Daily

daily@lists.cert.at

1 participants
3087 discussions

Tageszusammenfassung - 27.06.2018
by Daily end-of-shift report 27 Jun '18

27 Jun '18

===================== = End-of-Day report = ===================== Timeframe: Dienstag 26-06-2018 18:00 − Mittwoch 27-06-2018 18:00 Handler: Olaf Schwarz Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ NSA Exploit "DoublePulsar" Patched to Work on Windows IoT Systems ∗∗∗ --------------------------------------------- An infosec researcher who uses the online pseudonym of Capt. Meelo has modified an NSA hacking tool known as DoublePulsar to work on the Windows IoT operating system (formerly known as Windows Embedded). --------------------------------------------- https://www.bleepingcomputer.com/news/security/nsa-exploit-doublepulsar-pat… ∗∗∗ Codeausführung: Wordpress schließt Sicherheitslücke nicht ∗∗∗ --------------------------------------------- Eine Sicherheitslücke in Wordpress erlaubt angemeldeten Nutzern, die Installation zu übernehmen und Code auszuführen. Wordpress wusste von dem Problem seit November 2017, hat es aber bisher nicht gefixt. (Wordpress, PHP) --------------------------------------------- https://www.golem.de/news/codeausfuehrung-wordpress-schliesst-sicherheitslu… ∗∗∗ Datenleck bei FastBooking: Hacker klauen Daten von über 124.000 Hotelgästen ∗∗∗ --------------------------------------------- Hacker haben Daten vom Server eines Booking-Providers kopiert. Die Firma schweigt zum Ausmaß – eine Hotelkette warnte derweil fast 125.000 betroffene Gäste. --------------------------------------------- http://heise.de/-4093080 ∗∗∗ Top Tools for Security Analysts in 2018 ∗∗∗ --------------------------------------------- Last spring, after discussing the tools and tech used by our team, we published a list of 51 Tools for Security Analysts. The article was well-received, and the comments offered some great suggestions to top it all off. In the spirit of that list we’d like to offer our updated 2018 edition, featuring the Defiant [...] --------------------------------------------- https://www.wordfence.com/blog/2018/06/top-tools-for-security-analysts-in-2… ∗∗∗ Achtung vor Apple-ID Phishing-Versuch ∗∗∗ --------------------------------------------- InternetnutzerInnen erhalten vermehrt Nachrichten per E-Mail, in denen sie darüber informiert werden, dass angeblich ihre Apple-ID in China für einen Zugriff auf die iCloud verwendet wurde. Die EmpfängerInnen werden in weiterer Folge dazu aufgefordert einem Link zu folgen, sofern sie nicht selbst in China auf ihr Konto zugegriffen haben. Betroffene sollten der Aufforderung auf keinen Fall nachkommen, denn die Versender sind hinter ihren Daten her. --------------------------------------------- https://www.watchlist-internet.at/news/achtung-vor-apple-id-phishing-versuc… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (cantata and qutebrowser), Debian (imagemagick, php5, and redis), Fedora (cri-o and libgxps), Oracle (glibc, kernel, libvirt, samba, samba4, sssd and ding-libs, and zsh), Red Hat (ansible, dpdk, kernel, kernel-alt, kernel-rt, libvirt, pki-core, podman, qemu-kvm, and qemu-kvm-rhev), Scientific Linux (kernel, libvirt, pki-core, and qemu-kvm), SUSE (firefox, gcc43, and kernel), and Ubuntu (openssl). --------------------------------------------- https://lwn.net/Articles/758442/ ∗∗∗ TMM vulnerability CVE-2018-5528 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K27044729 ∗∗∗ SSL Forward Proxy vulnerability CVE-2018-5527 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K20134942 ∗∗∗ HPESBHF03844 rev.1 - HPE Integrated Lights-Out 4, 5 (iLO 4, 5), Remote Unauthorized Modification of Information ∗∗∗ --------------------------------------------- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_n… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 26.06.2018
by Daily end-of-shift report 26 Jun '18

26 Jun '18

===================== = End-of-Day report = ===================== Timeframe: Montag 25-06-2018 18:00 − Dienstag 26-06-2018 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ WPA3: Neuer WLAN-Verschlüsselungsstandard verabschiedet ∗∗∗ --------------------------------------------- Die Wi-Fi Alliance hat mit WPA3 einen neuen Verschlüsselungsstandard für drahtlose Netze vorgestellt. Darin werden einige Macken von früheren Standards ausgebessert, wie etwa Offline-Passwort-Angriffe unterbunden und Forward Secrecy eingeführt. --------------------------------------------- https://www.golem.de/news/wpa3-neuer-wlan-verschluesselungsstandard-verabsc… ∗∗∗ Sicherheit von Industrieanlagen: BSI veröffentlicht Snort-Regeln für SIS-Netzwerke ∗∗∗ --------------------------------------------- Zum besseren Schutz vor Cyber-Angriffen mit Schadsoftware wie "Triton/Trisis/HatMan" hat das Bundesamt für Sicherheit in der Informationstechnik (BSI) sogenannte Snort-Regeln für das TriStation-Kommunikationsprotokoll der Firma Schneider Electric veröffentlicht. --------------------------------------------- https://www.bsi.bund.de/DE/Presse/Pressemitteilungen/Presse2018/RAPSN_SETS_… ∗∗∗ Files Cannot Be Decrypted? Challenge Accepted. Talos Releases ThanatosDecryptor ∗∗∗ --------------------------------------------- This blog post was authored by Edmund Brumaghin, Earl Carter and Andrew Williams.Executive summaryCisco Talos has analyzed Thanatos, a ransomware variant that is being distributed via multiple malware campaigns that have been conducted over the past few months. As a result of our research, we have released a new, free decryption tool to help victims recover from this malware. --------------------------------------------- http://feedproxy.google.com/~r/feedburner/Talos/~3/_YSxzYWrMgs/ThanatosDecr… ===================== = Vulnerabilities = ===================== ∗∗∗ [20180602] - Core - XSS vulnerability in language switcher module ∗∗∗ --------------------------------------------- Severity: Low Versions: 1.6.0 through 3.8.8 Exploit type: XSS Number: CVE-2018-12711 In some cases the link of the current language might contain unescaped HTML special characters. This may lead to reflective XSS via injection of arbitrary parameters and/or values on the current page url. Affected Installs Joomla! CMS versions 1.6.0 through 3.8.8 Solution: Upgrade to version 3.8.9 --------------------------------------------- https://developer.joomla.org/security-centre/740-20180602-core-xss-vulnerab… ∗∗∗ [20180601] - Core - Local File Inclusion with PHP 5.3 ∗∗∗ --------------------------------------------- Severity: Low Versions: 2.5.0 through 3.8.8 Exploit type: LFI CVE Number: CVE-2018-12712 Our autoload code checks classnames to be valid, using the "class_exists" function in PHP. In PHP 5.3 this function validates invalid names as valid, which can result in a Local File Inclusion. Affected Installs: Joomla! CMS versions 2.5.0 through 3.8.8 Solution: Upgrade to version 3.8.9 --------------------------------------------- https://developer.joomla.org/security-centre/741-20180601-core-local-file-i… ∗∗∗ Bugtraq: KL-001-2018-008 : HPE VAN SDN Unauthenticated Remote Root Vulnerability ∗∗∗ --------------------------------------------- A hardcoded service token can be used to bypass authentication. Built-in functionality can be exploited to deploy and execute a malicious deb file containing a backdoor. A weak sudoers configuration can then be abused to escalate privileges to root. --------------------------------------------- http://www.securityfocus.com/archive/1/542101 ∗∗∗ SSA-159860 (Last Update: 2018-06-26): Access Control Vulnerability in IEC 61850 system configurator, DIGSI 5, DIGSI 4, SICAM PAS/PQS, SICAM PQ Analyzer, and SICAM SCC ∗∗∗ --------------------------------------------- IEC 61850 system configurator, DIGSI 5, DIGSI 4, SICAM PAS/PQS, SICAM PQ Analyzer, and SICAM SCC products are affected by a security vulnerability which could allow an attacker to either exfiltrate limited data from the system or to execute code with operating system user permissions.Siemens has released updates for several affected products, and recommends that customers update to the new version. --------------------------------------------- https://cert-portal.siemens.com/productcert/txt/ssa-159860.txt ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Slackware (firefox), SUSE (gpg2 and zlib), and Ubuntu (openssl, openssl1.0). --------------------------------------------- https://lwn.net/Articles/758310/ ∗∗∗ Security Advisory - Side-Channel Vulnerability Variants 3a and 4 ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2018/huawei-sa-20180615-… ∗∗∗ HPESBHF03843 rev.1 - HPE Moonshot Provisioning Manager, Remote Bypass of Security Restrictions, Local Arbitrary File Modification ∗∗∗ --------------------------------------------- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_n… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 25.06.2018
by Daily end-of-shift report 25 Jun '18

25 Jun '18

===================== = End-of-Day report = ===================== Timeframe: Freitag 22-06-2018 18:00 − Montag 25-06-2018 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Changes in WebAssembly Could Render Meltdown and Spectre Browser Patches Useless ∗∗∗ --------------------------------------------- "Once Wasm gets support for threads with shared memory (which is already on the Wasm roadmap), very accurate [JavaScript] timers can be created," Bergbom says, "that may render browser mitigations of certain CPU side channel attacks non-working." --------------------------------------------- https://www.bleepingcomputer.com/news/security/changes-in-webassembly-could… ∗∗∗ ST18-001: Securing Network Infrastructure Devices ∗∗∗ --------------------------------------------- Network infrastructure devices are ideal targets for malicious cyber actors. Most or all organizational and customer traffic must traverse these critical devices.An attacker with presence on an organization’s gateway router can monitor, modify, and deny traffic to and from the organization.An attacker with presence on an organization’s internal routing and switching infrastructure can monitor, modify, and deny traffic to and from key --------------------------------------------- https://www.us-cert.gov/ncas/tips/ST18-001 ∗∗∗ iOS: Verwirrung um Brute-Force-Hack der Gerätesperre ∗∗∗ --------------------------------------------- Ein Sicherheitsforscher behauptet, einen Trick gefunden zu haben, mit dem sich iPhone und iPad knacken lassen. Apple widerspricht dem. --------------------------------------------- http://heise.de/-4090901 ∗∗∗ Offene Firebase-Datenbanken: Tausende Apps leaken Passwörter, Nutzerdaten etc. ∗∗∗ --------------------------------------------- Dritte könnten mit vergleichsweise wenig Aufwand private Daten von Millionen App-Nutzern einsehen, warnen Sicherheitsforscher. --------------------------------------------- http://heise.de/-4090963 ∗∗∗ Leck in Intel-Prozessoren: TLBleed-Lücke verrät geheime Schlüssel ∗∗∗ --------------------------------------------- Forscher nutzen Hyper-Threading und den Transaction Lookaside Buffer (TLB) von Intel-Prozessoren, um geschützte Informationen per Seitenkanal abzuschöpfen. --------------------------------------------- http://heise.de/-4091114 ∗∗∗ Aufgepasst: Phishing-Mails schüren WannaCry-Panik ∗∗∗ --------------------------------------------- Aktuell gehen E-Mails um, die behaupten, der Rechner des Empfängers sei mit einem Verschlüsselungstrojaner infiziert. --------------------------------------------- http://heise.de/-4091746 ∗∗∗ Gefälschte Pichler Werkzeug GmbH-Rechnung verbreitet Schadsoftware ∗∗∗ --------------------------------------------- Unternehmen erhalten per E-Mail eine gefälschte Bestellbestätigung der Pichler Werkzeug GmbH aus Innsbruck. Darin heißt es, dass sie ein unterzeichnetes Formular zurück an die Absenderin retournieren sollen. Das Formular befindet sich angeblich in einer GZ-Datei. In Wahrheit verbirgt sie Schadsoftware. Empfänger/innen dürfen den Dateianhang nicht öffnen. --------------------------------------------- https://www.watchlist-internet.at/news/gefaelschte-pichler-werkzeug-gmbh-re… ===================== = Vulnerabilities = ===================== ∗∗∗ [20180507] - Core - Session deletion race condition ∗∗∗ --------------------------------------------- CVE Number: CVE-2018-11324 A long running background process, such as remote checks for core or extension updates, could create a race condition where a session which was expected to be destroyed would be recreated. Affected Installs: Joomla! CMS versions 3.0.0 through 3.8.7 Solution: Upgrade to version 3.8.8 --------------------------------------------- https://developer.joomla.org/security-centre/735-20180507-core-session-dele… ∗∗∗ Bluetooth-Lücke: Patch für "smartes" Vorhängeschloss Tapplock ∗∗∗ --------------------------------------------- Sicherheitsforscher knacken das Schloss Tapplock über Bluetooth in wenigen Sekunden. Auch rohe Gewalt kann das Schloss unter Umständen öffnen. --------------------------------------------- http://heise.de/-4091406 ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by CentOS (git), Debian (bouncycastle and lava-server), Fedora (ansible, epiphany, kernel, kernel-tools, matrix-synapse, mingw-podofo, pass, podofo, python-prometheus_client, redis, rubygem-sinatra, and thunderbird-enigmail), Gentoo (file and pnp4nagios), Mageia (file, glibc, kernel, librsvg, and libvorbis), openSUSE (go1.9, mariadb, phpMyAdmin, and redis), and SUSE (firefox, kernel modules packages, and python). --------------------------------------------- https://lwn.net/Articles/758211/ ∗∗∗ Synology-SA-18:33 DSM ∗∗∗ --------------------------------------------- Multiple vulnerabilities allow remote authenticated users to execute arbitrary OS commands or obtain sensitive information via a susceptible version of Synology Diskstation Manager (DSM). --------------------------------------------- https://www.synology.com/en-global/support/security/Synology_SA_18_33 ∗∗∗ FortiOS SSL VPN webportal user credentials present in plain text in client side javascript file ∗∗∗ --------------------------------------------- https://fortiguard.com/psirt/%20FG-IR-18-027 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 22.06.2018
by Daily end-of-shift report 22 Jun '18

22 Jun '18

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 21-06-2018 18:00 − Freitag 22-06-2018 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ New GZipDe Malware Drops Metasploit Backdoor ∗∗∗ --------------------------------------------- Security researchers from AlienVault have discovered a new malware strain named GZipDe that appears to be part of a targeted attack â€”most likely a cyber-espionage campaign. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-gzipde-malware-drops-met… ∗∗∗ FIRST Releases Training to Help Companies Respond to Product Vulnerabilities ∗∗∗ --------------------------------------------- The Forum of Incident Security Response Teams, Inc. (FIRST) is pleased to release the final Product Security Incident Response Teams (PSIRT) Services Framework (PDF) and accompanying training video course. This framework and training video course were developed by a global team of PSIRT practitioners from FIRST members and relevant subject matter experts. --------------------------------------------- https://www.first.org/newsroom/releases/20180621 ∗∗∗ Detecting Kernel Memory Disclosure – Whitepaper ∗∗∗ --------------------------------------------- Since early 2017, we have been working on Bochspwn Reloaded – a piece of dynamic binary instrumentation built on top of the Bochs IA-32 software emulator, designed to identify memory disclosure vulnerabilities in operating system kernels. Over the course of the project, we successfully used it to discover and report over 70 previously unknown security issues in Windows, and more than 10 bugs in Linux. --------------------------------------------- https://googleprojectzero.blogspot.com/2018/06/detecting-kernel-memory-disc… ∗∗∗ Financial Services Sector Rife with Hidden Tunnels ∗∗∗ --------------------------------------------- Attackers use the approach to look like legitimate traffic and hide data exfiltration in plain sight. --------------------------------------------- https://threatpost.com/financial-services-sector-rife-with-hidden-tunnels/1… ∗∗∗ Wie Sie eine Baby-Cam erfolgreich hacken (Gwelltimes P2P Cloud) ∗∗∗ --------------------------------------------- Vor einiger Zeit wurde in den USA ein Fall bekannt, bei dem ein W-LAN-fähiges Babyphone gehackt worden sei. Jemand hätte die Mutter und ihr Baby überwacht. SEC Consult hat sich den Fall nun aus der technischen Perspektive angesehen. --------------------------------------------- https://www.sec-consult.com/blog/2018/06/wie-sie-eine-babycam-erfolgreich-h… ∗∗∗ Documenting and Attacking a Windows Defender Application Control Feature the Hard Way - A Case Study in Security Research Methodology ∗∗∗ --------------------------------------------- As is typically the case for me, whenever a new Windows build is released, I diff the Windows Defender Application Control (WDAC, formerly Device Guard) code integrity policy schema (located in %windir%\schemas\CodeIntegrity\cipolicy.xsd) to see if there are any new, interesting features. I resort to doing this because new WDAC features are seldom documented [...] --------------------------------------------- https://posts.specterops.io/documenting-and-attacking-a-windows-defender-ap… ∗∗∗ Why You Should Care about Website Security on Your Small Site ∗∗∗ --------------------------------------------- Most people assume that if their website has been compromised, there must have been an attacker evaluating their site and looking for a specific vulnerability to hack. Under most circumstances however, bad actors don’t manually hand-pick websites to attack since it’s a tedious and time consuming process. Instead, they rely on automation to identify vulnerable websites and execute their attacks. --------------------------------------------- https://blog.sucuri.net/2018/06/why-you-should-care-about-website-security-… ===================== = Vulnerabilities = ===================== ∗∗∗ Delta Electronics Delta Industrial Automation COMMGR ∗∗∗ --------------------------------------------- This advisory includes mitigations for a stack-based buffer overflow vulnerability in the Delta Electronics Delta Industrial Automation COMMGR software. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-18-172-01 ∗∗∗ Rockwell Automation Allen-Bradley CompactLogix and Compact GuardLogix ∗∗∗ --------------------------------------------- This advisory includes mitigation recommendations for an improper input validation vulnerability reported in Rockwell Automation Allen-Bradley CompactLogix and Compact GuardLogix controllers. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-18-172-02 ∗∗∗ PMASA-2018-4 ∗∗∗ --------------------------------------------- File inclusion and remote code execution attackAffected VersionsphpMyAdmin 4.8.0 and 4.8.1 are affected.CVE ID(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12613, uCVE-2018-12613) --------------------------------------------- https://www.phpmyadmin.net/security/PMASA-2018-4/ ∗∗∗ PMASA-2018-3 ∗∗∗ --------------------------------------------- XSS in Designer featureAffected VersionsphpMyAdmin versions prior to 4.8.2.CVE ID(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12581, uCVE-2018-12581) --------------------------------------------- https://www.phpmyadmin.net/security/PMASA-2018-3/ ∗∗∗ Security Advisory - FRP Bypass Vulnerability in Some Huawei Smart Phones ∗∗∗ --------------------------------------------- There is Factory Reset Protection (FRP) bypass vulnerability in some Huawei smart phones. An attacker gets some users smart phone and performs some special operations in the guide function. The attacker may exploit the vulnerability to bypass FRP function and use the phone normally. (Vulnerability ID: HWPSIRT-2018-04051) --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180622-01-by… ∗∗∗ Security Advisory - Bluetooth Unlock Bypassing Vulnerability in Some Huawei Mobile Phones ∗∗∗ --------------------------------------------- Some Huawei mobile phones have a Bluetooth unlock bypassing vulnerability due to the lack of validation on Bluetooth devices. If a user has enabled the smart unlock function, an attacker can impersonate the users Bluetooth device to unlock the users mobile phone screen. (Vulnerability ID: HWPSIRT-2017-01088) --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170323-01-sm… ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (php-horde-image), openSUSE (kernel), Scientific Linux (git), SUSE (bluez, kernel, mariadb, and mariadb, mariadb-connector-c, xtrabackup), and Ubuntu (openjdk-7). --------------------------------------------- https://lwn.net/Articles/758024/ ∗∗∗ Lazy FP state restore vulnerability CVE-2018-3665 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K21344224 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 21.06.2018
by Daily end-of-shift report 21 Jun '18

21 Jun '18

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 20-06-2018 18:00 − Donnerstag 21-06-2018 18:00 Handler: Stephan Richter Co-Handler: Robert Waldner ===================== = News = ===================== ∗∗∗ Downloading 3rd Party OpenVPN Configs May Be Dangerous. Here’s Why. ∗∗∗ --------------------------------------------- If an actor wanted to cause the OpenVPN configuration file to execute a command they would add the "script-security 2" line, which allows user defined scripts to be executed, and a "up" entry, which contains the command that is executed after after a connection has been made. --------------------------------------------- https://www.bleepingcomputer.com/news/security/downloading-3rd-party-openvp… ∗∗∗ Beginner’s Guide to Pentesting IoT Architecture/Network and Setting Up IoT Pentesting Lab – Part 1 ∗∗∗ --------------------------------------------- In this post, I will explain how to pentest an IoT Network/Architecture. Also, I will explain how to set up an IoT Pentesting lab for getting started with IoT Pentesting. Since the post is too long, to make it digestible, it will be split into two parts. --------------------------------------------- https://resources.infosecinstitute.com/beginners-guide-to-pentesting-iot-ar… ∗∗∗ Google Developer Discovers a Critical Bug in Modern Web Browsers ∗∗∗ --------------------------------------------- Chrome and Safari already have a policy in place to reject such cross-origin requests as soon as they see any redirection after the underlying content appears to have changed between requests, their users are already protected. ... FireFox and Edge browsers that were found vulnerable to this issue have also patched the vulnerability in their latest versions after Archibald responsibly reported it to their security teams. Therefore, FireFox and Edge browser users are highly recommended to make sure that they are running the latest version of these browsers. --------------------------------------------- https://thehackernews.com/2018/06/browser-cross-origin-vulnerability.html ∗∗∗ Drupal Vulnerability (CVE-2018-7602) Exploited to Deliver Monero-Mining Malware ∗∗∗ --------------------------------------------- We were able to observe a series of network attacks exploiting CVE-2018-7602, a security flaw in the Drupal content management framework. For now, these attacks aim to turn affected systems into Monero-mining bots. Of note are its ways of hiding behind the Tor network to elude detection and how it checks the affected system first before infecting it with a cryptocurrency-mining malware. --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/0C5nXsg4wxQ/ ∗∗∗ Warnung vor gefälschter Finanzonline.at-Nachricht ∗∗∗ --------------------------------------------- Internet-Nutzer/innen erhalten eine gefälschte E-Mail des Finanzministeriums. Sie hat das Betreff „Ihre Steuerrückzahlung“. Darin heißt es, dass eine kürzlich erfolgte Steuerrückzahlung an Empfänger/innen fehlgeschlagen sei. Aus diesem Grund sollen sie auf einer unbekannten Website persönliche Bankdarten bekannt geben. Nutzer/innen übermitteln diese an Kriminelle und werden Opfer eines Datendiebstahls. --------------------------------------------- https://www.watchlist-internet.at/news/warnung-vor-gefaelschter-finanzonlin… ===================== = Vulnerabilities = ===================== ∗∗∗ NVIDIA TX1 Boot ROM Vulnerability ∗∗∗ --------------------------------------------- On April 24, 2018, researchers disclosed a vulnerability that takes advantage of a buffer overflow vulnerability in NVIDIA TX1 BootROM when Recovery Mode (RCM) is active. This vulnerability could allow an unprivileged, local attacker to bypass secure boot and execute unverified code on an affected system. The vulnerability has been identified by CVE-2018-6242. --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Nextcloud Server: Mehrere Schwachstellen ermöglichen u.a. das Umgehen von Sicherheitsvorkehrungen ∗∗∗ --------------------------------------------- er Hersteller stellt die Nextcloud Server Versionen 12.0.8 und 13.0.3 zur Behebung der Schwachstellen CVE-2018-3761 und CVE-2018-3762 zur Verfügung. Zur Behebung der Schwachstellen CVE-2018-3763 und CVE-2018-3764 stehen Sicherheitsupdates für die Apps 'Contacts' auf Version 2.1.2 und 'Calendar' auf Version 1.6.1 bzw. 1.5.8 zur Verfügung. --------------------------------------------- https://adv-archiv.dfn-cert.de/adv/2018-1204/ ∗∗∗ Security Advisory für Microsoft Exchange Server ∗∗∗ --------------------------------------------- Microsoft hat anlässlich des Quartals-Updates für Microsoft Exchange Server ein Security Advisory sowie Sicherheitsupdates für Elemente der "Outside In" Libraries von Oracle veröffentlicht, die in Microsoft Exchange Server enthalten sind. Durch diese Patches werden drei Schwachstellen geschlossen. --------------------------------------------- https://www.cert.at/warnings/all/20180620.html ∗∗∗ Sicherheitslücken (teils kritisch) in Cisco FXOS und NX-OS Software - Patches verfügbar ∗∗∗ --------------------------------------------- Cisco hat mehrere Security Advisories zu teils kritischen Sicherheitslücken in Cisco FXOS und Cisco NX-OS Software veröffentlicht. Fünf der Schwachstellen werden mit einem CVSS Base Score von 9.8 als kritisch eingestuft: [...] --------------------------------------------- https://www.cert.at/warnings/all/20180621.html ∗∗∗ Symantec Endpoint Protection Multiple Issues ∗∗∗ --------------------------------------------- Symantec has released a set of updates to address issues that were discovered in the Symantec Endpoint Protection product. --------------------------------------------- https://support.symantec.com/en_US/article.SYMSA1454.html ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by openSUSE (cobbler and matrix-synapse), Oracle (git), Red Hat (git), SUSE (java-1_7_1-ibm, nagios-nrpe, and ntp), and Ubuntu (AMD microcode). --------------------------------------------- https://lwn.net/Articles/757971/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 20.06.2018
by Daily end-of-shift report 20 Jun '18

20 Jun '18

===================== = End-of-Day report = ===================== Timeframe: Dienstag 19-06-2018 18:00 − Mittwoch 20-06-2018 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ ZeroFont Technique Lets Phishing Emails Bypass Office 365 Security Filters ∗∗∗ --------------------------------------------- Cyber-criminals are currently using a trick that allows them to bypass Microsofts security filters and deliver spam and phishing emails to Office 365 email accounts. --------------------------------------------- https://www.bleepingcomputer.com/news/security/zerofont-technique-lets-phis… ∗∗∗ Verschlüsselung: TLS 1.0 und 1.1 sollen "sterben, sterben, sterben" ∗∗∗ --------------------------------------------- Ein aktueller Entwurf der IETF sieht vor, dass die alten TLS-Versionen 1.0 und 1.1 künftig nicht mehr benutzt werden dürfen. Ein Fallback ist explizit nicht vorgesehen. (TLS, Verschlüsselung) --------------------------------------------- https://www.golem.de/news/verschluesselung-tls-1-0-und-1-1-sollen-sterben-s… ∗∗∗ Perverse Vulnerability from Interaction between 2-Factor Authentication and iOS AutoFill ∗∗∗ --------------------------------------------- Apple is rolling out an iOS security usability feature called Security code AutoFill. The basic idea is that the OS scans incoming SMS messages for security codes and suggests them in AutoFill, so that people can use them without having to memorize or type them.Sounds like a really good idea, but Andreas Gutmann points out an application where this could become a vulnerability: when authenticating transactions:Transaction authentication, as opposed to user authentication, is used to attest the [...] --------------------------------------------- https://www.schneier.com/blog/archives/2018/06/perverse_vulner.html ∗∗∗ Magento Credit Card Stealer Reinfector ∗∗∗ --------------------------------------------- In the past few months, we have frequently seen how attackers are infecting Magento installations to scrape confidential information such as credit cards, logins, and PayPal credentials. That is why we have reported on a credit card stealer reinfector of Magento websites in one of our recent Labs Notes. --------------------------------------------- https://blog.sucuri.net/2018/06/magento-credit-card-stealer-reinfector.html ∗∗∗ Malware Olympic Destroyer ist zurück und zielt auch auf Deutschland ∗∗∗ --------------------------------------------- Olympic Destroyer hat es auf europäische Einrichtungen zur chemischen und biologischen Gefahrenabwehr abgesehen, warnen Sicherheitsforscher. --------------------------------------------- http://heise.de/-4086654 ∗∗∗ Spectre-NG-Lücken: OpenBSD schaltet Hyper-Threading ab ∗∗∗ --------------------------------------------- Um das Risiko für Angriffe über Spectre-Lücken zu mindern, schaltet das Betriebssystem OpenBSD bei Intel-Prozessoren Multi-Threading jetzt standardmäßig ab. --------------------------------------------- http://heise.de/-4087035 ∗∗∗ Bawag P.S.K.-KundInnen dürfen keine angebliche Sicherheits-App installieren! ∗∗∗ --------------------------------------------- Kriminelle verfassen eine gefälschte Bawag P.S.K.-Nachricht und versenden diese massenhaft. In der Nachricht werden die EmpfängerInnen wegen einer vermeintlichen Einschränkung des Kontos dazu aufgefordert eine Sicherheits-App zu installieren, um ihr Konto wieder nutzen zu können. Achtung: Es handelt sich um Schadsoftware und einen Versuch an fremde Bankdaten zu gelangen. Wer die Applikation installiert gewährt den Kriminellen Zugriff auf das eigene Bankkonto. --------------------------------------------- https://www.watchlist-internet.at/news/bawag-psk-kundinnen-duerfen-keine-an… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (pass), Debian (xen), Fedora (chromium, cobbler, gnupg, kernel, LibRaw, mariadb, mingw-libtiff, nikto, and timidity++), Gentoo (chromium, curl, and transmission), Mageia (gnupg, gnupg2, librsvg, poppler, roundcubemail, and xdg-utils), Red Hat (ansible and glusterfs), Slackware (gnupg), SUSE (cobbler, dwr, java-1_8_0-ibm, kernel, microcode_ctl, pam-modules, salt, slf4j, and SMS3.1), and Ubuntu (libgcrypt11, libgcrypt11, libgcrypt20, and mozjs52). --------------------------------------------- https://lwn.net/Articles/757876/ ∗∗∗ QNAP QTS LDAP Server Command Injection Flaw Lets Remote Users Execute Arbitrary Commands on the Target System ∗∗∗ --------------------------------------------- http://www.securitytracker.com/id/1041141 ∗∗∗ Splunk REST Endpoint Lets Remote Users Obtain Potentially Sensitive Information on the Target System ∗∗∗ --------------------------------------------- http://www.securitytracker.com/id/1041148 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 19.06.2018
by Daily end-of-shift report 19 Jun '18

19 Jun '18

===================== = End-of-Day report = ===================== Timeframe: Montag 18-06-2018 18:00 − Dienstag 19-06-2018 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ 75% of Malware Uploaded on "No-Distribute" Scanners Is Unknown to Researchers ∗∗∗ --------------------------------------------- Three-quarters of malware samples uploaded to "no-distribute scanners" are never shared on "multiscanners" like VirusTotal, and hence, they remain unknown to security firms and researchers for longer periods of time. --------------------------------------------- https://www.bleepingcomputer.com/news/security/75-percent-of-malware-upload… ∗∗∗ Over 22,000 Container Orchestration Systems Connected to the Internet ∗∗∗ --------------------------------------------- The admin consoles of over 22,000 container orchestration and API management systems are currently exposed online, according to a report published on Monday by Lacework, a company specialized in cloud security. --------------------------------------------- https://www.bleepingcomputer.com/news/security/over-22-000-container-orches… ∗∗∗ FIRST releases 2017-2018 Annual Report ∗∗∗ --------------------------------------------- The Forum of Incident Response and Security Teams releases its second annual report, covering the scope of its activities from the 2017 conference in Puerto Rico, through its 2018 annual event in Kuala Lumpur. --------------------------------------------- https://www.first.org/newsroom/releases/20180619 ∗∗∗ macOS-Fehler macht verschlüsselte Bilder und Texte zugänglich ∗∗∗ --------------------------------------------- Ein Bug in der QuickLook-Schnellansicht speichert auch geschützte Dateien im Dateisystem, so Sicherheitsforscher. --------------------------------------------- http://heise.de/-4084698 ∗∗∗ Flightradar24 gehackt: Daten von 230.000 Nutzern abgezogen ∗∗∗ --------------------------------------------- Einige Mitglieder von Flightradar24 erhalten derzeit E-Mails mit Warnungen über einen Server-Einbruch. Die Betreiber haben Passwörter zurückgesetzt. --------------------------------------------- http://heise.de/-4084911 ∗∗∗ Warnung vor thermomix-outlet.com ∗∗∗ --------------------------------------------- Auf thermomix-outlet.com können Konsument/innen den Thermomix TM5 mit Cook-Key um 879,00 Euro kaufen. Die Bezahlung der Ware ist nur im Voraus möglich. Interessent/innen, die den Kaufpreis überweisen, verlieren ihr Geld an Kriminelle und werden Opfer eines Datendiebstahls. Von einem Einkauf auf thermomix-outlet.com ist daher dringend abzuraten! --------------------------------------------- https://www.watchlist-internet.at/news/warnung-vor-thermomix-outletcom/ ∗∗∗ Vermeintliche Geschäftsführung drängt zu Geldüberweisung ∗∗∗ --------------------------------------------- Verrechnungs- und Buchhaltungsabteilungen in Firmen sowie KassierInnen in Vereinen werden gezielt von Betrügern adressiert. Die E-Mails werden im Namen der Geschäftsführung der jeweiligen Firma bezehungsweise des jeweiligen Vereins verschickt. Darin werden die MitarbeiterInnen dazu aufgefordert hohe Geldbeträge ins Ausland zu überweisen. Wird die Überweisung durchgeführt, ist das Geld verloren. --------------------------------------------- https://www.watchlist-internet.at/news/vermeintliche-geschaeftsfuehrung-dra… ∗∗∗ Netzpolitik - Sicherheitsdefizit bei Chromecast und Google Home erlaubt exakte Ortung der Nutzer ∗∗∗ --------------------------------------------- Google verspricht Update – Forscher warnt generell vor falschem Vertrauen in das lokale Netzwerk --------------------------------------------- https://derstandard.at/2000081833170/Sicherheitsdefizit-bei-Chromecast-und-… ===================== = Vulnerabilities = ===================== ∗∗∗ ADV180010 | June 2018 Oracle Outside In Library Security Update ∗∗∗ --------------------------------------------- Microsoft Exchange Server contains some elements of the Oracle Outside In libraries. The June 19, 2018 releases of Microsoft Exchange Server contain fixes to the following vulnerabilities, [...] --------------------------------------------- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180010 ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (libgcrypt), Fedora (bouncycastle, nodejs, and perl-Archive-Tar), openSUSE (aubio), and Red Hat (chromium-browser, glibc, kernel, kernel-rt, libvirt, pcs, samba, samba4, sssd and ding-libs, and zsh). --------------------------------------------- https://lwn.net/Articles/757811/ ∗∗∗ IBM Security Bulletin: A vulnerability in IBM Java SDK affects IBM Spectrum Scale ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=ssg1S1012400 ∗∗∗ HPESBMU03837 rev.1 - HPE CentralView Fraud Risk Management - Multiple Remote Vulnerabilities ∗∗∗ --------------------------------------------- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_n… ∗∗∗ HPESBGN03853 rev.1 - HPE Network Function Virtuallization Director (NFVD), Remote Unauthorized Access to Sensitive Information ∗∗∗ --------------------------------------------- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_n… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 18.06.2018
by Daily end-of-shift report 18 Jun '18

18 Jun '18

===================== = End-of-Day report = ===================== Timeframe: Freitag 15-06-2018 18:00 − Montag 18-06-2018 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ macOS Breaks Your OpSec by Caching Data From Encrypted Hard Drives ∗∗∗ --------------------------------------------- Apples macOS surreptitiously creates and caches thumbnails for images and other file types stored on password-protected / encrypted containers (hard drives, partitions), according to Wojciech Reguła and Patrick Wardle, two macOS security experts. --------------------------------------------- https://www.bleepingcomputer.com/news/apple/macos-breaks-your-opsec-by-cach… ∗∗∗ Rootkit-Based Adware Wreaks Havoc Among Windows 10 Users in the US ∗∗∗ --------------------------------------------- Security researchers from Romania-based antivirus vendor Bitdefender have detailed the operations of an adware strain named Zacinlo that uses a rootkit component to gain persistence across OS reinstalls, a rootkit component thats even effective against Windows 10 installations. --------------------------------------------- https://www.bleepingcomputer.com/news/security/rootkit-based-adware-wreaks-… ∗∗∗ Vendor Patches Seven Vulnerabilities Across 392 Camera Models ∗∗∗ --------------------------------------------- Axis Communications AB, a Swedish manufacturer of network cameras for physical security and video surveillance, has patched seven security flaws across nearly 400 security camera models. --------------------------------------------- https://www.bleepingcomputer.com/news/security/vendor-patches-seven-vulnera… ∗∗∗ Betrügerische Pfändungstermine ignorieren ∗∗∗ --------------------------------------------- Kriminelle versenden gefälschte Inkassoschreiben und erklären den Empfänger/innen, dass sie ein Mahnverfahren erwirkt haben und ein Gerichtsvollzieher die vermeintlichen Schuldner/innen besuchen werde. Das könne einzig und allein eine Geldzahlung verhindern. Konsument/innen können die E-Mail ignorieren und müssen keine Geldzahlung leisten. --------------------------------------------- https://www.watchlist-internet.at/news/betruegerische-pfaendungstermine-ign… ===================== = Vulnerabilities = ===================== ∗∗∗ Xen Security Advisory CVE-2018-3665 / XSA-267 ∗∗∗ --------------------------------------------- Speculative register leakage from lazy FPU context switching --------------------------------------------- https://xenbits.xen.org/xsa/advisory-267.html ∗∗∗ MFSBGN03809 rev.1 - Universal CMDB, Deserialization Java Objects and CSRF ∗∗∗ --------------------------------------------- A potential vulnerability has been identified in UCMDB Browser. This vulnerability could be exploited to Deserialization & Cross-site Request forgery (CSRF). --------------------------------------------- https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM0… ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by CentOS (kernel), Debian (libgcrypt20, redis, and strongswan), Fedora (epiphany, freedink-dfarc, gnupg, LibRaw, nodejs-JSV, nodejs-uri-js, singularity, strongswan, and webkit2gtk3), Mageia (flash-player-plugin, freedink-dfarc, and imagemagick), openSUSE (enigmail, gpg2, java-1_7_0-openjdk, java-1_8_0-openjdk, poppler, postgresql96, python-python-gnupg, and samba), Oracle (kernel), SUSE (gpg2 and xen), and Ubuntu (gnupg and webkit2gtk). --------------------------------------------- https://lwn.net/Articles/757758/ ∗∗∗ BlackBerry powered by Android Security Bulletin – June 2018 ∗∗∗ --------------------------------------------- http://support.blackberry.com/kb/articleDetail?language=en_US&articleNumber… ∗∗∗ FFmpeg: Mehrere Schwachstellen ermöglichen verschiedene Denial-of-Service-Angriffe ∗∗∗ --------------------------------------------- https://adv-archiv.dfn-cert.de/adv/2018-1177/ ∗∗∗ IBM Security Bulletin: IBM Flex System FC3171 8Gb SAN Switch and SAN Pass-thru is affected by vulnerability in OpenSLP (CVE-2017-17833) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/home/docdisplay?lndocid=MIGR-5099813 ∗∗∗ IBM Security Bulletin: Vulnerabilities in OpenSSL Affect Sterling Connect:Direct for HP NonStop (CVE-2018-0739) ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg22016399 ∗∗∗ IBM Security Bulletin: Vulnerabilities in cURL affect IBM Flex System FC3171 8Gb SAN Switch and SAN Pass-thru (CVE-2017-8816 CVE-2017-8817 CVE-2017-8818) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/home/docdisplay?lndocid=migr-5099811 ∗∗∗ IBM Security Bulletin: Vulnerabilities in OpenSSL affect IBM Flex System FC3171 8Gb SAN Switch and SAN Pass-thru (CVE-2017-3737 CVE-2017-3738) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/home/docdisplay?lndocid=MIGR-5099812 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 15.06.2018
by Daily end-of-shift report 15 Jun '18

15 Jun '18

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 14-06-2018 18:00 − Freitag 15-06-2018 18:00 Handler: Alexander Riepl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Kaspersky Halts Europol and NoMoreRansom Project Coop After EU Parliament Vote ∗∗∗ --------------------------------------------- Kaspersky Lab announced it was temporarily halting its cooperation with Europol following the voting of a controversial motion in the European Parliament today. --------------------------------------------- https://www.bleepingcomputer.com/news/government/kaspersky-halts-europol-an… ∗∗∗ Decryptor Released for the Everbe Ransomware ∗∗∗ --------------------------------------------- A decryptor for the Everbe Ransomware was released by Michael Gillespie that allows victims to get their files back for free. It is not known how this ransomware is currently being distributed, but as long as victims have an unencrypted version of an encrypted file, they can use them to brute force the decryption key. --------------------------------------------- https://www.bleepingcomputer.com/news/security/decryptor-released-for-the-e… ∗∗∗ Mechanics Behind Ransomware-as-a-Service ∗∗∗ --------------------------------------------- Ransomware is an increasingly serious concern, and this problem is getting worse over time. Initially, this malware began to compromise fixed targets such as individuals, but now the focus has changed and became much broader — from individuals to organizations. --------------------------------------------- https://resources.infosecinstitute.com/mechanics-behind-ransomware-as-a-ser… ∗∗∗ Old Botnets never Die, and DDG REFUSE to Fade Away ∗∗∗ --------------------------------------------- DDG is a mining botnet that specializes in exploiting SSH, Redis database and OrientDB database servers. We first caught it on October 25, 2017, at that time, DDG used version number 2020 and 2021, and we noticed that the botnet has two internally reserved domain names that had not been [...] --------------------------------------------- http://blog.netlab.360.com/old-botnets-never-die-and-ddg-refuse-to-fade-awa… ∗∗∗ Spectre-NG: Harte Kritik von OpenBSD-Entwickler Theo de Raadt ∗∗∗ --------------------------------------------- Die Veröffentlichung des jüngsten Spectre-NG-Bugs wurde hektisch vorgezogen, nachdem Theo de Raadt die Informationspolitik von Intel kritisierte. --------------------------------------------- http://heise.de/-4078903 ∗∗∗ 5 Millionen Mal heruntergeladen: Bösartige Docker-Container schürfen Monero ∗∗∗ --------------------------------------------- Zehn Monate lang waren Docker-Images mit Hintertür über Docker Hub verfügbar, obwohl die Verantwortlichen längst über den Schadcode informiert waren. --------------------------------------------- http://heise.de/-4079414 ∗∗∗ Unintended Clipboard Paste Function in Windows 10 Leads to Information Leak in RS1 ∗∗∗ --------------------------------------------- The McAfee Labs Advanced Threat Research team has been investigating the Windows 10 platform. We have submitted several vulnerabilities already and have disclosed our research to Microsoft. Please refer to our vulnerability disclosure policy for further details or the post from earlier this week on Windows 10 Cortana vulnerabilities. --------------------------------------------- https://securingtomorrow.mcafee.com/mcafee-labs/unintended-clipboard-paste-… ∗∗∗ Fake Font Dropper ∗∗∗ --------------------------------------------- A website owner reached out to us to investigate a weird behavior on their site. It was randomly showing a popup window for a missing font and telling the visitors that they are unable to view the content of the site because their own computers are missing a required font by the website called "HoeflerText", [...] --------------------------------------------- http://labs.sucuri.net/?note=2018-06-14 ∗∗∗ Totally Pwning the Tapplock (the API way) ∗∗∗ --------------------------------------------- An awesome researcher contacted us on the back of our recent Tapplock pwnage. We had been looking at the local BLE unlock mechanism, however he focussed instead on the mobile app API. Vangelis Stykas (@evstykas) has found a way to unlock any lock, plus scrape users PII and home addresses. --------------------------------------------- https://www.pentestpartners.com/security-blog/totally-pwning-the-tapplock-t… ===================== = Vulnerabilities = ===================== ∗∗∗ Natus Xltek NeuroWorks ∗∗∗ --------------------------------------------- This medical device advisory includes mitigations for stack-based buffer overflow and out-of-bounds read vulnerabilities in the Natus Xltek NeuroWorks software. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSMA-18-165-01 ∗∗∗ Siemens SCALANCE X Switches, RUGGEDCOM WiMAX, RFID 181-EIP, and SIMATIC RF182C ∗∗∗ --------------------------------------------- This advisory includes mitigation recommendations for a permissions, privileges, and access controls vulnerability reported in Siemens SCALANCE X switches, RUGGEDCOM WiMAX, RFID 181-EIP, and SIMATIC RF182C. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-18-165-01 ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by CentOS (plexus-archiver), Fedora (chromium, kernel, and plexus-archiver), Mageia (firefox, gifsicle, jasper, leptonica, patch, perl-DBD-mysql, qt3, and scummvm), openSUSE (opencv), Oracle (kernel), Red Hat (kernel), Scientific Linux (kernel), SUSE (gpg2, nautilus, and postgresql96), and Ubuntu (gnupg2 and linux-raspi2). --------------------------------------------- https://lwn.net/Articles/757610/ ∗∗∗ Cisco IP Phone 7800 Series and 8800 Series Denial of Service Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ [R1] Nessus Agent 7.1.0 Fixes Multiple Third-party Vulnerabilities ∗∗∗ --------------------------------------------- http://www.tenable.com/security/tns-2018-09 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 14.06.2018
by Daily end-of-shift report 14 Jun '18

14 Jun '18

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 13-06-2018 18:00 − Donnerstag 14-06-2018 18:00 Handler: Alexander Riepl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ SigSpoof: Signaturen fälschen mit GnuPG ∗∗∗ --------------------------------------------- In bestimmten Situationen lässt sich die Signaturprüfung von GnuPG in den Plugins für Thunderbird und Apple Mail austricksen. Der Grund: Über ungefilterte Ausgaben lassen sich Statusmeldungen des Kommandozeilentools fälschen. Doch der Angriff funktioniert nur unter sehr speziellen Bedingungen. (GPG, E-Mail) --------------------------------------------- https://www.golem.de/news/sigspoof-signaturen-faelschen-mit-gnupg-1806-1349… ∗∗∗ Lazy FPU: Intels Floating Point Unit kann geheime Daten leaken ∗∗∗ --------------------------------------------- Register der Floating Point Unit in Core I und wohl auch von einigen Xeon-Prozessoren können Ergebnisse vertraulicher Berechnungen verraten. Dazu ist jedoch ein lokaler Angriff mit Malware erforderlich, außerdem ein veraltetes Betriebssystem. (Intel, Amazon) --------------------------------------------- https://www.golem.de/news/lazy-fpu-intels-floating-point-unit-kann-geheime-… ∗∗∗ Microsoft Reveals Which Bugs It Won’t Patch ∗∗∗ --------------------------------------------- A draft document lays out its criteria for addressing various flaws and notes the exceptions. --------------------------------------------- https://threatpost.com/microsoft-reveals-which-bugs-it-wont-patch/132817/ ∗∗∗ A Bunch of Compromized Wordpress Sites, (Wed, Jun 13th) ∗∗∗ --------------------------------------------- A few days ago, one of our readers contacted reported an incident affecting his website based on Wordpress. He performed quick checks by himself and found some pieces of evidence: [...] --------------------------------------------- https://isc.sans.edu/diary/rss/23764 ∗∗∗ Tapplock Smart locks found to be physically and digitally vulnerable ∗∗∗ --------------------------------------------- Tapplock Smart locks contain several physical and digital vulnerabilities, each of which could allow an attacker to crack the lock with some attacks taking as little as two seconds to execute. --------------------------------------------- https://www.scmagazine.com/tapplock-smart-locks-found-to-be-physically-and-… ∗∗∗ Malspam Campaigns Using IQY Attachments to Bypass AV Filters and Install RATs ∗∗∗ --------------------------------------------- Malspam campaigns, such as ones being distributed by Necurs, are utilizing a new attachment type that is doing a good job in bypassing antivirus and mail filters. These IQY attachments are called Excel Web Query files and when opened will attempt to pull data from external sources. --------------------------------------------- https://www.bleepingcomputer.com/news/security/malspam-campaigns-using-iqy-… ∗∗∗ Mac-Malware kann Sicherheits-Tools austricksen ∗∗∗ --------------------------------------------- Mit einer vermeintlichen Apple-Signatur ist es Schadsoftware möglich, bekannte Security-Tools zu umgehen. Das Problem besteht offenbar seit Jahren. --------------------------------------------- http://heise.de/-4077945 ∗∗∗ Ecos Secure Boot Stick: Forscher warnen vor Schwachstellen ∗∗∗ --------------------------------------------- Tests mit dem SBS-Stick 5.6.5 und der System-Management-Software 5.2.68 haben mehrere Angriffspunkte offenbart. Updates stehen bereit. --------------------------------------------- http://heise.de/-4078344 ∗∗∗ Schadcode per Git: Xcode-Update soll Schwachstelle beheben ∗∗∗ --------------------------------------------- Apple hat die Programmierumgebung aktualisiert, um Sicherheitslücken auszuräumen. Git-Nutzer sollten das Update zügig einspielen. --------------------------------------------- http://heise.de/-4078821 ∗∗∗ New CryptoMiner hijacks your Bitcoin transaction. Over 300,000 computers have been attacked. ∗∗∗ --------------------------------------------- Recently, 360 Security Center discovered a new type of actively spreading CryptoMiner, ClipboardWalletHijacker. The Trojan monitors clipboard activity to detect if it contains the account [...] --------------------------------------------- https://blog.360totalsecurity.com/en/new-cryptominer-hijacks-your-bitcoin-t… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (chromium and gnupg), Debian (spip), Fedora (pdns-recursor), Gentoo (adobe-flash, burp, quassel, and wget), openSUSE (bouncycastle and taglib), Oracle (kernel), SUSE (java-1_7_0-openjdk, java-1_8_0-openjdk, poppler, and samba), and Ubuntu (file, perl, and ruby1.9.1, ruby2.0, ruby2.3). --------------------------------------------- https://lwn.net/Articles/757531/ ∗∗∗ Custom Tokens - Critical - Arbitrary PHP code execution - SA-CONTRIB-2018-041 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2018-041 ∗∗∗ OpenSSL, Libgcrypt, LibreSSL: Zwei Schwachstellen ermöglichen u.a. einen Denial-of-Service-Angriff ∗∗∗ --------------------------------------------- https://adv-archiv.dfn-cert.de/adv/2018-1138/ https://www.openssl.org/news/secadv/20180612.txt ∗∗∗ Enigmail: Zwei Schwachstellen ermöglichen u.a. das Umgehen von Sicherheitsvorkehrungen ∗∗∗ --------------------------------------------- https://adv-archiv.dfn-cert.de/adv/2018-1155/ ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Algo Credit Manager ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22017118 ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM® SPSS Statistics Server ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22016900 ∗∗∗ IBM Security Bulletin: A privilege escalation vulnerability in nzhwinfo that affects IBM Netezza Platform Software clients. ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg22015701 ∗∗∗ IBM Security Bulletin: Vulnerability in IBM HTTP Server affects Netezza Performance Portal ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22016809 ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM® SDK, Java™ Technology Edition affect IBM Virtualization Engine TS7700 – October 2017, January 2018 and April 2018 ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=ssg1S1012379 ∗∗∗ IBM Security Bulletin: IBM WebSphere Cast Iron Solution is affected by Tomcat vulnerabilities ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22017032 ∗∗∗ SigSpoof: Spoofing signatures in GnuPG, Enigmail, GPGTools and python-gnupg (CVE-2018-12020) ∗∗∗ --------------------------------------------- https://neopg.io/blog/gpg-signature-spoof/ ∗∗∗ SigSpoof 2: More ways to spoof signatures in GnuPG (CVE-2018-12019) ∗∗∗ --------------------------------------------- https://neopg.io/blog/enigmail-signature-spoof/ ∗∗∗ SigSpoof 3: Breaking signature verification in pass (Simple Password Store) (CVE-2018-12356) ∗∗∗ --------------------------------------------- https://neopg.io/blog/pass-signature-spoof/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily