- Daily - CERT.at

Tageszusammenfassung - 15.01.2020
by Daily end-of-shift report 15 Jan '20

15 Jan '20

===================== = End-of-Day report = ===================== Timeframe: Dienstag 14-01-2020 18:00 − Mittwoch 15-01-2020 18:00 Handler: Stephan Richter Co-Handler: Robert Waldner ===================== = News = ===================== ∗∗∗ Patch Tuesday: Windows patzt bei Zertifikatsprüfung ∗∗∗ --------------------------------------------- Eine Lücke in der Zertifikatsvalidierung von Windows ermöglicht es, die Codesignaturprüfung auszutricksen und TLS-Verbindungen anzugreifen. Zudem gibt es eine Sicherheitslücke im Remote Desktop Gateway. --------------------------------------------- https://www.golem.de/news/patch-tuesday-windows-patzt-bei-zertifikatspruefu… ∗∗∗ CISA Releases Emergency Directive and Activity Alert on Critical Microsoft Vulnerabilities ∗∗∗ --------------------------------------------- The Cybersecurity and Infrastructure Security Agency (CISA) has released an Emergency Directive and Activity Alert addressing critical vulnerabilities affecting Windows CryptoAPI, Windows Remote Desktop Gateway (RD Gateway), and Windows Remote Desktop Client. A remote attacker could exploit these vulnerabilities to decrypt, modify, or inject data on user connections. --------------------------------------------- https://www.us-cert.gov/ncas/current-activity/2020/01/14/cisa-releases-emer… ∗∗∗ Critical Cisco DCNM flaws: Patch right now as PoC exploits are released ∗∗∗ --------------------------------------------- The need to patch Cisco Data Center Network Manager for Nexus switches becomes even more urgent. --------------------------------------------- https://www.zdnet.com/article/critical-cisco-dcnm-flaws-patch-right-now-as-… ===================== = Vulnerabilities = ===================== ∗∗∗ Oracle Critical Patch Update Advisory - January 2020 ∗∗∗ --------------------------------------------- This Critical Patch Update contains 334 new security patches across the product families listed below. --------------------------------------------- https://www.oracle.com/security-alerts/cpujan2020.html ∗∗∗ Huawei Security Advisories ∗∗∗ --------------------------------------------- * Intel Microarchitectural Data Sampling (MDS) vulnerabilities * Three OpenSSL Vulnerabilities in Huawei Products * Page-Cache Side-Channel Vulnerability * Three DoS Vulnerabilities in the SIP Module of Some Huawei Products * Information Leakage Vulnerability in some Huawei Firewall Product * Buffer Overflow Vulnerability in QEMU-KVM * FRP Bypass Vulnerability in Huawei Smart Phones * Insufficient Authentication Vulnerability in Some Huawei Smart Phones * Improper Authentication Vulnerability in Smartphones * FragmentSmack Vulnerability in Linux Kernel * Two Integer Overflow Vulnerabilities in LDAP of Some Huawei Products --------------------------------------------- https://www.huawei.com/en/psirt/all-bulletins?name=security-advisories&year… ∗∗∗ Sicherheitsupdates: Intel-Lücken zur Rechteausweitung geschlossen ∗∗∗ --------------------------------------------- Intels Entwickler haben gefährliche Lücken in unter anderem Chip-/CPU-Software und VTune geschlossen. --------------------------------------------- https://heise.de/-4638307 ∗∗∗ VMSA-2020-0002 ∗∗∗ --------------------------------------------- VMware Tools workaround addresses a local privilege escalation vulnerability (CVE-2020-3941) --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2020-0002.html ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (thunderbird), CentOS (firefox), openSUSE (chromium, firefox, GraphicsMagick, log4j, nodejs8, phpMyAdmin, singularity, and virglrenderer), Oracle (kernel), Red Hat (firefox), SUSE (man, nodejs10, openssl-1_1, and php7), and Ubuntu (php5, php7.0, php7.2, php7.3 and spamassassin). --------------------------------------------- https://lwn.net/Articles/809624/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 14.01.2020
by Daily end-of-shift report 14 Jan '20

14 Jan '20

===================== = End-of-Day report = ===================== Timeframe: Montag 13-01-2020 18:00 − Dienstag 14-01-2020 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Windows 7 Reaches End of Life Tomorrow, What You Need to Know ∗∗∗ --------------------------------------------- Its the end of an era: Windows 7 will reach end of support tomorrow, on January 14, a decade after its initial release, with Microsoft to no longer provide users with software updates and security updates or fixes. --------------------------------------------- https://www.bleepingcomputer.com/news/microsoft/windows-7-reaches-end-of-li… ∗∗∗ Shitrix: Das Citrix-Desaster ∗∗∗ --------------------------------------------- Eine Sicherheitslücke in Geräten der Firma Citrix zeigt in erschreckender Weise, wie schlecht es um die IT-Sicherheit in Behörden steht. Es fehlt an den absoluten Grundlagen. --------------------------------------------- https://www.golem.de/news/shitrix-das-citrix-desaster-2001-146047-rss.html ∗∗∗ Malware Obfuscation, Encoding and Encryption ∗∗∗ --------------------------------------------- Malware is complex and meant to confuse. Many computer users think malware is just another word for “virus” when a virus is actually a type of malware. And in addition to viruses, malware includes all sorts of malicious and unwanted code, including spyware, adware, Trojans and worms. Malware has been known to shut down [...] --------------------------------------------- https://resources.infosecinstitute.com/malware-obfuscation-encoding-and-enc… ∗∗∗ CISA Releases Test for Citrix ADC and Gateway Vulnerability ∗∗∗ --------------------------------------------- The Cybersecurity and Infrastructure Security Agency (CISA) has released a utility that enables users and administrators to test whether their Citrix Application Delivery Controller (ADC) and Citrix Gateway software is susceptible to the CVE-2019-19781 vulnerability. According to Citrix Security Bulletin CTX267027, beginning on January 20, 2020, Citrix will be releasing new versions of Citrix ADC and Citrix Gateway that will patch CVE-2019-19781. --------------------------------------------- https://www.us-cert.gov/ncas/current-activity/2020/01/13/cisa-releases-test… ∗∗∗ Mehrwertdienste von Drittanbietern auf Ihrer Handyrechnung sind meist Abo-Fallen ∗∗∗ --------------------------------------------- Eine Handyrechnung, die höher ausfällt als gewohnt, bedeutet meist nichts Gutes. Oftmals finden Sie Abbuchungen von Drittanbietern, Mehrwert- oder Partnerdiensten auf Ihrer Rechnung. Sie haben wahrscheinlich unwissentlich bei einem unseriösen Anbieter einen Abo-Vertrag abgeschlossen. Ihr Geld ist höchstwahrscheinlich jedoch nicht verloren: Sie können die Rechnung beim Mobilfunkanbieter beanstanden! --------------------------------------------- https://www.watchlist-internet.at/news/mehrwertdienste-von-drittanbietern-a… ∗∗∗ Microsoft spots malicious npm package stealing data from UNIX systems ∗∗∗ --------------------------------------------- Malicious JavaScript package was only active on the npm repository for two weeks. --------------------------------------------- https://www.zdnet.com/article/microsoft-spots-malicious-npm-package-stealin… ===================== = Vulnerabilities = ===================== ∗∗∗ Security Bulletins Posted ∗∗∗ --------------------------------------------- Adobe has published security bulletins for Adobe Experience Manager (APSB20-01) and Adobe Illustrator (APSB20-03). Adobe recommends users update their product installations to the latest versions using the instructions referenced in the bulletin. This posting is provided “AS IS” with no warranties and confers no rights. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1820 ∗∗∗ XSA-312 - arm: a CPU may speculate past the ERET instruction ∗∗∗ --------------------------------------------- Some CPUs can speculate past an ERET instruction and potentially perform speculative accesses to memory before processing the exception return. Since the register state is often controlled by lower privilege level (i.e guest kernel/userspace) at the point of the ERET, this could potentially be used as part of a side-channel attack. --------------------------------------------- https://xenbits.xen.org/xsa/advisory-312.html ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (wordpress and xen), Mageia (graphicsmagick, kernel, makepasswd, and unbound), openSUSE (containerd, docker, docker-runc,, dia, ffmpeg-4, libgcrypt, php7-imagick, proftpd, rubygem-excon, shibboleth-sp, tomcat, trousers, and xen), Oracle (firefox), Red Hat (kernel), Scientific Linux (firefox), SUSE (e2fsprogs, kernel, and libsolv, libzypp, zypper), and Ubuntu (libgcrypt20, libvirt, nginx, sdl-image1.2, and spamassassin). --------------------------------------------- https://lwn.net/Articles/809506/ ∗∗∗ SAP Security Patch Day – January 2020 ∗∗∗ --------------------------------------------- This post by SAP Product Security Response Team shares information on Patch Day Security Notes* that are released on second Tuesday of every month and fix vulnerabilities discovered in SAP products. SAP strongly recommends that the customer visits the Support Portal and applies patches on a priority to protect their SAP landscape. On 14th of January 2020, SAP Security Patch Day saw the release of 6 Security Notes. There are 1 updates to previously released Patch Day [...] --------------------------------------------- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=533671771 ∗∗∗ Siemens Security Advisories ∗∗∗ --------------------------------------------- https://new.siemens.com/global/en/products/services/cert.html#SecurityPubli… ∗∗∗ BIG-IP engineering hotfix TMM vulnerability CVE-2020-5852 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K53590702 ∗∗∗ BIG-IP APM Portal Access vulnerability CVE-2020-5853 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K73183618 ∗∗∗ BIG-IP engineering hotfix Trusted Platform Module vulnerability CVE-2020-5851 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K91171450 ∗∗∗ Critical Authentication Bypass Vulnerability in InfiniteWP Client Plugin ∗∗∗ --------------------------------------------- https://www.wordfence.com/blog/2020/01/critical-authentication-bypass-vulne… ∗∗∗ OTRS: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-0026 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 13.01.2020
by Daily end-of-shift report 13 Jan '20

13 Jan '20

===================== = End-of-Day report = ===================== Timeframe: Freitag 10-01-2020 18:00 − Montag 13-01-2020 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Citrix CVE-2019-19781 aktiv ausgenutzt ∗∗∗ --------------------------------------------- Ende 2019 wurde eine Sicherheitslücke in diversen Citrix-Geräten bekannt (CVE-2019-19781), die das Ausführen beliebiger Befehle über das Netzwerk ohne jegliche Authentifikation ermöglicht (unauthenticated RCE). Am 10. Jänner 2020 wurde der erste Exploit für diese Lücke auf GitHub veröffentlicht und sie wird (spätestens) seit diesem Zeitpunkt aktiv ausgenutzt. --------------------------------------------- https://cert.at/de/blog/2020/1/citrix-cve-2019-19781-aktiv-ausgenutzt ∗∗∗ Network Traffic Analysis for Incident Response: Internet Protocol with Wireshark ∗∗∗ --------------------------------------------- The Internet Protocol (IP) is the most widely-used network-level protocol. Common transport-level protocols, the Transport Control Protocol (TCP) and the User Datagram Protocol (UDP), are encapsulated within IP packets. The purpose of IP is to make networks like the internet possible. Within a subnet, it is possible to route traffic [...] --------------------------------------------- https://resources.infosecinstitute.com/network-traffic-analysis-for-inciden… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (file and firefox), Debian (apache-log4j1.2), Fedora (chromium, dovecot, GraphicsMagick, kubernetes, libvpx, makepasswd, matio, and slurm), Mageia (libtomcrypt, ming, oniguruma, opencv, pcsc-lite, phpmyadmin, and thunderbird), openSUSE (chromium, chromium, re2, and mozilla-nspr, mozilla-nss), Red Hat (chromium-browser, firefox, and rabbitmq-server), Slackware (mozilla), and SUSE (crowbar-core, crowbar-openstack, [...] --------------------------------------------- https://lwn.net/Articles/809312/ ∗∗∗ Security Advisory - Weak Algorithm Vulnerability in Some Huawei Products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20200108-… ∗∗∗ Security Vulnerabilities fixed in Thunderbird 68.4.1 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2020-04/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 10.01.2020
by Daily end-of-shift report 10 Jan '20

10 Jan '20

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 09-01-2020 18:00 − Freitag 10-01-2020 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Remote iPhone Exploitation Part 1: Poking Memory via iMessage and CVE-2019-8641 ∗∗∗ --------------------------------------------- This is the first blog post in a three-part series that will detail how a vulnerability in iMessage can be exploited remotely without any user interaction on iOS 12.4 (fixed in iOS 12.4.1 in August 2019). It is essentially a more detailed version of my 36C3 talk from December 2019. --------------------------------------------- https://googleprojectzero.blogspot.com/2020/01/remote-iphone-exploitation-p… ∗∗∗ Windows Debugging & Exploiting Part 3: WinDBG Time Travel Debugging ∗∗∗ --------------------------------------------- Time to start 2020? No better time for writing about the TTD (Time Travel Debugging) feature from WinDBG. --------------------------------------------- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/windows-deb… ===================== = Vulnerabilities = ===================== ∗∗∗ D-LINK Router: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit Administratorrechten ∗∗∗ --------------------------------------------- Betroffene Systeme: D-LINK Router DCS-935L, D-LINK Router DCS-960L Ein entfernter, anonymer Angreifer kann eine Schwachstelle in D-LINK Routern ausnutzen, um die Kontrolle über das Gerät zu übernehmen. --------------------------------------------- https://www.bsi-fuer-buerger.de/SharedDocs/Warnmeldungen/DE/TW/2020/01/warn… ∗∗∗ VMSA-2020-0001 - VMware Workspace ONE SDK and dependent mobile application updates address sensitive information disclosure vulnerability (CVE-2020-3940) ∗∗∗ --------------------------------------------- VMware Workspace ONE SDK and dependent mobile applications do not properly handle certificate verification failures if SSL Pinning has been enabled in the Workspace ONE UEM Console. VMware has evaluated the severity of this issue to be in the moderate severity range with a maximum CVSSv3 base score of 6.8. --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2020-0001.html ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (ldm and sa-exim), Mageia (firefox), openSUSE (chromium, firefox, and thunderbird), SUSE (containerd, docker, docker-runc, golang-github-docker-libnetwork, firefox, log4j, nodejs10, nodejs12, and openssl-1_0_0), and Ubuntu (firefox). --------------------------------------------- https://lwn.net/Articles/809175/ ∗∗∗ Mattermost security update 5.18.1 / 5.17.3 / 5.16.5 / 5.9.8 (ESR) released ∗∗∗ --------------------------------------------- We have released a recommended security update via Mattermost Team Edition 5.18.1, 5.17.3, 5.16.5, 5.9.8 (ESR) and Mattermost Enterprise Edition 5.18.1, 5.17.3, 5.16.5, 5.9.8 (ESR). This security update addresses a high level vulnerability discovered during a security research review by Juho Nurminen. --------------------------------------------- https://mattermost.com/blog/mattermost-security-update-5-18-1-5-17-3-5-16-5… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 09.01.2020
by Daily end-of-shift report 09 Jan '20

09 Jan '20

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 08-01-2020 18:00 − Donnerstag 09-01-2020 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ SNAKE Ransomware Is the Next Threat Targeting Business Networks ∗∗∗ --------------------------------------------- Since network administrators didnt already have enough on their plate, they now have to worry about a new ransomware called SNAKE that is targeting their networks and aiming to encrypt all of the devices connected to it [...] --------------------------------------------- https://www.bleepingcomputer.com/news/security/snake-ransomware-is-the-next… ∗∗∗ A tale of a lesser known NFS privesc ∗∗∗ --------------------------------------------- There are countless online examples of privilege escalation abusing bad NFS configuration. However they all rely on the same prerequisite: that you are able to mount the share from somewhere else. ... But it just so happens that there is another, lesser known local exploit. --------------------------------------------- https://www.errno.fr/nfs_privesc ∗∗∗ What is the Linux Auditing System (aka AuditD)? ∗∗∗ --------------------------------------------- The Linux Auditing System is a native feature to the Linux kernel that collects certain types of system activity to facilitate incident investigation. ... Our goal is to present a neutral overview of the Linux Auditing System so anyone considering implementing it in their own organization knows what to consider before embarking on their quest and what challenges may lurk ahead. --------------------------------------------- https://capsule8.com/blog/auditd-what-is-the-linux-auditing-system/ ===================== = Vulnerabilities = ===================== ∗∗∗ Schnell updaten: Sicherheitslücke in Firefox wird aktiv ausgenutzt ∗∗∗ --------------------------------------------- Firefox hat mit Version 72.0.1 ein wichtiges Sicherheitsupdate herausgegeben. Geschlossen wird eine Sicherheitslücke, die bereits aktiv ausgenutzt wird. Gemeldet wurde sie von einer chinesischen Sicherheitsfirma. (Firefox, Browser) --------------------------------------------- https://www.golem.de/news/schnell-updaten-sicherheitsluecke-in-firefox-wird… ∗∗∗ What is Cable Haunt? ∗∗∗ --------------------------------------------- Cable Haunt is a critical vulnerability found in cable modems from various manufacturers across the world. ... First, access to the vulnerable endpoint is gained through a client on the local network, such as a browser. Secondly the vulnerable endpoint is hit with a buffer overflow attack, which gives the attacker control of the modem. .. list of confirmed vulnerable modems: Sagemcom F@st 3890/3986, Technicolor TC7230, Netgear C6250EMR/CG3700EMR, COMPAL 7284E/7486E --------------------------------------------- https://cablehaunt.com/ ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (firefox-esr), Fedora (firefox), Oracle (kernel), Slackware (firefox and kernel), SUSE (apache2-mod_perl, git, java-1_7_0-ibm, java-1_7_1-ibm, log4j, mariadb, and nodejs8), and Ubuntu (gnutls28, graphicsmagick, and nss). --------------------------------------------- https://lwn.net/Articles/809074/ ∗∗∗ CVE-2020-6175 - Citrix SD-WAN Security Update ∗∗∗ --------------------------------------------- An information disclosure vulnerability has been identified in the Citrix SD-WAN Appliance. This vulnerability could allow an unauthenticated attacker to perform a man-in-the-middle attack against management traffic. The vulnerability has been assigned the following CVE number. CVE-2020-6175 – Information Disclosure in Citrix SD-WAN Appliance 10.2.x before 10.2.6 and 11.0.x before 11.0.3 --------------------------------------------- https://support.citrix.com/article/CTX263526 ∗∗∗ JSA10979 - 2020-01 Security Bulletin: Junos OS: A specific SNMP command can trigger a high CPU usage Denial of Service in the RPD daemon. (CVE-2020-1600) ∗∗∗ --------------------------------------------- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10979&actp=RSS ∗∗∗ JSA10980 - 2020-01 Security Bulletin: Junos OS: Upon receipt of certain types of malformed PCEP packets the pccd process may crash. (CVE-2020-1601) ∗∗∗ --------------------------------------------- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10980&actp=RSS ∗∗∗ JSA10982 - 2020-01 Security Bulletin: Junos OS: Improper handling of specific IPv6 packets sent by clients may cause client devices IPv6 traffic to be black holed, and eventually kernel crash (vmcore) the device. (CVE-2020-1603) ∗∗∗ --------------------------------------------- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10982&actp=RSS ∗∗∗ JSA10981 - 2020-01 Security Bulletin: Junos OS and Junos OS Evolved: Multiple vulnerabilities in JDHCPD allow for OS command injection and code execution of JDHCPD. ∗∗∗ --------------------------------------------- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10981&actp=RSS ∗∗∗ JSA10983 - 2020-01 Security Bulletin: Junos OS: EX4300/EX4600/QFX3500/QFX5100 Series: Stateless IP firewall filter may fail to evaluate certain packets (CVE-2020-1604) ∗∗∗ --------------------------------------------- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10983&actp=RSS ∗∗∗ JSA10985 - 2020-01 Security Bulletin: Junos OS: Path traversal vulnerability in J-Web (CVE-2020-1606) ∗∗∗ --------------------------------------------- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10985&actp=RSS ∗∗∗ JSA10986 - 2020-01 Security Bulletin: Junos OS: Cross-Site Scripting (XSS) in J-Web (CVE-2020-1607) ∗∗∗ --------------------------------------------- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10986&actp=RSS ∗∗∗ JSA10987 - 2020-01 Security Bulletin: Junos OS: MX Series: In BBE configurations, receipt of a specific MPLS or IPv6 packet causes a Denial of Service (CVE-2020-1608) ∗∗∗ --------------------------------------------- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10987&actp=RSS ∗∗∗ JSA10990 - 2020-01 Security Bulletin: SBR Carrier: Multiple Vulnerabilities in OpenSSL ∗∗∗ --------------------------------------------- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10990&actp=RSS ∗∗∗ JSA10991 - 2020-01 Security Bulletin: SBR Carrier: Multiple Vulnerabilities in Net-SNMP ∗∗∗ --------------------------------------------- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10991&actp=RSS -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 08.01.2020
by Daily end-of-shift report 08 Jan '20

08 Jan '20

===================== = End-of-Day report = ===================== Timeframe: Dienstag 07-01-2020 18:00 − Mittwoch 08-01-2020 18:00 Handler: Robert Waldner Co-Handler: Dimitri Robl ===================== = News = ===================== ∗∗∗ Project Zero: Googles Bug-Jäger wollen weniger schludrige Patches ∗∗∗ --------------------------------------------- Im laufenden Jahr wollen Googles Security-Bug-Forscher des Project Zero die Disclosure-Richtlinien ändern. Das soll betroffenen Unternehmen nicht nur Updates erleichtern, sondern vor allem die Qualität der Patches verbessern. --------------------------------------------- https://www.golem.de/news/project-zero-googles-bug-jaeger-wollen-weniger-sc… ∗∗∗ The Basics of Packed Malware: Manually Unpacking UPX Executables ∗∗∗ --------------------------------------------- In this blog post, I want to discuss what packing is, the basics of why malware developers pack their samples and how they go about doing so. Since this is an introductory post, and I myself am still learning all this stuff, we’re going to be manually unpacking a UPX-packed binary, which is one of the simplest packers out there. --------------------------------------------- https://kindredsec.com/2020/01/07/the-basics-of-packed-malware-manually-unp… ∗∗∗ Tricky Phish Angles for Persistence, Not Passwords ∗∗∗ --------------------------------------------- The phishing lure starts with a link that leads to the real login page for a cloud email and/or file storage service. Anyone who takes the bait will inadvertently forward a digital token to the attackers that gives them indefinite access to the victim’s email, files and contacts — even after the victim has changed their password. --------------------------------------------- https://krebsonsecurity.com/2020/01/tricky-phish-angles-for-persistence-not… ∗∗∗ SMS von TrackInfo zu gestopptem DHL-Paket führt in Abo-Falle ∗∗∗ --------------------------------------------- Zahlreiche LeserInnen wenden sich momentan an die Watchlist Internet, weil sie eine SMS von TrackInfo zu einem unzustellbaren Paket erhalten haben. Ein Link in der Nachricht führt auf eine gefälschte DHL-Website. Wegen zu hohen Gewichts müssten nun 2 Euro bezahlt werden. Achtung: Die Nachricht stammt von Kriminellen und soll EmpfängerInnen in eine Abo-Falle locken! --------------------------------------------- https://www.watchlist-internet.at/news/sms-von-trackinfo-zu-gestopptem-dhl-… ===================== = Vulnerabilities = ===================== ∗∗∗ Interpeak IPnet TCP/IP Stack (Update D) ∗∗∗ --------------------------------------------- This updated medical advisory is a follow-up to the advisory update titled ICSMA-19-274-01 Interpeak IPnet TCP/IP Stack (Update C) published November 5, 2019, on the ICS webpage on us-cert.gov. This updated medical advisory contains mitigations for stack-based buffer overflow, heap-based buffer overflow, integer underflow, improper restriction of operations within the bounds of a memory buffer, race condition, argument injection, and null pointer dereference vulnerabilities in the Interpeak [...] --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsma-19-274-01 ∗∗∗ PMASA-2020-1 ∗∗∗ --------------------------------------------- SQL injection in user accounts pageAffected VersionsphpMyAdmin 4.x versions prior to 4.9.4 are affected, at least as old as 4.0.0. phpMyAdmin 5.x version 5.0.0 is affected.CVE IDCVE-2020-5504 --------------------------------------------- https://www.phpmyadmin.net/security/PMASA-2020-1/ ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (firefox), Debian (python-django and wordpress), Fedora (dovecot), Mageia (opensc, radare2, and varnish), Red Hat (rh-java-common-apache-commons-beanutils), SUSE (containerd, docker, docker-runc, golang-github-docker-libnetwork, java-1_8_0-ibm, java-1_8_0-openjdk, libzypp, openssl-1_0_0, sysstat, and tomcat), and Ubuntu (clamav, linux-azure, and linux-lts-xenial, linux-aws). --------------------------------------------- https://lwn.net/Articles/808975/ ∗∗∗ Fortinet FortiSIEM 5.2.5 / 5.2.6 Hardcoded Key ∗∗∗ --------------------------------------------- https://cxsecurity.com/issue/WLB-2020010061 ∗∗∗ Cisco AnyConnect Secure Mobility Client for Android Service Hijack Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco Webex Video Mesh Node Command Injection Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco Webex Centers Denial of Service Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco Vision Dynamic Signage Director Authentication Bypass Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco UCS Director Information Disclosure Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco Mobility Management Entity Denial of Service Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco Identity Services Engine Authorization Bypass Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware Cross-Site Scripting Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco IOS and Cisco IOS XE Software Web UI Cross-Site Request Forgery Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco Finesse Cross-Site Scripting Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco Emergency Responder Stored Cross-Site Scripting Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco Data Center Analytics Framework Cross-Site Scripting Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco Unified Customer Voice Portal Insecure Direct Object Reference Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco Crosswork Change Automation Cross-Site Scripting Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Security Advisory - Weak Algorithm Vulnerability in Some Huawei Products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20200108-… ∗∗∗ Security Advisory - Information Leak Vulnerability in Some Huawei Product ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20200108-… ∗∗∗ Security Advisory - Improper Authentication Vulnerability in Several Smartphones ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20200108-… ∗∗∗ Security Advisory - Improper Authentication Vulnerability in Several Smartphones ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20200108-… ∗∗∗ January 6, 2020 TNS-2020-01 [R1] SimpleSAMLPHP Stand-alone Patch Available for Tenable.sc versions 5.9.x to 5.12.x ∗∗∗ --------------------------------------------- http://www.tenable.com/security/tns-2020-01-0 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 07.01.2020
by Daily end-of-shift report 07 Jan '20

07 Jan '20

===================== = End-of-Day report = ===================== Timeframe: Freitag 03-01-2020 18:00 − Dienstag 07-01-2020 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ In eigener Sache: CERT.at sucht Verstärkung ∗∗∗ --------------------------------------------- Für ein internationales Projekt suchen wir eine/n erfahrene/n Pythonentwickler/in (Vollzeit) zum ehestmöglichen Einstieg. Details finden sich auf unserer Jobs-Seite. --------------------------------------------- https://cert.at/de/ueber-uns/jobs/ ∗∗∗ Fake Windows 10 Desktop Used in New Police Browser Lock Scam ∗∗∗ --------------------------------------------- Scammers have taken an old browser scam and invigorated it using a clever and new tactic that takes advantage of your web browsers full-screen mode to show a fake Windows 10 desktop stating your computer is locked. --------------------------------------------- https://www.bleepingcomputer.com/news/security/fake-windows-10-desktop-used… ∗∗∗ Android-Schadsoftware: Die Tricks mit der Google-Sicherheitslücke ∗∗∗ --------------------------------------------- Sicherheitsforscher haben Schad-Apps im Play Store gefunden, die über eine Google lange bekannte Android-Sicherheitslücke und weitere Tricks Nutzer ausspionierten. Die im Oktober aktiv ausgenutzte Lücke hatte Google eineinhalb Jahre vorher selbst entdeckt. --------------------------------------------- https://www.golem.de/news/android-schadsoftware-die-tricks-mit-der-google-s… ∗∗∗ A Quick Update on Scanning for CVE-2019-19781 (Citrix ADC / Gateway Vulnerability), (Tue, Jan 7th) ∗∗∗ --------------------------------------------- For the last week, I have been monitoring our honeypot logs for evidence of exploits taking advantage of CVE-2019-19781. Currently, I have not seen an actual "exploit" being used. But there is some evidence that people are scanning for vulnerable systems. Based on some of the errors made with these scans, I would not consider them "sophisticated." There is luckily still no public exploit I am aware of. --------------------------------------------- https://isc.sans.edu/diary/rss/25686 ∗∗∗ The Hidden Cost of Ransomware: Wholesale Password Theft ∗∗∗ --------------------------------------------- Moral of the story: Companies that experience a ransomware attack — or for that matter any type of equally invasive malware infestation — should assume that all credentials stored anywhere on the local network (including those saved inside Web browsers and password managers) are compromised and need to be changed. --------------------------------------------- https://krebsonsecurity.com/2020/01/the-hidden-cost-of-ransomware-wholesale… ∗∗∗ Breaking PHPs mt_rand() with 2 values and no bruteforce ∗∗∗ --------------------------------------------- .. one of our researchers was adamant that it was possible to recover the Mersenne Twister seed using only two outputs of the mt_rand() function, and without any kind of bruteforce. Nevertheless, we were unable to find any information supporting this theory, and his notes on the matter were long lost. After crunching the numbers a little bit, and years after the PRNG-prediction circus, we proved him right. --------------------------------------------- https://www.ambionics.io/blog/php-mt-rand-prediction ∗∗∗ SSH Client Auditing & Hardening ∗∗∗ --------------------------------------------- Its been known for years now that SSH servers can (and should) be hardened by removing weak default algorithms. For example, recent versions of OpenSSH ship with algorithms suspected suspected of being back-doored by the NSA (i.e.: ECDSA with the NIST P-curves), along with other algorithms with sub-128bit security levels. But did you know that client software can be hardened too? --------------------------------------------- https://www.positronsecurity.com/blog/2020-01-07-ssh-client-auditing-and-ha… ∗∗∗ SSH Pentesting Guide ∗∗∗ --------------------------------------------- In this guide, I will: * Quickly introduce the SSH protocol and implementations. * Expose some common configuration mistakes then showcase some attacks on the protocol & implementations. * Present some SSH pentesting & blue team tools. * Give a standard reference for security guidelines --------------------------------------------- https://community.turgensec.com/ssh-hacking-guide/ ∗∗∗ First Chosen-Prefix Collision on SHA-1 and Application to the PGP Web of Trust [PDF] ∗∗∗ --------------------------------------------- In this paper, we report the first practical implementation of this attack, and its impact on real-world security with a PGP/GnuPG impersonation attack. We managed to significantly reduce the complexity of collisions attack against SHA-1.. --------------------------------------------- https://eprint.iacr.org/2020/014.pdf ∗∗∗ Jetzt patchen! Ransomware-Attacken auf VPN-Server mit Pulse Connect Secure ∗∗∗ --------------------------------------------- Erneut nehmen Angreifer VPN-Server mit Pulse Connect Secure ins Visier und nutzen eine kritische Sicherheitslücke aus. Ein Patch ist schon länger verfügbar. --------------------------------------------- https://heise.de/-4629452 ∗∗∗ Versteckte Kosten bei Übernachtungsgutscheinen von Geoplus ∗∗∗ --------------------------------------------- Wie zahlreiche InternetnutzerInnen erhalten Sie womöglich E-Mails von Geoplus, in denen Sie zur Teilnahme an einer europäischen Studie eingeladen werden. Dafür verspricht man Ihnen einen Gutschein für bis zu fünf kostenlose Übernachtungen in über 500 Hotels in 14 Ländern. Achtung: Von „kostenlos“ kann nicht die Rede sein, denn beim Einlösen der Gutscheine müssen Sie Zahlung von Pflichtverpflegungssätzen leisten. --------------------------------------------- https://www.watchlist-internet.at/news/versteckte-kosten-bei-uebernachtungs… ∗∗∗ What is the random oracle model and why should you care? (Part 5) ∗∗∗ --------------------------------------------- This is part five of a series on the Random Oracle Model. See here for the previous posts: Part 1: An introduction Part 2: The ROM formalized, a scheme and a proof sketch Part 3: How we abuse the ROM to make our security proofs work Part 4: Some more examples of where the ROM … Continue reading What is the random oracle model and why should you care? (Part 5) → --------------------------------------------- https://blog.cryptographyengineering.com/2020/01/05/what-is-the-random-orac… ∗∗∗ Half of the websites using WebAssembly use it for malicious purposes ∗∗∗ --------------------------------------------- In an academic research project that was carried out last year, four researchers from the Technical University in Braunschweig, Germany, looked at WebAssembly's use on the Alexa Top 1 Million popular sites on the internet, in an attempt to gauge the popularity of this new technology. --------------------------------------------- https://www.zdnet.com/article/half-of-the-websites-using-webassembly-use-it… ===================== = Vulnerabilities = ===================== ∗∗∗ Android Security Bulletin—January 2020 ∗∗∗ --------------------------------------------- The most severe of these issues is a critical security vulnerability in Media framework that could enable a remote attacker using a specially crafted file to execute arbitrary code within the context of a privileged process. --------------------------------------------- https://source.android.com/security/bulletin/2020-01-01.html ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (netty) and Fedora (libssh, nethack, php, samba, and xen). --------------------------------------------- https://lwn.net/Articles/808621/ ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Fedora (chromium, cyrus-imapd, drupal7-l10n_update, drupal7-webform, htmldoc, nethack, php, and singularity), Mageia (advancecomp, apache-commons-compress-, cyrus-imapd, cyrus-sasl, dia, freeimage, freeradius, igraph, jhead, jss, libdwarf, libextractor, libxml2, mediawiki, memcached, mozjs60, openconnect, openssl, putty, python-ecdsa, python-werkzeug, shadowsocks-libev, and upx), Oracle (container-tools:1.0 and container-tools:ol8), and Red Hat --------------------------------------------- https://lwn.net/Articles/808803/ ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (nss and pillow), Red Hat (java-1.8.0-ibm and kernel), Slackware (firefox), SUSE (virglrenderer), and Ubuntu (linux, linux-aws, linux-aws-5.0, linux-azure, linux-gcp, linux-gke-5.0, linux-kvm, linux-oem-osp1, linux-oracle, linux-oracle-5.0, linux-raspi2, linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon, linux-kvm, linux-oracle, linux-raspi2, and linux-snapdragon). --------------------------------------------- https://lwn.net/Articles/808881/ ∗∗∗ Security Vulnerabilities fixed in Firefox 72 ∗∗∗ --------------------------------------------- Severity: high CVE-2019-17015: Memory corruption in parent process during new content process initialization on Windows CVE-2019-17016: Bypass of @namespace CSS sanitization during pasting CVE-2019-17017: Type Confusion in XPCVariant.cpp --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2020-01/ ∗∗∗ Security Bulletin: Multiple Vulnerabilities in Liberty affect IBM WIoTP MessageGateway ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM MessageSight ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Financial Transaction Manager for Corporate Payment Services for Multi-Platform ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Financial Transaction Manager for Check Services is affected by a potential cross-site scripting (XSS) vulnerability (CVE-2018-15494) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-financial-transaction-man… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Financial Transaction Manager for Check Services for Multi-Platform ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Financial Transaction Manager for Corporate Payment Services is affected by a potential cross-site scripting (XSS) vulnerability (CVE-2018-15494) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-financial-transaction-man… ∗∗∗ Security Bulletin: Security Vulnerabilties have been addressed in IBM Cognos Analytics ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-security-vulnerabilties-h… ∗∗∗ Security Bulletin: Information Exposure vulnerability found on IBM Security Secret Server (CVE-2019-4634) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-information-exposure-vuln… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 03.01.2020
by Daily end-of-shift report 03 Jan '20

03 Jan '20

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 02-01-2020 18:00 − Freitag 03-01-2020 18:00 Handler: Robert Waldner Co-Handler: Dimitri Robl ===================== = News = ===================== ∗∗∗ Promiscuous Cookies and Their Impending Death via the SameSite Policy ∗∗∗ --------------------------------------------- Cookies like to get around. They have no scruples about where they go save for some basic constraints relating to the origin from which they were set. I mean have a think about it:If a website sets a cookie then you click a link to another page on that [...] --------------------------------------------- https://www.troyhunt.com/promiscuous-cookies-and-their-impending-death-via-… ∗∗∗ Gefälschte E-Mail zu Amazon-Bestellung ∗∗∗ --------------------------------------------- Kriminelle versenden derzeit E-Mails zu einer angeblichen Amazon-Bestellung. In der Mail wird darauf hingewiesen, dass eine Bestellung von einem bisher nicht benutzten Gerät aus getätigt wurde. Im Anhang findet man ein PDF mit Infos zur angeblichen Bestellung und der Möglichkeit, die Bestellung zu stornieren. Wer das tut, gibt seine Amazon-Zugangsdaten an Kriminelle weiter! --------------------------------------------- https://www.watchlist-internet.at/news/gefaelschte-e-mail-zu-amazon-bestell… ===================== = Vulnerabilities = ===================== ∗∗∗ Workaround verfügbar: Kritische Lücke in Citrix ADC und Gateway ∗∗∗ --------------------------------------------- Angreifer könnten Systeme mit Citrix ADC und Gateway attackieren und Schadcode ausführen. Patches sind bislang nicht erschienen. --------------------------------------------- https://heise.de/-4627525 ∗∗∗ Vulnerability Spotlight: Two buffer overflow vulnerabilities in OpenCV ∗∗∗ --------------------------------------------- Cisco Talos recently discovered two buffer overflow vulnerabilities in the OpenCV libraries. An attacker could potentially exploit these bugs to cause heap corruptions and potentially code execution. Intel Research originally developed OpenCV in 1999, but it is currently maintained by the non-profit organization OpenCV.org. OpenCV is used for numerous applications, including facial recognition technology, robotics, motion tracking [...] --------------------------------------------- https://blog.talosintelligence.com/2020/01/opencv-buffer-overflow-jan-2020.… ∗∗∗ WooCommerce Conversion Tracking < 2.0.6 - CSRF to XSS ∗∗∗ --------------------------------------------- https://wpvulndb.com/vulnerabilities/10001 ∗∗∗ Security Bulletin: Security Vulnerabilities affect IBM Cloud Private – OpenSSL (CVE-2019-1563, CVE-2019-1549, CVE-2019-1547) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-security-vulnerabilities-… ∗∗∗ Security Bulletin: IBM Cloud Private is vulnerable to a Kubernetes vulnerability (CVE-ID: CVE-2019-11244) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cloud-private-is-vuln… ∗∗∗ Security Bulletin: A vulnerability in IBM Java Runtime affects IBM Tivoli Storage Manager FastBack (CVE-2019-2816) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-ibm-ja… ∗∗∗ Security Bulletin: Vulnerabities in SSL in IBM DataPower Gateway ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabities-in-ssl-in-i… ∗∗∗ Security Bulletin: IBM DataPower Gateway is potentially vulnerable to two cryptographic side-channel vulnerabilities in SSL. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-datapower-gateway-is-… ∗∗∗ Security Bulletin: Potential side-channel cryptographic vulnerabilities in IBM DataPower Gateway ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-potential-side-channel-cr… ∗∗∗ Security Bulletin: Security Vulnerabilities affect IBM Cloud Private Cloud Foundry – Python (CVE-2019-9947, CVE-2019-9948) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-security-vulnerabilities-… ∗∗∗ Security Bulletin: Potential disclosure of information in IBM DataPower Gateway (CVE-2018-14348) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-potential-disclosure-of-i… ∗∗∗ D-LINK Router: Schwachstelle ermöglicht Offenlegung von Informationen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-0002 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 02.01.2020
by Daily end-of-shift report 02 Jan '20

02 Jan '20

===================== = End-of-Day report = ===================== Timeframe: Montag 30-12-2019 18:00 − Donnerstag 02-01-2020 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Ransomware in Node.js, (Thu, Jan 2nd) ∗∗∗ --------------------------------------------- Here is a sample that I spotted two days ago. Its an interesting one because its a malware that implements ransomware features developed in Node.js! The stage one is not obfuscated and I suspect the script to be a prototype or a test... --------------------------------------------- https://isc.sans.edu/diary/rss/25664 ∗∗∗ The Anatomy of Website Malware Part 2: Credit Card Stealers ∗∗∗ --------------------------------------------- One of the biggest malicious trends in the last few months and years are credit card stealers — also commonly referred to as credit card skimmers or cc stealers . In the second part of this Website Malware Anatomy series, I’m going to deconstruct several skimmers and show you what they look like, where they are hiding, and how they work. --------------------------------------------- https://blog.sucuri.net/2019/12/the-anatomy-of-website-malware-part-2-credi… ∗∗∗ Kaufen Sie keine Welpen auf realpuppieshome.com ∗∗∗ --------------------------------------------- Auf realpuppieshome.com werden Ihnen zahlreiche entzückende Zuchtwelpen angezeigt und zur Adoption angeboten. Die aufwendig gestaltete Website täuscht dabei ein seriöses Angebot vor. Doch nehmen Sie sich in Acht: Hier erhalten Sie das gewünschte Hundejunge nie. Stattdessen verlieren Sie Ihr Geld an Kriminelle. --------------------------------------------- https://www.watchlist-internet.at/news/kaufen-sie-keine-welpen-auf-realpupp… ===================== = Vulnerabilities = ===================== ∗∗∗ December 30, 2019 TNS-2019-09 [R1] Tenable.sc 5.13.0 Fixes Multiple Third-Party Vulnerabilities ∗∗∗ --------------------------------------------- Three separate third-party components (OpenSSL, Apache HTTP Server, SimpleSAMLphp) were found to contain vulnerabilities, and updated versions have been made available by the providers. Out of caution and in line with good practice, Tenable opted to upgrade the bundled libraries to address the potential impact of these issues in Tenable.sc. --------------------------------------------- http://www.tenable.com/security/tns-2019-09 ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (intel-microcode and libbsd), openSUSE (chromium, LibreOffice, and spectre-meltdown-checker), and SUSE (mozilla-nspr, mozilla-nss and python-azure-agent). --------------------------------------------- https://lwn.net/Articles/808319/ ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (igraph, jhead, libgcrypt20, otrs2, and waitress) and Mageia (clamaw, exiv2, filezilla, hunspell, libidn2, pdfresurrect, roundcubemail, and xpdf). --------------------------------------------- https://lwn.net/Articles/808395/ ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Red Hat (chromium-browser and rh-git218-git) and SUSE (java-1_8_0-ibm and openssl-1_1). --------------------------------------------- https://lwn.net/Articles/808488/ ∗∗∗ Cisco Data Center Network Manager Authentication Bypass Vulnerabilities ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco Data Center Network Manager XML External Entity Read Access Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco Data Center Network Manager JBoss EAP Unauthorized Access Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco Data Center Network Manager SQL Injection Vulnerabilities ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco Data Center Network Manager Path Traversal Vulnerabilities ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco Data Center Network Manager Command Injection Vulnerabilities ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Security Advisory - Missing Integrity Checking Vulnerability on Some Huawei Products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191225-… ∗∗∗ Security Advisory - Information Leak Vulnerability in Some Huawei Products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191030-… ∗∗∗ Security Advisory - Improper Credentials Management Vulnerability in Some Products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20200102-… ∗∗∗ Security Advisory - Information Leak Vulnerability in Some Huawei Smart Phones ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20200102-… ∗∗∗ Security Advisory - Denial of Service Vulnerability in Several Smartphones ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20200102-… ∗∗∗ Security Advisory - Buffer Error Vulnerability in Some Huawei Products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20200102-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Security Privileged Identity Manager ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: A Security Vulnerability affects IBM Cloud Private – Swagger UI (CVE-2019-17495) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: A Security Vulnerability affects IBM Cloud Private Kubernetes (CVE-2019-11245) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: IBM Cloud Private is vulnerable to IBM WebSphere Application Server Liberty vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cloud-private-is-vuln… ∗∗∗ Security Bulletin: IBM Cloud Private is vulnerable to an IBM WebSphere Application Server Liberty vulnerability (CVE-2014-3603) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cloud-private-is-vuln… ∗∗∗ Security Bulletin: IBM Cloud Private is vulnerable to an IBM WebSphere Application Server Liberty vulnerability (CVE-2019-12402) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cloud-private-is-vuln… ∗∗∗ Security Bulletin: A Security Vulnerability affects Cloud Foundry for IBM Cloud Private (CVE-2019-16935) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 30.12.2019
by Daily end-of-shift report 30 Dec '19

30 Dec '19

===================== = End-of-Day report = ===================== Timeframe: Freitag 27-12-2019 18:00 − Montag 30-12-2019 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Lesser-known Tools for Android Application PenTesting ∗∗∗ --------------------------------------------- Over time, I became familiar with the different tools, popular or not, that helped me in my assessments. In this post, I’ll list down these not-so-popular tools (in my opinion based on the different sources and blogs that I have read where these tools were not mentioned) that I’m using during my engagements. --------------------------------------------- https://captmeelo.com/pentest/2019/12/30/lesser-known-tools-for-android-pen… ∗∗∗ 36C3: Vertraue keinem Bluetooth-Gerät – schon gar nicht im vernetzten Auto ∗∗∗ --------------------------------------------- Bei Chips zur drahtlosen Datenübertragung etwa via Bluetooth gibt es massive Sicherheitslücken. Bei geteilten Antennen lässt sich etwa WLAN ausknipsen. --------------------------------------------- https://heise.de/-4624388 ===================== = Vulnerabilities = ===================== ∗∗∗ Trend Micro AntiVirus für Mac: Schwachstelle ermöglicht Manipulation von Dateien ∗∗∗ --------------------------------------------- Trend Micro AntiVirus ist eine Anti-Viren-Software. --------------------------------------------- https://www.bsi-fuer-buerger.de/SharedDocs/Warnmeldungen/DE/TW/2019/12/warn… ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by SUSE (dia, kernel, and libgcrypt). --------------------------------------------- https://lwn.net/Articles/808135/ ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (debian-lan-config, freeimage, imagemagick, libxml2, mediawiki, openssl1.0, php5, and tomcat8). --------------------------------------------- https://lwn.net/Articles/808234/ ∗∗∗ Intel SPS vulnerability CVE-2019-11109 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K54164678 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 27.12.2019
by Daily end-of-shift report 27 Dec '19

27 Dec '19

===================== = End-of-Day report = ===================== Timeframe: Montag 23-12-2019 18:00 − Freitag 27-12-2019 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Timely acquisition of network traffic evidence in the middle of an incident response procedure, (Wed, Dec 25th) ∗∗∗ --------------------------------------------- The acquisition of evidence is one of the procedures that always brings controversy in incident management. We must answer questions such as: [...] --------------------------------------------- https://isc.sans.edu/diary/rss/25560 ∗∗∗ Bypassing UAC to Install a Cryptominer ∗∗∗ --------------------------------------------- First of all, Merry Christmas to all our readers! I hope youre enjoying the break with your family and friends! Even if everything slows down in this period, there is always malicious activity ongoing. I found a small PowerShell script that looked interesting for a quick diary. First of all, it has a VT score of 2/60[1]. It installs a cryptominer and its most interesting feature is the use of a classic technique to bypass UAC[2]. --------------------------------------------- https://isc.sans.edu/forums/diary/Bypassing+UAC+to+Install+a+Cryptominer/25… ∗∗∗ Video: Identitätsdiebstahl mit gefälschten Airbnb-Mails ∗∗∗ --------------------------------------------- Airbnb genießt hohes Vertrauen bei seinen UserInnen. Das versuchen sich auch Kriminelle zu Nutze zu machen. Sie versenden betrügerische Phishing-Mails im Design von Airbnb. --------------------------------------------- https://www.watchlist-internet.at/news/video-identitaetsdiebstahl-mit-gefae… ∗∗∗ Video: Erpressungs-Mails ∗∗∗ --------------------------------------------- Kriminelle versenden massenhaft Erpressungs-Mails an InternetnutzerInnen. Darin behaupten sie, die EmpfängerInnen der Nachrichten beim Masturbieren gefilmt zu haben. Um zu vermeiden, dass das Video veröffentlicht wird, sollen gewisse Geldbeträge in Form von Bitcoins bezahlt werden. --------------------------------------------- https://www.watchlist-internet.at/news/video-erpressungs-mails/ ===================== = Vulnerabilities = ===================== ∗∗∗ New Magellan 2.0 SQLite Vulnerabilities Affect Many Programs ∗∗∗ --------------------------------------------- New vulnerabilities in the SQLite database engine affect a wide range of applications that utilize it as a component within their software packages. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-magellan-20-sqlite-vulne… ∗∗∗ AVE DOMINAplus 1.10.x Credentials Disclosure Exploit ∗∗∗ --------------------------------------------- The application suffers from clear-text credentials disclosure vulnerability that allows an unauthenticated attacker to issue a request to an unprotected directory that hosts an XML file /xml/authClients.xml and obtain administrative login information that allows for a successful authentication bypass attack. --------------------------------------------- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5550.php ∗∗∗ AVE DOMINAplus 1.10.x Authentication Bypass Exploit ∗∗∗ --------------------------------------------- DOMINAplus suffers from an authentication bypass vulnerability due to missing control check when directly calling the autologin GET parameter in changeparams.php script. Setting the autologin value to 1 allows an unauthenticated attacker to permanently disable the authentication security control and access the management interface with admin privileges without providing credentials. --------------------------------------------- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5549.php ∗∗∗ AVE DOMINAplus 1.10.x Unauthenticated Remote Reboot ∗∗∗ --------------------------------------------- The application suffers from an unauthenticated reboot command execution. Attackers can exploit this issue to cause a denial of service scenario. --------------------------------------------- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5548.php ∗∗∗ AVE DOMINAplus 1.10.x CSRF/XSS Vulnerabilities ∗∗∗ --------------------------------------------- The application suffers from multiple CSRF and XSS vulnerabilities. The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges if a logged-in user visits a malicious web site. Input passed to several GET/POST parameters is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script [...] --------------------------------------------- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5547.php ∗∗∗ Inim Electronics Smartliving SmartLAN/G/SI 6.x Hard-coded Credentials ∗∗∗ --------------------------------------------- The devices utilizes hard-coded credentials within its Linux distribution image. These sets of credentials (Telnet, SSH, FTP) are never exposed to the end-user and cannot be changed through any normal operation of the smart home device. Attacker could exploit this vulnerability by logging in and gain system access. --------------------------------------------- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5546.php ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by CentOS (freetype, kernel, nss, nss-softokn, nss-util, and thunderbird), Mageia (ghostpcl, libmirage, and spamassassin), Oracle (fribidi), and SUSE (mariadb-100, shibboleth-sp, and slurm). --------------------------------------------- https://lwn.net/Articles/808090/ ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by CentOS (firefox, fribidi, nss, nss-softokn, nss-util, openslp, and thunderbird), Debian (opensc), and Mageia (389-ds-base, apache, apache-mod_auth_openidc, kernel, libofx, microcode, php, and ruby). --------------------------------------------- https://lwn.net/Articles/808119/ ∗∗∗ CA Client Automation 14.x Privilege Escalation ∗∗∗ --------------------------------------------- https://cxsecurity.com/issue/WLB-2019120108 ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ ∗∗∗ Security Advisory - Insufficient Input Validation Vulnerability in Some Huawei Products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191225-… ∗∗∗ Security Advisory - Integer Overflow Vulnerability in the Linux Kernel (SACK Panic) ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191225-… ∗∗∗ Security Advisory - Multiple Vulnerabilities in the X.509 Implementation in Some Huawei Products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191225-… ∗∗∗ Security Advisory - Missing Integrity Checking Vulnerability on Some Huawei Products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191225-… ∗∗∗ Red Hat Enterprise Linux: Mehrere Schwachstellen ermöglichen Ausführen von beliebigem Programmcode mit den Rechten des Dienstes ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-1110 ∗∗∗ ImageMagick / GraphicsMagick: Mehrere Schwachstellen ermöglichen Denial of Service ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-1117 ∗∗∗ D-LINK Router: Schwachstelle ermöglicht Cross-Site Scripting ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-1116 ∗∗∗ Nvidia GeForce Experience: Schwachstelle ermöglicht Privilegieneskalation ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-1114 ∗∗∗ Trend Micro Maximum Security: Schwachstelle ermöglicht Denial of Service oder Offenlegung von Informationen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-1113 ∗∗∗ Trend Micro AntiVirus für Mac: Schwachstelle ermöglicht Manipulation von Dateien ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-1120 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 23.12.2019
by Daily end-of-shift report 23 Dec '19

23 Dec '19

===================== = End-of-Day report = ===================== Timeframe: Freitag 20-12-2019 18:00 − Montag 23-12-2019 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ FBI Issues Alert For LockerGoga and MegaCortex Ransomware ∗∗∗ --------------------------------------------- The FBI has issued a warning to private industry recipients to provide information and guidance on the LockerGoga and MegaCortex Ransomware. --------------------------------------------- https://www.bleepingcomputer.com/news/security/fbi-issues-alert-for-lockerg… ∗∗∗ Mozi, Another Botnet Using DHT ∗∗∗ --------------------------------------------- Mozi Botnet relies on the DHT protocol to build a P2P network, and uses ECDSA384 and the xor algorithm to ensure the integrity and security of its components and P2P network. The sample spreads via Telnet with weak passwords and some known exploits --------------------------------------------- https://blog.netlab.360.com/mozi-another-botnet-using-dht/ ∗∗∗ Extracting VBA Macros From .DWG Files, (Sun, Dec 22nd) ∗∗∗ --------------------------------------------- I updated my oledump.py tool to help with the analysis of files that embed OLE files, like AutoCAD's .dwg files with VBA macros. --------------------------------------------- https://isc.sans.edu/diary/rss/25634 ∗∗∗ Leveraging Disk Imaging Tools to Deliver RATs ∗∗∗ --------------------------------------------- This year we observed a notable uptick in disc imaging software (like .ISO) being used as a container for serving malware via email, with .ISO archives attributing to 6% of all malware attachment archives seen this year. --------------------------------------------- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/leveraging-… ∗∗∗ Looking into Attacks and Techniques Used Against WordPress Sites ∗∗∗ --------------------------------------------- This blog post lists different kinds of attacks against WordPress, by way of payload examples we observed in the wild, and how attacks have used hacked admin access and API, Alfa-Shell deployment, and SEO poisoning to take advantage of vulnerable sites. --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/mjE1ckQKGtA/ ∗∗∗ Geknackte Zwei-Faktor-Anmeldung: Warum Software Token keine gute Idee sind ∗∗∗ --------------------------------------------- Eine mutmaßlich chinesische Hackergruppe, deren Angriffe bis 2011 zurückgehen, soll einen neuartigen Angriff auf RSA-Software-Token entdeckt haben. --------------------------------------------- https://heise.de/-4622748 ∗∗∗ Jetzt updaten: Cisco ASA 5500-X Series Firewalls aus der Ferne angreifbar ∗∗∗ --------------------------------------------- Eine bereits seit 2018 bekannte ASA-Schwachstelle wird derzeit möglicherweise aktiv ausgenutzt. --------------------------------------------- https://heise.de/-4621541 ∗∗∗ Vorsicht vor GMX-Phishing-Mails ∗∗∗ --------------------------------------------- Zahlreiche LeserInnen melden uns momentan gefährliche Phishing-Mails, mit denen Kriminelle versuchen, an GMX-Konten zu gelangen. GMX-UserInnen müssen sich daher in Acht nehmen, wenn sie plötzlich wegen einer angeblichen Kontosperre, zu einem Login aufgefordert werden. Die Daten und E-Mail-Konten landen in den Händen Krimineller und können für Verbrechen unter fremder Identität genützt werden! --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-vor-gmx-phishing-mails/ ∗∗∗ War Never Changes: Attacks Against WPA3’s Enhanced Open — Part 2: Understanding OWE ∗∗∗ --------------------------------------------- https://posts.specterops.io/war-never-changes-attacks-against-wpa3s-enhance… ===================== = Vulnerabilities = ===================== ∗∗∗ Patch now: Published Citrix applications leave networks of potentially 80,000 firms at risk from attackers ∗∗∗ --------------------------------------------- Unauthorised users able to perform arbitrary code execution A critical vulnerability found in Citrix Application Delivery Controller and Citrix Gateway (formerly known as Netscaler ADC and Netscaler Gateway) means businesses with apps published using these technologies may be exposing their internal network to unauthorised access. --------------------------------------------- https://go.theregister.co.uk/feed/www.theregister.co.uk/2019/12/23/patch_no… ∗∗∗ Sicherheitslücke in Twitter-App für Android ∗∗∗ --------------------------------------------- Über eine Sicherheitslücke in der Twitter-App für Android lässt sich bösartiger Code einschleusen, der private Daten auslesen kann. Ein Update steht bereit. --------------------------------------------- https://heise.de/-4621735 ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (cups, cyrus-sasl2, tightvnc, and x2goclient), Fedora (cacti and cacti-spine), openSUSE (mariadb and samba), Oracle (fribidi, git, and python), Red Hat (fribidi, libyang, and qemu-kvm-rhev), Slackware (openssl and tigervnc), and SUSE (firefox, nspr, nss and kernel). --------------------------------------------- https://lwn.net/Articles/808026/ ∗∗∗ Synology-SA-19:43 Drupal ∗∗∗ --------------------------------------------- A vulnerability allows remote authenticated users to upload arbitrary files via a susceptible version of Drupal. --------------------------------------------- https://www.synology.com/en-global/support/security/Synology_SA_19_43 ∗∗∗ F5 Security Advisories ∗∗∗ --------------------------------------------- https://support.f5.com/csp/new-updated-articles ∗∗∗ Security Bulletin: Multiple Vulnerabilities in libpng affects IBM Watson Studio Local ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Input Validation Vulnerability in Watson Studio Local ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-input-validation-vulnerab… ∗∗∗ Security Bulletin: Multiple Vulnerabilities In Redis affects Watson Studio Local (CVE-2018-12453, CVE-2018-12326, CVE-2018-11218) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: JWT Token Check Vulnerability in Watson Studio Local ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-jwt-token-check-vulnerabi… ∗∗∗ Security Bulletin: Multiple Vulnerabilities in Kubernetes affects IBM Watson Studio Local ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Watson Studio Local Key Storage Vulnerability ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-watson-studio-local-key-s… ∗∗∗ Security Bulletin: Multiple Vulnerabilities in GNU binutils affects IBM Watson Studio Local ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple Vulnerabilities in GNU Binutils affects Watson Studio Local ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Internal SSL Communication Vulerability in Watson Studio Local (PSIRT-ADV0011800) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-internal-ssl-communicatio… ∗∗∗ Security Bulletin: Multiple Vulnerabilities in OpenSSL affects IBM Watson Studio Local ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Vulnerabilities in Samba affects IBM Watson Studio Local ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-samba-… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 20.12.2019
by Daily end-of-shift report 20 Dec '19

20 Dec '19

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 19-12-2019 18:00 − Freitag 20-12-2019 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ From dropbox(updater) to NT AUTHORITY\SYSTEM ∗∗∗ --------------------------------------------- In this post I’m going to show how to use the DropBoxUpdater service in order to get SYSTEM privileges starting from a simple Windows user. --------------------------------------------- https://decoder.cloud/2019/12/18/from-dropboxupdater-to-nt-authoritysystem/ ∗∗∗ Using WebRTC ICE Servers for Port Scanning in Chrome ∗∗∗ --------------------------------------------- Using the browser to scan a LAN isn’t a new idea. There are many implementations that use XHR requests, websockets, or plain HTML to discover and fingerprint LAN devices. But in this blog, I’ll introduce a new scanning technique using WebRTC ICE servers. This technique is fast and, unlike the other methods, bypasses the blocked ports list. Unfortunately, it only works when the victim is using Chrome. --------------------------------------------- https://medium.com/tenable-techblog/using-webrtc-ice-servers-for-port-scann… ===================== = Vulnerabilities = ===================== ∗∗∗ DSA-4590 cyrus-imapd - security update ∗∗∗ --------------------------------------------- It was discovered that the lmtpd component of the Cyrus IMAP server created mailboxes with administrator privileges if the fileinto [sieve directive] was used, bypassing ACL checks. --------------------------------------------- https://www.debian.org/security/2019/dsa-4590 ∗∗∗ Field Notice: FN - 70489 - PKI Self-Signed Certificate Expiration in Cisco IOS and Cisco IOS XE Software - Software Upgrade Recommended ∗∗∗ --------------------------------------------- Self-signed X.509 PKI certificates (SSC) that were generated on devices that run affected Cisco IOS® or Cisco IOS XE software releases expire on 2020-01-01 00:00:00 UTC. New self-signed certificates cannot be created on affected devices after 2020-01-01 00:00:00 UTC. Any service that relies on these self-signed certificates to establish or terminate a secure connection might not work after the certificate expires. --------------------------------------------- https://www.cisco.com/c/en/us/support/docs/field-notices/704/fn70489.html ∗∗∗ OpenSSL version 1.0.2u published ∗∗∗ --------------------------------------------- The OpenSSL project team is pleased to announce the release of version 1.0.2u of our open source toolkit for SSL/TLS. --------------------------------------------- https://mta.openssl.org/pipermail/openssl-announce/2019-December/000165.html ∗∗∗ VMSA-2019-0023 ∗∗∗ --------------------------------------------- VMware Workstation and Horizon View Agent updates address a DLL-hijacking issue (CVE-2019-5539) --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2019-0023.html ∗∗∗ Critical Vulnerability Patched in 301 Redirects – Easy Redirect Manager ∗∗∗ --------------------------------------------- On Friday December 13th, our Threat Intelligence team discovered vulnerabilities present in "301 Redirects – Easy Redirect Manager", a WordPress plugin installed on over 70,000 websites. These weaknesses allowed any authenticated user, even subscribers, to modify, delete, and inject redirect rules that could potentially result in a loss of site availability. We privately disclosed the issue to the plugin’s developer, who was incredibly quick to respond and release a patch. --------------------------------------------- https://www.wordfence.com/blog/2019/12/critical-vulnerability-patched-in-30… ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (cyrus-imapd and gdk-pixbuf), Fedora (cacti, cacti-spine, and fribidi), Red Hat (fribidi, git, and openstack-keystone), Scientific Linux (fribidi), Slackware (wavpack), and SUSE (firefox, kernel, mariadb, spectre-meltdown-checker, and trousers). --------------------------------------------- https://lwn.net/Articles/807851/ ∗∗∗ Atlassian Jira Software: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen ∗∗∗ --------------------------------------------- Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Atlassian Jira Software ausnutzen, um Sicherheitsvorkehrungen zu umgehen. --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-1105 ∗∗∗ Moxa EDS Ethernet Switches ∗∗∗ --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-19-353-01 ∗∗∗ Equinox Control Expert ∗∗∗ --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-19-353-02 ∗∗∗ WECON PLC Editor ∗∗∗ --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-19-353-03 ∗∗∗ Reliable Controls MACH-ProWebCom/Sys ∗∗∗ --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-19-353-04 ∗∗∗ Security Bulletin: IBM Cognos Analytics has addressed multiple vulnerabilties ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cognos-analytics-has-… ∗∗∗ Security Bulletin: Multiple vulnerabilities of Mozzila Firefox (less than Firefox 68.2.0 ESR) have affected Synthetic Playback Agent 8.1.4.0 – 8.1.4 IF09 + ICAM Synthetic 3.0 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Various security vulnerabilities in IBM Financial Transaction Manager for SWIFT Services ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-various-security-vulnerab… ∗∗∗ Security Bulletin: IBM Cognos Business Intelligence has addressed multiple vulnerabilties ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cognos-business-intel… ∗∗∗ Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM i ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple vulnerabilities of Mozzila Firefox (less than Firefox 68.2.0 ESR) have affected Synthetic Playback Agent 8.1.4.0 – 8.1.4 IF09 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ The BIG-IP DNS system may erroneously display the TSIG key secret in plain text form ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K36328238?utm_source=f5support&utm_mediu… ∗∗∗ ASM Cloud Security Services authentication vulnerability CVE-2019-6687 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K59957337?utm_source=f5support&utm_mediu… ∗∗∗ Synology-SA-19:42 Intel Processor Vulnerability ∗∗∗ --------------------------------------------- https://www.synology.com/en-global/support/security/Synology_SA_19_42 ∗∗∗ Synology-SA-19:41 WordPress ∗∗∗ --------------------------------------------- https://www.synology.com/en-global/support/security/Synology_SA_19_41 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 19.12.2019
by Daily end-of-shift report 19 Dec '19

19 Dec '19

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 18-12-2019 18:00 − Donnerstag 19-12-2019 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Emotet Gang Changes Tactics Ahead of the Winter Holidays ∗∗∗ --------------------------------------------- With the end of the year approaching fast, the authors of Emotet have made some changes that may increase their revenue for the holidays. --------------------------------------------- https://www.bleepingcomputer.com/news/security/emotet-gang-changes-tactics-… ∗∗∗ TP-Link Routers Give Cyberattackers an Open Door to Business Networks ∗∗∗ --------------------------------------------- Remote attackers can easily compromise the device and pivot to move laterally through the LAN or WAN. --------------------------------------------- https://threatpost.com/tp-link-routers-cyberattackers-open-door/151254/ ∗∗∗ Microsoft Updates November Security Updates with SharePoint Bug ∗∗∗ --------------------------------------------- Microsoft has added a fresh CVE to its security portal, linking it to the existing November security updates (the patch itself was already included in the updates, but not specifically named). The CVE describes a vulnerability in SharePoint Server. According to a Microsoft Security Advisory, an attacker could exploit the bug (CVE-2019-1491) to obtain sensitive information and then use that information to mount further attacks. --------------------------------------------- https://threatpost.com/microsoft-issues-out-of-band-update-sharepoint-bug/1… ∗∗∗ Data science for cybersecurity: A probabilistic time series model for detecting RDP inbound brute force attacks ∗∗∗ --------------------------------------------- Microsoft Defender ATP data scientists and threat hunters collaborate to use a data science-driven approach to detecting RDP brute force attacks to protect customers against real-world threats. --------------------------------------------- https://www.microsoft.com/security/blog/2019/12/18/data-science-for-cyberse… ∗∗∗ How Websites Are Used to Spread Emotet Malware ∗∗∗ --------------------------------------------- In past posts, we’ve discussed the more popular reasons why hackers target smaller websites. Today, we’ll focus instead on how hackers use compromised websites to spread dangerous malware like Emotet to end user victims. --------------------------------------------- https://blog.sucuri.net/2019/12/how-websites-are-used-to-spread-emotet-malw… ∗∗∗ Zero Day Vulnerability in Deutsche Bahn Ticket Machine Series System uncovered ∗∗∗ --------------------------------------------- Whitehat in action discovers Kiosk Escape & Escalation via Windows PasswordAgent --------------------------------------------- https://www.vulnerability-db.com/?q=articles/2019/12/13/zero-day-vulnerabil… ∗∗∗ Erpressung 2.0: Ransomware-Gangs wollen sensible Firmendaten veröffentlichen ∗∗∗ --------------------------------------------- Die Macher von Maze und Sodinokibi läuten womöglich einen unerfreulichen Trend ein: Sie wollen sensible Dokumente infizierter Unternehmen online stellen. --------------------------------------------- https://heise.de/-4619041 ∗∗∗ Gefälschte Krone.at-Werbung lockt auf Facebook mit gratis iPhones ∗∗∗ --------------------------------------------- Achtung: Auf Facebook kursieren Werbeschaltungen im Namen der Kronen Zeitung. Darin wird behauptet, dass die größte Apple-Lagerhalle gebrannt hat und nun 2173 unbeschädigte iPhones in Österreich verschenkt werden. Das ist frei erfunden und die Werbung stammt nicht von der Kronen Zeitung. Wer sich hier anmeldet, tappt in eine Abo-Falle! --------------------------------------------- https://www.watchlist-internet.at/news/gefaelschte-kroneat-werbung-lockt-au… ∗∗∗ 30 years of ransomware: How one bizarre attack laid the foundations for the malware taking over the world ∗∗∗ --------------------------------------------- In December 1989 the world was introduced to the first ever ransomware - and 30 years later ransomware attacks are now at crisis levels. --------------------------------------------- https://www.zdnet.com/article/30-years-of-ransomware-how-one-bizarre-attack… ===================== = Vulnerabilities = ===================== ∗∗∗ Drupal Releases Security Updates ∗∗∗ --------------------------------------------- Original release date: December 19, 2019Drupal has released security updates to address vulnerabilities in Drupal 7.x, 8.7.x, and 8.8.x. An attacker could exploit some of these vulnerabilities to modify data on an affected website. --------------------------------------------- https://www.us-cert.gov/ncas/current-activity/2019/12/19/drupal-releases-se… ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (git, libgit2, and shadow), Debian (debian-edu-config and python-django), Fedora (python-django), Mageia (apache-commons-beanutils, fence-agents, flightcrew, freerdp, htmldoc, libssh, pacemaker, rsyslog, samba, and sssd), Oracle (freetype and kernel), Scientific Linux (freetype and kernel), SUSE (firefox, spectre-meltdown-checker, thunderbird, xen, and zziplib), and Ubuntu (python-django). --------------------------------------------- https://lwn.net/Articles/807711/ ∗∗∗ Synology-SA-19:42 WordPress ∗∗∗ --------------------------------------------- Multiple vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML or bypass security constraint via a susceptible version of WordPress. --------------------------------------------- https://www.synology.com/en-global/support/security/Synology_SA_19_42 ∗∗∗ Security Bulletin: IBM API Connect is impacted by a vulnerability in libexpat ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-api-connect-is-impact… ∗∗∗ Security Bulletin: Multiple Vulnerabilities in GnuTLS affects IBM Watson Studio Local ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple Vulnerabilities in libpng affects IBM Watson Studio Local ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Vulnerability in jQuery affects IBM Watson Studio Local ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-jquery-a… ∗∗∗ Security Bulletin: Multiple Vulnerabilities in libxml2 affects IBM Watson Studio Local ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ PHP: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-1099 ∗∗∗ Ruby on Rails: Schwachstelle ermöglicht Offenlegung von Informationen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-1098 ∗∗∗ Citrix Systems NetScaler Gateway: Schwachstelle ermöglicht Codeausführung ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-1093 ∗∗∗ Atlassian Confluence: Schwachstelle ermöglicht Offenlegung von Informationen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-1101 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 18.12.2019
by Daily end-of-shift report 18 Dec '19

18 Dec '19

===================== = End-of-Day report = ===================== Timeframe: Dienstag 17-12-2019 18:00 − Mittwoch 18-12-2019 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Forthcoming OpenSSL release ∗∗∗ --------------------------------------------- The OpenSSL project team would like to announce the forthcoming release of OpenSSL version 1.0.2u. This release will be made available on Friday 20th December 2019 between 1300-1700 UTC. This will contain one LOW severity fix for CVE-2019-1551 previously announced here: https://www.openssl.org/news/secadv/20191206.txt --------------------------------------------- https://mta.openssl.org/pipermail/openssl-announce/2019-December/000164.html ∗∗∗ Betrügerische Zahlungsaufforderungen von top-urlaub.info nicht bezahlen! ∗∗∗ --------------------------------------------- Zahlreiche InternetnutzerInnen berichten uns momentan von betrügerischen Rechnungen und Zahlungsaufforderungen der Next Trip Ltd. Sie stoßen auf eine Werbung auf sozialen Netzwerken, die günstige Urlaubsangebote verspricht. Eine Registrierung führt zu hohen Zahlungsaufforderungen wegen einer angeblich abgeschlossenen Jahresmitgliedschaft. Die Rechnung über 239,90 Euro muss in derartigen Fällen nicht bezahlt werden! --------------------------------------------- https://www.watchlist-internet.at/news/betruegerische-zahlungsaufforderunge… ===================== = Vulnerabilities = ===================== ∗∗∗ Google Releases Security Updates for Chrome for Windows, Mac, and Linux ∗∗∗ --------------------------------------------- Google has released security updates for Chrome version 79.0.3945.88 for Windows, Mac, and Linux. This version addresses a vulnerability that an attacker could exploit to take control of an affected system. --------------------------------------------- https://www.us-cert.gov/ncas/current-activity/2019/12/18/google-releases-se… ∗∗∗ Microsoft Releases Out-of-Band Security Updates ∗∗∗ --------------------------------------------- Microsoft has released out-of-band security updates to address a vulnerability in SharePoint Server. An attacker could exploit this vulnerability to obtain sensitive information. --------------------------------------------- https://www.us-cert.gov/ncas/current-activity/2019/12/18/microsoft-releases… ∗∗∗ SpamAssassin 3.4.3 available ∗∗∗ --------------------------------------------- Apache SpamAssassin 3.4.3 contains numerous tweaks and bug fixes as we prepare to move to version 4.0.0 with better, native UTF-8 handling. There are a number of functional patches, improvements as well as security reasons to upgrade to 3.4.3. In this release, there are bug fixes for two CVEs. --------------------------------------------- https://lwn.net/Articles/807539/ ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (debian-edu-config, harfbuzz, libvorbis, and python-ecdsa), Fedora (chromium, fribidi, libssh, and openslp), openSUSE (chromium), Oracle (grub2), Red Hat (rh-maven35-apache-commons-beanutils), SUSE (kernel, libssh, mariadb, samba, and xen), and Ubuntu (openjdk-8, openjdk-lts). --------------------------------------------- https://lwn.net/Articles/807609/ ∗∗∗ Dell XPS 13 2-in-1 (7390): Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit Administratorrechten ∗∗∗ --------------------------------------------- https://www.bsi-fuer-buerger.de/SharedDocs/Warnmeldungen/DE/TW/2019/12/warn… ∗∗∗ GE S2020/S2020G Fast Switch 61850 ∗∗∗ --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-19-351-01 ∗∗∗ Security Advisory - Improper Access Control Vulnerability in Huawei Share ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191218-… ∗∗∗ Security Advisory - Insufficient Input Validation Vulnerability in Huawei Share ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191218-… ∗∗∗ Security Advisory - Buffer Overflow Vulnerability in Some Huawei Smart Phones ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191218-… ∗∗∗ Security Advisory - Information Disclosure Vulnerability in Some Huawei Products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191218-… ∗∗∗ Security Bulletin: vulnerabilities in OpenSSL affect IBM Integration Bus and IBM App Connect ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-openss… ∗∗∗ Security Bulletin: IBM Cloud Transformation Advisor is affected by a Node.js by Prototype Pollution vulnerabiliy ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cloud-transformation-… ∗∗∗ Security Bulletin: Multiple Vulnerabilities in the Linux kernel affect the IBM FlashSystem models V840 and V9000 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: IBM Cloud Transformation Advisor is affected by a Node.js vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cloud-transformation-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Cloud Transformation Advisor ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in jackson-databind affect IBM Platform Symphony and IBM Spectrum Symphony ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: IBM Planning Analytics has addressed a Security Vulnerability ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-planning-analytics-ha… ∗∗∗ Security Bulletin: Multiple Vulnerabilities in the Linux kernel affect the IBM FlashSystem models 840 and 900 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple Vulnerabilities in IBM Java Runtime affect IBM Cognos Command Center ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 17.12.2019
by Daily end-of-shift report 17 Dec '19

17 Dec '19

===================== = End-of-Day report = ===================== Timeframe: Montag 16-12-2019 18:00 − Dienstag 17-12-2019 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ #include ∗∗∗ --------------------------------------------- Recently I saw a tweet where someone mentioned that you can include /dev/stdin in C code compiled with gcc. This is, to say the very least, surprising. When you see something like this with an IT security background you start to wonder if this can be abused for an attack. --------------------------------------------- https://blog.hboeck.de/archives/898-include-etcshadow.html ∗∗∗ Is it Possible to Identify DNS over HTTPs Without Decrypting TLS? ∗∗∗ --------------------------------------------- Aside from the session length, I found that the payload length for DoH is somewhat telling. DNS queries and responses are usually a couple of hundred bytes long. HTTPS connections, on the other hand, tend to "fill" the MTU. --------------------------------------------- https://isc.sans.edu/diary/rss/25616 ∗∗∗ ESET BlueKeep (CVE‑2019‑0708) Detection‑Tool ∗∗∗ --------------------------------------------- Obwohl die BlueKeep-Schwachstelle (CVE-2019-0708) bisher nicht für weitverbreitetes Chaos sorgte, befindet sie sich doch noch in einem recht frühen Stadium der Exploit-Lebensdauer. Tatsächlich ist es so, dass viele Systeme noch nicht gepatcht sind und eine Version des Exploits als Wurm noch auftauchen könnte. Aufgrund dieser Faktoren stellt ESET ein kostenloses Detection-Tool bereit, das checken soll, ob ein System in Bezug auf BlueKeep verwundbar ist. --------------------------------------------- https://www.welivesecurity.com/deutsch/2019/12/17/eset-bluekeep-detection-t… ∗∗∗ Weihnachtseinkäufe auf Amazon: Vorsicht vor Kriminellen ∗∗∗ --------------------------------------------- Eine Bestellung auf Amazon ist für viele bereits selbstverständlich und mit einer überwiegend positiven Kauferfahrung verbunden. Doch auf Amazon finden sich auch betrügerische Angebote: werden Sie aufgefordert, HändlerInnen vorab per E-Mail zu kontaktieren oder die Zahlung über ein externes Konto und nicht über Amazon abzuwickeln, können Sie von einem unseriösen Angebot ausgehen! --------------------------------------------- https://www.watchlist-internet.at/news/weihnachtseinkaeufe-auf-amazon-vorsi… ===================== = Vulnerabilities = ===================== ∗∗∗ Joomla - [20191202] - Core - Various SQL injections through configuration parameters ∗∗∗ --------------------------------------------- Versions: 2.5.0 - 3.9.13 CVE Number: CVE-2019-19846 The lack of validation of configuration parameters used in SQL queries caused various SQL injection vectors. --------------------------------------------- https://developer.joomla.org/security-centre/797-20191202-core-various-sql-… ∗∗∗ Joomla - [20191201] - Core - Path Disclosure in framework files ∗∗∗ --------------------------------------------- Versions: 3.8.0 - 3.9.13 Number: CVE-2019-19845 Missing access check in framework files could lead to a path disclosure. --------------------------------------------- https://developer.joomla.org/security-centre/796-20191201-core-path-disclos… ∗∗∗ This Bug Could Have Let Anyone Crash WhatsApp Of All Group Members ∗∗∗ --------------------------------------------- WhatsApp, the worlds most popular end-to-end encrypted messaging application, patched an incredibly frustrating software bug that could have allowed a malicious group member to crash the messaging app for all members of the same group, The Hacker News learned. ... Check Point responsibly reported this crash bug to the WhatsApp security team back in late August this year, and the company patched the issue with the release of WhatsApp version 2.19.58 in mid-September. --------------------------------------------- https://thehackernews.com/2019/12/whatsapp-group-crash.html ∗∗∗ CVE-2019-18935: Remote Code Execution via Insecure Deserialization in Telerik UI ∗∗∗ --------------------------------------------- Telerik UI for ASP.NET AJAX is a widely used suite of UI components for web applications. It insecurely deserializes JSON objects in a manner that results in arbitrary remote code execution on the softwares underlying host. --------------------------------------------- https://know.bishopfox.com/research/cve-2019-18935-remote-code-execution-in… ∗∗∗ Vulnerabilities in multiple third party TYPO3 CMS extensions ∗∗∗ --------------------------------------------- several vulnerabilities have been found in the following third party TYPO3 extensions: - "MKSamlAuth" (mksamlauth) - "Change password for frontend users" (fe_change_pwd) - "File List" (file_list) - "femanager direct mail subscription" (femanager_dmail_subscribe) - "femanager" (femanager) --------------------------------------------- http://lists.typo3.org/pipermail/typo3-announce/2019/000455.html ∗∗∗ TYPO3 10.2.2, 9.5.13 and 8.7.30 security releases published ∗∗∗ --------------------------------------------- We are announcing the release of the following TYPO3 updates: TYPO3 10.2.2 TYPO3 9.5.13 LTS TYPO3 8.7.30 LTS All versions are security releases and contain important security fixes --------------------------------------------- https://typo3.org/article/typo3-1022-9513-and-8730-security-releases-publis… ∗∗∗ Sicherheitsupdate: Passwortabfrage von TP-Links Archer-Routern umgehbar ∗∗∗ --------------------------------------------- Angreifer könnten eine kritische Sicherheitslücke ausnutzen, um mit Admin-Rechten auf einige Router der Archer-Serie zu zugreifen. --------------------------------------------- https://heise.de/-4616996 ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (libssh, ruby2.3, and ruby2.5), Fedora (kernel and libgit2), openSUSE (chromium and libssh), Oracle (openslp), Red Hat (container-tools:1.0, container-tools:rhel8, freetype, kernel, and kpatch-patch), Scientific Linux (openslp), SUSE (git and LibreOffice), and Ubuntu (graphicsmagick). --------------------------------------------- https://lwn.net/Articles/807505/ ∗∗∗ Intel Patches Privilege Escalation Flaw in Rapid Storage Technology ∗∗∗ --------------------------------------------- A vulnerability Intel has addressed in the Rapid Storage Technology (RST) could allow a local user to escalate privileges to System. Intel RST is a Windows-based application that is provided with many computers that feature Intel chips to deliver improved performance and reliability when SATA disks are used. --------------------------------------------- https://www.securityweek.com/intel-patches-privilege-escalation-flaw-rapid-… ∗∗∗ Security Bulletin: A security vulnerability has been identified in lodash shipped with PowerAI ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: IBM MQ Appliance is affected by a libcgroup vulnerability (CVE-2018-14348) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-appliance-is-affec… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Rational Directory Server (Tivoli) & Rational Directory Administrator ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: A security vulnerability has been identified in SQLite shipped with PowerAI ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: IBM SDK Oracle Java vunerabilities affect IBM Watson Text to Speech and Speech to Text (IBM Watson™ Speech Services 1.1) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sdk-oracle-java-vuner… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 16.12.2019
by Daily end-of-shift report 16 Dec '19

16 Dec '19

===================== = End-of-Day report = ===================== Timeframe: Freitag 13-12-2019 18:00 − Montag 16-12-2019 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ PCI Point-to-Point Encryption Standard 3.0 released ∗∗∗ --------------------------------------------- The PCI Security Standards Council (PCI SSC) has updated the PCI Point-to-Point Encryption Standard (P2PE) and supporting program. PCI P2PE Version 3.0 simplifies the process for component and solution providers to validate their P2PE products for cardholder data protection efforts. --------------------------------------------- https://www.helpnetsecurity.com/2019/12/16/pci-point-to-point-encryption-st… ===================== = Vulnerabilities = ===================== ∗∗∗ Javascript: Node-Pakete können Binärdateien unterjubeln ∗∗∗ --------------------------------------------- Eine Sicherheitslücke in den Paketmanangern für Node.js, NPM und Yarn, ermöglicht das Unterschieben und Manipulieren von Binärdateien auf dem Client-System. Updates stehen bereit. --------------------------------------------- https://www.golem.de/news/javascript-node-pakete-koennen-binaerdateien-unte… ∗∗∗ 2019-11-12: Cybersecurity Advisory - Automation Builder 2.2 (and earlier), Drive Application Builder 1.0 ∗∗∗ --------------------------------------------- ABB is aware of public reports of a vulnerability in the product versions listed above. This issue will be fixed by · Version 2.3.0 of Automation Builder. The release of this version is expected for end of Q1 2020 · Version 1.1.0 of Drive Application Builder. The release of this version is expected for end of 2019 An attacker who successfully exploited this vulnerability could insert and run arbitrary JavaScript and/or ActiveX code. --------------------------------------------- https://search.abb.com/library/Download.aspx?DocumentID=3ADR010465&Language… ∗∗∗ Multiple Vulnerabilities in ABB PB610 PanelBuilder 600 ∗∗∗ --------------------------------------------- ABB is aware of a private report of four vulnerabilities in PB610 Panel Builder 600, versions 2.8.0.424 and earlier, affecting the HMIStudio and HMISimulator components. The vulnerabilities are corrected in version 2.8.0.460. --------------------------------------------- http://www02.abb.com/GLOBAL/GAD/GAD01626.NSF/0/1520A33C30E2562EC12584D20058… ∗∗∗ Vulnerability Spotlight: Multiple vulnerabilities in WAGO PFC200 ∗∗∗ --------------------------------------------- The WAGO PFC200 and PFC100 controllers contain multiple exploitable vulnerabilities. The PFC200 is one of WAGO’s programmable automation controllers that are used in many industries including automotive, rail, power engineering, manufacturing and building management. The vulnerabilities disclosed here all have their root cause within the protocol handling code of the I/O Check (iocheckd) configuration... --------------------------------------------- https://blog.talosintelligence.com/2019/12/vulnerability-spotlight-multiple… ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (davical, intel-microcode, libpgf, php-horde, spamassassin, spip, and thunderbird), Mageia (clementine, dnsmasq, git, jasper, kdelibs4, kernel, libcroco, libgit2, libvirt, ncurses, openafs, proftpd, qbittorrent, signing-party, squid, and wireshark), openSUSE (java-1_8_0-openjdk and postgresql), Oracle (kernel), Red Hat (chromium-browser and openslp), and SUSE (kernel, libssh, and xen). --------------------------------------------- https://lwn.net/Articles/807412/ ∗∗∗ Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect z/TPF ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: API Connect is impacted by credential caching ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-api-connect-is-impacted-b… ∗∗∗ Security Bulletin: A security vulnerability has been identified in Kubernetes shipped with PowerAI Vision ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: IBM MQ is vulnerable to a denial of service attack caused by an abend while processing messages. (CVE-2019-4560) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-is-vulnerable-to-a… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 13.12.2019
by Daily end-of-shift report 13 Dec '19

13 Dec '19

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 12-12-2019 18:00 − Freitag 13-12-2019 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ New Echobot Variant Exploits 77 Remote Code Execution Flaws ∗∗∗ --------------------------------------------- The Echobot botnet is still after the low hanging fruit as a new variant has been spotted with an increased number of exploits that target unpatched devices, IoT for the most part. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-echobot-variant-exploits… ∗∗∗ All in the (Ransomware) Family: 10 Ways to Take Action ∗∗∗ --------------------------------------------- Check out our list of top 10 things to do to protect your organization from the deepening scourge of ransomware. --------------------------------------------- https://threatpost.com/ransomware-family-10-ways-take-action/151080/ ∗∗∗ Multi-stage downloader Trojan sLoad abuses BITS almost exclusively for malicious activities ∗∗∗ --------------------------------------------- Many of today’s threats evolve to incorporate as many living-off-the-land techniques as possible into the attack chain. The PowerShell-based downloader Trojan known as sLoad, however, puts all its bets on BITS. --------------------------------------------- https://www.microsoft.com/security/blog/2019/12/12/multi-stage-downloader-t… ∗∗∗ Internet banking sites and their use of TLS... and SSLv3... and SSLv2?!, (Fri, Dec 13th) ∗∗∗ --------------------------------------------- Although SSLv3 has been considered obsolete and insecure for a long time, a large number of web servers still support its use. And even though the numbers are much lower, some servers on the web support SSLv2 to this day as well. And, as it turns out, this is true even when it comes to web servers hosting internet banking portals --------------------------------------------- https://isc.sans.edu/diary/rss/25606 ∗∗∗ Unmasking Black Hat SEO for Dating Scams ∗∗∗ --------------------------------------------- Malware obfuscation comes in all shapes and sizes - and it’s sometimes hard to recognize the difference between malicious and legitimate code when you see it. Recently, we came across an interesting case where attackers went a few extra miles to make it more difficult to notice the site infection. --------------------------------------------- https://blog.sucuri.net/2019/12/unmasking-black-hat-seo-for-dating-scams.ht… ∗∗∗ Threat spotlight: The curious case of Ryuk ransomware ∗∗∗ --------------------------------------------- >From comic book death god to ransomware baddie, Ryuk ransomware remains a mainstay when organizations find themselves in a crippling malware pinch. We look at Ryuks origins, attack methods, and how to protect against this ever-present threat. --------------------------------------------- https://blog.malwarebytes.com/threat-spotlight/2019/12/threat-spotlight-the… ∗∗∗ Targeted Attacks Deliver New "Anchor" Malware to High-Profile Companies ∗∗∗ --------------------------------------------- TrickBot/Anchor Campaign Could be a New Targeted Magecart Attack Against High-Profile Companies --------------------------------------------- https://www.securityweek.com/targeted-attacks-deliver-new-anchor-malware-hi… ===================== = Vulnerabilities = ===================== ∗∗∗ Advantech DiagAnywhere Server ∗∗∗ --------------------------------------------- This advisory contains mitigations for a stack-based buffer overflow vulnerability in the Advantech DiagAnywhere Server. --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-19-346-01 ∗∗∗ Omron PLC CJ and CS Series ∗∗∗ --------------------------------------------- This advisory includes information and mitigation recommendations for authentications vulnerabilities reported in the Omron PLC CJ and CS Series. --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-19-346-02 ∗∗∗ Omron PLC CJ, CS and NJ Series ∗∗∗ --------------------------------------------- This advisory includes information and mitigation recommendations for an authentication related vulnerability in the Omron PLC CJ, CS, and NJ Series. --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-19-346-03 ∗∗∗ WordPress 5.3.1 Security and Maintenance Release ∗∗∗ --------------------------------------------- This security and maintenance release features 46 fixes and enhancements. Plus, it adds a number of security fixes - see the list below. --------------------------------------------- https://wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance… ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Fedora (knot-resolver and xen), openSUSE (kernel), and SUSE (haproxy, kernel, and openssl). --------------------------------------------- https://lwn.net/Articles/807261/ ∗∗∗ Security Bulletin: Multiple vulnerabilities affect IBM Tivoli Monitoring embedded WebSphere Application and IHS server ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: A cross site scripting security vulnerability has been identified with Case Builder component in IBM Case Manager (CVE-2019-4426) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-cross-site-scripting-se… ∗∗∗ Security Bulletin: A cross site scripting security vulnerability has been identified with Case Builder component shipped with IBM Business Automation Workflow (CVE-2019-4426) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-cross-site-scripting-se… ∗∗∗ HPESBHF03974 rev.1 - HPE Servers using certain Intel Processors, Local Denial of Service, Disclosure of Information, Escalation of Privilege ∗∗∗ --------------------------------------------- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_n… ∗∗∗ Dovecot: Schwachstelle ermöglicht Denial of Service ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-1076 ∗∗∗ Trend Micro AntiVirus: Schwachstelle ermöglicht Denial of Service oder Codeausführung ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-1077 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 12.12.2019
by Daily end-of-shift report 12 Dec '19

12 Dec '19

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 11-12-2019 18:00 − Donnerstag 12-12-2019 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ (Almost) Hollow and Innocent: Monero Miner Remains Undetected via Process Hollowing ∗∗∗ --------------------------------------------- Cryptocurrencies values are increasing again, which may explain why the number of stealthy techniques to deliver them have also increased this year. We found another campaign using process hollowing and a dropper component to evade detection and analysis, and can potentially be used for other malware payloads. --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/wSpVXlrw0Ok/ ∗∗∗ Code & Data Reuse in the Malware Ecosystem ∗∗∗ --------------------------------------------- In the past, I already had the opportunity to give some "security awareness" sessions to developers. One topic that was always debated is the reuse of existing code. Indeed, for a developer, its tempting to not reinvent the wheel when somebody already wrote a piece of code that achieves the expected results. From a gain of time perspective, its a win for the developers who can focus on other code. Of course, this can have side effects and introduce bugs, backdoors, etc... --------------------------------------------- https://isc.sans.edu/forums/diary/Code+Data+Reuse+in+the+Malware+Ecosystem/… ∗∗∗ Winbox in the Wild ∗∗∗ --------------------------------------------- I’ve written, ad nauseam, about MikroTik routers. I’ve detailed vulnerabilities, post exploitation, and the protocol used by Winbox to communicate to the router on port 8291: [...] --------------------------------------------- https://medium.com/tenable-techblog/winbox-in-the-wild-9a2ee4946add?source=… ∗∗∗ The little-known ways mobile device sensors can be exploited by cybercriminals ∗∗∗ --------------------------------------------- Mobile device sensors offer great utility to users—from taking pictures and commanding voice assistants to determining which direction to flip your screen. However, they harbor little-known vulnerabilities that could be exploited by crafty cybercriminals. --------------------------------------------- https://blog.malwarebytes.com/iot/2019/12/the-little-known-ways-mobile-devi… ∗∗∗ Gefälschte Post-SMS zur Zahlung für wartende Pakete ∗∗∗ --------------------------------------------- Warten Sie gerade auf ein Paket? In der Weihnachtszeit ist das nicht unwahrscheinlich! Kriminelle nützen das und versenden gefälschte SMS mit dem Absendenamen „PST“ oder „POST“. Sie sollen eine Zahlung über 2,99 Euro bestätigen indem Sie einem Link folgen. Sie landen auf einer gefälschten Post-Website. Geben Sie Ihre Daten hier nicht ein – man versucht sie Ihnen zu stehlen! --------------------------------------------- https://www.watchlist-internet.at/news/gefaelschte-post-sms-zur-zahlung-fue… ∗∗∗ What I Learned from Reverse Engineering Windows Containers ∗∗∗ --------------------------------------------- Our researcher provides an overview on containers - starting with their Linux history - and shows the different implementations of containers in Windows, how they work, the security pitfalls that may occur, as well as the internal implementation of objects that are necessary for Containers in Windows. --------------------------------------------- https://unit42.paloaltonetworks.com/what-i-learned-from-reverse-engineering… ∗∗∗ Microsoft details the most clever phishing techniques it saw in 2019 ∗∗∗ --------------------------------------------- This years most clever phishing tricks include hijacking Google search results and abusing 404 error pages. --------------------------------------------- https://www.zdnet.com/article/microsoft-details-the-most-clever-phishing-te… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by CentOS (firefox and nss-softokn), Fedora (samba), Oracle (nss, nss-softokn, nss-util, nss-softokn, and thunderbird), Scientific Linux (thunderbird), SUSE (firefox), and Ubuntu (librabbitmq and samba). --------------------------------------------- https://lwn.net/Articles/807186/ ∗∗∗ Synology-SA-19:40 Samba AD DC ∗∗∗ --------------------------------------------- CVE-2019-14861 and CVE-2019-11479 allow remote authenticated users to conduct denial-of-service attacks or bypass security constraints via a susceptible version of Synology Directory Server. --------------------------------------------- https://www.synology.com/en-global/support/security/Synology_SA_19_40 ∗∗∗ Webform - Critical - Multiple vulnerabilities - SA-CONTRIB-2019-096 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2019-096 ∗∗∗ Modal Page - Moderately critical - Access bypass - SA-CONTRIB-2019-094 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2019-094 ∗∗∗ Taxonomy access fix - Moderately critical - Access bypass - SA-CONTRIB-2019-093 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2019-093 ∗∗∗ Smart Trim - Moderately critical - Cross site scripting - SA-CONTRIB-2019-092 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2019-092 ∗∗∗ Permissions by Term - Moderately critical - Access bypass - SA-CONTRIB-2019-095 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2019-095 ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ ∗∗∗ BIG-IP TMM vulnerability CVE-2019-6671 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K39225055 ∗∗∗ TMOS vulnerability CVE-2019-6664 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K03126093 ∗∗∗ HPESBHF03973 rev.1 - HPE Servers with certain Intel Processors, Local Disclosure of Information, Local Escalation of Privilege ∗∗∗ --------------------------------------------- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_n… ∗∗∗ Red Hat OpenShift Service Mesh: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-1067 ∗∗∗ OpenBSD: Schwachstelle ermöglicht Privilegieneskalation ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-1070 ∗∗∗ Linux Kernel und hostapd: Mehrere Schwachstellen ermöglichen Denial of Service ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-1071 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 11.12.2019
by Daily end-of-shift report 11 Dec '19

11 Dec '19

===================== = End-of-Day report = ===================== Timeframe: Dienstag 10-12-2019 18:00 − Mittwoch 11-12-2019 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Zeppelin Ransomware Targets Healthcare and IT Companies ∗∗∗ --------------------------------------------- A new variant of the VegaLocker/Buran Ransomware called Zeppelin has been spotted infecting U.S. and European companies via targeted installs. --------------------------------------------- https://www.bleepingcomputer.com/news/security/zeppelin-ransomware-targets-… ∗∗∗ Bad news: KeyWe Smart Lock is easily bypassed and cant be fixed ∗∗∗ --------------------------------------------- Good news? There is no good news File this one under "not everything needs a computer in it". Finnish security house F-Secure today revealed a vulnerability in the KeyWe Smart Lock that could let a sticky-fingered miscreant easily bypass it. --------------------------------------------- https://go.theregister.co.uk/feed/www.theregister.co.uk/2019/12/11/f_secure… ∗∗∗ Intel flickt "Plundervolt" und zahlreiche weitere Sicherheitslücken ∗∗∗ --------------------------------------------- Durch bösartiges Prozessor-"Undervolting" lassen sich SGX-verschlüsselten RAM-Enklaven Geheimnisse entlocken; Intel patcht auch 10 weitere Sicherheitslücken. --------------------------------------------- https://heise.de/-4611068 ∗∗∗ Gratis Online-Dating oder teure Abo-Falle? ∗∗∗ --------------------------------------------- Immer wieder erreichen uns Beschwerden verärgerter Singles, die auf heissetreffen.at auf der Suche nach Liebe oder Spaß waren. Die erste Anmeldung ist völlig kostenlos. Wer hier aber Profilbilder sehen möchte, soll das Alter über Eingabe der Kreditkartendaten bestätigen. Achtung: Dadurch rutscht man in eine teure Abo-Falle! Für Zahlungen besteht kein Grund. --------------------------------------------- https://www.watchlist-internet.at/news/gratis-online-dating-oder-teure-abo-… ===================== = Vulnerabilities = ===================== ∗∗∗ Apple Releases Multiple Security Updates ∗∗∗ --------------------------------------------- Apple has released security updates to address vulnerabilities in multiple products. An attacker could exploit some of these vulnerabilities to take control of an affected system. --------------------------------------------- https://www.us-cert.gov/ncas/current-activity/2019/12/10/apple-releases-mul… ∗∗∗ Microsoft Releases December 2019 Security Updates ∗∗∗ --------------------------------------------- Microsoft has released updates to address multiple vulnerabilities in Microsoft software. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. --------------------------------------------- https://www.us-cert.gov/ncas/current-activity/2019/12/10/microsoft-releases… ∗∗∗ Intel Releases Security Updates ∗∗∗ --------------------------------------------- Intel has released security updates to address vulnerabilities in multiple products. An authenticated attacker with local access could exploit some of these vulnerabilities to gain escalation of privileges. --------------------------------------------- https://www.us-cert.gov/ncas/current-activity/2019/12/10/intel-releases-sec… ∗∗∗ Xen Security Advisory CVE-2019-19581,CVE-2019-19582 / XSA-307 - find_next_bit() issues ∗∗∗ --------------------------------------------- In a number of places bitmaps are being used by the hypervisor to track certain state. Iteration over all bits involves functions which may misbehave in certain corner cases: [...] --------------------------------------------- https://xenbits.xen.org/xsa/advisory-307.html ∗∗∗ Xen Security Advisory CVE-2019-19583 / XSA-308 - VMX: VMentry failure with debug exceptions and blocked states ∗∗∗ --------------------------------------------- The VMX VMEntry checks does not like the exact combination of state which occurs when #DB in intercepted, Single Stepping is active, and blocked by STI/MovSS is active, despite this being a legitimate state to be in. The resulting VMEntry failure is fatal to the guest. --------------------------------------------- https://xenbits.xen.org/xsa/advisory-308.html ∗∗∗ Xen Security Advisory CVE-2019-19578 / XSA-309 - Linear pagetable use / entry miscounts ∗∗∗ --------------------------------------------- [...] If an attacker could engineer such a situation to occur, they might be able to make loops or other arbitrary chains of linear pagetables, as described in XSA-240. --------------------------------------------- https://xenbits.xen.org/xsa/advisory-309.html ∗∗∗ Xen Security Advisory CVE-2019-19580 / XSA-310 - Further issues with restartable PV type change operations ∗∗∗ --------------------------------------------- XSA-299 addressed several critical issues in restartable PV type change operations. Despite extensive testing and auditing, some corner cases were missed. --------------------------------------------- https://xenbits.xen.org/xsa/advisory-310.html ∗∗∗ Xen Security Advisory CVE-2019-19577 / XSA-311 - Bugs in dynamic height handling for AMD IOMMU pagetables ∗∗∗ --------------------------------------------- A malicious guest administrator can cause Xen to access data structures while they are being modified, causing Xen to crash. Privilege escalation is thought to be very difficult but cannot be ruled out. --------------------------------------------- https://xenbits.xen.org/xsa/advisory-311.html ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (crypto++ and thunderbird), Debian (cacti, freeimage, git, and jackson-databind), Fedora (nss), openSUSE (clamav, dnsmasq, munge, opencv, permissions, and shadowsocks-libev), Red Hat (nss, nss-softokn, nss-util, rh-maven35-jackson-databind, and thunderbird), Scientific Linux (nss, nss-softokn, nss-util, nss-softokn, and thunderbird), SUSE (caasp-openstack-heat-templates, crowbar-core, crowbar-openstack, crowbar-ui, etcd, flannel, galera-3, [...] --------------------------------------------- https://lwn.net/Articles/807073/ ∗∗∗ Citrix Hypervisor Security Update ∗∗∗ --------------------------------------------- CTX266932 NewApplicable Products : Citrix Hypervisor 8.0, XenServer 7.0, XenServer 7.1 LTSR Cumulative Update 2, XenServer 7.6A number of vulnerabilities have been found in Citrix Hypervisor (formerly Citrix XenServer) that may:i. Allow the host to be compromised by privileged code in a PV guest VM,ii. allow unprivileged code in a HVM guest VM to cause that guest to [...] --------------------------------------------- https://support.citrix.com/article/CTX266932 ∗∗∗ Security Advisory - Denial of Service Vulnerability on Some Huawei Smartphones ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20190911-… ∗∗∗ Security Advisory - Information Leakage Vulnerability on Some Huawei Products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191211-… ∗∗∗ Security Advisory - Information Disclosure Vulnerability in Several Smartphones ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191211-… ∗∗∗ Security Advisory - Information Leak Vulnerability in Huawei CloudUSM-EUA Product ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191211-… ∗∗∗ Security Advisory - Multiple Vulnerabilities in Some Huawei Products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191211-… ∗∗∗ Security Bulletin: A vulnerability has been identified in IBM Spectrum Scale which allows users to embed arbitrary JavaScript code in the Web UI (CVE-2019-4665) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-has-been-… ∗∗∗ Security Bulletin: Security vulnerability in IBM WebSphere Application Server affects IBM Voice Gateway ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-security-vulnerability-in… ∗∗∗ Security Bulletin: IBM Operations Analytics – Log Analysis is affected by an Apache Zookeeper vulnerability (CVE-2019-4244) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-operations-analytics-… ∗∗∗ Security Bulletin: IBM Integration Bus & IBM App Connect Enterprise are affected by a Websphere Application Server Vulnerability (CVE-2018-1996) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-integration-bus-ibm-a… ∗∗∗ Security Bulletin: A vulnerability has been identified in IBM Spectrum Scale where remoted authenticated attacker can execute arbitrary command(CVE 2019-4715)) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-has-been-… ∗∗∗ Security Bulletin: Multiple vulnerabilities of Mozilla Firefox have affected Synthetic Playback Agent 8.1.4.x ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: CVE-2019-10072 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-cve-2019-10072/ ∗∗∗ Security Bulletin: A vulnerability has been identified in IBM Spectrum Scale which allows users to embed arbitrary JavaScript code in the Web UI (CVE-2019-4665) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-has-been-… ∗∗∗ File Extension Spoofing in Windows Defender Antivirus ∗∗∗ --------------------------------------------- https://sec-consult.com/en/blog/advisories/file-extension-spoofing-in-windo… ∗∗∗ Red Hat Enterprise Linux: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit den Rechten des Dienstes ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-1054 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 10.12.2019
by Daily end-of-shift report 10 Dec '19

10 Dec '19

===================== = End-of-Day report = ===================== Timeframe: Montag 09-12-2019 18:00 − Dienstag 10-12-2019 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Snatch Ransomware Reboots to Windows Safe Mode to Bypass AV Tools ∗∗∗ --------------------------------------------- Researchers discovered a new Snatch ransomware strain that will reboot computers it infects into Safe Mode to disable any resident security solutions and immediately starts encrypting files once the system loads. --------------------------------------------- https://www.bleepingcomputer.com/news/security/snatch-ransomware-reboots-to… ∗∗∗ Dont pay off Ryuk ransomware, warn infoseccers: Its creators borked the decryptor ∗∗∗ --------------------------------------------- Oracle DBs particularly vulnerable to fake decryptions, say researchers If youre an Oracle database user and are tempted to pay off a Ryuk ransomware infection to get your files back, for pitys sake, dont. The criminals behind it have broken their own decryptor, meaning nobody will be able to unlock files scrambled by the malicious software. --------------------------------------------- https://go.theregister.co.uk/feed/www.theregister.co.uk/2019/12/10/ryuk_dec… ∗∗∗ Was Sie beim Onlineshoppen beachten müssen ∗∗∗ --------------------------------------------- Nicht mehr lang, dann ist wieder Weihnachten. Für die einen die besinnlichste Zeit im Jahr, für die anderen der pure Stress - vor allem wenn viele Geschenke besorgt werden müssen. Onlineshoppen ist da eine bequeme Lösung. Doch Onlineshoppen birgt auch einige Gefahren. --------------------------------------------- https://www.watchlist-internet.at/news/was-sie-beim-onlineshoppen-beachten-… ===================== = Vulnerabilities = ===================== ∗∗∗ Security Bulletins Posted ∗∗∗ --------------------------------------------- Adobe has published security bulletins for Adobe Acrobat and Reader (APSB19-55), Adobe Photoshop (APSB19-56), Brackets (APSB19-57) and Adobe ColdFusion (APSB19-58). Adobe recommends users update their product installations to the latest versions using the instructions referenced in the bulletin. This posting is provided "AS IS" with no warranties and confers no rights. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1813 ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (firefox-esr, jruby, and squid3), Fedora (librabbitmq, libuv, and xpdf), openSUSE (calamares and opera), Oracle (kernel and nss), Red Hat (httpd24-httpd, kernel, kernel-alt, kpatch-patch, nss-softokn, sudo, and thunderbird), SUSE (apache2-mod_perl, java-1_8_0-openjdk, and postgresql), and Ubuntu (eglibc, firefox, and samba). --------------------------------------------- https://lwn.net/Articles/806957/ ∗∗∗ SAP Security Patch Day – December 2019 ∗∗∗ --------------------------------------------- Page edited by Aditi Kulkarni This post by SAP Product Security Response Team shares information on Patch Day Security Notes that are released on second Tuesday of every month and fix vulnerabilities discovered in SAP products. SAP strongly recommends that the customer visits the Support Portal and applies patches on a priority to protect their SAP landscape.On 10th of December 2019, SAP Security Patch Day saw the release of 5 Security Notes. There are 2 updates to previously released Patch [...] --------------------------------------------- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=533660397 ∗∗∗ Security Bulletin: Multiple Vulnerabilities in MongoDB affects IBM Watson Studio Local ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: WebSphere Application Server Liberty is vulnerable to Cross-site Scripting (CVE-2019-4663) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-websphere-application-ser… ∗∗∗ Security Bulletin: Vulnerabilities addressed in IBM Cloud Pak System (CVE-2019-4521, CVE-2019-4095) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-addressed… ∗∗∗ Security Bulletin: Multiple Vulnerabilities in HAProxy affects IBM Watson Studio Local ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple Vulnerabilities in IBM® Java SDK affect WebSphere Application Server October 2019 CPU ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple Security Vulnerabilities Affect IBM WebSphere Application Server in IBM Cloud ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnera… ∗∗∗ Security Bulletin: Multiple Vulnerabilities in python affects IBM Watson Studio Local ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: IBM Integration Bus Hyper visor Edition V9.0 require customer action for security vulnerabilities in Red Hat Linux ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-integration-bus-hyper… ∗∗∗ IBM Security Bulletin: PowerVC is impacted by an OpenStack Neutron vulnerability related to security group rules (CVE-2019-10876) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-powervc-is-impacted-b… ∗∗∗ IBM Security Bulletin: PowerVC is impacted by an OpenStack Neutron denial of service vulnerability (CVE-2018-14635) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-powervc-is-impacted-b… ∗∗∗ SSA-451445 (Last Update: 2019-12-10): Multiple Vulnerabilities in SPPA-T3000 ∗∗∗ --------------------------------------------- https://cert-portal.siemens.com/productcert/pdf/ssa-451445.pdf ∗∗∗ SSA-273799 (Last Update: 2019-12-10): Vulnerability in SIMATIC products ∗∗∗ --------------------------------------------- https://cert-portal.siemens.com/productcert/pdf/ssa-273799.pdf ∗∗∗ SSA-525454 (Last Update: 2019-12-10): Vulnerabilities in XHQ Operations Intelligence ∗∗∗ --------------------------------------------- https://cert-portal.siemens.com/productcert/pdf/ssa-525454.pdf ∗∗∗ SSA-418979 (Last Update: 2019-12-10): Vulnerabilities in EN100 Ethernet Communication Module ∗∗∗ --------------------------------------------- https://cert-portal.siemens.com/productcert/pdf/ssa-418979.pdf ∗∗∗ SSA-761617 (Last Update: 2019-12-10): Multiple Vulnerabilities in SiNVR Video Management Solution ∗∗∗ --------------------------------------------- https://cert-portal.siemens.com/productcert/pdf/ssa-761617.pdf ∗∗∗ SSA-344983 (Last Update: 2019-12-10): Vulnerability in WPA2 Key Handling affecting SCALANCE W700 and SCALANCE W1700 Devices ∗∗∗ --------------------------------------------- https://cert-portal.siemens.com/productcert/pdf/ssa-344983.pdf ∗∗∗ SSA-618620 (Last Update: 2019-12-10): Vulnerabilities in Boot Loader (U-Boot) of RUGGEDCOM ROS Devices ∗∗∗ --------------------------------------------- https://cert-portal.siemens.com/productcert/pdf/ssa-618620.pdf ∗∗∗ Samba: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-1048 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 09.12.2019
by Daily end-of-shift report 09 Dec '19

09 Dec '19

===================== = End-of-Day report = ===================== Timeframe: Freitag 06-12-2019 18:00 − Montag 09-12-2019 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ SCshell: Fileless Lateral Movement Using Service Manager ∗∗∗ --------------------------------------------- During red team engagements, lateral movement in a network is crucial. In addition, as a critical part of exploit chains, security solutions put a lot of effort to detect this movement. Techniques such as remote WMI and PsExec are fairly well detected. In the case of WMI, WmiPrvSe.exe will be the parent process responsible for spawning the process, making the detection a bit easier. PsExec on its end will push a file on the remote system and register a new service. --------------------------------------------- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/scshell-fil… ∗∗∗ We thought they were potatoes but they were beans (from Service Account to SYSTEM again) ∗∗∗ --------------------------------------------- Nevertheless, we decided to do some further research in order to understand if any bypass of the new OXID resolver restrictions, which in fact inhibits resolver requests over a port different to 135, is still possible. --------------------------------------------- https://decoder.cloud/2019/12/06/we-thought-they-were-potatoes-but-they-wer… ∗∗∗ Detecting unsafe path access patterns with PathAuditor ∗∗∗ --------------------------------------------- Posted by Marta Rożek, Google Summer Intern 2019, and Stephen Röttger, Software Engineer #!/bin/shcat /home/user/fooWhat can go wrong if this command runs as root? Does it change anything if foo is a symbolic link to /etc/shadow? How is the output going to be used? Depending on the answers to the questions above, accessing files this way could be a vulnerability. The vulnerability exists in syscalls that operate on file paths, such as open, rename, chmod, or exec. --------------------------------------------- https://security.googleblog.com/2019/12/detecting-unsafe-path-access-patter… ===================== = Vulnerabilities = ===================== ∗∗∗ NVIDIA Patches Severe Flaws in Mercedes Infotainment System Chips ∗∗∗ --------------------------------------------- NVIDIA released security updates for six high severity vulnerabilities found in the Tegra Linux Driver Package (L4T) for Jetson AGX Xavier, TK1, TX1, TX2, and Nano chips used in Mercedes-Benzs MBUX infotainment system and Bosch self-driving computer systems. --------------------------------------------- https://www.bleepingcomputer.com/news/security/nvidia-patches-severe-flaws-… ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by CentOS (SDL), Debian (htmldoc, librabbitmq, nss, openjdk-7, openslp-dfsg, and phpmyadmin), Fedora (chromium, community-mysql, kernel, libidn2, oniguruma, proftpd, and rabbitmq-server), Mageia (ansible, clamav, evince, firefox, graphicsmagick, icu, libcryptopp, libtasn1, libtiff, libvncserver, libvpx, lz4, nss, openexr, openjpeg2, openssl, phpmyadmin, python-psutil, python-twisted, QT, sdl2_image, SDL_image, sysstat, thunderbird, and tnef), Oracle (firefox), [...] --------------------------------------------- https://lwn.net/Articles/806832/ ∗∗∗ OpenSSL: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-1045 ∗∗∗ [dos] Omron PLC 1.0.0 - Denial of Service (PoC) ∗∗∗ --------------------------------------------- https://www.exploit-db.com/exploits/47757 ∗∗∗ [webapps] Alcatel-Lucent Omnivista 8770 - Remote Code Execution ∗∗∗ --------------------------------------------- https://www.exploit-db.com/exploits/47761 ∗∗∗ [webapps] Yachtcontrol Webapplication 1.0 - Unauthenticated Remote Code Execution ∗∗∗ --------------------------------------------- https://www.exploit-db.com/exploits/47760 ∗∗∗ Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in FasterXML jackson-databind ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-watson-discovery-for-… ∗∗∗ Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in FasterXML jackson-databind ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-watson-discovery-for-… ∗∗∗ Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in FasterXML jackson-databind ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-watson-discovery-for-… ∗∗∗ Security Bulletin: IBM Planning Analytics Local is affected by security vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-planning-analytics-lo… ∗∗∗ Security Bulletin: Vulnerability affects IBM Watson Assistant for IBM Cloud Pak for Data ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-affects-ibm… ∗∗∗ Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in FasterXML jackson-databind ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-watson-discovery-for-… ∗∗∗ Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in FasterXML jackson-databind ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-watson-discovery-for-… ∗∗∗ Security Bulletin: IBM Transparent Could Tiering is affected by a vulnerability in Apache Commons Compress (CVE-2019-12402) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-transparent-could-tie… ∗∗∗ Security Bulletin: IBM Transparent Cloud Tiering is affected by Netty vulnerability ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-transparent-cloud-tie… ∗∗∗ Security Bulletin: Multiple vulnerabilities in Node.js affect IBM Transparent Cloud Tiering ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: IBM Spectrum Scale Transparent Cloud Tiering is affected by multiple vulnerabilities in IBM® Runtime Environment Java™ Version 8 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-spectrum-scale-transp… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 06.12.2019
by Daily end-of-shift report 06 Dec '19

06 Dec '19

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 05-12-2019 18:00 − Freitag 06-12-2019 18:00 Handler: Robert Waldner Co-Handler: Dimitri Robl ===================== = News = ===================== ∗∗∗ 8 common pen testing mistakes and how to avoid them ∗∗∗ --------------------------------------------- One of the most effective ways to uncover flaws and weaknesses in your security posture is to have a third party carry out planned attacks on your system. Penetration testing is all about exposing gaps in your defenses so that they can be plugged before someone with malicious intent can take advantage. There are several different types of pen test designed to target different aspects of your organization. --------------------------------------------- https://www.csoonline.com/article/3487557/8-common-pen-testing-mistakes-and… ∗∗∗ Lazarus Group Goes Fileless ∗∗∗ --------------------------------------------- The rather infamous APT group, "Lazarus", continues to evolve their macOS capabilities. Today, we tear apart their latest 1st-stage implant that supports remote download & in-memory execution of secondary payloads! --------------------------------------------- https://objective-see.com/blog/blog_0x51.html ∗∗∗ Phishing with a self-contained credentials-stealing webpage ∗∗∗ --------------------------------------------- Phishing e-mails which are used to steal credentials usually depend on user clicking a link which leads to a phishing website that looks like login page for some valid service. Not all credentials-stealing has to be done using a remote website, however. I recently came across an interesting phishing campaign in which the scammers used a rather novel technique. --------------------------------------------- https://isc.sans.edu/diary/rss/25580 ∗∗∗ If theres somethin stored in a secure enclave, who ya gonna call? Membuster! ∗∗∗ --------------------------------------------- Computer scientists from UC Berkeley, Texas A&M, and semiconductor biz SK Hynix have found a way to defeat secure enclave protections by observing memory requests from a CPU to off-chip DRAM through the memory bus. --------------------------------------------- https://www.theregister.co.uk/2019/12/05/membuster_secure_enclave/ ∗∗∗ Nur noch wenige Wochen: Planänderungen beim Support-Ende bei Windows 7 ∗∗∗ --------------------------------------------- Drei Wochen nach Weihnachten will Microsoft zum letzten Mal kostenlose Sicherheits-Updates für Windows 7 spendieren. Bald wird es also Zeit für den Umstieg.. --------------------------------------------- https://heise.de/-4602768 ===================== = Vulnerabilities = ===================== ∗∗∗ Unix-artige Systeme: Sicherheitslücke ermöglicht Übernahme von VPN-Verbindung ∗∗∗ --------------------------------------------- Durch eine gezielte Analyse und Manipulation von TCP-Paketen könnten Angreifer eigene Daten in VPN-Verbindungen einschleusen und diese so übernehmen. Betroffen sind fast alle Unix-artigen Systeme sowie auch VPN-Protokolle. Ein Angriff ist in der Praxis wohl aber eher schwierig. (Security, Server) --------------------------------------------- https://www.golem.de/news/unix-artige-systeme-sicherheitsluecke-ermoeglicht… ∗∗∗ VMware ESXi and Horizon DaaS updates address OpenSLP remote code execution vulnerability (CVE-2019-5544) ∗∗∗ --------------------------------------------- OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8. --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2019-0022.html ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (libav), Fedora (kernel, libuv, and nodejs), Oracle (firefox), Red Hat (firefox and java-1.7.1-ibm), SUSE (clamav, cloud-init, dnsmasq, dpdk, ffmpeg, munge, opencv, and permissions), and Ubuntu (librabbitmq). --------------------------------------------- https://lwn.net/Articles/806543/ ∗∗∗ Thales DIS SafeNet Sentinel LDK License Manager Runtime ∗∗∗ --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-19-339-01 ∗∗∗ Security Bulletin: Netcool Operations Insight – Cloud Native Event Analytics is affected by a FasterXML jackson-databind vulnerability (CVE-2019-14439) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-netcool-operations-insigh… ∗∗∗ Security Bulletin: ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-2/ ∗∗∗ Security Bulletin: ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin/ ∗∗∗ Security Bulletin: IBM DataPower Gateway enables default IPMI account ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-datapower-gateway-ena… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 05.12.2019
by Daily end-of-shift report 05 Dec '19

05 Dec '19

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 04-12-2019 18:00 − Donnerstag 05-12-2019 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Security prenotification for Adobe Acrobat and Reader | APSB19-55 ∗∗∗ --------------------------------------------- Adobe is planning to release security updates for Adobe Acrobat and Reader for Windows and macOS on Tuesday, December 10, 2019. --------------------------------------------- https://helpx.adobe.com/security/products/acrobat/apsb19-55.html ∗∗∗ Atlassian scrambles to fix zero-day security hole accidentally disclosed on Twitter ∗∗∗ --------------------------------------------- Twitter security celeb SwiftOnSecurity on Tuesday inadvertently disclosed a zero-day vulnerability affecting enterprise software biz Atlassian, a flaw that may be echoed in IBM's Aspera software. --------------------------------------------- https://go.theregister.co.uk/feed/www.theregister.co.uk/2019/12/05/atlassia… ∗∗∗ NTLMRecon ∗∗∗ --------------------------------------------- A fast NTLM reconnaissance tool without external dependencies. Useful to find out information about NTLM endpoints when working with a large set of potential IP addresses and domains. --------------------------------------------- https://github.com/sachinkamath/ntlmrecon ∗∗∗ xHunt Actor’s Cheat Sheet ∗∗∗ --------------------------------------------- Unit 42 found evidence that the developers who created the Sakabota tool had carried out two sets of testing activities on Sakabota in an attempt to evade detection. Within one sample created during this testing process, we uncovered a cheat sheet meant to assist operators of the tool to carry out activities on the compromised system and network, which weve never seen before. --------------------------------------------- https://unit42.paloaltonetworks.com/xhunt-actors-cheat-sheet/ ===================== = Vulnerabilities = ===================== ∗∗∗ Authentication vulnerabilities in OpenBSD ∗∗∗ --------------------------------------------- We discovered an authentication-bypass vulnerability in OpenBSDs authentication system: this vulnerability is remotely exploitable in smtpd, ldapd, and radiusd, but its real-world impact should be studied on a case-by-case basis. For example, sshd is not exploitable thanks to its defense-in-depth mechanisms. (CVE-2019-19521) --------------------------------------------- https://www.openwall.com/lists/oss-security/2019/12/04/5 ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (firefox), Fedora (cyrus-imapd, freeipa, haproxy, ImageMagick, python-pillow, rubygem-rmagick, sqlite, squid, and tnef), openSUSE (haproxy), Oracle (microcode_ctl), and Ubuntu (squid, squid3). --------------------------------------------- https://lwn.net/Articles/806384/ ∗∗∗ Weidmueller multiple vulnerabilities in various Industrial Ethernet managed switches ∗∗∗ --------------------------------------------- CVE-2019-16670: The Authentication mechanism has no brute-force prevention. CVE-2019-16671: Remote authenticated users can crash a device with a special packet because of Uncontrolled Resource Consumption. CVE-2019-16672: Sensitive Credentials data is transmitted in cleartext. ... CVSS-Scores: bis 9.8 --------------------------------------------- https://cert.vde.com/de-de/advisories/vde-2019-018 ∗∗∗ Mozilla Thunderbird: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Mozilla Thunderbird ausnutzen, um beliebigen Programmcode mit Benutzerrechten auszuführen, vertrauliche Daten einzusehen oder einen Denial of Service Angriff durchzuführen. --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-1040 ∗∗∗ Wireshark: Schwachstelle ermöglicht Denial of Service ∗∗∗ --------------------------------------------- Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Wireshark ausnutzen, um einen Denial of Service Angriff durchzuführen. --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-1039 ∗∗∗ Security Bulletin: IBM ToolsCenter Dynamic System Analysis (DSA) Preboot is affected by multiple vulnerabilities. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-toolscenter-dynamic-s… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli Business Service Manager ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Intel MCE vulnerability CVE-2018-12207 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K17269881 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 04.12.2019
by Daily end-of-shift report 04 Dec '19

04 Dec '19

===================== = End-of-Day report = ===================== Timeframe: Dienstag 03-12-2019 18:00 − Mittwoch 04-12-2019 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ RSA-240: Faktorisierungserfolg gefährdet RSA nicht ∗∗∗ --------------------------------------------- Forscher haben auf einem Rechencluster eine 795 Bit große Zahl faktorisiert. Das RSA-Verschlüsselungs- und Signaturverfahren basiert darauf, dass Faktorisierung schwierig ist. Für die praktische Sicherheit von RSA mit modernen Schlüssellängen hat dieser Durchbruch heute aber wenig Bedeutung. --------------------------------------------- https://www.golem.de/news/rsa-240-faktorisierungserfolg-gefaehrdet-rsa-nich… ∗∗∗ APT review: what the world’s threat actors got up to in 2019 ∗∗∗ --------------------------------------------- What were the most interesting developments in terms of APT activity during the year and what can we learn from them? --------------------------------------------- https://securelist.com/ksb-2019-review-of-the-year/95394/ ∗∗∗ SEC Xtractor: Extrahieren von Daten aus elektronischen Geräten ∗∗∗ --------------------------------------------- Das SEC Consult Hardware Lab hat ein spezielles Hardware-Analyse-Tool entwickelt, mit dem Security Consultants auf einfache Weise Firmware aus Speicherchips auslesen können. Der sogenannte „SEC Xtractor“ wurde nun als Open-Source-Version veröffentlicht. --------------------------------------------- https://www.sec-consult.com/blog/2019/12/sec-xtractor-extrahieren-von-daten… ∗∗∗ Introducing Password Cracking Manager: CrackQ ∗∗∗ --------------------------------------------- Today we are releasing CrackQ, a queuing system to manage password cracking that Ive been working on for about a year. It is primarily for offensive security teams during red teaming and pentesting engagements. Its an intuitive interface for Hashcat served by a REST API and a JavaScript front-end web application for ease of use. --------------------------------------------- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/introducing… ∗∗∗ How to Respond to Emotet Infection (FAQ) ∗∗∗ --------------------------------------------- The purpose of this entry is to provide instructions on how to check if you are infected with Emotet and what you can do in case of infection (based on the information available as of December 2019). --------------------------------------------- https://blogs.jpcert.or.jp/en/2019/12/emotetfaq.html ∗∗∗ Breaking the Rules: A Tough Outlook for Home Page Attacks (CVE-2017-11774) ∗∗∗ --------------------------------------------- As established, the patches for CVE-2017-11774 can be effectively “disabled” by modifying registry keys on an endpoint with no special privileges. The following registry keys and values should be configured via Group Policy to reinforce the recommended configurations in the event that an attacker attempts to reverse the intended security configuration on an endpoint to allow for Outlook home page persistence for malicious purposes. --------------------------------------------- https://www.fireeye.com/blog/threat-research/2019/12/breaking-the-rules-tou… ∗∗∗ Microsoft Guidance for cleaning up orphaned keys generated on vulnerable TPMs and used for Windows Hello for Business ∗∗∗ --------------------------------------------- ... WHfB keys are tied to a user and a device that has been added to Azure AD, and if the device is removed, the corresponding WHfB key is considered orphaned. However, these orphaned keys are not deleted even when the device it was created on is no longer present. Any authentication to Azure AD using such an orphaned WHfB key will be rejected. However, some of these orphaned keys could lead to the following security issue in Active Directory 2016 or 2019, in either hybrid or on-premises --------------------------------------------- https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV190026 ∗∗∗ Betrug mit begehrten Champions League Tickets auf Facebook ∗∗∗ --------------------------------------------- Die Lieblings-Band einmal live zu erleben oder den favorisierten Fußballklub in der UEFA Champions League live im Stadion anzufeuern, ist ein einmaliges Erlebnis. In Facebook-Gruppen ausverkaufter Events versuchen verzweifelte Fans, die letzten Tickets zu ergattern. In Privatnachrichten werden ihnen diese Karten auf Facebook gegen Überweisung oder PayPal-Zahlung versprochen. Vorsicht: Dahinter können Kriminelle stecken! --------------------------------------------- https://www.watchlist-internet.at/news/betrug-mit-begehrten-champions-leagu… ∗∗∗ Two malicious Python libraries removed from PyPI ∗∗∗ --------------------------------------------- One library was available for only two days, but the second was live for nearly a year. --------------------------------------------- https://www.zdnet.com/article/two-malicious-python-libraries-removed-from-p… ===================== = Vulnerabilities = ===================== ∗∗∗ Reliable Controls LicenseManager ∗∗∗ --------------------------------------------- This advisory contains mitigations for an unquoted search path or element vulnerability in the Reliable Controls LicenseManager. --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-19-337-01 ∗∗∗ Moxa AWK-3121 ∗∗∗ --------------------------------------------- This advisory contains mitigations for multiple vulnerabilities in Moxa’s AWK-3121 wireless access point/bridge/client. --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-19-337-02 ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by CentOS (389-ds-base, ghostscript, kernel, and tcpdump), Debian (libonig), Fedora (clamav, firefox, and oniguruma), openSUSE (calamares, cloud-init, haproxy, libarchive, libidn2, libxml2, and ucode-intel), Scientific Linux (SDL and tcpdump), Slackware (mozilla), and Ubuntu (haproxy, intel-microcode, and postgresql-common). --------------------------------------------- https://lwn.net/Articles/806296/ ∗∗∗ Security Advisory - Improper Authentication Vulnerability in Smartphones ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191204-… ∗∗∗ Security Advisory - Remote Code Execution Vulnerability in Fastjson ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191204-… ∗∗∗ Security Advisory - Out-of-bounds Read Vulnerability in Advanced Packages of Gauss100 OLTP Database ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191204-… ∗∗∗ Security Advisory - Denial of Service Vulnerability in some Huawei Products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191204-… ∗∗∗ Security Advisory - Weak Algorithm Vulnerability in Some Huawei Products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191204-… ∗∗∗ Security Advisory - DoS Vulnerability in Some Huawei Products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191204-… ∗∗∗ Security Advisory - Insufficient Verification of Data Authenticity Vulnerability in Some Huawei Products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191204-… ∗∗∗ Security Advisory - Improper Authentication Vulnerability in Several Products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191204-… ∗∗∗ Security Advisory - Path Traversal Vulnerability in Several Smartphones ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191204-… ∗∗∗ Security Advisory - Improper Authorization Vulnerability in Several Smartphones ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191204-… ∗∗∗ Security Bulletin: : Netcool Operations Insight – Cloud Native Event Analytics is affected by a FasterXML jackson-databind vulnerability (CVE-2019-12814) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-netcool-operations-insigh… ∗∗∗ Security Bulletin: Vulnerability in OpenSSL affects IBM Cloud Pak System (CVE-2019-1552) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-openssl-… ∗∗∗ Security Bulletin: Security Vulnerabilities have been identified in IBM Java Runtime as shipped with Tivoli Federated Identity Manager ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-security-vulnerabilities-… ∗∗∗ Security Bulletin: A security vulnerability has been identified in Red Hat® Enterprise Linux (RHEL) Server shipped with PurePower Integrated Manager (PPIM) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: Netcool Operations Insight – Cloud Native Event Analytics is affected by an Apache Kafka vulnerability (CVE-2018-17196) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-netcool-operations-insigh… ∗∗∗ Security Bulletin: A security vulnerability has been identified in Red Hat® Enterprise Linux (RHEL) Server shipped with PurePower Integrated Manager (PPIM) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: Netcool Operations Insight – Cloud Native Event Analytics is affected by an Apache Zookeeper vulnerability (CVE-2019-0201) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-netcool-operations-insigh… ∗∗∗ IBM Security Bulletin: Vulnerability in IBM Java SDK affects IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products (CVE-2019-2602) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-vulnerability-in-ibm-… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 03.12.2019
by Daily end-of-shift report 03 Dec '19

03 Dec '19

===================== = End-of-Day report = ===================== Timeframe: Montag 02-12-2019 18:00 − Dienstag 03-12-2019 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Strandhogg: Sicherheitslücke in Android wird aktiv ausgenutzt ∗∗∗ --------------------------------------------- Unter Android können sich Schad-Apps als legitime Apps tarnen und weitere Berechtigungen anfordern. Die Strandhogg genannte Sicherheitslücke wird bereits aktiv ausgenutzt und eignet sich beispielsweise für Banking-Trojaner. Einen Patch gibt es nicht. ... Die Sicherheitsfirma Lookout konnte bereits 36 Apps ausfindig machen, die die Sicherheitslücke ausnutzen. Die betroffenen Apps nennt die Sicherheitsfirma allerdings nicht. Diese seien zum Teil auch im Google Play Store zu finden gewesen, allerdings hätten sie die Schadsoftware nicht enthalten, sondern diese erst nach der Installation nachgeladen - sogenannte Dropper-Apps. Google hat die betroffenen Apps nach einem Hinweis aus dem Play Store gelöscht. --------------------------------------------- https://www.golem.de/news/strandhogg-sicherheitsluecke-in-android-wird-akti… ∗∗∗ Network traffic analysis for Incident Response (IR): TLS decryption ∗∗∗ --------------------------------------------- e post Network traffic analysis for Incident Response (IR): TLS decryption appeared first on Infosec Resources.Network traffic analysis Over the years, the use of TLS has grown dramatically, with over half of websites using HTTPS by default. However, situations exist where it is useful to be able to decrypt this traffic. For example, many organizations perform deep packet inspection (DPI) in order to detect and block potentially malicious traffic. --------------------------------------------- https://resources.infosecinstitute.com/network-traffic-analysis-for-inciden… ∗∗∗ Another Fake Google Domain: fonts[.]googlesapi[.]com ∗∗∗ --------------------------------------------- Our Remediation team lead Ben Martin recently found a fake Google domain that is pretty convincing to the naked eye. The malicious domain was abusing the URL shortener service is.gd: shortened URLs were being injected into the posts table of the client’s WordPress database. Whenever the infected WordPress page loads, the actual content is obscured behind the is.gd shortener, which obtains content from the fake Google domain: fonts[.]googlesapi[.]com --------------------------------------------- https://blog.sucuri.net/2019/12/another-fake-google-domain-fonts-googlesapi… ∗∗∗ Ursnif infection with Dridex ∗∗∗ --------------------------------------------- Todays diary reviews an Ursnif infection from this campaign that I generated in my lab environment on Monday, December 2nd. --------------------------------------------- https://isc.sans.edu/diary/rss/25566 ∗∗∗ Anruf von Microsoft? – Legen Sie sofort auf! ∗∗∗ --------------------------------------------- Kriminelle geben sich als Microsoft-MitarbeiterInnen aus und erklären besorgten NutzerInnen, ihr Computer sei von einem Trojaner befallen. Mit diesem Vorwand versuchen Kriminelle sich Zugriff auf den Computer zu verschaffen und anschließend sensible Zugangsdaten zu stehlen oder wertvolle Daten zu löschen. Es handelt sich um eine Betrugsmasche, Microsoft würde niemals persönlich anrufen! --------------------------------------------- https://www.watchlist-internet.at/news/anruf-von-microsoft-legen-sie-sofort… ∗∗∗ A decade of malware: Top botnets of the 2010s ∗∗∗ --------------------------------------------- ZDNet goes over the list of biggest malware botnets of the past decade, from Necurs to Mirai. --------------------------------------------- https://www.zdnet.com/article/a-decade-of-malware-top-botnets-of-the-2010s/ ===================== = Vulnerabilities = ===================== ∗∗∗ Multiple MOTEX products vulnerable to privilege escalation ∗∗∗ --------------------------------------------- LanScope Cat and LanScope An provided by MOTEX Inc. contain a privilege escalation vulnerability. An user who can login to the PC where the vulnerable product is installed may obtain unauthorized privileges and execute arbitrary code. --------------------------------------------- https://jvn.jp/en/jp/JVN49068796/ ∗∗∗ Patchday: Google serviert Sicherheitspatches für Android und seine Pixel-Serie ∗∗∗ --------------------------------------------- Verschiedene Android-Versionen sind über kritische Sicherheitslücken attackierbar. Nun gibt es Sicherheitsupdates. --------------------------------------------- https://heise.de/-4602506 ∗∗∗ Multiple vulnerabilites in Fronius Solar Inverter Series (CVE-2019-19229, CVE-2019-19228) ∗∗∗ --------------------------------------------- The vendor automatically performed a fleet update of the solar inverters in the field in order to patch them. Nevertheless, as not all devices could be reached through such an update, all remaining users are advised to install the patches provided by the vendor immediately. (CVE-2019-19229, CVE-2019-19228) --------------------------------------------- https://sec-consult.com/en/blog/advisories/multiple-vulnerabilites-in-froni… ∗∗∗ Vulnerability Spotlight: Two vulnerabilities in EmbedThis GoAhead ∗∗∗ --------------------------------------------- EmbedThis’ GoAhead Web Server contains two vulnerabilities that both arise when the software attempts to process a multi-part/form-data HTTP request. An attacker could exploit these vulnerabilities to remotely execute code on the victim machine, or cause a denial-of-service condition. --------------------------------------------- https://blog.talosintelligence.com/2019/12/vulnerability-spotlight-EmbedThi… ∗∗∗ Vulnerability Spotlight: Accusoft ImageGear PNG IHDR width code execution vulnerability ∗∗∗ --------------------------------------------- Accusoft ImageGear contains two remote code execution vulnerabilities. ImageGear is a document and imaging library from Accusoft that developers can use to build their applications. The library contains the entire document imaging lifecycle. This vulnerability is present in the Accusoft ImageGear library, which is a document-imaging developer toolkit. --------------------------------------------- https://blog.talosintelligence.com/2019/12/vulnerability-spotlight-accusoft… ∗∗∗ Vulnerability Spotlight: SQL injection vulnerabilities in Forma Learning Management System ∗∗∗ --------------------------------------------- Cisco Talos recently discovered three SQL injection vulnerabilities in the authenticated portion of the Formal Learning Management System. LMS is a set of software that allows companies to build and host different training courses for their employees. The software operates with an open-source licensing model and now operates under the Forma organization. --------------------------------------------- https://blog.talosintelligence.com/2019/12/vulnerability-spotlight-sql-inje… ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (intel-ucode and libtiff), Debian (exiv2), Oracle (SDL), Red Hat (kernel, patch, and python-jinja2), and Ubuntu (graphicsmagick, linux, linux-aws, linux-aws-5.0, linux-gcp, linux-gke-5.0, linux-hwe, linux-kvm, linux-oem-osp1, linux-oracle, linux-oracle-5.0, linux-raspi2, linux, linux-aws, linux-aws-hwe, linux-gcp, linux-gke-4.15, linux-hwe, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon, linux, linux-aws, linux-gcp...) --------------------------------------------- https://lwn.net/Articles/806202/ ∗∗∗ Kaspersky Internet Security: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit den Rechten des Dienstes ∗∗∗ --------------------------------------------- Ein lokaler Angreifer kann eine Schwachstelle in Kaspersky Internet Security und Kaspersky Total Security ausnutzen, um beliebigen Programmcode mit den Rechten des Dienstes auszuführen. --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-1035 ∗∗∗ Trend Micro Internet Security: Schwachstelle ermöglicht Privilegieneskalation ∗∗∗ --------------------------------------------- Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Trend Micro Internet Security und Trend Micro AntiVirus ausnutzen, um seine Privilegien zu erhöhen. --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-1034 ∗∗∗ Security Bulletin: IBM Cloud Pak System is vulnerable to Intel Microarchitectural Data Sampling (MDS) Vulnerabilites ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cloud-pak-system-is-v… ∗∗∗ Security Bulletin: Vulnerability in Google Guava affects IBM Cloud Pak System (CVE-2018-10237) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-google-g… ∗∗∗ Security Bulletin: Vulnerability from Apache HttpComponents affects IBM Cloud Pak System (CVE-2011-1498, CVE-2015-5262) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-from-apache… ∗∗∗ Security Bulletin: Multiple cross-site scripting vulnerabilities in Cloud Pak System ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-cross-site-scrip… ∗∗∗ Security Bulletin: Cross-site scripting vulnerability in IBM Cloud Pak System (CVE-2019-4098) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-cross-site-scripting-vuln… ∗∗∗ BIND vulnerability CVE-2019-6477 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K15840535?utm_source=f5support&utm_mediu… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 02.12.2019
by Daily end-of-shift report 02 Dec '19

02 Dec '19

===================== = End-of-Day report = ===================== Timeframe: Freitag 29-11-2019 18:00 − Montag 02-12-2019 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Cybercrime-Bericht 2018: Kriminalität im Netz bleibt große Herausforderung ∗∗∗ --------------------------------------------- Auch im Jahr 2018 verzeichnete das Cybercrime Competence Center (C4) des Bundeskriminalamtes eine Zunahme von Cybercrime Delikten. Im Vergleich zum Vorjahr wurde ein Anstieg von 16,8 Prozent registriert, vorwiegend im Bereich Internetbetrug. --------------------------------------------- http://www.bmi.gv.at/news.aspx?id=6D4D326A543767595673593D ∗∗∗ Analysis of Malicious ElectrumX Servers Source Code ∗∗∗ --------------------------------------------- Recently I have found some malicious ElectrumX nodes in the Electrum network that are still being connected by the Electrum software. In this post I share some information about these nodes and the ElectrumX patched code that they execute. --------------------------------------------- http://www.peppermalware.com/2019/12/analysis-of-malicious-electrumx-server… ∗∗∗ Polizei warnt vor professionellen Fake-Shops im Internet ∗∗∗ --------------------------------------------- In der Weihnachtszeit wird kräftig online eingekauft. Das machen sich auch Betrüger zunutze. Experten der Polizei warnen gerade jetzt vor deren Maschen. --------------------------------------------- https://heise.de/-4600046 ∗∗∗ Insight into NIS Directive sectoral incident response capabilities ∗∗∗ --------------------------------------------- The report provides a deeper insight into NISD sectoral Incident Response capabilities, procedures, processes and tools to identify the trends and possible gaps and overlaps. --------------------------------------------- https://www.helpnetsecurity.com/2019/12/02/nis-directive-incident-response/ ===================== = Vulnerabilities = ===================== ∗∗∗ Multiple Critical Vulnerabilities in SALTO ProAccess SPACE ∗∗∗ --------------------------------------------- In the software SALTO ProAccess Space ... multiple typical web application vulnerabilities got identified. An authenticated attacker was able to exploit a path traversal vulnerability to backup arbitrary files into the web root. This allowed an attacker to export the database into the web root and download it. Furthermore, it was possible to combine another export feature with the path traversal vulnerability to write arbitrary contents to arbitrary locations on the backend Windows server. --------------------------------------------- https://sec-consult.com/en/blog/advisories/multiple-critical-vulnerabilitie… ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (389-ds-base, asterisk, file, nss, proftpd-dfsg, ssvnc, and tnef), Fedora (chromium, djvulibre, freeradius, ImageMagick, jhead, kernel, phpMyAdmin, python-pillow, and rubygem-rmagick), Mageia (bzip2, chromium-browser-stable, curl, dbus, djvulibre, glib2.0, glibc, gnupg2, httpie, libreoffice, libssh2, mosquitto, nginx, python-sqlalchemy, unbound, and zipios++), openSUSE (bluez, clamav, cpio, freerdp, openafs, phpMyAdmin, strongswan, and webkit2gtk3), --------------------------------------------- https://lwn.net/Articles/806079/ ∗∗∗ Multiple Cisco Analog Telephone Adapters Remote Code Execution Vulnerabilities ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco Webex Teams and Cisco Webex Meetings Client DLL Hijacking Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 29.11.2019
by Daily end-of-shift report 29 Nov '19

29 Nov '19

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 28-11-2019 18:00 − Freitag 29-11-2019 18:00 Handler: Robert Waldner Co-Handler: Dimitri Robl ===================== = News = ===================== ∗∗∗ Sicherheitslücken: So einfach lassen sich SMS mitlesen ∗∗∗ --------------------------------------------- Mit dem SMS-Nachfolger RCS werden SMS und Telefonanrufe über das Internet abgewickelt - mit einem vorgegebenen Passwort. Mit diesem können auch klassische SMS unbemerkt mitgelesen werden. Eine entsprechende Konfigurationsdatei lässt sich von jeder App empfangen. (Joyn, Datenschutz) --------------------------------------------- https://www.golem.de/news/sicherheitsluecken-so-einfach-lassen-sich-sms-mit… ∗∗∗ Smartwatch exposes locations and other data on thousands of children ∗∗∗ --------------------------------------------- A device that is supposed to help parents keep track of their children and give them a peace of mind can be turned into a surveillance device for bad actors The post Smartwatch exposes locations and other data on thousands of children appeared first on WeLiveSecurity --------------------------------------------- https://www.welivesecurity.com/2019/11/29/smartwatch-exposes-location-data-… ===================== = Vulnerabilities = ===================== ∗∗∗ Y2K-Bug-Variante trifft Splunk-Produkte – Lösungen verfügbar ∗∗∗ --------------------------------------------- Splunk-Admins sollten sich vor dem Jahreswechsel dringend mit einem "Jahr-2020-Problem" in der Software auseinandersetzen. Updates stehen bereit. --------------------------------------------- https://heise.de/-4599420 ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (libvpx and vino), Fedora (grub2 and nss), and SUSE (cloud-init, libarchive, libtomcrypt, ncurses, and ucode-intel). --------------------------------------------- https://lwn.net/Articles/805811/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 28.11.2019
by Daily end-of-shift report 28 Nov '19

28 Nov '19

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 27-11-2019 18:00 − Donnerstag 28-11-2019 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Video: Abo-Falle Streaming-Plattformen ∗∗∗ --------------------------------------------- Streaming-Plattformen werben mit einer kostenlosen Registrierung. Nach fünf Tagen verlangen sie von BenutzerInnen für einen Premium-Status 358,80 Euro, 359,88 Euro bzw. 395,88 Euro. Für die Bezahlung der Rechnung gibt es keinen Grund. --------------------------------------------- https://www.watchlist-internet.at/news/video-abo-falle-streaming-plattforme… ∗∗∗ Adobe discloses security breach impacting Magento Marketplace users ∗∗∗ --------------------------------------------- Security breach was detected last week and traced back to a vulnerability in the Magento Marketplace website. --------------------------------------------- https://www.zdnet.com/article/adobe-discloses-security-breach-impacting-mag… ===================== = Vulnerabilities = ===================== ∗∗∗ BlackBerry Powered by Android Security Bulletin - November 2019 ∗∗∗ --------------------------------------------- BlackBerry has released a security update to address multiple vulnerabilities in BlackBerry powered by Android smartphones. We recommend users update to the latest available software build. --------------------------------------------- http://support.blackberry.com/kb/articleDetail?language=en_US&articleNumber… ∗∗∗ DSA-4577 haproxy - security update ∗∗∗ --------------------------------------------- Tim Düsterhus discovered that haproxy, a TCP/HTTP reverse proxy, didnot properly sanitize HTTP headers when converting from HTTP/2 toHTTP/1. This would allow a remote user to perform CRLF injections. --------------------------------------------- https://www.debian.org/security/2019/dsa-4577 ∗∗∗ QNAP NAS: Hersteller fixt unter anderem kritische Schwachstelle in Photo Station ∗∗∗ --------------------------------------------- QTS-Updates beseitigen zahlreiche Angriffsmöglichkeiten aus der Ferne. --------------------------------------------- https://heise.de/-4598238 ∗∗∗ Security updates for (US) Thanksgiving ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (haproxy and libvorbis), Fedora (mod_auth_mellon and xen), Oracle (389-ds-base, kernel, and tcpdump), SUSE (bsdtar, java-11-openjdk, java-1_7_0-openjdk, and libxml2), and Ubuntu (nss and python-psutil). --------------------------------------------- https://lwn.net/Articles/805777/ ∗∗∗ WordPress Plugin "WP Spell Check" vulnerable to cross-site request forgery ∗∗∗ --------------------------------------------- https://jvn.jp/en/jp/JVN26838191/ ∗∗∗ Security Bulletin: IBM Security QRadar Packet Capture is vulnerable to Using Components with Known Vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-qradar-packe… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 27.11.2019
by Daily end-of-shift report 27 Nov '19

27 Nov '19

===================== = End-of-Day report = ===================== Timeframe: Dienstag 26-11-2019 18:00 − Mittwoch 27-11-2019 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Almost 60% Of Malicious Ads Come from Three Ad Providers ∗∗∗ --------------------------------------------- In Confiants "Demand Quality Report for Q3 2019", the ad fraud and security company analyzed 120 billion ad impressions between January 1st and September 20th that flowed through their systems in order to provide a breakdown of different malicious ad campaigns. --------------------------------------------- https://www.bleepingcomputer.com/news/security/almost-60-percent-of-malicio… ∗∗∗ Top 25 Most Dangerous Vulnerabilities Refreshed After 8 Years ∗∗∗ --------------------------------------------- For the first time in eight years, the list with the most dangerous 25 software vulnerabilities received an update that promises to be relevant for current times. --------------------------------------------- https://www.bleepingcomputer.com/news/security/top-25-most-dangerous-vulner… ∗∗∗ MITRE ATT&CK vulnerability spotlight: Credentials in registry ∗∗∗ --------------------------------------------- One of the attack stages as described in the MITRE ATT&CK tool is credential access, where a hacker tries to steal user credential information to gain access to new accounts or elevate privileges on a compromised system. One of the means by which an attacker can perform this stage of an attack is by extracting credentials from where they are stored in the Windows registry. --------------------------------------------- https://resources.infosecinstitute.com/mitre-attck-vulnerability-spotlight-… ∗∗∗ Insights from one year of tracking a polymorphic threat ∗∗∗ --------------------------------------------- We discovered the polymoprhic threat Dexphot in October 2018. In the months that followed, we closely tracked the threat as attackers upgraded the malware, targeted new processes, and worked around defensive measures. One year’s worth of intelligence helped us gain insight not only into the goals and motivations of Dexphot’s authors, but of cybercriminals in general. --------------------------------------------- https://www.microsoft.com/security/blog/2019/11/26/insights-from-one-year-o… ∗∗∗ Exposed Firebase Database ∗∗∗ --------------------------------------------- An issue can arise in firebase when developers fail to enable authentication. This vulnerability is very similar to every other database misconfiguration, theres no authentication. Leaving a database exposed to the world unauthenticated is an open invite for malicious hackers. --------------------------------------------- http://ghostlulz.com/google-exposed-firebase-database/ ∗∗∗ Vorsicht vor Ping-Anrufen! ∗∗∗ --------------------------------------------- KonsumentInnen erhalten immer wieder sogenannte Ping-Calls. Sie werden dabei von unbekannten Nummern angerufen. Die Anrufe werden meist nach dem ersten oder zweiten Läuten wieder beendet. Wer aus Höflichkeit oder Neugierde zurückruft, tappt in die Kostenfalle. Bei unbekannten, verdächtigen Nummern gilt: Nicht abheben und nicht zurückrufen! --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-vor-ping-anrufen/ ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (bsdiff, libvpx, tiff, and xmlrpc-epi), Fedora (freeimage, imapfilter, kernel, mingw-freeimage, and thunderbird), openSUSE (cups and djvulibre), Oracle (SDL), SUSE (ardana-db, ardana-keystone, ardana-neutron, ardana-nova, crowbar-core, crowbar-openstack, crowbar-ui, openstack-barbican, openstack-heat-templates, openstack-keystone, openstack-neutron, openstack-neutron-gbp, openstack-neutron-lbaas, openstack-nova, openstack-octavia, openstack-sahara, python-psutil, release-notes-suse-openstack-cloud, freerdp, mailman, slurm) and Ubuntu (ruby2.3, ruby2.5). --------------------------------------------- https://lwn.net/Articles/805720/ ∗∗∗ Security Advisory - Information Leak Vulnerability in Huawei Smart Speaker Myna ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191127-… ∗∗∗ Security Advisory - Buffer Overflow Vulnerability in Huawei Atlas Product ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191127-… ∗∗∗ Security Advisory - Improper Authorization Vulnerability in Several Smartphones ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191127-… ∗∗∗ Security Advisory - Information Disclosure Vulnerability in Several Smartphones ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191127-… ∗∗∗ Security Bulletin: OpenSSL as used by IBM QRadar Network Packet Capture is vulnerable to (CVE-2019-1559) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-openssl-as-used-by-ibm-qr… ∗∗∗ Security Bulletin: Vulnerabilities in OpenSSL affect AIX (CVE-2019-1547, CVE-2019-1563) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-openss… ∗∗∗ Security Bulletin: Vulnerability CVE-2019-10218 in Samba affects IBM i ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-cve-2019-10… ∗∗∗ Security Bulletin: Python as used by IBM QRadar Network Packet Capture is vulnerable to Improper Neutralization of CRLF Sequences in HTTP Headers (CVE-2019-9947, CVE-2019-9948) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-python-as-used-by-ibm-qra… ∗∗∗ Security Bulletin: OpenSSL as used by IBM QRadar Network Packet Capture is vulnerable to a timing side channel attack (CVE-2018-0734) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-openssl-as-used-by-ibm-qr… ∗∗∗ TMM vulnerability CVE-2019-6669 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K11447758 ∗∗∗ BIG-IP AAM vulnerability CVE-2019-6666 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K92411323 ∗∗∗ BIG-IP FIX profile security advisory vulnerability CVE-2019-6667 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K82781208 ∗∗∗ BIG-IP TMM vulnerability CVE-2019-6671 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K39225055 ∗∗∗ BIG-IP AFM vulnerability CVE-2019-6672 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K14703097 ∗∗∗ BIG-IP ASM Bot Detection DNS cache does not expire security exposure ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K79240502 ∗∗∗ The BIG-IP system may fail to properly parse HTTP headers that are prepended by whitespace (non RFC2616 compliant) ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K39794285 ∗∗∗ BIG-IP ASM and BIG-IQ/Enterprise Manager/F5 iWorkflow device authentication and trust vulnerability CVE-2019-6665 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K26462555 ∗∗∗ BIG-IP HTTP/2 vulnerability CVE-2019-6673 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K81557381 ∗∗∗ F5 SSL Orchestrator vulnerability CVE-2019-6674 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K21135478 ∗∗∗ BIG-IP Edge Client for macOS vulnerability CVE-2019-6668 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K49827114 ∗∗∗ BIG-IP APM ignores the Restrict to Single Client IP option for Native RDP resources ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K24241590 ∗∗∗ vCMP vulnerability CVE-2019-6670 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K05765031 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 26.11.2019
by Daily end-of-shift report 26 Nov '19

26 Nov '19

===================== = End-of-Day report = ===================== Timeframe: Montag 25-11-2019 18:00 − Dienstag 26-11-2019 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Unsichere Tracking-Smartwatch: Angreifer könnten Tausende Kinder stalken ∗∗∗ --------------------------------------------- Billige Tracker-Uhren aus China sind recht häufig Gegenstand von Sicherheitswarnungen. Das aktuelle Kindermodell SMA-WATCH-M2 setzt den (Abhör-)Alptraum fort. --------------------------------------------- https://heise.de/-4596410 ∗∗∗ Vorsicht beim Black-Friday-Shopping ∗∗∗ --------------------------------------------- Zahlreiche Online-HändlerInnen locken im Zuge des Black Fridays mit sagenhaften Angeboten. Am Freitag können Sie Kleidung, Elektronik, Haushaltswaren und viel mehr deutlich günstiger erwerben. Seien Sie jedoch bei den unglaublichsten Schnäppchen doppelt vorsichtig, denn nicht jedes Angebot ist seriös. --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-beim-black-friday-shopping/ ∗∗∗ A hacking group is hijacking Docker systems with exposed API endpoints ∗∗∗ --------------------------------------------- Its almost 2020 and some sysadmins are still leaving Docker admin ports exposed on the internet. --------------------------------------------- https://www.zdnet.com/article/a-hacking-group-is-hijacking-docker-systems-w… ===================== = Vulnerabilities = ===================== ∗∗∗ ZDI-19-996: Dell EMC Storage Monitoring and Reporting Java RMI Deserialization of Untrusted Data Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on affected installations of Dell EMC Storage Monitoring and Reporting. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-19-996/ ∗∗∗ Xen Security Advisory XSA-306 - Device quarantine for alternate pci assignment methods ∗∗∗ --------------------------------------------- An untrusted domain with access to a physical device can DMA into host memory, leading to privilege escalation. --------------------------------------------- https://xenbits.xen.org/xsa/advisory-306.html ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (libxdmcp, nss, php-imagick, and ruby2.1), openSUSE (java-11-openjdk), Red Hat (389-ds-base, kernel, kernel-rt, python-jinja2, qemu-kvm-ma, and tcpdump), SUSE (bluez, clamav, cpio, cups, gcc9, libpng16, libssh2_org, mailman, sqlite3, squid, strongswan, tiff, and webkit2gtk3), and Ubuntu (redmine). --------------------------------------------- https://lwn.net/Articles/805650/ ∗∗∗ Paessler PRTG: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- PRTG Network Monitor ist eine Netzwerk Monitoring Werkzeug der Paessler AG. Ein Angreifer kann mehrere Schwachstellen in Paessler PRTG ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen oder beliebigen Programmcode mit Rechten des Dienstes auszuführen. --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-1019 ∗∗∗ Kaspersky Produkte: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Kaspersky Anti-Virus, Kaspersky Internet Security und Kaspersky Total Security ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen oder einen Denial of Service zu verursachen. --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-1018 ∗∗∗ Security Bulletin: Multiple IBM MQ Security Vulnerabilities Affect IBM Sterling B2B Integrator ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-ibm-mq-security-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect the IBM Spectrum Protect Server on AIX (CVE-2019-4473, CVE-2019-11771) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: WebSphere Application Server is vulnerable to Apache Commons Beanutils (CVE-2019-10086) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-websphere-application-ser… ∗∗∗ Security Bulletin: SQL Injection Vulnerability Affects IBM Sterling B2B Integrator (CVE-2019-4387) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-sql-injection-vulnerabili… ∗∗∗ Security Bulletin: Multiple Db2 vulnerabilities affect the IBM Spectrum Protect Server (CVE-2019-4057, CVE-2019-4101, CVE-2019-4154, CVE-2019-4386, CVE-2019-4322) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-db2-vulnerabilit… ∗∗∗ BIG-IP Engineering Hotfix authentication bypass vulnerability CVE-2019-6675 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K55655944 ∗∗∗ NodeJS vulnerability CVE-2018-7160 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K63025104 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 25.11.2019
by Daily end-of-shift report 25 Nov '19

25 Nov '19

===================== = End-of-Day report = ===================== Timeframe: Freitag 22-11-2019 18:00 − Montag 25-11-2019 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ A Short History of Juice Jacking ∗∗∗ --------------------------------------------- The days are now shorter, and the holiday season is upon us. Many of us have travel booked to bring our family together and will soon be uncomfortably sitting in the halls of airline terminals, desperate to escape the monotony of an international waiting room we will sit transfixed to our mobile devices. Breaking our mobile-mindfulness-zen like state, an alert graces the screen: 15% battery life remaining. --------------------------------------------- https://www.secjuice.com/history-of-juice-jacking/ ∗∗∗ Local Malware Analysis with Malice, (Sat, Nov 23rd) ∗∗∗ --------------------------------------------- This project (Malice) provides the ability to have your own locally managed multi-engine malware scanning system. The framework allows the owner to analyze files for known malware. It can be used both as a command tool to analyze samples and review the results via a Kibana web interface. The Command-Line Interface (CLI) is used to scan a file or directory or can be setup to watch and scan new files when copied into a write only directory. --------------------------------------------- https://isc.sans.edu/diary/rss/25544 ∗∗∗ Introducing Merlin - A cross-platform post-exploitation HTTP/2 Command & Control Tool ∗∗∗ --------------------------------------------- Merlin is a cross-platform post-exploitation framework that leverages HTTP/2 communications to evade inspection. HTTP/2 is a relatively new protocol that requests Perfect Forward Secrecy (PFS) encryption cipher suites are used. ... Additionally, many security technologies are not equipped with HTTP/2 protocol dissectors and are therefore not able to evaluate traffic even if keying material is provided. --------------------------------------------- https://medium.com/@Ne0nd0g/introducing-merlin-645da3c635a ∗∗∗ Trickbot Updates Password Grabber Module ∗∗∗ --------------------------------------------- Trickbot is a modular malware, and one of its modules is a password grabber. In November 2019, we started seeing indicators of Trickbot's password grabber targeting data from OpenSSH and OpenVPN applications. --------------------------------------------- https://unit42.paloaltonetworks.com/trickbot-updates-password-grabber-modul… ∗∗∗ PC-Fernwartung: Sicherheitsforscher warnen vor angreifbarer VNC-Software ∗∗∗ --------------------------------------------- Angreifer könnten Clients und Server mit verschiedener VNC-Software attackieren und unter bestimmten Voraussetzungen Malware platzieren. --------------------------------------------- https://heise.de/-4595718 ∗∗∗ Kauf von Konzertkarten auf eventtickets24.com birgt Gefahren ∗∗∗ --------------------------------------------- Die Smartfox Media b.v. aus den Niederlanden bietet auf eventtickets24.com Konzert- und Veranstaltungskarten an. Zahlreiche KundInnen berichten von groben Problemen nach dem Ticketkauf. So kommt es u.U. zu Schwierigkeiten bei der Beschaffung und Lieferung oder ausbleibenden Rückerstattungen nach Nichtlieferung. Wir raten zu großer Vorsicht bei diesem Angebot. --------------------------------------------- https://www.watchlist-internet.at/news/kauf-von-konzertkarten-auf-eventtick… ===================== = Vulnerabilities = ===================== ∗∗∗ Patched GIF Processing Vulnerability CVE-2019-11932 Still Afflicts Multiple Mobile Apps ∗∗∗ --------------------------------------------- CVE-2019-11932, which is a vulnerability in WhatsApp for Android, was first disclosed to the public on October 2, 2019 after a researcher named Awakened discovered that attackers could use maliciously crafted GIF files to allow remote code execution. The vulnerability was patched with version 2.19.244 of WhatsApp, but the underlying problem lies in the library called libpl_droidsonroids_gif.so, which is part of the android-gif-drawable package. While this flaw has also been patched, many [...] --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/sBAf9Ks1I8Y/ ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (chromium, enigmail, isc-dhcp, libice, libofx, and pam-python), Fedora (chromium, ghostscript, mingw-cfitsio, mingw-gdal, mingw-libidn2, and rsyslog), Gentoo (adobe-flash, chromium, expat, and firefox), openSUSE (apache2-mod_perl, haproxy, java-11-openjdk, and ncurses), Oracle (ghostscript, kernel, php:7.2, php:7.3, and sudo), Red Hat (chromium-browser, python27-python, and SDL), and Ubuntu (dpdk and libvpx). --------------------------------------------- https://lwn.net/Articles/805527/ ∗∗∗ Weak encryption cipher and hardcoded cryptographic keys in Fortinet products ∗∗∗ --------------------------------------------- https://sec-consult.com/en/blog/advisories/weak-encryption-cipher-and-hardc… ∗∗∗ Security Bulletin: Incorrect permissions on CIT files in IBM Spectrum Protect Backup-Archive Client and IBM Spectrum Protect for Virtual Environments (CVE-2018-2025) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-incorrect-permissions-on-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Spectrum Protect for Enterprise Resource Planning on AIX (CVE-2019-4473, CVE-2019-11771) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Denial of Service vulnerability in IBM Spectrum Protect Backup-Archive Client (CVE-2019-4406) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-denial-of-service-vulnera… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Spectrum Protect Snapshot on AIX (CVE-2019-4473, CVE-2019-11771) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: SMB signing not required in IBM Spectrum Protect Plus (CVE-2016-2115) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-smb-signing-not-required-… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 22.11.2019
by Daily end-of-shift report 22 Nov '19

22 Nov '19

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 21-11-2019 18:00 − Freitag 22-11-2019 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Securing Portable Electronic Devices During Travel ∗∗∗ --------------------------------------------- Holiday travelers often use portable electronic devices (PEDs) because they offer a range of conveniences, for example, enabling the traveler to order gifts on-the-go, access to online banking, or download boarding passes. However, these devices are vulnerable to cyberattack or theft, resulting in exposure of personal information. --------------------------------------------- https://www.us-cert.gov/ncas/current-activity/2019/11/22/securing-portable-… ∗∗∗ Abusing Web Filters Misconfiguration for Reconnaissance ∗∗∗ --------------------------------------------- Yesterday, an interesting incident was detected while working at a customer SOC. They use a “next-generation” firewall that implements a web filter based on categories. This is common in many organizations today: Users web traffic is allowed/denied based on an URL categorization database (like “adult content”, “hacking”, “gambling”, …). How was it detected? --------------------------------------------- https://isc.sans.edu/diary/rss/25538 ∗∗∗ ENISA: How to implement security by design for IoT ∗∗∗ --------------------------------------------- ENISA, the European Union Agency for Cybersecurity releases ‘Good Practices for Security of IoT’, a significant report to promote security by design for IoT. --------------------------------------------- https://www.enisa.europa.eu/news/enisa-news/how-to-implement-security-by-de… ∗∗∗ A guidebook to open-source OT reconnaissance ∗∗∗ --------------------------------------------- An attacker targeting OT needs to perform reconnaissance on the targeted system and learn how it is connected to the IT network. This often involves old-fashioned or digital espionage, but a lot of such information is actually available out there in the open. ... how open source intelligence (OSINT) can be used to learn crucial details of the inner workings of many a system. An important lesson from Daniels paper and talk is that security by obscurity is dead and ... --------------------------------------------- https://www.virusbulletin.com/blog/2019/11/vb2019-paper-fantastic-informati… ∗∗∗ Introducing Flan Scan: Cloudflare’s Lightweight Network Vulnerability Scanner ∗∗∗ --------------------------------------------- Today, we’re excited to open source Flan Scan, Cloudflare’s in-house lightweight network vulnerability scanner. Flan Scan is a thin wrapper around Nmap that converts this popular open source tool into a vulnerability scanner with the added benefit of easy deployment. --------------------------------------------- https://blog.cloudflare.com/introducing-flan-scan/ ∗∗∗ Ransomware: A free tool can decrypt this malware variant that puts a ransom note on you desktop wallpaper ∗∗∗ --------------------------------------------- Emsisoft, which has build the decryption tool, said that the Hakbit ransomware has hit home users and businesses in the US and Europe, demanding $300 in bitcoin from victims, while warning them how many files they stand to lose. --------------------------------------------- https://www.zdnet.com/article/ransomware-a-free-tool-can-decrypt-this-malwa… ===================== = Vulnerabilities = ===================== ∗∗∗ ClamAV: Schwachstelle ermöglicht Denial of Service ∗∗∗ --------------------------------------------- Ein entfernter, anonymer Angreifer kann eine Schwachstelle in ClamAV ausnutzen, um einen Denial of Service Angriff durchzuführen. --------------------------------------------- https://www.bsi-fuer-buerger.de/SharedDocs/Warnmeldungen/DE/TW/2019/11/warn… ∗∗∗ Nodequeue - Critical - Cross Site Scripting - SA-CONTRIB-2019-085 ∗∗∗ --------------------------------------------- Nodequeues JavaScript can be leveraged to insert HTML from attacker-controlled JSON data. This is exploitable if user-submitted "Filtered HTML" content is displayed on a page where nodequeue.js is loaded. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "manipulate queues". --------------------------------------------- https://www.drupal.org/sa-contrib-2019-085 ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Fedora (dpdk, mingw-djvulibre, mingw-hunspell, mingw-ilmbase, mingw-OpenEXR, php-symfony, php-symfony3, and rsyslog), openSUSE (chromium and squid), SUSE (aspell, cups, djvulibre, and dpdk), and Ubuntu (djvulibre). --------------------------------------------- https://lwn.net/Articles/805367/ ∗∗∗ Asterisk: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Asterisk ausnutzen, um beliebigen Programmcode mit den Rechten des Dienstes auszuführen oder einen Denial of Service Zustand herbeizuführen. --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-1011 ∗∗∗ New bypass disclosed in Microsoft PatchGuard (KPP) ∗∗∗ --------------------------------------------- After GhostHook and InfinityHook, we now have ByePg. No patch out yet. --------------------------------------------- https://www.zdnet.com/article/new-bypass-disclosed-in-microsoft-patchguard-… ∗∗∗ Security Bulletin: Information disclosure vulnerability in IBM Tivoli Netcool Impact (CVE-2019-4570) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-information-disclosure-vu… ∗∗∗ Security Bulletin: Log Analysis is vulnerable to a client side scripting attack due to missing HTTPOnly and Secure attribute in the cookie ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-log-analysis-is-vulnerabl… ∗∗∗ Security Bulletin: Stored cross site scripting vulnerability in IBM Tivoli Netcool Impact (CVE-2019-4569) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-stored-cross-site-scripti… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 21.11.2019
by Daily end-of-shift report 21 Nov '19

21 Nov '19

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 20-11-2019 18:00 − Donnerstag 21-11-2019 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Millions of Sites Exposed by Flaw in Jetpack WordPress Plugin ∗∗∗ --------------------------------------------- Admins and owners of WordPress websites are urged to immediately apply the Jetpack 7.9.1 critical security update to prevent potential attacks that could abuse a vulnerability present since Jetpack 5.1. --------------------------------------------- https://www.bleepingcomputer.com/news/security/millions-of-sites-exposed-by… ∗∗∗ New RIPlace Bypass Evades Windows 10, AV Ransomware Protection ∗∗∗ --------------------------------------------- A new ransomware bypass technique called RIPlace requires only a few lines of code to bypass ransomware protection features built into many security products and Windows 10. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-riplace-bypass-evades-wi… ∗∗∗ Gnip Banking Trojan Shows Ongoing, Aggressive Development ∗∗∗ --------------------------------------------- The mobile malware, which incorporates Anubis source code, could evolve into a fully fledged spyware in the future. --------------------------------------------- https://threatpost.com/gnip-banking-trojan-aggressive-development/150521/ ∗∗∗ Linux Webmin Servers Under Attack by Roboto P2P Botnet ∗∗∗ --------------------------------------------- A newly-discovered peer-to-peer (P2P) botnet has been found targeting a remote code execution vulnerability in Linux Webmin servers. --------------------------------------------- https://threatpost.com/linux-webmin-servers-attack-p2p-botnet/150513/ ∗∗∗ Security baseline (FINAL) for Windows 10 v1909 and Windows Server v1909 ∗∗∗ --------------------------------------------- Microsoft is pleased to announce the final release of the security configuration baseline settings for Windows 10 version 1909 (a.k.a., “19H2”), and for Windows Server version 1909. Note that Windows Server version 1909 is Server Core only and does not offer a Desktop Experience (a.k.a., “full”) server installation option. --------------------------------------------- https://techcommunity.microsoft.com/t5/Microsoft-Security-Baselines/Securit… ∗∗∗ Explained: juice jacking ∗∗∗ --------------------------------------------- Juice jacking is a type of cyberattack that uses a USB charging port to steal data or infect phones with malware. Learn how it works and ways to protect against it. --------------------------------------------- https://blog.malwarebytes.com/explained/2019/11/explained-juice-jacking/ ∗∗∗ Video: Identitätsdiebstahl bei Umfragejob ∗∗∗ --------------------------------------------- Auf diversen Job-Portalen stoßen Sie momentan auf Ausschreibungen zu Umfragejobs. Schon bei der Registrierung verlangt man Ihre Ausweiskopie. Melden Sie sich hier nicht an! Kriminelle stehlen Ihre Daten und tarnen die Eröffnung eines Bankkontos in Ihrem Namen als bezahlte Umfrage. --------------------------------------------- https://www.watchlist-internet.at/news/video-identitaetsdiebstahl-bei-umfra… ∗∗∗ DePriMon downloader uses novel ways to infect your PC with ColoredLambert malware ∗∗∗ --------------------------------------------- It is believed the downloader is using techniques not seen before in the wild. --------------------------------------------- https://www.zdnet.com/article/deprimon-downloader-uses-novel-ways-to-infect… ∗∗∗ New SectopRAT Trojan creates hidden second desktop to control browser sessions ∗∗∗ --------------------------------------------- The Trojan makes sure the second desktop is hidden from sight. --------------------------------------------- https://www.zdnet.com/article/new-sectoprat-malware-creates-hidden-second-d… ===================== = Vulnerabilities = ===================== ∗∗∗ Microsoft Releases Outlook for Android Security Update ∗∗∗ --------------------------------------------- Original release date: November 21, 2019Microsoft has released an update to address a vulnerability in Outlook for Android. An attacker could exploit this vulnerability to take control of an affected system. --------------------------------------------- https://www.us-cert.gov/ncas/current-activity/2019/11/21/microsoft-releases… ∗∗∗ New security release versions of BIND are available: 9.11.13, 9.14.8 and 9.15.6 ∗∗∗ --------------------------------------------- New security releases of BIND are available which contain fixes for the CVEs disclosed today. --------------------------------------------- https://lists.isc.org/pipermail/bind-announce/2019-November/001143.html ∗∗∗ Apache Solr Bug Gets Bumped Up to High Severity ∗∗∗ --------------------------------------------- The vulnerability (CVE-2019-12409) was first reported in July and patched in August. ... Since the bug was initially discovered, researchers have reevaluated the threat and escalated its severity to high-risk. --------------------------------------------- https://threatpost.com/apache-solr-bug-gets-bumped-up-to-high-severity/1504… ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Fedora (oniguruma and thunderbird-enigmail), openSUSE (chromium, ghostscript, and slurm), Oracle (kernel), Red Hat (kpatch-patch), Slackware (bind), SUSE (python-ecdsa), and Ubuntu (bind9 and mariadb). --------------------------------------------- https://lwn.net/Articles/805281/ ∗∗∗ Security Bulletin: Inadequate account lockout in Cloud Pak System (CVE-2019-4096) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-inadequate-account-lockou… ∗∗∗ Security Bulletin: Vulnerabilities in WAS Liberty affect IBM Spectrum LSF Suite, Spectrum LSF Suite for HPA and Spectrum LSF Application Center ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-was-li… ∗∗∗ Security Bulletin: Bypass Client-Side Validation vulnerability in Cloud Pak System (CVE-2019-4240) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-bypass-client-side-valida… ∗∗∗ Security Bulletin: A vulnerability in Apache Solr (lucene) affects IBM Operations Analytics – Log Analysis (CVE-2019-4243) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-apache… ∗∗∗ Security Bulletin: Clickjacking vulnerability in IBM Operations Analytics – Log Analysis (CVE-2019-4215) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-clickjacking-vulnerabilit… ∗∗∗ Security Bulletin: IBM Operations Analytics – Log Analysis is vulnerable to potential Host Header Injection (CVE-2019-4216) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-operations-analytics-… ∗∗∗ Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Tivoil Federated Identity Manager ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: XStream as used by IBM QRadar SIEM is vulnerable to os command injection (CVE-2019-10173) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-xstream-as-used-by-ibm-qr… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Spectrum Protect Operations Center on AIX (CVE-2019-4473, CVE-2019-11771) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ IBM Security Bulletin: A Vulnerability in Apache PDFBox Affects Transformation Extender ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-a-vulnerability-in-ap… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Tivoli Netcool/OMNIbus (CVE-2019-4473, CVE-2019-11771) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM OS Images for Red Hat Linux Systems (July2019 updates) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: IBM Cognos Controller 2019Q4 Security Updater: Multiple Security Vulnerabilities have been identified in IBM Cognos Controller ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cognos-controller-201… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 20.11.2019
by Daily end-of-shift report 20 Nov '19

20 Nov '19

===================== = End-of-Day report = ===================== Timeframe: Dienstag 19-11-2019 18:00 − Mittwoch 20-11-2019 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ NSA Releases Cyber Advisory: Managing Risk from Transport Layer Security Inspection ∗∗∗ --------------------------------------------- The National Security Agency (NSA) has released a Cyber Advisory that addresses managing risk from Transport Layer Security Inspection (TLSI). This short, informative document defines TLSI (a security process that allows incoming traffic to be decrypted, inspected, and re-encrypted), explains some risks and associated challenges, and discusses mitigations. --------------------------------------------- https://www.us-cert.gov/ncas/current-activity/2019/11/19/nsa-releases-cyber… ∗∗∗ D-Link Adds More Buggy Router Models to 'Won’t Fix' List ∗∗∗ --------------------------------------------- D-Link has warned that more of its routers are vulnerable to critical flaws that allow remote hackers to take control of hardware and steal data. The routers won’t be fixed, said D-Link, explaining that the hardware has reached its end-of-life and will no longer receive security updates. ... D-Link identified the additional affected models as: DIR-866, DIR-655, DHP-1565, DIR-652, DAP-1533, DGL-5500, DIR-130, DIR-330, DIR-615, DIR-825, DIR-835, DIR-855L and DIR-862. --------------------------------------------- https://threatpost.com/d-link-wont-fix-router-bugs/150438/ ∗∗∗ Monero Project site compromised, served malware-infected binaries ∗∗∗ --------------------------------------------- The official website of the Monero Project has been compromised to serve a malware-infected version of the CLI (command-line interface) wallet. The malicious file was available for download for around 14 hours and at least one of the users who downloaded the malware has had their funds stolen. What happened? --------------------------------------------- https://www.helpnetsecurity.com/2019/11/20/monero-project-compromised/ ===================== = Vulnerabilities = ===================== ∗∗∗ Google and Samsung Fix Android Spying Flaw. Other Makers May Still Be Vulnerable ∗∗∗ --------------------------------------------- Until recently, weaknesses in Android camera apps from Google and Samsung made it possible for rogue apps to record video and audio and take images and then upload them to an attacker-controlled server -- without any permissions to do so. Camera apps from other manufacturers may still be susceptible. --------------------------------------------- https://tech.slashdot.org/story/19/11/19/1737219/google-and-samsung-fix-and… ∗∗∗ Administration Views - Moderately critical - Access bypass - SA-CONTRIB-2019-076 ∗∗∗ --------------------------------------------- This module replaces administrative overview/listing pages with actual views for superior usability.The module doesnt sufficiently check user access when using the "Menu system path" access handler on a Views displays other than "System". --------------------------------------------- https://www.drupal.org/sa-contrib-2019-076 ∗∗∗ Unbound: Vulnerability in IPSEC module ∗∗∗ --------------------------------------------- Due to unsanitized characters passed to the ipsecmod-hook shell command, it is possible for Unbound to allow shell code execution from a specially crafted IPSECKEY answer. (CVE-2019-18934) --------------------------------------------- https://nlnetlabs.nl/projects/unbound/security-advisories/ ∗∗∗ Flexera FlexNet Publisher ∗∗∗ --------------------------------------------- These vulnerabilities could allow an attacker to deny the acquisition of a valid license for legal use of the product. The memory corruption vulnerability could allow remote code execution. (CVE-2018-20033, CVSS v3 9.8) --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-19-323-01 ∗∗∗ High Severity Vulnerability Patched in WP Maintenance Plugin ∗∗∗ --------------------------------------------- This flaw allowed attackers to enable a vulnerable site’s maintenance mode and inject malicious code affecting site visitors. We disclosed this issue privately to the plugin’s developer who released a patch the next day. Plugin versions of WP Maintenance up to 5.0.5 are vulnerable to attacks against this flaw. All WP Maintenance users should update to version 5.0.6 immediately. --------------------------------------------- https://www.wordfence.com/blog/2019/11/high-severity-vulnerability-patched-… ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (redmine), Fedora (libidn2), Mageia (clamav, ghostscript, kernel, kernel-linus, libexif, libjpeg, mariadb, microcode, and systemd), and openSUSE (libjpeg-turbo). --------------------------------------------- https://lwn.net/Articles/805224/ ∗∗∗ Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco Unified Communications Manager SQL Injection Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco Webex Teams for Windows DLL Hijacking Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco WebEx Centers Username Enumeration Information Disclosure Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco SD-WAN Solution vManage Cross-Site Request Forgery Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco Unity Express Command Injection Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco Unified Communications Domain Manager Persistent Cross-Site Scripting Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco Stealthwatch Enterprise Cross-Site Scripting Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco Small Business Routers RV016, RV042, RV042G, and RV082 Information Disclosure Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco IOS XR Software NETCONF Over Secure Shell ACL Bypass Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco Email Security Appliance URL Filtering Bypass Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco Email Security Appliance MP3 Content Filter Bypass Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco DNA Spaces: Connector SQL Injection Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco DNA Spaces: Connector Privilege Escalation Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco DNA Spaces: Connector Command Injection Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Security Advisory - Use of Insufficiently Random Values Vulnerability in Huawei ViewPoint Products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191120-… ∗∗∗ Security Advisory - Two Vulnerabilities in Some Huawei Home Routers ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191113-… ∗∗∗ Security Advisory - Improper Validation of Array Index Vulnerability in Several Smartphones ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191120-… ∗∗∗ Security Bulletin: IBM Maximo Asset Management is vulnerable to Privilege Escalation (CVE-2019-4530) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-maximo-asset-manageme… ∗∗∗ Security Bulletin: A security vulnerability has been fixed in the IBM Security Identity Manager product (CVE-2019-4561) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: Vulnerabilities in WAS Liberty affect IBM Spectrum LSF Suite, Spectrum LSF Suite for HPA and Spectrum LSF Application Center ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-was-li… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 19.11.2019
by Daily end-of-shift report 19 Nov '19

19 Nov '19

===================== = End-of-Day report = ===================== Timeframe: Montag 18-11-2019 18:00 − Dienstag 19-11-2019 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Linux, Windows Users Targeted With New ACBackdoor Malware ∗∗∗ --------------------------------------------- Researchers have discovered a new multi-platform backdoor that infects Windows and Linux systems allowing the attackers to run malicious code and binaries on the compromised machines. --------------------------------------------- https://www.bleepingcomputer.com/news/security/linux-windows-users-targeted… ∗∗∗ Buran Ransomware Infects PCs via Microsoft Excel Web Queries ∗∗∗ --------------------------------------------- A new spam campaign has been spotted distributing the Buran Ransomware through IQY file attachments. When opened, these Microsoft Excel Web Query attachments will execute a remote command that installs the ransomware onto a victims computer. --------------------------------------------- https://www.bleepingcomputer.com/news/security/buran-ransomware-infects-pcs… ∗∗∗ Coin Stealer Found in Monero Linux Binaries From Official Site ∗∗∗ --------------------------------------------- The Monero Project is currently investigating a potential compromise of the official website after a coin stealer was found in the Linux 64-bit command line (CLI) Monero binaries downloaded from the download page. --------------------------------------------- https://www.bleepingcomputer.com/news/security/coin-stealer-found-in-monero… ∗∗∗ Elasticsearch: Datenleak bei Conrad ∗∗∗ --------------------------------------------- Der Elektronikhändler Conrad meldet, dass ein Angreifer Zugang zu Kundendaten und Kontonummern gehabt habe. Grund dafür war eine ungesicherte Elasticsearch-Datenbank. --------------------------------------------- https://www.golem.de/news/elasticsearch-datenleak-bei-conrad-1911-145091-rs… ∗∗∗ Windows Debugging & Exploiting Part 2 - WinDBG 101 ∗∗∗ --------------------------------------------- Hello again! After our previous post about the environment setup, now it is time to cover the main tool of this project, the WinDBG. --------------------------------------------- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/windows-deb… ∗∗∗ When Bank Communication is Indistinguishable from Phishing Attacks ∗∗∗ --------------------------------------------- You know how banks really, really want to avoid their customers falling victim to phishing scams? And how they put a heap of effort into education to warn folks about the hallmarks of phishing scams? And how banks are the shining beacons of light when it comes to demonstrating security [...] --------------------------------------------- https://www.troyhunt.com/when-bank-communication-is-indistinguishable-from-… ∗∗∗ Vulnerability in ABB Plant Historian Disclosed 5 Years After Discovery ∗∗∗ --------------------------------------------- It took Swiss-based industrial technology solutions provider ABB five years to inform customers of a critical vulnerability affecting one of its products, and the researcher who found it says this increased the chances of threat actors discovering and exploiting the security flaw. --------------------------------------------- https://www.securityweek.com/vulnerability-abb-plant-historian-disclosed-5-… ∗∗∗ Vorsicht bei angeblichen Gewinnspielen von Magenta, A1, Drei oder Liwest ∗∗∗ --------------------------------------------- Aktuell verbreiten Kriminelle über unterschiedliche Kanäle Fake-Gewinnspiele. Sie werden entweder per E-Mail, SMS oder mittels Pop-Up im Browser benachrichtigt, dass Sie angeblich ein Smartphone gewonnen haben. Um den Gewinn zu erhalten, muss nur eine kurze Umfrage beantwortet und ein kleiner Geldbetrag für den Versand bezahlt werden. Vorsicht: Es handelt sich um eine Abo-Falle. --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-bei-angeblichen-gewinnspiel… ===================== = Vulnerabilities = ===================== ∗∗∗ Schwere Sicherheitslücke in WhatsApp entdeckt ∗∗∗ --------------------------------------------- In WhatsApp wurde eine Schwachstelle gefunden, die es Angreifern ermöglicht, Dateien zu stehlen und Nachrichten auszulesen. --------------------------------------------- https://futurezone.at/apps/schwere-sicherheitsluecke-in-whatsapp-entdeckt/4… ∗∗∗ Lernplattform Moodle: Entwickler schließen kritische Schwachstellen ∗∗∗ --------------------------------------------- Moodle-Admins aufgepasst: Neue Versionen schließen mehrere, teils als "Serious" bewertete Lücken. --------------------------------------------- https://heise.de/-4591094 ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (python-psutil, slurm-llnl, symfony, and thunderbird), Fedora (gd and ghostscript), and SUSE (ceph, haproxy, java-11-openjdk, and ncurses). --------------------------------------------- https://lwn.net/Articles/805149/ ∗∗∗ Lexmark Services Monitor 2.27.4.0.39 Directory Traversal ∗∗∗ --------------------------------------------- https://cxsecurity.com/issue/WLB-2019110124 ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Performance Management products ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Vulnerabilities in Curl affect PowerSC (CVE-2019-5435, CVE-2019-5436) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-curl-a… ∗∗∗ HPESBHF03963 rev.1 - Certain HPE ProLiant Servers with Intel CSME, AMT, SPS, TXE, ∗∗∗ --------------------------------------------- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_n… ∗∗∗ HPESBHF03968 rev.1 - HPE Gen10 ProLiant, Apollo, and Synergy Servers using Intel CPU Transactional Synchronization Extensions (TSX) Asynchronous Abort (TAA), Local Disclosure of Information ∗∗∗ --------------------------------------------- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_n… ∗∗∗ HPESBHF03969 rev.1 - HPE ProLiant Gen10 Servers using certain Intel Xeon Scalable Processors, Voltage Modulation, Local Denial of Service ∗∗∗ --------------------------------------------- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_n… ∗∗∗ HPESBHF03971 rev.1 - HPE Servers using certain Intel Processors, SMM and TXT, Local Escalation of Privilege ∗∗∗ --------------------------------------------- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_n… ∗∗∗ HPESBST03964 rev.1 - HPE Nimble Storage, Multiple Remote Vulnerabilities ∗∗∗ --------------------------------------------- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_n… ∗∗∗ Google Chrome: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-0998 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 18.11.2019
by Daily end-of-shift report 18 Nov '19

18 Nov '19

===================== = End-of-Day report = ===================== Timeframe: Freitag 15-11-2019 18:00 − Montag 18-11-2019 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ New NextCry Ransomware Encrypts Data on NextCloud Linux Servers ∗∗∗ --------------------------------------------- On October 24, Nextcloud released an urgent alert about a remote code execution vulnerability that impacts the default Nextcloud NGINX configuration. Tracked as CVE-2019-11043, the flaw is in the PHP-FPM (FastCGI Process Manager) component, included by some hosting providers like Nextcloud in their default setup. A public exploit exists and has been leveraged to compromised servers. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-nextcry-ransomware-encry… ∗∗∗ Powershell ConstrainedLanguage Mode ∗∗∗ --------------------------------------------- Gastbeitrag vom milCERT - Philipp Thaller und Stefan Bachmair - Bei der Analyse von aktueller Malware stellte sich heraus dass viele der aktuellen Exemplare (inkl. Emotet ) auf die PowerShell angewiesen sind um ihr schadhaftes Potential entfalten zu können. Schränkt man die PowerShell entsprechend ein, ist eine Ausführung des eigentlichen Schadcodes oft gar nicht möglich. --------------------------------------------- https://cert.at/de/blog/2019/11/201911-powershell-constrainedlanguage ∗∗∗ Willhaben warnt vor betrügerischer Phishing-SMS ∗∗∗ --------------------------------------------- Wer von der Verkaufsplattform Willhaben eine SMS mit Zahlungsinformationen bekommt, soll den Link keinesfalls anklicken. --------------------------------------------- https://futurezone.at/apps/willhaben-warnt-vor-betruegerischer-phishing-sms… ∗∗∗ pax: Exploit padding oracles for fun and profit ∗∗∗ --------------------------------------------- Pax (PAdding oracle eXploiter) is a tool for exploiting padding oracles in order to: - Obtain plaintext for a given piece of CBC encrypted data. - Obtain encrypted bytes for a given piece of plaintext, using the unknown encryption algorithm used by the oracle. --------------------------------------------- https://github.com/liamg/pax ∗∗∗ RdpThief: Extracting Clear-text Credentials from Remote Desktop Clients ∗∗∗ --------------------------------------------- In this blogpost I will describe the process I followed to write a tool that will extract clear-text credentials from the Microsoft RDP client using API hooking. Using this approach, if you are already operating under the privileges of the compromised user (e.g. as a result of a phish) and the user has an RDP session open, you are able to extract the clear-text credentials without privilege escalation. --------------------------------------------- https://www.mdsec.co.uk/2019/11/rdpthief-extracting-clear-text-credentials-… ∗∗∗ Medica 2019: BSI-Leitfaden zur Cyber-Sicherheit von Medizinprodukten ∗∗∗ --------------------------------------------- Im Kontext der sicheren Digitalisierung im Gesundheitswesen hat das Bundesamt für Sicherheit in der Informationstechnik (BSI) im Rahmen der Messe "Medica" in Düsseldorf einen neuen Leitfaden "Sicherheit von Medizinprodukten – Leitfaden zur Nutzung des MDS2 aus 2019" (Manufacturer Disclosure Statement for Medical Device Security) veröffentlicht. --------------------------------------------- https://www.bsi.bund.de/DE/Presse/Pressemitteilungen/Presse2019/Leitfaden_M… ∗∗∗ Google patches ‘awesome’ XSS vulnerability in Gmail dynamic email feature ∗∗∗ --------------------------------------------- The bug bounty hunter who disclosed the issue says the bug is a prime example of DOM Clobbering. --------------------------------------------- https://www.zdnet.com/article/google-patches-awesome-xss-vulnerability-in-g… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (angular.js, libapache2-mod-auth-openidc, mosquitto, postgresql-common, and thunderbird), Fedora (chromium, djvulibre, freetds, ghostscript, java-1.8.0-openjdk-aarch32, samba, thunderbird-enigmail, wpa_supplicant, and xen), openSUSE (go1.12, ImageMagick, and ucode-intel), Oracle (ghostscript and kernel), Red Hat (libcomps and sudo), Slackware (kernel), SUSE (microcode_ctl, slurm, and ucode-intel), and Ubuntu (mysql-5.7, mysql-8.0 and python-ecdsa). --------------------------------------------- https://lwn.net/Articles/805083/ ∗∗∗ Security Bulletin: Denial of Service vulnerability in WebSphere Application Server Liberty affects IBM Spectrum Protect Operations Center (CVE-2019-4096) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-denial-of-service-vulnera… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 15.11.2019
by Daily end-of-shift report 15 Nov '19

15 Nov '19

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 14-11-2019 18:00 − Freitag 15-11-2019 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ How the Linux kernel balances the risks of public bug disclosure ∗∗∗ --------------------------------------------- A serious Wi-Fi flaw shows how Linux handles security in plain sight. --------------------------------------------- https://nakedsecurity.sophos.com/2019/11/15/how-the-linux-kernel-balances-t… ∗∗∗ A Tale of Rootkits and Other Backdoors ∗∗∗ --------------------------------------------- In this post, we will focus on software backdoors commonly seen in Linux environments, we will attempt to outline some representative examples, and we will discuss common techniques backdoor authors use to hide their malicious payloads. --------------------------------------------- https://capsule8.com/blog/dont-get-kicked-out-a-tale-of-rootkits-and-other-… ===================== = Vulnerabilities = ===================== ∗∗∗ Security Advisory 2019-15: Security Update for OTRS Framework ∗∗∗ --------------------------------------------- OTRS can be put into an endless loop by providing filenames with overly long extensions. This applies to the PostMaster (sending in email) and also upload (attaching files to mails, for example). --------------------------------------------- https://community.otrs.com/security-advisory-2019-15-security-update-for-ot… ∗∗∗ Security Advisory 2019-14: Security Update for OTRS Framework ∗∗∗ --------------------------------------------- An attacker who is logged into OTRS as an agent is able to list tickets assigned to other agents, which are in the queue where attacker doesn’t have permissions. --------------------------------------------- https://community.otrs.com/security-advisory-2019-14-security-update-for-ot… ∗∗∗ A heap overflow vulnerability has been found in wolfssl ∗∗∗ --------------------------------------------- Wolfssl is an TLS library mostly used in embedded Linux devices. It is also used in the popular tool curl. ... The vulnerability has been given the CVE of CVE-2019–18840. --------------------------------------------- https://medium.com/@social_62682/heap-overflow-in-wolfssl-cve-2019-18840-18… ∗∗∗ Lücke in älteren WhatsApp-Versionen erlaubte Codeausführung aus der Ferne ∗∗∗ --------------------------------------------- Facebook weist auf eine Lücke in dem Messenger WhatsApp hin. Viele Geräte sollten dank automatischer Updates bereits seit einiger Zeit geschützt sein. --------------------------------------------- https://heise.de/-4587119 ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by CentOS (kernel), Debian (ghostscript, mesa, and postgresql-common), Fedora (chromium, php-robrichards-xmlseclibs, php-robrichards-xmlseclibs3, samba, scap-security-guide, and wpa_supplicant), Mageia (cpio, fribidi, libapreq2, python-numpy, webkit2, and zeromq), openSUSE (ImageMagick, kernel, libtomcrypt, qemu, ucode-intel, and xen), Oracle (kernel), Red Hat (ghostscript, kernel, and kernel-rt), Scientific Linux (ghostscript and kernel), SUSE (bash, enigmail, ghostscript, kernel, libjpeg-turbo, openconnect, squid), Ubuntu (ghostscript, imagemagick, postgresql-common). --------------------------------------------- https://lwn.net/Articles/804904/ ∗∗∗ Philips IntelliBridge EC40/80 ∗∗∗ --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsma-19-318-01 ∗∗∗ Omron CX-Supervisor ∗∗∗ --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-19-318-04 ∗∗∗ ABB Power Generation Information Manager (PGIM) and Plant Connect ∗∗∗ --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-19-318-05 ∗∗∗ Security Bulletin: CSV Injection (CVE-2019-4490) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-csv-injection-cve-2019-44… ∗∗∗ Security Bulletin: Multiple vulnerabilities in jackson-databind affect IBM Platform Symphony and IBM Spectrum Symphony ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Security vulnerabilities affect IBM Cloud Object Storage SDK Java (November 2019 Bulletin) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-security-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Performance Management products ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: IBM OS Images for RedHat Enterprise System is vulnerable to Intel Microarchitectural Data Sampling (MDS) Vulnerabilites (CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-os-images-for-redhat-… ∗∗∗ Security Bulletin: OpenSSL vulnerabilites impacting IBM Aspera Connect 3.7.4 and earlier (CVE-2017-3732, CVE-2016-7055) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-openssl-vulnerabilites-im… ∗∗∗ Security Bulletin: Apache Commons Collections library in WebSphere Application Server Knowledge Center is vulnerable (CVE-2015-7450) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-apache-commons-collection… ∗∗∗ iControl REST logs a plaintext password when the syntax of a cURL request is incorrect ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K61105950 ∗∗∗ BIG-IP / BIG-IQ / Enterprise Manager / F5 iWorkflow Configuration utility vulnerability CVE-2019-6663 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K76052144 ∗∗∗ TMM vulnerability CVE-2019-6660 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K23860356 ∗∗∗ TLS 1.3 vulnerability CVE-2019-6659 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K34450231 ∗∗∗ BIG-IP restjavad vulnerability CVE-2019-6662 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K01049383 ∗∗∗ TMOS vulnerability CVE-2019-6664 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K03126093 ∗∗∗ BIG-IP APM apd vulnerability CVE-2019-6661 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K61705126 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 14.11.2019
by Daily end-of-shift report 14 Nov '19

14 Nov '19

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 13-11-2019 18:00 − Donnerstag 14-11-2019 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Researchers Find Bug in Qualcomm Code for Trusted App ∗∗∗ --------------------------------------------- Researchers stressing the code related to Qualcomms implementation of the secure execution area on mobile devices found a new vulnerability that could allow access to critical data. --------------------------------------------- https://www.bleepingcomputer.com/news/security/researchers-find-bug-in-qual… ∗∗∗ NCSC-NZ Cyber threat report for 2018/19 released ∗∗∗ --------------------------------------------- The National Cyber Security Centre, (NCSC) has released its Cyber Threat Report for the 2018/19 reporting year. --------------------------------------------- https://www.ncsc.govt.nz/newsroom/cyber-threat-report-for-201819-released/ ∗∗∗ Windows & Linux get options to disable Intel TSX to prevent Zombieload v2 attacks ∗∗∗ --------------------------------------------- Disclosure of new Zombieload v2 vulnerability prompts OS makers to react with ways to disable Intels TSX technology. --------------------------------------------- https://www.zdnet.com/article/windows-linux-get-options-to-disable-intel-ts… ===================== = Vulnerabilities = ===================== ∗∗∗ Symantec Fixes Privilege Escalation Flaw in Endpoint Protection ∗∗∗ --------------------------------------------- Symantec fixed a local privilege escalation security flaw affecting all Symantec Endpoint Protection software versions prior to 14.2 RU2, and allowing attackers to escalate privileges on compromised devices and execute malicious code using SYSTEM privileges. --------------------------------------------- https://www.bleepingcomputer.com/news/security/symantec-fixes-privilege-esc… ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (kernel, linux-lts, and linux-zen), CentOS (kernel, sudo, and thunderbird), Debian (linux-4.9), Fedora (samba), openSUSE (apache2-mod_auth_openidc, kernel, qemu, rsyslog, and ucode-intel), Oracle (kernel), Red Hat (kernel and kernel-rt), Scientific Linux (kernel), SUSE (kernel and microcode_ctl), and Ubuntu (kernel, libjpeg-turbo, linux, linux-hwe, linux-oem, linux, linux-hwe, linux-oem-osp1, and qemu). --------------------------------------------- https://lwn.net/Articles/804775/ ∗∗∗ Movable Type vulnerable to open redirect ∗∗∗ --------------------------------------------- https://jvn.jp/en/jp/JVN65280626/ ∗∗∗ Security Bulletin: IBM Security Guardium is affected by an OpenSSL vulnerability ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by an Oracle MySQL vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by an OpenSSL vulnerability ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli Netcool Impact ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ bzip2 vulnerability CVE-2019-12900 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K68713584 ∗∗∗ lodash library vulnerability CVE-2019-10744 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K47105354 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 13.11.2019
by Daily end-of-shift report 13 Nov '19

13 Nov '19

===================== = End-of-Day report = ===================== Timeframe: Dienstag 12-11-2019 18:00 − Mittwoch 13-11-2019 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Network Traffic Analysis for IR: Address Resolution Protocol (ARP) with Wireshark ∗∗∗ --------------------------------------------- Introduction to the Address Resolution Protocol The Address Resolution Protocol (ARP) was first defined in RFC 826. As the name suggests, it is designed to resolve IP addresses into a form usable by other systems within a subnet. Network addressing works at a couple of different layers of the OSI model. --------------------------------------------- https://resources.infosecinstitute.com/address-resolution-protocol-arp-with… ∗∗∗ Schlüssel aus TPM-Chips lassen sich extrahieren ∗∗∗ --------------------------------------------- Mit einem Timing-Angriff lassen sich Signaturschlüssel auf Basis elliptischer Kurven aus TPM-Chips extrahieren. ... TPM-Chips sind in allen modernen PCs vorhanden und teilweise umstritten, da sie auch dazu genutzt werden können, Schutzmechanismen gegen den Willen des Nutzers umzusetzen. Trotz ihrer Verbreitung werden die Chips eher selten für kritische Applikationen genutzt, die Auswirkungen der Lücke dürften sich in Grenzen halten. --------------------------------------------- https://www.golem.de/news/tpm-fail-schluessel-aus-tpm-chips-lassen-sich-ext… ∗∗∗ GSM Traffic and Encryption: A5/1 Stream Cipher ∗∗∗ --------------------------------------------- This write-up documents some of my follow-up research with regard to analyzing the GSM traffic packets I captured using Software Defined Radio. My attempt was to better understand the GSM mobile network protocols and procedures, with an emphasis on the authentication and ciphering algorithms being deployed. --------------------------------------------- https://www.blackhillsinfosec.com/gsm-traffic-and-encryption-a5-1-stream-ci… ∗∗∗ Angriffe über USB und Bluetooth: Android-Smartphones verwundbar ∗∗∗ --------------------------------------------- Sicherheitsforscher haben Schwachstellen in mehreren älteren Android-Smartphones entdeckt, die sie über USB- und Bluetooth-Verbindungen ausnutzen konnten. --------------------------------------------- https://heise.de/-4584690 ∗∗∗ Seriöses Job-Angebot oder Auftrag zur Geldwäsche? ∗∗∗ --------------------------------------------- Auf diversen Job-Börsen und Kleinanzeigenportalen stoßen Arbeitssuchende momentan auf Angebote zur freien Mitarbeit der „TideBit Deutschland LTD“. Die Firma existiert in dieser Form nicht. Kriminelle missbrauchen den Namen eines Kryptowährungsunternehmens, um BewerberInnen zur Geldwäsche zu bringen. Wer die Aufgaben erfüllt, macht sich womöglich selbst strafbar. --------------------------------------------- https://www.watchlist-internet.at/news/serioeses-job-angebot-oder-auftrag-z… ===================== = Vulnerabilities = ===================== ∗∗∗ November 2019 security updates are available! ∗∗∗ --------------------------------------------- We have released the November security updates to provide additional protections against malicious attackers. As a best practice, we encourage customers to turn on automatic updates. More information about this month’s security updates can be found in the Security Update Guide. As a reminder, Windows 7 and Windows Server 2008 R2 will be out of extended support and no longer receiving updates as of January 14, 2020. --------------------------------------------- https://msrc-blog.microsoft.com:443/2019/11/12/november-2019-security-updat… ∗∗∗ Intel fixt Sicherheitslücken und enthüllt nebenbei eine neue ZombieLoad-Variante ∗∗∗ --------------------------------------------- Zum Patch Tuesday hat Intel 77 teils kritische Lücken gefixt, unter denen sich auch ein bislang geheim gehaltener Seitenkanalangriff befand. --------------------------------------------- https://heise.de/-4584543 ∗∗∗ VMSA-2019-0020 ∗∗∗ --------------------------------------------- VMware ESXi, Workstation, and Fusion patches provide Hypervisor-Specific Mitigations for Speculative-Execution Vulnerabilities (CVE-2018-12207, CVE-2019-11135) --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2019-0020.html ∗∗∗ VMSA-2019-0021 ∗∗∗ --------------------------------------------- VMware Workstation and Fusion updates address multiple security vulnerabilities (CVE-2019-5540, CVE-2019-5541, CVE-2019-5542) --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2019-0021.html ∗∗∗ VMSA-2019-0008.2 ∗∗∗ --------------------------------------------- VMware product updates enable Hypervisor-Specific Mitigations, Hypervisor-Assisted Guest Mitigations, and Operating System-Specific Mitigations for Microarchitectural Data Sampling (MDS) Vulnerabilities (CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, and CVE-2019-11091) --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2019-0008.html ∗∗∗ Xen Security Advisory CVE-2019-11135 / XSA-305 ∗∗∗ --------------------------------------------- A new way to sample data from microarchitectural structures has been identified. A TSX Asynchronous Abort is a state which occurs between a transaction definitely aborting (usually for reasons outside of the pipeline's control e.g. receiving an interrupt), and architectural state being rolled back to start of the transaction. During this period, speculative execution may be able to infer the value of data in the microarchitectural structures. --------------------------------------------- https://xenbits.xen.org/xsa/advisory-305.html ∗∗∗ Xen Security Advisory CVE-2018-12207 / XSA-304 ∗∗∗ --------------------------------------------- An erratum exists across some CPUs whereby an instruction fetch may cause a machine check error if the pagetables have been updated in a specific manner without invalidating the TLB. ... This corner case can be triggered by guest kernels. --------------------------------------------- https://xenbits.xen.org/xsa/advisory-304.html ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (dpdk, intel-microcode, kernel, libssh2, qemu, and webkit2gtk), Fedora (apache-commons-beanutils, bluez, iwd, kernel, kernel-headers, kernel-tools, libell, and microcode_ctl), openSUSE (gdb), Oracle (kernel), Red Hat (kernel and kernel-rt), SUSE (dhcp, evolution, kernel, libcaca, python, python-xdg, qemu, sysstat, ucode-intel, and xen), and Ubuntu (dpdk, intel-microcode, kernel, linux, linux-aws, ..., webkit2gtk) --------------------------------------------- https://lwn.net/Articles/804641/ ∗∗∗ Citrix Hypervisor Security Update ∗∗∗ --------------------------------------------- CTX263684 - A security issue has been identified in certain CPU hardware that may allow unprivileged code running on a CPU core to infer the value of memory data belonging to other processes, virtual machines or the hypervisor that are, or have recently been, running on the same CPU core. --------------------------------------------- https://support.citrix.com/article/CTX263684 ∗∗∗ Citrix ADC and Citrix Gateway Security Update (CVE-2019-0140) ∗∗∗ --------------------------------------------- CTX263807 - A vulnerability has been identified affecting Citrix Application Delivery Controller (ADC) formerly known as NetScaler ADC, and Citrix Gateway, formerly known as NetScaler Gateway, platforms which could result in privilege escalation via layer 2 network access on all network interfaces. --------------------------------------------- https://support.citrix.com/article/CTX263807 ∗∗∗ Cisco Prime Infrastructure and Evolved Programmable Network Manager Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco Identity Services Engine Cross-Site Scripting Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Security Advisory - Two Vulnerabilities in Some Huawei Products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191113-… ∗∗∗ Security Advisory - Improper File Management Vulnerability in Huawei Share ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191113-… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by kernel vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Security Bulletin: IBM NeXtScale Fan Power Controller (FPC) is affected by vulnerability in OpenSSL (CVE-2019-1559) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-nextscale-fan-power-c… ∗∗∗ libpcap vulnerability CVE-2019-15163 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K92862401?utm_source=f5support&utm_mediu… ∗∗∗ Hotfix XS80E008 - For Citrix Hypervisor 8.0 ∗∗∗ --------------------------------------------- https://support.citrix.com/article/CTX263663 ∗∗∗ Hotfix XS76E012 - For XenServer 7.6 ∗∗∗ --------------------------------------------- https://support.citrix.com/article/CTX263662 ∗∗∗ Hotfix XS71ECU2024 - For XenServer 7.1 Cumulative Update 2 ∗∗∗ --------------------------------------------- https://support.citrix.com/article/CTX263661 ∗∗∗ Hotfix XS70E075 - For XenServer 7.0 ∗∗∗ --------------------------------------------- https://support.citrix.com/article/CTX263660 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 12.11.2019
by Daily end-of-shift report 12 Nov '19

12 Nov '19

===================== = End-of-Day report = ===================== Timeframe: Montag 11-11-2019 18:00 − Dienstag 12-11-2019 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Threat Alert: TCP Amplification Attacks ∗∗∗ --------------------------------------------- TCP reflection attacks, such as SYN-ACK reflection attacks, have been less popular among attackers until recently. The lack of popularity was mainly due to the wrong assumption that TCP reflection attacks cannot generate enough amplification compared to UDP-based reflections. In general, TCP attacks are low bandwidth and less likely to saturate an internet link. --------------------------------------------- https://blog.radware.com/security/2019/11/threat-alert-tcp-reflection-attac… ∗∗∗ Tech Support Scammers Exploiting Unpatched Firefox Bug ∗∗∗ --------------------------------------------- Mozilla is working on addressing a Firefox bug that has been exploited by tech support scammers to lock the browser when users visit specially crafted websites. --------------------------------------------- https://www.securityweek.com/tech-support-scammers-exploiting-unpatched-fir… ∗∗∗ Netflix: Vorsicht vor betrügerischen Phishing-Mails ∗∗∗ --------------------------------------------- Aktuell häufen sich Meldungen über betrügerische E-Mails, die angeblich von Netflix stammen. Es sei ein Problem mit der Zahlungsabwicklung aufgetreten, sodass Netflix die Nutzungsgebühr nicht abbuchen kann und daher den Account vorübergehend gesperrt hat. Kriminelle fordern Netflix-NutzerInnen auf, die Kontoinformationen zu aktualisieren. Es handelt sich jedoch um Phishing! --------------------------------------------- https://www.watchlist-internet.at/news/netflix-vorsicht-vor-betruegerischen… ∗∗∗ This unusual new ransomware is going after servers ∗∗∗ --------------------------------------------- The previously undetected server-encrypting malware has been detailed in research by cyber security analysts at Intezer and IBM X-Force, who've named it PureLocker because it's written in written in the PureBasic programming language. ... It's currently uncertain how exactly PureLocker is delivered to victims, but researchers note that more_eggs campaigns begin with phishing emails, so the ransomware attacks could begin in the same way, with the final payload likely to be the final part of a multi-staged attack. --------------------------------------------- https://www.zdnet.com/article/this-unusual-new-ransomware-is-going-after-se… ===================== = Vulnerabilities = ===================== ∗∗∗ McAfee Patches Privilege Escalation Flaw in Antivirus Software ∗∗∗ --------------------------------------------- McAfee patched a security vulnerability discovered in all editions of its Antivirus software for Windows and enabling potential attackers to escalate privileges and execute code using SYSTEM privileges. --------------------------------------------- https://www.bleepingcomputer.com/news/security/mcafee-patches-privilege-esc… ∗∗∗ Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- A vulnerability in the implementation of the Lua interpreter integrated in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code with root privileges on the underlying Linux operating system of an affected device. --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Adobe Security Bulletins ∗∗∗ --------------------------------------------- Adobe has published security bulletins for Adobe Animate CC (APSB19-34), Adobe Illustrator CC (APSB19-36), Adobe Media Encoder (APSB19-52) and Adobe Bridge CC (APSB19-53). --------------------------------------------- https://blogs.adobe.com/psirt/?p=1801 ∗∗∗ Sicherheitsupdate: Magento-Onlineshops von Schadcode-Attacken gefährdet ∗∗∗ --------------------------------------------- Wer einen Onlineshop mit Magento-Software betreibt, sollte aus Sicherheitsgründen zügig die aktuelle Version installieren. --------------------------------------------- https://heise.de/-4584383 ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Fedora (community-mysql, crun, java-latest-openjdk, and mupdf), openSUSE (libssh2_org), and SUSE (go1.12, libseccomp, and tar). --------------------------------------------- https://lwn.net/Articles/804412/ ∗∗∗ Synology-SA-19:38 Synology Assistant ∗∗∗ --------------------------------------------- A vulnerability allows remote attackers to conduct denial-of-service attacks via a susceptible version of Synology Assistant. --------------------------------------------- https://www.synology.com/en-global/support/security/Synology_SA_19_38 ∗∗∗ SAP Security Patch Day – November 2019 ∗∗∗ --------------------------------------------- On 12th of November 2019, SAP Security Patch Day saw the release of 12 Security Notes. There are 3 updates to previously released Patch Day Security Notes. --------------------------------------------- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528880390 ∗∗∗ Security Bulletin: IBM Tivoli Netcool Impact is affected by an Apache ActiveMQ vulnerability (CVE-2018-11775) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-tivoli-netcool-impact… ∗∗∗ Security Bulletin: Incorrect permissions on restored files and directories on Windows using IBM Spectrum Protect Plus (CVE-2019-4652) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-incorrect-permissions-on-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in Java affect IBM Spectrum Protect Plus ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: IBM Tivoli Netcool Impact Configuration and Deployment Management Clickjacking ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-tivoli-netcool-impact… ∗∗∗ Security Bulletin: IBM Tivoli Netcool Impact is affected by a jQuery vulnerability (CVE-2015-9251) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-tivoli-netcool-impact… ∗∗∗ Security Bulletin: IBM Tivoli Netcool Impact is affected by a jQuery vulnerability (CVE-2019-11358) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-tivoli-netcool-impact… ∗∗∗ SSA-686531 (Last Update: 2019-11-12): Hardware based manufacturing access on S7-1200 ∗∗∗ --------------------------------------------- https://cert-portal.siemens.com/productcert/pdf/ssa-686531.pdf ∗∗∗ SSA-616472 (Last Update: 2019-11-12): ZombieLoad and Microarchitectural Data Sampling Vulnerabilities in Industrial Products ∗∗∗ --------------------------------------------- https://cert-portal.siemens.com/productcert/pdf/ssa-616472.pdf ∗∗∗ SSA-898181 (Last Update: 2019-11-12): Desigo PX Web Remote Denial of Service Vulnerability ∗∗∗ --------------------------------------------- https://cert-portal.siemens.com/productcert/pdf/ssa-898181.pdf ∗∗∗ SSA-434032 (Last Update: 2019-11-12): Vulnerability in Mentor Nucleus Networking Module ∗∗∗ --------------------------------------------- https://cert-portal.siemens.com/productcert/pdf/ssa-434032.pdf ∗∗∗ Multiple tcpdump vulnerabilities ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K44551633 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 11.11.2019
by Daily end-of-shift report 11 Nov '19

11 Nov '19

===================== = End-of-Day report = ===================== Timeframe: Freitag 08-11-2019 18:00 − Montag 11-11-2019 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ DDoS attacks in Q3 2019 ∗∗∗ --------------------------------------------- Statistically, Q3 2019 differs little from Q2. In terms of geographical distribution of attacks and targets, we saw a continuation of the now familiar trend of unexpected guests appearing, only to drop out the next quarter. --------------------------------------------- https://securelist.com/ddos-report-q3-2019/94958/ ∗∗∗ Vulnerable Versions of Adminer as a Universal Infection Vector ∗∗∗ --------------------------------------------- This past week, we’ve been monitoring a new wave of website infections mostly impacting WordPress and Magento websites. We found that hackers have been injecting scripts from scripts.trasnaltemyrecords[.]com into multiple files and database tables. This is still the same ongoing campaign that we’ve been following for the past few years, where site visitors are redirected to various kinds of scam landing pages—including tech support scams, fake lottery wins, and malicious [...] --------------------------------------------- https://blog.sucuri.net/2019/11/vulnerable-versions-of-adminer-as-a-univers… ∗∗∗ Ring Video Doorbell Pro: Mitteilsame IoT-Türklingel verriet WLAN-Zugangsdaten ∗∗∗ --------------------------------------------- Eine Klingel, die Besucher sicht- und hörbar macht, hätte Angreifern unbemerkt vollen WLAN-Zugriff verschaffen können. Automatische Updates wurden verteilt. --------------------------------------------- https://heise.de/-4583764 ∗∗∗ Sofortübersetzer von Muama Enence hält nicht, was er verspricht ∗∗∗ --------------------------------------------- Ein Gerät, das 32 Sprachen unmittelbar übersetzt und Verständigungsprobleme im Urlaub oder bei Geschäftstätigkeiten beseitigt, klingt erstmal hervorragend! Dies verspricht die UAB Ekomlita mit dem MUAMA Enence Instant Translator. Doch Vorsicht: Hier werden mitunter wichtige Informationen zum Produkt verheimlicht, es kommt zu groben Problemen beim Rücktritt und wir hegen Bedenken zum Datenschutz! --------------------------------------------- https://www.watchlist-internet.at/news/sofortuebersetzer-von-muama-enence-h… ∗∗∗ Apples Siri unterwandert E-Mail-Verschlüsselung ∗∗∗ --------------------------------------------- Nachrichten werden unter macOS im Klartext lokal gespeichert – Fehlerbereinigung laut Apple in Arbeit --------------------------------------------- https://www.derstandard.at/story/2000110928043/apples-siri-unterwandert-e-m… ===================== = Vulnerabilities = ===================== ∗∗∗ Jira Service Desk Security Advisory 2019-11-06 ∗∗∗ --------------------------------------------- CVE-2019-15003 - Authorization bypass allows information disclosure CVE-2019-15004 - URL path traversal allows information disclosure --------------------------------------------- https://confluence.atlassian.com/jira/jira-service-desk-security-advisory-2… ∗∗∗ UniFi Video Server Privilege Escalation From user to SYSTEM via unauthenticated command execution ∗∗∗ --------------------------------------------- The vulnerability, or feature depending how you look at it, is the ability to execute commands using the evostream API interface that is exposed on localhost:7440. --------------------------------------------- https://hackerone.com/reports/544928 ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (ampache, chromium, djvulibre, firefox-esr, gdal, and ruby-haml), Fedora (chromium, file, gd, hostapd, nspr, and rssh), openSUSE (bcm20702a1-firmware, firefox, gdal, libtomcrypt, php7, python-ecdsa, python3, samba, and thunderbird), SUSE (apache2-mod_auth_openidc, libssh2_org, and rsyslog), and Ubuntu (bash). --------------------------------------------- https://lwn.net/Articles/804325/ ∗∗∗ Security Bulletin: IBM QRadar SIEM is vulnerable to multiple Kernel vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-qradar-siem-is-vulner… ∗∗∗ Security Bulletin: IBM RackSwitch firmware products are affected by TCP denial of service vulnarabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-rackswitch-firmware-p… ∗∗∗ Security Bulletin: IBM Tivoli Netcool Impact is affected by an Apache Camel vulnerability (CVE-2019-0188) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-tivoli-netcool-impact… ∗∗∗ Security Bulletin: Node.js lodash vulnerability affects IBM Spectrum Control (formerly Tivoli Storage Productivity Center) ( CVE-2019-10744) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-node-js-lodash-vulnerabil… ∗∗∗ Security Bulletin: IBM Flex System Chassis Management Module (CMM) is affected by vulnerability in SQLite (CVE-2018-20346) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-flex-system-chassis-m… ∗∗∗ Security Bulletin: IBM QRadar SIEM is vulnerable to Jetty Vulnerabilities (CVE-2017-7656, CVE-2017-7657, CVE-2017-7658, CVE-2018-12536) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-qradar-siem-is-vulner… ∗∗∗ Security Bulletin: IBM Tivoli Netcool Impact is affected by an Apache Camel vulnerability (CVE-2019-0194) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-tivoli-netcool-impact… ∗∗∗ Security Bulletin: IBM QRadar SIEM is vulnerable to cross site scripting (XSS) (CVE-2019-4470) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-qradar-siem-is-vulner… ∗∗∗ Security Bulletin: Multiple vulnerabilities in Python affect IBM i ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: IBM QRadar SIEM is vulnerable to Intel Microarchitectural Data Sampling (MDS) Vulnerabilites ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-qradar-siem-is-vulner… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 08.11.2019
by Daily end-of-shift report 08 Nov '19

08 Nov '19

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 07-11-2019 18:00 − Freitag 08-11-2019 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Microsoft Warns of More Harmful Windows BlueKeep Attacks, Patch Now ∗∗∗ --------------------------------------------- The Microsoft Defender ATP Research Team says that the BlueKeep attacks detected on November 2 are connected with a coin mining campaign from September that used the same command-and-control (C2) infrastructure. --------------------------------------------- https://www.bleepingcomputer.com/news/security/microsoft-warns-of-more-harm… ∗∗∗ QNAP Warns Users to Secure Devices Against QSnatch Malware ∗∗∗ --------------------------------------------- Network-attached storage (NAS) maker QNAP urges customers to secure their NAS devices against an ongoing malicious campaign that infects them with QSnatch malware capable of stealing user credentials. --------------------------------------------- https://www.bleepingcomputer.com/news/security/qnap-warns-users-to-secure-d… ∗∗∗ Amazon Kindle, Embedded Devices Open to Code-Execution ∗∗∗ --------------------------------------------- Flaws in Das U-Boot affect third-party hardware that uses the universal bootloader as an underlying component. --------------------------------------------- https://threatpost.com/amazon-kindle-embedded-devices-code-execution/150003/ ∗∗∗ Pwn2Own Tokyo Roundup: Amazon Echo, Routers and Smart TVs Fall to Hackers ∗∗∗ --------------------------------------------- The latest edition of the bi-annual hacking contest saw creative exploits in new device categories. --------------------------------------------- https://threatpost.com/pwn2own-tokyo-2019-amazon-echo-hackers/150033/ ∗∗∗ Microsoft Apps Diverted from Their Main Use, (Fri, Nov 8th) ∗∗∗ --------------------------------------------- This week, the CERT.eu[1] organized its yearly conference in Brussels. Across many interesting presentations, one of them covered what they called the "catnmouse" game that Blue and Red teams are playing continuously. When the Blue team has detected an attack technique, they write a rule or implement a new control to detect or block it. Then, the Red team has to find an alternative attack path, [...] --------------------------------------------- https://isc.sans.edu/diary/rss/25502 ∗∗∗ Skimmers for Both Magento and WordPress ∗∗∗ --------------------------------------------- We often write about malware that steal payment information from sites built with Magento and other types of e-commerce CMS. When discussing credit card skimmers like Magecart, it’s sometimes overlooked that WordPress also has a decent share in the ecommerce segment. There are numerous popular plugins that can easily turn a WordPress site into a full-featured online store. In fact, Woocommerce alone has over 5 million installations. --------------------------------------------- https://blog.sucuri.net/2019/11/skimmers-for-both-magento-and-wordpress.html ∗∗∗ Wireshark Tutorial: Examining Trickbot Infections ∗∗∗ --------------------------------------------- A tutorial offering tips on how to identify Trickbot, an information stealer and banking malware that has been infecting victims since 2016. --------------------------------------------- https://unit42.paloaltonetworks.com/wireshark-tutorial-examining-trickbot-i… ===================== = Vulnerabilities = ===================== ∗∗∗ Medtronic Valleylab FT10 and LS10 ∗∗∗ --------------------------------------------- This medical advisory contains mitigations for improper authentication and protection mechanism failure vulnerabilities in Medtronic’s Valleylab FT10 and LS10 energy and electrosurgery products. --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsma-19-311-01 ∗∗∗ Medtronic Valleylab FT10 and FX8 ∗∗∗ --------------------------------------------- This medical advisory contains mitigations for use of hard-coded credentials, reversible one-way hash, and improper input validation vulnerabilities in Medtronic’s Valleylab FT10 and FX8 products. --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsma-19-311-02 ∗∗∗ Mitsubishi Electric MELSEC-Q Series and MELSEC-L Series CPU Modules ∗∗∗ --------------------------------------------- This advisory contains mitigations for an uncontrolled resource consumption vulnerability in select Mitsubishi Electrics CPU modules. --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-19-311-01 ∗∗∗ Fuji Electric V-Server ∗∗∗ --------------------------------------------- This advisory contains mitigations for a heap-based buffer overflow vulnerability in Fuji Electrics V-Server data collection and management service. --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-19-311-02 ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (linux-hardened), Debian (fribidi), Gentoo (oniguruma, openssh/openssh, openssl, and pump), Mageia (chromium-browser-stable, expat, firefox, freetds, proftpd, python, thunderbird, and unbound), Oracle (sudo), Scientific Linux (thunderbird), Slackware (kernel), SUSE (rubygem-haml), and Ubuntu (fribidi and webkit2gtk). --------------------------------------------- https://lwn.net/Articles/804202/ ∗∗∗ IBM Security Bulletin: Security vulnerabilities affect multiple IBM Rational products based on IBM Jazz technology ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-security-vulnerabilit… ∗∗∗ tcpdump vulnerability CVE-2018-14879 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K51512510 ∗∗∗ WebKitGTK and WPE WebKit Security Advisory WSA-2019-0006 ∗∗∗ --------------------------------------------- https://webkitgtk.org/security/WSA-2019-0006.html ∗∗∗ Squid: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-0966 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 07.11.2019
by Daily end-of-shift report 07 Nov '19

07 Nov '19

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 06-11-2019 18:00 − Donnerstag 07-11-2019 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Specially Crafted ZIP Files Used to Bypass Secure Email Gateways ∗∗∗ --------------------------------------------- Attackers are always looking for new tricks to distribute malware without them being detected by antivirus scanners and secure email gateways. This was illustrated in a new phishing campaign that utilized a specially crafted ZIP file that was designed to bypass secure email gateways to distribute the NanoCore RAT. --------------------------------------------- https://www.bleepingcomputer.com/news/security/specially-crafted-zip-files-… ∗∗∗ How to Secure Critical Infrastructure When Patching Isn’t Possible ∗∗∗ --------------------------------------------- Mission-critical systems cant just be switched off to apply security updates -- so patching can take weeks if not years. --------------------------------------------- https://threatpost.com/secure-critical-infrastructure-when-patching-isnt-po… ∗∗∗ Vulnerability hunting with Semmle QL: DOM XSS ∗∗∗ --------------------------------------------- In two previous blog posts ( part 1 and part 2), we talked about using Semmle QL in C and C++ codebases to find vulnerabilities such as integer overflow, path traversal, and those leading to memory corruption. In this post, we will explore applying Semmle QL to web security by hunting for one of the [...] --------------------------------------------- https://msrc-blog.microsoft.com:443/2019/11/06/vulnerability-hunting-with-s… ∗∗∗ Getting the best value out of security assessments, (Thu, Nov 7th) ∗∗∗ --------------------------------------------- Since my day job is all about hacking, I get a lot of questions (and there appears to be a lot of confusion) about what a vulnerability scan, penetration test or red team assessment is. --------------------------------------------- https://isc.sans.edu/diary/rss/25498 ∗∗∗ Magento 1 End of Life ∗∗∗ --------------------------------------------- It’s no secret that a CMS without support will develop vulnerabilities. Eventually, these lead to a compromised website — which cripples any ecommerce business. When you consider the popularity of the Magento ecommerce platform, it’s easy to see how their announcement of the Magento 1 end of life could leave a significant portion of ecommerce retailers scrambling for new solutions. --------------------------------------------- https://blog.sucuri.net/2019/11/magento-1-end-of-life.html ∗∗∗ VB2019 paper: DNS on fire ∗∗∗ --------------------------------------------- In a paper presented at VB2019, Cisco Talos researchers Warren Mercer and Paul Rascagneres looked at two recent attacks against DNS infrastructure: DNSpionage and Sea Turtle. Today we publish their paper and the recording of their presentation. --------------------------------------------- https://www.virusbulletin.com:443/blog/2019/11/vb2019-paper-dns-fire/ ∗∗∗ C2 With It All: From Ransomware To Carding ∗∗∗ --------------------------------------------- Cisco Talos recently discovered a new server hosting a large stockpile of malicious files. Our analysis of these files shows that these attackers were able to obtain a deep level of access to victims infrastructure — all of which allowed us to identify several targets of these attacks, including one American manufacturing company. Talos notified these targets of the attack. --------------------------------------------- https://blog.talosintelligence.com/2019/11/c2-with-it-all.html ∗∗∗ 5 Tipps zur Steigerung der Cybersecurity Awareness von Angestellten ∗∗∗ --------------------------------------------- Wie können Firmen ein Arbeitsumfeld schaffen, das es Angestellten ermöglicht, die nötigen Fähigkeiten zu erwerben, um Cybergefahren richtig einzuschätzen? --------------------------------------------- https://www.welivesecurity.com/deutsch/2019/11/07/5-tipps-steigerung-cybers… ∗∗∗ Falsche Gewinnspiele für Kinogutscheine kosten 80 Euro pro Monat ∗∗∗ --------------------------------------------- Mit Facebook-Anzeigen und nachgebauten Facebook-Seiten von Kinos in ganz Österreich werben Kriminelle für ein Gewinnspiel. Angeblich können Kinogutscheine gewonnen werden. Doch Vorsicht: Hier gibt es nichts zu gewinnen! Statt eines Kinobesuchs gibt es nur Ärger. Die Kreditkartendaten landen in den Händen von Kriminellen, die dann 80 bis 90 Euro pro Monat abbuchen. --------------------------------------------- https://www.watchlist-internet.at/news/falsche-gewinnspiele-fuer-kinogutsch… ===================== = Vulnerabilities = ===================== ∗∗∗ Gamers Hit with Nvidia GPU Driver, GeForce Flaws ∗∗∗ --------------------------------------------- Vulnerabilities in several PC gaming products offered by Nvidia can lead to escalation of privilege, denial of service and other malicious attacks. --------------------------------------------- https://threatpost.com/gamers-hit-with-nvidia-gpu-driver-geforce-flaws/1499… ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (squid), Fedora (chromium, libssh2, and wpa_supplicant), openSUSE (chromium), Red Hat (ansible, chromium-browser, openstack-octavia, patch, qemu-kvm-rhev, sudo, and thunderbird), Scientific Linux (sudo), SUSE (bluez, gdb, php72, and thunderbird), and Ubuntu (cpio and rygel). --------------------------------------------- https://lwn.net/Articles/804091/ ∗∗∗ Cisco: All these routers have the same embedded crypto keys, so update firmware ∗∗∗ --------------------------------------------- Cisco removes static encryption keys that were shared across its small-business routers. --------------------------------------------- https://www.zdnet.com/article/cisco-all-these-routers-have-the-same-embedde… ∗∗∗ Open Social - Critical - Insecure Session Management - SA-CONTRIB-2019-075 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2019-075 ∗∗∗ PEPPERL+FUCHS Linux Kernel Vulnerability on ecom Mobile Devices ∗∗∗ --------------------------------------------- https://cert.vde.com/de-de/advisories/vde-2019-021 ∗∗∗ Red Hat OpenShift Container Platform: Schwachstelle ermöglicht Offenlegung von Informationen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-0965 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 06.11.2019
by Daily end-of-shift report 06 Nov '19

06 Nov '19

===================== = End-of-Day report = ===================== Timeframe: Dienstag 05-11-2019 18:00 − Mittwoch 06-11-2019 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Emotet, Trickbot, Ryuk – ein explosiver Malware-Cocktail ∗∗∗ --------------------------------------------- Der aktuell "zerstörerischste" Schädling Emotet besteht aus einer Kaskade mehrerer Schadprogramme, die zusammen vielstellige Millionenschäden verursachen. --------------------------------------------- https://heise.de/-4573848 ∗∗∗ Überteuerte Visums- und Einreisegenehmigungsangebote im Internet ∗∗∗ --------------------------------------------- Ihr nächstes Urlaubsziel verlangt ein Visum? Dann nehmen Sie sich vor unseriösen Websites in Acht, die ein Vielfaches der tatsächlich anfallenden Gebühr für die Einreisegenehmigungen verlangen. Besondere Vorsicht ist beispielsweise bei Reisen nach Australien, Ägypten, Vietnam, Indien sowie Kanada oder in die USA und die Türkei geboten – theoretisch ist die Masche aber bei allen Destinationen mit Visumspflicht möglich. --------------------------------------------- https://www.watchlist-internet.at/news/ueberteuerte-visums-und-einreisegene… ∗∗∗ German Dridex spam campaign is unfashionably large ∗∗∗ --------------------------------------------- VB has analysed a malicious spam campaign targeting German-speaking users with obfuscated Excel malware that would likely download Dridex but that mostly stood out through its size. --------------------------------------------- https://www.virusbulletin.com:443/blog/2019/11/german-malspam-campaign-unfa… ∗∗∗ Scammers Are Exploiting a Firefox Bug to Freeze Your Browser ∗∗∗ --------------------------------------------- Fraudulent tech-support sites are causing the browser to lock up and display a disturbing message. Force quitting is the only way out. --------------------------------------------- https://www.wired.com/story/scammers-are-exploiting-a-firefox-bug-to-freeze… ∗∗∗ Siemens PLC Feature Can Be Exploited for Evil - and for Good ∗∗∗ --------------------------------------------- A hidden feature in some newer models of the vendors programmable logic controllers leaves the devices open to attack. Siemens says it plans to fix it. --------------------------------------------- https://www.darkreading.com/vulnerabilities---threats/siemens-plc-feature-c… ∗∗∗ Kamerka OSINT tool shows your countrys internet-connected critical infrastructure ∗∗∗ --------------------------------------------- Kamerka lets you see what a hacker sees. It plots maps with SCADA equipment, webcams, and printers that have been left exposed on the internet inside any given country. --------------------------------------------- https://www.zdnet.com/article/kamerka-osint-tool-shows-your-countrys-intern… ===================== = Vulnerabilities = ===================== ∗∗∗ Omron CX-Supervisor ∗∗∗ --------------------------------------------- This advisory contains mitigations for a use of obsolete function vulnerability in Omrons CX-Supervisor SCADA and HMI package. --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-19-309-01 ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (cpio, openafs, proftpd-dfsg, simplesamlphp, and wordpress), Fedora (thunderbird), openSUSE (binutils, docker-runc, kernel, nfs-utils, php7, python3, and samba), Red Hat (389-ds:1.4, ansible, bind, container-tools:1.0, container-tools:rhel8, curl, dbus, dhcp, dovecot, edk2, elfutils, evolution, freeradius:3.0, gdb, gettext, glib2, glibc, GNOME, gnutls, go-toolset:rhel8, http-parser, httpd:2.4, kernel, kernel-rt, libarchive, libjpeg-turbo, libqb, [...] --------------------------------------------- https://lwn.net/Articles/804018/ ∗∗∗ Smartwares HOME easy v1.0.9 Database Backup Information Disclosure Exploit ∗∗∗ --------------------------------------------- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5541.php ∗∗∗ Smartwares HOME easy v1.0.9 Client-Side Authentication Bypass ∗∗∗ --------------------------------------------- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5540.php ∗∗∗ Cisco Security Advisories ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/publicationListing.x ∗∗∗ Security Advisory - Insufficient Authentication Vulnerability in Several Band Products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191106-… ∗∗∗ libpcap vulnerability CVE-2018-16301 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K86252029 ∗∗∗ Red Hat Enterprise Linux: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-0959 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 05.11.2019
by Daily end-of-shift report 05 Nov '19

05 Nov '19

===================== = End-of-Day report = ===================== Timeframe: Montag 04-11-2019 18:00 − Dienstag 05-11-2019 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Alexa und Siri: Sprachbefehle unhörbar per Laser übertragen ∗∗∗ --------------------------------------------- Sprachbefehle müssen nicht unbedingt per Sprache übertragen werden: Forschern ist es gelungen, smarte Lautsprecher wie Amazon Echo oder Google Home mit einem Laser aus bis zu 110 Metern Entfernung zu steuern - und so beispielsweise ein Garagentor zu öffnen. --------------------------------------------- https://www.golem.de/news/alexa-und-siri-sprachbefehle-unhoerbar-per-laser-… ∗∗∗ Magecart Groups Attack Simultaneous Sites in Card-Theft Frenzy ∗∗∗ --------------------------------------------- Stealing payment-card data and PII from e-commerce sites has become so lucrative that some are being targeted by multiple groups at the same time. --------------------------------------------- https://threatpost.com/magecart-groups-attack-simultaneous-sites-in-card-th… ∗∗∗ Bluekeep exploitation causing Bluekeep vulnerability scan to fail, (Tue, Nov 5th) ∗∗∗ --------------------------------------------- I woke up this morning to the long anticipated news that Bluekeep exploitation is happening in the wild. As some of you may recall, back in August I wrote a diary demonstrating a way to scan for Bluekeep vulnerable devices. So the next thing I did was check my Bluekeep scan results and was presented with this graph. --------------------------------------------- https://isc.sans.edu/diary/rss/25488 ∗∗∗ Pwning a Smart Car Charger, Building a Bot-Net ∗∗∗ --------------------------------------------- ...or Why We Don’t Build Commercial IoT on a Raspberry Pi. A positive story of disclosure and remediation. We’re quite in to our electric vehicles at PTP, so we started hunting for a smart car charger. There are plenty of industrial chargers out there and some research has been done in the past. We got [...] --------------------------------------------- https://www.pentestpartners.com/security-blog/pwning-a-smart-car-charger-bu… ∗∗∗ Bestellen Sie nicht bei kafrosa.de ∗∗∗ --------------------------------------------- kafrosa.de vertreibt Kaffeemaschinen, Kaffeevollautomaten und sogar Kaffee zu günstigen Preisen. Der Aufbau von kafrosa.de wirkt seriös, verpflichtende Angaben über das Unternehmen werden angeführt und die Auszeichnungen des Shops stiften Vertrauen. Doch Vorsicht: Der Schein trügt. Es handelt sich um einen Fake-Shop, der keine Ware liefert! --------------------------------------------- https://www.watchlist-internet.at/news/bestellen-sie-nicht-bei-kafrosade/ ∗∗∗ A look at WP-VCD, todays largest WordPress hacking operation ∗∗∗ --------------------------------------------- Exclusive look into the WP-VCD gang operations! --------------------------------------------- https://www.zdnet.com/article/a-look-at-wp-vcd-todays-largest-wordpress-hac… ===================== = Vulnerabilities = ===================== ∗∗∗ Windows-Kernel-Lücke in Netzwerküberwachsungssoftware PRTG geschlossen ∗∗∗ --------------------------------------------- Die in Paessler PRTG integrierte Paket-Sniffer-Bibliothek Npcap ist verwundbar. Das haben die Entwickler nun repariert. --------------------------------------------- https://heise.de/-4577699 ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (electron, ghostscript, glibc, python2, and samba), Debian (webkit2gtk), Slackware (libtiff), SUSE (ImageMagick, python-ecdsa, and samba), and Ubuntu (apport, haproxy, ruby-nokogiri, and whoopsie). --------------------------------------------- https://lwn.net/Articles/803885/ ∗∗∗ Synology-SA-19:37 DSM ∗∗∗ --------------------------------------------- Multiple vulnerabilities allow remote authenticated users to execute arbitrary commands or conduct denial-of-service attacks, or allow remote attackers to delete arbitrary files via a susceptible version of DiskStation Manager (DSM). --------------------------------------------- https://www.synology.com/en-global/support/security/Synology_SA_19_37 ∗∗∗ Microsoft Office365 Integrity Validation / Remote Code Execution ∗∗∗ --------------------------------------------- https://cxsecurity.com/issue/WLB-2019110022 ∗∗∗ [20191002] - Core - Path Disclosure in phpuft8 mapping files ∗∗∗ --------------------------------------------- http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/Zi-lVuM4KoY/795-20191002-c… ∗∗∗ [20191001] - Core - CSRF in com_template overrides view ∗∗∗ --------------------------------------------- http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/LaIC5kOPGB0/794-20191001-c… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM MessageGateway ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: IBM QRadar Advisor With Watson is vulnerable to Hazardous Input Validation in some cases ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-qradar-advisor-with-w… ∗∗∗ November 4, 2019 TNS-2019-07 [R1] PHP Stand-alone Patch Available for Tenable.sc versions 5.7.x to 5.11.x ∗∗∗ --------------------------------------------- http://www.tenable.com/security/tns-2019-07 ∗∗∗ FRF.16 parser vulnerability CVE-2018-14468 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K04367730 ∗∗∗ Dell integrated Dell Remote Access Controller: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-0957 ∗∗∗ Google Android: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-0958 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 04.11.2019
by Daily end-of-shift report 04 Nov '19

04 Nov '19

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 31-10-2019 18:00 − Montag 04-11-2019 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Windows: Schadsoftware nutzt erstmals Bluekeep-Sicherheitslücke aus ∗∗∗ --------------------------------------------- Als eine Sicherheitslücke wie Wanna Cry beschreibt Microsoft Bluekeep. Nun entdeckten Sicherheitsforscher die erste Schadsoftware, die die Lücke ausnutzt. Diese ist jedoch noch weit entfernt von dem Worst-Case-Szenario. --------------------------------------------- https://www.golem.de/news/windows-schadsoftware-nutzt-erstmals-bluekeep-sic… ∗∗∗ Malware "QSnatch" attackiert QNAP-Netzwerkspeicher – auch in Deutschand ∗∗∗ --------------------------------------------- QSnatch hat es auch hierzulande auf NAS von QNAP abgesehen. Ob ein Firmware-Update hilft, ist unklar – durchführen sollte man es dennoch. --------------------------------------------- https://heise.de/-4573483 ∗∗∗ Android Beam erlaubt Einschleusen fremder Apps ∗∗∗ --------------------------------------------- Über NFC könnten fast unbemerkt gefährliche Apps auf Android-Geräte gelangen. Betroffen sind Android 8, 9 und 10. Es gibt Abhilfe. --------------------------------------------- https://heise.de/-4574396 ===================== = Vulnerabilities = ===================== ∗∗∗ Advantech WISE-PaaS/RMM ∗∗∗ --------------------------------------------- This advisory contains mitigations for path traversal, missing authorization, improper restriction of XML external entity reference, and SQL injection vulnerabilities in Advantech’s WISE-PaaS/RMM IoT device remote monitoring and management platform. --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-19-304-01 ∗∗∗ Honeywell equIP Series IP Cameras ∗∗∗ --------------------------------------------- This advisory contains mitigations for an improper input validation vulnerability in Honeywells equIP series IP cameras. --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-19-304-02 ∗∗∗ Honeywell equIP and Performance Series IP Cameras ∗∗∗ --------------------------------------------- This advisory contains mitigations for a missing authentication for critical function vulnerability in Honeywells equIP series and Performance series IP cameras. --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-19-304-03 ∗∗∗ Honeywell equIP and Performance Series IP Cameras and Recorders ∗∗∗ --------------------------------------------- This advisory contains mitigations for an authentication bypass by capture-relay vulnerability in Honeywells equIP series and Performance series IP cameras and recorders. --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-19-304-04 ∗∗∗ Watch Out IT Admins! Two Unpatched Critical RCE Flaws Disclosed in rConfig ∗∗∗ --------------------------------------------- If youre using the popular rConfig network configuration management utility to protect and manage your network devices, here we have an important and urgent warning for you. A cybersecurity researcher has recently published details and proof-of-concept exploits for two unpatched, critical remote code execution vulnerabilities in the rConfig utility, at least one of which could allow [...] --------------------------------------------- https://thehackernews.com/2019/11/rConfig-network-vulnerability.html ∗∗∗ Microsoft Office for Mac cannot properly disable XLM macros ∗∗∗ --------------------------------------------- The Microsoft Office for Mac option "Disable all macros without notification" enables XLM macros without prompting, which can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. --------------------------------------------- https://kb.cert.org/vuls/id/125336/ ∗∗∗ Update verfügbar: MikroTik sichert Router gegen vier Schwachstellen ab ∗∗∗ --------------------------------------------- Schwachstellen in RouterOS lassen sich zu einer Exploit-Chain zusammenbauen. Gerätebesitzer sollten jetzt updaten. --------------------------------------------- https://heise.de/-4573749 ∗∗∗ Xcode: Lücken in Entwicklungsumgebung erlaubten beliebige Codeausführung ∗∗∗ --------------------------------------------- Zwei Lücken in der macOS-Entwicklungsumgebung Xcode vor Version 11.2 erlaubten die beliebige Programmcode-Ausführung – möglicherweise auch aus der Ferne. --------------------------------------------- https://heise.de/-4575632 ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by CentOS (firefox, sudo, and thunderbird), Debian (libarchive and qtbase-opensource-src), Oracle (php), Red Hat (php, rh-php71-php, and rh-php72-php), Scientific Linux (firefox and php), and SUSE (kernel and samba). --------------------------------------------- https://lwn.net/Articles/803651/ ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (chromium and qt5-webengine), CentOS (firefox and php), Fedora (file, java-latest-openjdk, nspr, nss, php, t1utils, and webkit2gtk3), Mageia (ansible, aspell, golang, libsoup, and libxslt), openSUSE (chromium and chromium, re2), Oracle (php), and Ubuntu (apport and file). --------------------------------------------- https://lwn.net/Articles/803785/ ∗∗∗ Synology-SA-19:36 PHP ∗∗∗ --------------------------------------------- CVE-2019-11043 allows remote attackers to execute arbitrary code via a susceptible version of PHP 7.2, or PHP 7.3. --------------------------------------------- https://www.synology.com/en-global/support/security/Synology_SA_19_36 ∗∗∗ [remote] Microsoft Windows Server 2012 - Group Policy Security Feature Bypass ∗∗∗ --------------------------------------------- https://www.exploit-db.com/exploits/47559 ∗∗∗ [remote] Microsoft Windows Server 2012 - Group Policy Remote Code Execution ∗∗∗ --------------------------------------------- https://www.exploit-db.com/exploits/47558 ∗∗∗ Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with IBM Cloud Orchestrator (CVE-2019-4442) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: IBM Flex System Chassis Management Module (CMM) is affected by vulnerabilities in PHP (CVE-2019-6978, CVE-2019-6977) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-flex-system-chassis-m… ∗∗∗ Security Bulletin: IBM Navigator for i is affected by CVE-2019-4450 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-navigator-for-i-is-af… ∗∗∗ Security Bulletin: IBM Flex System Chassis Management Module (CMM) is affected by vulnerabilities in libssh2 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-flex-system-chassis-m… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by a TCP SACK PANIC -Kernel vulnerability ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Security Bulletin: IBM Flex System Chassis Management Module (CMM) is affected by vulnerability in PHP. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-flex-system-chassis-m… ∗∗∗ Security Bulletin: IBM Content Navigator is affected by a vulnerability in Apache Commons Beanutils (CVE-2019-10086) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-content-navigator-is-… ∗∗∗ Security Bulletin: IBM Navigator for i is affected by CVE-2019-4450 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-navigator-for-i-is-af… ∗∗∗ BIG-IP TMUI XSS vulnerability CVE-2019-6657 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K22441651 ∗∗∗ BIG-IP AFM SQL injection vulnerability CVE-2019-6658 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K21121741 ∗∗∗ Citrix Hypervisor Security Update ∗∗∗ --------------------------------------------- https://support.citrix.com/article/CTX263477 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 31.10.2019
by Daily end-of-shift report 31 Oct '19

31 Oct '19

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 30-10-2019 18:00 − Donnerstag 31-10-2019 18:00 Handler: Dimitri Robl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ EML attachments in O365 - a recipe for phishing, (Thu, Oct 31st) ∗∗∗ --------------------------------------------- Ive recently come across interesting behavior of Office 365 when EML files are attached to e-mail messages, which can be useful for any red teamers out there but which can potentially also make certain types of phishing attacks more successful. --------------------------------------------- https://isc.sans.edu/diary/rss/25474 ∗∗∗ Data URLs and HTML Entities in New WordPress Malware ∗∗∗ --------------------------------------------- Last week, an ongoing WordPress malware campaign started a new wave which included a variety of experimental injection types. Scripts as Data URLs The first type looks pretty similar to what we discussed in our recent post. However, instead of placing the code between the … tags, these injections have begun to embed them inline using a so called data URL notation in the src parameter. --------------------------------------------- https://blog.sucuri.net/2019/10/data-urls-and-html-entities-in-new-wordpres… ∗∗∗ MS-ISAC Releases EOS Software Report List ∗∗∗ --------------------------------------------- Original release date: October 30, 2019The Multi-State Information Sharing and Analysis Center (MS-ISAC) has released an end-of-support (EOS) software report list. Software that has reached its EOS date no longer receives security updates and patches from the vendor and is, therefore, susceptible to exploitation from security vulnerabilities. --------------------------------------------- https://www.us-cert.gov/ncas/current-activity/2019/10/30/ms-isac-releases-e… ∗∗∗ 5th eHealth Security Conference: ENISA advises on cybersecurity for hospitals ∗∗∗ --------------------------------------------- ENISA, the EU Agency for Cybersecurity organised the 5th consecutive eHealth Security Conference in cooperation with the Spanish Authorities and the Centre for Information Security of Catalonia (CESICAT) on the 30th October in Barcelona. --------------------------------------------- https://www.enisa.europa.eu/news/enisa-news/5th-ehealth-security-conference… ∗∗∗ Office 365 Users Targeted by Voicemail Scam Pages ∗∗∗ --------------------------------------------- Over the past few weeks McAfee Labs has been observing a new phishing campaign using a fake voicemail message to lure victims into entering their Office 365 email credentials. At first, we believed that only one phishing kit was being used to harvest the user’s credentials. However, during our investigation, we found three different malicious [...] --------------------------------------------- https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/office-365-user… ∗∗∗ Ungenutzte E-Mail-Adressen ermöglichen Zugang zu persönlichen Konten ∗∗∗ --------------------------------------------- E-Mail-Adressen, die nicht mehr genutzt werden, werden oft neu vergeben. Wenn diese Adressen noch bei Social-Media-Konten, Gaming-Accounts, Online-Shops oder anderen Zugangsdaten hinterlegt sind, können sich die neuen BesitzerInnen Zugang zu diesen Konten verschaffen. Kriminelle nutzen das zu Betrugs- und Erpressungszwecken aus. --------------------------------------------- https://www.watchlist-internet.at/news/ungenutzte-e-mail-adressen-ermoeglic… ∗∗∗ Untitled Goose Game security hole could have allowed hackers to wreak havoc ∗∗∗ --------------------------------------------- The highly popular “Untitled Goose Game” has been found to be vulnerable to an attack that could allow hackers to run malicious code on your computer. --------------------------------------------- https://hotforsecurity.bitdefender.com/blog/untitled-goose-game-security-ho… ∗∗∗ Home & Small Office Wireless Routers Exploited to Attack Gaming Servers ∗∗∗ --------------------------------------------- Unit 42 researchers discovered an updated Gafgy variant that looks to infect home and small office WiFi routers of known commercial brands, like Zyxel, Huawei, and Realtek to attack gaming servers. More than 32,000 WiFi routers are potentially vulnerable to these exploits around the world. --------------------------------------------- https://unit42.paloaltonetworks.com/home-small-office-wireless-routers-expl… ∗∗∗ Vorwarnung: Neue Webseite kommt nächste Woche ∗∗∗ --------------------------------------------- tl;dr: Nein, wir werden nächste Woche nicht gehackt, wir stellen nur eine neue Webseite online. --------------------------------------------- http://www.cert.at/services/blog/20191031121150-2561.html ===================== = Vulnerabilities = ===================== ∗∗∗ XSA-299 Security Vulnerability ∗∗∗ --------------------------------------------- IBM is aware of a reported XSA-299 security vulnerability (CVE-2019-18421) that potentially would permit an attacker from within a VSI to elevate privileges to that of the host.There are no known malicious exploits of this vulnerability, which potentially impacts the hypervisor.IBM is implementing updates to remediate this vulnerability. No downtime for clients is expected and no client action is necessary for IBM Cloud virtual servers. While we do not anticipate any issues with remediation, we [...] --------------------------------------------- https://www.ibm.com/blogs/psirt/xsa-299-security-vulnerability/ ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (italc and python-ecdsa), Fedora (php and sudo), openSUSE (binutils and docker-runc), Oracle (thunderbird), Red Hat (firefox and sudo), SUSE (ardana-ansible, ardana-glance, ardana-horizon, ardana-input-model, ardana-manila, ardana-neutron, ardana-nova, ardana-octavia, ardana-tempest, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, galera-3, grafana, mariadb, mariadb-connector-c, novnc, openstack-cinder, openstack-glance, openstack-heat, [...] --------------------------------------------- https://lwn.net/Articles/803583/ ∗∗∗ XSA-303 - ARM: Interrupts are unconditionally unmasked in exception handlers ∗∗∗ --------------------------------------------- https://xenbits.xen.org/xsa/advisory-303.html ∗∗∗ XSA-302 - passed through PCI devices may corrupt host memory after deassignment ∗∗∗ --------------------------------------------- https://xenbits.xen.org/xsa/advisory-302.html ∗∗∗ XSA-301 - add-to-physmap can be abused to DoS Arm hosts ∗∗∗ --------------------------------------------- https://xenbits.xen.org/xsa/advisory-301.html ∗∗∗ XSA-299 - Issues with restartable PV type change operations ∗∗∗ --------------------------------------------- https://xenbits.xen.org/xsa/advisory-299.html ∗∗∗ XSA-298 - missing descriptor table limit checking in x86 PV emulation ∗∗∗ --------------------------------------------- https://xenbits.xen.org/xsa/advisory-298.html ∗∗∗ XSA-296 - VCPUOP_initialise DoS ∗∗∗ --------------------------------------------- https://xenbits.xen.org/xsa/advisory-296.html Next End-of-Day report: 2019-11-04 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 30.10.2019
by Daily end-of-shift report 30 Oct '19

30 Oct '19

===================== = End-of-Day report = ===================== Timeframe: Dienstag 29-10-2019 18:00 − Mittwoch 30-10-2019 18:00 Handler: Dimitri Robl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Paradise Ransomware Decryptor Gets Your Files Back for Free ∗∗∗ --------------------------------------------- A decryptor for the Paradise Ransomware has been released by Emsisoft that allows victims to decrypt their files for free. --------------------------------------------- https://www.bleepingcomputer.com/news/security/paradise-ransomware-decrypto… ∗∗∗ A1 warnt Android-Nutzer vor App, die Bankdaten stiehlt ∗∗∗ --------------------------------------------- Kunden sollten sich vor einer App mit dem Titel „Netztest“ in Acht nehmen. --------------------------------------------- https://futurezone.at/digital-life/a1-warnt-android-nutzer-vor-app-die-bank… ∗∗∗ Gewinnversprechen von Coca-Cola in Höhe von 1 Million US-Dollar ist Scam ∗∗∗ --------------------------------------------- Wenn Sie per E-Mail über einen Gewinn in Millionenhöhe benachrichtigt werden, handelt es sich um einen Betrugsversuch. Aktuell geben sich Kriminelle als Kommunikationsbeauftragte von Coca-Cola aus und informieren Sie über einen vermeintlichen Gewinn. Die Gewinnsumme wird im Austausch Ihrer persönlichen Daten und Ausweiskopien übermittelt. Vorsicht: Kriminelle versuchen an Ihr Geld zu kommen, stehlen Ihre Identität und missbrauchen sie für Straftaten in Ihrem [...] --------------------------------------------- https://www.watchlist-internet.at/news/gewinnversprechen-von-coca-cola-in-h… ===================== = Vulnerabilities = ===================== ∗∗∗ PHOENIX CONTACT Automation Worx Software Suite ∗∗∗ --------------------------------------------- This advisory contains mitigations for an improper input validation vulnerability in Phoenix Contacts Automation Worx Software Suite products. --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-19-302-01 ∗∗∗ Apple Releases Security Updates ∗∗∗ --------------------------------------------- Original release date: October 30, 2019Content: Apple has released security updates to address vulnerabilities in multiple products. An attacker could exploit some of these vulnerabilities to take control of an affected system.The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review the Apple security pages for the following products and apply the necessary updates: [...] --------------------------------------------- https://www.us-cert.gov/ncas/current-activity/2019/10/30/apple-releases-sec… ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (imapfilter, libvncserver, and pam-python), Fedora (tcpdump), Mageia (file, graphviz, kernel, and php, pcre2), openSUSE (nfs-utils), Red Hat (heketi and samba), Scientific Linux (thunderbird), SUSE (libtomcrypt, php7, and runc), and Ubuntu (apport, libarchive, libidn2, samba, and whoopsie). --------------------------------------------- https://lwn.net/Articles/803474/ ∗∗∗ Synology-SA-19:35 Samba ∗∗∗ --------------------------------------------- These vulnerabilities allow remote attackers to bypass security constraints via a susceptible version of DiskStation Manager (DSM), Synology Router Manager (SRM), and allow remote authenticated users to conduct denial-of-service attacks via a susceptible version of Synology Directory Server. --------------------------------------------- https://www.synology.com/en-global/support/security/Synology_SA_19_35 ∗∗∗ Security Advisory - Two Heap Buffer Overflow Vulnerabilities in Broadcom WiFi Chipset Drivers ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191030-… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 29.10.2019
by Daily end-of-shift report 29 Oct '19

29 Oct '19

===================== = End-of-Day report = ===================== Timeframe: Montag 28-10-2019 18:00 − Dienstag 29-10-2019 18:00 Handler: Dimitri Robl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Sicherheitslücke in EU-Authentifizierungssoftware (eIDAS Node) ∗∗∗ --------------------------------------------- SEC Consult identifizierte kritische Schwachstellen in eIDAS-Node, die es einem Angreifer ermöglichen könnten, sich als beliebiger EU-Bürger auszugeben. --------------------------------------------- https://www.sec-consult.com/blog/2019/10/sicherheitsluecke-in-eu-authentifi… ∗∗∗ File Inclusions: kleiner Programmierfehler, fatale Wirkung ∗∗∗ --------------------------------------------- Angriffe über File Inclusions sind vor allem in PHP und JSP nach wie vor möglich und können verheerende Folgen haben. --------------------------------------------- https://heise.de/-4570773 ∗∗∗ MikroTik Router Vulnerabilities Can Lead to Backdoor Creation ∗∗∗ --------------------------------------------- A chain of vulnerabilities in MikroTik routers could allow an attacker to gain a backdoor. The chain starts with DNS poisoning, goes on to downgrading the installed version of MikroTiks RouterOS software, and ends with enabling a backdoor. read more --------------------------------------------- https://www.securityweek.com/mikrotik-router-vulnerabilities-can-lead-backd… ∗∗∗ Achtung Abo-Falle: endlich-windelfrei.de & baby-endlich-schlafen.de ∗∗∗ --------------------------------------------- Die Websites endlich-windelfrei.de und baby-endlich-schlafen.de versprechen Eltern große Erleichterungen beim Abgewöhnen der Windel und Schlafenlegen der Kinder. Die Systeme „Endlich Schlaf für Ihr Baby“ und „Von der Windel zum Töpfchen – in nur 3 Tagen“ können um nur 1 Euro erworben werden. Doch Vorsicht: Der Kauf führt in eine Abo-Falle! --------------------------------------------- https://www.watchlist-internet.at/news/achtung-abo-falle-endlich-windelfrei… ∗∗∗ Modern Wireless Tradecraft Pt I ∗∗∗ --------------------------------------------- The past few years have seen some exciting developments in the subtle art of forcing wireless devices to connect to malicious access points. We’ve seen the resurgence of karma-style attacks with Dominic White’s and Ian de Villiers’ work on MANA, as well George Chatzisofroniou’s Lure10 and Known Beacon attacks, which can be used to target devices that are immune to karma [1][2]. --------------------------------------------- https://posts.specterops.io/modern-wireless-attacks-pt-i-basic-rogue-ap-the… ===================== = Vulnerabilities = ===================== ∗∗∗ Trend Micro schließt zwei Schwachstellen in Sicherheitssoftware für Windows ∗∗∗ --------------------------------------------- Patches für Apex One, OfficeScan und WFBS fixen zwei Schwachstellen. Trend Micro hat Exploit-Versuche beobachtet und rät zum zügigen Update. --------------------------------------------- https://heise.de/-4571304 ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (php7.0, php7.3, ruby-loofah, and spip), Fedora (proftpd), openSUSE (lz4 and sysstat), Red Hat (chromium-browser, jss, kernel, kernel-alt, kpatch-patch, pango, polkit, sudo, systemd, and thunderbird), SUSE (graphite-web, python3, and samba), and Ubuntu (php5, php7.0, php7.2, php7.3, and samba). --------------------------------------------- https://lwn.net/Articles/803381/ ∗∗∗ WebKitGTK and WPE WebKit Security Advisory WSA-2019-0005 ∗∗∗ --------------------------------------------- Date Reported: October 29, 2019 Advisory ID: WSA-2019-0005 CVE identifiers: CVE-2019-8625, CVE-2019-8674,CVE-2019-8707, CVE-2019-8719,CVE-2019-8720, CVE-2019-8726,CVE-2019-8733, CVE-2019-8735,CVE-2019-8763, CVE-2019-8768,CVE-2019-8769, CVE-2019-8771. Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2019-8625 Versions affected: WebKitGTK before 2.26.0 and WPE WebKit before2.26.0. Credit to Sergei Glazunov of Google Project Zero. Impact: Processing maliciously crafted [...] --------------------------------------------- https://webkitgtk.org/security/WSA-2019-0005.html ∗∗∗ Unauthenticated Access to Modbus Interface in Carel pCOWeb HVAC ∗∗∗ --------------------------------------------- As part of its features, the Carel pCOWeb card exposes a Modbus interface to the network. By design, Modbus does not provide authentication, allowing to control the affected system. --------------------------------------------- https://www.redteam-pentesting.de/en/advisories/rt-sa-2019-014/ ∗∗∗ Unsafe Storage of Credentials in Carel pCOWeb HVAC ∗∗∗ --------------------------------------------- The Carel pCOWeb card stores password hashes in the file "/etc/passwd",allowing privilege escalation by authenticated users. Additionally,plaintext copies of the passwords are stored. --------------------------------------------- https://www.redteam-pentesting.de/en/advisories/rt-sa-2019-013/ ∗∗∗ BlackBerry Powered by Android Security Bulletin - October 2019 ∗∗∗ --------------------------------------------- http://support.blackberry.com/kb/articleDetail?language=en_US&articleNumber… ∗∗∗ tcpdump vulnerability CVE-2018-14880 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K56551263?utm_source=f5support&utm_mediu… ∗∗∗ Open Redirect Vulnerability Patched In Bridge Theme ∗∗∗ --------------------------------------------- https://www.wordfence.com/blog/2019/10/open-redirect-vulnerability-patched-… ∗∗∗ PHOENIX CONTACT improper access control exists on FL NAT devices when using MAC-based port security ∗∗∗ --------------------------------------------- https://cert.vde.com/de-de/advisories/vde-2019-020 ∗∗∗ Samba: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-0945 ∗∗∗ McAfee Total Protection: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-0944 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily