Daily

daily@lists.cert.at

1 participants
3282 discussions

Tageszusammenfassung - 26.11.2019
by Daily end-of-shift report 26 Nov '19

26 Nov '19

===================== = End-of-Day report = ===================== Timeframe: Montag 25-11-2019 18:00 − Dienstag 26-11-2019 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Unsichere Tracking-Smartwatch: Angreifer könnten Tausende Kinder stalken ∗∗∗ --------------------------------------------- Billige Tracker-Uhren aus China sind recht häufig Gegenstand von Sicherheitswarnungen. Das aktuelle Kindermodell SMA-WATCH-M2 setzt den (Abhör-)Alptraum fort. --------------------------------------------- https://heise.de/-4596410 ∗∗∗ Vorsicht beim Black-Friday-Shopping ∗∗∗ --------------------------------------------- Zahlreiche Online-HändlerInnen locken im Zuge des Black Fridays mit sagenhaften Angeboten. Am Freitag können Sie Kleidung, Elektronik, Haushaltswaren und viel mehr deutlich günstiger erwerben. Seien Sie jedoch bei den unglaublichsten Schnäppchen doppelt vorsichtig, denn nicht jedes Angebot ist seriös. --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-beim-black-friday-shopping/ ∗∗∗ A hacking group is hijacking Docker systems with exposed API endpoints ∗∗∗ --------------------------------------------- Its almost 2020 and some sysadmins are still leaving Docker admin ports exposed on the internet. --------------------------------------------- https://www.zdnet.com/article/a-hacking-group-is-hijacking-docker-systems-w… ===================== = Vulnerabilities = ===================== ∗∗∗ ZDI-19-996: Dell EMC Storage Monitoring and Reporting Java RMI Deserialization of Untrusted Data Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on affected installations of Dell EMC Storage Monitoring and Reporting. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-19-996/ ∗∗∗ Xen Security Advisory XSA-306 - Device quarantine for alternate pci assignment methods ∗∗∗ --------------------------------------------- An untrusted domain with access to a physical device can DMA into host memory, leading to privilege escalation. --------------------------------------------- https://xenbits.xen.org/xsa/advisory-306.html ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (libxdmcp, nss, php-imagick, and ruby2.1), openSUSE (java-11-openjdk), Red Hat (389-ds-base, kernel, kernel-rt, python-jinja2, qemu-kvm-ma, and tcpdump), SUSE (bluez, clamav, cpio, cups, gcc9, libpng16, libssh2_org, mailman, sqlite3, squid, strongswan, tiff, and webkit2gtk3), and Ubuntu (redmine). --------------------------------------------- https://lwn.net/Articles/805650/ ∗∗∗ Paessler PRTG: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- PRTG Network Monitor ist eine Netzwerk Monitoring Werkzeug der Paessler AG. Ein Angreifer kann mehrere Schwachstellen in Paessler PRTG ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen oder beliebigen Programmcode mit Rechten des Dienstes auszuführen. --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-1019 ∗∗∗ Kaspersky Produkte: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Kaspersky Anti-Virus, Kaspersky Internet Security und Kaspersky Total Security ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen oder einen Denial of Service zu verursachen. --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-1018 ∗∗∗ Security Bulletin: Multiple IBM MQ Security Vulnerabilities Affect IBM Sterling B2B Integrator ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-ibm-mq-security-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect the IBM Spectrum Protect Server on AIX (CVE-2019-4473, CVE-2019-11771) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: WebSphere Application Server is vulnerable to Apache Commons Beanutils (CVE-2019-10086) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-websphere-application-ser… ∗∗∗ Security Bulletin: SQL Injection Vulnerability Affects IBM Sterling B2B Integrator (CVE-2019-4387) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-sql-injection-vulnerabili… ∗∗∗ Security Bulletin: Multiple Db2 vulnerabilities affect the IBM Spectrum Protect Server (CVE-2019-4057, CVE-2019-4101, CVE-2019-4154, CVE-2019-4386, CVE-2019-4322) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-db2-vulnerabilit… ∗∗∗ BIG-IP Engineering Hotfix authentication bypass vulnerability CVE-2019-6675 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K55655944 ∗∗∗ NodeJS vulnerability CVE-2018-7160 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K63025104 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 25.11.2019
by Daily end-of-shift report 25 Nov '19

25 Nov '19

===================== = End-of-Day report = ===================== Timeframe: Freitag 22-11-2019 18:00 − Montag 25-11-2019 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ A Short History of Juice Jacking ∗∗∗ --------------------------------------------- The days are now shorter, and the holiday season is upon us. Many of us have travel booked to bring our family together and will soon be uncomfortably sitting in the halls of airline terminals, desperate to escape the monotony of an international waiting room we will sit transfixed to our mobile devices. Breaking our mobile-mindfulness-zen like state, an alert graces the screen: 15% battery life remaining. --------------------------------------------- https://www.secjuice.com/history-of-juice-jacking/ ∗∗∗ Local Malware Analysis with Malice, (Sat, Nov 23rd) ∗∗∗ --------------------------------------------- This project (Malice) provides the ability to have your own locally managed multi-engine malware scanning system. The framework allows the owner to analyze files for known malware. It can be used both as a command tool to analyze samples and review the results via a Kibana web interface. The Command-Line Interface (CLI) is used to scan a file or directory or can be setup to watch and scan new files when copied into a write only directory. --------------------------------------------- https://isc.sans.edu/diary/rss/25544 ∗∗∗ Introducing Merlin - A cross-platform post-exploitation HTTP/2 Command & Control Tool ∗∗∗ --------------------------------------------- Merlin is a cross-platform post-exploitation framework that leverages HTTP/2 communications to evade inspection. HTTP/2 is a relatively new protocol that requests Perfect Forward Secrecy (PFS) encryption cipher suites are used. ... Additionally, many security technologies are not equipped with HTTP/2 protocol dissectors and are therefore not able to evaluate traffic even if keying material is provided. --------------------------------------------- https://medium.com/@Ne0nd0g/introducing-merlin-645da3c635a ∗∗∗ Trickbot Updates Password Grabber Module ∗∗∗ --------------------------------------------- Trickbot is a modular malware, and one of its modules is a password grabber. In November 2019, we started seeing indicators of Trickbot's password grabber targeting data from OpenSSH and OpenVPN applications. --------------------------------------------- https://unit42.paloaltonetworks.com/trickbot-updates-password-grabber-modul… ∗∗∗ PC-Fernwartung: Sicherheitsforscher warnen vor angreifbarer VNC-Software ∗∗∗ --------------------------------------------- Angreifer könnten Clients und Server mit verschiedener VNC-Software attackieren und unter bestimmten Voraussetzungen Malware platzieren. --------------------------------------------- https://heise.de/-4595718 ∗∗∗ Kauf von Konzertkarten auf eventtickets24.com birgt Gefahren ∗∗∗ --------------------------------------------- Die Smartfox Media b.v. aus den Niederlanden bietet auf eventtickets24.com Konzert- und Veranstaltungskarten an. Zahlreiche KundInnen berichten von groben Problemen nach dem Ticketkauf. So kommt es u.U. zu Schwierigkeiten bei der Beschaffung und Lieferung oder ausbleibenden Rückerstattungen nach Nichtlieferung. Wir raten zu großer Vorsicht bei diesem Angebot. --------------------------------------------- https://www.watchlist-internet.at/news/kauf-von-konzertkarten-auf-eventtick… ===================== = Vulnerabilities = ===================== ∗∗∗ Patched GIF Processing Vulnerability CVE-2019-11932 Still Afflicts Multiple Mobile Apps ∗∗∗ --------------------------------------------- CVE-2019-11932, which is a vulnerability in WhatsApp for Android, was first disclosed to the public on October 2, 2019 after a researcher named Awakened discovered that attackers could use maliciously crafted GIF files to allow remote code execution. The vulnerability was patched with version 2.19.244 of WhatsApp, but the underlying problem lies in the library called libpl_droidsonroids_gif.so, which is part of the android-gif-drawable package. While this flaw has also been patched, many [...] --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/sBAf9Ks1I8Y/ ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (chromium, enigmail, isc-dhcp, libice, libofx, and pam-python), Fedora (chromium, ghostscript, mingw-cfitsio, mingw-gdal, mingw-libidn2, and rsyslog), Gentoo (adobe-flash, chromium, expat, and firefox), openSUSE (apache2-mod_perl, haproxy, java-11-openjdk, and ncurses), Oracle (ghostscript, kernel, php:7.2, php:7.3, and sudo), Red Hat (chromium-browser, python27-python, and SDL), and Ubuntu (dpdk and libvpx). --------------------------------------------- https://lwn.net/Articles/805527/ ∗∗∗ Weak encryption cipher and hardcoded cryptographic keys in Fortinet products ∗∗∗ --------------------------------------------- https://sec-consult.com/en/blog/advisories/weak-encryption-cipher-and-hardc… ∗∗∗ Security Bulletin: Incorrect permissions on CIT files in IBM Spectrum Protect Backup-Archive Client and IBM Spectrum Protect for Virtual Environments (CVE-2018-2025) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-incorrect-permissions-on-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Spectrum Protect for Enterprise Resource Planning on AIX (CVE-2019-4473, CVE-2019-11771) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Denial of Service vulnerability in IBM Spectrum Protect Backup-Archive Client (CVE-2019-4406) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-denial-of-service-vulnera… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Spectrum Protect Snapshot on AIX (CVE-2019-4473, CVE-2019-11771) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: SMB signing not required in IBM Spectrum Protect Plus (CVE-2016-2115) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-smb-signing-not-required-… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 22.11.2019
by Daily end-of-shift report 22 Nov '19

22 Nov '19

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 21-11-2019 18:00 − Freitag 22-11-2019 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Securing Portable Electronic Devices During Travel ∗∗∗ --------------------------------------------- Holiday travelers often use portable electronic devices (PEDs) because they offer a range of conveniences, for example, enabling the traveler to order gifts on-the-go, access to online banking, or download boarding passes. However, these devices are vulnerable to cyberattack or theft, resulting in exposure of personal information. --------------------------------------------- https://www.us-cert.gov/ncas/current-activity/2019/11/22/securing-portable-… ∗∗∗ Abusing Web Filters Misconfiguration for Reconnaissance ∗∗∗ --------------------------------------------- Yesterday, an interesting incident was detected while working at a customer SOC. They use a “next-generation” firewall that implements a web filter based on categories. This is common in many organizations today: Users web traffic is allowed/denied based on an URL categorization database (like “adult content”, “hacking”, “gambling”, …). How was it detected? --------------------------------------------- https://isc.sans.edu/diary/rss/25538 ∗∗∗ ENISA: How to implement security by design for IoT ∗∗∗ --------------------------------------------- ENISA, the European Union Agency for Cybersecurity releases ‘Good Practices for Security of IoT’, a significant report to promote security by design for IoT. --------------------------------------------- https://www.enisa.europa.eu/news/enisa-news/how-to-implement-security-by-de… ∗∗∗ A guidebook to open-source OT reconnaissance ∗∗∗ --------------------------------------------- An attacker targeting OT needs to perform reconnaissance on the targeted system and learn how it is connected to the IT network. This often involves old-fashioned or digital espionage, but a lot of such information is actually available out there in the open. ... how open source intelligence (OSINT) can be used to learn crucial details of the inner workings of many a system. An important lesson from Daniels paper and talk is that security by obscurity is dead and ... --------------------------------------------- https://www.virusbulletin.com/blog/2019/11/vb2019-paper-fantastic-informati… ∗∗∗ Introducing Flan Scan: Cloudflare’s Lightweight Network Vulnerability Scanner ∗∗∗ --------------------------------------------- Today, we’re excited to open source Flan Scan, Cloudflare’s in-house lightweight network vulnerability scanner. Flan Scan is a thin wrapper around Nmap that converts this popular open source tool into a vulnerability scanner with the added benefit of easy deployment. --------------------------------------------- https://blog.cloudflare.com/introducing-flan-scan/ ∗∗∗ Ransomware: A free tool can decrypt this malware variant that puts a ransom note on you desktop wallpaper ∗∗∗ --------------------------------------------- Emsisoft, which has build the decryption tool, said that the Hakbit ransomware has hit home users and businesses in the US and Europe, demanding $300 in bitcoin from victims, while warning them how many files they stand to lose. --------------------------------------------- https://www.zdnet.com/article/ransomware-a-free-tool-can-decrypt-this-malwa… ===================== = Vulnerabilities = ===================== ∗∗∗ ClamAV: Schwachstelle ermöglicht Denial of Service ∗∗∗ --------------------------------------------- Ein entfernter, anonymer Angreifer kann eine Schwachstelle in ClamAV ausnutzen, um einen Denial of Service Angriff durchzuführen. --------------------------------------------- https://www.bsi-fuer-buerger.de/SharedDocs/Warnmeldungen/DE/TW/2019/11/warn… ∗∗∗ Nodequeue - Critical - Cross Site Scripting - SA-CONTRIB-2019-085 ∗∗∗ --------------------------------------------- Nodequeues JavaScript can be leveraged to insert HTML from attacker-controlled JSON data. This is exploitable if user-submitted "Filtered HTML" content is displayed on a page where nodequeue.js is loaded. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "manipulate queues". --------------------------------------------- https://www.drupal.org/sa-contrib-2019-085 ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Fedora (dpdk, mingw-djvulibre, mingw-hunspell, mingw-ilmbase, mingw-OpenEXR, php-symfony, php-symfony3, and rsyslog), openSUSE (chromium and squid), SUSE (aspell, cups, djvulibre, and dpdk), and Ubuntu (djvulibre). --------------------------------------------- https://lwn.net/Articles/805367/ ∗∗∗ Asterisk: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Asterisk ausnutzen, um beliebigen Programmcode mit den Rechten des Dienstes auszuführen oder einen Denial of Service Zustand herbeizuführen. --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-1011 ∗∗∗ New bypass disclosed in Microsoft PatchGuard (KPP) ∗∗∗ --------------------------------------------- After GhostHook and InfinityHook, we now have ByePg. No patch out yet. --------------------------------------------- https://www.zdnet.com/article/new-bypass-disclosed-in-microsoft-patchguard-… ∗∗∗ Security Bulletin: Information disclosure vulnerability in IBM Tivoli Netcool Impact (CVE-2019-4570) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-information-disclosure-vu… ∗∗∗ Security Bulletin: Log Analysis is vulnerable to a client side scripting attack due to missing HTTPOnly and Secure attribute in the cookie ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-log-analysis-is-vulnerabl… ∗∗∗ Security Bulletin: Stored cross site scripting vulnerability in IBM Tivoli Netcool Impact (CVE-2019-4569) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-stored-cross-site-scripti… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 21.11.2019
by Daily end-of-shift report 21 Nov '19

21 Nov '19

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 20-11-2019 18:00 − Donnerstag 21-11-2019 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Millions of Sites Exposed by Flaw in Jetpack WordPress Plugin ∗∗∗ --------------------------------------------- Admins and owners of WordPress websites are urged to immediately apply the Jetpack 7.9.1 critical security update to prevent potential attacks that could abuse a vulnerability present since Jetpack 5.1. --------------------------------------------- https://www.bleepingcomputer.com/news/security/millions-of-sites-exposed-by… ∗∗∗ New RIPlace Bypass Evades Windows 10, AV Ransomware Protection ∗∗∗ --------------------------------------------- A new ransomware bypass technique called RIPlace requires only a few lines of code to bypass ransomware protection features built into many security products and Windows 10. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-riplace-bypass-evades-wi… ∗∗∗ Gnip Banking Trojan Shows Ongoing, Aggressive Development ∗∗∗ --------------------------------------------- The mobile malware, which incorporates Anubis source code, could evolve into a fully fledged spyware in the future. --------------------------------------------- https://threatpost.com/gnip-banking-trojan-aggressive-development/150521/ ∗∗∗ Linux Webmin Servers Under Attack by Roboto P2P Botnet ∗∗∗ --------------------------------------------- A newly-discovered peer-to-peer (P2P) botnet has been found targeting a remote code execution vulnerability in Linux Webmin servers. --------------------------------------------- https://threatpost.com/linux-webmin-servers-attack-p2p-botnet/150513/ ∗∗∗ Security baseline (FINAL) for Windows 10 v1909 and Windows Server v1909 ∗∗∗ --------------------------------------------- Microsoft is pleased to announce the final release of the security configuration baseline settings for Windows 10 version 1909 (a.k.a., “19H2”), and for Windows Server version 1909. Note that Windows Server version 1909 is Server Core only and does not offer a Desktop Experience (a.k.a., “full”) server installation option. --------------------------------------------- https://techcommunity.microsoft.com/t5/Microsoft-Security-Baselines/Securit… ∗∗∗ Explained: juice jacking ∗∗∗ --------------------------------------------- Juice jacking is a type of cyberattack that uses a USB charging port to steal data or infect phones with malware. Learn how it works and ways to protect against it. --------------------------------------------- https://blog.malwarebytes.com/explained/2019/11/explained-juice-jacking/ ∗∗∗ Video: Identitätsdiebstahl bei Umfragejob ∗∗∗ --------------------------------------------- Auf diversen Job-Portalen stoßen Sie momentan auf Ausschreibungen zu Umfragejobs. Schon bei der Registrierung verlangt man Ihre Ausweiskopie. Melden Sie sich hier nicht an! Kriminelle stehlen Ihre Daten und tarnen die Eröffnung eines Bankkontos in Ihrem Namen als bezahlte Umfrage. --------------------------------------------- https://www.watchlist-internet.at/news/video-identitaetsdiebstahl-bei-umfra… ∗∗∗ DePriMon downloader uses novel ways to infect your PC with ColoredLambert malware ∗∗∗ --------------------------------------------- It is believed the downloader is using techniques not seen before in the wild. --------------------------------------------- https://www.zdnet.com/article/deprimon-downloader-uses-novel-ways-to-infect… ∗∗∗ New SectopRAT Trojan creates hidden second desktop to control browser sessions ∗∗∗ --------------------------------------------- The Trojan makes sure the second desktop is hidden from sight. --------------------------------------------- https://www.zdnet.com/article/new-sectoprat-malware-creates-hidden-second-d… ===================== = Vulnerabilities = ===================== ∗∗∗ Microsoft Releases Outlook for Android Security Update ∗∗∗ --------------------------------------------- Original release date: November 21, 2019Microsoft has released an update to address a vulnerability in Outlook for Android. An attacker could exploit this vulnerability to take control of an affected system. --------------------------------------------- https://www.us-cert.gov/ncas/current-activity/2019/11/21/microsoft-releases… ∗∗∗ New security release versions of BIND are available: 9.11.13, 9.14.8 and 9.15.6 ∗∗∗ --------------------------------------------- New security releases of BIND are available which contain fixes for the CVEs disclosed today. --------------------------------------------- https://lists.isc.org/pipermail/bind-announce/2019-November/001143.html ∗∗∗ Apache Solr Bug Gets Bumped Up to High Severity ∗∗∗ --------------------------------------------- The vulnerability (CVE-2019-12409) was first reported in July and patched in August. ... Since the bug was initially discovered, researchers have reevaluated the threat and escalated its severity to high-risk. --------------------------------------------- https://threatpost.com/apache-solr-bug-gets-bumped-up-to-high-severity/1504… ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Fedora (oniguruma and thunderbird-enigmail), openSUSE (chromium, ghostscript, and slurm), Oracle (kernel), Red Hat (kpatch-patch), Slackware (bind), SUSE (python-ecdsa), and Ubuntu (bind9 and mariadb). --------------------------------------------- https://lwn.net/Articles/805281/ ∗∗∗ Security Bulletin: Inadequate account lockout in Cloud Pak System (CVE-2019-4096) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-inadequate-account-lockou… ∗∗∗ Security Bulletin: Vulnerabilities in WAS Liberty affect IBM Spectrum LSF Suite, Spectrum LSF Suite for HPA and Spectrum LSF Application Center ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-was-li… ∗∗∗ Security Bulletin: Bypass Client-Side Validation vulnerability in Cloud Pak System (CVE-2019-4240) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-bypass-client-side-valida… ∗∗∗ Security Bulletin: A vulnerability in Apache Solr (lucene) affects IBM Operations Analytics – Log Analysis (CVE-2019-4243) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-apache… ∗∗∗ Security Bulletin: Clickjacking vulnerability in IBM Operations Analytics – Log Analysis (CVE-2019-4215) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-clickjacking-vulnerabilit… ∗∗∗ Security Bulletin: IBM Operations Analytics – Log Analysis is vulnerable to potential Host Header Injection (CVE-2019-4216) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-operations-analytics-… ∗∗∗ Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Tivoil Federated Identity Manager ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: XStream as used by IBM QRadar SIEM is vulnerable to os command injection (CVE-2019-10173) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-xstream-as-used-by-ibm-qr… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Spectrum Protect Operations Center on AIX (CVE-2019-4473, CVE-2019-11771) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ IBM Security Bulletin: A Vulnerability in Apache PDFBox Affects Transformation Extender ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-a-vulnerability-in-ap… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Tivoli Netcool/OMNIbus (CVE-2019-4473, CVE-2019-11771) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM OS Images for Red Hat Linux Systems (July2019 updates) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: IBM Cognos Controller 2019Q4 Security Updater: Multiple Security Vulnerabilities have been identified in IBM Cognos Controller ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cognos-controller-201… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 20.11.2019
by Daily end-of-shift report 20 Nov '19

20 Nov '19

===================== = End-of-Day report = ===================== Timeframe: Dienstag 19-11-2019 18:00 − Mittwoch 20-11-2019 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ NSA Releases Cyber Advisory: Managing Risk from Transport Layer Security Inspection ∗∗∗ --------------------------------------------- The National Security Agency (NSA) has released a Cyber Advisory that addresses managing risk from Transport Layer Security Inspection (TLSI). This short, informative document defines TLSI (a security process that allows incoming traffic to be decrypted, inspected, and re-encrypted), explains some risks and associated challenges, and discusses mitigations. --------------------------------------------- https://www.us-cert.gov/ncas/current-activity/2019/11/19/nsa-releases-cyber… ∗∗∗ D-Link Adds More Buggy Router Models to 'Won’t Fix' List ∗∗∗ --------------------------------------------- D-Link has warned that more of its routers are vulnerable to critical flaws that allow remote hackers to take control of hardware and steal data. The routers won’t be fixed, said D-Link, explaining that the hardware has reached its end-of-life and will no longer receive security updates. ... D-Link identified the additional affected models as: DIR-866, DIR-655, DHP-1565, DIR-652, DAP-1533, DGL-5500, DIR-130, DIR-330, DIR-615, DIR-825, DIR-835, DIR-855L and DIR-862. --------------------------------------------- https://threatpost.com/d-link-wont-fix-router-bugs/150438/ ∗∗∗ Monero Project site compromised, served malware-infected binaries ∗∗∗ --------------------------------------------- The official website of the Monero Project has been compromised to serve a malware-infected version of the CLI (command-line interface) wallet. The malicious file was available for download for around 14 hours and at least one of the users who downloaded the malware has had their funds stolen. What happened? --------------------------------------------- https://www.helpnetsecurity.com/2019/11/20/monero-project-compromised/ ===================== = Vulnerabilities = ===================== ∗∗∗ Google and Samsung Fix Android Spying Flaw. Other Makers May Still Be Vulnerable ∗∗∗ --------------------------------------------- Until recently, weaknesses in Android camera apps from Google and Samsung made it possible for rogue apps to record video and audio and take images and then upload them to an attacker-controlled server -- without any permissions to do so. Camera apps from other manufacturers may still be susceptible. --------------------------------------------- https://tech.slashdot.org/story/19/11/19/1737219/google-and-samsung-fix-and… ∗∗∗ Administration Views - Moderately critical - Access bypass - SA-CONTRIB-2019-076 ∗∗∗ --------------------------------------------- This module replaces administrative overview/listing pages with actual views for superior usability.The module doesnt sufficiently check user access when using the "Menu system path" access handler on a Views displays other than "System". --------------------------------------------- https://www.drupal.org/sa-contrib-2019-076 ∗∗∗ Unbound: Vulnerability in IPSEC module ∗∗∗ --------------------------------------------- Due to unsanitized characters passed to the ipsecmod-hook shell command, it is possible for Unbound to allow shell code execution from a specially crafted IPSECKEY answer. (CVE-2019-18934) --------------------------------------------- https://nlnetlabs.nl/projects/unbound/security-advisories/ ∗∗∗ Flexera FlexNet Publisher ∗∗∗ --------------------------------------------- These vulnerabilities could allow an attacker to deny the acquisition of a valid license for legal use of the product. The memory corruption vulnerability could allow remote code execution. (CVE-2018-20033, CVSS v3 9.8) --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-19-323-01 ∗∗∗ High Severity Vulnerability Patched in WP Maintenance Plugin ∗∗∗ --------------------------------------------- This flaw allowed attackers to enable a vulnerable site’s maintenance mode and inject malicious code affecting site visitors. We disclosed this issue privately to the plugin’s developer who released a patch the next day. Plugin versions of WP Maintenance up to 5.0.5 are vulnerable to attacks against this flaw. All WP Maintenance users should update to version 5.0.6 immediately. --------------------------------------------- https://www.wordfence.com/blog/2019/11/high-severity-vulnerability-patched-… ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (redmine), Fedora (libidn2), Mageia (clamav, ghostscript, kernel, kernel-linus, libexif, libjpeg, mariadb, microcode, and systemd), and openSUSE (libjpeg-turbo). --------------------------------------------- https://lwn.net/Articles/805224/ ∗∗∗ Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco Unified Communications Manager SQL Injection Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco Webex Teams for Windows DLL Hijacking Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco WebEx Centers Username Enumeration Information Disclosure Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco SD-WAN Solution vManage Cross-Site Request Forgery Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco Unity Express Command Injection Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco Unified Communications Domain Manager Persistent Cross-Site Scripting Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco Stealthwatch Enterprise Cross-Site Scripting Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco Small Business Routers RV016, RV042, RV042G, and RV082 Information Disclosure Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco IOS XR Software NETCONF Over Secure Shell ACL Bypass Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco Email Security Appliance URL Filtering Bypass Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco Email Security Appliance MP3 Content Filter Bypass Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco DNA Spaces: Connector SQL Injection Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco DNA Spaces: Connector Privilege Escalation Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco DNA Spaces: Connector Command Injection Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Security Advisory - Use of Insufficiently Random Values Vulnerability in Huawei ViewPoint Products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191120-… ∗∗∗ Security Advisory - Two Vulnerabilities in Some Huawei Home Routers ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191113-… ∗∗∗ Security Advisory - Improper Validation of Array Index Vulnerability in Several Smartphones ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191120-… ∗∗∗ Security Bulletin: IBM Maximo Asset Management is vulnerable to Privilege Escalation (CVE-2019-4530) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-maximo-asset-manageme… ∗∗∗ Security Bulletin: A security vulnerability has been fixed in the IBM Security Identity Manager product (CVE-2019-4561) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: Vulnerabilities in WAS Liberty affect IBM Spectrum LSF Suite, Spectrum LSF Suite for HPA and Spectrum LSF Application Center ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-was-li… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 19.11.2019
by Daily end-of-shift report 19 Nov '19

19 Nov '19

===================== = End-of-Day report = ===================== Timeframe: Montag 18-11-2019 18:00 − Dienstag 19-11-2019 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Linux, Windows Users Targeted With New ACBackdoor Malware ∗∗∗ --------------------------------------------- Researchers have discovered a new multi-platform backdoor that infects Windows and Linux systems allowing the attackers to run malicious code and binaries on the compromised machines. --------------------------------------------- https://www.bleepingcomputer.com/news/security/linux-windows-users-targeted… ∗∗∗ Buran Ransomware Infects PCs via Microsoft Excel Web Queries ∗∗∗ --------------------------------------------- A new spam campaign has been spotted distributing the Buran Ransomware through IQY file attachments. When opened, these Microsoft Excel Web Query attachments will execute a remote command that installs the ransomware onto a victims computer. --------------------------------------------- https://www.bleepingcomputer.com/news/security/buran-ransomware-infects-pcs… ∗∗∗ Coin Stealer Found in Monero Linux Binaries From Official Site ∗∗∗ --------------------------------------------- The Monero Project is currently investigating a potential compromise of the official website after a coin stealer was found in the Linux 64-bit command line (CLI) Monero binaries downloaded from the download page. --------------------------------------------- https://www.bleepingcomputer.com/news/security/coin-stealer-found-in-monero… ∗∗∗ Elasticsearch: Datenleak bei Conrad ∗∗∗ --------------------------------------------- Der Elektronikhändler Conrad meldet, dass ein Angreifer Zugang zu Kundendaten und Kontonummern gehabt habe. Grund dafür war eine ungesicherte Elasticsearch-Datenbank. --------------------------------------------- https://www.golem.de/news/elasticsearch-datenleak-bei-conrad-1911-145091-rs… ∗∗∗ Windows Debugging & Exploiting Part 2 - WinDBG 101 ∗∗∗ --------------------------------------------- Hello again! After our previous post about the environment setup, now it is time to cover the main tool of this project, the WinDBG. --------------------------------------------- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/windows-deb… ∗∗∗ When Bank Communication is Indistinguishable from Phishing Attacks ∗∗∗ --------------------------------------------- You know how banks really, really want to avoid their customers falling victim to phishing scams? And how they put a heap of effort into education to warn folks about the hallmarks of phishing scams? And how banks are the shining beacons of light when it comes to demonstrating security [...] --------------------------------------------- https://www.troyhunt.com/when-bank-communication-is-indistinguishable-from-… ∗∗∗ Vulnerability in ABB Plant Historian Disclosed 5 Years After Discovery ∗∗∗ --------------------------------------------- It took Swiss-based industrial technology solutions provider ABB five years to inform customers of a critical vulnerability affecting one of its products, and the researcher who found it says this increased the chances of threat actors discovering and exploiting the security flaw. --------------------------------------------- https://www.securityweek.com/vulnerability-abb-plant-historian-disclosed-5-… ∗∗∗ Vorsicht bei angeblichen Gewinnspielen von Magenta, A1, Drei oder Liwest ∗∗∗ --------------------------------------------- Aktuell verbreiten Kriminelle über unterschiedliche Kanäle Fake-Gewinnspiele. Sie werden entweder per E-Mail, SMS oder mittels Pop-Up im Browser benachrichtigt, dass Sie angeblich ein Smartphone gewonnen haben. Um den Gewinn zu erhalten, muss nur eine kurze Umfrage beantwortet und ein kleiner Geldbetrag für den Versand bezahlt werden. Vorsicht: Es handelt sich um eine Abo-Falle. --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-bei-angeblichen-gewinnspiel… ===================== = Vulnerabilities = ===================== ∗∗∗ Schwere Sicherheitslücke in WhatsApp entdeckt ∗∗∗ --------------------------------------------- In WhatsApp wurde eine Schwachstelle gefunden, die es Angreifern ermöglicht, Dateien zu stehlen und Nachrichten auszulesen. --------------------------------------------- https://futurezone.at/apps/schwere-sicherheitsluecke-in-whatsapp-entdeckt/4… ∗∗∗ Lernplattform Moodle: Entwickler schließen kritische Schwachstellen ∗∗∗ --------------------------------------------- Moodle-Admins aufgepasst: Neue Versionen schließen mehrere, teils als "Serious" bewertete Lücken. --------------------------------------------- https://heise.de/-4591094 ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (python-psutil, slurm-llnl, symfony, and thunderbird), Fedora (gd and ghostscript), and SUSE (ceph, haproxy, java-11-openjdk, and ncurses). --------------------------------------------- https://lwn.net/Articles/805149/ ∗∗∗ Lexmark Services Monitor 2.27.4.0.39 Directory Traversal ∗∗∗ --------------------------------------------- https://cxsecurity.com/issue/WLB-2019110124 ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Performance Management products ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Vulnerabilities in Curl affect PowerSC (CVE-2019-5435, CVE-2019-5436) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-curl-a… ∗∗∗ HPESBHF03963 rev.1 - Certain HPE ProLiant Servers with Intel CSME, AMT, SPS, TXE, ∗∗∗ --------------------------------------------- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_n… ∗∗∗ HPESBHF03968 rev.1 - HPE Gen10 ProLiant, Apollo, and Synergy Servers using Intel CPU Transactional Synchronization Extensions (TSX) Asynchronous Abort (TAA), Local Disclosure of Information ∗∗∗ --------------------------------------------- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_n… ∗∗∗ HPESBHF03969 rev.1 - HPE ProLiant Gen10 Servers using certain Intel Xeon Scalable Processors, Voltage Modulation, Local Denial of Service ∗∗∗ --------------------------------------------- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_n… ∗∗∗ HPESBHF03971 rev.1 - HPE Servers using certain Intel Processors, SMM and TXT, Local Escalation of Privilege ∗∗∗ --------------------------------------------- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_n… ∗∗∗ HPESBST03964 rev.1 - HPE Nimble Storage, Multiple Remote Vulnerabilities ∗∗∗ --------------------------------------------- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_n… ∗∗∗ Google Chrome: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-0998 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 18.11.2019
by Daily end-of-shift report 18 Nov '19

18 Nov '19

===================== = End-of-Day report = ===================== Timeframe: Freitag 15-11-2019 18:00 − Montag 18-11-2019 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ New NextCry Ransomware Encrypts Data on NextCloud Linux Servers ∗∗∗ --------------------------------------------- On October 24, Nextcloud released an urgent alert about a remote code execution vulnerability that impacts the default Nextcloud NGINX configuration. Tracked as CVE-2019-11043, the flaw is in the PHP-FPM (FastCGI Process Manager) component, included by some hosting providers like Nextcloud in their default setup. A public exploit exists and has been leveraged to compromised servers. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-nextcry-ransomware-encry… ∗∗∗ Powershell ConstrainedLanguage Mode ∗∗∗ --------------------------------------------- Gastbeitrag vom milCERT - Philipp Thaller und Stefan Bachmair - Bei der Analyse von aktueller Malware stellte sich heraus dass viele der aktuellen Exemplare (inkl. Emotet ) auf die PowerShell angewiesen sind um ihr schadhaftes Potential entfalten zu können. Schränkt man die PowerShell entsprechend ein, ist eine Ausführung des eigentlichen Schadcodes oft gar nicht möglich. --------------------------------------------- https://cert.at/de/blog/2019/11/201911-powershell-constrainedlanguage ∗∗∗ Willhaben warnt vor betrügerischer Phishing-SMS ∗∗∗ --------------------------------------------- Wer von der Verkaufsplattform Willhaben eine SMS mit Zahlungsinformationen bekommt, soll den Link keinesfalls anklicken. --------------------------------------------- https://futurezone.at/apps/willhaben-warnt-vor-betruegerischer-phishing-sms… ∗∗∗ pax: Exploit padding oracles for fun and profit ∗∗∗ --------------------------------------------- Pax (PAdding oracle eXploiter) is a tool for exploiting padding oracles in order to: - Obtain plaintext for a given piece of CBC encrypted data. - Obtain encrypted bytes for a given piece of plaintext, using the unknown encryption algorithm used by the oracle. --------------------------------------------- https://github.com/liamg/pax ∗∗∗ RdpThief: Extracting Clear-text Credentials from Remote Desktop Clients ∗∗∗ --------------------------------------------- In this blogpost I will describe the process I followed to write a tool that will extract clear-text credentials from the Microsoft RDP client using API hooking. Using this approach, if you are already operating under the privileges of the compromised user (e.g. as a result of a phish) and the user has an RDP session open, you are able to extract the clear-text credentials without privilege escalation. --------------------------------------------- https://www.mdsec.co.uk/2019/11/rdpthief-extracting-clear-text-credentials-… ∗∗∗ Medica 2019: BSI-Leitfaden zur Cyber-Sicherheit von Medizinprodukten ∗∗∗ --------------------------------------------- Im Kontext der sicheren Digitalisierung im Gesundheitswesen hat das Bundesamt für Sicherheit in der Informationstechnik (BSI) im Rahmen der Messe "Medica" in Düsseldorf einen neuen Leitfaden "Sicherheit von Medizinprodukten – Leitfaden zur Nutzung des MDS2 aus 2019" (Manufacturer Disclosure Statement for Medical Device Security) veröffentlicht. --------------------------------------------- https://www.bsi.bund.de/DE/Presse/Pressemitteilungen/Presse2019/Leitfaden_M… ∗∗∗ Google patches ‘awesome’ XSS vulnerability in Gmail dynamic email feature ∗∗∗ --------------------------------------------- The bug bounty hunter who disclosed the issue says the bug is a prime example of DOM Clobbering. --------------------------------------------- https://www.zdnet.com/article/google-patches-awesome-xss-vulnerability-in-g… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (angular.js, libapache2-mod-auth-openidc, mosquitto, postgresql-common, and thunderbird), Fedora (chromium, djvulibre, freetds, ghostscript, java-1.8.0-openjdk-aarch32, samba, thunderbird-enigmail, wpa_supplicant, and xen), openSUSE (go1.12, ImageMagick, and ucode-intel), Oracle (ghostscript and kernel), Red Hat (libcomps and sudo), Slackware (kernel), SUSE (microcode_ctl, slurm, and ucode-intel), and Ubuntu (mysql-5.7, mysql-8.0 and python-ecdsa). --------------------------------------------- https://lwn.net/Articles/805083/ ∗∗∗ Security Bulletin: Denial of Service vulnerability in WebSphere Application Server Liberty affects IBM Spectrum Protect Operations Center (CVE-2019-4096) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-denial-of-service-vulnera… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 15.11.2019
by Daily end-of-shift report 15 Nov '19

15 Nov '19

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 14-11-2019 18:00 − Freitag 15-11-2019 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ How the Linux kernel balances the risks of public bug disclosure ∗∗∗ --------------------------------------------- A serious Wi-Fi flaw shows how Linux handles security in plain sight. --------------------------------------------- https://nakedsecurity.sophos.com/2019/11/15/how-the-linux-kernel-balances-t… ∗∗∗ A Tale of Rootkits and Other Backdoors ∗∗∗ --------------------------------------------- In this post, we will focus on software backdoors commonly seen in Linux environments, we will attempt to outline some representative examples, and we will discuss common techniques backdoor authors use to hide their malicious payloads. --------------------------------------------- https://capsule8.com/blog/dont-get-kicked-out-a-tale-of-rootkits-and-other-… ===================== = Vulnerabilities = ===================== ∗∗∗ Security Advisory 2019-15: Security Update for OTRS Framework ∗∗∗ --------------------------------------------- OTRS can be put into an endless loop by providing filenames with overly long extensions. This applies to the PostMaster (sending in email) and also upload (attaching files to mails, for example). --------------------------------------------- https://community.otrs.com/security-advisory-2019-15-security-update-for-ot… ∗∗∗ Security Advisory 2019-14: Security Update for OTRS Framework ∗∗∗ --------------------------------------------- An attacker who is logged into OTRS as an agent is able to list tickets assigned to other agents, which are in the queue where attacker doesn’t have permissions. --------------------------------------------- https://community.otrs.com/security-advisory-2019-14-security-update-for-ot… ∗∗∗ A heap overflow vulnerability has been found in wolfssl ∗∗∗ --------------------------------------------- Wolfssl is an TLS library mostly used in embedded Linux devices. It is also used in the popular tool curl. ... The vulnerability has been given the CVE of CVE-2019–18840. --------------------------------------------- https://medium.com/@social_62682/heap-overflow-in-wolfssl-cve-2019-18840-18… ∗∗∗ Lücke in älteren WhatsApp-Versionen erlaubte Codeausführung aus der Ferne ∗∗∗ --------------------------------------------- Facebook weist auf eine Lücke in dem Messenger WhatsApp hin. Viele Geräte sollten dank automatischer Updates bereits seit einiger Zeit geschützt sein. --------------------------------------------- https://heise.de/-4587119 ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by CentOS (kernel), Debian (ghostscript, mesa, and postgresql-common), Fedora (chromium, php-robrichards-xmlseclibs, php-robrichards-xmlseclibs3, samba, scap-security-guide, and wpa_supplicant), Mageia (cpio, fribidi, libapreq2, python-numpy, webkit2, and zeromq), openSUSE (ImageMagick, kernel, libtomcrypt, qemu, ucode-intel, and xen), Oracle (kernel), Red Hat (ghostscript, kernel, and kernel-rt), Scientific Linux (ghostscript and kernel), SUSE (bash, enigmail, ghostscript, kernel, libjpeg-turbo, openconnect, squid), Ubuntu (ghostscript, imagemagick, postgresql-common). --------------------------------------------- https://lwn.net/Articles/804904/ ∗∗∗ Philips IntelliBridge EC40/80 ∗∗∗ --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsma-19-318-01 ∗∗∗ Omron CX-Supervisor ∗∗∗ --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-19-318-04 ∗∗∗ ABB Power Generation Information Manager (PGIM) and Plant Connect ∗∗∗ --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-19-318-05 ∗∗∗ Security Bulletin: CSV Injection (CVE-2019-4490) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-csv-injection-cve-2019-44… ∗∗∗ Security Bulletin: Multiple vulnerabilities in jackson-databind affect IBM Platform Symphony and IBM Spectrum Symphony ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Security vulnerabilities affect IBM Cloud Object Storage SDK Java (November 2019 Bulletin) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-security-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Performance Management products ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: IBM OS Images for RedHat Enterprise System is vulnerable to Intel Microarchitectural Data Sampling (MDS) Vulnerabilites (CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-os-images-for-redhat-… ∗∗∗ Security Bulletin: OpenSSL vulnerabilites impacting IBM Aspera Connect 3.7.4 and earlier (CVE-2017-3732, CVE-2016-7055) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-openssl-vulnerabilites-im… ∗∗∗ Security Bulletin: Apache Commons Collections library in WebSphere Application Server Knowledge Center is vulnerable (CVE-2015-7450) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-apache-commons-collection… ∗∗∗ iControl REST logs a plaintext password when the syntax of a cURL request is incorrect ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K61105950 ∗∗∗ BIG-IP / BIG-IQ / Enterprise Manager / F5 iWorkflow Configuration utility vulnerability CVE-2019-6663 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K76052144 ∗∗∗ TMM vulnerability CVE-2019-6660 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K23860356 ∗∗∗ TLS 1.3 vulnerability CVE-2019-6659 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K34450231 ∗∗∗ BIG-IP restjavad vulnerability CVE-2019-6662 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K01049383 ∗∗∗ TMOS vulnerability CVE-2019-6664 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K03126093 ∗∗∗ BIG-IP APM apd vulnerability CVE-2019-6661 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K61705126 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 14.11.2019
by Daily end-of-shift report 14 Nov '19

14 Nov '19

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 13-11-2019 18:00 − Donnerstag 14-11-2019 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Researchers Find Bug in Qualcomm Code for Trusted App ∗∗∗ --------------------------------------------- Researchers stressing the code related to Qualcomms implementation of the secure execution area on mobile devices found a new vulnerability that could allow access to critical data. --------------------------------------------- https://www.bleepingcomputer.com/news/security/researchers-find-bug-in-qual… ∗∗∗ NCSC-NZ Cyber threat report for 2018/19 released ∗∗∗ --------------------------------------------- The National Cyber Security Centre, (NCSC) has released its Cyber Threat Report for the 2018/19 reporting year. --------------------------------------------- https://www.ncsc.govt.nz/newsroom/cyber-threat-report-for-201819-released/ ∗∗∗ Windows & Linux get options to disable Intel TSX to prevent Zombieload v2 attacks ∗∗∗ --------------------------------------------- Disclosure of new Zombieload v2 vulnerability prompts OS makers to react with ways to disable Intels TSX technology. --------------------------------------------- https://www.zdnet.com/article/windows-linux-get-options-to-disable-intel-ts… ===================== = Vulnerabilities = ===================== ∗∗∗ Symantec Fixes Privilege Escalation Flaw in Endpoint Protection ∗∗∗ --------------------------------------------- Symantec fixed a local privilege escalation security flaw affecting all Symantec Endpoint Protection software versions prior to 14.2 RU2, and allowing attackers to escalate privileges on compromised devices and execute malicious code using SYSTEM privileges. --------------------------------------------- https://www.bleepingcomputer.com/news/security/symantec-fixes-privilege-esc… ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (kernel, linux-lts, and linux-zen), CentOS (kernel, sudo, and thunderbird), Debian (linux-4.9), Fedora (samba), openSUSE (apache2-mod_auth_openidc, kernel, qemu, rsyslog, and ucode-intel), Oracle (kernel), Red Hat (kernel and kernel-rt), Scientific Linux (kernel), SUSE (kernel and microcode_ctl), and Ubuntu (kernel, libjpeg-turbo, linux, linux-hwe, linux-oem, linux, linux-hwe, linux-oem-osp1, and qemu). --------------------------------------------- https://lwn.net/Articles/804775/ ∗∗∗ Movable Type vulnerable to open redirect ∗∗∗ --------------------------------------------- https://jvn.jp/en/jp/JVN65280626/ ∗∗∗ Security Bulletin: IBM Security Guardium is affected by an OpenSSL vulnerability ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by an Oracle MySQL vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by an OpenSSL vulnerability ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli Netcool Impact ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ bzip2 vulnerability CVE-2019-12900 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K68713584 ∗∗∗ lodash library vulnerability CVE-2019-10744 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K47105354 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 13.11.2019
by Daily end-of-shift report 13 Nov '19

13 Nov '19

===================== = End-of-Day report = ===================== Timeframe: Dienstag 12-11-2019 18:00 − Mittwoch 13-11-2019 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Network Traffic Analysis for IR: Address Resolution Protocol (ARP) with Wireshark ∗∗∗ --------------------------------------------- Introduction to the Address Resolution Protocol The Address Resolution Protocol (ARP) was first defined in RFC 826. As the name suggests, it is designed to resolve IP addresses into a form usable by other systems within a subnet. Network addressing works at a couple of different layers of the OSI model. --------------------------------------------- https://resources.infosecinstitute.com/address-resolution-protocol-arp-with… ∗∗∗ Schlüssel aus TPM-Chips lassen sich extrahieren ∗∗∗ --------------------------------------------- Mit einem Timing-Angriff lassen sich Signaturschlüssel auf Basis elliptischer Kurven aus TPM-Chips extrahieren. ... TPM-Chips sind in allen modernen PCs vorhanden und teilweise umstritten, da sie auch dazu genutzt werden können, Schutzmechanismen gegen den Willen des Nutzers umzusetzen. Trotz ihrer Verbreitung werden die Chips eher selten für kritische Applikationen genutzt, die Auswirkungen der Lücke dürften sich in Grenzen halten. --------------------------------------------- https://www.golem.de/news/tpm-fail-schluessel-aus-tpm-chips-lassen-sich-ext… ∗∗∗ GSM Traffic and Encryption: A5/1 Stream Cipher ∗∗∗ --------------------------------------------- This write-up documents some of my follow-up research with regard to analyzing the GSM traffic packets I captured using Software Defined Radio. My attempt was to better understand the GSM mobile network protocols and procedures, with an emphasis on the authentication and ciphering algorithms being deployed. --------------------------------------------- https://www.blackhillsinfosec.com/gsm-traffic-and-encryption-a5-1-stream-ci… ∗∗∗ Angriffe über USB und Bluetooth: Android-Smartphones verwundbar ∗∗∗ --------------------------------------------- Sicherheitsforscher haben Schwachstellen in mehreren älteren Android-Smartphones entdeckt, die sie über USB- und Bluetooth-Verbindungen ausnutzen konnten. --------------------------------------------- https://heise.de/-4584690 ∗∗∗ Seriöses Job-Angebot oder Auftrag zur Geldwäsche? ∗∗∗ --------------------------------------------- Auf diversen Job-Börsen und Kleinanzeigenportalen stoßen Arbeitssuchende momentan auf Angebote zur freien Mitarbeit der „TideBit Deutschland LTD“. Die Firma existiert in dieser Form nicht. Kriminelle missbrauchen den Namen eines Kryptowährungsunternehmens, um BewerberInnen zur Geldwäsche zu bringen. Wer die Aufgaben erfüllt, macht sich womöglich selbst strafbar. --------------------------------------------- https://www.watchlist-internet.at/news/serioeses-job-angebot-oder-auftrag-z… ===================== = Vulnerabilities = ===================== ∗∗∗ November 2019 security updates are available! ∗∗∗ --------------------------------------------- We have released the November security updates to provide additional protections against malicious attackers. As a best practice, we encourage customers to turn on automatic updates. More information about this month’s security updates can be found in the Security Update Guide. As a reminder, Windows 7 and Windows Server 2008 R2 will be out of extended support and no longer receiving updates as of January 14, 2020. --------------------------------------------- https://msrc-blog.microsoft.com:443/2019/11/12/november-2019-security-updat… ∗∗∗ Intel fixt Sicherheitslücken und enthüllt nebenbei eine neue ZombieLoad-Variante ∗∗∗ --------------------------------------------- Zum Patch Tuesday hat Intel 77 teils kritische Lücken gefixt, unter denen sich auch ein bislang geheim gehaltener Seitenkanalangriff befand. --------------------------------------------- https://heise.de/-4584543 ∗∗∗ VMSA-2019-0020 ∗∗∗ --------------------------------------------- VMware ESXi, Workstation, and Fusion patches provide Hypervisor-Specific Mitigations for Speculative-Execution Vulnerabilities (CVE-2018-12207, CVE-2019-11135) --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2019-0020.html ∗∗∗ VMSA-2019-0021 ∗∗∗ --------------------------------------------- VMware Workstation and Fusion updates address multiple security vulnerabilities (CVE-2019-5540, CVE-2019-5541, CVE-2019-5542) --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2019-0021.html ∗∗∗ VMSA-2019-0008.2 ∗∗∗ --------------------------------------------- VMware product updates enable Hypervisor-Specific Mitigations, Hypervisor-Assisted Guest Mitigations, and Operating System-Specific Mitigations for Microarchitectural Data Sampling (MDS) Vulnerabilities (CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, and CVE-2019-11091) --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2019-0008.html ∗∗∗ Xen Security Advisory CVE-2019-11135 / XSA-305 ∗∗∗ --------------------------------------------- A new way to sample data from microarchitectural structures has been identified. A TSX Asynchronous Abort is a state which occurs between a transaction definitely aborting (usually for reasons outside of the pipeline's control e.g. receiving an interrupt), and architectural state being rolled back to start of the transaction. During this period, speculative execution may be able to infer the value of data in the microarchitectural structures. --------------------------------------------- https://xenbits.xen.org/xsa/advisory-305.html ∗∗∗ Xen Security Advisory CVE-2018-12207 / XSA-304 ∗∗∗ --------------------------------------------- An erratum exists across some CPUs whereby an instruction fetch may cause a machine check error if the pagetables have been updated in a specific manner without invalidating the TLB. ... This corner case can be triggered by guest kernels. --------------------------------------------- https://xenbits.xen.org/xsa/advisory-304.html ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (dpdk, intel-microcode, kernel, libssh2, qemu, and webkit2gtk), Fedora (apache-commons-beanutils, bluez, iwd, kernel, kernel-headers, kernel-tools, libell, and microcode_ctl), openSUSE (gdb), Oracle (kernel), Red Hat (kernel and kernel-rt), SUSE (dhcp, evolution, kernel, libcaca, python, python-xdg, qemu, sysstat, ucode-intel, and xen), and Ubuntu (dpdk, intel-microcode, kernel, linux, linux-aws, ..., webkit2gtk) --------------------------------------------- https://lwn.net/Articles/804641/ ∗∗∗ Citrix Hypervisor Security Update ∗∗∗ --------------------------------------------- CTX263684 - A security issue has been identified in certain CPU hardware that may allow unprivileged code running on a CPU core to infer the value of memory data belonging to other processes, virtual machines or the hypervisor that are, or have recently been, running on the same CPU core. --------------------------------------------- https://support.citrix.com/article/CTX263684 ∗∗∗ Citrix ADC and Citrix Gateway Security Update (CVE-2019-0140) ∗∗∗ --------------------------------------------- CTX263807 - A vulnerability has been identified affecting Citrix Application Delivery Controller (ADC) formerly known as NetScaler ADC, and Citrix Gateway, formerly known as NetScaler Gateway, platforms which could result in privilege escalation via layer 2 network access on all network interfaces. --------------------------------------------- https://support.citrix.com/article/CTX263807 ∗∗∗ Cisco Prime Infrastructure and Evolved Programmable Network Manager Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco Identity Services Engine Cross-Site Scripting Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Security Advisory - Two Vulnerabilities in Some Huawei Products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191113-… ∗∗∗ Security Advisory - Improper File Management Vulnerability in Huawei Share ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191113-… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by kernel vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Security Bulletin: IBM NeXtScale Fan Power Controller (FPC) is affected by vulnerability in OpenSSL (CVE-2019-1559) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-nextscale-fan-power-c… ∗∗∗ libpcap vulnerability CVE-2019-15163 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K92862401?utm_source=f5support&utm_mediu… ∗∗∗ Hotfix XS80E008 - For Citrix Hypervisor 8.0 ∗∗∗ --------------------------------------------- https://support.citrix.com/article/CTX263663 ∗∗∗ Hotfix XS76E012 - For XenServer 7.6 ∗∗∗ --------------------------------------------- https://support.citrix.com/article/CTX263662 ∗∗∗ Hotfix XS71ECU2024 - For XenServer 7.1 Cumulative Update 2 ∗∗∗ --------------------------------------------- https://support.citrix.com/article/CTX263661 ∗∗∗ Hotfix XS70E075 - For XenServer 7.0 ∗∗∗ --------------------------------------------- https://support.citrix.com/article/CTX263660 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily