Daily

daily@lists.cert.at

1 participants
3183 discussions

Tageszusammenfassung - 11.12.2020
by Daily end-of-shift report 11 Dec '20

11 Dec '20

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 10-12-2020 18:00 − Freitag 11-12-2020 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Widespread malware campaign seeks to silently inject ads into search results, affects multiple browsers ∗∗∗ --------------------------------------------- A persistent malware campaign has been actively distributing Adrozek, an evolved browser modifier malware at scale since at least May 2020. At its peak in August, the threat was observed on over 30,000 devices every day. The malware is designed to inject ads into search engine results pages and affects multiple browsers. --------------------------------------------- https://www.microsoft.com/security/blog/2020/12/10/widespread-malware-campa… ∗∗∗ Symantec Messaging Gateway könnte Passwörter leaken ∗∗∗ --------------------------------------------- Es ist ein wichtiges Sicherheitsupdate für Symantec Messaging Gateway erschienen. --------------------------------------------- https://heise.de/-4986723 ∗∗∗ PoC Released for Unpatched Windows Vulnerability Present Since 2006 ∗∗∗ --------------------------------------------- Details and a proof-of-concept (PoC) exploit have been released for an unpatched privilege escalation vulnerability in Windows related to the PsExec administration tool. The vulnerability was discovered by Tenable researcher David Wells and it was disclosed this week after Microsoft failed to release a patch within 90 days. --------------------------------------------- https://www.securityweek.com/poc-released-unpatched-windows-vulnerability-p… ∗∗∗ myusenet.de, bigusenet.de & Co.: Neue betrügerische Streaming-Plattformen führen in Abofalle! ∗∗∗ --------------------------------------------- Immer wieder berichtet die Watchlist Internet von betrügerischen Streaming-Plattformen, die in die Abofalle führen. Derzeit gehen zahlreiche Meldungen bei uns ein, die vor myusenet.de, foxusenet.de bigusenet.de und megausenet.de warnen. Diese neuen Streaming-Plattformen sehen zwar anders aus als die üblichen Fake-Streaming-Plattformen, die Masche bleibt aber die gleiche: Nach einer Registrierung, erhalten Sie eine Zahlungsaufforderung von 384 Euro. --------------------------------------------- https://www.watchlist-internet.at/news/myusenetde-bigusenetde-co-neue-betru… ∗∗∗ Update now: Researchers warn of security vulnerabilities in these widely used point-of-sale terminals ∗∗∗ --------------------------------------------- Security researchers disclose vulnerabilities including default passwords in two of the largest PoS manufacturers in the world. --------------------------------------------- https://www.zdnet.com/article/update-now-researchers-warn-of-security-vulne… ===================== = Vulnerabilities = ===================== ∗∗∗ Adobe Releases Security Updates for Acrobat and Reader ∗∗∗ --------------------------------------------- Adobe has released security updates to address a vulnerability in Acrobat and Reader. An attacker could exploit this vulnerability to obtain sensitive information. --------------------------------------------- https://us-cert.cisa.gov/ncas/current-activity/2020/12/10/adobe-releases-se… ∗∗∗ Hotfix rüstet Firewalls und Router von Sophos gegen Attacken ∗∗∗ --------------------------------------------- Unter bestimmten Voraussetzungen könnten Angreifer das Netzwerkbetriebssystem Cyberoam attackieren. --------------------------------------------- https://heise.de/-4986665 ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (minidlna and x11vnc), Fedora (pam), openSUSE (chromium, minidlna, nsd, openssl-1_1, and pngcheck), SUSE (gcc7 and kernel), and Ubuntu (lxml and squirrelmail). --------------------------------------------- https://lwn.net/Articles/839861/ ∗∗∗ OpenSSL vulnerability CVE-2020-1968 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K92451315 ∗∗∗ F5 TMM vulnerability CVE-2020-5950 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K05204103 ∗∗∗ F5 TMUI XSS vulnerability CVE-2020-5948 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K42696541 ∗∗∗ TMM vulnerability CVE-2020-27713 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K37960100 ∗∗∗ BIG-IP LTM vulnerability CVE-2020-5949 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K20984059 ∗∗∗ Security Bulletin: IBM Resilient Platform could allow formula injection in Excel (CVE-2020-4633) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-resilient-platform-co… ∗∗∗ Security Bulletin: NGINX vulnerability CVE-2019-20372 impacts IBM Aspera High-Speed Transfer Server and Aspera High-Speed Transfer Endpoint versions prior to V4.0 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-nginx-vulnerability-cve-2… ∗∗∗ Security Bulletin: IBM® Db2® is vulnerable to a buffer overflow (CVE-2020-4701) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-db2-is-vulnerable-to-… ∗∗∗ Security Bulletin: Fixed CP4D timeout for IBM Netezza for Cloud Pak for Data 11.1.1.0 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-fixed-cp4d-timeout-for-ib… ∗∗∗ Security Bulletin: OpenSSL vulnerability CVE-2020-1968 impacts IBM Aspera Streaming/IBM Aspera Streaming for Video version 3.9.6.1 and earlier ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-openssl-vulnerability-cve… ∗∗∗ Security Bulletin: App Connect Enterprise Certified Container is vulnerable to code injection and Denial of Service attacks ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-app-connect-enterprise-ce… ∗∗∗ Security Bulletin: HAProxy vulnerability CVE-2019-18277 impacts IBM Aspera High-Speed Transfer Server and Aspera High-Speed Transfer Endpoint versions prior to V4.0 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-haproxy-vulnerability-cve… ∗∗∗ Security Bulletin: IBM® Db2® is vulnerable to buffer overflow leading to a privileged escalation (CVE-2020-4363) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-db2-is-vulnerable-to-… ∗∗∗ Security Bulletin: IBM® Db2® is vulnerable to an information disclosure. (CVE-2020-4387) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-db2-is-vulnerable-to-… ∗∗∗ Security Bulletin: App Connect Enterprise Certified Container Integration Servers could cause a Denial of Service or a buffer overflow when using MQ ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-app-connect-enterprise-ce… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 10.12.2020
by Daily end-of-shift report 10 Dec '20

10 Dec '20

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 10-12-2020 18:00 − Donnerstag 10-12-2020 18:00 Handler: Stephan Richter Co-Handler: Dimitri Robl ===================== = News = ===================== ∗∗∗ Qbot malware switched to stealthy new Windows autostart method ∗∗∗ --------------------------------------------- A new Qbot malware version now activates its persistence mechanism right before infected Windows devices shutdown and it automatically removes any traces when the system restarts or wakes up from sleep. --------------------------------------------- https://www.bleepingcomputer.com/news/security/qbot-malware-switched-to-ste… ∗∗∗ Adobe Flash Player: Jetzt ist endgültig Schluss ∗∗∗ --------------------------------------------- Seit Jahren wird das Ende des Adobe Flash Players verkündet. Im Januar 2021 soll es nun aber tatsächlich so weit sein. --------------------------------------------- https://www.golem.de/news/adobe-flash-player-jetzt-ist-endgueltig-schluss-2… ∗∗∗ Python Backdoor Talking to a C2 Through Ngrok, (Thu, Dec 10th) ∗∗∗ --------------------------------------------- I spotted a malicious Python script that implements a backdoor. The interesting behavior is the use of Ngrok to connect to the C2 server. Ngrok has been used for a while by attackers. Like most services available on the Internet, it has been abused by attackers for a long time. --------------------------------------------- https://isc.sans.edu/diary/rss/26866 ∗∗∗ PGMiner: New Cryptocurrency Mining Botnet Delivered via PostgreSQL ∗∗∗ --------------------------------------------- PGMiner is a novel Linux-based cryptocurrency mining botnet that exploits a disputed PostgreSQL remote code execution vulnerability.The post PGMiner: New Cryptocurrency Mining Botnet Delivered via PostgreSQL appeared first on Unit42. --------------------------------------------- https://unit42.paloaltonetworks.com/pgminer-postgresql-cryptocurrency-minin… ∗∗∗ Hackers are selling more than 85,000 SQL databases on a dark web portal ∗∗∗ --------------------------------------------- Hackers break into databases, steal their content, hold it for ransom for 9 days, and then sell to the highest bidder if the DB owner doesnt want to pay the ransom demand. --------------------------------------------- https://www.zdnet.com/article/hackers-are-selling-more-than-85000-sql-datab… ∗∗∗ Proof-of-concept exploit code published for new Kerberos Bronze Bit attack ∗∗∗ --------------------------------------------- The Kerberos Bronze Bit attack can allow intruders to bypass authentication and access sensitive network services. --------------------------------------------- https://www.zdnet.com/article/proof-of-concept-exploit-code-published-for-n… ===================== = Vulnerabilities = ===================== ∗∗∗ Reflected XSS in PageLayer Plugin Affects Over 200,000 WordPress Sites ∗∗∗ --------------------------------------------- On November 4, 2020, the Wordfence Threat Intelligence team found two reflected Cross-Site Scripting (XSS) vulnerabilities in PageLayer, a WordPress plugin installed on over 200,000 sites. These vulnerabilities could lead to an attacker executing malicious Javascript in an administrator’s browser, which could lead to takeover of a vulnerable WordPress site. We contacted the plugin’s publisher, ...Read MoreThe post Reflected XSS in PageLayer Plugin Affects Over 200,000 WordPress --------------------------------------------- https://www.wordfence.com/blog/2020/12/reflected-xss-in-pagelayer-plugin-af… ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (ant, cimg, containerd, libproxy, libproxy-mozjs, libproxy-webkit, libslirp, python-lxml, tomcat8, tomcat9, and xorg-server), CentOS (firefox and thunderbird), Debian (apt, linux-4.19, python-apt, and sqlite3), Fedora (ceph, chromium, containerd, matrix-synapse, mingw-openjpeg2, openjpeg2, python-authlib, python-canonicaljson, and spice-gtk), Mageia (chromium-browser-stable), openSUSE (chromium and pngcheck), Slackware (curl), SUSE (clamav, curl, --------------------------------------------- https://lwn.net/Articles/839668/ ∗∗∗ Serious Vulnerabilities in Dualog Connection Suite ∗∗∗ --------------------------------------------- TL;DR The flaws found in this maritime comms and connection suite were many, and not insignificant: Directory traversal 2FA challenge/response is performed in a client-side application Default install password SQL […]The post Serious Vulnerabilities in Dualog Connection Suite first appeared on Pen Test Partners. --------------------------------------------- https://www.pentestpartners.com/security-blog/serious-vulnerabilities-in-du… ∗∗∗ Medtronic MyCareLink ∗∗∗ --------------------------------------------- This advisory contains mitigations for Improper Authentication, Heap-based Buffer Overflow, and Time-of-check Time-of-use Race Condition vulnerabilities in the Medtronic MyCareLink Patient Reader. --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsma-20-345-01 ∗∗∗ Mitsubishi Electric MELSEC iQ-F Series ∗∗∗ --------------------------------------------- This advisory contains mitigations for an Improper Check or Handling of Exceptional Conditions vulnerability in Mitsubishi Electrics MELSEC iQ-F series FX5U(C) CPU modules. --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-20-345-01 ∗∗∗ Host Engineering H2-ECOM100 Module ∗∗∗ --------------------------------------------- This advisory contains mitigations for an Improper Input Validation vulnerability in the Host Engineering ECOM100 Module, an Ethernet communications module for PLC systems. --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-20-345-02 ∗∗∗ Gafgyt Using Pulse Secure Vulnerability ∗∗∗ --------------------------------------------- SummaryA vulnerability in Pulse Secures Connect VPN framework is allowing for exploitation by Gafgyt. Avira details how this exploit works in a new blog.Threat TypeMalware, VulnerabilityOverviewAvira Labs has observed an increase in IoT malware binaries. These binaries have the capability to exploit CVE-2020-8218. This increase led to the discovery of a new variant of Gafgyt. Its functionality is mostly the same as the original Gafgyt with some inclusion of functionality from other malware --------------------------------------------- https://exchange.xforce.ibmcloud.com/collection/02145e80d8a7b87b486015b3588… ∗∗∗ Cisco Jabber Desktop and Mobile Client Software Vulnerabilities ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Security Bulletin: Vulnerabilities in Node.js affect IBM App Connect Enterprise V11 ( CVE-2020-8244) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-node-j… ∗∗∗ Security Bulletin: Vulnerabilities in OpenSSL affect IBM Integration Bus and IBM App Connect (CVE-2019-1552) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-openss… ∗∗∗ Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Node.js ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-watson-discovery-for-… ∗∗∗ Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Apache Commons Codec ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-watson-discovery-for-… ∗∗∗ Security Bulletin: Multiple vulnerabilities affect IBM® SDK for Node.js™ in IBM Cloud ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple Security Vulnerabilities in Apache Struts Affect IBM Sterling File Gateway (CVE-2019-0233, CVE-2019-0230) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnera… ∗∗∗ Security Bulletin: Vulnerability in Hibernate Validator affects Liberty for Java for IBM Cloud (CVE-2020-10693) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-hibernat… ∗∗∗ Security Bulletin: IBM® Db2® is vulnerable to a buffer overflow (CVE-2020-4701) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-db2-is-vulnerable-to-… ∗∗∗ Security Bulletin: JRE vulnerability (CVEID: 178768) impacts IBM Aspera High-Speed Transfer Server/IBM Aspera High-Speed Transfer Endpoint version 3.9.6.2 and earlier ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-jre-vulnerability-cveid-1… ∗∗∗ Security Bulletin: Vulnerability in ksu affects AIX (CVE-2020-4829) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-ksu-affe… ∗∗∗ Symantec Messaging Gateway: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-1222 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 09.12.2020
by Daily end-of-shift report 09 Dec '20

09 Dec '20

===================== = End-of-Day report = ===================== Timeframe: Montag 07-12-2020 18:00 − Mittwoch 09-12-2020 18:00 Handler: Stephan Richter Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ Credit card stealing malware bundles backdoor for easy reinstall ∗∗∗ --------------------------------------------- An almost impossible to remove malware set to automatically activate on Black Friday was deployed on multiple Magento-powered online stores by threat actors according to researchers at Dutch cyber-security company Sansec. --------------------------------------------- https://www.bleepingcomputer.com/news/security/credit-card-stealing-malware… ∗∗∗ Microsoft fixes new Windows Kerberos security bug in staged rollout ∗∗∗ --------------------------------------------- Microsoft has issued security updates to address a Kerberos security feature bypass vulnerability impacting multiple Windows Server versions in a two-phase staged rollout. --------------------------------------------- https://www.bleepingcomputer.com/news/security/microsoft-fixes-new-windows-… ∗∗∗ IT-Security: Hacker klauen Hacking-Werkzeuge von Fireeye ∗∗∗ --------------------------------------------- Das Security-Unternehmen versucht nun, das Schlimmste zu verhindern und gibt Tipps gegen die eigenen Angriffswerkzeuge. --------------------------------------------- https://www.golem.de/news/it-security-hacker-klauen-hacking-werkzeuge-von-f… ∗∗∗ OpenSSL behebt Speicherfehler ∗∗∗ --------------------------------------------- Ein Update beseitigt einen Null-Pointer-Zugriff, der laut Advisory zum Absturz führen kann. --------------------------------------------- https://heise.de/-4985050 ∗∗∗ Threat Assessment: Egregor Ransomware ∗∗∗ --------------------------------------------- Unit 42 shares courses of action that can help mitigate tactics, techniques and procedures used with Egregor ransomware. --------------------------------------------- https://unit42.paloaltonetworks.com/egregor-ransomware-courses-of-action/ ∗∗∗ njRAT Spreading Through Active Pastebin Command and Control Tunnel ∗∗∗ --------------------------------------------- Malware authors have been leveraging njRAT (AKA Bladabindi), a Remote Access trojan), to download and deliver second-stage payloads from Pastebin. --------------------------------------------- https://unit42.paloaltonetworks.com/njrat-pastebin-command-and-control/ ∗∗∗ Achtung: Kriminelle versenden betrügerische Mails im Namen von FinanzOnline ∗∗∗ --------------------------------------------- Derzeit versenden BetrügerInnen zahlreiche E-Mails im Namen des Finanzamtes. Angeblich würden Sie eine Steuerrückerstattung von 1.850 Euro bekommen. --------------------------------------------- https://www.watchlist-internet.at/news/achtung-kriminelle-versenden-betrueg… ===================== = Vulnerabilities = ===================== ∗∗∗ Command Injection: NSA warnt vor VMware-Lücke ∗∗∗ --------------------------------------------- Der US-Geheimdienst NSA sieht russische Akteure hinter Angriffen auf eine Sicherheitslücke in VMware-Produkten. --------------------------------------------- https://www.golem.de/news/command-injection-nsa-warnt-vor-vmware-luecke-201… ∗∗∗ D-Link Routers at Risk for Remote Takeover from Zero-Day Flaws ∗∗∗ --------------------------------------------- Critical vulnerabilities discovered by Digital Defense can allow attackers to gain root access and take over devices running same firmware. --------------------------------------------- https://threatpost.com/d-link-routers-zero-day-flaws/162064/ ∗∗∗ Zero-Click Wormable RCE Vulnerability Reported in Microsoft Teams ∗∗∗ --------------------------------------------- A zero-click remote code execution (RCE) bug in Microsoft Teams desktop apps could have allowed an adversary to execute arbitrary code by merely sending a specially-crafted chat message and compromise a targets system. --------------------------------------------- https://thehackernews.com/2020/12/zero-click-wormable-rce-vulnerability.html ∗∗∗ ZDI-20-1400: (0Day) Realtek RTL8811AU Wi-Fi Driver rtwlane Out-Of-Bounds Write Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of the Realtek RTL8811AU Wi-Fi driver. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-20-1400/ ∗∗∗ ZDI-20-1399: (0Day) Realtek RTL8811AU Wi-Fi Driver rtwlanu Out-Of-Bounds Write Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of the Realtek RTL8811AU Wi-Fi driver. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-20-1399/ ∗∗∗ Jetzt updaten: Cisco schiebt Update für Security-Manager-Lücke von November nach ∗∗∗ --------------------------------------------- Für eine Sicherheitslücke mit "High"-Einstufung im Security Manager stand noch ein Fix aus. Da Proof-of-Concept-Code online ist, sollten Nutzer jetzt handeln. --------------------------------------------- https://heise.de/-4983238 ∗∗∗ Patchday: Microsoft stopft kritische Lücken in Exchange Server ∗∗∗ --------------------------------------------- Für unter anderem Hyper-V, Office und Windows stehen wichtige Sicherheitsupdates zum Download bereit. Einige Lücken gelten als kritisch. --------------------------------------------- https://heise.de/-4984254 ∗∗∗ Kritische Lücke im Python-Framework PyYAML bedroht IBM Spectrum Protect ∗∗∗ --------------------------------------------- IBM hat unter anderem für IBM Db2 und Spectrum Protect wichtige Sicherheitsupdates veröffentlicht. --------------------------------------------- https://heise.de/-4983755 ∗∗∗ Patchday: Adobe schließt kritische Lücken - aber nicht in Flash ∗∗∗ --------------------------------------------- Sicherheitspatches schließen Schadcode-Lücken in Adobe Experience Manager, Lightroom und Prelude. --------------------------------------------- https://heise.de/-4984303 ∗∗∗ Patchday: SAP-Updates versperren Angriffswege über teils kritische Lücken ∗∗∗ --------------------------------------------- Neben einer NetWeaver-Schwachstelle mit dem CVSS-"Highscore" 10 hat SAP zum Patchday noch zahlreiche weitere Sicherheitsprobleme aus seinen Produkten entfernt. --------------------------------------------- https://heise.de/-4984262 ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (minidlna, openssl, and trafficserver), Mageia (oniguruma, php-pear, python, python3, and x11vnc), openSUSE (minidlna), Oracle (kernel and net-snmp), Red Hat (kernel, mariadb-galera, microcode_ctl, and net-snmp), Slackware (seamonkey), SUSE (thunderbird and xen), and Ubuntu (xorg-server). --------------------------------------------- https://lwn.net/Articles/839311/ ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (golang-golang-x-net-dev, python-certbot, and xorg-server), Fedora (resteasy, scap-security-guide, and vips), openSUSE (chromium, python, and rpmlint), SUSE (kernel), and Ubuntu (aptdaemon, curl, gdk-pixbuf, lxml, and openssl, openssl1.0). --------------------------------------------- https://lwn.net/Articles/839481/ ∗∗∗ December 2020 Android Updates Patch 46 Vulnerabilities ∗∗∗ --------------------------------------------- A total of 46 vulnerabilities were addressed this week with the release of the December 2020 security updates for Android. --------------------------------------------- https://www.securityweek.com/december-2020-android-updates-patch-46-vulnera… ∗∗∗ Amnesia:33: TCP/IP-Schwachstellen gefährden Millionen internetfähige Geräte ∗∗∗ --------------------------------------------- Die 33 Anfälligkeiten verteilen sich auf vier Open-Source-Bibliotheken. Hersteller integrieren die Bibliotheken wiederum in die Firmware von Routern, Switches, Druckern und vielen anderen Geräten. Oftmals bieten diese keine Option zur Aktualisierung der Gerätesoftware. --------------------------------------------- https://www.zdnet.de/88390349/amnesia33-tcp-ip-schwachstellen-gefaehrden-mi… ∗∗∗ GE Healthcare Imaging and Ultrasound Products ∗∗∗ --------------------------------------------- This advisory contains mitigations for Unprotected Transport of Credentials, and Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in select GE Healthcare Imaging and Ultrasound products. --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsma-20-343-01 ∗∗∗ ICS-CERT Security Advisories - December 8th, 2020 ∗∗∗ --------------------------------------------- SummaryICS-CERT has released nine security advisories addressing vulnerabilities in ICS-related devices and software. --------------------------------------------- https://exchange.xforce.ibmcloud.com/collection/7b486a6b0dbeee0d5e268e11454… ∗∗∗ Cisco AnyConnect Secure Mobility Client Arbitrary Code Execution Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ ∗∗∗ Security Advisory - Information Disclosure Vulnerability in TE Mobile Software ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20201209-… ∗∗∗ Security Advisory - CSV Injection Vulnerability in iManager NetEco Product ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20201209-… ∗∗∗ LibTIFF vulnerability CVE-2018-18557 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K70117303 ∗∗∗ Linux kernel vulnerability CVE-2017-10661 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K04337834 ∗∗∗ Linux kernel vulnerability CVE-2017-18344 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K07020416 ∗∗∗ NGINX Controller Agent vulnerability CVE-2020-27730 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K43530108 ∗∗∗ Linux kernel vulnerability CVE-2018-18397 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K83102920 ∗∗∗ Linux kernel vulnerability CVE-2018-1120 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K42202505 ∗∗∗ Citrix Secure Mail for Android Security Update ∗∗∗ --------------------------------------------- https://support.citrix.com/article/CTX286763 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 07.12.2020
by Daily end-of-shift report 07 Dec '20

07 Dec '20

===================== = End-of-Day report = ===================== Timeframe: Freitag 04-12-2020 18:00 − Montag 07-12-2020 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Finanzmarktaufsicht und Bundeskriminalamt warnen vor Geldwäsche-Jobs ∗∗∗ --------------------------------------------- Warnung: Professionelle Geldwäscher versuchen Jobsuchende als Finanzagent anzuwerben und zur Geldwäscherei zu missbrauchen. --------------------------------------------- https://www.watchlist-internet.at/news/finanzmarktaufsicht-und-bundeskrimin… ∗∗∗ Sicherheitslücke: Remote Code Execution in Microsoft Teams ∗∗∗ --------------------------------------------- Im Desktop-Client von Microsoft Teams fand sich eine extrem kritische Sicherheitslücke, aber Microsoft hat das Problem heruntergespielt. --------------------------------------------- https://www.golem.de/news/sicherheitsluecke-remote-code-execution-in-micros… ∗∗∗ What is Ransomware - 15 Easy Steps To Protect Your System [Updated 2020] ∗∗∗ --------------------------------------------- May 12th 2017 saw the biggest ever cyber attack in Internet history (yes, bigger than the Dyn DDoS). A ransomware named WannaCry stormed through the web, with the damage epicenter being in Europe. WannaCry leveraged a vulnerability in Windows OS, first discovered by the NSA, and then publicly revealed to the world by the Shadow [...] --------------------------------------------- https://heimdalsecurity.com/blog/what-is-ransomware-protection/ ∗∗∗ Obfuscation Techniques in MARIJUANA Shell "Bypass" ∗∗∗ --------------------------------------------- Attackers are always trying to come up with new ways to evade detection from the wide range of security controls available for web applications. This also extends to malware like PHP shells, which are typically left on compromised websites as a backdoor to maintain unauthorized access. MARIJUANA is the name of a PHP shell that we have been tracking since last year. --------------------------------------------- https://blog.sucuri.net/2020/12/obfuscation-techniques-in-marijuana-shell-b… ∗∗∗ Payment Card Skimmer Group Using Raccoon Info-Stealer to Siphon Off Data ∗∗∗ --------------------------------------------- A cybercrime group known for targeting e-commerce websites unleashed a "multi-stage malicious campaign" earlier this year designed with an intent to distribute information stealers and JavaScript-based payment skimmers. In a new report published today and shared with The Hacker News, Singapore-based cybersecurity firm Group-IB attributed the operation to the same group thats been linked to a [...] --------------------------------------------- https://thehackernews.com/2020/12/payment-card-skimmer-group-using.html ∗∗∗ Exploitation of Windows RDP Vulnerability CVE-2019-0708 (BlueKeep): Get RCE with System Privilege Using Refresh Rect PDU and RDPDR Client Name Request PDU ∗∗∗ --------------------------------------------- To better protect Windows users, we discuss how attackers might exploit CVE-2019-0708 (BlueKeep) on Windows RDP endpoints. --------------------------------------------- https://unit42.paloaltonetworks.com/cve-2019-0708-bluekeep/ ∗∗∗ Shodan Verified Vulns 2020-12 ∗∗∗ --------------------------------------------- Auch im Dezember wollen wir einen Blick auf Schwachstellen werfen, die Shodan in Österreich sieht. Die folgende Grafik basiert auf den Daten vom 2020-12-01: [...] --------------------------------------------- https://cert.at/de/aktuelles/2020/12/shodan-verified-vulns-2020-12 ===================== = Vulnerabilities = ===================== ∗∗∗ QNAP patches QTS vulnerabilities allowing NAS device takeover ∗∗∗ --------------------------------------------- Network-attached storage (NAS) maker QNAP today released security updates to address vulnerabilities that could enable attackers to take control of unpatched NAS devices following successful exploitation. --------------------------------------------- https://www.bleepingcomputer.com/news/security/qnap-patches-qts-vulnerabili… ∗∗∗ Cisco Security Manager Java Deserialization Vulnerabilities ∗∗∗ --------------------------------------------- Multiple vulnerabilities in the Java deserialization function that is used by Cisco'Security Manager could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (ceph, gitea, matrix-synapse, musl, mutt, neomutt, opensc, and webkit2gtk), Debian (debian-security-support, openldap, salt, xen, and xorg-server), Fedora (fossil, pdfresurrect, tcpdump, thunderbird, and xorg-x11-server), Gentoo (chromium, firefox, mariadb, pam, postgresql, seamonkey, thunderbird, and xorg-server), Mageia (mutt, pdfresurrect, privoxy, and thunderbird), openSUSE (chromium, java-1_8_0-openjdk, kernel, minidlna, neomutt, opera, [...] --------------------------------------------- https://lwn.net/Articles/839198/ ∗∗∗ HPE HP-UX: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K20-1199 ∗∗∗ Security Bulletin: Vulnerability in PyYAML affects IBM Spectrum Protect Plus Container and Microsoft File Systems Agents (CVE-2020-1747) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-pyyaml-a… ∗∗∗ Security Bulletin: Denial of Service Vulnerability in Chart.js affects IBM Spectrum Protect Plus (CVE-2020-7746) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-denial-of-service-vulnera… ∗∗∗ Security Bulletin: Upgrade to IBP v2.5.1 to address recent concerns/issues with Golang versions other than 1.14.7 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-upgrade-to-ibp-v2-5-1-to-… ∗∗∗ Security Bulletin: Vulnerability in Urllib3 affects IBM Spectrum Protect Container and Microsoft File Systems Agents (CVE-2020-26137) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-urllib3-… ∗∗∗ Public Service Announcement ∗∗∗ --------------------------------------------- Due to Dec 8 being a public holiday in Austria the next End-of-Day report will be published on Dec 9. --------------------------------------------- https://en.wikipedia.org/wiki/Feast_of_the_Immaculate_Conception -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 04.12.2020
by Daily end-of-shift report 04 Dec '20

04 Dec '20

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 03-12-2020 18:00 − Freitag 04-12-2020 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Achtung! Amazon-Phishing Mails boomen derzeit! ∗∗∗ --------------------------------------------- Der Black Friday ist vorbei, Weihnachten steht vor der Tür und Österreich befindet sich nach wie vor im Lockdown. All das sind Gründe, wieso der Online-Handel derzeit boomt – genauso boomen jedoch betrügerische Nachrichten, die im Namen von Amazon verschickt werden. Aktuell kursieren E-Mails, bei denen BetrügerInnen Ihnen eine doppelte Abbuchung vorgaukeln, um an Ihre Daten zu kommen. --------------------------------------------- https://www.watchlist-internet.at/news/achtung-amazon-phishing-mails-boomen… ∗∗∗ Malware für den Diebstahl von Finanzdaten versteckt sich hinter Social-Media-Buttons ∗∗∗ --------------------------------------------- Die Buttons erlauben angeblich das Teilen von Inhalten per Facebook, Twitter und Instagram. Stattdessen aktivieren sie Schadcode, der es auf persönliche Informationen und Kreditkartendaten abgesehen hat. Die zugehörige Malware ist bereits seit Ende September im Umlauf. --------------------------------------------- https://www.zdnet.de/88390301/malware-fuer-den-diebstahl-von-finanzdaten-ve… ∗∗∗ Cybercrime: Trickbot lernt neuen Trick ∗∗∗ --------------------------------------------- Emotet-Infektionen werden zukünftig noch gefährlicher. Denn die nachgeladene Malware könnte sich im BIOS festsetzen. --------------------------------------------- https://heise.de/-4980197 ∗∗∗ Forscher warnen vor teils noch ungefixter Schwachstelle in diversen Android-Apps ∗∗∗ --------------------------------------------- Die ehemals verwundbare, durch Google bereits im März reparierte Play Core-Library wurde durch manche App-Entwickler (noch) nicht aktiv aktualisiert. --------------------------------------------- https://heise.de/-4979478 ∗∗∗ The chronicles of Emotet ∗∗∗ --------------------------------------------- More than six years have passed since the banking Trojan Emotet was first detected. During this time it has repeatedly mutated, changed direction, acquired partners, picked up modules, and generally been the cause of high-profile incidents and multimillion-dollar losses. --------------------------------------------- https://securelist.com/the-chronicles-of-emotet/99660/ ∗∗∗ Leaking Browser URL/Protocol Handlers ∗∗∗ --------------------------------------------- An important step in any targeted attack is reconnaissance. The more information an attacker can obtain on the victim the greater the chances for a successful exploitation and infiltration. Recently, we uncovered two information disclosure vulnerabilities affecting three of the major web browsers which can be leveraged to leak out a vast range of installed applications, including the presence of security products, allowing a threat actor to gain critical insights on the target. --------------------------------------------- https://www.fortinet.com/blog/threat-research/leaking-browser-url-protocol-… ===================== = Vulnerabilities = ===================== ∗∗∗ VMware Releases Security Updates to Address CVE-2020-4006 ∗∗∗ --------------------------------------------- VMware has released security updates to address a vulnerability—CVE-2020-4006—in VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector. An attacker could exploit this vulnerability to take control of an affected system. The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review VMware Security Advisory VMSA-2020-0027.2 and apply the necessary updates. --------------------------------------------- https://us-cert.cisa.gov/ncas/current-activity/2020/12/03/vmware-releases-s… ∗∗∗ Webserver-Sicherheitslücke: Heikle Konfigurations- und Statusdaten publiziert ∗∗∗ --------------------------------------------- Fehlkonfigurierte Webserver von Bundesbehörden und IT-Firmen präsentierten Besucher-IPs, Benutzernamen, Meeting-Kennungen und mehr offen im Internet. --------------------------------------------- https://heise.de/-4971830 ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (thunderbird), Fedora (c-ares, pdfresurrect, webkit2gtk3, and xen), openSUSE (python3), SUSE (gdm, python-pip, rpmlint, and xen), and Ubuntu (snapcraft). --------------------------------------------- https://lwn.net/Articles/838960/ ∗∗∗ WECON LeviStudioU (Update C) ∗∗∗ --------------------------------------------- This updated advisory is a follow-up to the advisory update titled ICSA-20-238-03 WECON LeviStudioU (Update B) that was published October 29, 2020, to the ICS webpage on us-cert.cisa.gov. This advisory contains mitigations for a Stack-based Buffer Overflow vulnerability in the WECON Technology LeviStudioU software. --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-20-238-03 ∗∗∗ Apache Tomcat: Schwachstelle ermöglicht Offenlegung von Informationen ∗∗∗ --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K20-1195 ∗∗∗ Security Advisory - Privilege Escalation Vulnerability in Huawei Smartphone ∗∗∗ --------------------------------------------- https://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20201202… ∗∗∗ Security Advisory - Resource Management Error Vulnerability in Huawei CloudEngine 1800V Product ∗∗∗ --------------------------------------------- https://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20201202… ∗∗∗ Intel CPU vulnerability CVE-2020-0591 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K82356391 ∗∗∗ Intel CPU vulnerability CVE-2020-0592 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K04160444 ∗∗∗ QEMU vulnerability CVE-2020-27617 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K41142448 ∗∗∗ Jetty vulnerability CVE-2019-10247 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K41412302 ∗∗∗ Security Bulletin: jQuery Vulnerabilities Affect IBM Emptoris Program Management (CVE-2020-11023, CVE-2020-11022) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-jquery-vulnerabilities-af… ∗∗∗ Security Bulletin: Trusteer Mobile SDK is vulnerable to CVE-2019-17362 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-trusteer-mobile-sdk-is-vu… ∗∗∗ Security Bulletin: jQuery Vulnerabilities Affect IBM Emptoris Sourcing (CVE-2020-11023, CVE-2020-11022) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-jquery-vulnerabilities-af… ∗∗∗ Security Bulletin: jQuery Vulnerabilities Affect IBM Emptoris Contract Management (CVE-2020-11023, CVE-2020-11022) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-jquery-vulnerabilities-af… ∗∗∗ Security Bulletin: jQuery Vulnerabilities Affect IBM Emptoris Spend Analysis (CVE-2020-11023, CVE-2020-11022) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-jquery-vulnerabilities-af… ∗∗∗ Security Bulletin: IBM API Connect is vulnerable to arbitrary code execution and security bypass in Drupal (CVE-2020-13664, CVE-2020-13665) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-api-connect-is-vulner… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Watson Explorer and Watson Explorer Content Analytics Studio (CVE-2020-14579, CVE-2020-14578, CVE-2020-14577, CVE-2020-14621) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: jQuery Vulnerabilities Affect IBM Emptoris Strategic Supply Management Platform (CVE-2020-11023, CVE-2020-11022) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-jquery-vulnerabilities-af… ∗∗∗ Security Bulletin: Multiple security vulnerabilities with IBM Content Navigator component in IBM Business Automation Workflow – CVE-2020-4687, CVE-2020-4760, CVE-2020-4704 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnera… ∗∗∗ Security Bulletin: Upgrade javaenv:2.2 to address Gradle oauth authentication concerns. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-upgrade-javaenv2-2-to-add… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 03.12.2020
by Daily end-of-shift report 03 Dec '20

03 Dec '20

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 02-12-2020 18:00 − Donnerstag 03-12-2020 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ APT-Gruppen: Turla und Co. tarnen Angriffe durch scheinbar harmlose Aktivitäten ∗∗∗ --------------------------------------------- Eine Spionage-Malware der wohl staatlich finanzierten Turla-Gang setzt auf Dropbox zum Datenklau. In einem anderen Fall verschleierte Coin-Mining Schlimmeres. --------------------------------------------- https://heise.de/-4978541 ∗∗∗ Studie: Schwachstellen in Open-Source-Software bleiben in der Regel vier Jahre unentdeckt ∗∗∗ --------------------------------------------- Patches stehen in der Regel innerhalb von vier Wochen zur Verfügung. Zudem sind nur 17 Prozent der registrierten Sicherheitslücken als "schädlich" einzustufen. GitHub sieht Open-Source-Software als "kritische Infrastruktur" an. --------------------------------------------- https://www.zdnet.de/88390280/studie-schwachstellen-in-open-source-software… ∗∗∗ What did DeathStalker hide between two ferns? ∗∗∗ --------------------------------------------- While tracking DeathStalker’s Powersing-based activities in May 2020, we detected a previously unknown implant that leveraged DNS over HTTPS as a C2 channel, as well as parts of its delivery chain. We named this new malware "PowerPepper". --------------------------------------------- https://securelist.com/what-did-deathstalker-hide-between-two-ferns/99616/ ∗∗∗ Xerox DocuShare Bugs Allow Data Leaks ∗∗∗ --------------------------------------------- CISA warns the leading enterprise document management platform is open to attack and urges companies to apply fixes. --------------------------------------------- https://threatpost.com/xerox-docushare-bugs/161791/ ∗∗∗ Another LILIN DVR 0-day being used to spread Mirai ∗∗∗ --------------------------------------------- In March, we reported[1] that multiple botnets, including Chalubo, Fbot, Moobot were using a same 0 day vulnerability to attack LILIN DVR devices, the vendor soon fixed the vulnerability. On August 26, 2020, our Anglerfish honeypot detected that another new LILINDVR/ [...] --------------------------------------------- https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mi… ∗∗∗ Adventures in Anti-Gravity (Part II) ∗∗∗ --------------------------------------------- Here we continue to deconstruct a Mac variant of GravityRAT (the cross-platform spyware, known to target the Indian armed forces), focusing on its Electron component. --------------------------------------------- https://objective-see.com/blog/blog_0x5C.html ∗∗∗ TrickBot Malware Gets UEFI/BIOS Bootkit Feature to Remain Undetected ∗∗∗ --------------------------------------------- TrickBot, one of the most notorious and adaptable malware botnets in the world, is expanding its toolset to set its sights on firmware vulnerabilities to potentially deploy bootkits and take complete control of an infected system. The new functionality, dubbed "TrickBoot" by Advanced Intelligence (AdvIntel) and Eclypsium, makes use of readily available tools to check devices for well-known [...] --------------------------------------------- https://thehackernews.com/2020/12/trickbot-malware-gets-uefibios-bootkit.ht… ∗∗∗ Spamhaus Intelligence API: Free threat intelligence data for security developers ∗∗∗ --------------------------------------------- Spamhaus Technology releases its Intelligence API. This is the first time Spamhaus has released its extensive threat intelligence via API, providing enriched data relating to IP addresses exhibiting compromised behaviour. Available free of charge, developers can readily access enhanced data that catalogues IP addresses compromised by malware, worms, Trojan infections, devices controlled by botnets, and third party exploits, such as open proxies. The API features live and historical data, [...] --------------------------------------------- https://www.helpnetsecurity.com/2020/12/03/spamhaus-intelligence-api/ ∗∗∗ Open Source Tool Helps Secure Siemens PCS 7 Control Systems ∗∗∗ --------------------------------------------- Industrial cybersecurity company OTORIO has released an open source tool designed to help organizations harden Siemens’ SIMATIC PCS 7 distributed control systems (DCS). --------------------------------------------- https://www.securityweek.com/open-source-tool-helps-secure-siemens-pcs-7-co… ===================== = Vulnerabilities = ===================== ∗∗∗ Google Play Apps Remain Vulnerable to High-Severity Flaw ∗∗∗ --------------------------------------------- Patches for a flaw (CVE-2020-8913) in the Google Play Core Library have not been implemented by several popular Google Play apps, including Cisco Teams and Edge. --------------------------------------------- https://threatpost.com/google-play-apps-remain-vulnerable-to-high-severity-… ∗∗∗ iCloud for Windows 11.5 ∗∗∗ --------------------------------------------- Foundation: A local user may be able to read arbitrary files ImageIO: Processing a maliciously crafted image may lead to arbitrary code execution ImageIO: Opening a maliciously crafted PDF file may lead to an unexpected application termination or arbitrary code execution libxml2: Processing maliciously crafted web content may lead to code execution libxml2: A remote attacker may be able to cause unexpected application termination or arbitrary code execution libxml2: Processing a maliciously crafted file may lead to arbitrary code execution SQLite: A remote attacker may be able to cause a denial of service SQLite: A remote attacker may be able to cause arbitrary code execution SQLite: A remote attacker may be able to leak memory SQLite: A maliciously crafted SQL query may lead to data corruption WebKit: Processing maliciously crafted web content may lead to arbitrary code execution --------------------------------------------- https://support.apple.com/kb/HT211935 ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Mageia (cimg, pngcheck, poppler, tor, and xdg-utils), openSUSE (mariadb), Red Hat (go-toolset-1.14-golang), and Ubuntu (linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-gke-4.15, linux-hwe, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon). --------------------------------------------- https://lwn.net/Articles/838870/ ∗∗∗ Mozilla Foundation Security Advisory 2020-53 ∗∗∗ --------------------------------------------- In security advisory 2020-53, the Mozilla Foundation describes a stack overflow vulnerability (CVE-2020-26970) patched in Thunderbird 78.5.1. The issue was caused by writing an SMTP server status integer value on the stack designed to only hold one byte. This could potentially corrupt the stack which might be exploitable. --------------------------------------------- https://exchange.xforce.ibmcloud.com/collection/0f933021879b159a96ec2380843… ∗∗∗ Red Hat Enterprise Linux: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K20-1190 ∗∗∗ Security Bulletin: Vulnerability in PyYAML affects IBM Spectrum Protect Plus Container and Microsoft File Systems Agents (CVE-2020-1747) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-pyyaml-a… ∗∗∗ Security Bulletin: IBM Security Guardium Big Data Intelligence (SonarG) is affected by a 3rd party cryptographc vulnerability (CVE-2020-4254) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-big… ∗∗∗ Security Bulletin: A security bypass vulnerability in Apache Solr (lucene) affects IBM InfoSphere Information Server ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-bypass-vulnera… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java affect IBM Netezza Analytics ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple security vulnerabilities with Administration Console for Content Platform Engine component in IBM Business Automation Workflow and IBM Business Process Manager (BPM) – CVE-2020-4447, CVE-2020-4759 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnera… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 02.12.2020
by Daily end-of-shift report 02 Dec '20

02 Dec '20

===================== = End-of-Day report = ===================== Timeframe: Dienstag 01-12-2020 18:00 − Mittwoch 02-12-2020 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Project Zero: Exploit zeigt Komplettübernahme von iPhones per WLAN ∗∗∗ --------------------------------------------- Ohne Bugfix hätten iPhones vollständig per WLAN ausgelesen werden können - über eine triviale Lücke. Apple hat den Fehler bereits behoben. --------------------------------------------- https://www.golem.de/news/project-zero-exploit-zeigt-komplettuebernahme-von… ∗∗∗ "Free" Symchanger Malware Tricks Users Into Installing Backdoor ∗∗∗ --------------------------------------------- In a previous post, I discussed how attackers can trick website owners into installing malware onto a website - granting the attacker the same unauthorized access as if they had exploited a vulnerability or compromised login details for the website. But did you know attackers use the same tactic against other bad actors? They do this by offering free malware, even going to great lengths to include a guide on how to use it. --------------------------------------------- https://blog.sucuri.net/2020/12/free-symchanger-malware-tricks-users-into-i… ∗∗∗ Remote Code Execution: Lücken in NAS-Betriebssystem QTS von Qnap geschlossen ∗∗∗ --------------------------------------------- Die Qnap-Entwickler haben eine abgesicherte Version von QTS für NAS-Geräte aus dem eigenen Haus veröffentlicht. --------------------------------------------- https://heise.de/-4977592 ∗∗∗ Paketmanager npm: Remote Access Trojan tarnt sich als JSON-Tool ∗∗∗ --------------------------------------------- Die zwei Pakete jdb.js und db-json.js versuchen njRAT zu installieren und die Windows-Firewall passend zu öffnen. --------------------------------------------- https://heise.de/-4977572 ∗∗∗ Zahlreiche betrügerische Jobangebote von rareAI und enixAI online! ∗∗∗ --------------------------------------------- „Quereinsteiger im KI-Training“ oder „Datenerfasser/KI-Trainer“ – so oder so ähnlich klingen betrügerische Jobangebote, die derzeit auf zahlreichen Plattformen inseriert werden. Dahinter stecken die angeblichen Start-Ups rareAI oder enixAI. Doch weder die Unternehmen existieren erhalten Interessierte eine bezahlte Arbeit. Stattdessen wird der Bewerbungsprozess genutzt, um im Namen der Opfer ein Konto zu eröffnen, nebenbei klauen die Kriminellen noch [...] --------------------------------------------- https://www.watchlist-internet.at/news/zahlreiche-betruegerische-jobangebot… ===================== = Vulnerabilities = ===================== ∗∗∗ ICS Advisory (ICSA-20-336-01) Schneider Electric EcoStruxure Operator Terminal Expert runtime (Vijeo XD) ∗∗∗ --------------------------------------------- Successful exploitation of this vulnerability may allow unauthorized command execution by a local user of the Windows engineering workstation, which could result in loss of availability, confidentiality, and integrity of the workstation where EcoStruxure Operator Terminal Expert runtime is installed. --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-20-336-01 ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (brotli, jupyter-notebook, and postgresql-9.6), Fedora (perl-Convert-ASN1 and php-pear), openSUSE (go1.15, libqt5-qtbase, mutt, python-setuptools, and xorg-x11-server), Oracle (firefox, kernel, libvirt, and thunderbird), Red Hat (rh-postgresql10-postgresql and rh-postgresql12-postgresql), SUSE (java-1_8_0-openjdk, python, python-cryptography, python-setuptools, python3, and xorg-x11-server), and Ubuntu (linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp, linux-gcp-5.4, linux-hwe-5.4, linux-kvm, linux-oracle, linux-oracle-5.4, linux, linux-aws, linux-azure, linux-gcp, linux-kvm, linux-oracle, linux-raspi, linux, linux-aws, linux-azure, linux-kvm, linux-lts-trusty, linux-raspi2, linux-snapdragon, python-werkzeug, and xorg-server, xorg-server-hwe-16.04, xorg-server-hwe-18.04). --------------------------------------------- https://lwn.net/Articles/838786/ ∗∗∗ Security Advisory - Privilege Escalation Vulnerability in Some Huawei Products ∗∗∗ --------------------------------------------- https://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20201202… ∗∗∗ HCL Domino: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit den Rechten des Dienstes ∗∗∗ --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K20-1182 ∗∗∗ FreeBSD: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K20-1185 ∗∗∗ McAfee Total Protection: Schwachstelle ermöglicht Privilegieneskalation ∗∗∗ --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K20-1184 ∗∗∗ Security Bulletin: Multiple Vulnerabilities in IBM Java SDK affect IBM Virtualization Engine TS7700 – July 2020 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple Vulnerabilities in firmware supporting products shipped with IBM Clouf Pak System ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: CVE-2020-26217 XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-cve-2020-26217-xstream-be… ∗∗∗ Security Bulletin: Multiple security vulnerabilities with Administration Console for Content Platform Engine component in IBM Business Automation Workflow and IBM Business Process Manager (BPM) – CVE-2020-4447, CVE-2020-4459 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnera… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 01.12.2020
by Daily end-of-shift report 01 Dec '20

01 Dec '20

===================== = End-of-Day report = ===================== Timeframe: Montag 30-11-2020 18:00 − Dienstag 01-12-2020 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Banking-Malware Gootkit ist zurück und hat es auf PCs in Deutschland abgesehen ∗∗∗ --------------------------------------------- Das CERT-Bund und verschiedene Sicherheitsforscher warnen vor Trojaner-Attacken. Infektionen sind aber nicht ohne Weiteres möglich. --------------------------------------------- https://heise.de/-4976043 ∗∗∗ FBI warns of BEC scammers using email auto-forwarding in attacks ∗∗∗ --------------------------------------------- The FBI is warning U.S. companies about scammers actively abusing auto-forwarding rules on web-based email clients to increase the likelihood of successful Business Email Compromise (BEC) attacks. --------------------------------------------- https://www.bleepingcomputer.com/news/security/fbi-warns-of-bec-scammers-us… ∗∗∗ Critical Oracle WebLogic flaw actively exploited by DarkIRC malware ∗∗∗ --------------------------------------------- A botnet known as DarkIRC is actively targeting thousands of exposed Oracle WebLogic servers in attacks designed to exploit the CVE-2020-14882 remote code execution (RCE) vulnerability fixed by Oracle two months ago. --------------------------------------------- https://www.bleepingcomputer.com/news/security/critical-oracle-weblogic-fla… ∗∗∗ IceRat evades antivirus by running PHP on Java VM ∗∗∗ --------------------------------------------- IceRat keeps low detections rates for weeks by using an unusual language implementation: JPHP. But there are more reasons than the choice of the compiler. This article explores IceRat and explains a way to analyze JPHP malware. --------------------------------------------- https://www.gdatasoftware.com/blog/icerat-evades-antivirus-by-using-jphp ∗∗∗ How prevalent is DNS spoofing? Could a repeat of the Dyn/Mirai DDoS attack have the same results? ∗∗∗ --------------------------------------------- Two separate groups of academics have recently released research papers based on research into the Domain Name System (DNS). One has found that the overwhelming majority of popular site operators haven’t learned from the 2016 Dyn/Mirai incident/attack and set up a backup DNS server, and the other has shown that the rate of DNS spoofing, though still very small, has more than doubled in less than seven years. --------------------------------------------- https://www.helpnetsecurity.com/2020/12/01/dns-spoofing/ ∗∗∗ Xanthe - Docker aware miner ∗∗∗ --------------------------------------------- Ransomware attacks and big-game hunting making the headlines, but adversaries use plenty of other methods to monetize their efforts in less intrusive ways. Cisco Talos recently discovered a cryptocurrency-mining botnet attack were calling "Xanthe," which attempted to compromise one of Ciscos security honeypots for tracking Docker-related threats. --------------------------------------------- https://blog.talosintelligence.com/2020/12/xanthe-docker-aware-miner.html ∗∗∗ Docker malware is now common, so devs need to take Docker security seriously ∗∗∗ --------------------------------------------- Three years after the first malware attacks targeting Docker, developers are still misconfiguring and exposing their Docker servers online. --------------------------------------------- https://www.zdnet.com/article/docker-malware-is-now-common-so-devs-need-to-… ===================== = Vulnerabilities = ===================== ∗∗∗ GO SMS Pro Vulnerable to File Theft: Part 2 ∗∗∗ --------------------------------------------- Last week we released an advisory about an SMS app called GO SMS Pro. Media files sent via text in the app are stored insecurely on a publicly accessible server. With some very minor scripting, it is trivial to throw a wide net around that content. While its not directly possible to link the media to specific users, those media files with faces, names, or other identifying characteristics do that for you. [...] It seems like GOMO is attempting to fix the issue, but a complete fix is still not available in the app. --------------------------------------------- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/go-sms-pro-… ∗∗∗ Multiple (RCE) Vulnerabilities in Micro Focus Operations Bridge Manager ∗∗∗ --------------------------------------------- After analysing OBM, I found a mountain of critical security vulnerabilities that when combined result in a complete compromise of the application: - Use of Hard-coded Credentials - Insecure Java Deserialization (an incredible total of 41 of them) - Use of Outdated and Insecure Java Libraries - Incorrect Default Folder Permissions (resulting in Privilege Escalation to SYSTEM) All of these vulnerabilities affect the latest version, 2020.05, and possibly earlier versions. Both Windows and Linux installations are affected, except for the privilege escalation, which only affects Windows. --------------------------------------------- https://github.com/pedrib/PoC/blob/master/advisories/Micro_Focus/Micro_Focu… ∗∗∗ WebKitGTK and WPE WebKit Security Advisory WSA-2020-0009 ∗∗∗ --------------------------------------------- Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. [...] Impact: Processing maliciously crafted web content may lead toarbitrary code execution. --------------------------------------------- https://webkitgtk.org/security/WSA-2020-0009.html ∗∗∗ QNAP QTS: Mehrere Schwachstellen ermöglichen Codeausführung ∗∗∗ --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K20-1181 ∗∗∗ Foxit Phantom PDF Suite: Schwachstelle ermöglicht nicht spezifizierten Angriff ∗∗∗ --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K20-1180 ∗∗∗ HCL Domino: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K20-1177 ∗∗∗ Security Bulletin: IBM® Db2® is vulnerable to a buffer overflow (CVE-2020-4701) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-db2-is-vulnerable-to-… ∗∗∗ Security Bulletin: Information disclosure vulnerability may affect IBM Business Automation Workflow – CVE-2020-4900 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-information-disclosure-vu… ∗∗∗ Security Bulletin: Node.js upgrade for IBM Cloud Pak for Data Streams Flows ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-node-js-upgrade-for-ibm-c… ∗∗∗ Security Bulletin: Node.js module upgrade for IBM Cloud Pak for Data Streams Flows ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-node-js-module-upgrade-fo… ∗∗∗ Security Bulletin: Multiple Security Vulnerabilities in IBM WebSphere Application Server affects IBM Voice Gateway ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnera… ∗∗∗ Security Bulletin: A security vulnerability in Node.js affects IBM Voice Gateway ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: Node.js upgrade for IBM Cloud Pak for Data Streams Flows ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-node-js-upgrade-for-ibm-c… ∗∗∗ Security Bulletin: Multiple security vulnerabilities in IBM Java SDK affects IBM Voice Gateway ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnera… ∗∗∗ Security Bulletin: IBM® Db2® could allow a local authenticated attacker to execute arbitrary code on the system, caused by DLL search order hijacking vulnerability in Microsoft Windows client. (CVE-2020-4739) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-db2-could-allow-a-loc… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 30.11.2020
by Daily end-of-shift report 30 Nov '20

30 Nov '20

===================== = End-of-Day report = ===================== Timeframe: Freitag 27-11-2020 18:00 − Montag 30-11-2020 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Bug oder Feature: Privilege Escalation in Windows Autopilot ∗∗∗ --------------------------------------------- SEC Consult hat im Deploymentprozess von Windows Autopilot eine Schwachstelle identifziert, die eine Erweiterung lokaler Berechtigungen ermöglicht. --------------------------------------------- https://www.sec-consult.com/./blog/2020/11/bug-oder-feature-privilege-escal… ∗∗∗ Credit card skimmer fills fake PayPal forms with stolen order info ∗∗∗ --------------------------------------------- A newly discovered credit card skimmer uses an innovative technique to inject highly convincing PayPal iframes and hijack the checkout process on compromised online stores. --------------------------------------------- https://www.bleepingcomputer.com/news/security/credit-card-skimmer-fills-fa… ∗∗∗ Cyberthreats to financial organizations in 2021 ∗∗∗ --------------------------------------------- Let us review the forecasts we made at the end of 2019 and see how accurate we were. Then we will go through the key events of 2020 relating to financial attacks. Finally, we need to make a forecast of financial attacks in 2021. --------------------------------------------- https://securelist.com/cyberthreats-to-financial-organizations-in-2021/9959… ∗∗∗ Threat Hunting with JARM, (Fri, Nov 27th) ∗∗∗ --------------------------------------------- Recently I have been testing a new tool created by the people at Salesforce. The tool is called JARM and what it does is query TLS instances (HTTPS servers and services) to create a fingerprint of their TLS configuration. Much like analyzing the nuances of network traffic can be used to fingerprint the operating system and version of a server, JARM fingerprints TLS instances to create a fingerprint which can be used to compare one TLS service to another. --------------------------------------------- https://isc.sans.edu/diary/rss/26832 ∗∗∗ German users targeted with Gootkit banker or REvil ransomware ∗∗∗ --------------------------------------------- After a noted absence, the Gootkit banking Trojan returns en masse to hit Germany. In an interesting twist, some of the victims may receive ransomware instead. --------------------------------------------- https://blog.malwarebytes.com/threat-analysis/2020/11/german-users-targeted… ∗∗∗ SD-WAN Product Vulnerabilities Allow Hackers to Steer Traffic, Shut Down Networks ∗∗∗ --------------------------------------------- Researchers at cybersecurity consulting firm Realmode Labs have identified vulnerabilities in SD-WAN products from Silver Peak, Cisco, Citrix and VMware, including potentially serious flaws that can be exploited to steer traffic or completely shut down an organization’s network. --------------------------------------------- https://www.securityweek.com/sd-wan-product-vulnerabilities-allow-hackers-s… ∗∗∗ Tens of Dormant North American Networks Suspiciously Resurrected at Once ∗∗∗ --------------------------------------------- More than fifty networks in the North American region suddenly burst to life after being dormant for a long period of time, Spamhaus reveals. The Geneva-based international nonprofit organization is focused on tracking spam, phishing, malware, and botnets, and provides threat intelligence that can help filter spam and related threats. --------------------------------------------- https://www.securityweek.com/tens-dormant-north-american-networks-suspiciou… ∗∗∗ Hackers are targeting MacOS users with this updated malware ∗∗∗ --------------------------------------------- Researchers link new malware attacks designed to install a backdoor onto compromised systems to Vietnamese-backed hacking operation OceanLotus. --------------------------------------------- https://www.zdnet.com/article/hackers-are-targeting-macos-users-with-this-u… ∗∗∗ Whac-A-Mole: Six Years of DNS Spoofing. (arXiv:2011.12978v1 [cs.CR]) ∗∗∗ --------------------------------------------- DNS is important in nearly all interactions on the Internet. All large DNS operators use IP anycast, announcing servers in BGP from multiple physical locations to reduce client latency and provide capacity. However, DNS is easy to spoof: third parties intercept and respond to queries for benign or malicious purposes. Spoofing is of particular risk for services using anycast, since service is already announced from multiple origins. --------------------------------------------- http://arxiv.org/abs/2011.12978 ===================== = Vulnerabilities = ===================== ∗∗∗ Sicherheitsupdate: Lücke in Trend Micro ServerProtect gefährdet Linux-Systeme ∗∗∗ --------------------------------------------- Es gibt eine abgesicherte Version von Trend Micro ServerProtect for Linux. --------------------------------------------- https://heise.de/-4974321 ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (c-ares, libass, raptor, rclone, and swtpm), Debian (libproxy, qemu, tcpflow, and x11vnc), Fedora (asterisk, c-ares, microcode_ctl, moodle, pam, tcpdump, and webkit2gtk3), Mageia (jruby and webkit2), openSUSE (buildah, c-ares, ceph, fontforge, java-1_8_0-openjdk, kernel, LibVNCServer, mariadb, thunderbird, ucode-intel, and wireshark), Red Hat (firefox, rh-mariadb103-mariadb and rh-mariadb103-galera, and thunderbird), SUSE (binutils, libssh2_org, [...] --------------------------------------------- https://lwn.net/Articles/838579/ ∗∗∗ Security Bulletin: A vulnerability in IBM Java Runtime affects TXSeries for Multiplatforms ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-ibm-ja… ∗∗∗ Security Bulletin: IBM QRadar Network Security is affected by Network Time Protocol (NTP) vulnerabilities (CVE-2020-11868, CVE-2020-13817) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-qradar-network-securi… ∗∗∗ Security Bulletin: A vulnerability in IBM Java Runtime affects TXSeries for Multiplatforms ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-ibm-ja… ∗∗∗ Security Bulletin: Vulnerability in IBM Java SDK affect IBM Content Classification ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-ibm-java… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Content Classification ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: IBM Content Classification is affected by a Eclipse Jetty (Publicly disclosed vulnerability) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-content-classificatio… ∗∗∗ Security Bulletin: A vulnerability in IBM Java Runtime affects IBM CICS TX on Cloud ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-ibm-ja… ∗∗∗ Security Bulletin: Eclipse Jetty (Publicly disclosed vulnerability) affects Content Classifaction ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-eclipse-jetty-publicly-di… ∗∗∗ Security Bulletin: A vulnerability in IBM Java Runtime affect IBM CICS TX on Cloud ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-ibm-ja… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 27.11.2020
by Daily end-of-shift report 27 Nov '20

27 Nov '20

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 26-11-2020 18:00 − Freitag 27-11-2020 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Achtung Identitätsdiebstahl: Kriminelle versenden betrügerische E-Mails im Namen der Post! ∗∗∗ --------------------------------------------- Zahlreiche LeserInnen melden uns derzeit eine betrügerische E-Mail, die im Namen der Österreichischen Post verschickt wird. In diesem E-Mail werden Sie dazu aufgefordert, eine Ausweiskopie zu senden, damit eine Lieferung verarbeitet werden kann. Ignorieren Sie diese E-Mail. Es handelt sich um Betrug! --------------------------------------------- https://www.watchlist-internet.at/news/achtung-identitaetsdiebstahl-krimine… ∗∗∗ Sicherheitsupdates: Archive mit Schadcode könnten Drupal-Websites gefährden ∗∗∗ --------------------------------------------- Die Drupal-Enwickler haben zwei gefährliche Sicherheitslücken im Content Management System Drupal geschlossen. --------------------------------------------- https://heise.de/-4972845 ∗∗∗ Mit dem Bloodhound auf Active-Directory-Jagd ∗∗∗ --------------------------------------------- Auf seiner SO-CON zeigte SpecterOps viele Aktualisierungen für Security-Werkzeuge, darunter BloodHound 4.0 für Active-Directory-Angriffe. --------------------------------------------- https://heise.de/-4973049 ∗∗∗ Hackers Love Expired Domains ∗∗∗ --------------------------------------------- Sometimes, website owners no longer want to own a domain name and they allow it to expire without attempting to renew it. This happens all the time and is totally normal, but it’s important to remember that attackers regularly monitor domain expirations and may target certain domains that meet specific criteria. Vendor domains can be an easy backdoor A vendor (supplier) domain is defined as a website that is used to host and load third party Javascript resources [...] --------------------------------------------- https://blog.sucuri.net/2020/11/hackers-love-expired-domains.html ∗∗∗ Digitally Signed Bandook Malware Once Again Targets Multiple Sectors ∗∗∗ --------------------------------------------- A cyberespionage group with suspected ties to the Kazakh and Lebanese governments has unleashed a new wave of attacks against a multitude of industries with a retooled version of a 13-year-old backdoor Trojan. Check Point Research called out hackers affiliated with a group named Dark Caracal in a new report published yesterday for their efforts to deploy "dozens of digitally signed variants" of [...] --------------------------------------------- https://thehackernews.com/2020/11/digitally-signed-bandook-malware-once.html ===================== = Vulnerabilities = ===================== ∗∗∗ Citrix Virtual Apps and Desktops Security Update ∗∗∗ --------------------------------------------- 2020-11-25: Improved clarification on when a version is impacted and added that 1912 LTSR CU2 is now available --------------------------------------------- https://support.citrix.com/article/CTX285059 ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (go, libxml2, postgresql, and wireshark-cli), Debian (drupal7 and lxml), Fedora (drupal7, java-1.8.0-openjdk-aarch32, libxml2, pacemaker, slurm, and swtpm), openSUSE (c-ares, ceph, chromium, dash, firefox, go1.14, java-1_8_0-openjdk, kernel, krb5, perl-DBI, podman, postgresql10, postgresql12, rclone, slurm, ucode-intel, wireshark, wpa_supplicant, and xen), SUSE (ceph, firefox, kernel, LibVNCServer, and python), and Ubuntu (freerdp, poppler, and [...] --------------------------------------------- https://lwn.net/Articles/838469/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily