Daily

daily@lists.cert.at

1 participants
3210 discussions

Tageszusammenfassung - 27.01.2020
by Daily end-of-shift report 27 Jan '20

27 Jan '20

===================== = End-of-Day report = ===================== Timeframe: Freitag 24-01-2020 18:00 − Montag 27-01-2020 18:00 Handler: Thomas Pribitzer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ DIVD-2020-00002 - Wildcard certificates Citrix ADC ∗∗∗ --------------------------------------------- Our analysis of the scan data collected on the night of January 9 to 10 shows that of the more than 700 vulnerable Citrix servers identified in the Netherlands, over 450 used wildcard certificates. [...] Recommendation: Revoke and replace certificates (preferably for non-wildcard versions) unless you can reliable determine that the Citrix system wasn't compromised. --------------------------------------------- https://www.securitymeldpunt.nl/cases/DIVD-2020-00002/ ∗∗∗ Mitsubishi-Hack: Sicherheitslücke in Anti-Viren-Software als Einfallstor ∗∗∗ --------------------------------------------- Es gibt neue Details über die Hacker-Attacke auf Mitsubishi Electric. Mittlerweile ist die Sicherheitslücke bekannt und was die Angreifer kopiert haben. --------------------------------------------- https://heise.de/-4646386 ∗∗∗ Potenziell schädlich: Mozilla löscht 197 Add-ons für Firefox ∗∗∗ --------------------------------------------- Mozilla hat insgesamt 197 Add-ons für Firefox gelöscht, die potenziell schädlich waren. Die meisten stammten vom selben Anbieter. --------------------------------------------- https://heise.de/-4646392 ∗∗∗ New Ryuk Info Stealer Targets Government and Military Secrets ∗∗∗ --------------------------------------------- A new version of the Ryuk Stealer malware has been enhanced to allow it to steal a greater amount of confidential files related to the military, government, financial statements, banking, and other sensitive data. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-ryuk-info-stealer-target… ∗∗∗ Does Your Domain Have a Registry Lock? ∗∗∗ --------------------------------------------- If youre running a business online, few things can be as disruptive or destructive to your brand as someone stealing your companys domain name and doing whatever they wish with it. Even so, most major Web site owners arent taking full advantage of the security tools available to protect their domains from being hijacked. Heres the story of one recent victim who was doing almost everything possible to avoid such a situation and still had a key domain stolen by scammers. --------------------------------------------- https://krebsonsecurity.com/2020/01/does-your-domain-have-a-registry-lock/ ∗∗∗ PoC Exploits Created for Recently Patched BlueGate Windows Server Flaws ∗∗∗ --------------------------------------------- Proof-of-concept (PoC) exploits have been released for two recently patched Remote Desktop Gateway vulnerabilities that can be exploited for remote code execution. --------------------------------------------- https://www.securityweek.com/poc-exploits-created-recently-patched-bluegate… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (jsoup and slirp), Fedora (community-mysql, elog, fontforge, libuv, libvpx, mingw-podofo, nodejs, opensc, podofo, thunderbird-enigmail, transfig, and xfig), openSUSE (arc, libssh, and libvpx), Red Hat (git, java-1.8.0-openjdk, java-11-openjdk, python-reportlab, and sqlite), Slackware (thunderbird), and SUSE (java-1_8_0-openjdk, python, and samba). --------------------------------------------- https://lwn.net/Articles/810614/ ∗∗∗ Fortinet removes SSH and database backdoors from its SIEM product ∗∗∗ --------------------------------------------- Patches have been released for CVE-2019-17659 and CVE-2019-16153. --------------------------------------------- https://www.zdnet.com/article/fortinet-removes-ssh-and-database-backdoors-f… ∗∗∗ Linux kernel vulnerability CVE-2019-19069 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K60130614 ∗∗∗ WPS Hide Login < 1.5.5 - Secret Login Page Disclosure ∗∗∗ --------------------------------------------- https://wpvulndb.com/vulnerabilities/10046 ∗∗∗ Security Bulletin: A Security Vulnerability Has Been Identified In IBM Security Secret Server (CVE-2019-4638) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: IBM Watson IoT MessageGateway Server is affected by a buffer overflow vulnerability (CVE-2020-4207) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-watson-iot-messagegat… ∗∗∗ Security Bulletin: Vulnerability in IBM Websphere Application Server Liberty used by IBM Cloud Pak System (CVE-2019-12402) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-ibm-webs… ∗∗∗ Security Bulletin: A Security Vulnerability Has Been Identified In IBM Security Secret Server (CVE-2019-4639) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: A Security Vulnerability Has Been Identified In IBM Security Secret Server (CVE-2019-4632) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: Multiple Vulnerabilities Have Been Identified In IBM Security Secret Server ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: A Security Vulnerability Has Been Identified In IBM Security Secret Server (CVE-2019-4637) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: IBM MQ is vulnerable to a denial of service attack caused by converting an invalid message. (CVE-2019-4614) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-is-vulnerable-to-a… ∗∗∗ Security Bulletin: A Security Vulnerability Has Been Identified In IBM Security Secret Server (CVE-2019-4635) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: Overly Permissive CORS Policy vulnerability found on IBM Security Secret Server (CVE-2019-4633) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-overly-permissive-cors-po… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 24.01.2020
by Daily end-of-shift report 24 Jan '20

24 Jan '20

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 23-01-2020 18:00 − Freitag 24-01-2020 18:00 Handler: Thomas Pribitzer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ TrickBot Now Steals Windows Active Directory Credentials ∗∗∗ --------------------------------------------- A new module for the TrickBot trojan has been discovered that targets the Active Directory database stored on compromised Windows domain controllers. --------------------------------------------- https://www.bleepingcomputer.com/news/security/trickbot-now-steals-windows-… ∗∗∗ NSA Releases Guidance on Mitigating Cloud Vulnerabilities ∗∗∗ --------------------------------------------- The National Security Agency (NSA) has released an information sheet with guidance on mitigating cloud vulnerabilities. NSA identifies cloud security components and discusses threat actors, cloud vulnerabilities, and potential mitigation measures. The Cybersecurity and Infrastructure Security Agency (CISA) encourages administrators and users to review NSAs guidance on Mitigating Cloud Vulnerabilities and CISA’s page on APTs Targeting IT Service [...] --------------------------------------------- https://www.us-cert.gov/ncas/current-activity/2020/01/24/nsa-releases-guida… ∗∗∗ Kaspersky: Shlayer-Trojaner und Adware häufigste Bedrohungen für Mac-Nutzer ∗∗∗ --------------------------------------------- Shlayer wird auch über Links auf großen Seiten wie YouTube und Wikipedia verbreitet, warnt die Sicherheitsfirma. Der Trojaner schleuste bislang nur Adware ein. --------------------------------------------- https://heise.de/-4645548 ∗∗∗ Hackers target unpatched Citrix servers to deploy ransomware ∗∗∗ --------------------------------------------- REvil ransomware gang has been spotted abusing Citrix bug to infect victims. --------------------------------------------- https://www.zdnet.com/article/hackers-target-unpatched-citrix-servers-to-de… ===================== = Vulnerabilities = ===================== ∗∗∗ Cisco Webex Meetings Suite and Cisco Webex Meetings Online Unauthenticated Meeting Join Vulnerability ∗∗∗ --------------------------------------------- A vulnerability in Cisco Webex Meetings Suite sites and Cisco Webex Meetings Online sites could allow an unauthenticated, remote attendee to join a password-protected meeting without providing the meeting password. The connection attempt must initiate from a Webex mobile application for either iOS or Android. The vulnerability is due to unintended meeting information exposure in a specific meeting join flow for mobile applications. --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Fixes now available for Citrix ADC, Citrix Gateway versions 12.1 and 13.0 ∗∗∗ --------------------------------------------- Today, we released permanent fixes to address the CVE-2019-19781 vulnerability for Citrix Application Delivery Controller (ADC) and Citrix Gateway versions 12.1 and 13.0. These fixes are available to download for ADC and Gateway. --------------------------------------------- https://www.citrix.com/blogs/2020/01/23/fixes-now-available-for-citrix-adc-… ∗∗∗ MDhex: Angreifer könnten medizinische Geräte von GE Healthcare kontrollieren ∗∗∗ --------------------------------------------- Aufgrund von unsicheren Standardeinstellungen und veralteter Software mit Sicherheitslücken ist die Überwachung von Patienten gefährdet. --------------------------------------------- https://heise.de/-4645197 ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (git and python-apt), Oracle (openslp), Red Hat (chromium-browser and ghostscript), SUSE (samba, slurm, and tomcat), and Ubuntu (clamav, gnutls28, and python-apt). --------------------------------------------- https://lwn.net/Articles/810459/ ∗∗∗ WebKitGTK and WPE WebKit Security Advisory WSA-2020-0001 ∗∗∗ --------------------------------------------- Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2019-8835 Versions affected: WebKitGTK before 2.26.3 and WPE WebKit before 2.26.3. Credit to Anonymous working with Trend Micro’s Zero Day Initiative, Mike Zhang of Pangu Team. Impact: Processing maliciously crafted web content may lead toarbitrary code execution. --------------------------------------------- https://webkitgtk.org/security/WSA-2020-0001.html ∗∗∗ wpCentral < 1.4.8 - Privilege Escalation ∗∗∗ --------------------------------------------- https://wpvulndb.com/vulnerabilities/10045 ∗∗∗ Security Bulletin: IBM MQ for HP NonStop Server is affected by multiple OpenSSL vulnerabilities (CVE-2019-1547,CVE-2019-1549, CVE-2019-1563) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-for-hp-nonstop-ser… ∗∗∗ Security Bulletin: IBM MQ Appliance affected by NSS and libgcrypt vulnerabilities (CVE-2018-12404 and CVE-2018-0495) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-appliance-affected… ∗∗∗ Security Bulletin: IBM MQ Appliance is affected by an MIT Kerberos 5 vulnerability (CVE-2017-11462) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-appliance-is-affec… ∗∗∗ Security Bulletin: IBM MQ Appliance is affected by an unauthorised access vulnerability (CVE-2019-4621) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-appliance-is-affec… ∗∗∗ Security Bulletin: IBM MQ Appliance could allow a local attacker to bypass security restrictions (CVE-2019-4620) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-appliance-could-al… ∗∗∗ Security Bulletin: IBM MQ for HP NonStop Server is affected by OpenSSL vulnerability CVE-2019-1552 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-for-hp-nonstop-ser… ∗∗∗ Security Bulletin: CVE-2019-2989 vulnerabilitiy in IBM Java Runtime affects IBM Process Designer used in IBM Business Automation Workflow and IBM Business Process Manager ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-cve-2019-2989-vulnerabili… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 23.01.2020
by Daily end-of-shift report 23 Jan '20

23 Jan '20

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 22-01-2020 18:00 − Donnerstag 23-01-2020 18:00 Handler: Thomas Pribitzer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Datenleck: Microsoft-Datenbank mit 250 Millionen Support-Fällen im Netz ∗∗∗ --------------------------------------------- Rund einen Monat konnte auf eine Datenbank des Microsoft-Supports über das Internet zugegriffen werden. Die Fälle reichen bis in das Jahr 2005 zurück. --------------------------------------------- https://www.golem.de/news/datenleck-microsoft-datenbank-mit-250-millionen-s… ∗∗∗ Datenleck bei Autovermietung Buchbinder: Was Betroffene jetzt tun können ∗∗∗ --------------------------------------------- Auskunftsansprüche, Meldepflichten oder sogar Schadensersatz: Was können die drei Millionen Betroffenen unternehmen und welche Rechte stehen ihnen zu? --------------------------------------------- https://heise.de/-4644140 ===================== = Vulnerabilities = ===================== ∗∗∗ Keine Anmeldung nötig - Angreifer könnten Cisco Firepower übernehmen ∗∗∗ --------------------------------------------- Es sind Sicherheitsupdates für verschiedene Cisco-Produkte erschienen. Eine Lücke gilt als kritisch. --------------------------------------------- https://heise.de/-4644474 ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by openSUSE (chromium, libredwg, and thunderbird), Oracle (apache-commons-beanutils, java-1.8.0-openjdk, libarchive, and python-reportlab), Red Hat (kernel), Scientific Linux (apache-commons-beanutils, libarchive, and openslp), SUSE (java-11-openjdk), and Ubuntu (e2fsprogs, graphicsmagick, python-apt, and zlib). --------------------------------------------- https://lwn.net/Articles/810367/ ∗∗∗ PHP: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-0067 ∗∗∗ Calculated Fields Form < 1.0.354 - Authenticated Stored XSS ∗∗∗ --------------------------------------------- https://wpvulndb.com/vulnerabilities/10043 ∗∗∗ SpamSpan filter - Moderately critical - Cross site scripting - SA-CONTRIB-2020-002 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2020-002 ∗∗∗ Security Bulletin: A security vulnerability has been identified in OpenCV shipped with PowerAI ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: IBM Integrated Management Module II (IMM2) is affected by vulnerability in OpenSSH (CVE-2018-15919) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-integrated-management… ∗∗∗ Security Bulletin: A security vulnerability has been identified in lodash shipped with PowerAI. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: IBM Security Information Queue uses database components with known vulnerabilities (CVE-2016-3506, CVE-2018-1058, CVE-2018-10936, CVE-2019-9193) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-information-… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 22.01.2020
by Daily end-of-shift report 22 Jan '20

22 Jan '20

===================== = End-of-Day report = ===================== Timeframe: Dienstag 21-01-2020 18:00 − Mittwoch 22-01-2020 18:00 Handler: Thomas Pribitzer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Actively Exploited IE 11 Zero-Day Bug Gets Temporary Patch ∗∗∗ --------------------------------------------- A micropatch implementing Microsofts workaround for the actively exploited zero-day remote code execution (RCE) vulnerability impacting Internet Explorer is now available via the 0patch platform until an official fix will be released. --------------------------------------------- https://www.bleepingcomputer.com/news/security/actively-exploited-ie-11-zer… ∗∗∗ sLoad launches version 2.0, Starslord ∗∗∗ --------------------------------------------- sLoad has launched version 2.0. With the new version, sLoad, which is a PowerShell-based Trojan downloader notable for its almost exclusive use of the Windows BITS service for malicious activities, has added an anti-analysis trick and the ability to track the stage of infection for every affected machine. --------------------------------------------- https://www.microsoft.com/security/blog/2020/01/21/sload-launches-version-2… ∗∗∗ FireEye and Citrix Tool Scans for Indicators of Compromise Related to CVE-2019-19781 ∗∗∗ --------------------------------------------- [...] To help organizations identify compromised systems associated with CVE-2019-19781, FireEye and Citrix worked together to release a new tool that searches for indicators of compromise (IoC) associated with attacker activity observed by FireEye Mandiant. This tool is freely accessible in both the Citrix and FireEye GitHub repositories. --------------------------------------------- https://www.fireeye.com/blog/products-and-services/2020/01/fireeye-and-citr… ∗∗∗ Aktuelle Welle: Ursnif-Trojaner versteckt sich in Zip-Archiven ∗∗∗ --------------------------------------------- Derzeit sind mal wieder vermehrt E-Mails mit gefährlichem Dateianhang in Umlauf. Der Schädling namens Ursnif hat es unter anderem auf Account-Daten abgesehen. --------------------------------------------- https://heise.de/-4643571 ∗∗∗ Achtung: Gekaperte WhatsApp-Kontakte verlangen Verifizierungscode ∗∗∗ --------------------------------------------- Einige WhatsApp-UserInnen berichten von eigenen Kontakten, die per WhatsApp einen Verifizierungscode verlangen. Die Profile dieser Kontakte wurden bereits über die gleiche Betrugsmasche übernommen. Wer auf die Nachrichten der vermeintlichen Bekannten und Familienmitglieder mit den angeforderten Codes antwortet, verliert das eigene WhatsApp-Profil an Kriminelle. --------------------------------------------- https://www.watchlist-internet.at/news/achtung-gekaperte-whatsapp-kontakte-… ∗∗∗ In enterprise attack wave, NetWire Trojan now buries itself in disk image files ∗∗∗ --------------------------------------------- Enterprise companies are being targeted by a business email scam harnessing the Trojan. --------------------------------------------- https://www.zdnet.com/article/in-new-enterprise-attack-wave-netwire-rat-tro… ===================== = Vulnerabilities = ===================== ∗∗∗ Honeywell Maxpro VMS & NVR ∗∗∗ --------------------------------------------- This advisory contains mitigations for deserialization of untrusted data and SQL injection vulnerabilities in Honeywells MAXPRO VMS & NVR video management systems. --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-20-021-01 ∗∗∗ Bitdefender BOX 2 bootstrap download_image command injection vulnerability ∗∗∗ --------------------------------------------- An exploitable command injection vulnerability exists in the bootstrap stage of Bitdefender BOX 2, versions 2.1.47.42 and 2.1.53.45. The API method /api/download_image unsafely handles the production firmware URL supplied by remote servers, leading to arbitrary execution of system commands. An unauthenticated attacker should impersonate a remote nimbus server to trigger this vulnerability. --------------------------------------------- https://talosintelligence.com/vulnerability_reports/TALOS-2019-0919 ∗∗∗ Sicherheitsupdate: AMD-Treiber und VMware können ein gefährlicher Cocktail sein ∗∗∗ --------------------------------------------- Angreifer könnten mit einem präparierten Pixel Shader eine AMD-Treiber-Lücke ausnutzen, um aus einer VM auszubrechen. --------------------------------------------- https://heise.de/-4643294 ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (tiff and transfig), Fedora (thunderbird-enigmail), Mageia (ffmpeg and sox), openSUSE (fontforge, python3, and tigervnc), Oracle (python-reportlab), Red Hat (apache-commons-beanutils, java-1.8.0-openjdk, kernel, kernel-alt, libarchive, openslp, openvswitch2.11, openvswitch2.12, and python-reportlab), Scientific Linux (java-1.8.0-openjdk and python-reportlab), SUSE (samba and tigervnc), and Ubuntu (python-pysaml2). --------------------------------------------- https://lwn.net/Articles/810282/ *** Cisco Security Advisories *** --------------------------------------------- https://tools.cisco.com/security/center/publicationListing.x ∗∗∗ IBM Security Bulletins (High Severity) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/tag/psirthigh/ ∗∗∗ Security Bulletin: IBM Integration Bus Hyper visor Edition V9.0 require customer action for security vulnerabilities in Red Hat Linux ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-integration-bus-hyper… ∗∗∗ Security Advisory - Improper Authorization Vulnerability in Several Huawei Smart Phones ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20200122-… ∗∗∗ Security Advisory - Two Integer Overflow Vulnerabilities in LDAP of Some Huawei Products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20200115-… ∗∗∗ Security Advisory - Insufficient Verification Vulnerability in Some Huawei products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20200122-… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 21.01.2020
by Daily end-of-shift report 21 Jan '20

21 Jan '20

===================== = End-of-Day report = ===================== Timeframe: Montag 20-01-2020 18:00 − Dienstag 21-01-2020 18:00 Handler: Thomas Pribitzer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ SIM Hijacking ∗∗∗ --------------------------------------------- SIM hijacking -- or SIM swapping -- is an attack where a fraudster contacts your cell phone provider and convinces them to switch your account to a phone that they control. Since your smartphone often serves as a security measure or backup verification system, this allows the fraudster to take over other accounts of yours. Sometimes this involves people inside the phone companies. Phone companies have added security measures since this attack became popular and public, but a new study [...] --------------------------------------------- https://www.schneier.com/blog/archives/2020/01/sim_hijacking.html ∗∗∗ Realistic Factory Honeypot Shows Threats Faced by Industrial Organizations ∗∗∗ --------------------------------------------- Trend Micro researchers have set up a factory honeypot and found that industrial organizations should be more concerned about attacks launched by profit-driven cybercriminals rather than the threat posed by sophisticated state-sponsored groups. --------------------------------------------- https://www.securityweek.com/realistic-factory-honeypot-shows-threats-faced… ∗∗∗ Vorsicht vor betrügerischen Microsoft-Anrufen ∗∗∗ --------------------------------------------- Aktuell geben sich Kriminelle wieder als Microsoft-MitarbeiterInnen aus und rufen beliebige Telefonnummern an. Angeblich gäbe es ein Problem mit Ihrem Computer. Dieses wollen die betrügerischen AnruferInnen nun mit Ihnen gemeinsam beheben. Legen Sie sofort auf, Kriminelle wollen sich Zugang auf Ihren Computer verschaffen und sensible Benutzerdaten abgreifen. --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-vor-betruegerischen-microso… ∗∗∗ Antivirus vendors push fixes for EFS ransomware attack method ∗∗∗ --------------------------------------------- Signature-based software may not be enough to protect Microsoft’s Windows EFS against evolving ransomware families. --------------------------------------------- https://www.zdnet.com/article/antivirus-vendors-scramble-to-fix-new-efs-ran… ===================== = Vulnerabilities = ===================== ∗∗∗ Samba Releases Security Updates ∗∗∗ --------------------------------------------- The Samba Team has released security updates to address vulnerabilities in multiple versions of Samba. An attacker could exploit one of these vulnerabilities to take control of an affected system. The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review the Samba Security Announcements for CVE-2019-14902, CVE-2019-14907, and CVE-2019-19344 and apply the necessary updates and workarounds. --------------------------------------------- https://www.us-cert.gov/ncas/current-activity/2020/01/21/samba-releases-sec… ∗∗∗ CVE-2019-19886 – HIGH – DoS against libModSecurity 3 ∗∗∗ --------------------------------------------- The ModSecurity 3.0.x release line suffers from a Denial of Service vulnerability after triggering a segmentation fault on the webserver when parsing a malformed cookie header. All users of ModSecurity 3.0.0 – 3.0.3 should update to ModSecurity 3.0.4 as soon as possible. --------------------------------------------- https://coreruleset.org/20200118/cve-2019-19886-high-dos-against-libmodsecu… ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (openconnect), Fedora (e2fsprogs, glibc, kernel, and nss), openSUSE (Mesa, php7, and slurm), Oracle (.NET Core, java-1.8.0-openjdk, java-11-openjdk, and thunderbird), Red Hat (java-1.8.0-openjdk, openvswitch, and openvswitch2.11), Scientific Linux (java-1.8.0-openjdk), SUSE (java-11-openjdk, libssh, libvpx, Mesa, and thunderbird), and Ubuntu (libbsd and samba). --------------------------------------------- https://lwn.net/Articles/810157/ ∗∗∗ Insufficient Authentication Vulnerability in OSCA Products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20200121-… ∗∗∗ Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen ermöglichen Codeausführung ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-0062 ∗∗∗ Red Hat Enterprise Linux: Schwachstelle ermöglicht Denial of Service ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-0061 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 20.01.2020
by Daily end-of-shift report 20 Jan '20

20 Jan '20

===================== = End-of-Day report = ===================== Timeframe: Freitag 17-01-2020 18:00 − Montag 20-01-2020 18:00 Handler: Thomas Pribitzer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Datenleck: Passwörter zu 515.000 Servern und IoT-Geräten veröffentlicht ∗∗∗ --------------------------------------------- Der Betreiber eines DDoS-Dienstes hat eine lange Liste mit Zugangsdaten und IP-Adressen von Servern, Routern und IoT-Geräten veröffentlicht. Die Daten könnten zum Aufbau eines Botnetzwerkes missbraucht werden - oder um die Geräte zu zerstören. --------------------------------------------- https://www.golem.de/news/datenleck-passwoerter-zu-515-000-servern-und-iot-… ∗∗∗ TLS: Netgear verteilt private Schlüssel in Firmware ∗∗∗ --------------------------------------------- Sicherheitsforscher haben private Schlüssel für TLS-Zertifikate veröffentlicht, die Netgear mit seiner Router-Firmware verteilt. Der Hersteller hatte nur wenige Tage Reaktionszeit. Die Forscher lehnen die Praktiken von Netgear prinzipiell ab, was zur Veröffentlichung geführt hat. --------------------------------------------- https://www.golem.de/news/tls-netgear-verteilt-private-schluessel-in-firmwa… ∗∗∗ Jetzt patchen! Erste Sicherheitsupdates für kritische Citrix-Lücke erschienen ∗∗∗ --------------------------------------------- Da Angreifer derzeit eine Lücke in Citrix ADC ausnutzen, sollten Admins die nun verfügbaren Patches umgehend installieren. --------------------------------------------- https://heise.de/-4641774 ∗∗∗ Business in the front, party in the back: backdoors in elastic servers expose private data ∗∗∗ --------------------------------------------- Its all too easy to discover data leaks online, especially in cloud services. We take a look at misconfigurations in elastic servers that lead to exposed data on the Internet. --------------------------------------------- https://blog.malwarebytes.com/threat-spotlight/2020/01/business-in-the-fron… ∗∗∗ Gefälschte A1-Mail greift Kreditkartendaten ab! ∗∗∗ --------------------------------------------- Unzählige KonsumentInnen wenden sich mit gefälschten A1-E-Mails an die Watchlist Internet. Angeblich sind bei der letzten Abrechnung 72,77 Euro zu viel abgebucht worden. Um das Geld zurückzuerhalten, soll ein Rückerstattungsantrag ausgefüllt werden. Betroffene dürfen das keinesfalls tun, denn sonst landen sämtliche Kreditkartendaten in den Händen Krimineller! --------------------------------------------- https://www.watchlist-internet.at/news/gefaelschte-a1-mail-greift-kreditkar… ===================== = Vulnerabilities = ===================== ∗∗∗ Internet Explorer: Zero-Day-Schwachstelle in JScript Scripting Engine ∗∗∗ --------------------------------------------- Im Internet Explorer steckt eine teils als kritisch eingestufte Schwachstelle, die Remote Code Execution erlaubt. Derzeit hilft dagegen nur ein Workaround. --------------------------------------------- https://heise.de/-4641331 ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by CentOS (git, java-11-openjdk, and thunderbird), Debian (cacti, chromium, gpac, kernel, openjdk-11, ruby-excon, and thunderbird), Fedora (chromium and rubygem-rack), Mageia (suricata, tigervnc, and wireshark), openSUSE (glusterfs, libredwg, and uftpd), and Ubuntu (linux-hwe and sysstat). --------------------------------------------- https://lwn.net/Articles/810070/ ∗∗∗ 2J SlideShow < 1.3.40 - Authenticated Arbitrary Plugin Deactivation ∗∗∗ --------------------------------------------- https://wpvulndb.com/vulnerabilities/10034 ∗∗∗ Security Advisory - Path Traversal Vulnerability in Huawei GaussDB ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20200120-… ∗∗∗ Security Advisory - Command Injection Vulnerability in GaussDB 200 Product ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20200120-… ∗∗∗ Security Advisory - Improper Authentication Vulnerability in Smartphones ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20200120-… ∗∗∗ HPESBST03977 rev.1 - HPE Command View Advanced Edition (CVAE), Multiple Vulnerabilities ∗∗∗ --------------------------------------------- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_n… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 17.01.2020
by Daily end-of-shift report 17 Jan '20

17 Jan '20

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 16-01-2020 18:00 − Freitag 17-01-2020 18:00 Handler: Thomas Pribitzer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ TrickBot Now Uses a Windows 10 UAC Bypass to Evade Detection ∗∗∗ --------------------------------------------- The TrickBot Trojan has received an update that adds a UAC bypass targeting the Windows 10 operating system so that it infects users without displaying any visible prompts. --------------------------------------------- https://www.bleepingcomputer.com/news/security/trickbot-now-uses-a-windows-… ∗∗∗ Dutch Govt Suggests Turning Off Citrix ADC Devices, Mitigations May Fail ∗∗∗ --------------------------------------------- Mitigation recommendations for CVE-2019-19781, a currently unpatched critical flaw affecting Citrix Application Delivery Controller (ADC) and Citrix Gateway, do not have the expected effect on all product versions. --------------------------------------------- https://www.bleepingcomputer.com/news/security/dutch-govt-suggests-turning-… ∗∗∗ FTCODE Ransomware - New Version Includes Stealing Capabilities ∗∗∗ --------------------------------------------- Recently, the Zscaler ThreatLabZ team came across PowerShell-based ransomware called “FTCODE,” which targets Italian-language users. An earlier version of FTCODE ransomware was being downloaded using a document file that contained malicious macros. In the recent campaign, the ransomware is being downloaded using VBScript. --------------------------------------------- https://www.zscaler.com/blogs/research/ftcode-ransomware--new-version-inclu… ∗∗∗ 404 Exploit Not Found: Vigilante Deploying Mitigation for CitrixNetScaler Vulnerability While Maintaining Backdoor ∗∗∗ --------------------------------------------- As noted in Rough Patch: I Promise Itll Be 200 OK, our FireEye Mandiant Incident Response team has been hard at work responding to intrusions stemming from the exploitation of CVE-2019-19781. After analyzing dozens of successful exploitation attempts against Citrix ADCs that did not have the Citrix mitigation steps implemented, we’ve recognized multiple groups of post-exploitation activity. Within these, something caught our eye: one particular threat actor that’s been deploying a [...] --------------------------------------------- http://www.fireeye.com/blog/threat-research/2020/01/vigilante-deploying-mit… ∗∗∗ Hinweise auf mögliche Verwundbarkeiten der Medizin-Telematik ∗∗∗ --------------------------------------------- Open-Source-Bibliotheken, die im Telematik-Konnektor von T-Systems zum Einsatz kommen, weisen hunderte bekannter Sicherheitslücken auf. --------------------------------------------- https://heise.de/-4635791 ∗∗∗ WeLeakInfo, the site which sold access to passwords stolen in data breaches, is brought down by the FBI ∗∗∗ --------------------------------------------- Law enforcement agencies have seized control of the domain of WeLeakInfo, a website offering cheap access to billions of personal credentials stolen from approximately 10,000 data breaches. --------------------------------------------- https://www.grahamcluley.com/weleakinfo-seized/ ===================== = Vulnerabilities = ===================== ∗∗∗ Schneider Electric Modicon Controllers ∗∗∗ --------------------------------------------- This advisory contains mitigations for several improper check for unusual or exceptional conditions vulnerabilities in Schneider Electric Modicon PLC controllers. --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-20-016-01 ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (chromium), Fedora (gnulib, ImageMagick, jetty, ocsinventory-agent, phpMyAdmin, python-django, rubygem-rmagick, thunderbird, and xar), Mageia (e2fsprogs, kernel, and libjpeg), openSUSE (icingaweb2), Oracle (git, java-11-openjdk, and thunderbird), Red Hat (.NET Core), Scientific Linux (git, java-11-openjdk, and thunderbird), SUSE (fontforge and LibreOffice), and Ubuntu (kamailio and thunderbird). --------------------------------------------- https://lwn.net/Articles/809916/ ∗∗∗ HPESBNS03981 rev.1 - HPE ViewPoint on NonStop, Local Disclosure of Sensitive Information ∗∗∗ --------------------------------------------- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_n… ∗∗∗ HPESBNS03976 rev.1 - HPE NonStop using Sudo ∗∗∗ --------------------------------------------- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_n… ∗∗∗ Pivotal Spring Framework: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-0057 ∗∗∗ Trend Micro Produkte: Mehrere Schwachstellen ermöglichen Erlangen von Administratorrechten ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-0055 ∗∗∗ Linux Kernel: Schwachstelle ermöglicht Offenlegung von Informationen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-0058 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 16.01.2020
by Daily end-of-shift report 16 Jan '20

16 Jan '20

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 15-01-2020 18:00 − Donnerstag 16-01-2020 18:00 Handler: Thomas Pribitzer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Microsoft Office January Security Updates Fix Code Execution Bugs ∗∗∗ --------------------------------------------- Microsoft released the January 2019 Office security updates, bundling a total of seven security updates and three cumulative updates for five different products, six of them patching flaws allowing remote code execution. --------------------------------------------- https://www.bleepingcomputer.com/news/security/microsoft-office-january-sec… ∗∗∗ PoC Exploits Published For Microsoft Crypto Bug ∗∗∗ --------------------------------------------- Two proof-of-concept exploits were publicly released for the major Microsoft crypto-spoofing vulnerability. --------------------------------------------- https://threatpost.com/poc-exploits-published-for-microsoft-crypto-bug/1519… ∗∗∗ CVE-2020-0601 Followup, (Wed, Jan 15th) ∗∗∗ --------------------------------------------- Among the patches Microsoft released yesterday, the vulnerability in the CryptoAPI got by far the most attention. Here are some answers to questions we have received about this vulnerability. Many of these questions also came from our webcast audience (for a recording, see https://sans.org/cryptoapi-isc ) Thanks to Jake Williams for helping us with the webcast! --------------------------------------------- https://isc.sans.edu/diary/rss/25714 ∗∗∗ What do Brit biz consultants and X-rated cam stars have in common? Wide open... AWS S3 buckets on public internet ∗∗∗ --------------------------------------------- Exposed: Intimate... personal details belonging to thousands of folks A pair of misconfigured cloud-hosted file silos have left thousands of peoples sensitive info sitting on the open internet. --------------------------------------------- https://go.theregister.co.uk/feed/www.theregister.co.uk/2020/01/15/open_s3_… ∗∗∗ Analyzing Magecart Malware - From Zero to Hero ∗∗∗ --------------------------------------------- Javascript obfuscation is not a new trend, but it is widely used today to hide malware code in many websites. This post is for technical readers who want to understand Magecart’s common obfuscation pattern, and ways to decode it. --------------------------------------------- https://www.perimeterx.com/blog/analyzing_magecart_malware_from_zero_to_her… ∗∗∗ Sicherheitsupdates: Lücken in VMware-Software bedrohen Android, iOS und Windows ∗∗∗ --------------------------------------------- Es sind wichtige Sicherheitsupdates für VMware Tools und Workspace ONE SDK erschienen. --------------------------------------------- https://heise.de/-4639627 ∗∗∗ Key Cloud Security Challenges and Strategies to Overcome Them ∗∗∗ --------------------------------------------- The cloud has changed how we use and consume IT services. Where data resides along with how it is transferred, stored and processed has fundamentally changed and with-it new risk management challenges. Let’s talk about some of those challenges. First and foremost, the cat is out of the bag. We’re not going back to the [...] --------------------------------------------- https://www.tripwire.com/state-of-security/security-data-protection/cloud/k… ∗∗∗ Unseriöse Angebote für die digitale Vignette ∗∗∗ --------------------------------------------- Wie jedes Jahr steht bei den meisten AutofahrerInnen mit dem Jahreswechsel der Kauf einer neuen Vignette an. Diese kann analog oder digital unter anderem bei der ASFINAG, dem ÖAMTC und dem ARBÖ erworben werden. Achtung: Auch unseriöse Angebote, bei denen das gesetzliche Widerrufsrecht unterschlagen wird und zusätzliche Kosten anfallen, sind im Internet zu finden. --------------------------------------------- https://www.watchlist-internet.at/news/unserioese-angebote-fuer-die-digital… ∗∗∗ Beware of this sneaky phishing technique now being used in more attacks ∗∗∗ --------------------------------------------- Security company researchers warn of a large increase in conversation-hijacking attacks. Heres what they are and how to spot them. --------------------------------------------- https://www.zdnet.com/article/beware-of-this-sneaky-phishing-technique-now-… ===================== = Vulnerabilities = ===================== ∗∗∗ OSIsoft PI Vision ∗∗∗ --------------------------------------------- This advisory contains mitigations for improper access control, cross-site request forgery, cross-site scripting, and inclusion of sensitive information vulnerabilities in OSIsofts PI Vision visualization tool. --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-20-014-06 ∗∗∗ Radix - Moderately critical - Cross site scripting - SA-CONTRIB-2020-001 ∗∗∗ --------------------------------------------- Project: Radix Date: 2020-January-15 Security risk: Moderately critical 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross site scripting Description: Radix is a base theme for Drupal, with Bootstrap 4, Sass, ES6 and BrowserSync built-in. The module doesnt sufficiently filter menu titles when used in a dropdown in the main menu. This vulnerability is mitigated by the fact that an attacker must have permission to edit a menu title used in the main menu. --------------------------------------------- https://www.drupal.org/sa-contrib-2020-001 ∗∗∗ Easily Exploitable Vulnerabilities Patched in WP Database Reset Plugin ∗∗∗ --------------------------------------------- On January 7th, our Threat Intelligence team discovered vulnerabilities in WP Database Reset, a WordPress plugin installed on over 80,000 websites. One of these flaws allowed any unauthenticated user to reset any table from the database to the initial WordPress set-up state, while the other flaw allowed any authenticated user, even those with minimal permissions, [...] --------------------------------------------- https://www.wordfence.com/blog/2020/01/easily-exploitable-vulnerabilities-p… ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (debian-lan-config and phpmyadmin), openSUSE (openssl-1_1), Oracle (firefox and kernel), Red Hat (.NET Core, git, java-11-openjdk, and thunderbird), SUSE (Mesa, python3, shibboleth-sp, slurm, and tigervnc), and Ubuntu (libpcap and nginx). --------------------------------------------- https://lwn.net/Articles/809769/ ∗∗∗ HPESBGN03975 rev.1 - HPE enhanced Internet Usage Manager (eIUM), Remote Cross Site Scripting ∗∗∗ --------------------------------------------- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_n… ∗∗∗ HPESBHF03978 rev.1 - HPE Superdome Flex Server, Multiple Remote Vulnerabilities ∗∗∗ --------------------------------------------- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_n… ∗∗∗ Foxit Reader und Foxit Phantom PDF Suite: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-0052 ∗∗∗ Wireshark: Mehrere Schwachstellen ermöglichen Denial of Service ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-0053 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 15.01.2020
by Daily end-of-shift report 15 Jan '20

15 Jan '20

===================== = End-of-Day report = ===================== Timeframe: Dienstag 14-01-2020 18:00 − Mittwoch 15-01-2020 18:00 Handler: Stephan Richter Co-Handler: Robert Waldner ===================== = News = ===================== ∗∗∗ Patch Tuesday: Windows patzt bei Zertifikatsprüfung ∗∗∗ --------------------------------------------- Eine Lücke in der Zertifikatsvalidierung von Windows ermöglicht es, die Codesignaturprüfung auszutricksen und TLS-Verbindungen anzugreifen. Zudem gibt es eine Sicherheitslücke im Remote Desktop Gateway. --------------------------------------------- https://www.golem.de/news/patch-tuesday-windows-patzt-bei-zertifikatspruefu… ∗∗∗ CISA Releases Emergency Directive and Activity Alert on Critical Microsoft Vulnerabilities ∗∗∗ --------------------------------------------- The Cybersecurity and Infrastructure Security Agency (CISA) has released an Emergency Directive and Activity Alert addressing critical vulnerabilities affecting Windows CryptoAPI, Windows Remote Desktop Gateway (RD Gateway), and Windows Remote Desktop Client. A remote attacker could exploit these vulnerabilities to decrypt, modify, or inject data on user connections. --------------------------------------------- https://www.us-cert.gov/ncas/current-activity/2020/01/14/cisa-releases-emer… ∗∗∗ Critical Cisco DCNM flaws: Patch right now as PoC exploits are released ∗∗∗ --------------------------------------------- The need to patch Cisco Data Center Network Manager for Nexus switches becomes even more urgent. --------------------------------------------- https://www.zdnet.com/article/critical-cisco-dcnm-flaws-patch-right-now-as-… ===================== = Vulnerabilities = ===================== ∗∗∗ Oracle Critical Patch Update Advisory - January 2020 ∗∗∗ --------------------------------------------- This Critical Patch Update contains 334 new security patches across the product families listed below. --------------------------------------------- https://www.oracle.com/security-alerts/cpujan2020.html ∗∗∗ Huawei Security Advisories ∗∗∗ --------------------------------------------- * Intel Microarchitectural Data Sampling (MDS) vulnerabilities * Three OpenSSL Vulnerabilities in Huawei Products * Page-Cache Side-Channel Vulnerability * Three DoS Vulnerabilities in the SIP Module of Some Huawei Products * Information Leakage Vulnerability in some Huawei Firewall Product * Buffer Overflow Vulnerability in QEMU-KVM * FRP Bypass Vulnerability in Huawei Smart Phones * Insufficient Authentication Vulnerability in Some Huawei Smart Phones * Improper Authentication Vulnerability in Smartphones * FragmentSmack Vulnerability in Linux Kernel * Two Integer Overflow Vulnerabilities in LDAP of Some Huawei Products --------------------------------------------- https://www.huawei.com/en/psirt/all-bulletins?name=security-advisories&year… ∗∗∗ Sicherheitsupdates: Intel-Lücken zur Rechteausweitung geschlossen ∗∗∗ --------------------------------------------- Intels Entwickler haben gefährliche Lücken in unter anderem Chip-/CPU-Software und VTune geschlossen. --------------------------------------------- https://heise.de/-4638307 ∗∗∗ VMSA-2020-0002 ∗∗∗ --------------------------------------------- VMware Tools workaround addresses a local privilege escalation vulnerability (CVE-2020-3941) --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2020-0002.html ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (thunderbird), CentOS (firefox), openSUSE (chromium, firefox, GraphicsMagick, log4j, nodejs8, phpMyAdmin, singularity, and virglrenderer), Oracle (kernel), Red Hat (firefox), SUSE (man, nodejs10, openssl-1_1, and php7), and Ubuntu (php5, php7.0, php7.2, php7.3 and spamassassin). --------------------------------------------- https://lwn.net/Articles/809624/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 14.01.2020
by Daily end-of-shift report 14 Jan '20

14 Jan '20

===================== = End-of-Day report = ===================== Timeframe: Montag 13-01-2020 18:00 − Dienstag 14-01-2020 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Windows 7 Reaches End of Life Tomorrow, What You Need to Know ∗∗∗ --------------------------------------------- Its the end of an era: Windows 7 will reach end of support tomorrow, on January 14, a decade after its initial release, with Microsoft to no longer provide users with software updates and security updates or fixes. --------------------------------------------- https://www.bleepingcomputer.com/news/microsoft/windows-7-reaches-end-of-li… ∗∗∗ Shitrix: Das Citrix-Desaster ∗∗∗ --------------------------------------------- Eine Sicherheitslücke in Geräten der Firma Citrix zeigt in erschreckender Weise, wie schlecht es um die IT-Sicherheit in Behörden steht. Es fehlt an den absoluten Grundlagen. --------------------------------------------- https://www.golem.de/news/shitrix-das-citrix-desaster-2001-146047-rss.html ∗∗∗ Malware Obfuscation, Encoding and Encryption ∗∗∗ --------------------------------------------- Malware is complex and meant to confuse. Many computer users think malware is just another word for “virus” when a virus is actually a type of malware. And in addition to viruses, malware includes all sorts of malicious and unwanted code, including spyware, adware, Trojans and worms. Malware has been known to shut down [...] --------------------------------------------- https://resources.infosecinstitute.com/malware-obfuscation-encoding-and-enc… ∗∗∗ CISA Releases Test for Citrix ADC and Gateway Vulnerability ∗∗∗ --------------------------------------------- The Cybersecurity and Infrastructure Security Agency (CISA) has released a utility that enables users and administrators to test whether their Citrix Application Delivery Controller (ADC) and Citrix Gateway software is susceptible to the CVE-2019-19781 vulnerability. According to Citrix Security Bulletin CTX267027, beginning on January 20, 2020, Citrix will be releasing new versions of Citrix ADC and Citrix Gateway that will patch CVE-2019-19781. --------------------------------------------- https://www.us-cert.gov/ncas/current-activity/2020/01/13/cisa-releases-test… ∗∗∗ Mehrwertdienste von Drittanbietern auf Ihrer Handyrechnung sind meist Abo-Fallen ∗∗∗ --------------------------------------------- Eine Handyrechnung, die höher ausfällt als gewohnt, bedeutet meist nichts Gutes. Oftmals finden Sie Abbuchungen von Drittanbietern, Mehrwert- oder Partnerdiensten auf Ihrer Rechnung. Sie haben wahrscheinlich unwissentlich bei einem unseriösen Anbieter einen Abo-Vertrag abgeschlossen. Ihr Geld ist höchstwahrscheinlich jedoch nicht verloren: Sie können die Rechnung beim Mobilfunkanbieter beanstanden! --------------------------------------------- https://www.watchlist-internet.at/news/mehrwertdienste-von-drittanbietern-a… ∗∗∗ Microsoft spots malicious npm package stealing data from UNIX systems ∗∗∗ --------------------------------------------- Malicious JavaScript package was only active on the npm repository for two weeks. --------------------------------------------- https://www.zdnet.com/article/microsoft-spots-malicious-npm-package-stealin… ===================== = Vulnerabilities = ===================== ∗∗∗ Security Bulletins Posted ∗∗∗ --------------------------------------------- Adobe has published security bulletins for Adobe Experience Manager (APSB20-01) and Adobe Illustrator (APSB20-03). Adobe recommends users update their product installations to the latest versions using the instructions referenced in the bulletin. This posting is provided “AS IS” with no warranties and confers no rights. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1820 ∗∗∗ XSA-312 - arm: a CPU may speculate past the ERET instruction ∗∗∗ --------------------------------------------- Some CPUs can speculate past an ERET instruction and potentially perform speculative accesses to memory before processing the exception return. Since the register state is often controlled by lower privilege level (i.e guest kernel/userspace) at the point of the ERET, this could potentially be used as part of a side-channel attack. --------------------------------------------- https://xenbits.xen.org/xsa/advisory-312.html ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (wordpress and xen), Mageia (graphicsmagick, kernel, makepasswd, and unbound), openSUSE (containerd, docker, docker-runc,, dia, ffmpeg-4, libgcrypt, php7-imagick, proftpd, rubygem-excon, shibboleth-sp, tomcat, trousers, and xen), Oracle (firefox), Red Hat (kernel), Scientific Linux (firefox), SUSE (e2fsprogs, kernel, and libsolv, libzypp, zypper), and Ubuntu (libgcrypt20, libvirt, nginx, sdl-image1.2, and spamassassin). --------------------------------------------- https://lwn.net/Articles/809506/ ∗∗∗ SAP Security Patch Day – January 2020 ∗∗∗ --------------------------------------------- This post by SAP Product Security Response Team shares information on Patch Day Security Notes* that are released on second Tuesday of every month and fix vulnerabilities discovered in SAP products. SAP strongly recommends that the customer visits the Support Portal and applies patches on a priority to protect their SAP landscape. On 14th of January 2020, SAP Security Patch Day saw the release of 6 Security Notes. There are 1 updates to previously released Patch Day [...] --------------------------------------------- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=533671771 ∗∗∗ Siemens Security Advisories ∗∗∗ --------------------------------------------- https://new.siemens.com/global/en/products/services/cert.html#SecurityPubli… ∗∗∗ BIG-IP engineering hotfix TMM vulnerability CVE-2020-5852 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K53590702 ∗∗∗ BIG-IP APM Portal Access vulnerability CVE-2020-5853 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K73183618 ∗∗∗ BIG-IP engineering hotfix Trusted Platform Module vulnerability CVE-2020-5851 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K91171450 ∗∗∗ Critical Authentication Bypass Vulnerability in InfiniteWP Client Plugin ∗∗∗ --------------------------------------------- https://www.wordfence.com/blog/2020/01/critical-authentication-bypass-vulne… ∗∗∗ OTRS: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-0026 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily