Daily

daily@lists.cert.at

1 participants
3150 discussions

Tageszusammenfassung - 22.12.2020
by Daily end-of-shift report 22 Dec '20

22 Dec '20

===================== = End-of-Day report = ===================== Timeframe: Montag 21-12-2020 18:00 − Dienstag 22-12-2020 18:00 Handler: Thomas Pribitzer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Ransomware Task Force gegründet ∗∗∗ --------------------------------------------- Verschiedene Sicherheitsspezialisten haben die Ransomware Taks Force aus der Taufe gehoben. Zu den Gründungsmitgliedern gehören bekannte Namen wie Microsoft, McAfee und Citrix, aber auch kleinere Hersteller und gemeinnützige Organisationen. --------------------------------------------- https://www.zdnet.de/88390942/ransomware-task-force-gegruendet/ ∗∗∗ Least Privilege Application Management - A Lesson Learned from SolarWinds Orion ∗∗∗ --------------------------------------------- The sophisticated, nation-state assault used to infiltrate SolarWinds Orion and then leveraged to compromise potentially thousands of its customers is astonishing in scope and potential fallout. --------------------------------------------- https://www.beyondtrust.com/blog/entry/least-privilege-application-manageme… ∗∗∗ Smart Doorbell Disaster: Many Brands Vulnerable to Attack ∗∗∗ --------------------------------------------- Investigation reveals device sector is problem plagued when it comes to security bugs. --------------------------------------------- https://threatpost.com/smart-doorbell-vulnerable-to-attack/162527/ ∗∗∗ Patrick Wardle on Hackers Leveraging 'Powerful' iOS Bugs in High-Level Attacks ∗∗∗ --------------------------------------------- Noted Apple security expert Patrick Wardle discusses how cybercriminals are stepping up their game in targeting Apple users with new techniques and cyberattacks. --------------------------------------------- https://threatpost.com/patrick-wardle-on-hackers-leveraging-powerful-ios-bu… ∗∗∗ Threat Actors Increasingly Using VBA Purging in Attacks ∗∗∗ --------------------------------------------- Cyberattacks relying on malicious Office documents have increasingly leveraged a relatively new technique called VBA Purging, FireEye said over the weekend, when it also announced the availability of a related open source tool. --------------------------------------------- https://www.securityweek.com/threat-actors-increasingly-using-vba-purging-a… ∗∗∗ Increase in Drive-by Attacks Using SocGholish ∗∗∗ --------------------------------------------- The SocGholish framework is commonly used to distribute fake updates for applications such as Chrome, Firefox, Flash Player, and Microsoft Teams through drive-by downloads. Menlo Labs has reported an uptick in attacks using SocGholish. --------------------------------------------- https://exchange.xforce.ibmcloud.com/collection/ef2a09a8bb57d90f200a51af745… ∗∗∗ Meyhod - Yet Another Magecart Skimmer ∗∗∗ --------------------------------------------- Discovered by RiskIQ in October, Meyhod is a Magecart skimmer that researchers observed on several sites, in some cases it has been present on a site for months. The IP address that is hosting the malicious JavaScript code has several other domains associated with it that are suspected to be malicious. --------------------------------------------- https://exchange.xforce.ibmcloud.com/collection/5a493a06b3a2fa9585d3f239007… ===================== = Vulnerabilities = ===================== ∗∗∗ Sicherheitslücke mit maximaler Gefahreneinstufung in Wyse-Thin-Clients von Dell ∗∗∗ --------------------------------------------- Zwei kritische Sicherheitslücken gefährden Dell-PCs der Wyse-Thin-Serie. Updates sind verfügbar. --------------------------------------------- https://heise.de/-4997456 ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by CentOS (kernel and thunderbird), Debian (openjdk-8 and webkit2gtk), Fedora (gdm, mingw-openjpeg2, and openjpeg2), Mageia (compat-openssl10, golang-googlecode-net, mbedtls, openssl, and virtualbox), openSUSE (ovmf and xen), Red Hat (kernel, mariadb-connector-c, mariadb:10.3, postgresql:10, and postgresql:9.6), and SUSE (ardana-cassandra, ardana-mq, ardana-osconfig, ardana-tempest, crowbar-core, crowbar-openstack, grafana, influxdb, openstack-cinder, [...] --------------------------------------------- https://lwn.net/Articles/841099/ ∗∗∗ Protecting Against an Unfixed Kubernetes Man-in-the-Middle Vulnerability (CVE-2020-8554) ∗∗∗ --------------------------------------------- A currently unpatched, medium-severity issue affecting all Kubernetes versions, CVE-2020-8554 can be mitigated in several ways. --------------------------------------------- https://unit42.paloaltonetworks.com/cve-2020-8554/ ∗∗∗ BlackBerry Powered by Android Security Bulletin - December 2020 ∗∗∗ --------------------------------------------- http://support.blackberry.com/kb/articleDetail?language=en_US&articleNumber… ∗∗∗ Security Bulletin: A vulnerability in IBM Java Runtime affect IBM Spectrum Conductor and IBM Spectrum Conductor with Spark ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-ibm-ja… ∗∗∗ Security Bulletin: Publicly disclosed vulnerability from Bind affects IBM Netezza Host Management ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-publicly-disclosed-vulner… ∗∗∗ Security Bulletin: Apache Poi as used by IBMQRadar SIEM is vulnerable to information disclosure (CVE-2019-12415, CVE-2017-12626) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-apache-poi-as-used-by-ibm… ∗∗∗ Apache Struts vulnerability CVE-2020-17530 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K24608264 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 21.12.2020
by Daily end-of-shift report 21 Dec '20

21 Dec '20

===================== = End-of-Day report = ===================== Timeframe: Freitag 18-12-2020 18:00 − Montag 21-12-2020 18:00 Handler: Thomas Pribitzer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Aktuelle Welle mit Ping-Anrufen ∗∗∗ --------------------------------------------- Die Rundfunk und Telekom Regulierungs-GmbH (RTR) erhält derzeit vermehrt Meldungen zu Ping-Anrufen aus dem Ausland. Die Anrufe kommen insbesondere aus Tunesien (+216), Abchasien (+79407), der Schweiz (+41748) und Uganda (+256). Hier darf nicht zurückgerufen oder abgehoben werden, denn dies kann hohe Kosten verursachen. --------------------------------------------- https://www.watchlist-internet.at/news/aktuelle-welle-mit-ping-anrufen/ ∗∗∗ Gitpaste-12 worm botnet returns with 30+ vulnerability exploits ∗∗∗ --------------------------------------------- Recently discovered Gitpaste-12 worm that spreads via GitHub and also hosts malicious payload on Pastebin, has returned with over 30 vulnerability exploits, according to researchers at Juniper Labs. --------------------------------------------- https://www.bleepingcomputer.com/news/security/gitpaste-12-worm-botnet-retu… ∗∗∗ Hacker Dumps Crypto Wallet Customer Data; Active Attacks Follow ∗∗∗ --------------------------------------------- Customer data from a June attack against cryptocurrency wallet firm Ledger is now public and actively being used in attacks. --------------------------------------------- https://threatpost.com/ledger-dump-active-attacks-follow/162477/ ===================== = Vulnerabilities = ===================== ∗∗∗ ZDI-20-1452: (0Day) Microsoft 3D Builder GLB File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft 3D Builder. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-20-1452/ ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (curl, influxdb, lxml, node-ini, php-pear, and postsrsd), Fedora (chromium, curl, firefox, matrix-synapse, mingw-jasper, phpldapadmin, and thunderbird), Mageia (openjpeg2), openSUSE (gcc7, openssh, PackageKit, python-urllib3, slurm_18_08, and webkit2gtk3), Oracle (fapolicydbug, firefox, nginx:1.16, nodejs:12, and thunderbird), Red Hat (libpq, openssl, and thunderbird), and SUSE (curl, firefox, openssh, ovmf, slurm_17_11, slurm_18_08, slurm_20_02, and [...] --------------------------------------------- https://lwn.net/Articles/840972/ ∗∗∗ Authentication Bypass Vulnerability Patched in Bouncy Castle Library ∗∗∗ --------------------------------------------- A high-severity authentication bypass vulnerability was recently addressed in the Bouncy Castle cryptography library. Founded in 2000, the project represents a collection of APIs used in cryptography for both Java and C#, with a strong emphasis on standards compliance and adaptability. --------------------------------------------- https://www.securityweek.com/authentication-bypass-vulnerability-patched-bo… ∗∗∗ Treck TCP/IP Stack ∗∗∗ --------------------------------------------- This advisory contains mitigations for Heap-based Buffer Overflow, Out-of-bounds Read, and Out-of-bounds Write vulnerabilities in Trecks TCP/IP stack, which may also be known as Kasago TCP/IP, ELMIC, Net+ OS, Quadnet, GHNET v2, Kwiknet, or AMX. --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-20-353-01 ∗∗∗ December 21, 2020 TNS-2020-11 [R1] Tenable.sc 5.17.0 Fixes Multiple Vulnerabilities ∗∗∗ --------------------------------------------- https://www.tenable.com/security/tns-2020-11 ∗∗∗ HCL Domino und Notes: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K20-1254 ∗∗∗ Red Hat OpenShift: Schwachstelle ermöglicht Denial of Service und Codeausführung ∗∗∗ --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K20-1252 ∗∗∗ Security Bulletin: Information disclosure and Denial of Service vulnerability affect IBM Business Automation Workflow and IBM Business Process Manager (BPM) – CVE-2020-4794 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-information-disclosure-an… ∗∗∗ Security Bulletin: Financial Transaction Manager for ACH Services is affected by a potential logout session timeout (CVE-2020-4555) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-financial-transaction-man… ∗∗∗ Security Bulletin: Financial Transaction Manager for Check Services is affected by a potential logout session timeout (CVE-2020-4555) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-financial-transaction-man… ∗∗∗ Security Bulletin: IBM MQ could allow an authenticated user, under nondefault configuration to cause a data corruption attack due to an error when using segmented messages. (CVE-2020-4592) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-could-allow-an-aut… ∗∗∗ Security Bulletin: Vulnerability in BIND affects AIX (CVE-2020-8622) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-bind-aff… ∗∗∗ Security Bulletin: Multiple vulnerabilities in the IBM Java Runtime affect IBM Rational ClearQuest ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: IBM MQ Appliance is affected by denial of service vulnerabilities (CVE-2020-5481, CVE-2020-4580, CVE-2020-4579) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-appliance-is-affec… ∗∗∗ Security Bulletin: Multiple vulnerabilities in middleware software affect IBM Cloud Pak for Automation ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Financial Transaction Manager for Corporate Payment Services is affected by a potential logout session timeout (CVE-2020-4555) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-financial-transaction-man… ∗∗∗ Security Bulletin: Financial Transaction Manager for Corporate Payment Services v2.1.1 is affected by a potential logout session timeout (CVE-2020-4555) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-financial-transaction-man… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 18.12.2020
by Daily end-of-shift report 18 Dec '20

18 Dec '20

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 17-12-2020 18:00 − Freitag 18-12-2020 18:00 Handler: Dimitri Robl Co-Handler: Robert Waldner ===================== = News = ===================== ∗∗∗ Security baseline (FINAL) for Windows 10 and Windows Server, version 20H2 ∗∗∗ --------------------------------------------- We are pleased to announce the final release of the for Windows 10 and Windows Server, version 20H2 (a.k.a. October 2020 Update) security baseline package! --------------------------------------------- https://techcommunity.microsoft.com/t5/microsoft-security-baselines/securit… ∗∗∗ A slightly optimistic tale of how patching went for CVE-2019-19781, (Fri, Dec 18th) ∗∗∗ --------------------------------------------- Since we could all probably use a little distraction from the current Solarigate/SUNBURST news, I thought it might be good to look at something a little bit more positive today. Specifically, at how patching of CVE-2019-19781 AKA "Shitrix" AKA "one of the more famous named vulnerabilities from the end of 2019" went. --------------------------------------------- https://isc.sans.edu/diary/rss/26900 ∗∗∗ E-Mails mit gefälschten Domain-Rechnungen im Umlauf ∗∗∗ --------------------------------------------- Derzeit erhalten Unternehmen E-Mails, in denen vorgegeben wird, dass sie für eine Domainregistrierung die Rechnung bezahlen müssten. Tatsächlich haben die EmpfängerInnen jedoch keinen derartigen Auftrag erteilt. Daher sollten Sie nichts bezahlten und die E-Mail ignorieren. --------------------------------------------- https://www.watchlist-internet.at/news/e-mails-mit-gefaelschten-domain-rech… ∗∗∗ SUPERNOVA: SolarStorm’s Novel .NET Webshell ∗∗∗ --------------------------------------------- The SolarStorm actors behind the supply chain attack on SolarWinds' Orion software have demonstrated a high degree of technical sophistication and attention to operational security, as well as a novel combination of techniques in the potential compromise of approximately 18,000 SolarWinds customers. As published in the original disclosure, the attackers were observed removing their initial backdoor once a more legitimate method of persistence was obtained. --------------------------------------------- https://unit42.paloaltonetworks.com/solarstorm-supernova/ ∗∗∗ Operation SignSight: Supply‑chain attack against a certification authority in Southeast Asia ∗∗∗ --------------------------------------------- ESET researchers uncovered this new supply-chain attack in early December 2020 and notified the compromised organization and the VNCERT. We believe that the website has not been delivering compromised software installers as of the end of August 2020 and ESET telemetry data does not indicate the compromised installers being distributed anywhere else. The Vietnam Government Certification Authority confirmed that they were aware of the attack before our notification and that they notified the users who downloaded the trojanized software. --------------------------------------------- https://www.welivesecurity.com/2020/12/17/operation-signsight-supply-chain-… ∗∗∗ Updates zu SolarWinds Orion ∗∗∗ --------------------------------------------- Die Situation um den Supply-Chain Angriff auf SolarWinds Orion Produkt ist um einige Facetten reichter geworden: --------------------------------------------- https://cert.at/de/aktuelles/2020/12/updates-zu-solarwinds-orion ===================== = Vulnerabilities = ===================== ∗∗∗ ZDI-20-1452: NETGEAR Multiple Routers mini_httpd Command Injection Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6020, R6080, R6120, R6220, R6260, R6700v2, R6800, R6900v2, R7450, JNR3210, WNR2020, Nighthawk AC2100, and Nighthawk AC2400 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-20-1452/ ∗∗∗ ZDI-20-1451: NETGEAR Multiple Routers mini_httpd Authentication Bypass Vulnerability ∗∗∗ --------------------------------------------- This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6020, R6080, R6120, R6220, R6260, R6700v2, R6800, R6900v2, R7450, JNR3210, WNR2020, Nighthawk AC2100, and Nighthawk AC2400 routers. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-20-1451/ ∗∗∗ VMSA-2020-0029 VMware ESXi, Workstation, Fusion and Cloud Foundation updates address a denial of service vulnerability (CVE-2020-3999) ∗∗∗ --------------------------------------------- A denial of service vulnerability in VMware ESXi, Workstation and Fusion was privately reported to VMware. Updates are available to address this vulnerability in affected VMware products. --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2020-0029.html ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (blueman, chromium, gdk-pixbuf2, hostapd, lib32-gdk-pixbuf2, minidlna, nsd, pam, and unbound), CentOS (gd, openssl, pacemaker, python-rtslib, samba, and targetcli), Debian (kernel, lxml, and mediawiki), Fedora (mbedtls), openSUSE (clamav and openssl-1_0_0), Oracle (firefox and openssl), Red Hat (openssl, postgresql:12, postgresql:9.6, and thunderbird), Scientific Linux (openssl and thunderbird), and SUSE (cyrus-sasl, openssh, slurm_18_08, and webkit2gtk3). --------------------------------------------- https://lwn.net/Articles/840731/ ∗∗∗ D-LINK Router DSL-2888A: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in D-LINK Router ausnutzen, um die Authentisierung zu umgehen, seine Rechte zu erweitern, Code auszuführen oder Informationen offenzulegen. --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-1246 ∗∗∗ Security Bulletin: z/TPF is affected by an OpenSSL vulnerability ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-z-tpf-is-affected-by-an-o… ∗∗∗ Security Bulletin: IBM Planning Analytics has addressed a security vulnerability (CVE-2020-4764) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-planning-analytics-ha… ∗∗∗ Security Bulletin: Version 12.18.0 of Node.js included in IBM Netcool Operations Insight 1.6.2.x has several security vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-version-12-18-0-of-node-j… ∗∗∗ Emerson Rosemount X-STREAM ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-20-352-01 ∗∗∗ PTC Kepware KEPServerEX ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-20-352-02 ∗∗∗ PTC Kepware LinkMaster ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-20-352-03 ∗∗∗ ctrlX Products affected by OpenSSL Vulnerability CVE-2020-1971 ∗∗∗ --------------------------------------------- https://psirt.bosch.com/security-advisories/bosch-sa-274557.html -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 17.12.2020
by Daily end-of-shift report 17 Dec '20

17 Dec '20

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 16-12-2020 18:00 − Donnerstag 17-12-2020 18:00 Handler: Robert Waldner Co-Handler: Dimitri Robl ===================== = News = ===================== ∗∗∗ Maximizing Your Defense with Windows DNS Logging ∗∗∗ --------------------------------------------- In part 3 of 5 of this blog series, learn how to improve your log collection deployment. Follow a sample Windows log scenario and receive a deployment checklist to help optimize your DNS logging. --------------------------------------------- https://www.domaintools.com/resources/blog/maximizing-your-defense-with-win… ∗∗∗ IoT: Wenn Sicherheitsrisiken unter dem Weihnachtsbaum landen ∗∗∗ --------------------------------------------- Experten haben beliebte, vernetzte Gadgets auf Sicherheitslücken und Datenhunger untersucht und Erschreckendes festgestellt. --------------------------------------------- https://futurezone.at/netzpolitik/iot-wenn-sicherheitsrisiken-unterm-weihna… ∗∗∗ DNS Logs in Public Clouds, (Wed, Dec 16th) ∗∗∗ --------------------------------------------- The current Solarwinds/Sunburst/Fireeye incident and its associated command&control (C2) traffic to avsvmcloud[.]com domains have spurred potentially affected Solarwinds customers to searching their logs and data for any presence of this C2 domain. --------------------------------------------- https://isc.sans.edu/diary/rss/26892 ∗∗∗ The NoneNone Brute Force Attacks: Even Hackers Need QA ∗∗∗ --------------------------------------------- For the last few weeks we’ve seen and blocked an increase in brute-force, credential stuffing, and dictionary attacks targeting the WordPress xmlrpc.php endpoint, on some days exceeding 150 million attacks against 1.9 million sites in a 24-hour period. --------------------------------------------- https://www.wordfence.com/blog/2020/12/the-nonenone-brute-force-attacks-eve… ===================== = Vulnerabilities = ===================== ∗∗∗ WordPress plugin with 5 million installs has a critical vulnerability ∗∗∗ --------------------------------------------- The team behind a popular WordPress plugin has disclosed a critical file upload vulnerability and issued a patch. The vulnerable plugin, Contact Form 7, has over 5 million active installations making this upgrade a necessity for WordPress site owners out there. --------------------------------------------- https://www.bleepingcomputer.com/news/security/wordpress-plugin-with-5-mill… ∗∗∗ CVE-2020-25695 Privilege Escalation in Postgresql ∗∗∗ --------------------------------------------- This is my first and probably only post for the year, and covers a fun privilege escalation vulnerability I found in Postgresql. This affects all supported versions of Postgresql going back to 9.5, it is likely it affects most earlier versions as well. (Notiz: fehlerbereinigte Versionen wurden am 12. Nov. 2020 veröffentlicht.) --------------------------------------------- https://staaldraad.github.io/post/2020-12-15-cve-2020-25695-postgresql-priv… ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (firefox-esr, sympa, thunderbird, tomcat8, and xerces-c), Fedora (fprintd, kernel, libfprint, and synergy), Mageia (bitcoin, dpic, firefox, jasper, jupyter-notebook, sam2p, thunderbird, and x11-server), Oracle (firefox, gd, kernel, net-snmp, openssl, python-rtslib, samba, and targetcli), Red Hat (fapolicyd, openshift, Red Hat Virtualization, and web-admin-build), SUSE (xen), and Ubuntu (unzip). --------------------------------------------- https://lwn.net/Articles/840583/ ∗∗∗ Security Advisory - Out Of Bound Read Vulnerability in Huawei Smartphone ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20201216-… ∗∗∗ Security Advisory - Use after Free Vulnerability in Huawei Product ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20201216-… ∗∗∗ Security Advisory - Information Leak Vulnerability in Huawei Product ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20201216-… ∗∗∗ Security Advisory - Resource Management Errors Vulnerability in Huawei Smartphone Product ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20201216-… ∗∗∗ Security Bulletin: A GNU glibc vulnerability affects IBM Watson Text to Speech and Speech to Text (IBM Watson Speech Services for Cloud Pak for Data 1.2) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-gnu-glibc-vulnerability… ∗∗∗ Security Bulletin: IBM® Db2® is vulnerable to an information disclosure. (CVE-2020-4386) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-db2-is-vulnerable-to-… ∗∗∗ Security Bulletin: Spring Framework vulnerabilities affect IBM Watson Text to Speech and Speech to Text (IBM Watson Speech Services for Cloud Pak for Data 1.2) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-spring-framework-vulnerab… ∗∗∗ Security Bulletin: Apache Tomcat vulnerabilities affect IBM Watson Text to Speech and Speech to Text (IBM Watson Speech Services for Cloud Pak for Data 1.2) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-apache-tomcat-vulnerabili… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect Rational Performance Tester ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Java Vulnerablity affects IBM Watson Speech Services for Cloud Pak for Data 1.2 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-java-vulnerablity-affects… ∗∗∗ Security Bulletin: Multiple Vulnerabilities Have Been Identified In IBM Security Verify Privilege Manager previously known as IBM Security Privilege Manager ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Vulnerability in IBM Java SDK and IBM Java Runtime affects Rational Performance Tester ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-ibm-java… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect Rational Service Tester ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect z/TPF ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ F5 BIG-IP: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-1245 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 16.12.2020
by Daily end-of-shift report 16 Dec '20

16 Dec '20

===================== = End-of-Day report = ===================== Timeframe: Dienstag 15-12-2020 18:00 − Mittwoch 16-12-2020 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Video: Sicher einkaufen im Amazon Marketplace ∗∗∗ --------------------------------------------- Auf Amazon können Sie direkt von Amazon, aber auch von unabhängigen Marketplace-Händlerinnen und Händlern bestellen. Vor allem im Marketplace treiben aber auch Kriminelle ihr Unwesen! In diesem Video erfahren Sie, was der Marketplace ist und vor allem wie Sie auch im Marketplace sicher bestellen. --------------------------------------------- https://www.watchlist-internet.at/news/video-sicher-einkaufen-im-amazon-mar… ===================== = Vulnerabilities = ===================== ∗∗∗ HPE discloses critical zero-day in server management software ∗∗∗ --------------------------------------------- Hewlett Packard Enterprise (HPE) has disclosed a zero-day bug in the latest versions of its proprietary HPE Systems Insight Manager (SIM) software for Windows and Linux. While security updates are not yet available for this remote code execution (RCE) vulnerability, HPE has provided Windows mitigation info and is working on addressing the zero-day. ... The vulnerability ... is tracked as CVE-2020-7200 and it affects HPE Systems Insight Manager (SIM) 7.6.x. --------------------------------------------- https://www.bleepingcomputer.com/news/security/hpe-discloses-critical-zero-… ∗∗∗ VMSA-2020-0028 VMware Carbon Black Cloud macOS Sensor installer file overwrite issue (CVE-2020-4008) ∗∗∗ --------------------------------------------- The installer of the macOS Sensor for VMware Carbon Black Cloud handles certain files in an insecure way. VMware has evaluated the severity of this issue to be in the Low severity range with a CVSSv3 base score of 3.6. --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2020-0028.html ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (firefox-esr), Fedora (mingw-openjpeg2, openjpeg2, and synergy), openSUSE (audacity and gdm), Oracle (libexif, libpq, and thunderbird), Red Hat (firefox, gnutls, go-toolset:rhel8, java-1.7.1-ibm, java-1.8.0-ibm, kernel, kernel-rt, linux-firmware, mariadb-connector-c, mariadb:10.3, memcached, net-snmp, nginx:1.16, nodejs:12, openssl, pacemaker, postgresql:10, python-django-horizon, python-XStatic-Bootstrap-SCSS, python-XStatic-jQuery, python-XStatic-jQuery224 and python-django-horizon), Scientific Linux (gd, kernel, pacemaker, python-rtslib, samba and targetcli), SUSE (PackageKit, openssh, spice and spice-gtk), Ubuntu (firefox and imagemagick). --------------------------------------------- https://lwn.net/Articles/840398/ ∗∗∗ ABB Central Licensing System Vulnerabilities, impact on Symphony Plus, Composer Harmony, Composer Melody, Harmony OPC Server ∗∗∗ --------------------------------------------- https://search.abb.com/library/Download.aspx?DocumentID=2PAA123981&Language… ∗∗∗ ABB Multiple Vulnerabilities in Symphony PlusHistorian ∗∗∗ --------------------------------------------- https://search.abb.com/library/Download.aspx?DocumentID=2PAA123982&Language… ∗∗∗ ABB Multiple Vulnerabilities in Symphony Plus Operations ∗∗∗ --------------------------------------------- https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&Language… ∗∗∗ Security Advisory - Improper Authentication Vulnerability in Some Huawei Products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20200318-… ∗∗∗ Security Advisory - Out of Bound Read Vulnerability in Huawei Product ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20201216-… ∗∗∗ Security Advisory - Improper Authentication Vulnerability in Huawei Product ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20201216-… ∗∗∗ Security Advisory - Out Of Bound Read Vulnerability in Huawei Smartphone ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20201216-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect IBM QRadar SIEM ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: PostgresSQL JDBC Driver as used in IBM QRadar SIEM is vulnerable to information disclosure (CVE-2020-13692) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-postgressql-jdbc-driver-a… ∗∗∗ Security Bulletin: Open Source Security issues for NPS console. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-open-source-security-issu… ∗∗∗ Security Bulletin: Multiple Security Vulnerabilities Affect IBM WebSphere Application Server in IBM Cloud ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnera… ∗∗∗ Security Bulletin: Apache Santuario as used in IBM QRadar SIEM is vulnerable to improper input validation (CVE-2019-12400) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-apache-santuario-as-used-… ∗∗∗ Security Bulletin: IBM RackSwitch firmware products are affected by a vulnerability in the Kernel (CVE-2020-12464) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-rackswitch-firmware-p… ∗∗∗ Security Bulletin: A security vulnerability in Node.js npm package affects IBM Cloud Pak for Multicloud Management Managed Service. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: App Connect Enterprise Certified Container may be vulnerable to buffer overflows, Denial of Service or HTTP request smuggling ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-app-connect-enterprise-ce… ∗∗∗ Security Bulletin: Netcool Operations Insight – Cloud Native Event Analytics is affected by an Apache Commons Codec vulnerability ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-netcool-operations-insigh… ∗∗∗ Security Bulletin: A security vulnerability in Node.js node-forge module affects IBM Cloud Pak for Multicloud Management Managed Service. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ QEMU vulnerability CVE-2020-14364 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K09081535?utm_source=f5support&utm_mediu… ∗∗∗ QEMU vulnerability CVE-2020-25084 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K41301038?utm_source=f5support&utm_mediu… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 15.12.2020
by Daily end-of-shift report 15 Dec '20

15 Dec '20

===================== = End-of-Day report = ===================== Timeframe: Montag 14-12-2020 18:00 − Dienstag 15-12-2020 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ SolarWinds hackers have a clever way to bypass multi-factor authentication ∗∗∗ --------------------------------------------- Hackers who hit SolarWinds compromised a think tank three separate times. --------------------------------------------- https://arstechnica.com/?p=1729836 ∗∗∗ Paypal‑Betrugsmaschen – Wie Sie sich schützen können ∗∗∗ --------------------------------------------- Paypal ist einer der größten und beliebtesten Zahlungsdienste und daher im Fadenkreuz vieler Cyberkrimineller. Wie kann man sich vor deren Tricks schützen? --------------------------------------------- https://www.welivesecurity.com/deutsch/2020/12/15/betrugsmaschen-der-paypal… ∗∗∗ Vorsicht: Gefälschte Benachrichtigungen von Paketdiensten im Umlauf ∗∗∗ --------------------------------------------- Warten Sie gerade auf ein Paket? Dann nehmen Sie sich vor gefälschten Benachrichtigungen per E-Mail oder SMS im Namen der Post, DHL oder anderen Paketdiensten in Acht! Kriminelle fälschen E-Mails bekannter Zustelldienste und behaupten darin, es müssten 1-2 Euro Zustellungs- oder Zollgebühren bezahlt werden. Wird diese Gebühr per Kreditkarte bezahlt, buchen Kriminelle Monat für Monat 50-90 Euro ab. --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-gefaelschte-benachrichtigun… ∗∗∗ Hospitals are leaving millions of sensitive medical images exposed online ∗∗∗ --------------------------------------------- Cybersecurity researchers discover millions of medical files and associated personal data left discoverable on the open web due to being stored insecurely. --------------------------------------------- https://www.zdnet.com/article/hospitals-are-leaving-millions-of-sensitive-m… ===================== = Vulnerabilities = ===================== ∗∗∗ Xen Security Advisories ∗∗∗ --------------------------------------------- Xen has released 15 Security Advisories. --------------------------------------------- https://xenbits.xen.org/xsa/ ∗∗∗ URL Spoofing Vulnerability in Bitdefender SafePay (VA-8958) ∗∗∗ --------------------------------------------- An Origin Validation Error vulnerability in the SafePay component of Bitdefender Antivirus Plus allows a web resource to misrepresent itself in the URL bar. This issue affects Bitdefender Antivirus Plus versions prior to 25.0.7.29. --------------------------------------------- https://www.bitdefender.com/support/security-advisories/url-spoofing-vulner… ∗∗∗ Apple security updates ∗∗∗ --------------------------------------------- Apple has released the following security updates: iOS 14.3 and iPadOS 14.3, macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, macOS Server 5.11, tvOS 14.3, watchOS 7.2, Safari 14.0.2, iOS 12.5, watchOS 6.3 --------------------------------------------- https://support.apple.com/en-us/HT201222 ∗∗∗ libarchive vulnerability CVE-2017-5601 ∗∗∗ --------------------------------------------- An error in the lha_read_file_header_1() function (archive_read_support_format_lha.c) in libarchive 3.2.2 allows remote attackers to trigger an out-of-bounds read memory access and subsequently cause a crash via a specially crafted archive. [...] The specified products contain the affected code. However, F5 identifies the vulnerability status as Not vulnerable because the attacker cannot exploit the code in default, standard, or recommended configurations. --------------------------------------------- https://support.f5.com/csp/article/K50543013 ∗∗∗ SECURITY BULLETIN: December 2020 Security Bulletin for Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 SP2 ∗∗∗ --------------------------------------------- Trend Micro has made a Critical Patch (CP) available for Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 SP2. This CP addresses multiple vulnerabilities related to CRSF protection bypass, cross-site scripting (XSS), authorization/authentication bypass, command execution and unauthenticated command injections. --------------------------------------------- https://success.trendmicro.com/solution/000283077 ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (libxstream-java and xen), Fedora (curl), openSUSE (curl, kernel, mariadb, and openssl-1_1), Oracle (kernel, libexif, thunderbird, and xorg-x11-server), Red Hat (curl, gd, kernel, kernel-rt, linux-firmware, net-snmp, openssl, pacemaker, python-rtslib, samba, targetcli, and xorg-x11-server), Scientific Linux (libexif, thunderbird, and xorg-x11-server), and SUSE (clamav, gdm, and kernel). --------------------------------------------- https://lwn.net/Articles/840217/ ∗∗∗ Synology-SA-20:28 File Station ∗∗∗ --------------------------------------------- A vulnerability allows remote attackers to read arbitrary files via a susceptible version of File Station. --------------------------------------------- https://www.synology.com/en-global/support/security/Synology_SA_20_28 ∗∗∗ Citrix Hypervisor Security Update ∗∗∗ --------------------------------------------- Several security issues have been identified that, collectively, may allow privileged code running in a guest VM to compromise the host or cause a denial of service. --------------------------------------------- https://support.citrix.com/article/CTX286756 ∗∗∗ WAGO Series 750-88x and 750-352 (Update A) ∗∗∗ --------------------------------------------- This updated advisory is a follow-up to the original advisory titled ICSA-20-308-01 WAGO Series 750-88x and 750-352 that was published November 3, 2020, on the ICS webpage on us-cert.gov. This advisory contains mitigations for an Uncontrolled Resource Consumption vulnerability in the WAGO Fieldbus Ethernet coupler. --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-20-308-01 ∗∗∗ Eclipse Jetty vulnerability CVE-2019-10241 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K01869532 ∗∗∗ HCL Domino: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit den Rechten des Dienstes ∗∗∗ --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K20-1237 ∗∗∗ Red Hat Enterprise Linux: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen ∗∗∗ --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K20-1238 ∗∗∗ Security Bulletin: A security vulnerability in angular.js affects IBM Cloud Pak for Multicloud Management Infrastructure Management and Managed Service. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: Gradle version in IBP javaenv and dind images depends on vulnerable Apache Ant ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-gradle-version-in-ibp-jav… ∗∗∗ Security Bulletin: A security vulnerability in GO affects IBM Cloud Pak for Multicloud Management Managed Service. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: Vulnerability in nss and nspr CVE-2019-17006. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-nss-and-… ∗∗∗ Security Bulletin: A vulnerability have been identified in jwt-go shipped with IBM Netcool Operations Insight Event Integrations Operator (CVE-2020-26160) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-have-been… ∗∗∗ Security Bulletin: A security vulnerability in Node.js serialize-javascript affects IBM Cloud Pak for Multicloud Management Managed Service. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: IBP javaenv and dind images ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibp-javaenv-and-dind-imag… ∗∗∗ Security Bulletin: A security vulnerability in Node.js acorn and bootstrap-select affects IBM Cloud Pak for Multicloud Management Infrastructure Management and Managed Service. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: A security vulnerability in GO affects IBM Cloud Pak for Multicloud Management Managed Service. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: Vulnerability in libssh2 CVE-2019-17498. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-libssh2-… ∗∗∗ ZDI-20-1444: (0Day) Eaton EASYsoft E70 File Parsing Type Confusion Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-20-1444/ ∗∗∗ ZDI-20-1443: (0Day) Eaton EASYsoft E70 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-20-1443/ ∗∗∗ ZDI-20-1442: (0Day) Eaton EASYsoft E70 File Parsing Type Confusion Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-20-1442/ ∗∗∗ ZDI-20-1441: (0Day) Eaton EASYsoft E70 File Parsing Type Confusion Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-20-1441/ ∗∗∗ ZDI-20-1429: D-Link DAP-1860 uhttpd Authentication Bypass Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-20-1429/ ∗∗∗ ZDI-20-1428: D-Link DAP-1860 HNAP Authorization Command Injection Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-20-1428/ ∗∗∗ ZDI-20-1427: D-Link Multiple Routers dhttpd Authentication Bypass Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-20-1427/ ∗∗∗ ZDI-20-1426: D-Link Multiple Routers dhttpd Command Injection Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-20-1426/ ∗∗∗ ZDI-20-1438: (0Day) D-Link DCS-960L HTTP Authorization Header Stack-based Buffer Overflow Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-20-1438/ ∗∗∗ ZDI-20-1437: (0Day) D-Link DCS-960L HNAP LoginPassword Incorrect Implementation of Authentication Algorithm Authentication Bypass Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-20-1437/ ∗∗∗ ZDI-20-1436: (0Day) D-Link DCS-960L HNAP Login Cookie Format String Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-20-1436/ ∗∗∗ ZDI-20-1435: (0Day) D-Link DCS-960L HNAP Cookie Format String Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-20-1435/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 14.12.2020
by Daily end-of-shift report 14 Dec '20

14 Dec '20

===================== = End-of-Day report = ===================== Timeframe: Freitag 11-12-2020 18:00 − Montag 14-12-2020 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Backdoor in SolarWinds Orion ∗∗∗ --------------------------------------------- Nach einem erfolgreichen Angriff auf den IT-Security-Dienstleister FireEye in der vergangen Woche, wurden neue Informationen zu dem Vorfall veröffentlicht. Wie nun bekannt wurde, erfolgten die Angriffe mittels einer sogenannten "Supply-Chain-Attack"; sowohl SolarWinds als auch FireEye berichten, dass die AngreiferInnen bei einem erfolgreichen Angriff auf SolarWinds eine Hintertür in Updates für das Produkt "SolarWinds Orion" eingeschleust haben. Betroffen sind [...] --------------------------------------------- https://cert.at/de/aktuelles/2020/12/backdoor-in-solarwinds-orion ∗∗∗ pfSense Firewall Configuration Audit with pfAudit ∗∗∗ --------------------------------------------- pfSense is a very popular free and open source firewall solution. It does not only provide classic firewall services but has plenty of features like VPN server or can offer DNS, DHCP, proxy services [...] --------------------------------------------- https://blog.rootshell.be/2020/12/14/pfsense-firewall-configuration-audit-w… ∗∗∗ PyMICROPSIA: New Information-Stealing Trojan from AridViper ∗∗∗ --------------------------------------------- We've identified a new information-stealing Trojan we call PyMICROPSIA, related to the previously identified MICROPSIA malware family. --------------------------------------------- https://unit42.paloaltonetworks.com/pymicropsia/ ===================== = Vulnerabilities = ===================== ∗∗∗ Patchday: Google schließt gefährliche Lücken in Android 8.0 bis 11 ∗∗∗ --------------------------------------------- Es sind wichtige Sicherheitsupdates für eine Reihe von Android-Versionen erschienen. Angreifer könnten unter anderem Schadcode ausführen. --------------------------------------------- https://heise.de/-4988647 ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (lxml, openexr, openssl, and openssl1.0), Fedora (libpri, libxls, mediawiki, nodejs, opensc, php-wikimedia-assert, php-zordius-lightncandy, squeezelite, and wireshark), openSUSE (curl, openssh, openssl-1_0_0, python-urllib3, and rpmlint), Red Hat (libexif, libpq, and thunderbird), Slackware (p11), SUSE (kernel, Kubernetes, etcd, helm, openssl, openssl-1_0_0, and python), and Ubuntu (linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, [...] --------------------------------------------- https://lwn.net/Articles/840110/ ∗∗∗ Zero-Day-Lücke im WordPress-SMTP-Plug-in erlaubt das Zurücksetzen von Admin-Passwörtern ∗∗∗ --------------------------------------------- Das Plug-in speichert eine Log-Datei in einem unter Umständen unsicheren Verzeichnis. Hacker erhalten so Zugriff auf die Datei, die auch Links zum Zurücksetzen von Administrator-Passwörtern aufzeichnet. Inzwischen steht ein Patch für die Schwachstelle zur Verfügung. --------------------------------------------- https://www.zdnet.de/88390454/zero-day-luecke-im-wordpress-smtp-plug-in-erl… ∗∗∗ BIND vulnerability CVE-2020-8624 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K91090139 ∗∗∗ Apache Struts vulnerability CVE-2012-0392 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K13434228 ∗∗∗ Apache Struts vulnerability CVE-2012-0391 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K20127031 ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Security SiteProtector System ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: IBM Resilient Platform could allow formula injection in Excel (CVE-2020-4633) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-resilient-platform-co… ∗∗∗ Security Bulletin: IBM Cloud Transformation Advisor is affected by a Node.js vulnerability ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cloud-transformation-… ∗∗∗ Security Bulletin: Security Vulnerabilities in GNU glibc affect IBM Cloud Pak for Data – GNU glibc (CVE-2020-1751) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-security-vulnerabilities-… ∗∗∗ Security Bulletin: Apache Commons Codec could allow a remote attacker to obtain sensitive information, caused by the improper validation of input. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-apache-commons-codec-coul… ∗∗∗ Security Bulletin: Apache Hadoop could allow a remote attacker to obtain sensitive information that could affect IBM Streams. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-apache-hadoop-could-allow… ∗∗∗ Security Bulletin: App Connect Enterprise Certified Container may be vulnerable to man in the middle attack through use of OpenSSL (CVE-2019-1551) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-app-connect-enterprise-ce… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK affects WebSphere Application Server October 2020 CPU that is bundled with IBM WebSphere Application Server Patterns ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Java vulnerability CVE-2020-2590 affecting IBM Streams ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-java-vulnerability-cve-20… ∗∗∗ Security Bulletin: Open Source Security issues for NPS service provider ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-open-source-security-issu… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 11.12.2020
by Daily end-of-shift report 11 Dec '20

11 Dec '20

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 10-12-2020 18:00 − Freitag 11-12-2020 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Widespread malware campaign seeks to silently inject ads into search results, affects multiple browsers ∗∗∗ --------------------------------------------- A persistent malware campaign has been actively distributing Adrozek, an evolved browser modifier malware at scale since at least May 2020. At its peak in August, the threat was observed on over 30,000 devices every day. The malware is designed to inject ads into search engine results pages and affects multiple browsers. --------------------------------------------- https://www.microsoft.com/security/blog/2020/12/10/widespread-malware-campa… ∗∗∗ Symantec Messaging Gateway könnte Passwörter leaken ∗∗∗ --------------------------------------------- Es ist ein wichtiges Sicherheitsupdate für Symantec Messaging Gateway erschienen. --------------------------------------------- https://heise.de/-4986723 ∗∗∗ PoC Released for Unpatched Windows Vulnerability Present Since 2006 ∗∗∗ --------------------------------------------- Details and a proof-of-concept (PoC) exploit have been released for an unpatched privilege escalation vulnerability in Windows related to the PsExec administration tool. The vulnerability was discovered by Tenable researcher David Wells and it was disclosed this week after Microsoft failed to release a patch within 90 days. --------------------------------------------- https://www.securityweek.com/poc-released-unpatched-windows-vulnerability-p… ∗∗∗ myusenet.de, bigusenet.de & Co.: Neue betrügerische Streaming-Plattformen führen in Abofalle! ∗∗∗ --------------------------------------------- Immer wieder berichtet die Watchlist Internet von betrügerischen Streaming-Plattformen, die in die Abofalle führen. Derzeit gehen zahlreiche Meldungen bei uns ein, die vor myusenet.de, foxusenet.de bigusenet.de und megausenet.de warnen. Diese neuen Streaming-Plattformen sehen zwar anders aus als die üblichen Fake-Streaming-Plattformen, die Masche bleibt aber die gleiche: Nach einer Registrierung, erhalten Sie eine Zahlungsaufforderung von 384 Euro. --------------------------------------------- https://www.watchlist-internet.at/news/myusenetde-bigusenetde-co-neue-betru… ∗∗∗ Update now: Researchers warn of security vulnerabilities in these widely used point-of-sale terminals ∗∗∗ --------------------------------------------- Security researchers disclose vulnerabilities including default passwords in two of the largest PoS manufacturers in the world. --------------------------------------------- https://www.zdnet.com/article/update-now-researchers-warn-of-security-vulne… ===================== = Vulnerabilities = ===================== ∗∗∗ Adobe Releases Security Updates for Acrobat and Reader ∗∗∗ --------------------------------------------- Adobe has released security updates to address a vulnerability in Acrobat and Reader. An attacker could exploit this vulnerability to obtain sensitive information. --------------------------------------------- https://us-cert.cisa.gov/ncas/current-activity/2020/12/10/adobe-releases-se… ∗∗∗ Hotfix rüstet Firewalls und Router von Sophos gegen Attacken ∗∗∗ --------------------------------------------- Unter bestimmten Voraussetzungen könnten Angreifer das Netzwerkbetriebssystem Cyberoam attackieren. --------------------------------------------- https://heise.de/-4986665 ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (minidlna and x11vnc), Fedora (pam), openSUSE (chromium, minidlna, nsd, openssl-1_1, and pngcheck), SUSE (gcc7 and kernel), and Ubuntu (lxml and squirrelmail). --------------------------------------------- https://lwn.net/Articles/839861/ ∗∗∗ OpenSSL vulnerability CVE-2020-1968 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K92451315 ∗∗∗ F5 TMM vulnerability CVE-2020-5950 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K05204103 ∗∗∗ F5 TMUI XSS vulnerability CVE-2020-5948 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K42696541 ∗∗∗ TMM vulnerability CVE-2020-27713 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K37960100 ∗∗∗ BIG-IP LTM vulnerability CVE-2020-5949 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K20984059 ∗∗∗ Security Bulletin: IBM Resilient Platform could allow formula injection in Excel (CVE-2020-4633) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-resilient-platform-co… ∗∗∗ Security Bulletin: NGINX vulnerability CVE-2019-20372 impacts IBM Aspera High-Speed Transfer Server and Aspera High-Speed Transfer Endpoint versions prior to V4.0 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-nginx-vulnerability-cve-2… ∗∗∗ Security Bulletin: IBM® Db2® is vulnerable to a buffer overflow (CVE-2020-4701) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-db2-is-vulnerable-to-… ∗∗∗ Security Bulletin: Fixed CP4D timeout for IBM Netezza for Cloud Pak for Data 11.1.1.0 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-fixed-cp4d-timeout-for-ib… ∗∗∗ Security Bulletin: OpenSSL vulnerability CVE-2020-1968 impacts IBM Aspera Streaming/IBM Aspera Streaming for Video version 3.9.6.1 and earlier ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-openssl-vulnerability-cve… ∗∗∗ Security Bulletin: App Connect Enterprise Certified Container is vulnerable to code injection and Denial of Service attacks ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-app-connect-enterprise-ce… ∗∗∗ Security Bulletin: HAProxy vulnerability CVE-2019-18277 impacts IBM Aspera High-Speed Transfer Server and Aspera High-Speed Transfer Endpoint versions prior to V4.0 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-haproxy-vulnerability-cve… ∗∗∗ Security Bulletin: IBM® Db2® is vulnerable to buffer overflow leading to a privileged escalation (CVE-2020-4363) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-db2-is-vulnerable-to-… ∗∗∗ Security Bulletin: IBM® Db2® is vulnerable to an information disclosure. (CVE-2020-4387) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-db2-is-vulnerable-to-… ∗∗∗ Security Bulletin: App Connect Enterprise Certified Container Integration Servers could cause a Denial of Service or a buffer overflow when using MQ ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-app-connect-enterprise-ce… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 10.12.2020
by Daily end-of-shift report 10 Dec '20

10 Dec '20

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 10-12-2020 18:00 − Donnerstag 10-12-2020 18:00 Handler: Stephan Richter Co-Handler: Dimitri Robl ===================== = News = ===================== ∗∗∗ Qbot malware switched to stealthy new Windows autostart method ∗∗∗ --------------------------------------------- A new Qbot malware version now activates its persistence mechanism right before infected Windows devices shutdown and it automatically removes any traces when the system restarts or wakes up from sleep. --------------------------------------------- https://www.bleepingcomputer.com/news/security/qbot-malware-switched-to-ste… ∗∗∗ Adobe Flash Player: Jetzt ist endgültig Schluss ∗∗∗ --------------------------------------------- Seit Jahren wird das Ende des Adobe Flash Players verkündet. Im Januar 2021 soll es nun aber tatsächlich so weit sein. --------------------------------------------- https://www.golem.de/news/adobe-flash-player-jetzt-ist-endgueltig-schluss-2… ∗∗∗ Python Backdoor Talking to a C2 Through Ngrok, (Thu, Dec 10th) ∗∗∗ --------------------------------------------- I spotted a malicious Python script that implements a backdoor. The interesting behavior is the use of Ngrok to connect to the C2 server. Ngrok has been used for a while by attackers. Like most services available on the Internet, it has been abused by attackers for a long time. --------------------------------------------- https://isc.sans.edu/diary/rss/26866 ∗∗∗ PGMiner: New Cryptocurrency Mining Botnet Delivered via PostgreSQL ∗∗∗ --------------------------------------------- PGMiner is a novel Linux-based cryptocurrency mining botnet that exploits a disputed PostgreSQL remote code execution vulnerability.The post PGMiner: New Cryptocurrency Mining Botnet Delivered via PostgreSQL appeared first on Unit42. --------------------------------------------- https://unit42.paloaltonetworks.com/pgminer-postgresql-cryptocurrency-minin… ∗∗∗ Hackers are selling more than 85,000 SQL databases on a dark web portal ∗∗∗ --------------------------------------------- Hackers break into databases, steal their content, hold it for ransom for 9 days, and then sell to the highest bidder if the DB owner doesnt want to pay the ransom demand. --------------------------------------------- https://www.zdnet.com/article/hackers-are-selling-more-than-85000-sql-datab… ∗∗∗ Proof-of-concept exploit code published for new Kerberos Bronze Bit attack ∗∗∗ --------------------------------------------- The Kerberos Bronze Bit attack can allow intruders to bypass authentication and access sensitive network services. --------------------------------------------- https://www.zdnet.com/article/proof-of-concept-exploit-code-published-for-n… ===================== = Vulnerabilities = ===================== ∗∗∗ Reflected XSS in PageLayer Plugin Affects Over 200,000 WordPress Sites ∗∗∗ --------------------------------------------- On November 4, 2020, the Wordfence Threat Intelligence team found two reflected Cross-Site Scripting (XSS) vulnerabilities in PageLayer, a WordPress plugin installed on over 200,000 sites. These vulnerabilities could lead to an attacker executing malicious Javascript in an administrator’s browser, which could lead to takeover of a vulnerable WordPress site. We contacted the plugin’s publisher, ...Read MoreThe post Reflected XSS in PageLayer Plugin Affects Over 200,000 WordPress --------------------------------------------- https://www.wordfence.com/blog/2020/12/reflected-xss-in-pagelayer-plugin-af… ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (ant, cimg, containerd, libproxy, libproxy-mozjs, libproxy-webkit, libslirp, python-lxml, tomcat8, tomcat9, and xorg-server), CentOS (firefox and thunderbird), Debian (apt, linux-4.19, python-apt, and sqlite3), Fedora (ceph, chromium, containerd, matrix-synapse, mingw-openjpeg2, openjpeg2, python-authlib, python-canonicaljson, and spice-gtk), Mageia (chromium-browser-stable), openSUSE (chromium and pngcheck), Slackware (curl), SUSE (clamav, curl, --------------------------------------------- https://lwn.net/Articles/839668/ ∗∗∗ Serious Vulnerabilities in Dualog Connection Suite ∗∗∗ --------------------------------------------- TL;DR The flaws found in this maritime comms and connection suite were many, and not insignificant: Directory traversal 2FA challenge/response is performed in a client-side application Default install password SQL […]The post Serious Vulnerabilities in Dualog Connection Suite first appeared on Pen Test Partners. --------------------------------------------- https://www.pentestpartners.com/security-blog/serious-vulnerabilities-in-du… ∗∗∗ Medtronic MyCareLink ∗∗∗ --------------------------------------------- This advisory contains mitigations for Improper Authentication, Heap-based Buffer Overflow, and Time-of-check Time-of-use Race Condition vulnerabilities in the Medtronic MyCareLink Patient Reader. --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsma-20-345-01 ∗∗∗ Mitsubishi Electric MELSEC iQ-F Series ∗∗∗ --------------------------------------------- This advisory contains mitigations for an Improper Check or Handling of Exceptional Conditions vulnerability in Mitsubishi Electrics MELSEC iQ-F series FX5U(C) CPU modules. --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-20-345-01 ∗∗∗ Host Engineering H2-ECOM100 Module ∗∗∗ --------------------------------------------- This advisory contains mitigations for an Improper Input Validation vulnerability in the Host Engineering ECOM100 Module, an Ethernet communications module for PLC systems. --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-20-345-02 ∗∗∗ Gafgyt Using Pulse Secure Vulnerability ∗∗∗ --------------------------------------------- SummaryA vulnerability in Pulse Secures Connect VPN framework is allowing for exploitation by Gafgyt. Avira details how this exploit works in a new blog.Threat TypeMalware, VulnerabilityOverviewAvira Labs has observed an increase in IoT malware binaries. These binaries have the capability to exploit CVE-2020-8218. This increase led to the discovery of a new variant of Gafgyt. Its functionality is mostly the same as the original Gafgyt with some inclusion of functionality from other malware --------------------------------------------- https://exchange.xforce.ibmcloud.com/collection/02145e80d8a7b87b486015b3588… ∗∗∗ Cisco Jabber Desktop and Mobile Client Software Vulnerabilities ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Security Bulletin: Vulnerabilities in Node.js affect IBM App Connect Enterprise V11 ( CVE-2020-8244) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-node-j… ∗∗∗ Security Bulletin: Vulnerabilities in OpenSSL affect IBM Integration Bus and IBM App Connect (CVE-2019-1552) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-openss… ∗∗∗ Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Node.js ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-watson-discovery-for-… ∗∗∗ Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Apache Commons Codec ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-watson-discovery-for-… ∗∗∗ Security Bulletin: Multiple vulnerabilities affect IBM® SDK for Node.js™ in IBM Cloud ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple Security Vulnerabilities in Apache Struts Affect IBM Sterling File Gateway (CVE-2019-0233, CVE-2019-0230) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnera… ∗∗∗ Security Bulletin: Vulnerability in Hibernate Validator affects Liberty for Java for IBM Cloud (CVE-2020-10693) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-hibernat… ∗∗∗ Security Bulletin: IBM® Db2® is vulnerable to a buffer overflow (CVE-2020-4701) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-db2-is-vulnerable-to-… ∗∗∗ Security Bulletin: JRE vulnerability (CVEID: 178768) impacts IBM Aspera High-Speed Transfer Server/IBM Aspera High-Speed Transfer Endpoint version 3.9.6.2 and earlier ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-jre-vulnerability-cveid-1… ∗∗∗ Security Bulletin: Vulnerability in ksu affects AIX (CVE-2020-4829) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-ksu-affe… ∗∗∗ Symantec Messaging Gateway: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-1222 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 09.12.2020
by Daily end-of-shift report 09 Dec '20

09 Dec '20

===================== = End-of-Day report = ===================== Timeframe: Montag 07-12-2020 18:00 − Mittwoch 09-12-2020 18:00 Handler: Stephan Richter Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ Credit card stealing malware bundles backdoor for easy reinstall ∗∗∗ --------------------------------------------- An almost impossible to remove malware set to automatically activate on Black Friday was deployed on multiple Magento-powered online stores by threat actors according to researchers at Dutch cyber-security company Sansec. --------------------------------------------- https://www.bleepingcomputer.com/news/security/credit-card-stealing-malware… ∗∗∗ Microsoft fixes new Windows Kerberos security bug in staged rollout ∗∗∗ --------------------------------------------- Microsoft has issued security updates to address a Kerberos security feature bypass vulnerability impacting multiple Windows Server versions in a two-phase staged rollout. --------------------------------------------- https://www.bleepingcomputer.com/news/security/microsoft-fixes-new-windows-… ∗∗∗ IT-Security: Hacker klauen Hacking-Werkzeuge von Fireeye ∗∗∗ --------------------------------------------- Das Security-Unternehmen versucht nun, das Schlimmste zu verhindern und gibt Tipps gegen die eigenen Angriffswerkzeuge. --------------------------------------------- https://www.golem.de/news/it-security-hacker-klauen-hacking-werkzeuge-von-f… ∗∗∗ OpenSSL behebt Speicherfehler ∗∗∗ --------------------------------------------- Ein Update beseitigt einen Null-Pointer-Zugriff, der laut Advisory zum Absturz führen kann. --------------------------------------------- https://heise.de/-4985050 ∗∗∗ Threat Assessment: Egregor Ransomware ∗∗∗ --------------------------------------------- Unit 42 shares courses of action that can help mitigate tactics, techniques and procedures used with Egregor ransomware. --------------------------------------------- https://unit42.paloaltonetworks.com/egregor-ransomware-courses-of-action/ ∗∗∗ njRAT Spreading Through Active Pastebin Command and Control Tunnel ∗∗∗ --------------------------------------------- Malware authors have been leveraging njRAT (AKA Bladabindi), a Remote Access trojan), to download and deliver second-stage payloads from Pastebin. --------------------------------------------- https://unit42.paloaltonetworks.com/njrat-pastebin-command-and-control/ ∗∗∗ Achtung: Kriminelle versenden betrügerische Mails im Namen von FinanzOnline ∗∗∗ --------------------------------------------- Derzeit versenden BetrügerInnen zahlreiche E-Mails im Namen des Finanzamtes. Angeblich würden Sie eine Steuerrückerstattung von 1.850 Euro bekommen. --------------------------------------------- https://www.watchlist-internet.at/news/achtung-kriminelle-versenden-betrueg… ===================== = Vulnerabilities = ===================== ∗∗∗ Command Injection: NSA warnt vor VMware-Lücke ∗∗∗ --------------------------------------------- Der US-Geheimdienst NSA sieht russische Akteure hinter Angriffen auf eine Sicherheitslücke in VMware-Produkten. --------------------------------------------- https://www.golem.de/news/command-injection-nsa-warnt-vor-vmware-luecke-201… ∗∗∗ D-Link Routers at Risk for Remote Takeover from Zero-Day Flaws ∗∗∗ --------------------------------------------- Critical vulnerabilities discovered by Digital Defense can allow attackers to gain root access and take over devices running same firmware. --------------------------------------------- https://threatpost.com/d-link-routers-zero-day-flaws/162064/ ∗∗∗ Zero-Click Wormable RCE Vulnerability Reported in Microsoft Teams ∗∗∗ --------------------------------------------- A zero-click remote code execution (RCE) bug in Microsoft Teams desktop apps could have allowed an adversary to execute arbitrary code by merely sending a specially-crafted chat message and compromise a targets system. --------------------------------------------- https://thehackernews.com/2020/12/zero-click-wormable-rce-vulnerability.html ∗∗∗ ZDI-20-1400: (0Day) Realtek RTL8811AU Wi-Fi Driver rtwlane Out-Of-Bounds Write Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of the Realtek RTL8811AU Wi-Fi driver. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-20-1400/ ∗∗∗ ZDI-20-1399: (0Day) Realtek RTL8811AU Wi-Fi Driver rtwlanu Out-Of-Bounds Write Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of the Realtek RTL8811AU Wi-Fi driver. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-20-1399/ ∗∗∗ Jetzt updaten: Cisco schiebt Update für Security-Manager-Lücke von November nach ∗∗∗ --------------------------------------------- Für eine Sicherheitslücke mit "High"-Einstufung im Security Manager stand noch ein Fix aus. Da Proof-of-Concept-Code online ist, sollten Nutzer jetzt handeln. --------------------------------------------- https://heise.de/-4983238 ∗∗∗ Patchday: Microsoft stopft kritische Lücken in Exchange Server ∗∗∗ --------------------------------------------- Für unter anderem Hyper-V, Office und Windows stehen wichtige Sicherheitsupdates zum Download bereit. Einige Lücken gelten als kritisch. --------------------------------------------- https://heise.de/-4984254 ∗∗∗ Kritische Lücke im Python-Framework PyYAML bedroht IBM Spectrum Protect ∗∗∗ --------------------------------------------- IBM hat unter anderem für IBM Db2 und Spectrum Protect wichtige Sicherheitsupdates veröffentlicht. --------------------------------------------- https://heise.de/-4983755 ∗∗∗ Patchday: Adobe schließt kritische Lücken - aber nicht in Flash ∗∗∗ --------------------------------------------- Sicherheitspatches schließen Schadcode-Lücken in Adobe Experience Manager, Lightroom und Prelude. --------------------------------------------- https://heise.de/-4984303 ∗∗∗ Patchday: SAP-Updates versperren Angriffswege über teils kritische Lücken ∗∗∗ --------------------------------------------- Neben einer NetWeaver-Schwachstelle mit dem CVSS-"Highscore" 10 hat SAP zum Patchday noch zahlreiche weitere Sicherheitsprobleme aus seinen Produkten entfernt. --------------------------------------------- https://heise.de/-4984262 ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (minidlna, openssl, and trafficserver), Mageia (oniguruma, php-pear, python, python3, and x11vnc), openSUSE (minidlna), Oracle (kernel and net-snmp), Red Hat (kernel, mariadb-galera, microcode_ctl, and net-snmp), Slackware (seamonkey), SUSE (thunderbird and xen), and Ubuntu (xorg-server). --------------------------------------------- https://lwn.net/Articles/839311/ ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (golang-golang-x-net-dev, python-certbot, and xorg-server), Fedora (resteasy, scap-security-guide, and vips), openSUSE (chromium, python, and rpmlint), SUSE (kernel), and Ubuntu (aptdaemon, curl, gdk-pixbuf, lxml, and openssl, openssl1.0). --------------------------------------------- https://lwn.net/Articles/839481/ ∗∗∗ December 2020 Android Updates Patch 46 Vulnerabilities ∗∗∗ --------------------------------------------- A total of 46 vulnerabilities were addressed this week with the release of the December 2020 security updates for Android. --------------------------------------------- https://www.securityweek.com/december-2020-android-updates-patch-46-vulnera… ∗∗∗ Amnesia:33: TCP/IP-Schwachstellen gefährden Millionen internetfähige Geräte ∗∗∗ --------------------------------------------- Die 33 Anfälligkeiten verteilen sich auf vier Open-Source-Bibliotheken. Hersteller integrieren die Bibliotheken wiederum in die Firmware von Routern, Switches, Druckern und vielen anderen Geräten. Oftmals bieten diese keine Option zur Aktualisierung der Gerätesoftware. --------------------------------------------- https://www.zdnet.de/88390349/amnesia33-tcp-ip-schwachstellen-gefaehrden-mi… ∗∗∗ GE Healthcare Imaging and Ultrasound Products ∗∗∗ --------------------------------------------- This advisory contains mitigations for Unprotected Transport of Credentials, and Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in select GE Healthcare Imaging and Ultrasound products. --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsma-20-343-01 ∗∗∗ ICS-CERT Security Advisories - December 8th, 2020 ∗∗∗ --------------------------------------------- SummaryICS-CERT has released nine security advisories addressing vulnerabilities in ICS-related devices and software. --------------------------------------------- https://exchange.xforce.ibmcloud.com/collection/7b486a6b0dbeee0d5e268e11454… ∗∗∗ Cisco AnyConnect Secure Mobility Client Arbitrary Code Execution Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ ∗∗∗ Security Advisory - Information Disclosure Vulnerability in TE Mobile Software ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20201209-… ∗∗∗ Security Advisory - CSV Injection Vulnerability in iManager NetEco Product ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20201209-… ∗∗∗ LibTIFF vulnerability CVE-2018-18557 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K70117303 ∗∗∗ Linux kernel vulnerability CVE-2017-10661 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K04337834 ∗∗∗ Linux kernel vulnerability CVE-2017-18344 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K07020416 ∗∗∗ NGINX Controller Agent vulnerability CVE-2020-27730 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K43530108 ∗∗∗ Linux kernel vulnerability CVE-2018-18397 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K83102920 ∗∗∗ Linux kernel vulnerability CVE-2018-1120 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K42202505 ∗∗∗ Citrix Secure Mail for Android Security Update ∗∗∗ --------------------------------------------- https://support.citrix.com/article/CTX286763 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily