Daily

daily@lists.cert.at

1 participants
3284 discussions

Tageszusammenfassung - 24.07.2020
by Daily end-of-shift report 24 Jul '20

24 Jul '20

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 23-07-2020 18:00 − Freitag 24-07-2020 18:00 Handler: Dimitri Robl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ 5 severe D-Link router vulnerabilities disclosed, patch now ∗∗∗ --------------------------------------------- 5 severe D-Link vulnerabilities have been disclosed that could allow an attacker to take complete control over a router without needing to login. --------------------------------------------- https://www.bleepingcomputer.com/news/security/5-severe-d-link-router-vulne… ∗∗∗ Sicherheitslücke: Wenn das Youtube-Tutorial die Cloud-Zugangsdaten leakt ∗∗∗ --------------------------------------------- Sicherheitsforscher haben Hunderte Youtube-Tutorials ausgewertet und immer wieder Zugangsdaten entdeckt - mit diesen konnten sie sich auf AWS einloggen. --------------------------------------------- https://www.golem.de/news/sicherheitsluecke-wenn-das-youtube-tutorial-die-c… ∗∗∗ MMS Exploit Part 2: Effective Fuzzing of the Qmage Codec ∗∗∗ --------------------------------------------- This post is the second of a multi-part series capturing my journey from discovering a vulnerable little-known Samsung image codec, to completing a remote zero-click MMS attack that worked on the latest Samsung flagship devices. --------------------------------------------- https://googleprojectzero.blogspot.com/2020/07/mms-exploit-part-2-effective… ∗∗∗ Compromized Desktop Applications by Web Technologies, (Fri, Jul 24th) ∗∗∗ --------------------------------------------- For a long time now, it has been said that "the new operating system is the browser". Today, we do everything in our browsers, we connect to the office, we process emails, documents, we chat, we perform our system maintenances, ... But many popular web applications provide also desktop client: Twitter, Facebook, Slack are good examples. Such applications just replace the classic browser and use the API [...] --------------------------------------------- https://isc.sans.edu/diary/rss/26384 ∗∗∗ Garmin Connect: Ausfall offenbar nach Ransomware-Attacke ∗∗∗ --------------------------------------------- Eine Ransomware-Attacke hat Server von Garmin lahmgelegt. Fitnesstracker und Sportuhren lassen sich nicht synchronisieren. Der Ausfall dauert wohl mehrere Tage. --------------------------------------------- https://heise.de/-4851576 ∗∗∗ New variant of Phobos ransomware is coming ∗∗∗ --------------------------------------------- In recent years, the spread of ransomware has become increasingly severe, thousands of servers and databases around the world have been invaded and destroyed. --------------------------------------------- https://blog.360totalsecurity.com/en/new-variant-of-phobos-ransomware-is-co… ∗∗∗ „Letzte Mahnung“: Ignorieren Sie diese betrügerische BAWAG-Mail! ∗∗∗ --------------------------------------------- BetrügerInnen senden derzeit vermehrt E-Mails im Namen der Bank „BAWAG P.S.K.“. Darin werden Sie aufgefordert einen neuen Dienst zu aktivieren, indem Sie Ihre Bankdaten auf einer gefälschten BAWAG-Seite eingeben sollen. Achtung, diese Daten landen direkt in den Händen der Kriminelle! --------------------------------------------- https://www.watchlist-internet.at/news/letzte-mahnung-ignorieren-sie-diese-… ===================== = Vulnerabilities = ===================== ∗∗∗ Easy Breadcrumb - Moderately critical - Cross site scripting - SA-CONTRIB-2020-027 ∗∗∗ --------------------------------------------- Project: Easy BreadcrumbVersion: 8.x-1.128.x-1.10Date: 2020-July-22Security risk: Moderately critical 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross site scriptingDescription: This module enables you to use the current URL (path alias) and the current pages title to automatically extract the breadcrumbs segments and its respective links then show them as breadcrumbs on your website.The module doesnt sufficiently sanitize editor input in certain --------------------------------------------- https://www.drupal.org/sa-contrib-2020-027 ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (qemu), Fedora (java-11-openjdk, mod_authnz_pam, podofo, and python27), openSUSE (cni-plugins, tomcat, and xmlgraphics-batik), Oracle (dbus and thunderbird), SUSE (freerdp, kernel, libraw, perl-YAML-LibYAML, and samba), and Ubuntu (libvncserver and openjdk-lts). --------------------------------------------- https://lwn.net/Articles/826965/ ∗∗∗ Security Bulletin: Multiple vulnerabilities in GNU Binutils affect IBM Netezza Platform Software clients. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: IBM Verify Gateway does not sufficiently guard against unauthorized API calls (PSIRT-ADV0022379) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-verify-gateway-does-n… ∗∗∗ Security Bulletin: IBM QRadar Advisor with Watson App for IBM QRadar SIEM does not adequately mask all passwords during input (CVE-2020-4408) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-qradar-advisor-with-w… ∗∗∗ Security Bulletin: IBM Verify Gateway PAM components do not set restricted access permission for debug logs (CVE-2020-4405) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-verify-gateway-pam-co… ∗∗∗ Privilege Escalation Vulnerability in SteelCentral Aternity Agent ∗∗∗ --------------------------------------------- https://sec-consult.com/./en/blog/advisories/privilege-escalation-vulnerabi… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 23.07.2020
by Daily end-of-shift report 23 Jul '20

23 Jul '20

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 22-07-2020 18:00 − Donnerstag 23-07-2020 18:00 Handler: Dimitri Robl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Popular Chinese-Made Drone Is Found To Have Security Weakness ∗∗∗ --------------------------------------------- Cybersecurity researchers revealed on Thursday a newfound vulnerability in an app that controls the worlds most popular consumer drones, threatening to intensify the growing tensions between China and the United States. From a report: In two reports, the researchers contended that an app on Googles Android operating system that powers drones made by China-based Da Jiang Innovations, or DJI, collects large amounts of personal information that could be exploited .. --------------------------------------------- https://it.slashdot.org/story/20/07/23/1437214/ ∗∗∗ Skimmers in Images & GitHub Repos ∗∗∗ --------------------------------------------- MalwareBytes recently shared some information about web skimmers that store malicious code inside real .ico files. During a routine investigation, we detected a similar issue. Instead of targeting .ico files, however, attackers chose to inject content into real .png files — both on compromised sites and in booby trapped Magento repos on GitHub. Googletagmanager.png Our security analyst Keith Petkus found this piece of malware injected on a compromised Magento 2.x site. --------------------------------------------- https://blog.sucuri.net/2020/07/skimmers-in-images-github-repos.html ∗∗∗ Towards native security defenses for the web ecosystem ∗∗∗ --------------------------------------------- With the recent launch of Chrome 83, and the upcoming release of Mozilla Firefox 79, web developers are gaining powerful new security mechanisms to protect their applications from common web vulnerabilities. In this post we share how our Information Security Engineering team is deploying Trusted Types, Content Security Policy, Fetch Metadata Request Headers and the Cross-Origin Opener Policy across Google to help guide and inspire other developers to similarly adopt these features to protect their applications. --------------------------------------------- https://security.googleblog.com/2020/07/towards-native-security-defenses-fo… ∗∗∗ Forensoftware vBulletin: Schlecht programmiertes Testskript als mögliche Gefahr ∗∗∗ --------------------------------------------- Wer das Skript vb_test.php zum Test von vBulletin-Installationsvoraussetzungen nutzt, sollte es danach wegen gefährlicher Lücken sofort vom Server löschen. --------------------------------------------- https://heise.de/-4851012 ===================== = Vulnerabilities = ===================== ∗∗∗ ASUS Router Vulnerable to Fake Updates and XSS ∗∗∗ --------------------------------------------- Recently ASUS patched two issues I discovered in the RT-AC1900P router firmware update functionality. These vulnerabilities could allow for complete compromise of the router and all traffic that traverses it. Finding 1: Update Accepts Forged Server Certificates (CVE-2020-15498) Finding 2: XSS in Release Notes Dialog Window (CVE-2020-15499) --------------------------------------------- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/asus-router… ∗∗∗ Drupal: Modal Form - Critical - Access bypass - SA-CONTRIB-2020-029 ∗∗∗ --------------------------------------------- Project: Modal Form Version: 8.x-1.x-dev Date: 2020-July-22 Security risk: Critical 16∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Access bypass Description: The Modal form module is a toolset for quick start of using forms in modal windows.Any form is available for view and submit when the modal_form module is installed. The only requirement is to know the forms fully-qualified class name. Solution: Upgrade to modal_form-8.x-1.2. --------------------------------------------- https://www.drupal.org/sa-contrib-2020-029 ∗∗∗ Sicherheitsupdate: Netzwerk-Schützer von Cisco sind löchrig ∗∗∗ --------------------------------------------- Admins, die Netzwerke mit Hard- und Software von Cisco schützen, sollten aus Sicherheitsgründen die aktuellen Versionen von Adaptive Security Appliance (ASA) und Firepower Threat Defense (FTD) installieren. ... Ein entfernter und unangemeldeter Angreifer könnte mittels präparierter HTTP-Anfragen auf das Web-Services-Dateisystem von anvisierten Geräten zugreifen (Directory-Traversal-Attacke). Dieses Dateisystem ist aber nur verfügbar, wenn Any-Connect- oder WebVPN-Features aktiviert sind. Davon sind alle Geräte mit verwundbaren ASA- und FTD-Versionen betroffen. (CVE-2020-3452) --------------------------------------------- https://heise.de/-4850949 ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (poppler and tomcat8), Fedora (cacti, cacti-spine, java-1.8.0-openjdk, mbedtls, mingw-python3, singularity, and xen), openSUSE (firefox, redis, and singularity), Red Hat (samba), SUSE (java-11-openjdk, qemu, and vino), and Ubuntu (ffmpeg and pillow). --------------------------------------------- https://lwn.net/Articles/826841/ ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Z Development and Test Environment – April 2020 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Novalink is impacted by Denial of service vulnerability in WebSphere Application Server Liberty ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-novalink-is-impacted-by-d… ∗∗∗ Security Bulletin: Websphere Application Server Liberty vulnerabilities used by IBM Streams ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-websphere-application-ser… ∗∗∗ Security Bulletin: Java vulnerability CVE-2019-2949 affecting IBM Streams ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-java-vulnerability-cve-20… ∗∗∗ Security Bulletin: IBM WebSphere Application Server Network Deployment security vulnerabilities in IBM Content Foundation on Cloud ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-websphere-application… ∗∗∗ Security Bulletin: Vulnerability exists in Watson Explorer (CVE-2020-4329) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-exists-in-w… ∗∗∗ Security Bulletin: Vulnerability affects Watson Explorer Foundational Components (CVE-2020-1967) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-affects-wat… ∗∗∗ Security Bulletin: WebSphere security vulnerability in IBM Content Foundation on Cloud ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-websphere-security-vulner… ∗∗∗ Security Bulletin: Java vulnerabilities affecting IBM Streams ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-java-vulnerabilities-affe… ∗∗∗ Security Bulletin: Cross Site Scripting security vulnerabilities in FileNet Content Manager ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-cross-site-scripting-secu… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 22.07.2020
by Daily end-of-shift report 22 Jul '20

22 Jul '20

===================== = End-of-Day report = ===================== Timeframe: Dienstag 21-07-2020 18:00 − Mittwoch 22-07-2020 18:00 Handler: Dimitri Robl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Cybercrime: Der Kampf um die Router ∗∗∗ --------------------------------------------- Router sind für Cyber-Kriminelle eine wichtige Ressource. Das rechtfertigt auch außergewöhnliche Maßnahmen. --------------------------------------------- https://heise.de/-4848764 ∗∗∗ Arbeiterkammer warnt: Bewertungen können zur Falle werden! ∗∗∗ --------------------------------------------- Gesucht: italienische Pizzeria. Gefunden: Pizzeria mit top Bewertungen! Vorsicht! Auch bei Online-Bewertungen gibt es Betrug. So kaufen Unternehmen Fake-Bewertungen, die die Unternehmen besser dastehen lassen sollen als sie sind. Gleichzeitig müssen auch Sie bei Bewertungen darauf achten, was Sie schreiben. Ansonsten könnte eine Klage drohen. Arbeiterkammer (AK) und Internet Ombudsmann haben rechtliche Fragen bei Bewertungsplattformen unter die Lupe genommen. --------------------------------------------- https://www.watchlist-internet.at/news/arbeiterkammer-warnt-bewertungen-koe… ∗∗∗ Phishing-Kampagne nutzt Googles Cloud-Dienste zum Diebstahl von Office-365-Anmeldedaten ∗∗∗ --------------------------------------------- Die Hacker hosten auf Google Drive eine speziell gestaltete PDF-Datei. Die Google Cloud stellt für den Angriff auch eine Phishing-Website bereit. Ähnliche Attacken missbrauchen auch Cloud-Dienste anderer Anbieter wie Microsoft Azur. --------------------------------------------- https://www.zdnet.de/88381697/phishing-kampagne-nutzt-googles-cloud-dienste… ∗∗∗ Emotet botnet is now heavily spreading QakBot malware ∗∗∗ --------------------------------------------- Researchers tracking Emotet botnet noticed that the malware started to push QakBot banking trojan at an unusually high rate, replacing the longtime TrickBot payload. --------------------------------------------- https://www.bleepingcomputer.com/news/security/emotet-botnet-is-now-heavily… ∗∗∗ Format String Vulnerabilities ∗∗∗ --------------------------------------------- C++ and strings The C++ programming language has a couple of different variable types designed to manage text data. These include C strings, which are defined as arrays of characters, and the C++ string data type. These types of variables can be used for a variety of different purposes. The most visible is printing messages [...] --------------------------------------------- https://resources.infosecinstitute.com/format-string-vulnerabilities/ ∗∗∗ Command Injection Vulnerabilities ∗∗∗ --------------------------------------------- What is a command injection vulnerability? Many applications are not designed to be wholly self-contained. They often access external systems as well, including databases, application programming interfaces (APIs) and others. Some applications are designed to run commands within the terminal of the system that they are running on. For example, a program may wish to [...] --------------------------------------------- https://resources.infosecinstitute.com/command-injection-vulnerabilities/ ∗∗∗ How to configure Internet Options for Local Group Policy ∗∗∗ --------------------------------------------- Does this sound familiar? “Welcome to Monopoly!” “All right, now we’re going to go with auctions if you don’t buy.” “Why? That’s so annoying!” “Because if we don’t, it takes forever.” “All right, fine, but I want money if I land on Free Parking.” “Fine, if that’s what it takes. But I want ‘even [...] --------------------------------------------- https://resources.infosecinstitute.com/how-to-configure-internet-options-fo… ∗∗∗ MATA: Multi-platform targeted malware framework ∗∗∗ --------------------------------------------- The MATA malware framework possesses several components, such as loader, orchestrator and plugins. The framework is able to target Windows, Linux and macOS operating systems. --------------------------------------------- https://securelist.com/mata-multi-platform-targeted-malware-framework/97746/ ∗∗∗ A few IoCs related to CVE-2020-5092, (Wed, Jul 22nd) ∗∗∗ --------------------------------------------- I know I am a bit late to the game, but a couple of weeks ago I responded to an incident resulting from an F5 compromise related to CVE-2020-5092. As I responded I captured a number if indicators of compromise. While I have not had a lot of time to dig into them, hopefully they will be of use to somebody. --------------------------------------------- https://isc.sans.edu/diary/rss/26378 ∗∗∗ Malicious Magento User Creator ∗∗∗ --------------------------------------------- We recently found a simple malicious script leveraging Magento’s internal functions to create a new admin user with the admin role “Inchoo” ⁠— probably referring to a Croatian Magento consulting company. The script is simple but very effective and can easily be overlooked as another Magento file without closer inspection. It’s based on a sample that has been circulating the Internet since 2012 and provides a boilerplate for attackers to easily specify user [...] --------------------------------------------- https://blog.sucuri.net/2020/07/malicious-magento-user-creator.html ===================== = Vulnerabilities = ===================== ∗∗∗ Shadow Attacks: Forscher hebeln PDF-Signaturprüfung erneut aus ∗∗∗ --------------------------------------------- 2019 umgingen Forscher von der Ruhr-Universität Bochum die Signatur-Überprüfung von PDF-Software. Nun entwickelten sie erfolgreich drei neue Angriffe. --------------------------------------------- https://heise.de/-4849183 ∗∗∗ Jetzt updaten: Exploit-Code für Patchday-Lücke in SharePoint Server verfügbar ∗∗∗ --------------------------------------------- Gegen eine kritische Lücke in SharePoint Server, Visual Studio und dem .NET Framework gibt es seit dem MS-Patchday Updates. Die Gefahr eines Angriffs steigt. --------------------------------------------- https://heise.de/-4849584 ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (librsvg and squid), Fedora (mailman, mingw-LibRaw, php-horde-kronolith, and targetcli), openSUSE (openconnect), Red Hat (cloud-init, container-tools:rhel8, dbus, java-1.8.0-openjdk, java-11-openjdk, jbig2dec, kernel, kpatch-patch, mod_auth_openidc:2.3, nodejs:10, openstack-keystone, rh-nodejs10-nodejs, sane-backends, thunderbird, and virt:rhel), SUSE (webkit2gtk3 and xrdp), and Ubuntu (evolution-data-server, linux, linux-aws, linux-aws-hwe, [...] --------------------------------------------- https://lwn.net/Articles/826713/ ∗∗∗ Raining SYSTEM Shells with Citrix Workspace app ∗∗∗ --------------------------------------------- TL;DR Citrix Workspace is vulnerable to a remote command execution attack running under the context of the SYSTEM account. By sending a crafted message over a named pipe and spoofing [...] --------------------------------------------- https://www.pentestpartners.com/security-blog/raining-system-shells-with-ci… ∗∗∗ Security Advisory - fastjson Injection Vulnerability in Huawei Products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20200722-… ∗∗∗ Security Bulletin: Multiple Vulnerabilities in jackson-databind shipped with IBM Cloud Pak System ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: IBM Verify Gateway does not hide a cryptographic key in one of its binary files (CVE-2020-4385) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-verify-gateway-does-n… ∗∗∗ Security Bulletin: IBM WebSphere Application Server Network Deployment security vulnerability in IBM Content Foundation on Cloud ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-websphere-application… ∗∗∗ Security Bulletin: WebSphere network security vulnerability in IBM Content Foundation on Cloud ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-websphere-network-securit… ∗∗∗ Security Bulletin: SB0003748 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-sb0003748/ ∗∗∗ Security Bulletin: SB0003749 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-sb0003749/ ∗∗∗ Security Bulletin: WebSphere Application Server security vulnerability in FileNet Content Manager ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-websphere-application-ser… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect z/TPF ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: IBM Verify Gateway does not hide client secrets when debug tracing is active (CVE-2020-4372) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-verify-gateway-does-n… ∗∗∗ Security Bulletin: IBM Verify Gateway PAM components default to cleartext storage of client secret (CVE-2020-4369) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-verify-gateway-pam-co… ∗∗∗ Red Hat OpenShift: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-0746 ∗∗∗ Red Hat Enterprise Linux: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-0745 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 21.07.2020
by Daily end-of-shift report 21 Jul '20

21 Jul '20

===================== = End-of-Day report = ===================== Timeframe: Montag 20-07-2020 18:00 − Dienstag 21-07-2020 18:00 Handler: Dimitri Robl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Microsoft will disable insecure TLS in Office 365 on Oct 15 ∗∗∗ --------------------------------------------- Microsoft has set the official retirement date for the insecure Transport Layer Security (TLS) 1.0 and 1.1 protocols in Office 365 starting with October 15, 2020, after temporarily halting deprecation enforcement for commercial customers due to COVID-19. --------------------------------------------- https://www.bleepingcomputer.com/news/microsoft/microsoft-will-disable-inse… ∗∗∗ Sextortion Update: The Final Final Chapter, (Mon, Jul 20th) ∗∗∗ --------------------------------------------- Even though the Sextortion emails which began in the July of 2018 are old news, and old hat, I am still tracking the BTC Addresses that were holding the money from the successful transactions. --------------------------------------------- https://isc.sans.edu/diary/rss/26334 ∗∗∗ Couple of interesting Covid-19 related stats, (Tue, Jul 21st) ∗∗∗ --------------------------------------------- It is nothing new that Covid-19 forced many organizations around the world to quickly adopt the "work from home" model, which in turn resulted in an increased number of machines offering remote access services and protocols accessible from the internet. --------------------------------------------- https://isc.sans.edu/diary/rss/26374 ∗∗∗ Understanding the Benefits of the Capability Maturity Model Integration (CMMI) ∗∗∗ --------------------------------------------- “Cybersecurity is the leading corporate governance challenge today, yet 87% of C-suite professionals and board members lack confidence in their company’s cybersecurity capabilities. Many CISOs and CSOs focus on implementing standards and frameworks, but what good is compliance if it does not improve your overall cybersecurity resilience? --------------------------------------------- https://www.tripwire.com/state-of-security/featured/understanding-benefits-… ∗∗∗ Kleinanzeigenbetrug: Das können Opfer tun ∗∗∗ --------------------------------------------- Sie haben auf einer Kleinanzeigenplattform, wie ebay, willhaben und Co ein Produkt an einen Kriminellen verkauft? Sie haben den Betrug zu spät erkannt – das Paket wurde bereits aufgegeben? Mit ein wenig Glück, viele Recherche, Kommunikation und Hartnäckigkeit können Sie das Paket möglicherweise stoppen und wieder zurückbekommen! --------------------------------------------- https://www.watchlist-internet.at/news/kleinanzeigenbetrug-das-koennen-opfe… ===================== = Vulnerabilities = ===================== ∗∗∗ Citrix Workspace app for Windows Security Update ∗∗∗ --------------------------------------------- A vulnerability has been identified in the automatic update service of Citrix Workspace app for Windows that could result in: A local user escalating their privilege level to that of an administrator on the computer running Citrix Workspace app for Windows. A remote compromise of the computer running Citrix Workspace app when Windows file sharing (SMB) is enabled. --------------------------------------------- https://support.citrix.com/article/CTX277662 ∗∗∗ Notfallpatches: Adobe stopft kritische Lücken in Bridge, Prelude und Photoshop ∗∗∗ --------------------------------------------- Der Softwarehersteller Adobe hat Sicherheitsupdates außer der Reihe für Android- und Windows-Anwendungen veröffentlicht. --------------------------------------------- https://heise.de/-4849092 ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (ksh), openSUSE (ant, chromium, ldb, samba, and LibVNCServer), Red Hat (dbus, kernel, kernel-rt, and NetworkManager), and SUSE (cni-plugins, firefox, openexr, Salt, salt, SUSE Manager Client Tools, and tomcat). --------------------------------------------- https://lwn.net/Articles/826603/ ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli System Automation for Multiplatforms Oct 2019 CPU ( CVE-2019-2949) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: WML CE: SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-wml-ce-sqlite-through-3-3… ∗∗∗ Security Bulletin: Multiple vulnerabilities affect IBM Cloud Object Storage Systems (July 2020v1) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: SB003732 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-sb003732/ ∗∗∗ Security Bulletin: WML CE: TensorFlow: In SQLite before 3.32.3, select.c mishandles query-flattener optimization ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-wml-ce-tensorflow-in-sqli… ∗∗∗ Security Bulletin: Multiple Security Vulnerabilities in Jackson-databind Affect B2B API of IBM Sterling B2B Integrator ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnera… ∗∗∗ Red Hat Enterprise Linux: Schwachstelle ermöglicht XXE ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-0740 ∗∗∗ Red Hat Enterprise Linux: Schwachstelle ermöglicht Offenlegung von Informationen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-0741 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 20.07.2020
by Daily end-of-shift report 20 Jul '20

20 Jul '20

===================== = End-of-Day report = ===================== Timeframe: Freitag 17-07-2020 18:00 − Montag 20-07-2020 18:00 Handler: Dimitri Robl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Emotet: Erste Angriffswelle nach fünfmonatiger Pause ∗∗∗ --------------------------------------------- Nach mehrmonatiger Pause haben Forscher eine neue Emotet-Angriffswelle beobachtet. Die Ziele lagen vor allem in den USA sowie im Vereinigten Königreich. --------------------------------------------- https://heise.de/-4847070 ∗∗∗ How to use Windows 10 File History to make secure backups ∗∗∗ --------------------------------------------- With File History feature on Windows, you can back up copies of files that are in the Documents, Music, Pictures, Videos, and Desktop folders. --------------------------------------------- https://www.bleepingcomputer.com/news/microsoft/how-to-use-windows-10-file-… ∗∗∗ Zone.Identifier: A Coupe Of Observations, (Sat, Jul 18th) ∗∗∗ --------------------------------------------- In diary entry "Sysmon and Alternate Data Streams", we reported that Sysmon records the content of small Alternate Data Streams (containing text) in the event log. This is useful for the Zone.Identifier ADS, a stream that is added by many browsers to mark a file as orginating from the Internet. Modern browsers will include extra information in Zone.Identifier, like the URL: [...] --------------------------------------------- https://isc.sans.edu/diary/rss/26366 ∗∗∗ Online-Shop-Software: Zwei-Faktor-Authentifizierung für Magento-Shops verfügbar ∗∗∗ --------------------------------------------- Admins können Online-Shops auf Magento-Basis nun effektiver gegen feindliche Übernahmen absichern. --------------------------------------------- https://heise.de/-4847660 ===================== = Vulnerabilities = ===================== ∗∗∗ Windows 10 Store wsreset tool lets attackers bypass antivirus ∗∗∗ --------------------------------------------- A technique that exploits Windows 10 Microsoft Store called wsreset.exe can delete files to bypass antivirus protection on a host without being detected. --------------------------------------------- https://www.bleepingcomputer.com/news/security/windows-10-store-wsreset-too… ∗∗∗ Scanning Activity for ZeroShell Unauthenticated Access, (Sun, Jul 19th) ∗∗∗ --------------------------------------------- In the past 36 hours, an increase in scanning activity to exploit and compromise ZeroShell Linux router began. This router software had several unauthenticated remote code execution released in the past several years, the last one was CVE-2019-12725. The router latest software version can be dowloaded here. --------------------------------------------- https://isc.sans.edu/diary/rss/26368 ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (libopenmpt, nginx, nss, qemu, rails, redis, ruby-sanitize, and tomcat9), Fedora (glibc, libldb, nspr, nss, samba, and webkit2gtk3), openSUSE (cairo, firefox, google-compute-engine, LibVNCServer, mumble, ntp, openconnect, openexr, openldap2, pdns-recursor, python-ipaddress, rubygem-puma, samba, singularity, slirp4netns, thunderbird, xen, and xrdp), and Oracle (.NET Core, .NET Core 3.1, java-1.8.0-openjdk, java-11-openjdk, kernel, and thunderbird). --------------------------------------------- https://lwn.net/Articles/826537/ ∗∗∗ 3 Vulnerabilities Found on AvertX IP Cameras ∗∗∗ --------------------------------------------- Security cameras make up 5% of enterprise IoT devices but account for 33% of all security issues. We found three vulnerabilities in AvertX IP cameras. --------------------------------------------- https://unit42.paloaltonetworks.com/avertx-ip-cameras-vulnerabilities/ ∗∗∗ Security Bulletin: Multiple Oracle Database Server Security Vulnerabilities Affect IBM Emptoris Supplier Lifecycle Mgmt ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-oracle-database-… ∗∗∗ Security Bulletin: WML CE: Pillow before 7.1.0 has multiple out-of-bounds reads ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-wml-ce-pillow-before-7-1-… ∗∗∗ Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU – Jan 2020 – Includes Oracle Jan 2020 CPU affect IBM Content Classification ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sdk-java-technology-e… ∗∗∗ Security Bulletin: Multiple Oracle Database Server Security Vulnerabilities Affect IBM Emptoris Sourcing ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-oracle-database-… ∗∗∗ Security Bulletin: IBM Planning Analytics Workspace is affected by security vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-planning-analytics-wo… ∗∗∗ Security Bulletin: WML CE: In Pillow before 7.1.0, there is a Buffer Overflow ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-wml-ce-in-pillow-before-7… ∗∗∗ Security Bulletin: Multiple Oracle Database Server Security Vulnerabilities Affect IBM Emptoris Strategic Supply Management Platform ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-oracle-database-… ∗∗∗ Security Bulletin: WML CE: libjpeg-turbo 2.0.4, and mozjpeg 4.0.0, has a heap-based buffer over-read ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-wml-ce-libjpeg-turbo-2-0-… ∗∗∗ Security Bulletin: WML CE: SQLite through 3.32.2 has has a use-after-free problem. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-wml-ce-sqlite-through-3-3… ∗∗∗ Security Bulletin: A vulnerability in Jackson Databind affects IBM Operations Analytics Predictive Insights (CVE-2020-8840) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-jackso… ∗∗∗ Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Rails ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-watson-discovery-for-… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 17.07.2020
by Daily end-of-shift report 17 Jul '20

17 Jul '20

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 16-07-2020 18:00 − Freitag 17-07-2020 18:00 Handler: Dimitri Robl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ MMS Exploit Part 1: Introduction to the Samsung Qmage Codec and Remote Attack Surface ∗∗∗ --------------------------------------------- This post is the first of a multi-part series capturing my journey from discovering a vulnerable little-known Samsung image codec, to completing a remote zero-click MMS attack that worked on the latest Samsung flagship devices. New posts will be published as they are completed and will be linked here when complete. --------------------------------------------- https://googleprojectzero.blogspot.com/2020/07/mms-exploit-part-1-introduct… ∗∗∗ Zoom Addresses Vanity URL Zero-Day ∗∗∗ --------------------------------------------- A previously undisclosed bug in Zoom’s customizable URL feature has been addressed that could have offered a hacker a perfect social-engineering avenue for stealing credentials or sensitive information. --------------------------------------------- https://threatpost.com/zoom-vanity-url-zero-day/157510/ ∗∗∗ Fake WordPress Plugin SiteSpeed Serves Malicious Ads & Backdoors ∗∗∗ --------------------------------------------- Fake WordPress plugins appear to be trending as an effective way of establishing a foothold on compromised websites. During a recent investigation, we discovered a fake component which was masquerading as a legitimate plugin. Named SiteSpeed, it contained a lot of interesting malicious capabilities. --------------------------------------------- https://blog.sucuri.net/2020/07/fake-wordpress-plugin-sitespeed-malware-bac… ∗∗∗ capa: Automatically Identify Malware Capabilities ∗∗∗ --------------------------------------------- capa is the FLARE team’s newest open-source tool for analyzing malicious programs. Our tool provides a framework for the community to encode, recognize, and share behaviors that we’ve seen in malware. Regardless of your background, when you use capa, you invoke decades of cumulative reverse engineering experience to figure out what a program does. In this post you will learn how capa works, how to install and use the tool, and why you should integrate it into your triage workflow [...] --------------------------------------------- http://www.fireeye.com/blog/threat-research/2020/07/capa-automatically-iden… ∗∗∗ Threat modelling and IoT hubs ∗∗∗ --------------------------------------------- IoT hubs are increasingly being used to provide a single point of access to the myriad of smart devices in the home. One ring to rule them all, if rather [...] --------------------------------------------- https://www.pentestpartners.com/security-blog/threat-modelling-and-iot-hubs/ ∗∗∗ Diese Betrugsmaschen sollten GamerInnen kennen (Teil 2) ∗∗∗ --------------------------------------------- Ob Phishing-Versuche oder Fake-Shops: Die Betrugsmaschen im Gaming-Bereich unterscheiden sich teilweise kaum von anderen Betrügereien im Internet. Wir sammeln die häufigsten Betrugsmaschen und erklären, wie Sie diese erkennen und dagegen vorgehen können. Im zweiten Teil zeigen wir Ihnen Betrugsmaschen rund um Schadsoftware, Fake-Shops und betrügerische Apps. --------------------------------------------- https://www.watchlist-internet.at/news/diese-betrugsmaschen-sollten-gamerin… ∗∗∗ Diebold Nixdorf warns of a new class of ATM black box attacks across Europe ∗∗∗ --------------------------------------------- New ATM black box (jackpotting) attacks have been spotted in Belgium. --------------------------------------------- https://www.zdnet.com/article/diebold-nixdorf-warns-of-a-new-class-of-atm-b… ∗∗∗ Mac cryptocurrency trading application rebranded, bundled with malware ∗∗∗ --------------------------------------------- ESET researchers lure GMERA malware operators to remotely control their Mac honeypots --------------------------------------------- https://www.welivesecurity.com/2020/07/16/mac-cryptocurrency-trading-applic… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Fedora (bashtop and python39), openSUSE (openexr), Red Hat (java-1.8.0-openjdk), and Scientific Linux (thunderbird). --------------------------------------------- https://lwn.net/Articles/826367/ ∗∗∗ Security Bulletin: Vulnerabilities in Dojo affect IBM Spectrum Protect for Virtual Environments (CVE-2020-5259, CVE-2020-5258) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-dojo-a… ∗∗∗ Security Bulletin: IBM Spectrum Protect Backup-Archive Client web user interface, IBM Spectrum Protect for Space Management, and IBM Spectrum Protect for Virtual Environments are vulnerabile to Logjam (CVE-2015-4000) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-spectrum-protect-back… ∗∗∗ Security Bulletin: IBM Spectrum Protect Snapshot for VMware is vulnerable to Logjam (CVE-2015-4000) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-spectrum-protect-snap… ∗∗∗ Security Bulletin: Vulnerabilities in Dojo affect IBM Spectrum Protect Snapshot for VMware (CVE-2020-5259, CVE-2020-5258) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-dojo-a… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java JRE, 8.0-1.1 affect IBM Netezza Platform Software clients. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Addressing the Sqlite Vulnerability CVE-2020-11656, CVE-2020-11655 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-addressing-the-sqlite-vul… ∗∗∗ Security Bulletin: IBM Java Runtime Vulnerability affects IBM Spectrum Protect Snapshot for VMware (CVE-2020-2654) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-java-runtime-vulnerab… ∗∗∗ Security Bulletin: IBM WebSphere Application Server Liberty XSS Vulnerabilities Affect IBM Control Center (CVE-2020-4303, CVE-2020-4304) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-websphere-application… ∗∗∗ Security Bulletin: Apache CXF XSS Vulnerability Affects IBM Control Center (CVE-2019-17573) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-apache-cxf-xss-vulnerabil… ∗∗∗ Security Bulletin: WebSphere Application Server is vulnerable to a remote code execution vulnerability (CVE-2020-4464) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-websphere-application-ser… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 16.07.2020
by Daily end-of-shift report 16 Jul '20

16 Jul '20

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 15-07-2020 18:00 − Donnerstag 16-07-2020 18:00 Handler: Dimitri Robl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ BlackRock - the Trojan that wanted to get them all ∗∗∗ --------------------------------------------- Around May 2020 ThreatFabric analysts have uncovered a new strain of banking malware dubbed BlackRock that looked pretty familiar. After investigation, it became clear that this newcomer is derived from the code of the Xerxes banking malware, which itself is a strain of the LokiBot Android banking Trojan. The source code of the Xerxes malware was made public by its author around May 2019, which means that it is accessible to any threat actor. --------------------------------------------- https://www.threatfabric.com/blogs/blackrock_the_trojan_that_wanted_to_get_… ∗∗∗ Windows Server Containers Are Open, and Here’s How You Can Break Out ∗∗∗ --------------------------------------------- We demonstrate a complete technique to escalate privileges and escape Windows Server Containers.The post Windows Server Containers Are Open, and Here’s How You Can Break Out appeared first on Unit42. --------------------------------------------- https://unit42.paloaltonetworks.com/windows-server-containers-vulnerabiliti… ===================== = Vulnerabilities = ===================== ∗∗∗ Xen Security Advisory XSA-329 - Linux ioperm bitmap context switching issues ∗∗∗ --------------------------------------------- IO port permissions dont get rescinded when context switching to an unprivileged task. Therefore, all userspace can use the IO ports granted to the most recently scheduled task with IO port permissions. --------------------------------------------- https://xenbits.xen.org/xsa/advisory-329.html ∗∗∗ Schadcode-Lücken gefährden Router von Cisco ∗∗∗ --------------------------------------------- Der Netzwerkausrüster Cisco holt zum Rundumschlag aus und veröffentlicht quer durch die eigenen Produktreihen Sicherheitsupdates. --------------------------------------------- https://heise.de/-4845109 https://tools.cisco.com/security/center/Search.x?publicationTypeIDs=1&first… ∗∗∗ 2 Million Users Affected by Vulnerability in All in One SEO Pack ∗∗∗ --------------------------------------------- On July 10, 2020, our Threat Intelligence team discovered a vulnerability in All In One SEO Pack, a WordPress plugin installed on over 2 million sites. This flaw allowed authenticated users with contributor level access or above the ability to inject malicious scripts that would be executed if a victim accessed the wp-admin panel's [...] --------------------------------------------- https://www.wordfence.com/blog/2020/07/2-million-users-affected-by-vulnerab… ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (evolution-data-server and webkit2gtk), Fedora (kernel, snapd, and xen), openSUSE (thunderbird and xen), Oracle (dbus and thunderbird), Red Hat (java-1.8.0-openjdk, java-11-openjdk, jbig2dec, sane-backends, and thunderbird), Scientific Linux (kernel), SUSE (cairo, containerd, docker, docker-runc, golang-github-docker-libnetwork, google-compute-engine, mailman, mercurial, openconnect, openexr, and xrdp), and Ubuntu (libvpx and snapd). --------------------------------------------- https://lwn.net/Articles/826288/ ∗∗∗ Synology-SA-20:18 DSM ∗∗∗ --------------------------------------------- Multiple vulnerabilities allow remote attackers to conduct man-in-the-middle attacks via a susceptible version of Synology DiskStation Manager (DSM). --------------------------------------------- https://www.synology.com/en-global/support/security/Synology_SA_20_18 ∗∗∗ Trend Micro Internet Security: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-0724 ∗∗∗ Nagios Enterprises Nagios XI: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-0721 ∗∗∗ macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierra ∗∗∗ --------------------------------------------- https://support.apple.com/kb/HT211289 ∗∗∗ iOS 13.6 and iPadOS 13.6 ∗∗∗ --------------------------------------------- https://support.apple.com/kb/HT211288 ∗∗∗ tvOS 13.4.8 ∗∗∗ --------------------------------------------- https://support.apple.com/kb/HT211290 ∗∗∗ watchOS 6.2.8 ∗∗∗ --------------------------------------------- https://support.apple.com/kb/HT211291 ∗∗∗ Security Advisory - Windows DNS Server Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20200716-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli System Automation Application Manager Oct 2019 CPU (CVE-2019-2949) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: XML External Entity Injection (XXE) Vulnerability Affects IBM Secure External Authentication Server (CVE-2020-4462) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-xml-external-entity-injec… ∗∗∗ Security Bulletin: Cross-site Scripting and Vulnerable library – JQuery v1.11.1 affects IBM Engineering Workflow Management ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-cross-site-scripting-and-… ∗∗∗ Security Bulletin: Missing Cookie Attribute Vulnerability Affects IBM Secure Proxy ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-missing-cookie-attribute-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli System Automation Application Manager Jan 2020 CPU (CVE-2020-2654) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: IBM Java Runtime Vulnerability Affects IBM Secure External Authentication Server (CVE-2020-2654) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-java-runtime-vulnerab… ∗∗∗ Security Bulletin: : HTTP Header Weakness Affects IBM Secure External Authentication Server ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-http-header-weakness-affe… ∗∗∗ Security Bulletin: Cross-site scripting vulnerability affects IBM Jazz Foundation and IBM Engineering products. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-cross-site-scripting-vuln… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli System Automation for Multiplatforms Jan 2020 CPU (CVE-2020-2654) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Publicly disclosed vulnerabilities from Kernel affect IBM Netezza Host Management ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-publicly-disclosed-vulner… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 15.07.2020
by Daily end-of-shift report 15 Jul '20

15 Jul '20

===================== = End-of-Day report = ===================== Timeframe: Dienstag 14-07-2020 18:00 − Mittwoch 15-07-2020 18:00 Handler: Dimitri Robl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Windows Server: Sigred ist eine wurmartige kritische Lücke in Windows DNS ∗∗∗ --------------------------------------------- Der Bug betrifft alle Maschinen mit Windows Server 2003 bis 2019. Microsoft rät zum Patch, da sich Malware darüber selbst ausbreiten kann. --------------------------------------------- https://www.golem.de/news/windows-server-sigred-ist-eine-wurmartige-kritisc… ∗∗∗ Spamdexing (SEO spam malware) ∗∗∗ --------------------------------------------- Introduction: About SEO spam - is my website a target? You’ve spent time and energy in positioning your website high in search engine rankings through good SEO practices. You realize, however, that someone has hijacked your site by inserting their own spam. You are a victim of SEO spam, otherwise known as spamdexing, web spam, [...] --------------------------------------------- https://resources.infosecinstitute.com/spamdexing-seo-spam-malware/ ∗∗∗ Word docs with macros for IcedID (Bokbot), (Wed, Jul 15th) ∗∗∗ --------------------------------------------- Today's diary reviews Microsoft Word documents with macros to infect vulnerable Windows hosts with IcedID malware (also known as Bokbot) on Tuesday 2020-07-14. This campaign has previously pushed Valak or Ursnif, often with IcedID as the follow-up malware to these previous infections. --------------------------------------------- https://isc.sans.edu/diary/rss/26352 ∗∗∗ Simple DGA Spotted in a Malicious PowerShell ∗∗∗ --------------------------------------------- DGA (“Domain Generation Algorithm“) is a technique implemented in some malware families to defeat defenders and to make the generation of IOC’s (and their usage – example to implement black lists) more difficult. When a piece of malware has to contact a C2 server, it uses domain names or IP [...] --------------------------------------------- https://blog.rootshell.be/2020/07/14/simple-dga-spotted-in-a-malicious-powe… ∗∗∗ Website misconfigurations and other errors to avoid ∗∗∗ --------------------------------------------- Website misconfigurations can lead to hacking, malfunction, and worse. We take a look at recent mishaps and advise site owners on how to lock down their platforms. --------------------------------------------- https://blog.malwarebytes.com/how-tos-2/2020/07/website-misconfigurations-a… ∗∗∗ Diese Betrugsmaschen sollten GamerInnen kennen (Teil 1) ∗∗∗ --------------------------------------------- Ob Phishing-Versuche oder Fake-Shops: Die Betrugsmaschen im Gaming-Bereich unterscheiden sich teilweise kaum von anderen Betrügereien im Internet. Wir sammeln die häufigsten Betrugsmaschen und erklären, wie Sie diese erkennen und dagegen vorgehen können. Im ersten Teil zeigen wir Ihnen die betrügerischen Tricks rund um Phishing und Accountdiebstahl. --------------------------------------------- https://www.watchlist-internet.at/news/diese-betrugsmaschen-sollten-gamerin… ===================== = Vulnerabilities = ===================== ∗∗∗ Microsoft July 2020 Patch Tuesday - Patch Now!, (Tue, Jul 14th) ∗∗∗ --------------------------------------------- This month we got patches for 123 vulnerabilities. Of these, 17 are critical and 2 were previously disclosed. --------------------------------------------- https://isc.sans.edu/diary/rss/26350 ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by CentOS (dbus), Debian (python3.5), Fedora (podofo and roundcubemail), Oracle (dbus, dovecot, jbig2dec, kernel, nodejs:10, nodejs:12, sane-backends, and thunderbird), Red Hat (.NET Core and kernel), SUSE (ansible, ansible1, ardana-ansible, ardana-cluster, ardana-freezer, ardana-input-model, ardana-logging, ardana-mq, ardana-neutron, ardana-octavia, ardana-osconfig, caasp-openstack-heat-templates, crowbar-core, crowbar-openstack, [...] --------------------------------------------- https://lwn.net/Articles/826181/ ∗∗∗ Security Advisory - Two Vulnerabilities in SaltStack Salt ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20200715-… ∗∗∗ Security Advisory - Apache Tomcat File Inclusion Vulnerability ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20200715-… ∗∗∗ Security Bulletin: IBM has released a Unified Extensible Firmware Interface (UEFI) fix in response to an Intel escalation of information disclosure vulnerability ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-has-released-a-unifie… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli System Automation for Multiplatforms Apr 2020 CPU ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Vulnerabilities in Java affect the IBM FlashSystem 900 (CVE-2019-2989 and CVE-2019-2964) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-java-a… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli System Automation Application Manager Apr 2020 CPU (CVE-2020-2805, CVE-2020-2803, CVE-2020-2757, CVE-2020-2756) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM eDiscovery Analyzer ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Apache Tomcat: Mehrere Schwachstellen ermöglichen Denial of Service ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-0717 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 14.07.2020
by Daily end-of-shift report 14 Jul '20

14 Jul '20

===================== = End-of-Day report = ===================== Timeframe: Montag 13-07-2020 18:00 − Dienstag 14-07-2020 18:00 Handler: Thomas Pribitzer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ SCANdalous! (External Detection Using Network Scan Data and Automation) ∗∗∗ --------------------------------------------- Real Quick In case you’re thrown by that fantastic title, our lawyers made us change the name of this project so we wouldn’t get sued. SCANdalous—a.k.a. Scannah Montana a.k.a. Scanny McScanface a.k.a. “Scan I Kick It? (Yes You Scan)”—had another name before today that, for legal reasons, we’re keeping to ourselves. A special thanks to our legal team who is always looking out for us, this blog post would be a lot less fun without them. Strap in folks. --------------------------------------------- http://www.fireeye.com/blog/threat-research/2020/07/scandalous-external-det… ∗∗∗ Vorsicht vor betrügerischer Werbung auf Facebook ∗∗∗ --------------------------------------------- Facebook und Instagram, durchaus lukrative Werbekanäle. Dass haben auch Kriminelle erkannt. Mit der Botschaft, dass die Shops luvpatient.com, liebesfreund.de und colorootd.com die Corona-Krise angeblich nicht überstanden haben, werden Produkte zu sehr günstigen Preisen im Feed oder zwischen den Stories beworben. Doch Vorsicht: Die bestellte Ware kommt nicht oder nur in minderwertiger Qualität an! --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-vor-betruegerischer-werbung… ===================== = Vulnerabilities = ===================== ∗∗∗ Security Bulletins Posted ∗∗∗ --------------------------------------------- Adobe has published security bulletins for Adobe Creative Cloud Desktop Application (APSB20-33), Adobe Media Encoder (APSB20-36), Adobe Genuine Service (APSB20-37), Adobe ColdFusion (APSB20-43) and Adobe Download Manager (APSB20-49). Adobe recommends users update their product installations to the latest versions using the instructions referenced in the bulletin. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1893 ∗∗∗ SAP Patchday Juli 2020 ∗∗∗ --------------------------------------------- Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in mehreren SAP Produkten ausnutzen, um die Kontrolle über SAP Anwendungen zu übernehmen, um Informationen offenzulegen, um einen Cross-Site Scripting Angriff durchzuführen und um weitere, nicht spezifizierte Auswirkungen zu erreichen. --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K20-0690 ∗∗∗ SSA-305120 (Last Update: 2020-07-14): Vulnerabilities in SICAM MMU, SICAM T and SICAM SGU ∗∗∗ --------------------------------------------- SICAM MMU, SICAM T and the discontinued SICAM SGU devices are affected by multiple security vulnerabilities which could allow an attacker to perform a variety of attacks. This may include unauthenticated firmware installation, remote code execution and leakage of confidential data like passwords. Siemens has released updates to introduce authentication to the web application. It is still recommended to implement further mitigations, as most of the vulnerabilities might not be sufficiently [...] --------------------------------------------- https://cert-portal.siemens.com/productcert/txt/ssa-305120.txt ∗∗∗ SSA-364335 (Last Update: 2020-07-14): Clear Text Transmission Vulnerability on SIMATIC HMI Panels ∗∗∗ --------------------------------------------- A clear text transmission vulnerability in SIMATIC HMI panels could allow an attacker to access sensitive information under certain circumstances.Siemens recommends specific countermeasures to mitigate this vulnerability. --------------------------------------------- https://cert-portal.siemens.com/productcert/txt/ssa-364335.txt ∗∗∗ SSA-573753 (Last Update: 2020-07-14): Remote Code Execution in Siemens LOGO! Web Server ∗∗∗ --------------------------------------------- The latest update for LOGO! 8 BM devices fixes a vulnerability that could allow remote code execution in the web server functionality.Siemens provides a firmware update for the latest versions of LOGO! BM. --------------------------------------------- https://cert-portal.siemens.com/productcert/txt/ssa-573753.txt ∗∗∗ SSA-589181 (Last Update: 2020-07-14): Denial-Of-Service in SIMATIC S7-200 SMART CPU Family Devices ∗∗∗ --------------------------------------------- The latest update for SIMATIC S7-200 SMART fixes a vulnerability that could allow an attacker to cause a permanent Denial-of-Service of an affected device by sending a large number of crafted packets.Siemens has released an update for the SIMATIC S7-200 SMART CPU family and recommends that customers update to the latest version. --------------------------------------------- https://cert-portal.siemens.com/productcert/txt/ssa-589181.txt ∗∗∗ SSA-604937 (Last Update: 2020-07-14): Multiple Web Server Vulnerabilities in Opcenter Execution Core ∗∗∗ --------------------------------------------- The latest update of Opcenter Execution Core fixes multiple vulnerabilities where the most severe could allow an attacker to perform a cross-site scripting (XSS) attack under certain conditions.Siemens has released an update for the Opcenter Execution Core and recommends that customers update to the latest version. Siemens recommends specific countermeasures as there are currently no further fixes available. --------------------------------------------- https://cert-portal.siemens.com/productcert/txt/ssa-604937.txt ∗∗∗ SSA-631949 (Last Update: 2020-07-14): Ripple20 and Intel SPS Vulnerabilities in SPPA-T3000 Solutions ∗∗∗ --------------------------------------------- SPPA-T3000 solutions are affected by vulnerabilities that were recently dislosed by JSOF research lab (“Ripple20”) for the TCP/IP stack used in APC UPS systems, and by Intel for the Server Platform Services (SPS) used in SPPA-T3000 Application Server and Terminal Server hardware.The advisory provides information to what amount SPAA-T3000 solutions are affected. --------------------------------------------- https://cert-portal.siemens.com/productcert/txt/ssa-631949.txt ∗∗∗ SSA-841348 (Last Update: 2020-07-14): Multiple Vulnerabilities in the UMC Stack ∗∗∗ --------------------------------------------- The latest update for the below listed products fixes two security vulnerabilities that could allow an attacker to cause a partial Denial-of-Service on the UMC component of the affected devices under certain circumstances, and one vulnerability that could allow an attacker to locally escalate privileges from a user with administrative privileges to execute code with SYSTEM level privileges. --------------------------------------------- https://cert-portal.siemens.com/productcert/txt/ssa-841348.txt ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Fedora (mingw-podofo and python-rsa), openSUSE (LibVNCServer, mozilla-nss, nasm, openldap2, and permissions), Red Hat (dovecot, sane-backends, and thunderbird), Scientific Linux (dbus), and SUSE (firefox and thunderbird). --------------------------------------------- https://lwn.net/Articles/826113/ ∗∗∗ [20200706] - Core - System Information screen could expose redis or proxy credentials ∗∗∗ --------------------------------------------- https://developer.joomla.org:443/security-centre/823-20200706-core-system-i… ∗∗∗ [20200705] - Core - Escape mod_random_image link ∗∗∗ --------------------------------------------- https://developer.joomla.org:443/security-centre/822-20200705-core-escape-m… ∗∗∗ [20200704] - Core - Variable tampering via user table class ∗∗∗ --------------------------------------------- https://developer.joomla.org:443/security-centre/821-20200704-core-variable… ∗∗∗ [20200703] - Core - CSRF in com_privacy remove-request feature ∗∗∗ --------------------------------------------- https://developer.joomla.org:443/security-centre/820-20200703-core-csrf-in-… ∗∗∗ [20200702] - Core - Missing checks can lead to a broken usergroups table record ∗∗∗ --------------------------------------------- https://developer.joomla.org:443/security-centre/819-20200702-core-missing-… ∗∗∗ [20200701] - Core - CSRF in com_installer ajax_install endpoint ∗∗∗ --------------------------------------------- https://developer.joomla.org:443/security-centre/818-20200701-core-csrf-in-… ∗∗∗ Security Bulletin: Apache Tika as used by IBM QRadar SIEM is vulnerable to a denial of service (CVE-2020-1951, CVE-2020-1950) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-apache-tika-as-used-by-ib… ∗∗∗ Security Bulletin: IBM QRadar is vulnerable to an XML External Entity Injection (XXE) attack (CVE-2020-4510) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-qradar-is-vulnerable-… ∗∗∗ Security Bulletin: IBM QRadar SIEM is vulnerable to cross-site scripting (CVE-2020-4513) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-qradar-siem-is-vulner… ∗∗∗ Security Bulletin: Vulnerabilities in Java affect the IBM FlashSystem 900 (CVE-2019-2989 and CVE-2019-2964) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-java-a… ∗∗∗ Security Bulletin: IBM QRadar SIEM is vulnerable to denial of service (CVE-2020-4511) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-qradar-siem-is-vulner… ∗∗∗ Security Bulletin: IBM QRadar SIEM is vulnerable to Using Components with Known Vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-qradar-siem-is-vulner… ∗∗∗ Security Bulletin: IBM QRadar SIEM is vulnerable to command injection (CVE-2020-4512) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-qradar-siem-is-vulner… ∗∗∗ Security Bulletin: IBM QRadar SIEM is vulnerable to cross-site scripting (CVE-2020-4364) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-qradar-siem-is-vulner… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 13.07.2020
by Daily end-of-shift report 13 Jul '20

13 Jul '20

===================== = End-of-Day report = ===================== Timeframe: Freitag 10-07-2020 18:00 − Montag 13-07-2020 18:00 Handler: Thomas Pribitzer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Malware adds online sandbox detection to evade analysis ∗∗∗ --------------------------------------------- Malware developers are now checking if their malware is running in the Any.Run malware analysis service to prevent their malware from being easily analyzed by researchers. --------------------------------------------- https://www.bleepingcomputer.com/news/security/malware-adds-anyrun-sandbox-… ∗∗∗ Hidden Miners ∗∗∗ --------------------------------------------- It is always a good idea to have multiple options when it comes to making a profit. This is especially true for criminals. Having a backdoor is nice, but having the backdoored system directly make money is even better. --------------------------------------------- https://www.gdatasoftware.com/blog/2020/07/36122-hidden-miners ∗∗∗ Scanning Home Internet Facing Devices to Exploit, (Sat, Jul 11th) ∗∗∗ --------------------------------------------- In the past 45 days, I noticed a surge of activity in my honeypot logs for home router exploitation. This is a summary of the various hosts and IP addresses with potential exploit packages available for download. What is also interesting is the fact that most URL were only IP based, no hostname associated with them. --------------------------------------------- https://isc.sans.edu/diary/rss/26340 ∗∗∗ Injecting Magecart into Magento Global Config ∗∗∗ --------------------------------------------- At the beginning of June 2020, we were contacted about a Magento website breach that caused a leak of credit card numbers. A thorough analysis of the website identified the webpage’s footer had malicious code added to it. --------------------------------------------- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/injecting-m… ∗∗∗ Introducing Winbindex - the Windows Binaries Index ∗∗∗ --------------------------------------------- I indexed all Windows files which appear in Windows update packages, and created a website which allows to quickly view information about the files and download some of them from Microsoft servers. The files that can be downloaded are executable files (currently exe, dll and sys files). --------------------------------------------- https://m417z.com/Introducing-Winbindex-the-Windows-Binaries-Index/ ∗∗∗ Threat spotlight: WastedLocker, customized ransomware ∗∗∗ --------------------------------------------- WastedLocker ransomware, attributed to the Russian Evil Corp gang, is such a targeted threat, you might call it a custom-built ransomware family. --------------------------------------------- https://blog.malwarebytes.com/threat-spotlight/2020/07/threat-spotlight-was… ∗∗∗ TrickBot Malware Warning Victims of Infection by Mistake ∗∗∗ --------------------------------------------- Security researchers observed some variants of the TrickBot malware family mistakenly warning victims that they had suffered an infection. Advanced Intel’s Vitali Kremez traced the mistake to “password-stealing grabber.dll.” This module is responsible for stealing browser credentials and cookies from Google Chrome, Microsoft Edge and other web browsers that are stored on a victim’s machine. --------------------------------------------- https://www.tripwire.com/state-of-security/security-data-protection/trickbo… ∗∗∗ TrickBots new API-Hammering explained ∗∗∗ --------------------------------------------- As usual, at Joe Security, we keep a close eye on evasive malware. Some days ago we detected an interesting sample, MD5: b32d28ebab62e99cd2d46aca8b2ffb81. It turned out to be a new TrickBot sample using API hammering to bypass analysis. In this blog post, we will outline the evasion and explain how it works. --------------------------------------------- http://blog.joesecurity.org/2020/07/trickbots-new-api-hammering-explained.h… ∗∗∗ Researchers create magstripe versions from EMV and contactless cards ∗∗∗ --------------------------------------------- Banking industry loophole reported more than a decade ago still remains open and ripe for exploitation today. --------------------------------------------- https://www.zdnet.com/article/researchers-create-magstripe-versions-of-emv-… ∗∗∗ This botnet has surged back into action spreading a new ransomware campaign via phishing emails ∗∗∗ --------------------------------------------- Theres been a big jump in Phorpiex botnet activity - but its a trojan malware attack that was the most common malware campaign in June. --------------------------------------------- https://www.zdnet.com/article/this-botnet-has-surged-back-into-action-sprea… ===================== = Vulnerabilities = ===================== ∗∗∗ Popular TP-Link Family of Kasa Security Cams Vulnerable to Attack ∗∗∗ --------------------------------------------- Researcher warns the highly-rated Kasa family of security cameras have bugs that gives hackers access to private video feeds and settings. --------------------------------------------- https://threatpost.com/popular-tp-link-family-of-kasa-security-cams-vulnera… ∗∗∗ macOS-Sicherheitslücke: Komplettes Dateisystem ohne Zugriffsrechte auslesbar ∗∗∗ --------------------------------------------- In mount_apfs steckte ein Bug, der Apples Systemschutz zumindest read-only aushebeln konnte. Ein Fix ist da, doch der ist eher ungewöhnlich. --------------------------------------------- https://heise.de/-4841670 ∗∗∗ Remote Code Execution Vulnerability in Zoom Client for Windows (0day) ∗∗∗ --------------------------------------------- [Update 7/13/2020: Zoom only took one (!) day to issue a new version of Client for Windows that fixes this vulnerability, which is remarkable. We have reviewed their fix and can confirm that it efficiently resolves the vulnerability. --------------------------------------------- https://blog.0patch.com/2020/07/remote-code-execution-vulnerability-in.html ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (chromium, mailman, openjpeg2, ruby-rack, squid3, tomcat8, and xen), Fedora (botan2, kernel, LibRaw, mingw-OpenEXR, mingw-podofo, podofo, seamonkey, squid, and webkit2gtk3), Mageia (ffmpeg, mbedtls, mediawiki, and xpdf), Oracle (kernel), Red Hat (bind, dbus, jbig2dec, and rh-nodejs12-nodejs), and SUSE (graphviz and xen). --------------------------------------------- https://lwn.net/Articles/826038/ ∗∗∗ Sophos XG Firewall: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit den Rechten des Dienstes ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-0686 ∗∗∗ Atlassian Jira Software: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-0688 ∗∗∗ Red Hat Enterprise Linux: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit den Rechten des Dienstes ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-0687 ∗∗∗ Security Bulletin: Multiple vulnerabilities of Mozilla Firefox (less than Firefox 68.8 ESR) hava affected Synthetic Playback Agent 8.1.4.0-8.1.4 IF11 + ICAM2019.3.0 – 2020.1.0 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Addressing the Sqlite Vulnerability CVE-2020-11656, CVE-2020-11655 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-addressing-the-sqlite-vul… ∗∗∗ Security Bulletin: Multiple vulnerabilities in the IBM SDK, Java Technology Edition affects IBM Performance Management products ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple Vulnerabilities in IBM® Java SDK affect IBM StoredIQ InstaScan ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server Liberty shipped with IBM StoredIQ InstaScan (CVE-2019-17495) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: Multiple Vulnerabilities in IBM® Java SDK affect IBM StoredIQ InstaScan ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in the IBM SDK, Java Technology Edition affects IBM Performance Management products ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in the IBM SDK, Java Technology Edition affects IBM Performance Management products ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Vulnerability identified in Apache ActiveMQ used in Cloud Pak System (CVE-2020-1941) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-identified-… ∗∗∗ Security Bulletin: IBM StoredIQ is affected by a vulnerability in NGINX (CVE-2019-20372) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-storediq-is-affected-… ∗∗∗ Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server Liberty shipped with IBM StoredIQ (CVE-2019-17495) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily