Daily

daily@lists.cert.at

1 participants
3088 discussions

Tageszusammenfassung - 05.10.2018
by Daily end-of-shift report 05 Oct '18

05 Oct '18

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 04-10-2018 18:00 − Freitag 05-10-2018 18:00 Handler: Dimitri Robl Co-Handler: Stefan Lenzhofer ===================== = News = ===================== ∗∗∗ Fallout Exploit Kit Now Installing the Kraken Cryptor Ransomware ∗∗∗ --------------------------------------------- The Fallout Exploit has been distributing the GandCrab Ransomware for the past few weeks, but has now switched its payload to the Kraken Cryptor Ransomware. --------------------------------------------- https://www.bleepingcomputer.com/news/security/fallout-exploit-kit-now-inst… ∗∗∗ 365 Days Later: Finding and Exploiting Safari Bugs using Publicly Available Tools ∗∗∗ --------------------------------------------- Posted by Ivan Fratric, Google Project ZeroAround a year ago, we published the results of research about the resilience of modern browsers against DOM fuzzing, a well-known technique for finding browser bugs. Together with the bug statistics we also published Domato, our DOM fuzzing tool that was used to find those bugs.Given that in the previous research, Apple Safari, or more specifically, WebKit (its DOM engine) did noticeably worse than other browsers, we decided to revisit it after a year [...] --------------------------------------------- https://googleprojectzero.blogspot.com/2018/10/365-days-later-finding-and-e… ∗∗∗ ThreatList: 83% of Routers Contain Vulnerable Code ∗∗∗ --------------------------------------------- Five out of six name brand routers, such as Linksys, NETGEAR and D-Link, contain known open-source vulnerabilities. --------------------------------------------- https://threatpost.com/threatlist-83-of-routers-contain-vulnerable-code/137… ∗∗∗ Domain Name System: Vorsichtsmaßnahmen für den DNS-Schlüsseltausch ∗∗∗ --------------------------------------------- Der kryptografische Hauptschlüssel des DNS wird in einer Woche gewechselt. Für unvorbereitete Provider kann das fatale Folgen haben. --------------------------------------------- http://heise.de/-4179793 ===================== = Vulnerabilities = ===================== ∗∗∗ Carestream Vue RIS ∗∗∗ --------------------------------------------- This advisory includes mitigations for an information exposure through an error message vulnerability in the Carestream Vue RIS, a web-based radiology information system. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSMA-18-277-01 ∗∗∗ Change Healthcare PeerVue Web Server ∗∗∗ --------------------------------------------- This advisory includes mitigations for an information exposure through an error message vulnerability in the Change Healthcare PeerVue Web Server. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSMA-18-277-02 ∗∗∗ WECON PI Studio ∗∗∗ --------------------------------------------- This advisory includes information on stack-based buffer overflow, out-of-bounds write, and out-of-bounds read vulnerabilities in WECON’s PI Studio HMI project programmer. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-18-277-01 ∗∗∗ Security Advisory 2018-06: Security Update for OTRS Framework ∗∗∗ --------------------------------------------- October 05, 2018 — Please read carefully and check if the version of your OTRS system is affected by this vulnerability. Please send information regarding vulnerabilities in OTRS to: security(a)otrs.org PGP Key pub 2048R/9C227C6B 2011-03-21 [expires at: 2020-11-16] uid OTRS Security Team GPG Fingerprint E330 4608 DA6E 34B7 1551 C244 7F9E 44E9 9C22The post Security Advisory 2018-06: Security Update for OTRS Framework appeared first on | community.otrs.com. --------------------------------------------- https://community.otrs.com/security-advisory-2018-06-security-update-for-ot… ∗∗∗ VMSA-2018-0024.1 ∗∗∗ --------------------------------------------- VMware Workspace ONE Unified Endpoint Management Console (AirWatch Console) update resolves SAML authentication bypass vulnerability --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2018-0024.html ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (kernel), Fedora (lcms2, php-tcpdf, and udisks2), openSUSE (ImageMagick, libX11, openssl-1_0_0, openssl-1_1, and otrs), SUSE (kernel, php5, php53, php7, and python), and Ubuntu (apparmor and imagemagick). --------------------------------------------- https://lwn.net/Articles/767689/ ∗∗∗ IBM Security Bulletin: A vulnerability in yum-utils affects PowerKVM ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10728307 ∗∗∗ IBM Security Bulletin: Vulnerabilities in docker affect PowerKVM ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10725649 ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Rational DOORS Web Access ∗∗∗ --------------------------------------------- https://www.ibm.com/support/docview.wss?uid=ibm10733857 ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Rational Application Developer for WebSphere Software ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10733905 ∗∗∗ IBM Security Bulletin: IBM Security Key Lifecycle Manager generates Application Error (CVE-2018-1753) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10733359 ∗∗∗ IBM Security Bulletin: IBM Security Key Lifecycle Manager is vulnerable to Incorrect Permission Assignment for Critical Resource (CVE-2018-1750) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10733311 ∗∗∗ IBM Security Bulletin: IBM Security Key Lifecycle Manager is vulnerable to Hazardous Input Validation ( CVE-2018-1749) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10733303 ∗∗∗ IBM Security Bulletin: IBM Security Key Lifecycle Manager is vulnerable to Information Exposure (CVE-2018-1743) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10733351 ∗∗∗ IBM Security Bulletin: IBM Security Key Lifecycle Manager Uses Hard-coded Credentials (CVE-2018-1742) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10733419 ∗∗∗ IBM Security Bulletin: IBM Security Key Lifecycle Manager is vulnerable to Improper Control of Interaction Frequency (CVE-2018-1741) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10733425 ∗∗∗ Security vulnerabilities fixed in Thunderbird 60.2.1 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2018-25/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 04.10.2018
by Daily end-of-shift report 04 Oct '18

04 Oct '18

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 03-10-2018 18:00 − Donnerstag 04-10-2018 18:00 Handler: Stephan Richter Co-Handler: Dimitri Robl ===================== = News = ===================== ∗∗∗ Phishing Attacks Distributed Through CloudFlares IPFS Gateway ∗∗∗ --------------------------------------------- Yesterday we reported on a phishing attack that utilizes Azure Blob storage in order to have login forms secured by a Microsoft issued SSL certificate. After reviewing the URLs used by the same attacker, BleepingComputer has discovered that these same bad actors are utilizing the Cloudflare IPFS gateway for the same purpose. --------------------------------------------- https://www.bleepingcomputer.com/news/security/phishing-attacks-distributed… ∗∗∗ Nicht bei conquerconsoles.com, konsolenkammer24.de oder konsolenstation24.com kaufen ∗∗∗ --------------------------------------------- Die Fakeshops conquerconsoles.com, konsolenkammer24.de und konsolenstation24.com vertreiben Spielkonsolen und Spiele zu unschlagbaren Preisen. Die Fakeshops locken mit Angeboten, wo Sie eine PlayStation 4 samt Spiel und Controller kostengünstig erwerben können. Sie können nur im Voraus per Banküberweisung bezahlen, erhalten aber keine Ware! --------------------------------------------- https://www.watchlist-internet.at/news/nicht-bei-conquerconsolescom-konsole… ===================== = Vulnerabilities = ===================== ∗∗∗ Printer, email and PDF versions - Highly critical - Remote Code Execution - SA-CONTRIB-2018-063 ∗∗∗ --------------------------------------------- Project: Printer, email and PDF versionsVersion: 7.x-2.x-devDate: 2018-October-03Security risk: Highly critical 20∕25 AC:None/A:None/CI:All/II:All/E:Theoretical/TD:UncommonVulnerability: Remote Code ExecutionDescription: This module provides printer-friendly versions of content, including send by e-mail and PDF versions.The module doesnt sufficiently sanitize the arguments passed to the wkhtmltopdf executable, allowing a remote attacker to execute arbitrary shell commands. --------------------------------------------- https://www.drupal.org/sa-contrib-2018-063 ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (firefox and python-django), Debian (dnsmasq, firefox-esr, imagemagick, and linux-4.9), Fedora (haproxy), openSUSE (bitcoin, firefox, and texlive), SUSE (openslp), and Ubuntu (apache2). --------------------------------------------- https://lwn.net/Articles/767611/ ∗∗∗ Cisco Digital Network Architecture Center Unauthenticated Access Vulnerability ∗∗∗ --------------------------------------------- A vulnerability in Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated, remote attacker to bypass authentication and have direct unauthorized access to critical management functions.The vulnerability is due to an insecure default configuration of the affected system. An attacker could exploit this vulnerability by directly connecting to the exposed services. An exploit could allow the attacker to retrieve and modify critical system files. --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco Digital Network Architecture Center Authentication Bypass Vulnerability ∗∗∗ --------------------------------------------- A vulnerability in the identity management service of Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated, remote attacker to bypass authentication and take complete control of identity management functions.The vulnerability is due to insufficient security restrictions for critical management functions. An attacker could exploit this vulnerability by sending a valid identity management request to the affected system. --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ More Cisco Security Advisories ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/publicationListing.x ∗∗∗ Red Hat JBoss Web Server: Eine Schwachstelle ermöglicht das Erlangen von Benutzerrechten ∗∗∗ --------------------------------------------- https://adv-archiv.dfn-cert.de/adv/2018-1992/ ∗∗∗ Apache Tomcat: Eine Schwachstelle ermöglicht das Darstellen falscher Informationen ∗∗∗ --------------------------------------------- https://adv-archiv.dfn-cert.de/adv/2018-2000/ ∗∗∗ ClamAV: Mehrere Schwachstellen ermöglichen verschiedene Denial-of-Service-Angriffe ∗∗∗ --------------------------------------------- https://adv-archiv.dfn-cert.de/adv/2018-2008/ ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 03.10.2018
by Daily end-of-shift report 03 Oct '18

03 Oct '18

===================== = End-of-Day report = ===================== Timeframe: Dienstag 02-10-2018 18:00 − Mittwoch 03-10-2018 18:00 Handler: Dimitri Robl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Phishing Attack Uses Azure Blob Storage to Impersonate Microsoft ∗∗∗ --------------------------------------------- A new Office 365 phishing attack utilizes an interesting method of storing their phishing form hosted on Azure Blob Storage in order to be secured by a Microsoft SSL certificate. --------------------------------------------- https://www.bleepingcomputer.com/news/security/phishing-attack-uses-azure-b… ∗∗∗ ct deckt auf: Enigmail verschickt Krypto-Mails im Klartext ∗∗∗ --------------------------------------------- In der verbreiteten Thunderbird-Erweiterung Enigmail steckt ein fataler Fehler. Das Problem betrifft den Junior-Modus, der seit April standardmäßig aktiv ist. --------------------------------------------- https://heise.de/-4180405 ∗∗∗ Popular TP-Link wireless home router open to remote hijacking ∗∗∗ --------------------------------------------- By concatenating a known improper authentication flaw with a newly discovered CSRF vulnerability, remote unauthenticated attackers can obtain full control over TP-Link TL-WR841N, a popular wireless consumer router used worldwide. "This type of remote attack can also compromise routers behind a network address translator (NAT) and those not exposed to the public wide area network (WAN) as the vulnerability is remotely reflected off a locally connected host, rather than coming directly over [...] --------------------------------------------- https://www.helpnetsecurity.com/2018/10/03/tp-link-wireless-home-router-hij… ===================== = Vulnerabilities = ===================== ∗∗∗ Delta Electronics ISPSoft ∗∗∗ --------------------------------------------- This advisory includes mitigations for a stack-based buffer overflow vulnerability in the Delta Electronics ISPSoft software. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-18-275-01 ∗∗∗ GE Communicator ∗∗∗ --------------------------------------------- This advisory includes mitigations for a heap-based buffer overflow vulnerability in GEs Communicator, an application for programming and monitoring supported metering devices. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-18-275-02 ∗∗∗ Entes EMG 12 ∗∗∗ --------------------------------------------- This advisory includes mitigations for improper authentication and information exposure through query strings in GET request vulnerabilities in the Entes EMG 12 Ethernet Modbus Gateway. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-18-275-03 ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Fedora (elfutils), Gentoo (firefox), Red Hat (instack-undercloud, openstack-tripleo-heat-templates and openstack-nova), Slackware (mozilla), SUSE (ghostscript, ImageMagick, kernel, mgetty, qemu, and unzip), and Ubuntu (firefox, haproxy, kernel, liblouis, and webkit2gtk). --------------------------------------------- https://lwn.net/Articles/767539/ ∗∗∗ ZDI-18-1107: (0Day) Wecon PIStudio screendata HSC Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-18-1107/ ∗∗∗ ZDI-18-1106: (0Day) Wecon PIStudio xmlparser LoadXMLFile XML External Entity Processing Information Disclosure Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-18-1106/ ∗∗∗ ZDI-18-1109: (0Day) Wecon PIStudio basedll TextContent Stack-based Buffer Overflow Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-18-1109/ ∗∗∗ ZDI-18-1108: (0Day) Wecon PIStudio cximageu Image Parsing Out-Of-Bounds Read Information Disclosure Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-18-1108/ ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ ∗∗∗ HPESBGN03900 rev.1 - HPE enhanced Internet Usage Manager (eIUM) Remote Unauthorized Disclosure of Information vulnerability and Remote Bypass Security Restrictions ∗∗∗ --------------------------------------------- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_n… ∗∗∗ Security vulnerabilities fixed in Firefox 62.0.3 and Firefox ESR 60.2.2 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2018-24/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 02.10.2018
by Daily end-of-shift report 02 Oct '18

02 Oct '18

===================== = End-of-Day report = ===================== Timeframe: Montag 01-10-2018 18:00 − Dienstag 02-10-2018 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Security Update for Foxit PDF Reader Fixes 118 Vulnerabilities ∗∗∗ --------------------------------------------- It has not been a good week for PDF programs. We had an Adobe Acrobat & Reader update released yesterday that fixed 86 vulnerabilities, including numerous critical ones. Not to be beaten, an update for Foxit PDF Reader and Foxit PhantomPDF was released last Friday that fixes a whopping 116 vulnerabilities. --------------------------------------------- https://www.bleepingcomputer.com/news/security/security-update-for-foxit-pd… ∗∗∗ Nine NAS Bugs Open LenovoEMC, Iomega Devices to Attack ∗∗∗ --------------------------------------------- Rated as high-risk vulnerabilities, these privilege-escalation flaws could allow an unauthenticated attacker to access protected content. --------------------------------------------- https://threatpost.com/nine-nas-bugs-open-lenovoemc-iomega-devices-to-attac… ∗∗∗ Keine Rechnung von ibostream.de und sobastream.de zahlen ∗∗∗ --------------------------------------------- Die Abo-Fallen ibostream.de und sobastream.de sehen für ihre Nutzung eine kostenlose Registrierung vor. Fünf Tagen nach der Registrierung erhalten Konsument/innen von der Ibo Das Limited oder der Stream It Limited eine Rechnung von 359,88- Euro. Nutzer/innen müssen die Summe nicht bezahlen, denn zwischen ihnen und ibostream.de oder sobastream.de gibt es keinen Vertrag. --------------------------------------------- https://www.watchlist-internet.at/news/keine-rechnung-von-ibostreamde-und-s… ===================== = Vulnerabilities = ===================== ∗∗∗ Kritische Sicherheitslücken in Adobe Acrobat und Reader - Patches verfügbar ∗∗∗ --------------------------------------------- Adobe hat ausserhalb des monatlichen Patch-Zyklus Updates für Acrobat und Reader veröffentlicht, mit denen teils kritische Sicherheitslücken geschlossen werden. --------------------------------------------- https://www.cert.at/warnings/all/20181002.html ∗∗∗ Android Security Bulletin - October 2018 ∗∗∗ --------------------------------------------- The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. [...] The most severe of these issues is a critical security vulnerability in Framework that could enable a remote attacker using a specially crafted file to execute arbitrary code within the context of a privileged process. --------------------------------------------- https://source.android.com/security/bulletin/2018-10-01.html ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (lib32-libxml2, libxml2, mosquitto, and ntp), Debian (kernel and strongswan), Fedora (firefox), openSUSE (zsh), Oracle (kernel), Red Hat (ceph-iscsi-cli), SUSE (openssl-1_0_0), and Ubuntu (kernel, linux, linux-aws, linux-gcp, linux-kvm, linux-oem, linux-raspi2, linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon, linux-hwe, linux-gcp, linux-lts-trusty, linux-lts-xenial, linux-aws, and strongswan). --------------------------------------------- https://lwn.net/Articles/767467/ ∗∗∗ Vuln: LibTIFF CVE-2018-17795 Heap Based Buffer Overflow Vulnerability ∗∗∗ --------------------------------------------- http://www.securityfocus.com/bid/105445 ∗∗∗ Red Hat JBoss A-MQ, Red Hat JBoss Fuse: Eine Schwachstelle ermöglicht das Erlangen von Benutzerrechten ∗∗∗ --------------------------------------------- https://adv-archiv.dfn-cert.de/adv/2018-1989/ ∗∗∗ IBM Security Bulletin: Multiple security vulnerabilities in GSKit used by Edge Caching proxy of WebSphere Application Server ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10732391 ∗∗∗ IBM Security Bulletin: Cross-site scripting vulnerability in OAuth ear in WebSphere Application Server (CVE-2018-1794) ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10729571 ∗∗∗ IBM Security Bulletin: Cross-site scripting vulnerability in SAML ear in WebSphere Application Server (CVE-2018-1793) ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10729563 ∗∗∗ IBM Security Bulletin: Multiple Security Vulnerabilities affect IBM® Cloud Private (CVE-2018-0739,CVE-2017-17512, CVE-2018-1000122) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10719199 ∗∗∗ IBM Security Bulletin: IBM b-type Network/Storage switches are affected by Sweet32: Birthday attacks on 64-bit block ciphers in TLS and OpenVPN (openssl ,redhat,openVPN) vulnerabilities. ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ssg1S1010724 ∗∗∗ Password disclosure vulnerability & XSS in PTC ThingWorx ∗∗∗ --------------------------------------------- https://www.sec-consult.com/en/blog/advisories/password-disclosure-vulnerab… ∗∗∗ HPESBHF03897 rev.1 - HPE Switches and Routers using OpenSSL, and Intelligent Management Center (iMC) PLAT, Remote Denial of Service ∗∗∗ --------------------------------------------- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_n… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 01.10.2018
by Daily end-of-shift report 01 Oct '18

01 Oct '18

===================== = End-of-Day report = ===================== Timeframe: Freitag 28-09-2018 18:00 − Montag 01-10-2018 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ IC3 Issues Alert Regarding Remote Desktop Protocol (RDP) Attacks ∗∗∗ --------------------------------------------- The Internet Crime Complaint Center (IC3), in collaboration with the Department of Homeland Security and the FBI, have issued a security alert regarding attacks being conducted through the Windows Remote Desktop Protocol. --------------------------------------------- https://www.bleepingcomputer.com/news/security/ic3-issues-alert-regarding-r… ∗∗∗ FBI löst Rätsel um 15 Jahre alte Malware ∗∗∗ --------------------------------------------- Jahrelang spionierte die Fruitfly-Malware unbemerkt Mac-User aus. Nun wurde bekannt, wie die Schadsoftware verbreitet wurde. --------------------------------------------- https://futurezone.at/digital-life/fbi-loest-raetsel-um-15-jahre-alte-malwa… ∗∗∗ Dark Web Azorult Generator Offers Free Binaries to Cybercrooks ∗∗∗ --------------------------------------------- The Gazorp online builder makes it easy to start stealing passwords, credit-card information, cryptocurrency wallet data and more. --------------------------------------------- https://threatpost.com/dark-web-azorult-generator-offers-free-binaries-to-c… ∗∗∗ 70+ different types of home routers(all together 100,000+) are being hijacked by GhostDNS ∗∗∗ --------------------------------------------- note:We have informed various ISPs on the IoC list, and OVH, ORACLE, Google have taken down the related IPs and some others are working on it (Thanks!)Background introductionDNSchanger is not something new and was quite active years ago [1], we occasionally encountered one every once in a [...] --------------------------------------------- http://blog.netlab.360.com/70-different-types-of-home-routers-all-together-… ∗∗∗ Oktober ist Cyber Security-Monat! ∗∗∗ --------------------------------------------- Unter dem Titel "Cyber Security is a Shared Responsibility" findet im Oktober die inzwischen 7. Kampagne der EU zur Verbesserung der allgemeinen Informationssicherheit statt: Der Europäische Cybersicherheitsmonat (ECSM) ist ein breit koordiniertes und umfangreich aufgestelltes Veranstaltungsformat, das Bewusstsein fördern und Kenntnisse vermitteln will. So werden Schritte aufzeigt, die alle Bürger*innen und Organisationen zum Schutz von persönlichen, finanziellen [...] --------------------------------------------- https://www.ikarussecurity.com/at/ueber-ikarus/security-blog/oktober-ist-cy… ∗∗∗ Facebook-Hack: Kombination aus mehreren Software-Lücken war schuld ∗∗∗ --------------------------------------------- Drei Lücken exponierten Millionen Facebook-Konten, darunter das von Mark Zuckerberg. Womöglich waren auch Drittanbieter-Dienste per Facebook-Login betroffen. --------------------------------------------- https://heise.de/-4178569 ∗∗∗ Explosion of look-alike domains aims to steal sensitive data from online shoppers ∗∗∗ --------------------------------------------- Venafi released research on the explosion of look-alike domains, which are routinely used to steal sensitive data from online shoppers. Venafi's research analyzed suspicious domains targeting the top 20 retailers in five key markets: the U.S., U.K., France, Germany and Australia. --------------------------------------------- https://www.helpnetsecurity.com/2018/10/01/look-alike-domains/ ∗∗∗ Erpressung mit intimen Videomaterial ∗∗∗ --------------------------------------------- Kriminelle versenden eine E-Mail, in der es heißt, dass sie das Empfänger/innen-Konto übernommen haben und sein Passwort kennen. Opfer sollen 600 US-Dollar in Bitcoins zahlen, damit die Verbrecher/innen kein intimes Videomaterial veröffentlichen. Konsument/innen können die Nachricht ignorieren und müssen nur ihr Passwort ändern. Eine Zahlung ist nicht erforderlich. --------------------------------------------- https://www.watchlist-internet.at/news/erpressung-mit-intimen-videomaterial/ ===================== = Vulnerabilities = ===================== ∗∗∗ Skype On Debian Microsoft Apt Repo Addition ∗∗∗ --------------------------------------------- Topic: Skype On Debian Microsoft Apt Repo Addition Risk: High Text:Level: Critical Description: The Skype debian packege for Skype (even when not installed via their offical repo) [...] --------------------------------------------- https://cxsecurity.com/issue/WLB-2018090274 ∗∗∗ UPDATED: Security Bulletins Posted ∗∗∗ --------------------------------------------- [...] UPDATE: As of September 28, Adobe is aware of a report that CVE-2018-15961 is being actively exploited in the wild. The updates for ColdFusion 2018 and ColdFusion 2016 announced in APSB18-33 have been elevated to Priority 1, and Adobe recommends customers update to the latest version as soon as possible. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1607 ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (mediawiki), CentOS (389-ds-base, firefox, flatpak, kernel, mod_perl, nss, spice and spice-gtk, and spice-gtk and spice-server), Debian (389-ds-base, ghostscript, mosquitto, and python3.5), Fedora (ca-certificates, firefox, glusterfs, kernel-headers, kernel-tools, libxkbcommon, udisks2, and zchunk), Mageia (firefox), openSUSE (gd, gnutls, mgetty, openssl, and yast2-smt), Oracle (firefox and kernel), Scientific Linux (firefox), SUSE (libX11 and [...] --------------------------------------------- https://lwn.net/Articles/767373/ ∗∗∗ Security Advisory - FRP Bypass Vulnerability in MyCloud APP of Huawei Smart Phones ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2018/huawei-sa-20180930-… ∗∗∗ IBM Security Bulletin: IBM Security Guardium is affected by a Publicly disclosed Apache Struts vulnerability ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10732783 ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM i ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10731329 ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Security Guardium ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10732785 ∗∗∗ IBM Security Bulletin: Cross-site scripting vulnerabilities affect multiple IBM Rational products based on IBM Jazz technology ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10732477 ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Tivoli Netcool/OMNIbus (Multiple CVEs) ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10733457 ∗∗∗ IBM Security Bulletin: IBM Security Guardium is affected by a Using Components with Known Vulnerabilities vulnerability ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10730313 ∗∗∗ IBM Security Bulletin: IBM Security Guardium is affected by a Improper Certificate Validation vulnerability ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10730321 ∗∗∗ IBM Security Bulletin: IBM Security Guardium is affected by a Using Components with Known Vulnerabilities vulnerabilities ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10730329 ∗∗∗ IBM Security Bulletin: IBM Security Guardium is affected by a Missing Security Control vulnerability ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10730323 ∗∗∗ IBM Security Bulletin: IBM Security Guardium is affected by a Password in Clear Text vulnerability ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10730317 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 28.09.2018
by Daily end-of-shift report 28 Sep '18

28 Sep '18

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 27-09-2018 18:00 − Freitag 28-09-2018 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl ===================== = News = ===================== ∗∗∗ New Iot Botnet Torii Uses Six Methods for Persistence, Has No Clear Purpose ∗∗∗ --------------------------------------------- Security researchers discovered a new IoT botnet that is in a league superior to the Mirai variants .. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-iot-botnet-torii-uses-si… ∗∗∗ Out of sight but not invisible: Defeating fileless malware with behavior monitoring, AMSI, and next-gen AV ∗∗∗ --------------------------------------------- Removing the need for files is the next progression of attacker techniques. While fileless techniques used to be employed almost exclusively in sophisticated cyberattacks, they are now becoming widespread in common malware, .. --------------------------------------------- https://cloudblogs.microsoft.com/microsoftsecure/2018/09/27/out-of-sight-bu… ∗∗∗ Credential Leak Flaws in Windows PureVPN Client ∗∗∗ --------------------------------------------- Using a VPN (Virtual Private Network) can bring many advantages, particularly when you want to .. --------------------------------------------- https://trustwave.com/Resources/SpiderLabs-Blog/Credential-Leak-Flaws-in-Wi… ∗∗∗ DNSSEC Key Signing Key Rollover ∗∗∗ --------------------------------------------- Original release date: September 27, 2018 On October 11, 2018, the Internet Corporation for Assigned Names and Numbers (ICANN) will be changing the Root Zone Key Signing Key (KSK) used in the Domain Name System (DNS) Security .. --------------------------------------------- https://www.us-cert.gov/ncas/current-activity/2018/09/27/DNSSEC-Key-Signing… ∗∗∗ [SANS ISC] More Excel DDE Code Injection ∗∗∗ --------------------------------------------- I published the following diary on isc.sans.edu: “More Excel DDE Code Injection“: The “DDE code injection” technique is not brand new. DDE stands for “Dynamic Data Exchange”. It has already been discussed by many security researchers. Just a quick .. --------------------------------------------- https://blog.rootshell.be/2018/09/28/sans-isc-more-excel-dde-code-injection/ ∗∗∗ Stellungnahme des BSI zur Schadsoftware "LoJax" ∗∗∗ --------------------------------------------- https://www.bsi.bund.de/DE/Presse/Pressemitteilungen/Presse2018/LoJax-Schad… ===================== = Vulnerabilities = ===================== ∗∗∗ Emerson AMS Device Manager ∗∗∗ --------------------------------------------- This advisory includes mitigations for improper access control and improper privilege management vulnerabilities in the Emerson AMS Device Manager software. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-18-270-01 ∗∗∗ Fuji Electric Alpha5 Smart Loader ∗∗∗ --------------------------------------------- This advisory includes information on classic buffer overflow and heap-based buffer overflow vulnerabilities in Fuji Electrics Alpha5 Smart Loader servo drive. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-18-270-02 ∗∗∗ Fuji Electric FRENIC Devices ∗∗∗ --------------------------------------------- This advisory includes information on buffer over-read, out-of-bounds read, and stack-based buffer overflow vulnerabilities in Fuji Electrics FRENIC HVAC drive devices. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-18-270-03 ∗∗∗ OpenSSH vulnerability CVE-2018-15473 ∗∗∗ --------------------------------------------- OpenSSH vulnerability CVE-2018-15473. Security Advisory. Security Advisory Description. OpenSSH through 7.7 is prone ... --------------------------------------------- https://support.f5.com/csp/article/K28942395 ∗∗∗ ZDI-18-1093: Delta Industrial Automation PMSoft rtl60 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-18-1093/ ∗∗∗ Foxit Reader, Foxit PhantomPDF: Mehrere Schwachstellen ermöglichen u. a. die Ausführung beliebigen Programmcodes ∗∗∗ --------------------------------------------- https://adv-archiv.dfn-cert.de/adv/2018-1972/ ∗∗∗ IBM Security Bulletin: PowerKVM has released fixes in response to the vulnerabilities known as Foreshadow ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10733108 ∗∗∗ IBM Security Bulletin: Security Misconfiguration during Combined Cumulative Fix Installation Affects IBM WebSphere Portal (CVE-2018-1420) ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=swg22014276 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 27.09.2018
by Daily end-of-shift report 27 Sep '18

27 Sep '18

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 26-09-2018 18:00 − Donnerstag 27-09-2018 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Upcoming Security Updates for Adobe Acrobat and Reader (APSB18-30) ∗∗∗ --------------------------------------------- A prenotification security advisory (APSB18-30) has been posted regarding upcoming Adobe Acrobat and Reader updates scheduled for Tuesday, October 02, 2018. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1621 ∗∗∗ Password Managers Can Be Tricked Into Believing That Malicious Android Apps Are Legitimate ∗∗∗ --------------------------------------------- A new academic study published today reveals that Android-based password managers have a hard time distinguishing between legitimate and fake applications, leading to easy phishing scenarios. From a report: The study looked at how password managers work on modern versions of the Android OS, and which of the OS features attackers can abuse to collect user credentials via phishing attacks carried out via fake, lookalike apps. --------------------------------------------- https://it.slashdot.org/story/18/09/26/1534203/password-managers-can-be-tri… ∗∗∗ LoJax: First UEFI rootkit found in the wild, courtesy of the Sednit group ∗∗∗ --------------------------------------------- Some UEFI rootkits have been presented as proofs of concept; some are known to be at the disposal of (at least some) governmental agencies. However, no UEFI rootkit has ever been detected in the wild – until we discovered a campaign by the Sednit APT group that successfully deployed a malicious UEFI module on a victim’s system. --------------------------------------------- https://www.welivesecurity.com/2018/09/27/lojax-first-uefi-rootkit-found-wi… ∗∗∗ Geldmacherei mit e-Visum für Ägypten ∗∗∗ --------------------------------------------- Konsument/innen, die nach Ägypten einreisen möchten, müssen ein e-Visum beantragen. Auf der offiziellen Regierungswebsite visa2egypt.gov.eg kostet es für eine einmalige Einreise als Tourist/in 25 US-Dollar. Das ist der günstigste Preis für das e-Visum. Andere Anbieter/innen verlangen dafür wesentlich höhere Kosten. Aus diesem Grund ist bei der Beantragung Vorsicht geboten. --------------------------------------------- https://www.watchlist-internet.at/news/geldmacherei-mit-e-visum-fuer-aegypt… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (asterisk, otrs2, and strongswan), Fedora (kernel-headers, moodle, ntp, visualboyadvance-m, and yaml-cpp), Mageia (rsyslog), openSUSE (ant, libzypp, zypper, shadow, and tiff), Oracle (389-ds-base, flatpak, kernel, nss, and openssl), Red Hat (rh-perl524-mod_perl and rh-perl526-mod_perl), Scientific Linux (389-ds-base, flatpak, kernel, and nss), SUSE (firefox, gd, glibc, kernel, mgetty, php7, and wireshark), and Ubuntu (udisks2). --------------------------------------------- https://lwn.net/Articles/766959/ ∗∗∗ WebKitGTK+ and WPE WebKit Security Advisory WSA-2018-0007 ∗∗∗ --------------------------------------------- Several vulnerabilities were discovered in WebKitGTK+ and WPE WebKit. ... We recommend updating to the latest stable versions of WebKitGTK+ and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. --------------------------------------------- https://webkitgtk.org/security/WSA-2018-0007.html ∗∗∗ Cisco Catalyst 6800 Series Switches ROM Monitor Software Secure Boot Bypass Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco IOS XE Software Web UI Denial of Service Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco IOS XE Software HTTP Denial of Service Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco IOS and IOS XE Software VLAN Trunking Protocol Denial of Service Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco IOS and IOS XE Software TACACS+ Client Denial of Service Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco IOS and IOS XE Software SM-1T3/E3 Service Module Denial of Service Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco IOS XE Software NAT Session Initiation Protocol Application Layer Gateway Denial of Service Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco IOS XE Software Shell Access Authentication Bypass Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco IOS Software Precision Time Protocol Denial of Service Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco IOS XE Software Privileged EXEC Mode Root Shell Access Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco IOS and IOS XE Software Plug and Play Agent Memory Leak Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco IOS and IOS XE Software OSPFv3 Denial of Service Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco IOS XE Software MACsec MKA Using EAP-TLS Authentication Bypass Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco IOS Software for Cisco 800 Series Industrial Integrated Services Routers Arbitrary Memory Write Vulnerabilities ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco IOS and IOS XE Software IPv6 Hop-by-Hop Options Denial of Service Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco IOS XE Software and Cisco ASA 5500-X Series Adaptive Security Appliance IPsec Denial of Service Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco IOS XE Software Command Injection Vulnerabilities ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco IOS XE Software Errdisable Denial of Service Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco IOS XE Software Digital Signature Verification Bypass Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco IOS and IOS XE Software Cluster Management Protocol Denial of Service Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco IOS XE Software Cisco Discovery Protocol Memory Leak Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco IOS and IOS XE Software Cisco Discovery Protocol Denial of Service Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ IBM Security Bulletin: A vulnerability in PostgreSQL affects PowerKVM ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10730491 ∗∗∗ IBM Security Bulletin: A vulnerability in gnupg2 affects PowerKVM ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10720353 ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect Rational Performance Tester ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10732455 ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect Rational Service Tester ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10732457 ∗∗∗ IBM Security Bulletin: Vulnerabilities in the Linux kernel affect PowerKVM ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10716879 ∗∗∗ IBM Security Bulletin: Multiple Security Vulnerabilities affect IBM® Cloud Private and IBM Cloud Private Cloud Foundry (CVE-2018-7167, CVE-2018-7164, CVE-2018-7162, CVE-2018-1000168, CVE-2018-7161) ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10718901 ∗∗∗ IBM Security Bulletin: Arbitrary URL Redirection (CVE-2018-1704) affects IBM Platform Symphony, IBM Spectrum Symphony ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10719671 ∗∗∗ IBM Security Bulletin: XML Entity Expansion vulnerability (CVE-2018-1702) affects IBM Platform Symphony, IBM Spectrum Symphony ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10719659 ∗∗∗ IBM Security Bulletin: A vulnerability in policycoreutils affects PowerKVM ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10728473 ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Rational Developer for i and Rational Developer for AIX and Linux Security Bulletin ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10730623 ∗∗∗ HPESBST03884 rev.1 - HPE ConvergedSystem 700 Solutions Using HPE 3PAR Service Processor, Multiple Vulnerabilities ∗∗∗ --------------------------------------------- https://support.hpe.com/hpsc/doc/public/display?docLocale=en&docId=emr_na-h… ∗∗∗ HPESBHF03890 rev.1 - HPE Service Governance Framework (SGF) - Remote Unauthorized Disclosure of Information ∗∗∗ --------------------------------------------- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_n… ∗∗∗ HPESBHF03901 rev.1 - HPE intelligence Management Center (iMC) PLAT, Remote Code Execution ∗∗∗ --------------------------------------------- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_n… ∗∗∗ HPESBHF03902 rev.1 - HPE Intelligent Management Center (iMC) PLAT, Remote Code Execution ∗∗∗ --------------------------------------------- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_n… ∗∗∗ HPESBST03884 rev.2 - HPE ConvergedSystem 700 Solutions Using HPE 3PAR Service Processor, Multiple Vulnerabilities ∗∗∗ --------------------------------------------- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_n… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 26.09.2018
by Daily end-of-shift report 26 Sep '18

26 Sep '18

===================== = End-of-Day report = ===================== Timeframe: Dienstag 25-09-2018 18:00 − Mittwoch 26-09-2018 18:00 Handler: Alexander Riepl Co-Handler: Robert Waldner ===================== = News = ===================== ∗∗∗ Der nächste Meilenstein: [CERT.at #1000000] ∗∗∗ --------------------------------------------- Für unsere Kommunikation per E-Mail verwenden wir (wie viele Firmen) ein Ticketsystem, damit a) die Kommunikation für alle Teammitglieder nachvollziehbar ist, dass b) möglichst keine Anfragen unbeantwortet bleiben und c) der Workflow mit Meldung/Vorfall/Nachforschung abgebildet werden kann. --------------------------------------------- http://www.cert.at/services/blog/20180926100651-2293.html ∗∗∗ Nach Safari und Chrome: Firefox ins Jenseits befördern ∗∗∗ --------------------------------------------- Mit einem präparierten Link kann Mozillas Firefox zum Absturz gebracht werden. Ähnliches hat ein Sicherheitsforscher zuvor mit Apples Safari und Googles Chrome gezeigt. Auf einer Webseite sammelt er die Lücken - mitsamt Absturz-Button. --------------------------------------------- https://www.golem.de/news/nach-safari-und-chrome-firefox-ins-jenseits-befoe… ∗∗∗ New CVE-2018-8373 Exploit Spotted ∗∗∗ --------------------------------------------- On September 18, 2018, more than a month after we published a blog revealing the details of a use-after-free (UAF) vulnerability CVE-2018-8373 that affects the VBScript engine in newer Windows versions, we spotted another exploit that uses the same vulnerability. Its important to note that this exploit doesnt work on systems with updated Internet Explorer versions. --------------------------------------------- https://blog.trendmicro.com/trendlabs-security-intelligence/new-cve-2018-83… ∗∗∗ Full compliance with the PCI DSS drops for the first time in six years ∗∗∗ --------------------------------------------- After documenting improvements in Payment Card Industry Data Security Standard (PCI DSS) compliance over the past six years (2010 – 2016), Verizon’s 2018 Payment Security Report (PSR) now reveals a concerning downward trend with companies failing compliance assessments and perhaps, more importantly, not maintaining – full compliance. --------------------------------------------- https://www.helpnetsecurity.com/2018/09/26/pci-dss-compliance-drop/ ∗∗∗ Gefälschte kabelplus-Phishingmail im Umlauf ∗∗∗ --------------------------------------------- Kriminelle versenden eine gefälschte kabelplus-Nachricht. Darin behaupten sie, dass „ihr Kabelplus Webmail (kabsi.at) Nachrichtenspeicher das Limit-Kontingent in unserer Datenbank erreicht“ hat. Aus diesem Grund sollen Kund/innen eine externe Website aufrufen und persönliche Daten bekannt geben. Diese übermitteln sie nicht an kabelplus, sondern an Kriminelle. --------------------------------------------- https://www.watchlist-internet.at/news/gefaelschte-kabelplus-phishingmail-i… ===================== = Vulnerabilities = ===================== ∗∗∗ Magecart Attacks Grow Rampant in September ∗∗∗ --------------------------------------------- Attacks that compromise websites with scripts that steal payment card data from checkout pages have increased to hundreds of thousands of attempts in little over a month. --------------------------------------------- https://www.bleepingcomputer.com/news/security/magecart-attacks-grow-rampan… ∗∗∗ VU#581311: TP-Link EAP Controller lacks RMI authentication and is vulnerable to deserialization attacks ∗∗∗ --------------------------------------------- TP-Link EAP Controller lacks RMI authentication and is vulnerable to deserialization attacks The TP-LINK EAP Controller is TP-LINKs software for remotely controlling wireless access point devices. EAP Controller for Linux lacks user authentication for RMI service commands, as well as utilizes an outdated vulnerable version of Apache commons-collections, which may allow an attacker to implement deserialization attacks and control the EAP Controller server. --------------------------------------------- http://www.kb.cert.org/vuls/id/581311 ∗∗∗ One Emotet infection leads to three follow-up malware infections, (Wed, Sep 26th) ∗∗∗ --------------------------------------------- In recent weeks, I've generally seen Emotet retrieve Trickbot, the IcedID banking Trojan, or spambot malware for its follow-up infection. I rarely see Emotet retrieve more than one type of follow-up malware. But on Tuesday 2018-09-25, my infected lab host retrieved Trickbot and IcedID immediately after an Emotet infection. Then IcedID caused another infection with AZORult on the same host. --------------------------------------------- https://isc.sans.edu/diary/rss/24140 ∗∗∗ eDirectory 9.1.1 Hot Patch 1 ∗∗∗ --------------------------------------------- This patch is an update to eDirectory 9.1 Support Pack 1 (9.1.1). This update is being provided to resolve potential critical issues found since the latest patch Architecture: x86-64 Security patch: Yes Priority: Mandatory --------------------------------------------- https://download.novell.com/Download?buildid=vP3nS-Hctkk~ ∗∗∗ Stored Cross-Site Scripting in Kendo UI Editor ∗∗∗ --------------------------------------------- A cross-site scripting (XSS) vulnerability in Progress Kendo UI Editor v2018.1.221 allows remote attackers to inject arbitrary JavaScript into the DOM of the WYSIWYG editor. If the victim accesses the editor, the payload gets executed. Furthermore, if the payload is reflected at any other resource that does rely on the sanitisation of the editor itself, the JavaScript payload will be executed in the context of the application which allows attackers in the worst case to take over user sessions. --------------------------------------------- https://www.sec-consult.com/en/blog/advisories/stored-cross-site-scripting-… ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (python2.7 and python3.4), openSUSE (php5-smarty3), Oracle (389-ds-base, flatpak, kernel, and nss), Red Hat (389-ds-base, chromium-browser, flatpak, kernel, kernel-alt, kernel-rt, nss, and qemu-kvm-ma), and SUSE (ant, dom4j, kernel, and wireshark). --------------------------------------------- https://lwn.net/Articles/766746/ ∗∗∗ IBM Security Bulletin: Cross-Site Scripting Vulnerability Affects IBM WebSphere Portal (CVE-2018-1820) ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10732287 ∗∗∗ IBM Security Bulletin: Security Vulnerability in Apache Batik Affects IBM WebSphere Portal (CVE-2018-8013) ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10731435 ∗∗∗ IBM Security Bulletin: Multiple Vulnerabilities in IBM Java SDK Affect IBM Algo Credit Manager ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10728567 ∗∗∗ IBM Security Bulletin: Multiple Vulnerabilities in IBM Runtime Environments Java Technology Edition, Versions 7 & 8 Affect Transformation Extender ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10720173 ∗∗∗ IBM Security Bulletin: Open Redirect Vulnerability in IBM WebSphere Portal (CVE-2018-1736) ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10729683 ∗∗∗ IBM Security Bulletin: Cross-Site Scripting Vulnerability in IBM WebSphere Portal (CVE-2018-1716) ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10729323 ∗∗∗ IBM Security Bulletin: Multiple security vulnerabilities affect Liberty for Java for IBM Cloud ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10732916 ∗∗∗ IBM Security Bulletin: Open Source Libvorbis, Patch and Python-paramiko vulnerabilities affect IBM Netezza Host Management ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10729297 ∗∗∗ IBM Security Bulletin: Cross-Site Scripting Vulnerability in IBM WebSphere Portal (CVE-2018-1660) ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=ibm10715923 ∗∗∗ IBM Security Bulletin: Publicly disclosed vulnerability from BIND affect IBM Netezza Host Management ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ibm10729637 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 25.09.2018
by Daily end-of-shift report 25 Sep '18

25 Sep '18

===================== = End-of-Day report = ===================== Timeframe: Montag 24-09-2018 18:00 − Dienstag 25-09-2018 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Android Trojan reads Whatsapp-Messages ∗∗∗ --------------------------------------------- A spyware still in development can read users Whatsapp-Messages and other sensitive data. G DATA researchers analysed the Malware to protect our customers. --------------------------------------------- https://www.gdatasoftware.com/blog/2018/09/31122-android-trojan-reads-whats… ∗∗∗ OpenPGP/GnuPG: Signaturen fälschen mit HTML und Bildern ∗∗∗ --------------------------------------------- PGP-Signaturen sollen gewährleisten, dass eine E-Mail tatsächlich vom korrekten Absender kommt. Mit einem simplen Trick kann man bei vielen Mailclients scheinbar signierte Nachrichten erstellen - indem man die entsprechende Anzeige mittels HTML fälscht. (OpenPGP, E-Mail) --------------------------------------------- https://www.golem.de/news/openpgp-gnupg-signaturen-faelschen-mit-html-und-b… ∗∗∗ Analyzing Encoded Shellcode with scdbg, (Mon, Sep 24th) ∗∗∗ --------------------------------------------- Reader Jason analyzed a malicious RTF file: using OfficeMalScanner and xorsearch he was able to extract and find the entry point of the shellcode, but scdbg was not able to emulate the shellcode. --------------------------------------------- https://isc.sans.edu/diary/rss/24134 ===================== = Vulnerabilities = ===================== ∗∗∗ Multiple Vulnerabilities in Cisco Identity Services Engine ∗∗∗ --------------------------------------------- Cisco Identity Services Engine (ISE) contains the following vulnerabilities: Cisco ISE Authenticated Arbitrary Command Execution Vulnerability Cisco ISE Support Information Download Authentication Bypass Vulnerability These .. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… ∗∗∗ DSA-4305 strongswan - security update ∗∗∗ --------------------------------------------- https://www.debian.org/security/2018/dsa-4305 ∗∗∗ ZDI-18-1083: Apple Safari Array Concat Uninitialized Buffer Information Disclosure Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-18-1083/ ∗∗∗ ZDI-18-1082: Apple Safari Subframe Same-Origin Policy Bypass Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-18-1082/ ∗∗∗ ZDI-18-1081: Apple Safari performProxyCall Internal Object Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-18-1081/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 24.09.2018
by Daily end-of-shift report 24 Sep '18

24 Sep '18

===================== = End-of-Day report = ===================== Timeframe: Freitag 21-09-2018 18:00 − Montag 24-09-2018 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Malware Disguised as Job Offers Distributed on Freelance Sites ∗∗∗ --------------------------------------------- Attackers are using freelance job sites such as fiverr and Freelancer to distribute malware disguised as job offers. These job offers contain attachments that pretends to be the job brief, but are actually .. --------------------------------------------- https://www.bleepingcomputer.com/news/security/malware-disguised-as-job-off… ∗∗∗ Security: Curl bekommt eigenes Bug-Bounty-Programm ∗∗∗ --------------------------------------------- Das kleine Kommandozeilenwerkzeug Curl und dessen Bibliothek finden sich in nahezu allen vernetzten Geräten. Sicherheitsforscher erhalten künftig eine Bug-Bounty, also Geld für das Auffinden von Sicherheitslücken in der .. --------------------------------------------- https://www.golem.de/news/security-curl-bekommt-eigenes-bug-bounty-programm… ∗∗∗ Adwind Dodges AV via DDE ∗∗∗ --------------------------------------------- Cisco Talos, along with fellow cybersecurity firm ReversingLabs, recently discovered a .. --------------------------------------------- https://blog.talosintelligence.com/2018/09/adwind-dodgesav-dde.html ∗∗∗ Security - Android: Immer mehr Hersteller liefern Sicherheits-Updates ∗∗∗ --------------------------------------------- Mittlerweile 250 Modelle mit Patch Level aus den letzten 90 Tagen – Google zahlt 3 Millionen Dollar für Bug Bounties --------------------------------------------- https://derstandard.at/2000087981052/Android-Immer-mehr-Hersteller-liefern-… ===================== = Vulnerabilities = ===================== ∗∗∗ Cisco Video Surveillance Manager Appliance Default Password Vulnerability ∗∗∗ --------------------------------------------- A vulnerability in Cisco Video Surveillance Manager (VSM) Software running on certain Cisco Connected Safety and Security Unified Computing System (UCS) platforms could allow an unauthenticated, remote .. --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ DSA-4301 mediawiki - security update ∗∗∗ --------------------------------------------- https://www.debian.org/security/2018/dsa-4301 ∗∗∗ DSA-4302 openafs - security update ∗∗∗ --------------------------------------------- https://www.debian.org/security/2018/dsa-4302 ∗∗∗ ZDI-18-1079: Cisco WebEx Network Recording Player NMVC RtpConfig Stack-based Buffer Overflow Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-18-1079/ ∗∗∗ ZDI-18-1078: Cisco WebEx Network Recording Player NMVC RtpConfig Stack-based Buffer Overflow Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-18-1078/ ∗∗∗ Multiple vulnerabilities in Citrix StorageZones Controller ∗∗∗ --------------------------------------------- https://www.sec-consult.com/en/blog/advisories/multiple-vulnerabilities-cit… ∗∗∗ Security vulnerabilities fixed in Firefox ESR 60.2.1 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2018-23/ ∗∗∗ Security vulnerabilities fixed in Firefox 62.0.2 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2018-22/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily