc.sans.edu/diary/rss/30248 ∗∗∗ Analysis of CVE-2023-38831 Zero-Day vulnerability in WinRAR ∗∗∗ --------------------------------------------- A remote code execution when the user attempts to view a benign file within a ZIP archive. The issue occurs because a) ZIP archive may include a benign file such as an ordinary .JPG file and also a folder that has the same name as the benign file, and the contents of the folder which may include executable content are processed during an attempt to access only the benign file. --------------------------------------------- https://blog.securelayer7.net/analysis-of-cve-2023-38831-zero-day-vulnerabi… ∗∗∗ Xenomorph Malware Strikes Again: Over 30+ US Banks Now Targeted ∗∗∗ --------------------------------------------- >From what was observed in previous cases, we were able to clearly identify a distribution campaign, using phishing webpages to trick victims into installing malicious APKs, which feature a larger list of targets compared to its previous versions. --------------------------------------------- https://www.threatfabric.com/blogs/xenomorph ∗∗∗ PGP-verschlüsselte E-Mails mit macOS 14: GPGTools warnt vor schnellem Upgrade ∗∗∗ --------------------------------------------- macOS 14 sägt Mail-Plug-ins ab, bewährte Tools wie GPG funktionieren deshalb nicht mehr. GPGTools stellt aber eine neue Extension für Apple Mail in Aussicht. --------------------------------------------- https://www.heise.de/-9318030 ∗∗∗ Vorsicht, wenn PCM Marketing anruft ∗∗∗ --------------------------------------------- Unternehmen werden im Moment häufig von der Marketing-Agentur „PCM Marketing“ angerufen und an eine Kündigung eines Abos erinnert. Bei Nichtkündigung kommt es angeblich zu hohen Kosten. Nach dem Telefonat erhalten Sie ein E-Mail mit einer ausgefüllten Vorlage, die Sie unterschreiben und zurückschicken sollen. Achtung: Unterschreiben Sie nicht, Sie werden in ein teures Abo gelockt! --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-wenn-pcm-marketing-anruft/ ∗∗∗ Fortifying your wireless network: A comprehensive guide to defend against wireless attacks ∗∗∗ --------------------------------------------- In this in-depth blog, we will delve into the technical intricacies of safeguarding your network against wireless threats. Armed with this knowledge, you can confidently defend your wireless infrastructure against potential attackers. --------------------------------------------- https://cybersecurity.att.com/blogs/security-essentials/fortifying-your-wir… ===================== = Vulnerabilities = ===================== ∗∗∗ Xen Security Advisory CVE-2023-20588 / XSA-439 ∗∗∗ --------------------------------------------- Version 1 accidentally linked to the wrong AMD bulletin. This has been corrected in v2. All other information in v1 is believed to be correct. | Impact: An attacker might be able to infer data from a different execution context on the same CPU core. --------------------------------------------- https://xenbits.xen.org/xsa/advisory-439.html ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (exempi, glib2.0, lldpd, and netatalk), Fedora (curl, libppd, and linux-firmware), Oracle (kernel), and SUSE (Cadence, frr, modsecurity, python-CairoSVG, python-GitPython, and tcpreplay). --------------------------------------------- https://lwn.net/Articles/945559/ ∗∗∗ Firefox 118 und 115.3 ESR freigegeben ∗∗∗ --------------------------------------------- Zum 26. September 2023 haben die Mozilla-Entwickler den neuen Firefox 118 sowie das Wartungsupdate des Firefox 115.3 ESR veröffentlicht. Mit den Updates wurden einige Schwachstellen geschlossen. --------------------------------------------- https://www.borncity.com/blog/2023/09/26/firefox-118-115-3-freigegeben/ ∗∗∗ Suprema BioStar 2 ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-269-01 ∗∗∗ Advantech EKI-1524-CE series ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-269-04 ∗∗∗ Hitachi Energy Asset Suite 9 ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-269-02 ∗∗∗ Baker Hughes Bently Nevada 3500 ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-269-05 ∗∗∗ Mitsubishi Electric FA Engineering Software ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-269-03 ∗∗∗ IBM Storage Protect Server is susceptible to numerous vulnerabilities due to Golang Go (CVE-2023-29402, CVE-2023-29403, CVE-2023-29404, CVE-2023-29405, CVE-2023-29406, CVE-2023-29400, CVE-2023-24540, CVE-2023-24539, X-Force 250518) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7038772 ∗∗∗ Vulnerability with kernel , OpenJDK jna-platform affect IBM Cloud Object Storage Systems (Sept2023) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7038968 ∗∗∗ Vulnerability with bcprov-jdk affect IBM Cloud Object Storage Systems (Sept2023) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7038966 ∗∗∗ Vulnerability with Python affect IBM Cloud Object Storage Systems (Sept2023v2) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7038969 ∗∗∗ IBM InfoSphere Information Server is vulnerable to OS command injection (CVE-2022-35717) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7038982 ∗∗∗ IBM Sterling Global Mailbox is vulnerable to privilege escalation attack due to Apache Cassandra ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7039222 ∗∗∗ Multiple vulnerabilities in IBM SDK for Node.js and packaged modules affect IBM Business Automation Workflow Configuration Editor ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7039262 ∗∗∗ Multiple security vulnerabilities affecting Watson Knowledge Catalog for IBM Cloud Pak for Data ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7039367 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 25.09.2023
by Daily end-of-shift report 25 Sep '23

25 Sep '23

===================== = End-of-Day report = ===================== Timeframe: Freitag 22-09-2023 18:00 − Montag 25-09-2023 18:00 Handler: Michael Schlagenhaufer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Akira Ransomware Mutates to Target Linux Systems ∗∗∗ --------------------------------------------- The newly emerged ransomware actively targets both Windows and Linux systems with a double-extortion approach. --------------------------------------------- https://www.darkreading.com/attacks-breaches/akira-ransomware-mutates-to-ta… ∗∗∗ Predator-Spyware: Staatstrojaner wurde über iOS-Schwachstellen eingeschleust ∗∗∗ --------------------------------------------- Intellexa hat die jüngst von Apple gepatchten Schwachstellen in iOS ausgenutzt, um eine Zero-Day-Exploit-Kette für iPhones zu entwickeln. --------------------------------------------- https://www.golem.de/news/predator-spyware-staatstrojaner-wurde-ueber-ios-s… ∗∗∗ Blocking Visual Studio Code embedded reverse shell before its too late ∗∗∗ --------------------------------------------- Since July 2023, Microsoft is offering the perfect reverse shell, embedded inside Visual Studio Code, a widely used development tool. With just a few clicks, any user with a github account can share their visual studio desktop on the web. VS code tunnel is almost considered a lolbin (Living Of the Land Binary). --------------------------------------------- https://ipfyx.fr/post/visual-studio-code-tunnel/ ∗∗∗ iRacing Exploit allows attackers to take control of users computer ∗∗∗ --------------------------------------------- If you have updated iRacing since 2023 Season 2 Patch 5, you’re safe. But if you have the game installed and haven’t updated it, it’s important to either update or uninstall it as soon as possible. Keep in mind this exploit is possible even if you haven’t got an active iRacing subscription, so if you were thinking about updating it later, it’s worth uninstalling it in the meanwhile. --------------------------------------------- https://blog.ss23.geek.nz/2023/09/21/iracing-electron-rce-exploit.html ∗∗∗ Außergewöhnliche Malware nimmt westeuropäische Telkos ins Visier ∗∗∗ --------------------------------------------- Lua Dream ist ein mittels Lua modular aufgebauter Schädling, der es auf Telekommunikationsunternehmen abgesehen hat – und wahrscheinlich aus Asien stammt. --------------------------------------------- https://www.heise.de/-9315204.html ∗∗∗ In-the-Wild Exploitation Expected for Critical TeamCity Flaw Allowing Server Takeover ∗∗∗ --------------------------------------------- A critical vulnerability in the TeamCity CI/CD server could allow unauthenticated attackers to execute code and take over vulnerable servers. --------------------------------------------- https://www.securityweek.com/in-the-wild-exploitation-expected-for-critical… ∗∗∗ Webinar: Manipulation durch Dark Patterns – wie kann ich mich schützen? ∗∗∗ --------------------------------------------- Dark Patterns werden im Internet eingesetzt, um uns zu Handlungen zu verleiten, die nicht in unserem Interesse liegen – und so z. B. mehr Geld auszugeben oder mehr Daten zu teilen, als wir eigentlich möchten. Dieses Webinar erklärt, wie uns Dark Patterns manipulieren und wie Sie sich davor schützen können. Nehmen Sie kostenlos teil: Dienstag 03. Oktober 2023, 18:30 - 20:00 Uhr via zoom --------------------------------------------- https://www.watchlist-internet.at/news/webinar-manipulation-durch-dark-patt… ∗∗∗ Gefälschtes Gewinnspiel für ÖBB-Geschenkkarten & iPhone 15 Pro ∗∗∗ --------------------------------------------- Uns werden aktuell betrügerische Gewinnspiele für das neue iPhone sowie ÖBB-Geschenkkarten zum Gratis-Zugfahren gemeldet. Die Gewinnspiele werden über Soziale Netzwerke, Messenger und per E-Mail verbreitet. Den Gewinn bekommen Sie angeblich, wenn Sie € 1,95 zahlen. Wer bezahlt verliert aber Geld! --------------------------------------------- https://www.watchlist-internet.at/news/gefaelschtes-gewinnspiel-fuer-oebb-g… ∗∗∗ SCCM Hierarchy Takeover ∗∗∗ --------------------------------------------- tl;dr: There is no security boundary between sites in the same hierarchy. When an administrative user is granted a security role in SCCM, such as Full Administrator or Infrastructure Administrator, in any primary site, the underlying database changes propagate upward to the central administration site (CAS) and then to other primary sites in the hierarchy. This means that if an attacker gains control of any primary site, they gain control of the entire SCCM hierarchy. --------------------------------------------- https://posts.specterops.io/sccm-hierarchy-takeover-41929c61e087 ∗∗∗ iOS 17 update secretly changed your privacy settings; here’s how to set them back ∗∗∗ --------------------------------------------- Many iPhone users who upgraded their iPhones to the recently-released iOS 17 will be alarmed to hear that they may have actually downgraded their security and privacy. --------------------------------------------- https://www.bitdefender.com/blog/hotforsecurity/ios-17-update-secretly-chan… ∗∗∗ From ScreenConnect to Hive Ransomware in 61 hours ∗∗∗ --------------------------------------------- In 2022, The DFIR Report observed an increase in the adversarial usage of Remote Management and Monitoring (RMM) tools. When compared to post-exploitation channels that heavily rely on terminals, [...] --------------------------------------------- https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-… ∗∗∗ CoinMiner Distribution Process within Infiltrated Systems (Detected by EDR) ∗∗∗ --------------------------------------------- AhnLab Security Emergency Response Center (ASEC) has identified the process through which threat actors install CoinMiners, which utilize a compromised system’s resources for cryptocurrency mining. This post will cover how the AhnLab EDR product detects the installation process of CoinMiners that use system resources for cryptocurrency mining. --------------------------------------------- https://asec.ahnlab.com/en/57222/ ∗∗∗ Kaspersky Reveals Alarming IoT Threats and Dark Web DDoS Boom ∗∗∗ --------------------------------------------- Kaspersky Unveils Alarming IoT Vulnerabilities and Dark Webs Thriving DDoS Economy. --------------------------------------------- https://www.hackread.com/iot-vulnerabilities-dark-web-ddos-economy/ ===================== = Vulnerabilities = ===================== ∗∗∗ Elasticsearch 8.9.0, 7.17.13 Security Update ∗∗∗ --------------------------------------------- An issue has been identified with how Elasticsearch handled incoming requests on the HTTP layer. An unauthenticated user could force an Elasticsearch node to exit with an OutOfMemory error by sending a moderate number of malformed HTTP requests. --------------------------------------------- https://discuss.elastic.co/t/elasticsearch-8-9-0-7-17-13-security-update/34… ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (bind9, elfutils, flac, ghostscript, libapache-mod-jk, lldpd, and roundcube), Fedora (linux-firmware, roundcubemail, and thunderbird), Mageia (curl, file, firefox/thunderbird, ghostpcl, libtommath, and nodejs), Oracle (kernel, open-vm-tools, qemu, and virt:ol and virt-devel:rhel), SUSE (bind, busybox, djvulibre, exempi, ImageMagick, libqb, libssh2_org, opera, postfix, python, python36, renderdoc, webkit2gtk3, and xrdp), and Ubuntu (accountsservice and open-vm-tools). --------------------------------------------- https://lwn.net/Articles/945503/ ∗∗∗ CISA Adds Three Known Exploited Vulnerabilities to Catalog ∗∗∗ --------------------------------------------- CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2023-41991 Apple Multiple Products Improper Certificate Validation Vulnerability CVE-2023-41992 Apple Multiple Products Kernel Privilege Escalation Vulnerability CVE-2023-41993 Apple Multiple Products WebKit Code Execution Vulnerability --------------------------------------------- https://www.cisa.gov/news-events/alerts/2023/09/25/cisa-adds-three-known-ex… ∗∗∗ RoyalTSX 6.0.1 RTSZ File Handling Heap Memory Corruption PoC ∗∗∗ --------------------------------------------- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5788.php ∗∗∗ Wago: Vulnerable WIBU-SYSTEMS Codemeter installed through e!COCKPIT and WAGO-I/O-Pro ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2023-042/ ∗∗∗ Stored Cross-Site Scripting in der mb Support broker management Solution openVIVA c2 ∗∗∗ --------------------------------------------- https://sec-consult.com/de/vulnerability-lab/advisory/stored-cross-site-scr… ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 22.09.2023
by Daily end-of-shift report 22 Sep '23

22 Sep '23

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 21-09-2023 18:00 − Freitag 22-09-2023 18:00 Handler: Michael Schlagenhaufer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Incomplete disclosures by Apple and Google create “huge blindspot” for 0-day hunters ∗∗∗ --------------------------------------------- No one mentioned that libwebp, a library found in millions of apps, was a 0-day origin. --------------------------------------------- https://arstechnica.com/?p=1970341 ∗∗∗ GitHub passkeys generally available for passwordless sign-ins ∗∗∗ --------------------------------------------- GitHub has made passkeys generally available across the platform today to secure accounts against phishing and allow passwordless logins for all users. --------------------------------------------- https://www.bleepingcomputer.com/news/security/github-passkeys-generally-av… ∗∗∗ iOS, iPad OS, Watch OS und MacOS: Apple behebt aktiv ausgenutzte Schwachstellen ∗∗∗ --------------------------------------------- Drei Zero-Day-Schwachstellen in iOS, iPad OS, Watch OS sowie Mac OS sollen bereits aktiv ausgenutzt werden. Patches stehen jetzt bereit. --------------------------------------------- https://www.golem.de/news/ios-ipad-os-watch-os-und-macos-apple-behebt-aktiv… ∗∗∗ The WebP 0day ∗∗∗ --------------------------------------------- Early last week, Google released a new stable update for Chrome. The update included a single security fix that was reported by Apples Security Engineering and Architecture (SEAR) team. The issue, CVE-2023-4863, was a heap buffer overflow in the WebP image library, and it had a familiar warning attached:"Google is aware that an exploit for CVE-2023-4863 exists in the wild." --------------------------------------------- https://blog.isosceles.com/the-webp-0day/ ∗∗∗ Proof-of-Concept-Exploit für WinRAR-Lücke bringt VenomRAT-Malware mit ∗∗∗ --------------------------------------------- Mitte August haben die Entwickler eine Zero-Day-Lücke in WinRAR ausgebessert. Dafür taucht ein gefälschter PoC auf, der Malware mitbringt. --------------------------------------------- https://www.heise.de/-9313479.html ∗∗∗ Qnap warnt vor Codeschmuggel durch Schwachstellen ∗∗∗ --------------------------------------------- Qnap warnt vor Sicherheitslücken im QTS-Betriebssystem und der Multimedia Console, durch die Angreifer Schadcode einschleusen können. --------------------------------------------- https://www.heise.de/-9313549.html ∗∗∗ Sicherheitslücke: Datenleaks auf Drupal-Websites möglich ∗∗∗ --------------------------------------------- Unter bestimmten Voraussetzungen können Angreifer mit dem Content Management System Drupal erstellte Seiten attackieren. Abgesicherte Versionen sind verfügbar. --------------------------------------------- https://www.heise.de/-9313594.html ∗∗∗ Schon einmal auf einen Fake-Shop hineingefallen? ∗∗∗ --------------------------------------------- Sie kaufen regelmäßig online ein und verwenden dabei Ihr Mobiltelefon? Sie sind schon einmal in Berührung mit Fake-Shops gekommen oder waren Opfer von Internetbetrug? Sie möchten mehr darüber erfahren, welche präventiven Maßnahmen es gibt, um den Einkauf in Fake-Shops zu verhindern? Sie möchten aktiv an der Gestaltung einer Lösung mitarbeiten? Dann nehmen Sie an unserem Workshop teil! --------------------------------------------- https://www.watchlist-internet.at/news/schon-einmal-auf-einen-fake-shop-hin… ∗∗∗ Finding Deserialization Bugs in the SolarWind Platform ∗∗∗ --------------------------------------------- It’s been a while since I have written a blog post, please accept my sincerest apologies. This is because a lot of fun stuff that I’ve recently done is going to be presented during conferences. Please treat this post as a small introduction to my upcoming Hexacon 2023 talk titled “Exploiting Hardened .NET Deserialization: New Exploitation Ideas and Abuse of Insecure Serialization”. --------------------------------------------- https://www.thezdi.com/blog/2023/9/21/finding-deserialization-bugs-in-the-s… ===================== = Vulnerabilities = ===================== ∗∗∗ ZDI-23-1449: (0Day) Intel Driver & Support Assistant Link Following Local Privilege Escalation Vulnerability ∗∗∗ --------------------------------------------- This vulnerability allows local attackers to escalate privileges on affected installations of Intel Driver & Support Assistant. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. --------------------------------------------- https://www.zerodayinitiative.com/advisories/ZDI-23-1449/ ∗∗∗ (0Day) Ashlar-Vellum Cobalt AR Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- The specific flaw exists within the parsing of AR files [...] Given the nature of the vulnerability, the only salient mitigation strategy is to restrict interaction with the application. (ZDI-23-1450 - ZDI-23-1454) --------------------------------------------- https://www.zerodayinitiative.com/advisories/published/ ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (gsl), Fedora (dotnet6.0 and dotnet7.0), Oracle (libwebp), Slackware (bind, cups, and seamonkey), SUSE (kernel and rust, rust1.72), and Ubuntu (cups, flac, gnome-shell, imagemagick, and python3.5). --------------------------------------------- https://lwn.net/Articles/945322/ ∗∗∗ Vulnerabilities in Apache HTTP Server ∗∗∗ --------------------------------------------- Multiple vulnerabilities in Apache HTTP Server have been reported to affect certain QNAP operating systems. --------------------------------------------- https://www.qnap.com/en-us/security-advisory/QSA-23-12 ∗∗∗ Vulnerability in Legacy QTS ∗∗∗ --------------------------------------------- A buffer copy without checking size of input vulnerability has been reported to affect certain legacy versions of QTS. --------------------------------------------- https://www.qnap.com/en-us/security-advisory/QSA-23-25 ∗∗∗ Vulnerability in Multimedia Console ∗∗∗ --------------------------------------------- A buffer copy without checking size of input vulnerability has been reported to affect certain versions of Multimedia Console. --------------------------------------------- https://www.qnap.com/en-us/security-advisory/QSA-23-29 ∗∗∗ Security update 1.5.4 released ∗∗∗ --------------------------------------------- We just published a security update to the LTS version 1.5 of Roundcube Webmail. It provides a fix to a recently reported XSS vulnerability: Cross-site scripting (XSS) vulnerability in handling of linkrefs in plain text messages, reported by Niraj Shivtarkar. See the full changelog in the release notes in the release notes on the Github download page. We strongly recommend to update all productive installations of Roundcube 1.5.x with this new version. --------------------------------------------- https://roundcube.net/news/2023/09/18/security-update-1.5.4-released ∗∗∗ Security update 1.4.14 released ∗∗∗ --------------------------------------------- We just published a security update to the LTS version 1.4 of Roundcube Webmail. It provides a fix to a recently reported XSS vulnerability: Cross-site scripting (XSS) vulnerability in handling of linkrefs in plain text messages, reported by Niraj Shivtarkar. See the full changelog in the release notes in the release notes on the Github download page. We strongly recommend to update all productive installations of Roundcube 1.4.x with this new version. --------------------------------------------- https://roundcube.net/news/2023/09/18/security-update-1.4.14-released ∗∗∗ Security update 1.6.3 released ∗∗∗ --------------------------------------------- We just published a security update to the version 1.6 of Roundcube Webmail. It provides a fix to a recently reported XSS vulnerability: Fix cross-site scripting (XSS) vulnerability in handling of linkrefs in plain text messages,reported by Niraj Shivtarkar. See the full changelog in the release notes in the release notes on the Github download page. We strongly recommend to update all productive installations of Roundcube 1.6.x with this new version. --------------------------------------------- https://roundcube.net/news/2023/09/15/security-update-1.6.3-released ∗∗∗ [R1] Nessus Version 10.5.5 Fixes Multiple Vulnerabilities ∗∗∗ --------------------------------------------- https://www.tenable.com/security/tns-2023-31 ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 21.09.2023
by Daily end-of-shift report 21 Sep '23

21 Sep '23

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 20-09-2023 18:00 − Donnerstag 21-09-2023 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Free Download Manager releases script to check for Linux malware ∗∗∗ --------------------------------------------- The developers of Free Download Manager (FDM) have published a script to check if a Linux device was infected through a recently reported supply chain attack. --------------------------------------------- https://www.bleepingcomputer.com/news/security/free-download-manager-releas… ∗∗∗ P2PInfect botnet activity surges 600x with stealthier malware variants ∗∗∗ --------------------------------------------- The P2PInfect botnet worm is going through a period of highly elevated activity volumes starting in late August and then picking up again in September 2023. --------------------------------------------- https://www.bleepingcomputer.com/news/security/p2pinfect-botnet-activity-su… ∗∗∗ LUCR-3: Scattered Spider Getting SaaS-y in the Cloud ∗∗∗ --------------------------------------------- LUCR-3 overlaps with groups such as Scattered Spider, Oktapus, UNC3944, and STORM-0875 and is a financially motivated attacker that leverages the Identity Provider (IDP) as initial access into an environment with the goal of stealing Intellectual Property (IP) for extortion. LUCR-3 targets Fortune 2000 companies across various sectors to include but not limited to Software, Retail, Hospitality, Manufacturing, and Telecoms. --------------------------------------------- https://permiso.io/blog/lucr-3-scattered-spider-getting-saas-y-in-the-cloud ∗∗∗ Remote Code Execution in Tutanota Desktop due to Code Flaw ∗∗∗ --------------------------------------------- In this article, we explained how an innocent-looking mistake in the code could significantly impact the security of an application. We showed how we found a Cross-Site Scripting vulnerability in Tutanota, a popular end-to-end encrypted webmail service, and explained how an attacker could have exploited the flaw to execute arbitrary code on a victims system. --------------------------------------------- https://www.sonarsource.com/blog/remote-code-execution-in-tutanota-desktop-… ===================== = Vulnerabilities = ===================== ∗∗∗ Drupal core - Critical - Cache poisoning - SA-CORE-2023-006 ∗∗∗ --------------------------------------------- This vulnerability only affects sites with the JSON:API module enabled, and can be mitigated by uninstalling JSON:API. The core REST and contributed GraphQL modules are not affected. --------------------------------------------- https://www.drupal.org/sa-core-2023-006 ∗∗∗ MOVEit Transfer: Schwachstellen ermöglichen Angreifern Datenschmuggel ∗∗∗ --------------------------------------------- Neue MOVEit Transfer-Versionen schließen teils hochriskante Sicherheitslücken. IT-Verantwortliche sollten sie zügig installieren. --------------------------------------------- https://www.heise.de/-9312162 ∗∗∗ Sicherheitsupdate: Passwort-Lücke bedroht Nagios XI ∗∗∗ --------------------------------------------- Angreifer können die Server-Monitoring-Lösung Nagios XI attackieren. Eine dagegen abgesicherte Version ist verfügbar. --------------------------------------------- https://www.heise.de/-9312331 ∗∗∗ Sicherheitsupdate: Authentifizierung von HPE OneView umgehbar ∗∗∗ --------------------------------------------- Die IT-Infrastrukturmanagementlösung OneView von HPE ist verwundbar. Der Entwickler hat zwei kritische Sicherheitslücken geschlossen. --------------------------------------------- https://www.heise.de/-9312816 ∗∗∗ Wordfence Intelligence Weekly WordPress Vulnerability Report (September 11, 2023 to September 17, 2023) ∗∗∗ --------------------------------------------- Last week, there were 55 vulnerabilities disclosed in 46 WordPress Plugins and no WordPress themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 15 Vulnerability Researchers that contributed to WordPress Security last week. --------------------------------------------- https://www.wordfence.com/blog/2023/09/wordfence-intelligence-weekly-wordpr… ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (frr and libyang), Fedora (golang-github-prometheus-exporter-toolkit, golang-github-xhit-str2duration, golang-gopkg-alecthomas-kingpin-2, libpano13, and open-vm-tools), Oracle (firefox, frr, and thunderbird), Red Hat (dmidecode, kernel, kernel-rt, kpatch-patch, libwebp: critical, linux-firmware, mariadb:10.3, ncurses, postgresql:15, and virt:rhel and virt-devel:rhel), Scientific Linux (firefox, open-vm-tools, and thunderbird), SUSE (binutils, bluez, chromium, curl, gcc7, go1.20, go1.21, grpc, protobuf, python-Deprecated, python-PyGithub, python-aiocontextvars, python-avro, python-bcrypt, python-cryptography, python- cryptography-vectors, python-google-api-core, pyt, gstreamer-plugins-good, kernel, libcares2, libxml2, mdadm, mutt, and python-brotlipy), and Ubuntu (indent, linux, linux-aws, linux-aws-5.15, linux-azure, linux-azure-5.15, linux-azure-fde, linux-azure-fde-5.15, linux-gcp, linux-gcp-5.15, linux-gke, linux-gkeop, linux-gkeop-5.15, linux-hwe-5.15, linux-ibm, linux-ibm-5.15, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp, linux-gcp-5.4, linux-gkeop, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-iot, linux-kvm, linux-oracle, linux-oracle-5.4, linux-xilinx-zynqmp, linux, linux-aws, linux-aws-6.2, linux-azure, linux-azure-6.2, linux-azure-fde-6.2, linux-gcp, linux-gcp-6.2, linux-hwe-6.2, linux-ibm, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-6.2, linux-oracle, linux-raspi, linux-starfive, linux, linux-aws, linux-kvm, linux-lts-xenial, linux-oem-6.0, linux-oem-6.1, and memcached). --------------------------------------------- https://lwn.net/Articles/945073/ ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (mutt, netatalk, and python2.7), Fedora (chromium, golang-github-prometheus-exporter-toolkit, golang-github-xhit-str2duration, and golang-gopkg-alecthomas-kingpin-2), Oracle (dmidecode, frr, libwebp, open-vm-tools, and thunderbird), Red Hat (libwebp and open-vm-tools), SUSE (cups, frr, mariadb, openvswitch3, python39, qemu, redis7, rubygem-rails-html-sanitizer, and skopeo), and Ubuntu (bind9, cups, and libppd). --------------------------------------------- https://lwn.net/Articles/945173/ ∗∗∗ Synology-SA-23:13 SRM ∗∗∗ --------------------------------------------- A vulnerability allow remote attackers to bypass security constraint via a susceptible version of Synology Router Manager (SRM). --------------------------------------------- https://www.synology.com/en-global/support/security/Synology_SA_23_13 ∗∗∗ ISC Releases Security Advisories for BIND 9 ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/alerts/2023/09/21/isc-releases-security-ad… ∗∗∗ Frauscher: Multiple Vulnerabilities in FDS101 ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2023-038/ ∗∗∗ Rockwell Automation FactoryTalk View Machine Edition ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-264-06 ∗∗∗ Rockwell Automation Connected Components Workbench ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-264-05 ∗∗∗ Rockwell Automation Select Logix Communication Modules ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-264-04 ∗∗∗ Delta Electronics DIAScreen ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-264-03 ∗∗∗ Real Time Automation 460 Series ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-264-01 ∗∗∗ IBM Security Guardium is affected by multiple vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6963075 ∗∗∗ IBM Virtualization Engine TS7700 is susceptible to a denial of service due to use of Apache Commons FileUpload (CVE-2023-24998) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7031979 ∗∗∗ Vulnerabilities in CKEditor library affects IBM Engineering Test Management (ETM) (CVE-2021-32809, CVE-2021-37695) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7037094 ∗∗∗ Multiple vulnerabilities in IBM Java SDK affects IBM Storage Scale ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7037135 ∗∗∗ IBM Events Operator is affected by a denial of service in OpenSSL (CVE-2023-0215). ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7037162 ∗∗∗ A vulnerability in Red Hat Enterprise Linux may affect IBM Robotic Process Automation for Cloud Pak and result in elevated privileges (CVE-2023-3899). ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7037164 ∗∗∗ IBM Events Operator is affected by a denial of service in OpenSSL (CVE-2022-4450). ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7037167 ∗∗∗ IBM Events Operator is vulnerable to a denial of service in OpenSSL (CVE-2023-0286) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7037165 ∗∗∗ Vulnerability in node.js package may affect IBM Storage Scale GUI (CVE-2022-25883) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7037185 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 20.09.2023
by Daily end-of-shift report 20 Sep '23

20 Sep '23

===================== = End-of-Day report = ===================== Timeframe: Dienstag 19-09-2023 18:00 − Mittwoch 20-09-2023 18:00 Handler: Michael Schlagenhaufer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Gitlab warnt vor kritischer Sicherheitslücke ∗∗∗ --------------------------------------------- Eine kritische Sicherheitslücke bedroht die Enterprise-Anwender des Repository-Diensts Gitlab. Kunden sollten unverzüglich ein Update einspielen. --------------------------------------------- https://www.heise.de/-9311249.html ∗∗∗ Atlassian stopft Sicherheitslecks in Bitbucket, Confluence und Jira ∗∗∗ --------------------------------------------- Atlassian warnt vor Sicherheitslücken in Bitbucket, Confluence und Jira. Aktualisierte Fassungen dichten sie ab. --------------------------------------------- https://www.heise.de/-9311520.html ∗∗∗ Trend Micro: Update schließt ausgenutzte, kritische Schwachstelle CVE-2023-41179 ∗∗∗ --------------------------------------------- Kurzer Hinweis für Nutzer und Administratoren von Trend Micro die Sicherheitsprodukte Apex One und Worry-Free Business Security unter Windows einsetzen. In den Produkten gibt es eine kritische Sicherheitslücke (CVE-2023-41179), die bereits in freier Wildbahn ausgenutzt wird. Der Hersteller bietet aber [...] --------------------------------------------- https://www.borncity.com/blog/2023/09/20/trend-micro-notfall-update-schliet… ∗∗∗ Analyzing a Modern In-the-wild Android Exploit ∗∗∗ --------------------------------------------- In December 2022, Google’s Threat Analysis Group (TAG) discovered an in-the-wild exploit chain targeting Samsung Android devices. TAG’s blog post covers the targeting and the actor behind the campaign. This is a technical analysis of the final stage of one of the exploit chains, specifically CVE-2023-0266 (a 0-day in the ALSA compatibility layer) and CVE-2023-26083 (a 0-day in the Mali GPU driver) as well as the techniques used by the [...] --------------------------------------------- https://googleprojectzero.blogspot.com/2023/09/analyzing-modern-in-wild-and… ∗∗∗ Fresh Wave of Malicious npm Packages Threaten Kubernetes Configs and SSH Keys ∗∗∗ --------------------------------------------- Cybersecurity researchers have discovered a fresh batch of malicious packages in the npm package registry that are designed to exfiltrate Kubernetes configurations and SSH keys from compromised machines to a remote server. Sonatype said it has discovered 14 different npm packages so far: [...] --------------------------------------------- https://thehackernews.com/2023/09/fresh-wave-of-malicious-npm-packages.html ∗∗∗ The mystery of the CVEs that are not vulnerabilities ∗∗∗ --------------------------------------------- Researchers have raised the alarm about a large set of CVE for older bugs that never were vulnerabilities. --------------------------------------------- https://www.malwarebytes.com/blog/news/2023/09/the-mystery-of-the-cves-that… ∗∗∗ Shodan Verified Vulns 2023-09-01 ∗∗∗ --------------------------------------------- Mit Stand 2023-09-01 sieht Shodan in Österreich die folgenden Schwachstellen: [...] In diesem Monat folgen die Schwachstellen in den unteren zwei Dritteln wieder dem Abwärtstrend und nähern sich der Nullmarke oder haben diese bereits erreicht. Im oberen Drittel ist im Gegensatz zu den Vormonaten ein leichter Anstieg bei FREAK (CVE-2015-0204) (+131) und Logjam (CVE-2015-4000) (+63) zu verzeichnen. --------------------------------------------- https://cert.at/de/aktuelles/2023/9/shodan-verified-vulns-2023-09-01 ∗∗∗ #StopRansomware: Snatch Ransomware ∗∗∗ --------------------------------------------- This joint Cybersecurity Advisory (CSA) is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect against ransomware. Visit stopransomware.gov to see all #StopRansomware advisories and to learn more [...] --------------------------------------------- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-263a ∗∗∗ Attacker Unleashes Stealthy Crypto Mining via Malicious Python Package ∗∗∗ --------------------------------------------- Recently, our team came across a Python package named “culturestreak”. A closer look reveals a darker purpose: unauthorized cryptocurrency mining. Let’s break down how “culturestreak” operates, its potential impact, and the broader implications for user security and ethical [...] --------------------------------------------- https://checkmarx.com/blog/attacker-unleashes-stealthy-crypto-mining-via-ma… ∗∗∗ Protect CNC Machines in Networked IT/OT Environments ∗∗∗ --------------------------------------------- Networking IT/OT environments is a bit like walking a tightrope, balancing the pursuit of intelligence and efficiency against the risks of exposing OT systems to the wider world. Trend Micro recently teamed up with global machine tool company Celada to identify specific risks associated with industrial CNC machines—and how to mitigate them. --------------------------------------------- https://www.trendmicro.com/en_us/ciso/23/i/cnc-machine-security.html ===================== = Vulnerabilities = ===================== ∗∗∗ Critical Security Flaws Exposed in Nagios XI Network Monitoring Software ∗∗∗ --------------------------------------------- Multiple security flaws have been disclosed in the Nagios XI network monitoring software that could result in privilege escalation and information disclosure. The four security vulnerabilities, tracked from CVE-2023-40931 through CVE-2023-40934, impact Nagios XI versions 5.11.1 and lower. Following responsible disclosure on August 4, 2023, They have been patched as of September 11, 2023, [...] --------------------------------------------- https://thehackernews.com/2023/09/critical-security-flaws-exposed-in.html ∗∗∗ Xen Security Advisory CVE-2023-34322 / XSA-438 ∗∗∗ --------------------------------------------- top-level shadow reference dropped too early for 64-bit PV guests | Impact: Privilege escalation, Denial of Service (DoS) affecting the entire host, and information leaks all cannot be ruled out. --------------------------------------------- https://xenbits.xen.org/xsa/advisory-438.html ∗∗∗ IBM Security Guardium is affected by several vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7007815 ∗∗∗ IBM Security Guardium is affected by an SQL Injection vulnerability (CVE-2023-33852) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7028514 ∗∗∗ IBM Security Guardium is affected by a denial of service vulnerability in MIT keb5 (CVE-2022-42898) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6981101 ∗∗∗ IBM Security Guardium is affected by multiple vulnerabilities (CVE-2023-30435, CVE-2023-30436, CVE-2023-30437) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7028506 ∗∗∗ IBM Security Guardium is affected by multiple vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7028511 ∗∗∗ IBM Security Guardium is affected by an Improper Restriction of Excessive Authentication Attempts vulnerability (CVE-2022-43904) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7028509 ∗∗∗ IBM Security Guardium is affected by an Hazardous Input Validation vulnerability (CVE-2022-43903) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7030110 ∗∗∗ IBM Storage Protect is vulnerable to a remote attack due to Java ( CVE-2023-21967 ) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7034474 ∗∗∗ IBM Storage Protect is vulnerable to deserialization issues due to Java ( CVE-2022-40609 ) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7034467 ∗∗∗ Vulnerability in moment-timezone affects IBM VM Recovery Manager DR GUI ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7035336 ∗∗∗ IBM App Connect Enterprise and IBM Integration Bus are vulnerable to a denial of service due to IBM MQ (CVE-2023-28513). ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7035334 ∗∗∗ The IBM Engineering Lifecycle Engineering product using IBM WebSphere Application Server Liberty is vulnerable to Identity Spoofing (CVE-2022-22476) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7035367 ∗∗∗ A vulnerability in python-request affects IBM Robotic Process Automation for Cloud Pak and may result in an attacker obtaining sensitive information (CVE-2023-32681) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7034002 ∗∗∗ A vulnerability in gRPC may affect IBM Robotic Process Automation and result in an attacker obtaining sensitive information. (CVE-2023-32731) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7034007 ∗∗∗ A vulnerability in Apache Johnzon may affect IBM Robotic Process Automation and result in a denial of service (CVE-2023-33008) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7034006 ∗∗∗ A vulnerability in Microsoft ASP.NET Core may affect IBM Robotic Process Automation and result in an exposure of sensitive information (CVE-2023-35391). ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7034005 ∗∗∗ IBM Security Guardium is affected by a Command injection in CLI vulnerability [CVE-2023-35893] ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7027853 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 19.09.2023
by Daily end-of-shift report 19 Sep '23

19 Sep '23

===================== = End-of-Day report = ===================== Timeframe: Montag 18-09-2023 18:00 − Dienstag 19-09-2023 18:00 Handler: Michael Schlagenhaufer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Jetzt patchen! Tausende Juniper-Firewalls immer noch ohne Sicherheitsupdate ∗∗∗ --------------------------------------------- Aufgrund eines neuen Exploits sind Attacken auf Juniper-Firewalls jetzt noch einfacher. Sicherheitspatches sind verfügbar. --------------------------------------------- https://www.heise.de/news/Jetzt-patchen-Tausende-Juniper-Firewalls-immer-no… ∗∗∗ Bumblebee malware returns in new attacks abusing WebDAV folders ∗∗∗ --------------------------------------------- The malware loader Bumblebee has broken its two-month vacation with a new campaign that employs new distribution techniques that abuse 4shared WebDAV services. --------------------------------------------- https://www.bleepingcomputer.com/news/security/bumblebee-malware-returns-in… ∗∗∗ Security baseline for Microsoft Edge version 117 ∗∗∗ --------------------------------------------- Automatically open downloaded MHT or MHTML files from the web in Internet Explorer mode (Added) --------------------------------------------- https://techcommunity.microsoft.com/t5/microsoft-security-baselines/securit… ∗∗∗ Härtung des Dateitransfers: Microsoft sichert das SMB-Protokoll ab ∗∗∗ --------------------------------------------- Mit zwei Maßnahmen sichert Microsoft sowohl die SMB Client- als auch die Serverseite besser ab. Wir zeigen, worauf Administratoren achten müssen. --------------------------------------------- https://www.heise.de/news/Haertung-des-Dateitransfers-Microsoft-sichert-das… ∗∗∗ CISA Says Owl Labs Vulnerabilities Requiring Close Physical Range Exploited in Attacks ∗∗∗ --------------------------------------------- The US cybersecurity agency CISA says four vulnerabilities found last year in Owl Labs video conferencing devices — flaws that require the attacker to be in close range of the target — have been exploited in attacks. --------------------------------------------- https://www.securityweek.com/cisa-says-owl-labs-vulnerabilities-requiring-c… ∗∗∗ Fake-Shop-Trends im Herbst und Winter ∗∗∗ --------------------------------------------- Warme Jacken, Skianzüge und Regenstiefel haben wieder Saison. Auch die Nachfrage nach Pellets und Holz steigt langsam wieder. Das wissen auch Kriminelle und stellen ihre Fake-Shops auf Herbst- und Winterangebote um. Wir zeigen Ihnen, welche Fake-Shop-Trends es gerade gibt und wie Sie sich vor betrügerischen Angeboten schützen. --------------------------------------------- https://www.watchlist-internet.at/news/fake-shop-trends-im-herbst-und-winte… ∗∗∗ Fake CVE-2023-40477 Proof of Concept Leads to VenomRAT ∗∗∗ --------------------------------------------- Researchers should be aware of threat actors repurposing older proof of concept (PoC) code to quickly craft a fake PoC for a newly released vulnerability. On Aug. 17, 2023, the Zero Day Initiative publicly reported a remote code execution (RCE) vulnerability in WinRAR tracked as CVE-2023-40477. They had disclosed it to the vendor on June 8, 2023. Four days after the public reporting of CVE-2023-40477, an actor using an alias of whalersplonk committed a fake PoC script to their GitHub repository. --------------------------------------------- https://unit42.paloaltonetworks.com/fake-cve-2023-40477-poc-hides-venomrat/ ===================== = Vulnerabilities = ===================== ∗∗∗ Wind River VxWorks tarExtract directory traversal vulnerability (CVE-2023-38346) ∗∗∗ --------------------------------------------- VxWorks is a real-time operating system used in many embedded devices in high-availability environments with high safety and security requirements. This includes important industrial, medical, airospace, networking and automotive devices. For example, NASAs Curiosity rover currently deployed on planet Mars is using Wind Rivers VxWorks operating system. --------------------------------------------- https://www.pentagrid.ch/en/blog/wind-river-vxworks-tarextract-directory-tr… ∗∗∗ SolarWinds Platform 2023.3.1 Release Notes ∗∗∗ --------------------------------------------- SolarWinds Platform 2023.3.1 is a service release providing bug and security fixes for release 2023.3. For information about the 2023.3 release, including EOL notices and upgrade information, see SolarWinds Platform 2023.3 Release Notes. --------------------------------------------- https://documentation.solarwinds.com/en/success_center/orionplatform/conten… ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (chromium, flac, gnome-shell, libwebp, openjdk-11, and xrdp), Fedora (giflib), Oracle (kernel), Red Hat (busybox, dbus, firefox, frr, kpatch-patch, libwebp, open-vm-tools, and thunderbird), Slackware (netatalk), SUSE (flac, gcc12, kernel, libeconf, libwebp, libxml2, and thunderbird), and Ubuntu (binutils, c-ares, libraw, linux-intel-iotg, nodejs, python-django, and vsftpd). --------------------------------------------- https://lwn.net/Articles/944848/ ∗∗∗ Trend Micro Patches Exploited Zero-Day Vulnerability in Endpoint Security Products ∗∗∗ --------------------------------------------- Trend Micro on Tuesday released an advisory to warn customers that a critical vulnerability affecting Apex One and other endpoint security products has been exploited in the wild. --------------------------------------------- https://www.securityweek.com/trend-micro-patches-exploited-zero-day-vulnera… ∗∗∗ Spring Security 5.8.7, 6.0.7, 6.1.4, 6.2.0-M1 Released, including fixes for CVE-2023-34042 ∗∗∗ --------------------------------------------- https://spring.io/blog/2023/09/18/spring-security-5-8-7-6-0-7-6-1-4-6-2-0-m… ∗∗∗ Spring for GraphQL 1.0.5, 1.1.6, 1.2.3 released ∗∗∗ --------------------------------------------- https://spring.io/blog/2023/09/19/spring-for-graphql-1-0-5-1-1-6-1-2-3-rele… ∗∗∗ Zyxel security advisory for command injection vulnerability in EMG2926-Q10A Ethernet CPE ∗∗∗ --------------------------------------------- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-… ∗∗∗ PHOENIX CONTACT: Multiple products affected by WIBU Codemeter Vulnerabilities ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2023-030/ ∗∗∗ Omron CJ/CS/CP Series ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-262-05 ∗∗∗ Omron Engineering Software ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-262-04 ∗∗∗ Omron Engineering Software Zip-Slip ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-262-03 ∗∗∗ Vulnerabilities in Bash affect ProtecTIER (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/690049 ∗∗∗ Multiple vulnerabilities in OpenSSL affect ProtecTIER ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/691201 ∗∗∗ Multiple vulnerabilities in Samba – including Badlock – affect ProtecTIER ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/691257 ∗∗∗ Vulnerability in Linux Kernel affects ProtecTIER: Dirty COW vulnerability (CVE-2016-5195) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/696401 ∗∗∗ Vulnerability in glibc library affects ProtecTIER(CVE-2014-5119) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/690187 ∗∗∗ Vulnerability in OpenSSL affects ProtecTIER (CVE-2016-2108) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/695443 ∗∗∗ IBM Security Guardium is affected by a multiple vulnerabilities (CVE-2023-22809, CVE-2019-12490, CVE-2023-0041) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7000021 ∗∗∗ IBM Storage Protect Operations Center is vulnerable to denial of service due to Websphere Application Server Liberty ( CVE-2023-28867 ) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7034039 ∗∗∗ IBM Storage Protect Server is vulnerable to denial of service and other attacks due to Db2 ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7034037 ∗∗∗ Vulnerability in moment-timezone affects IBM VM Recovery Manager DR GUI ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7034198 ∗∗∗ Vulnerabilities in Linux kernel and Python can affect IBM Spectrum Protect Plus ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7034265 ∗∗∗ IBM App Connect Enterprise is vulnerable to a remote attack and a denial of service due to Node.js modules tough-cookie and semver (CVE-2023-26136, CVE-2022-25883). ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7031733 ∗∗∗ A vulnerability in the Administrative command line client affects IBM Storage Protect Client, IBM Storage Protect for Virtual Environments, and IBM Storage Protect for Space Management (CVE-2023-40368) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7034288 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 18.09.2023
by Daily end-of-shift report 18 Sep '23

18 Sep '23

===================== = End-of-Day report = ===================== Timeframe: Freitag 15-09-2023 18:00 − Montag 18-09-2023 18:00 Handler: Michael Schlagenhaufer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ BlackCat ransomware hits Azure Storage with Sphynx encryptor ∗∗∗ --------------------------------------------- The BlackCat (ALPHV) ransomware gang now uses stolen Microsoft accounts and the recently spotted Sphynx encryptor to encrypt targets Azure cloud storage. --------------------------------------------- https://www.bleepingcomputer.com/news/security/blackcat-ransomware-hits-azu… ∗∗∗ Microsoft leaks 38TB of private data via unsecured Azure storage ∗∗∗ --------------------------------------------- The Microsoft AI research division accidentally leaked dozens of terabytes of sensitive data starting in July 2020 while contributing open-source AI learning models to a public GitHub repository. --------------------------------------------- https://www.bleepingcomputer.com/news/microsoft/microsoft-leaks-38tb-of-pri… ∗∗∗ Retool Falls Victim to SMS-Based Phishing Attack Affecting 27 Cloud Clients ∗∗∗ --------------------------------------------- Software development company Retool has disclosed that the accounts of 27 of its cloud customers were compromised following a targeted and SMS-based social engineering attack. The San Francisco-based firm blamed a Google Account cloud synchronization feature recently introduced in April 2023 for making the breach worse, calling it a "dark pattern." "The fact that Google Authenticator syncs to the cloud is a novel attack vector," Snir Kodesh, Retool's head of engineering, said. "What we had originally implemented was multi-factor authentication. But through this Google update, what was previously multi-factor-authentication had silently (to administrators) become single-factor-authentication." --------------------------------------------- https://thehackernews.com/2023/09/retool-falls-victim-to-sms-based.html ∗∗∗ Fuzzing with multiple servers in parallel: AFL++ with Network File Systems ∗∗∗ --------------------------------------------- When fuzzing large-scale applications, using a single server (even with 4 64-core AMD Ryzen CPUs) may not be powerful enough by itself. That’s where parallelized/distributed fuzzing comes in (i.e. automatic sharing of results between fuzzing systems). In this guide, we’ll take a look at how to set up multiple servers fuzzing the same program using AFL++, linked all together with an NFS (Network File System). --------------------------------------------- https://joshua.hu/fuzzing-multiple-servers-parallel-aflplusplus-nfs ∗∗∗ donut-decryptor ∗∗∗ --------------------------------------------- donut-decryptor checks file(s) for known signatures of the donut obfuscators loader shellcode. If located, it will parse the shellcode to locate, decrypt, and extract the DONUT_INSTANCE structure embedded in the binary, and report pertinent configuration data. If a DONUT_MODULE is present in the binary it is decrypted and dumped to disk. --------------------------------------------- https://github.com/volexity/donut-decryptor ∗∗∗ CVE-2023-34040 Spring Kafka Deserialization Remote Code Execution ∗∗∗ --------------------------------------------- MEDIUM | AUGUST 23, 2023 | CVE-2023-34040: In Spring for Apache Kafka 3.0.9 and earlier and versions 2.9.10 and earlier, a possible deserialization attack vector existed, but only if unusual configuration was applied. An attacker would have to construct a malicious serialized object in one of the deserialization exception record headers [...] According to the description in security bulletin, we can simply attain some critical points resulting in the vulnerability. --------------------------------------------- https://pyn3rd.github.io/2023/09/15/CVE-2023-34040-Spring-Kafka-Deserializa… ∗∗∗ AWS’s Hidden Threat: AMBERSQUID Cloud-Native Cryptojacking Operation ∗∗∗ --------------------------------------------- The Sysdig Threat Research Team (TRT) has uncovered a novel cloud-native cryptojacking operation which they’ve named AMBERSQUID. This operation leverages AWS services not commonly used by attackers, such as AWS Amplify, AWS Fargate, and Amazon SageMaker. The uncommon nature of these services means that they are often overlooked from a security perspective, and the AMBERSQUID operation can cost victims more than $10,000/day. --------------------------------------------- https://sysdig.com/blog/ambersquid/ ∗∗∗ Fileless Remote Code Execution on Juniper Firewalls ∗∗∗ --------------------------------------------- CVE-2023-36845 is a PHP environment variable manipulation vulnerability affecting Juniper SRX firewalls and EX switches. Juniper scored the vulnerability as a medium severity issue. However, in this blog, we’ll show you how this vulnerability alone can achieve remote, unauthenticated code execution without even touching the disk. --------------------------------------------- https://vulncheck.com/blog/juniper-cve-2023-36845 ∗∗∗ Sherlock: Spyware kommt über Online-Werbung ∗∗∗ --------------------------------------------- Die israelische Firma Insanet soll eine Spähsoftware entwickelt haben, die über gezielte Werbebanner auf Windows-PCs und gängige Smartphones ausgespielt wird. --------------------------------------------- https://www.heise.de/-9308891.html ∗∗∗ CISA Releases New Identity and Access Management Guidance ∗∗∗ --------------------------------------------- CISA has released new guidance on how federal agencies can integrate identity and access management into their ICAM architecture. --------------------------------------------- https://www.securityweek.com/cisa-releases-new-identity-and-access-manageme… ∗∗∗ Verkaufen auf Vinted: Vermeintliche Käufer:innen locken auf gefälschte Zahlungsplattform ∗∗∗ --------------------------------------------- Sie verkaufen etwas auf Vinted? Vorsicht, wenn interessierte Käufer:innen nach Ihrer E-Mail-Adresse fragen. Dahinter steckt eine Betrugsmasche, die darauf abzielt, Sie auf eine gefälschte Vinted-Zahlungsplattform zu locken. Auf dieser Plattform erhalten Sie angeblich den Kaufbetrag. Tatsächlich stehlen die Kriminellen dort Ihre Bank- oder Kreditkartendaten und überzeugen Sie, Zahlungen freizugeben. --------------------------------------------- https://www.watchlist-internet.at/news/verkaufen-auf-vinted-vermeintliche-k… ∗∗∗ Vorsicht: Steam Fake Accounts und Scam-Methoden ∗∗∗ --------------------------------------------- Kurze Warnung für Leser und Leserinnen, die auf der Plattform Steam unterwegs sind. Ein Leser hat mich auf eine Betrugswelle aufmerksam gemacht, die gerade läuft und mit gefälschten Konten operiert. --------------------------------------------- https://www.borncity.com/blog/2023/09/16/vorsicht-steam-fake-accounts-und-s… ∗∗∗ 18th September – Threat Intelligence Report ∗∗∗ --------------------------------------------- For the latest discoveries in cyber research for the week of 11th September, please download our Threat_Intelligence Bulletin. --------------------------------------------- https://research.checkpoint.com/2023/18th-september-threat-intelligence-rep… ∗∗∗ Earth Lusca Employs New Linux Backdoor, Uses Cobalt Strike for Lateral Movement ∗∗∗ --------------------------------------------- While monitoring Earth Lusca, we discovered an intriguing, encrypted file on the threat actors server - a Linux-based malware, which appears to originate from the open-source Windows backdoor Trochilus, which weve dubbed SprySOCKS due to its swift behavior and SOCKS implementation. --------------------------------------------- https://www.trendmicro.com/en_us/research/23/i/earth-lusca-employs-new-linu… ∗∗∗ MidgeDropper Variant Targets Work-from-Home Employees on Windows PCs ∗∗∗ --------------------------------------------- If you are working from home, you need to be on the lookout for the new and complex variant of MidgeDropper malware. --------------------------------------------- https://www.hackread.com/midgedropper-variant-work-from-home-windows/ ===================== = Vulnerabilities = ===================== ∗∗∗ Qnap-Updates schließen hochriskante Lücke ∗∗∗ --------------------------------------------- Qnap hat aktualisierte Betriebssysteme veröffentlicht. Die neuen QTS-, QuTS-hero- und QuTScloud-Releases schließen teils hochriskante Lücken. --------------------------------------------- https://www.heise.de/-9308427.html ∗∗∗ Anonymisierendes Linux: Kritische libWebP-Lücke in Tails 5.17.1 geschlossen ∗∗∗ --------------------------------------------- Die Maintainer des anonymisierenden Linux Tails für den USB-Stick haben in Version 5.17.1 die bereits angegriffene, kritische libWebP-Lücke geschlossen. --------------------------------------------- https://www.heise.de/-9307906.html ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (firefox-esr, libwebp, and thunderbird), Fedora (chromium, curl, flac, libtommath, libwebp, matrix-synapse, python-matrix-common, redis, and rust-pythonize), Gentoo (binwalk, ghostscript, python-requests, rar, samba, and wireshark), Oracle (.NET 6.0, kernel, and kernel-container), Slackware (python3), and SUSE (firefox). --------------------------------------------- https://lwn.net/Articles/944744/ ∗∗∗ Authenticated Remote Code Execution und fehlende Authentifizierung in Atos Unify OpenScape ∗∗∗ --------------------------------------------- https://sec-consult.com/de/vulnerability-lab/advisory/authenticated-remote-… ∗∗∗ Vulnerabilities in Apache Struts library affect Tivoli Netcool\/OMNIbus WebGUI ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7033228 ∗∗∗ Vulnerabilities in Certifi, cryptography, python-requests and Tornado can affect IBM Storage Protect Plus Microsoft File Systems Backup and Restore [CVE-2023-37920, CVE-2023-38325, CVE-2023-32681, CVE-2023-28370] ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7031489 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 15.09.2023
by Daily end-of-shift report 15 Sep '23

15 Sep '23

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 14-09-2023 18:00 − Freitag 15-09-2023 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a ===================== = News = ===================== ∗∗∗ What is Secure Shell (SSH) & How to Use It: Security & Best Practices ∗∗∗ --------------------------------------------- In this blog post, we’re going to delve deeper into what Secure Shell (SSH) is, how it operates, and why it’s useful. We’ll cover everything from the basics of connecting with SSH to common commands and best practices for ensuring secure communications and file transfers. --------------------------------------------- https://blog.sucuri.net/2023/09/what-is-secure-shell-ssh-how-to-use-it-secu… ∗∗∗ A detailed analysis of the Money Message Ransomware ∗∗∗ --------------------------------------------- The threat actor group, Money Message ransomware, first appeared in March 2023, demanding million-dollar ransoms from its targets. Its configuration, which contains the services and processes to stop a ransomware attack, can be found at the end of the executable. The ransomware creates a mutex and deletes the Volume Shadow Copies using vssadmin.exe. --------------------------------------------- https://resources.securityscorecard.com/research/analysis-money-message-ran… ∗∗∗ Mehr Sicherheit für (Open-)Sourcecode: OpenSSF veröffentlicht Leitfaden ∗∗∗ --------------------------------------------- Ein Leitfaden der Open Source Security Foundation zeigt Tools und Best Practices zum Absichern von Code auf Versionsverwaltungsplattformen auf. --------------------------------------------- https://www.heise.de/-9306112.html ∗∗∗ Watch out, this LastPass email with "Important information about your account" is a phish ∗∗∗ --------------------------------------------- The consequences of last year's LastPass breach continue to be felt, with the latest insult to users coming in the form of a highly convincing phishing email. --------------------------------------------- https://www.malwarebytes.com/blog/news/2023/09/nasty-lastpass-phish ∗∗∗ Threat Group Assessment: Turla (aka Pensive Ursa) ∗∗∗ --------------------------------------------- Pensive Ursa was chosen to be the main focus for the 2023 MITRE ATT&CK evaluation. MITRE has described Turla as being “known for their targeted intrusions and innovative stealth.” The results of this evaluation, including Palo Alto Networks scoring, will be published in late September 2023. --------------------------------------------- https://unit42.paloaltonetworks.com/turla-pensive-ursa-threat-assessment/ ∗∗∗ Why Are You Texting Me? UNC3944 Leverages SMS Phishing Campaigns for SIM Swapping, Ransomware, Extortion, and Notoriety ∗∗∗ --------------------------------------------- UNC3944 is a financially motivated threat cluster that has persistently used phone-based social engineering and SMS phishing campaigns (smshing) to obtain credentials to gain and escalate access to victim organizations. At least some UNC3944 threat actors appear to operate in underground communities, such as Telegram and underground forums, which they may leverage to acquire tools, services, and/or other support to augment their operations. --------------------------------------------- https://www.mandiant.com/resources/blog/unc3944-sms-phishing-sim-swapping-r… ===================== = Vulnerabilities = ===================== ∗∗∗ Jetzt patchen! Sicherheitslösungen von Fortinet als Sicherheitsrisiko ∗∗∗ --------------------------------------------- Mehrere Produkte von Fortinet sind verwundbar. Sicherheitsupdates schaffen Abhilfe. --------------------------------------------- https://www.heise.de/-9306543.html ∗∗∗ Management-Controller Lenovo XCC: Angreifer können Passwörter manipulieren ∗∗∗ --------------------------------------------- Der Computerhersteller Lenovo hat in XClarity Controller mehrere Sicherheitslücken geschlossen. --------------------------------------------- https://www.heise.de/-9304734.html ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (c-ares and samba), Fedora (borgbackup, firefox, and libwebp), Oracle (.NET 6.0 and kernel), Slackware (libwebp), SUSE (chromium and firefox), and Ubuntu (atftp, dbus, gawk, libssh2, libwebp, modsecurity-apache, and mutt). --------------------------------------------- https://lwn.net/Articles/944581/ ∗∗∗ QRadar Pulse application add on to IBM QRadar SIEM is vulnerable to using components with known vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7032220 ∗∗∗ Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to HTTP header injection due to Go CVE-2023-29406 ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7032249 ∗∗∗ Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to bypassing security restrictions due to multiple Node.js vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7032238 ∗∗∗ IBM Virtualization Engine TS7700 is susceptible to a denial of service due to use of Apache Commons FileUpload (CVE-2023-24998) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7031979 ∗∗∗ Due to use of Golang Go, IBM Cloud Pak for Multicloud Management Monitoring is vulnerable to multiple vulnerabilities. ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7032901 ∗∗∗ Multiple vulnerabilities in jackson-databind affect IBM Application Performance Management products ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7032899 ∗∗∗ IBM Operational Decision Manager August 2023 - Multiple CVEs addressed ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7032928 ∗∗∗ Vulnerabilities in Linux Kernel might affect IBM Spectrum Copy Data Management ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7029387 ∗∗∗ CVE-2023-24539, CVE-2023-29400, CVE-2023-29403, CVE-2023-24540, CVE-2023-29402, CVE-2023-29404, CVE-2023-29405 related to Go affect IBM CICS TX Standard 11.1 ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7033006 ∗∗∗ CVE-2023-24540, CVE-2023-29402, CVE-2023-29404, CVE-2023-29405 related to Go affect IBM CICS TX Advanced 11.1 ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7033004 ∗∗∗ Vulnerabilities in Golang, openSSH and openJDK might affect IBM Spectrum Copy Data Management ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7029389 ∗∗∗ Vulnerabilities in snappy-java might affect IBM Spectrum Copy Data Management ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7029381 ∗∗∗ Vulnerabilities in cURL libcurl might affect IBM Spectrum Copy Data Management ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7029380 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 14.09.2023
by Daily end-of-shift report 14 Sep '23

14 Sep '23

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 13-09-2023 18:00 − Donnerstag 14-09-2023 18:00 Handler: Michael Schlagenhaufer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Windows 11 ‘ThemeBleed’ RCE bug gets proof-of-concept exploit ∗∗∗ --------------------------------------------- Security researcher Gabe Kirkpatrick has made a proof-of-concept (PoC) exploit available for CVE-2023-38146, aka "ThemeBleed," which enables attackers to trigger arbitrary remote code execution if the target opens a specially crafted .theme file. --------------------------------------------- https://www.bleepingcomputer.com/news/security/windows-11-themebleed-rce-bu… ∗∗∗ Top 10 Facts About MOVEit Breach ∗∗∗ --------------------------------------------- This breach exposed the vulnerabilities inherent in some of the world’s most trusted platforms and highlighted the audacity and capabilities of modern cybercriminals. Furthermore, becoming the primary attack vector for the Cl0p ransomware group, it has led to many other attacks. --------------------------------------------- https://socradar.io/top-10-facts-about-moveit-breach/ ∗∗∗ Column-Level Encryption 101: What is It, implementation & Benefits ∗∗∗ --------------------------------------------- By encrypting individual columns of data, organizations can limit access to the data, reduce the potential damage of a breach and help ensure the privacy of their customers information. In this post, we will explore the power of column-level encryption for data security. So let’s dive in. --------------------------------------------- https://www.piiano.com/blog/column-level-encryption ∗∗∗ Uncursing the ncurses: Memory corruption vulnerabilities found in library ∗∗∗ --------------------------------------------- Microsoft has discovered a set of memory corruption vulnerabilities in a library called ncurses, which provides APIs that support text-based user interfaces (TUI). Released in 1993, the ncurses library is commonly used by various programs on Portable Operating System Interface (POSIX) operating systems, including Linux, macOS, and FreeBSD. --------------------------------------------- https://www.microsoft.com/en-us/security/blog/2023/09/14/uncursing-the-ncur… ∗∗∗ PSA: Ongoing Webex malvertising campaign drops BatLoader ∗∗∗ --------------------------------------------- A new malvertising campaign is targeting corporate users who are downloading the popular web conferencing software Webex. Threat actors have bought an advert that impersonates Cisco's brand and is displayed first when performing a Google search. --------------------------------------------- https://www.malwarebytes.com/blog/threat-intelligence/2023/09/ongoing-webex… ∗∗∗ QR-Code in E-Mails von vermeintlichen Lieferanten führt zu Phishing-Seite ∗∗∗ --------------------------------------------- Aktuell ist ein besonders perfides Phishing-Mail im Umlauf: Unternehmen werden von ihnen bekannten Lieferanten kontaktiert, die ein Angebot per QR-Code übermitteln. Zumindest wird das in der Nachricht behauptet. Tatsächlich führt das Scannen des QR-Codes auf eine Phishing-Seite. Kriminelle versuchen dabei, an die Zugangsdaten für das Microsoft-Konto der Mitarbeiter:innen zu kommen. --------------------------------------------- https://www.watchlist-internet.at/news/qr-code-in-e-mails-von-vermeintliche… ∗∗∗ Vorsicht vor Phishing-E-Mails von "oesterreich.gv.at" & "a-trust.at" ∗∗∗ --------------------------------------------- Momentan befinden sich zahlreiche Phishing-Nachrichten von vermeintlich vertrauenswürdigen Absendern in Umlauf. Die Nachrichten versprechen angebliche Rückerstattungen von Oesterreich.gv.at. Klicken Sie nicht auf die Links, Ihre Daten werden gestohlen! --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-vor-phishing-e-mails-von-oe… ===================== = Vulnerabilities = ===================== ∗∗∗ FortiGuard PSIRT Advisories ∗∗∗ --------------------------------------------- Fortiguard Labs have released 12 Advisories for FortiADC, FortiAPs, FortiAP-U, FortiClient-EMS, FortiManager & FortiAnalyzer, FortiOS & FortiProxy, FortiPresence, FortiSIEM, FortiTester and FortiWeb. (Severity: 3x High, 8x Medium, 1x Low) --------------------------------------------- https://fortiguard.fortinet.com/psirt?date=2023&product=FortiWeb,FortiSIEM,… ∗∗∗ Siemens hat mit 14.09.2023 weitere 2 Security Advisories veröffentlicht ∗∗∗ --------------------------------------------- SSA-646240: Sensitive Information Disclosure in SIMATIC PCS neo Administration Console (5.5), SSA-357182: Local Privilege Escalation Vulnerability in Spectrum Power 7 (8.2) --------------------------------------------- https://www.siemens.com/global/en/products/services/cert.html#SecurityPubli… ∗∗∗ Wordfence Intelligence Weekly WordPress Vulnerability Report (September 4, 2023 to September 10, 2023) ∗∗∗ --------------------------------------------- Last week, there were 107 vulnerabilities disclosed in 89 WordPress Plugins and 5 WordPress themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 36 Vulnerability Researchers that contributed to WordPress Security last week. --------------------------------------------- https://www.wordfence.com/blog/2023/09/wordfence-intelligence-weekly-wordpr… ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (firefox-esr, libwebp, ruby-loofah, and ruby-rails-html-sanitizer), Fedora (open-vm-tools and salt), Oracle (.NET 7.0, dmidecode, flac, gcc, httpd:2.4, keylime, libcap, librsvg2, and qemu-kvm), Red Hat (.NET 6.0 and .NET 7.0), Slackware (libarchive and mozilla), SUSE (chromium and kernel), and Ubuntu (curl, firefox, ghostscript, open-vm-tools, postgresql-9.5, and thunderbird). --------------------------------------------- https://lwn.net/Articles/944481/ ∗∗∗ Drupal: Mail Login - Critical - Access bypass - SA-CONTRIB-2023-045 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2023-045 ∗∗∗ Rockwell Automation Pavilion8 ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-257-07 ∗∗∗ Palo Alto: CVE-2023-3280 Cortex XDR Agent: Local Windows User Can Disable the Agent (Severity: MEDIUM) ∗∗∗ --------------------------------------------- https://security.paloaltonetworks.com/CVE-2023-3280 ∗∗∗ Palo Alto: CVE-2023-38802 PAN-OS: Denial-of-Service (DoS) Vulnerability in BGP Software (Severity: HIGH) ∗∗∗ --------------------------------------------- https://security.paloaltonetworks.com/CVE-2023-38802 ∗∗∗ : PostgreSQL Vulnerability Affects IBM Connect:Direct Web Service (CVE-2023-39417) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7032120 ∗∗∗ CISA Adds Three Known Vulnerabilities to Catalog ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/alerts/2023/09/13/cisa-adds-three-known-vu… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 13.09.2023
by Daily end-of-shift report 13 Sep '23

13 Sep '23

===================== = End-of-Day report = ===================== Timeframe: Dienstag 12-09-2023 18:00 − Mittwoch 13-09-2023 18:00 Handler: Michael Schlagenhaufer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Patchday: Angriffe mittels präparierter PDF-Dateien auf Adobe Acrobat ∗∗∗ --------------------------------------------- Adobe hat in Acrobat und Reader, Connect und Experience Manager mehrere Sicherheitslücken geschlossen. --------------------------------------------- https://heise.de/-9303487 ∗∗∗ Notfallpatch sichert Firefox und Thunderbird gegen Attacken ab ∗∗∗ --------------------------------------------- Mozilla hat in seinen Webbrowsern und seinem Mailclient eine Sicherheitslücke geschlossen, die Angreifer bereits ausnutzen. --------------------------------------------- https://heise.de/-9303536 ∗∗∗ Microsoft Security Update Summary (12. September 2023) ∗∗∗ --------------------------------------------- Am 12. September 2023 hat Microsoft Sicherheitsupdates für Windows-Clients und -Server, für Office- sowie für weitere Produkte – veröffentlicht. Die Sicherheitsupdates beseitigen 61 CVE-Schwachstellen, zwei sind 0-day Schwachstellen. Nachfolgend findet sich ein kompakter Überblick über diese Updates [...] --------------------------------------------- https://www.borncity.com/blog/2023/09/13/microsoft-security-update-summary-… ∗∗∗ Threat landscape for industrial automation systems. Statistics for H1 2023 ∗∗∗ --------------------------------------------- In the first half of 2023, the percentage of ICS computers on which malicious objects were blocked decreased from H2 2022 by just 0.3 pp to 34%. --------------------------------------------- https://securelist.com/threat-landscape-for-industrial-automation-systems-s… ∗∗∗ Malware distributor Storm-0324 facilitates ransomware access ∗∗∗ --------------------------------------------- The threat actor that Microsoft tracks as Storm-0324 is a financially motivated group known to gain initial access using email-based initial infection vectors and then hand off access to compromised networks to other threat actors. These handoffs frequently lead to ransomware deployment. Beginning in July 2023, Storm-0324 was observed distributing payloads using an open-source tool [...] --------------------------------------------- https://www.microsoft.com/en-us/security/blog/2023/09/12/malware-distributo… ∗∗∗ Alert: New Kubernetes Vulnerabilities Enable Remote Attacks on Windows Endpoints ∗∗∗ --------------------------------------------- Three interrelated high-severity security flaws discovered in Kubernetes could be exploited to achieve remote code execution with elevated privileges on Windows endpoints within a cluster. The issues, tracked as CVE-2023-3676, CVE-2023-3893, and CVE-2023-3955, carry CVSS scores of 8.8 and impact all Kubernetes environments with Windows nodes. Fixes for the vulnerabilities were released on August 23, 2023, [...] --------------------------------------------- https://thehackernews.com/2023/09/alert-new-kubernetes-vulnerabilities.html ∗∗∗ OpenSSL 1.1.1 reaches end of life for all but the well-heeled ∗∗∗ --------------------------------------------- $50k to breathe new life into its corpse. The rest of us must move on to OpenSSL 3.0 OpenSSL 1.1.1 has reached the end of its life, making a move to a later version essential for all, bar those with extremely deep pockets. --------------------------------------------- https://go.theregister.com/feed/www.theregister.com/2023/09/12/openssl_111_… ∗∗∗ macOS Info-Stealer Malware ‘MetaStealer’ Targeting Businesses ∗∗∗ --------------------------------------------- The MetaStealer macOS information stealer has been targeting businesses to exfiltrate keychain and other valuable information. --------------------------------------------- https://www.securityweek.com/macos-info-stealer-malware-metastealer-targeti… ∗∗∗ How Next-Gen Threats Are Taking a Page From APTs ∗∗∗ --------------------------------------------- Cybercriminals are increasingly trying to find ways to get around security, detection, intelligence and controls as APTs start to merge with conventional cybercrime. --------------------------------------------- https://www.securityweek.com/how-next-gen-threats-are-taking-a-page-from-ap… ∗∗∗ How Three Letters Brought Down UK Air Traffic Control ∗∗∗ --------------------------------------------- The UK bank holiday weekend at the end of August is a national holiday in which it sometimes seems the entire country ups sticks and makes for somewhere with a beach. This year though, many of them couldn’t, because the country’s NATS air traffic system went down and stranded many to grumble in the heat of a crowded terminal. At the time it was blamed on faulty flight data, but news now emerges that the data which brought down an entire country’s air traffic control may have not been faulty at all. --------------------------------------------- https://hackaday.com/2023/09/13/how-three-letters-brought-down-uk-air-traff… ∗∗∗ 3AM: New Ransomware Family Used As Fallback in Failed LockBit Attack ∗∗∗ --------------------------------------------- Attackers resorted to new ransomware after deployment of LockBit was blocked on targeted network. --------------------------------------------- https://symantec-enterprise-blogs.security.com/threat-intelligence/3am-rans… ∗∗∗ White House urging dozens of countries to publicly commit to not pay ransoms ∗∗∗ --------------------------------------------- The U.S. National Security Council (NSC) is urging the governments of all countries participating in the International Counter Ransomware Initiative (CRI) to issue a joint statement announcing they will not pay ransoms to cybercriminals, according to three sources with knowledge of the plans. --------------------------------------------- https://therecord.media/counter-ransomware-initiative-members-ransom-paymen… ∗∗∗ September 2023 release of new Exchange Server CVEs (resolved by August 2023 Security Updates) ∗∗∗ --------------------------------------------- You may have noticed there were several new Exchange Server CVEs that were released today (a part of September 2023 ‘Patch Tuesday’). If you haven’t yet, you can go to the Security Update Guide and filter on Exchange Server under Product Family to review CVE information. The CVEs released today were actually addressed in the August 2023 Exchange Server Security Update (SU). Due to the timing of validation of those fixes and release dates, we decided to release the CVEs as a part of September 2023 ‘Patch Tuesday’ release cycle. We know that many customers are accustomed to checking for Microsoft security releases on the second Tuesday of every month, and we did not want these CVEs to go unnoticed. --------------------------------------------- https://techcommunity.microsoft.com/t5/exchange-team-blog/september-2023-re… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (e2guardian), Fedora (libeconf), Red Hat (dmidecode, kernel, kernel-rt, keylime, kpatch-patch, libcap, librsvg2, linux-firmware, and qemu-kvm), Slackware (mozilla), SUSE (chromium and shadow), and Ubuntu (cups, dotnet6, dotnet7, file, flac, and ruby-redcloth). --------------------------------------------- https://lwn.net/Articles/944354/ ∗∗∗ BSRT-2023-001 Vulnerabilities in Management Console and Self Service Impact AtHoc Server ∗∗∗ --------------------------------------------- https://support.blackberry.com/kb/articleDetail?language=en_US&articleNumbe… ∗∗∗ VU#347067: Multiple BGP implementations are vulnerable to improperly formatted BGP updates ∗∗∗ --------------------------------------------- https://kb.cert.org/vuls/id/347067 ∗∗∗ PHP Shopping Cart-4.2 Multiple-SQLi ∗∗∗ --------------------------------------------- https://cxsecurity.com/issue/WLB-2023090037 ∗∗∗ Cisco IOS XR Software Compression ACL Bypass Vulnerability ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco IOS XR Software Image Verification Vulnerability ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco IOS XR Software iPXE Boot Signature Bypass Vulnerability ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco IOS XR Software Model-Driven Programmability Behavior with AAA Authorization ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco IOS XR Software Connectivity Fault Management Denial of Service Vulnerability ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco IOS XR Software Access Control List Bypass Vulnerability ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ K000136157 : sssd vulnerability CVE-2022-4254 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000136157?utm_source=f5support&utm_medi… ∗∗∗ Trumpf: Multiple Products affected by WIBU Codemeter Vulnerability ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2023-031/ ∗∗∗ Elliptic Labs Virtual Lock Sensor Vulnerability ∗∗∗ --------------------------------------------- https://support.lenovo.com/product_security/PS500576-ELLIPTIC-LABS-VIRTUAL-… ∗∗∗ Lenovo XClarity Controller (XCC) Vulnerabilities ∗∗∗ --------------------------------------------- https://support.lenovo.com/product_security/PS500578 ∗∗∗ Intel Dynamic Tuning Technology Advisory ∗∗∗ --------------------------------------------- https://support.lenovo.com/product_security/PS500577-INTEL-DYNAMIC-TUNING-T… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily