Daily

daily@lists.cert.at

1 participants
3190 discussions

Tageszusammenfassung - Donnerstag 3-03-2016
by Daily end-of-shift report 03 Mar '16

03 Mar '16

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 02-03-2016 18:00 − Donnerstag 03-03-2016 18:00 Handler: Stephan Richter Co-Handler: Alexander Riepl *** Cisco Unified Communications Domain Manager Cross-Site Scripting Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** LibreSSL Unaffected By DROWN *** --------------------------------------------- The OpenBSD people forked and heavily cleaned up OpenSSL to create LibreSSL due to dissatisfaction with the maintainance of OpenSSL, culminating in the heartbleed bug. The emphasis has been on cleaning up the code and improving security, which includes removing things such as SSL2 which has fundamental security flaws. As a result, LibreSSL is not .. --------------------------------------------- http://it.slashdot.org/story/16/03/02/1620221/libressl-unaffected-by-drown *** Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: March 2016 *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco Prime Infrastructure Log File Remote Code Execution Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Schneider Electric Building Operation Automation Server Vulnerability *** --------------------------------------------- This advisory contains mitigation details for a vulnerability in servers programmed with Schneider Electric's StruxureWare Building Operation software. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-16-061-01 *** Rockwell Automation Allen-Bradley CompactLogix Reflective Cross-Site Scripting Vulnerability *** --------------------------------------------- This advisory is a follow-up to the alert titled ICS-ALERT-15-225-01A Rockwell Automation 1766-L32 Series Vulnerability that was published August 13, 2015, on the NCCIC/ICS-CERT web site. This advisory contains mitigation details for a cross-site scripting vulnerability in Rockwell Automation's CompactLogix application. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-16-061-02 *** Windows Built-In PDF Reader Exposes Edge Browser To Hacking *** --------------------------------------------- Edge, Microsofts new browser, uses the WinRT PDF library to automatically embed and present PDF files while navigating the web. This is what Java does with applets, and Flash with SWF files -- it unintentionally allows a hacker to append malicious code to PDF files and trigger drive-by attacks, which exploit WinRT .. --------------------------------------------- http://news.slashdot.org/story/16/03/02/2210256/windows-built-in-pdf-reader… *** Open-Xchange Guard Access Control Flaw Lets Remote Authenticated Users Obtain Private Keys in Certain Cases *** --------------------------------------------- http://www.securitytracker.com/id/1035174 *** Google Analytics Counter - Moderately Critical - CSRF - SA-CONTRIB-2016-011 *** --------------------------------------------- The Google Analytics Counter module provides total pageview counts for each page on a website. In that it is similar to the core Statistics module counter, but it is much lighter and ultimately faster because it draws on .. --------------------------------------------- https://www.drupal.org/node/2679515 *** Register now for the International NCSC One Conference 2016 *** --------------------------------------------- Protecting Bits & Atoms is the theme for our international One Conference 2016. It is especially timely given the increasingly connected physical and digital worlds and how information and communication technologies (ICT) have ingrained themselves into the very fabric of our society. The ONE conference will take place on Tuesday April 5 and Wednesday April 6 at the World Forum in The Hague, The Netherlands. --------------------------------------------- https://www.ncsc.nl/english/current-topics/news/register-now-for-the-intern… *** Wie Betrüger Apple Pay missbrauchen können *** --------------------------------------------- Apple Pay ist praktisch und gilt als sicher. Doch das System lässt sich von Kriminellen missbrauchen, um digitale Kreditkartenkopien zu erstellen. --------------------------------------------- http://www.golem.de/news/security-wie-betrueger-apple-pay-missbrauchen-koen… *** Java Deserialization Attacks with Burp *** --------------------------------------------- This blog is about Java deserialization and the Java Serial Killer Burp extension. If you want to download the extension and skip past all of this, head to the Github page here. The recent Java deserialization attack that was discovered has provided a large window of opportunity for penetration testers to gain access to the underlying systems that Java applications communicate with. --------------------------------------------- https://blog.netspi.com/java-deserialization-attacks-burp/ *** Valve informiert Steam-Nutzer über Weihnachts-Datenpanne *** --------------------------------------------- Fast drei Monate nach der massiven Datenpanne informiert Valve nun die betroffenen Nutzer. Die hatten das Problem in der Zwischenzeit wahrscheinlich längst vergessen. --------------------------------------------- http://heise.de/-3127829

1 0

Tageszusammenfassung - Mittwoch 2-03-2016
by Daily end-of-shift report 02 Mar '16

02 Mar '16

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 01-03-2016 18:00 − Mittwoch 02-03-2016 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Threat Actors Behind "Shrouded Crossbow" Create BIFROSE for UNIX *** --------------------------------------------- We recently came across a variant of the BIFROSE malware that has been rewritten for UNIX and UNIX-like systems. This is the latest tool developed by attackers behind operation Shrouded Crossbow, which have produced other BIFROSE variants such as KIVARS and KIVARS x64. UNIX-based operating systems are widely used in servers, workstations, and even mobile devices. With a lot of highly confidential data found in these servers and devices, a UNIX version of BIFROSE can certainly be classified as a... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/m3eM40z3oI8/ *** Cachebleed-Angriff: CPU-Cache kann private Schlüssel verraten *** --------------------------------------------- Forschern ist es gelungen, RSA-Verschlüsselungsoperationen von OpenSSL mittels eines Cache-Timing-Angriffs zu belauschen und so den privaten Key zu knacken. Der Cachebleed-Angriff nutzt dabei Zugriffskonflikte auf den Cache-Speicher. --------------------------------------------- http://www.golem.de/news/cachebleed-angriff-cpu-cache-kann-private-schluess… *** Let's ride with TeslaCrypt *** --------------------------------------------- TeslaCrypt is a ransomware spread by e-mails or exploit kits. It encrypts your files and asks you to pay in order to retrieve the decryption key. The current version is 3.0. Many analysis are already available on the Internet. In this article we are focusing on two aspects of TeslaCrypt: - The attack vector - The web callback... --------------------------------------------- http://thisissecurity.net/2016/03/02/lets-ride-with-teslacrypt/ *** Security: Angebliche Locky-Warnung vom BKA ist ein Trojaner *** --------------------------------------------- Die Angst vor Locky wird jetzt offenbar von Kriminellen ausgenutzt. In einer angeblich vom Bundeskriminalamt stammenden Mail wird vor dem Kryptotrojaner gewarnt und ein Werkzeug zur Entfernung angeboten - das selbst Malware enthält. --------------------------------------------- http://www.golem.de/news/security-angebliche-locky-warnung-vom-bka-ist-ein-… *** $17 smartwatch sends something to random Chinese IP address *** --------------------------------------------- Samsung Gear 2 also has some problems, researcher says RSA bsides A cheap smart watch often peddled on eBay uses a pairing app for Android or iOS that contains a backdoor that quietly connects to an unknown Chinese IP address. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2016/03/02/chinese_bac… *** iPhone-Fingerabdruck lässt sich mit Plastilin austricksen *** --------------------------------------------- Ein Hersteller von Fingerabdrucksensoren zeigt, wie einfach Apples Touch-ID mit gefälschten Fingerabdrücken zu umgehen ist. --------------------------------------------- http://futurezone.at/produkte/iphone-fingerabdruck-laesst-sich-mit-plastili… *** Der DROWN Angriff auf SSL/TLS *** --------------------------------------------- Es ist wieder soweit: Es gibt einen Presserummel rund um eine neu entdeckte Schwachstelle in SSL/TLS. Es gibt einen Namen (DROWN = Decrypting RSA with Obsolete and Weakened eNcryption) und ein fancy Logo. Nachzulesen ist alles unter: [...] Wir haben uns das angesehen und beschlossen, dazu keine offizielle Warnung zu publizieren. Das Problem ist nicht so dringend und dramatisch, wie manche... --------------------------------------------- http://www.cert.at/services/blog/20160302151126-1688.html *** Django Bugs Let Remote Users Conduct Redirect and Cross-Site Scripting Attacks and Determine Valid Usernames *** --------------------------------------------- http://www.securitytracker.com/id/1035152 *** DFN-CERT-2016-0366: Perl: Mehrere Schwachstellen ermöglichen u.a. die Ausführung beliebigen Programmcodes mit Benutzerrechten *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2016-0366/ *** Intel Security - Security Bulletin: Protected resource access bypass vulnerability resolved in multiple McAfee endpoint products for Microsoft Windows *** --------------------------------------------- Multiple McAfee endpoint products include a private mechanism to access settings and files protected by self-protection rules. This mechanism is not sufficiently secure and may be misused to access registry keys and files that should be protected from tampering. --------------------------------------------- https://kc.mcafee.com/corporate/index?page=content&id=SB10151 *** Schneider Electric Building Operation Application Server Vulnerability *** --------------------------------------------- This advisory contains mitigation details for a vulnerability in servers programmed with Schneider Electric's StruxureWare Building Operation software. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-16-061-01 *** Rockwell Automation Allen-Bradley CompactLogix Reflective Cross-Site Scripiting *** --------------------------------------------- This advisory is a follow-up to the alert titled ICS-ALERT-15-225-01A Rockwell Automation 1766-L32 Series Vulnerability that was published August 13, 2015, on the NCCIC/ICS-CERT web site. This advisory contains mitigation details for a cross-site scripting vulnerability in Rockwell Automation's CompactLogix application. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-16-061-02 *** Cisco Security Advisories *** --------------------------------------------- *** Cisco NX-OS Software TCP Netstack Denial of Service Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco Nexus 3000 Series and 3500 Platform Switches Insecure Default Credentials Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco Web Security Appliance HTTPS Packet Processing Denial of Service Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco NX-OS Software SNMP Packet Denial of Service Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco FireSIGHT System Software Convert Timing Channel Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco FireSIGHT System Software Device Management UI Cross-Site Scripting Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: GNU C library (glibc) vulnerability affects IBM Security Privileged Identity Manager Virtual Appliance (CVE-2015-7547) *** http://www.ibm.com/support/docview.wss?uid=swg21978009 --------------------------------------------- *** IBM Security Bulletin: Lotus Protector for Mail affected by glibc, getaddrinfo stack-based buffer overflow (CVE-2015-7547) *** http://www.ibm.com/support/docview.wss?uid=swg21977368 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in MD5 Signature and Hash Algorithm affects IBM Marketing Platform, IBM Campaign, IBM Predictive Insight, IBM Contact Optimization, IBM Marketing Operations (CVE-2015-7575) *** http://www.ibm.com/support/docview.wss?uid=swg21976886 --------------------------------------------- *** IBM Security Bulletin: A vulnerability in the GSKit component of IBM Tivoli Storage Manager Fastback for Workstations (CVE-2016-0201) *** http://www.ibm.com/support/docview.wss?uid=swg21974685 --------------------------------------------- *** Security Bulletin: Vulnerabilities in OpenSSL and MD5 Signature and Hash Algorithm (CVE-2015-7575) affect IBM System Networking RackSwitch products. *** http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5099210 --------------------------------------------- *** Security Bulletin: Multiple vulnerabilities, including MD5 Signature and Hash Algorithm (CVE-2015-7575), affect IBM Flex System Networking Switches *** http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5099200 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in libpng affect IBM Cognos Metrics Manager (CVE-2015-8126, CVE-2015-8472, CVE-2015-8540) *** http://www.ibm.com/support/docview.wss?uid=swg21976924 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in MD5 Signature and Hash Algorithm affects IBM Client Application Access (CVE-2015-7575) *** http://www.ibm.com/support/docview.wss?uid=swg21977618 ---------------------------------------------

1 0

Tageszusammenfassung - Dienstag 1-03-2016
by Daily end-of-shift report 01 Mar '16

01 Mar '16

======================= = End-of-Shift report = ======================= Timeframe: Montag 29-02-2016 18:00 − Dienstag 01-03-2016 18:00 Handler: Stephan Richter Co-Handler: n/a *** Bleichenbacher-Angriff: Drown entschlüsselt mit uraltem SSL-Protokoll *** --------------------------------------------- Kein moderner Browser unterstützt das alte SSL-Protokoll Version 2. Trotzdem kann es zum Sicherheitsrisiko werden, solange Server es aus Kompatibilitätsgründen unterstützen. Es muss nicht einmal derselbe Server sein. --------------------------------------------- http://www.golem.de/news/bleichenbacher-angriff-drown-entschluesselt-mit-ur… *** The Definitive Guide on Win32 to NT Path Conversion *** --------------------------------------------- Posted by James Forshaw, path'ological reverse engineer. How the Win32 APIs process file paths on Windows NT is a tale filled with backwards compatibility hacks, weird behaviour, and beauty. Incorrect handling of Win32 paths can lead to security vulnerabilities. This blog post is to try and give a definitive* guide on the different types of paths supported by the OS. I'm going to try and avoid discussion of quirks in the underlying filesystem implementations (such as NTFS... --------------------------------------------- http://googleprojectzero.blogspot.com/2016/02/the-definitive-guide-on-win32… *** De-obfuscating malicious Vbscripts *** --------------------------------------------- With the returned popularity of visual basic as a first attack vector in mind, we took a look at de-obfuscating a few recent vbs files starting with a very easy one and progressing to a lot more complex script.Categories: Malware AnalysisTags: bankerclickerde-obfuscatedecryptdroppermalwareobfuscationPieter Arntztrojanvbsvbscriptworm(Read more...) --------------------------------------------- https://blog.malwarebytes.org/intelligence/2016/02/de-obfuscating-malicious… *** Look Into Locky *** --------------------------------------------- Some sources say that Locky is the latest ransomware created and released in the wild by Dridex gang. Our studies indicate that it is well prepared, which means that the threat actor/s behind it has invested for it.Categories: Malware AnalysisTags: Lockyransomware(Read more...) --------------------------------------------- https://blog.malwarebytes.org/intelligence/2016/03/look-into-locky/ *** OpenSSL Security Advisories *** --------------------------------------------- CVE-2016-0800 (OpenSSL advisory) [High severity] CVE-2016-0705 (OpenSSL advisory) [Low severity] CVE-2016-0798 (OpenSSL advisory) [Low severity] CVE-2016-0797 (OpenSSL advisory) [Low severity] CVE-2016-0799 (OpenSSL advisory) [Low severity] CVE-2016-0702 (OpenSSL advisory) [Low severity] CVE-2016-0703 (OpenSSL advisory) [High severity] CVE-2016-0704 (OpenSSL advisory) [Moderate severity] --------------------------------------------- https://openssl.org/news/vulnerabilities.html *** VU#938151: Forwarding Loop Attacks in Content Delivery Networks may result in denial of service *** --------------------------------------------- Vulnerability Note VU#938151 Forwarding Loop Attacks in Content Delivery Networks may result in denial of service Original Release date: 29 Feb 2016 | Last revised: 29 Feb 2016 Overview Content Delivery Networks (CDNs) may in some scenarios be manipulated into a forwarding loop, which consumes server resources and causes a denial of service (DoS) on the network. Description CWE-400: Uncontrolled Resource Consumption (Resource Exhaustion)Content Delivery Networks (CDNs) are used to improve... --------------------------------------------- http://www.kb.cert.org/vuls/id/938151 *** F5 Security Advisory: Multiple NTP vulnerabilities CVE-2015-8139 and CVE-2015-8140 *** --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/k/00/sol00329831.html?… *** Bugtraq: [security bulletin] HPSBUX03552 SSRT102983 rev.1 - HP-UX BIND running Named, Remote Denial of Service (DoS) *** --------------------------------------------- http://www.securityfocus.com/archive/1/537659 *** DFN-CERT-2016-0355: phpMyAdmin: Mehrere Schwachstellen ermöglichen u.a. das Umgehen von Sicherheitsvorkehrungen *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2016-0355/ *** Bugtraq: [SYSS-2016-009] Sophos UTM 525 Web Application Firewall - Cross-Site Scripting in *** --------------------------------------------- http://www.securityfocus.com/archive/1/537662 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: A vulnerability in the GSKit component of Tivoli Network Manager IP Edition (CVE-2016-0201) *** http://www.ibm.com/support/docview.wss?uid=swg21974785 --------------------------------------------- *** IBM Security Bulletin: Multiple Security Vulnerabilities in Apache Tomcat affect IBM RLKS Administration and Reporting Tool *** http://www.ibm.com/support/docview.wss?uid=swg21976103 --------------------------------------------- *** IBM Security Bulletin: GNU C library (glibc) vulnerability affects IBM Security Access Manager for Web (CVE-2015-7547) *** http://www.ibm.com/support/docview.wss?uid=swg21977374 --------------------------------------------- *** IBM Security Bulletin: GNU C library (glibc) vulnerability affects IBM Security Access Manager for Mobile (CVE-2015-7547) *** http://www.ibm.com/support/docview.wss?uid=swg21977372 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in IBM Java SDK affect IBM Tivoli Access Manager for e-business and IBM Security Access Manager for Web 7.0 software (CVE-2016-0603) *** http://www.ibm.com/support/docview.wss?uid=swg21978024 --------------------------------------------- *** IBM Security Bulletin: Cross-Site scripting vulnerability in IBM Business Process Manager document list control (CVE-2016-0227) *** http://www.ibm.com/support/docview.wss?uid=swg21978058 --------------------------------------------- *** IBM Security Bulletin: A vulnerability in IBM Java SDK affects IBM OS Images for Red Hat Linux Systems, AIX, and Windows. (CVE-2015-7575) *** http://www.ibm.com/support/docview.wss?uid=swg21977880 --------------------------------------------- *** IBM Security Bulletin:A vulnerability in IBM Java SDK affects IBM Image Construction and Composition Tool. (CVE-2015-7575) *** http://www.ibm.com/support/docview.wss?uid=swg21977647 --------------------------------------------- *** IBM Security Bulletin:A vulnerability in IBM Java SDK affects IBM Workload Deployer. (CVE-2015-7575) *** http://www.ibm.com/support/docview.wss?uid=swg21977646 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM SmartCloud Entry (CVE-2016-0475 CVE-2016-0448 CVE-2015-7575 CVE-2016-0466) *** http://www.ibm.com/support/docview.wss?uid=isg3T1023408 --------------------------------------------- *** Security Bulletin: Vulnerability in IBM Java SDK affects IBM System Networking Switch Center (CVE-2015-7575) *** http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5099203 --------------------------------------------- *** IBM Security Bulletin: A vulnerability in IBM Java SDK affects IBM PureApplication System. (CVE-2015-7575) *** http://www.ibm.com/support/docview.wss?uid=swg21978026 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Security Access Manager for Mobile *** http://www.ibm.com/support/docview.wss?uid=swg21976765 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Security Access Manager for Web and IBM Tivoli Access Manager for e-business *** http://www.ibm.com/support/docview.wss?uid=swg21976678 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affects Rational Software Architect, Software Architect for WebSphere Software & Rational Software Architect RealTime *** http://www.ibm.com/support/docview.wss?uid=swg21976894 --------------------------------------------- *** IBM Security Bulletin: A vulnerability in Apache ActiveMQ affects IBM Tivoli System Automation Application Manager (CVE-2015-5254) *** http://www.ibm.com/support/docview.wss?uid=swg21977546 ---------------------------------------------

1 0

Tageszusammenfassung - Montag 29-02-2016
by Daily end-of-shift report 29 Feb '16

29 Feb '16

======================= = End-of-Shift report = ======================= Timeframe: Freitag 26-02-2016 18:00 − Montag 29-02-2016 18:00 Handler: Stephan Richter Co-Handler: n/a *** Fixing the Internets routing security is urgent and requires collaboration *** --------------------------------------------- The Internet is fragile. Many of its protocols were designed at a time when the goal was rapid network expansion based on trust among operators. Today, the Internets open nature is what makes it so great for business, education and communication, but the absence of security mechanisms at its core is something that criminals are eager to exploit.In late January, traffic to many IP (Internet Protocol) addresses of the U.S. Marine Corps was temporarily diverted through an ISP in Venezuela. --------------------------------------------- http://www.cio.com/article/3038752/fixing-the-internets-routing-security-is… *** Angler Exploit Kit Learns New Tricks, Finds Home On Popular Website *** --------------------------------------------- Angler Exploit evaded detection through new technique that bypasses Firefox and Chrome security protection. --------------------------------------------- http://threatpost.com/angler-exploit-kit-learns-new-tricks-finds-home-on-po… *** HackingTeam Reborn; A Brief Analysis of an RCS Implant Installer *** --------------------------------------------- As Im generally quite occupied with my day job as Director of R&D at Synack, the weekend is when I finally have some free time to blog. This weekend I wasnt sure what Id write about until @osxreverser tweeted late Friday afternoon:... --------------------------------------------- https://objective-see.com/blog/blog_0x0D.html *** The rise of polymorphic malware *** --------------------------------------------- 97% of malware is unique to a specific endpoint, rendering signature-based security virtually useless. The data collected by Webroot throughout 2015 shows that today's threats are truly global and highly dynamic. Many attacks are staged, delivered, and terminated within a matter of hours, or even minutes, having harvested user credentials and other sensitive information. Countering these threats requires an innovative approach to attack detection that leverages advanced techniques and... --------------------------------------------- https://www.helpnetsecurity.com/2016/02/29/the-rise-of-polymorphic-malware/ *** ATMZombie: banking trojan in Israeli waters *** --------------------------------------------- On November 2015, Kaspersky Lab researchers identified ATMZombie, a banking Trojan that is considered to be the first malware to ever steal money from Israeli banks. The incident Israeli banks experienced had a very fascinating and innovative method of stealing the money. --------------------------------------------- http://securelist.com/blog/research/73866/atmzombie-banking-trojan-in-israe… *** Increasing the resilience of Europe's telecommunication infrastructures through Incident Reporting *** --------------------------------------------- A recent ENISA report analyses how mandatory incident reporting schemes have improved resilience and security in the EU telecoms sector. Experiences from this scheme can also serve as a model for the implementation of the forthcoming NIS Directive in other sectors. --------------------------------------------- https://www.enisa.europa.eu/media/press-releases/increasing-the-resilience-… *** Security: 85 Prozent der SSL-VPNs haben unsichere Konfigurationen *** --------------------------------------------- Zahlreiche SSL-VPNs sichern den Traffic der Nutzer nur unzureichend ab - das behauptet eine Sicherheitsfirma. Viele Anbieter würden nach wie vor SHA-1 oder MD5 verwenden. Außerdem seien rund 10 Prozent der Dienste für Heartbleed anfällig. --------------------------------------------- http://www.golem.de/news/security-85-prozent-der-ssl-vpns-haben-unsichere-k… *** Klickbetrug: Trojaner-Familie infiltriert immer wieder Google Play *** --------------------------------------------- Android-Nutzer müssen sich derzeit vor kostenlosen Apps in Acht nehmen, die sich als beliebte Spiele ausgeben. Dahinter verbergen sich Klickbetrugs-Apps, mit denen Gauner Kasse machen. --------------------------------------------- http://heise.de/-3120091 *** Cyber-Attack Against Ukrainian Critical Infrastructure *** --------------------------------------------- On December 23, 2015, Ukrainian power companies experienced unscheduled power outages impacting a large number of customers in Ukraine. This report provides an account of the events that took place based on interviews with company personnel. --------------------------------------------- https://ics-cert.us-cert.gov/alerts/IR-ALERT-H-16-056-01 *** OpenSSL CVE-2016-0799: heap corruption via BIO_printf *** --------------------------------------------- There are a couple of issues with OpenSSL's BIO_*printf() functions, defined in crypto/bio/b_print.c, that are set to be fixed in the forthcoming security release. The function that is primarily responsible for interpreting the format string and transforming this string and the functions arguments to a string is _dopr(). --------------------------------------------- https://guidovranken.wordpress.com/2016/02/27/openssl-cve-2016-0799-heap-co… *** VU#419128: IKE/IKEv2 protocol implementations may allow network amplification attacks *** --------------------------------------------- Vulnerability Note VU#419128 IKE/IKEv2 protocol implementations may allow network amplification attacks Original Release date: 29 Feb 2016 | Last revised: 29 Feb 2016 Overview Implementations of the IKEv2 protocol are vulnerable to network amplification attacks. Description CWE-406: Insufficient Control of Network Message Volume (Network Amplification)IKE/IKEv2 and other UDP-based protocols can be used to amplify denial-of-service attacks. In some scenarios, an amplification of up to 900%... --------------------------------------------- http://www.kb.cert.org/vuls/id/419128 *** F5 Security Advisory: libpng out-of-bounds read vulnerability CVE-2015-7981 *** --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/k/21/sol21057235.html?… *** APPLE-SA-2016-02-25-1 Apple TV 7.2.1 *** --------------------------------------------- APPLE-SA-2016-02-25-1 Apple TV 7.2.1Apple TV 7.2.1 is now available and addresses the following:bootpAvailable for: Apple TV (3rd Generation)Impact: A malicious Wi-Fi network may be able to determine networksa device has previously accessedDescription: Upon connecting to a Wi-Fi network, iOS may havebroadcast MAC addresses of previously accessed networks via the DNAv4protocol. This issue was addressed through disabling DNAv4 onunencrypted Wi-Fi networks.CVE-IDCVE-2015-3778 : Piers... --------------------------------------------- http://prod.lists.apple.com/archives/security-announce/2016/Feb/msg00000.ht… *** Access Governance Suite 6.0-6.4 *** --------------------------------------------- Abstract: README for HTML Fragment Privilege Escalation Vulnerability E-Fix E-Fix Deliverable: AGS-SV-eFix022416.zipDocument ID: 5236850Security Alert: YesDistribution Type: PublicEntitlement Required: NoFiles:AGS-SV-eFix022416.zip (3.83 kB)AGS-SV-eFix022416-CHECKSUM.txt (99 bytes)Products:Access Governance 6.4Access Governance 6.1Access Governance 6.2Access Governance 6.3Superceded Patches: None --------------------------------------------- https://download.novell.com/Download?buildid=Tft9udlb11s~ *** D-Link / Netgear FIRMADYNE Command Injection / Buffer Overflow *** --------------------------------------------- Topic: D-Link / Netgear FIRMADYNE Command Injection / Buffer Overflow Risk: High Text:Hello, We’d like to report several vulnerabilities in embedded devices developed by D-Link and Netgear, which were discove... --------------------------------------------- https://cxsecurity.com/issue/WLB-2016020224 *** Bugtraq: [security bulletin] HPSBGN03549 rev.1 - HP IceWall Products using glibc, Remote Denial of Service (DoS), Arbitrary Code Execution *** --------------------------------------------- http://www.securityfocus.com/archive/1/537637 *** Cisco Videoscape Distribution Suite for Internet Streaming TCP Session Handling Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Citrix Security Advisory for glibc Vulnerability CVE-2015-7547 *** --------------------------------------------- A vulnerability has been recently disclosed in the glibc getaddrinfo() function. This issue could potentially allow an attacker to inject code into a process that calls the vulnerable function. The issue has been assigned the following CVE identifier:... --------------------------------------------- https://support.citrix.com/article/CTX206991 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Vulnerability in IBM Java Runtime affects IBM WebSphere MQ Internet Pass-Thru (CVE-2015-7575) *** 2016-02-26T13:23:47-05:00 http://www.ibm.com/support/docview.wss?uid=swg21977517 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in IBM Java SDK affects Rational Functional Tester (CVE-2015-7575) *** http://www.ibm.com/support/docview.wss?uid=swg21976947 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM InfoSphere BigInsights (Applicable CVEs: CVE-2015-7575, CVE-2016-0448, CVE-2016-0466, CVE-2016-0475) *** http://www.ibm.com/support/docview.wss?uid=swg21976080 --------------------------------------------- *** IBM Security Bulletin: IBM Maximo Asset Management is vulnerable to cross-site scripting, caused by improper validation of user-supplied input (CVE-2016-0262) *** http://www.ibm.com/support/docview.wss?uid=swg21977828 --------------------------------------------- *** IBM Security Bulletin: Current releases of the IBM SDK, Java Technology Edition are affected by CVE-2016-0603 *** http://www.ibm.com/support/docview.wss?uid=swg21977549 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in Apache Cordova affects IBM MobileFirst Platform Foundation (CVE-2015-8320) *** http://www.ibm.com/support/docview.wss?uid=swg2C1000091 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect WebSphere DataPower XC10 Appliance (CVE-2016-0475, CVE-2015-7575, CVE-2016-0448) *** http://www.ibm.com/support/docview.wss?uid=swg21976366 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect WebSphere eXtreme Scale (CVE-2016-0475, CVE-2015-7575, CVE-2016-0448) *** http://www.ibm.com/support/docview.wss?uid=swg21976442 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in IBM Java Runtime Version 6 affects IBM Cognos Business Viewpoint (CVE-2015-7575 ) *** http://www.ibm.com/support/docview.wss?uid=swg21977407 --------------------------------------------- *** IBM Security Bulletin: IBM Maximo Asset Management could allow an authenticated user to view work logs during purchase orders that they should not have access to (CVE-2016-0222) *** http://www.ibm.com/support/docview.wss?uid=swg21976949 --------------------------------------------- *** Security Bulletin: Vulnerabilities in OpenSSL affect IBM BladeCenter Switches (CVE-2015-3194, CVE-2015-3195) *** http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5099199 --------------------------------------------- *** IBM Security Bulletin: Insecure Transmission Vulnerability with IBM InfoSphere Information Server (CVE-2015-7490) *** http://www.ibm.com/support/docview.wss?uid=swg21975827 --------------------------------------------- *** IBM Security Bulletin: libpng related security vulnerabilities identified in IBM Expeditor (CVE-2015-7981, CVE-2015-8126, CVE-2015-8540, CVE-2015-8472) *** http://www.ibm.com/support/docview.wss?uid=swg21975904 --------------------------------------------- *** IBM Security Bulletin: Sensitive data lingers in memory on the WebSphere DataPower XC10 Appliance *** http://www.ibm.com/support/docview.wss?uid=swg21971658 --------------------------------------------- *** IBM Security Bulletin: Sensitive data lingers in memory on the WebSphere eXtreme Scale server *** http://www.ibm.com/support/docview.wss?uid=swg21971657 --------------------------------------------- *** IBM Security Bulletin: IBM PowerVC is impacted by OpenStack Glance denial of service vulnerability (CVE-2015-5286) *** http://www.ibm.com/support/docview.wss?uid=nas8N1021122 --------------------------------------------- *** IBM Security Bulletin: IBM PowerVC is impacted by OpenStack Glance security vulnerability (CVE-2015-5251) *** http://www.ibm.com/support/docview.wss?uid=nas8N1021121 --------------------------------------------- *** IBM Security Bulletin: IBM PowerVC is impacted by OpenStack Nova denial of service vulnerability (CVE-2015-3280) *** http://www.ibm.com/support/docview.wss?uid=nas8N1021120 ---------------------------------------------

1 0

Tageszusammenfassung - Freitag 26-02-2016
by Daily end-of-shift report 26 Feb '16

26 Feb '16

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 25-02-2016 18:00 − Freitag 26-02-2016 18:00 Handler: Robert Waldner Co-Handler: n/a *** VU#444472: QNAP Signage Station and iArtist Lite contain multiple vulnerabilities *** --------------------------------------------- CVE-2015-6022An authenticated attacker without administrative permissions may upload a malicious file, such as a PHP script, --------------------------------------------- http://www.kb.cert.org/vuls/id/444472 *** DSA-3492 gajim - security update *** --------------------------------------------- Daniel Gultsch discovered a vulnerability in Gajim, an XMPP/jabberclient. Gajim didnt verify the origin of roster update, allowing anattacker to spoof them and potentially allowing her to intercept messages. --------------------------------------------- https://www.debian.org/security/2016/dsa-3492 *** Open Web Analytics 1.5.7 Cross Site Scripting *** --------------------------------------------- Open Web Analytics suffers from a Cross-Site Scripting vulnerability in the owa_site_id parameter because it fails to sanitize input before rendering the content to the user. The vulnerability can be triggered by hitting the ALT+SHIFT+X key after the payload is injected. --------------------------------------------- https://cxsecurity.com/issue/WLB-2016020217 *** Bugtraq: Zimbra Cross-Site Scripting vulnerabilities *** --------------------------------------------- Recently Zimbra Collaboration 8.6 Patch 5 was released. It fixed two Cross-Site Scripting vulnerabilities discovered by Fortinet's FortiGuard Labs. --------------------------------------------- http://www.securityfocus.com/archive/1/537627 *** Sicherheitsupdate für ältere Apple-TV-Geräte *** --------------------------------------------- Apple hat am Donnerstagabend das Betriebssystem älterer Multimediaboxen aktualisiert. Das Update bringt zahlreiche Security-Fixes. --------------------------------------------- http://heise.de/-3118206 *** Quick Audit of *NIX Systems, (Fri, Feb 26th) *** --------------------------------------------- If you think that only computers running Microsoft Windows are targeted by attackers, youre wrong! UNIX (used here as a generic term, not focusing on a specific distribution or brand) is a key operating system on the Internet. Many websites and other public services are relying on it (Netcraftis compiling interesting stats on this topic). Therefore it is mandatory to keep an eye on your servers by using proactive and reactive controls. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20771&rss *** Apache Xerces-C Buffer Overflow Lets Remote Users Deny Service or Potentially Execute Arbitrary Code *** --------------------------------------------- A vulnerability was reported in Apache Xerces-C. A remote user can execute arbitrary code on the target system. A remote user can send specially crafted documents to trigger a buffer overflow in the XML parser library and cause the target application to crash or potentially execute arbitrary code on the target system. --------------------------------------------- http://www.securitytracker.com/id/1035113 *** Krypto-Trojaner Locky: Batch-Dateien infizieren Windows, Tool verspricht Schutz *** --------------------------------------------- Batch-Dateien sind der neueste Schrei, wenn es darum geht, den Krypto-Trojaner Locky am Virenscanner vorbei zu schleusen - und der Plan geht auf. Auf der Suche nach Schutzmaßnahmen haben wir ein Tool ausprobiert, das Locky und Co. stoppen soll. --------------------------------------------- http://heise.de/-3118188 *** Infor CRM 8.2.0.1136 Multiple HTML Script Injection Vulnerabilities *** --------------------------------------------- Infor CRM suffers from multiple stored cross-site scripting vulnerabilities. Input passed to several POST/PUT parameters in JSON format is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. --------------------------------------------- https://cxsecurity.com/issue/WLB-2016020219 *** Serialization Must Die: Act 2: XStream (Jenkins CVE-2016-0792) *** --------------------------------------------- The following new pre-authentication exploit against Jenkins (CVE-2016-0792) works because Groovy is on the classpath. There are probably a million other apps that use XStream and have Groovy on the classpath. I put almost no effort into trying to find this vulnerable pattern in other open source applications -- this Jenkins CVE is just one of many. --------------------------------------------- https://www.contrastsecurity.com/security-influencers/serialization-must-di… *** IKE/IKEv2: Ripe for DDoS Abuse *** --------------------------------------------- This is my latest research into preemptive DDoS trends. This time I looked into IKEv2 and what potential it has in regards to DDoS abuse use cases and amplification measurements. The short answer is, it could be easily weaponized for DDoS campaigns. --------------------------------------------- https://www.reddit.com/r/netsec/comments/47l3zv/ikeikev2_ripe_for_ddos_abus… *** IBM Security Bulletins*** --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect IBM Spectrum Control (formerly Tivoli Storage Productivity Center) CVE-2015-3193, CVE-2015-3194, CVE-2015-3195, CVE-2015-3196, CVE-2015-1794 *** http://www.ibm.com/support/docview.wss?uid=swg21977355 --------------------------------------------- *** IBM Security Bulletin: Multiple Vulnerabilities in IBM Java Runtime affects IBM Control Center (CVE-2015-4872, CVE-2015-7575) *** http://www.ibm.com/support/docview.wss?uid=swg21977686 --------------------------------------------- *** IBM Security Bulletin: IBM PowerVC is impacted by OpenStack Glance information disclosure vulnerability (CVE-2015-5163) *** http://www.ibm.com/support/docview.wss?uid=nas8N1021118 --------------------------------------------- *** Security Bulletin: Vulnerabilities in glibc affect IBM Integrated Management Module II (IMM2) for System x, BladeCenter and Flex Systems (CVE-2015-1472, CVE-2013-7423, CVE-2014-7817, CVE-2014-9402) *** http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5099198 --------------------------------------------- *** IBM Security Bulletin: GNU C library (glibc) vulnerability affects IBM QRadar SIEM and Incident Forensics (CVE-2015-7547) *** http://www.ibm.com/support/docview.wss?uid=swg21977665 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in IBM SDK Java Technology Edition affects IBM Development Package for Apache Spark (CVE-2015-7575) *** http://www.ibm.com/support/docview.wss?uid=swg21977538 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in IBM Java SDK affects IBM B2B Advanced Communications (CVE-2015-7575) *** http://www.ibm.com/support/docview.wss?uid=swg21976813 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in IBM Java SDK affects IBM QRadar SIEM and Incident Forensics. (CVE-2015-7575) *** http://www.ibm.com/support/docview.wss?uid=swg21977664 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in IBM Java Runtime affect Watson Explorer, Watson Content Analytics, and OmniFind Enterprise Edition (CVE-2015-7575, CVE-2015-4872) *** http://www.ibm.com/support/docview.wss?uid=swg21976276 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in MD5 Signature and Hash Algorithm affects IBM Control Center (CVE-2015-7575) *** http://www.ibm.com/support/docview.wss?uid=swg21977575 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Initiate Master Data Service (CVE-2015-4872, CVE-2016-0466, CVE-2015-7575, CVE-2016-0448) *** http://www.ibm.com/support/docview.wss?uid=swg21976545 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Security AppScan Enterprise (CVE-2016-0466, CVE-2015-7575) *** http://www.ibm.com/support/docview.wss?uid=swg21976553 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in IBM Java Runtime affect Rational Policy Tester (CVE-2015-7575) *** http://www.ibm.com/support/docview.wss?uid=swg21976733 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in IBM Java SDK affect IBM Spectrum Scale RAID/IBM GPFS Native RAID (CVE-2015-7575) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005673 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in IBM Java SDK affect IBM Spectrum Scale RAID/IBM GPFS Native RAID (CVE-2015-7575) *** http://www.ibm.com/support/docview.wss?uid=isg3T1023364 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect Tivoli Endpoint Manager for Remote Control. *** http://www.ibm.com/support/docview.wss?uid=swg21976855 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Rational Business Developer (CVE-2015-7575, CVE-2016-0466) *** http://www.ibm.com/support/docview.wss?uid=swg21976768 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Rational Developer for i, Rational Developer for AIX and Linux, Rational Developer for Power Systems Software *** http://www.ibm.com/support/docview.wss?uid=swg21976840 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect WebSphere Cast Iron (CVE-2015-7575, CVE-2016-0448) *** http://www.ibm.com/support/docview.wss?uid=swg21977301 --------------------------------------------- *** IBM Security Bulletin: A security vulnerability has been identified in IBM Business Process Manager and IBM HTTP Server shipped with IBM Cloud Orchestrator (CVE-2015-1932, CVE-2015-4938) *** http://www.ibm.com/support/docview.wss?uid=swg2C1000043 ---------------------------------------------

1 0

Tageszusammenfassung - Donnerstag 25-02-2016
by Daily end-of-shift report 25 Feb '16

25 Feb '16

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 24-02-2016 18:00 − Donnerstag 25-02-2016 18:00 Handler: Robert Waldner Co-Handler: n/a *** Neue Virenwelle: Krypto-Trojaner Locky tarnt sich als Fax *** --------------------------------------------- Der gefährliche Erpressungs-Trojaner wird seit kurzem über Mails verbreitet, die vorgeben, dass der Empfänger ein Fax erhalten hat. Die Virenscanner können mit der aktuellen Locky-Fassung noch nicht viel anfangen. --------------------------------------------- http://heise.de/-3117249 *** Eavesdropping by the Foscam Security Camera *** --------------------------------------------- Brian Krebs has a really weird story about the build-in eavesdropping by the Chinese-made Foscam security camera: Imagine buying an internet-enabled surveillance camera, network attached storage device, or home automation gizmo, only to find that it secretly and constantly phones home to a vast peer-to-peer (P2P) network run by the Chinese manufacturer of the hardware. --------------------------------------------- https://www.schneier.com/blog/archives/2016/02/eavesdropping_b_1.html *** Behind the Malware - Botnet Analysis *** --------------------------------------------- While analyzing our website firewall logs we discovered an old vulnerability in the RevSlider plugin being retargeted. RevSlider, the plugin whose vulnerability led to massive website compromises in 2015, was being leveraged again in an attempt to infect websites over a year since its initial disclosure. The original hack required sending an AJAX request containing the action revslider_ajax_action to ... --------------------------------------------- https://blog.sucuri.net/2016/02/behind-the-malware-botnet-analysis.html *** Cisco FirePOWER Management Center Unauthenticated Information Disclosure Vulnerability *** --------------------------------------------- A vulnerability in the Cisco FirePOWER Management Center could allow an unauthenticated, remote attacker to obtain information about the Cisco FirePOWER Management Center software version from the device login page. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Drupal Core - Critical - Multiple Vulnerabilities - SA-CORE-2016-001 *** --------------------------------------------- Advisory ID: SA-CORE-2016-001 Project: Drupal core Version: 6.x, 7.x, 8.x Date: 2016-February-24 Security risk: 15/25 ( Critical) AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All Vulnerability: Multiple vulnerabilities --------------------------------------------- https://www.drupal.org/SA-CORE-2016-001 *** OpenSSL kündigt Patches für Sicherheitslücken an *** --------------------------------------------- Administratoren, auf dessen Servern die beliebte Kryptobibliothek für SSL/TLS-Verbindungen zum Einsatz kommt, müssen am Dienstag wieder mal patchen. --------------------------------------------- http://heise.de/-3117855 *** Critical Vulnerabilities in Palo Alto Networks PAN-OS , (Thu, Feb 25th) *** --------------------------------------------- Yesterday, Palo Alto Networks released an update to PAN-OS, which addresses five different vulnerabilities [1]. The security researcher who identified the vulnerabilities will publish details about these issues at a conference on March 16th. You MUST patch affected systems before that date. Two of the vulnerabilities appear to be in particular dangerous, and affected devices should be patched immediately. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20767&rss *** Malicious websites exploit Silverlight bug that can pwn Macs and Windows *** --------------------------------------------- Malicious websites are exploiting a recently fixed vulnerability in Microsoft's Silverlight application framework to perform drive-by malware attacks on vulnerable visitor devices, a security researcher has determined. The critical code-execution vulnerability, which Microsoft patched last month, was actively exploited for two years in attack code owned by Italy-based exploit broker Hacking Team. --------------------------------------------- http://arstechnica.com/security/2016/02/malicious-websites-exploit-silverli…

1 0

Tageszusammenfassung - Mittwoch 24-02-2016
by Daily end-of-shift report 24 Feb '16

24 Feb '16

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 23-02-2016 18:00 − Mittwoch 24-02-2016 18:00 Handler: Robert Waldner Co-Handler: n/a *** Zahlreiche Hersteller patchen dramatische glibc-Lücke *** --------------------------------------------- Linux ist fast überall und dementsprechend verbreitet ist auch die glibc, die in älteren Versionen angreifbar ist. Sicherheits-Updates gibt es unter anderem von Zyxel, VMware und Citrix, andere geben Entwarnung. --------------------------------------------- http://heise.de/-3115787 *** OpenCms 9.5.2 Cross Site Scripting *** --------------------------------------------- Topic: OpenCms 9.5.2 Cross Site Scripting Risk: Low Text: Advisory ID: SYSS-2015-063 Product: OpenCms Official Maintainer: Alkacon Software GmbH Affected Version(s): 9.5.2 Tested ... --------------------------------------------- https://cxsecurity.com/issue/WLB-2016020206 *** DFN-CERT-2016-0326/">Bibliothek libssh: Zwei Schwachstellen ermöglichen u.a. das Umgehen von Sicherheitsvorkehrungen *** --------------------------------------------- Zwei Schwachstellen in der Bibliothek libssh ermöglichen einem entfernten, nicht authentifizierten Angreifer das Durchführen eines Denial-of-Service (DoS)-Angriffs sowie das Umgehen von Sicherheitsvorkehrungen und in der Folge das Ausspähen von Informationen. --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2016-0326/ *** Squid: Multiple Denial of Service issues in HTTP Response processing. *** --------------------------------------------- Due to incorrect bounds checking Squid is vulnerable to a denial of service attack when processing HTTP responses. --------------------------------------------- http://www.squid-cache.org/Advisories/SQUID-2016_2.txt *** Exploiting a Kernel Paged Pool Buffer Overflow in Avast Virtualization Driver *** --------------------------------------------- Version(s): 11.1.2245; possibly earlier versions Description: A vulnerability was reported in avast!. A local user can gain system privileges on the target system. Avast Internet Security, Avast Pro Antivirus, Avast Premier, and Avast Free Antivirus are affected. Solution: The vendor has issued a fix (11.1.2253). --------------------------------------------- http://www.securitytracker.com/id/1035093 *** Drupal 6 hits the end of the line *** --------------------------------------------- If you have a Drupal 6 website then you wont be receiving any more official security advisories or patches; from today your site is vulnerable to any new security issues discovered in Drupal 6 core or its modules, forever. --------------------------------------------- https://nakedsecurity.sophos.com/2016/02/24/drupal-6-hits-the-end-of-the-li… *** Admins aufgepasst: Krypto-Trojaner befällt hunderte Webserver *** --------------------------------------------- Der Erpressungs-Trojaner CTB-Locker hat es dieses Mal nicht auf Windows-Nutzer, sondern auf Webserver abgesehen. Er hat bereits Dateien hunderter Websites verschlüsselt, ein Ende ist derzeit nicht absehbar. --------------------------------------------- http://heise.de/-3116470 *** F5: sol13304944: NTP vulnerability CVE-2015-7974 *** --------------------------------------------- NTP 4.x before 4.2.8p6 and 4.3.x before 4.3.90 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to conduct impersonation attacks via an arbitrary trusted key, aka a "skeleton key." (CVE-2015-7974) --------------------------------------------- https://support.f5.com/kb/en-us/solutions/public/k/13/sol13304944.html *** Analyzis of a Malicious .lnk File with an Embedded Payload, (Wed, Feb 24th) *** --------------------------------------------- We received some feedback today from Nick, aSANS ISC reader who detected an interesting phishing campaign based on an ACE file. I also detected the same kind of fileearlier this morning. ACE is an old compression algorithm developed by a German company called e-merge. This file format was popular around the year2000. Today it almost disappeared and was replaced by more popularformatsbut ACE files can still be handled by popular tools like WinRAR or WinZIP. The fact that the format is quite old --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20763&rss *** Attackers Can Turn Microsofts Exploit Defense Tool EMET Against Itself *** --------------------------------------------- itwbennett writes: FireEye researchers have found a way for exploits to trigger a specific function in EMET that disables all protections it enforces for other applications. The researchers believe that their new technique, which essentially uses EMET against itself, is more reliable and easier to use than any previously published bypasses. It works against all supported versions of EMET - 5.0, 5.1 and 5.2 - but Microsoft patched the issue in EMET 5.5, which was released on Feb. 2. --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/rwo8Nq2dFiw/attackers-can-t… *** Ransomware: Locky kommt jetzt auch über Jscript *** --------------------------------------------- Eine Spam-Kampagne verteilt die Locky-Ransomware jetzt auch über Jscript-Anhänge in E-Mails - die angeblich von einem Wursthersteller kommen. (Trojaner, Virus) --------------------------------------------- http://www.golem.de/news/ransomware-locky-kommt-jetzt-auch-ueber-javascript… *** Mousejacking: What you need to know *** --------------------------------------------- Got a wireless mouse or keyboards that uses a USB dongle? Seems that many of them can be fed fake clicks and keystrokes from a distance... --------------------------------------------- https://nakedsecurity.sophos.com/2016/02/24/mousejacking-what-you-need-to-k… *** Cisco ACE 4710 Application Control Engine Command Injection Vulnerability *** --------------------------------------------- A vulnerability in the Device Manager GUI of the Cisco ACE 4710 Application Control Engine could allow an authenticated, remote attacker to execute any command-line interface (CLI) command on the ACE with admin user privileges. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cleaners ought to be clean (and clear) *** --------------------------------------------- There are many programs that purport to clean up and optimize system performance. While Microsoft does not endorse the use of these tools with Windows, we do not view them as unwanted or malicious. Many programs in this category have a practice of providing a free version of their software that scans your system, ... --------------------------------------------- https://blogs.technet.microsoft.com/mmpc/2016/02/24/cleaners-ought-to-be-cl… *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in the IBM SDK for Node.js affect the Cordova tools in Rational Application Developer affecting Rational Developer for i and Rational Developer for AIX and Linux (CVE-2016-2086, CVE-2016-2216, *** http://www.ibm.com/support/docview.wss?uid=swg21977146 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect the Cordova tools in Rational Application Developer affecting Rational Developer for i and Rational Developer for AIX and Linux (CVE-2016-0701, CVE-2015-3197) *** http://www.ibm.com/support/docview.wss?uid=swg21977144 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in IBM Java SDK affects IBM Explorer for z/OS 3.0 (CVE-2015-7575) *** http://www.ibm.com/support/docview.wss?uid=swg21976483 --------------------------------------------- *** IBM Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Business Process Manager and WebSphere Lombardi Edition (CVE-2016-0483, CVE-2016-0475, CVE-2016-0466, CVE-2015-7575, *** http://www.ibm.com/support/docview.wss?uid=swg21977021 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK Version 8 Service Refresh 2 that affect IBM BigFix Compliance Analytics. *** http://www.ibm.com/support/docview.wss?uid=swg21976854 --------------------------------------------- *** IBM Security Bulletin: Java specific SLOTH - Weak MD5 Signature Hash *** http://www.ibm.com/support/docview.wss?uid=swg21975823 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in IBM Java Runtime shipped with WebSphere Partner Gateway Advanced/Enterprise editions (CVE-2015-7575) *** http://www.ibm.com/support/docview.wss?uid=swg21976925 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Rational Method Composer (CVE-2015-7575) *** http://www.ibm.com/support/docview.wss?uid=swg21975877 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in IBM Java SDK affects Rational Developer for System z (CVE-2015-7575) *** http://www.ibm.com/support/docview.wss?uid=swg21976476 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java affect IBM SPSS Modeler (CVE-2016-0466, CVE-2015-7575, CVE-2016-0475) *** http://www.ibm.com/support/docview.wss?uid=swg21977518 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in IBM Java Runtime affects IBM WebSphere MQ (CVE-2015-7575) *** http://www.ibm.com/support/docview.wss?uid=swg21977523 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Runtime Environments Java Technology Edition, Versions 6, 7, 8 affect IBM Transformation Extender Hypervisor Edition for AIX (CVE-2016-0466, CVE-2015-7575) *** http://www.ibm.com/support/docview.wss?uid=swg21977061 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Runtime Environments Java Technology Edition, Versions 6, 7, 8 affect IBM Transformation Extender Hypervisor Edition (CVE-2016-0466, CVE-2015-7575) *** http://www.ibm.com/support/docview.wss?uid=swg21976970 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect FileNet Content Manager, IBM Content Foundation and FileNet BPM (CVE-2015-7575, CVE-2016-0475, CVE-2016-0466) *** http://www.ibm.com/support/docview.wss?uid=swg21975820 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Tivoli Netcool/OMNIbus (Multiple CVEs) *** http://www.ibm.com/support/docview.wss?uid=swg21976845 --------------------------------------------- *** IBM Security Bulletin: Fixes available for Security Vulnerabilities in IBM WebSphere Portal *** http://www.ibm.com/support/docview.wss?uid=swg21976358 ---------------------------------------------

1 0

Tageszusammenfassung - Dienstag 23-02-2016
by Daily end-of-shift report 23 Feb '16

23 Feb '16

======================= = End-of-Shift report = ======================= Timeframe: Montag 22-02-2016 18:00 − Dienstag 23-02-2016 18:00 Handler: Alexander Riepl Co-Handler: n/a *** CVE-2016-0034 (Silverlight up to 5.1.41105.0) and Exploit Kits *** --------------------------------------------- http://malware.dontneedcoffee.com/2016/02/cve-2016-0034.html *** Incident Handling with Docker Containers *** --------------------------------------------- Honestly, I never really played with Docker but - For a few weeks, I succumbed to the temptation of playing with Docker thanks to a friend who's putting everything in docker containers. If you still don't know Docker, here is a very brief .. --------------------------------------------- https://blog.rootshell.be/2016/02/22/incident-handling-docker-to-the-rescue/ *** Is DNSSEC causing more problems than it solves? *** --------------------------------------------- New paper points to security protocol as vector for DDoS attacks The complex security protocol for the domain name system - DNSSEC - has another black mark against it: it is being used as a way to carry out denial-of-service (DDoS) .. --------------------------------------------- www.theregister.co.uk/2016/02/23/dnssec_more_problem_than_solution/ *** Ecommerce fraud surges 163% *** --------------------------------------------- The worst fears of online retailers has been confirmed with data just released today: in 2015, the number of attacks by fraudsters was up 163 percent - growing two and a half times in a mere three-quartered period. This data is part of the newly .. --------------------------------------------- https://www.helpnetsecurity.com/2016/02/23/ecommerce-fraud-surges-163/ *** Betrüger stahlen Grazer Unternehmen online 147.000 Euro *** --------------------------------------------- Unbekannte brachen in das Firmennetz ein und überwiesen den Betrag auf ein polnisches Konto. Das Geld ist verloren. --------------------------------------------- http://futurezone.at/b2b/betrueger-stahlen-grazer-unternehmen-online-147-00… *** 90% of SSL VPNs use insecure or outdated encryption, putting your data at risk *** --------------------------------------------- Have you ever thought how secure and reliable your SSL VPN? Probably you should. --------------------------------------------- https://www.htbridge.com/blog/90-percent-of-ssl-vpns-use-insecure-or-outdat… *** Mobile malware evolution 2015 *** --------------------------------------------- As the functionality of mobile devices and mobile services grows, the appetite of cybercriminals who profit from mobile malware will grow too. Malware authors will continue to improve their creations, develop new technologies and look for new ways of spreading mobile malware. Their main aim is to make money. --------------------------------------------- http://securelist.com/analysis/kaspersky-security-bulletin/73839/mobile-mal… *** Hackers arent so interested in your credit card data these days. Thats bad news *** --------------------------------------------- World governments now primary sources of breaches Healthcare and government have overtaken the retail sector as most-targeted for data breaches, according to security firm .. --------------------------------------------- www.theregister.co.uk/2016/02/23/breach_trends_gemalto/ *** Sicherheitsforscher: Gefahr durch Android-Banking-Trojaner größer denn je *** --------------------------------------------- Kaspersky sieht in einem Android-Trojaner "eine der größten Gefahren, die wir derzeit kennen“, während Sicherheitsexperten von IBM davon berichten, dass der Quellcode eines bekannten Trojaners veröffentlicht wurde. Ein Tutorial läd zum Ausprobieren ein --------------------------------------------- http://heise.de/-3115424 *** Two Charts That Demonstrate One Of Android's Big Security Problems *** --------------------------------------------- Applying the most recent security updates to your device's operating system is a best practice security fundamental. If you're not running the latest version of an OS, you're opening .. --------------------------------------------- https://labsblog.f-secure.com/2016/02/23/two-charts-that-demonstrate-one-of… *** Flaws in Wireless Mice and Keyboards Let Hackers Type on Your PC *** --------------------------------------------- Security researchers "mousejacking" attack exploits vulnerable wireless devices to type on a target PC from a hundred yards away. --------------------------------------------- http://www.wired.com/2016/02/flaws-in-wireless-mice-and-keyboards-let-hacke… *** Cisco Nexus 2000 Series Fabric Extender Software Default Credential Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** PowerPoint and Custom Actions *** --------------------------------------------- We've recently observed a Phishing attack which uses PowerPoint Custom Actions instead of macros to execute a malicious payload. Although using PowerPoint attachments is not new, these types of attacks are interesting as they generally bypass controls that assert on macro enabled Office attachments. --------------------------------------------- http://phishme.com/powerpoint-and-custom-actions/ *** TYPO3 CMS 6.2.19 and 7.6.4 released *** --------------------------------------------- https://typo3.org/news/article/typo3-cms-6219-and-764-released/

1 0

Tageszusammenfassung - Montag 22-02-2016
by Daily end-of-shift report 22 Feb '16

22 Feb '16

======================= = End-of-Shift report = ======================= Timeframe: Freitag 19-02-2016 18:00 − Montag 22-02-2016 18:00 Handler: Alexander Riepl Co-Handler: n/a *** glibc: Neue Version repariert dramatische Lücke in Linux-Netzwerkfunktionen *** --------------------------------------------- Den kritische Fehler, den Angreifer zur Übernahme von Linux-Systemen nutzen konnten, hat das glibc-Team mit Version 2.23 offenbar behoben. Die anderen Änderungen wie Unicode-8-Support stehen im Schatten des Bugfix. --------------------------------------------- http://heise.de/-3112519 *** Joomla Sites Join WordPress As TeslaCrypt Ransomware Target *** --------------------------------------------- Joomla is the newest prey of attackers behind a campaign that has targeted WordPress websites by injecting JavaScript files with malicious code. --------------------------------------------- http://threatpost.com/joomla-sites-join-wordpress-as-teslacrypt-ransomware-… *** PCI DSS 3.2 slated for early 2016 *** --------------------------------------------- PCI DSS version 3.2, scheduled for release in the first half of 2016, likely March or April, will address the current threat landscape as well as "trending attacks causing compromises" detailed in current breach forensics reports. --------------------------------------------- http://www.scmagazine.com/pci-dss-32-slated-for-early-2016/article/478089/ *** Investigating a Compromised Server with Rootcheck *** --------------------------------------------- What do you do if you suspect your server (VPS or dedicated) has been compromised? If you are a customer, you have the option to leverage our team to perform the incident response on your behalf, but what if you want to do an investigation on your own? In this .. --------------------------------------------- https://blog.sucuri.net/2016/02/investigating-a-compromised-server-with-roo… *** Wie Privatleute von Online-Kriminellen zur Geldwäsche missbraucht werden *** --------------------------------------------- Kriminelle Banden nutzen unscheinbare Privatleute zur Geldwäsche. Neuerdings haben sie auch Flüchtlinge im Visier. An die Hintermänner kommt man kaum ran. --------------------------------------------- http://heise.de/-3112859 *** Security: Rätselhafter Anstieg von Tor-Adressen *** --------------------------------------------- Ein ungewöhnlicher Anstieg von .onion-Adressen im Tor-Netzwerk gibt zurzeit Rätsel auf. Grund für den Anstieg könnte eine neue Messaging-App sein - oder Malware. --------------------------------------------- http://www.golem.de/news/security-sprunghafter-anstieg-von-tor-adressen-160… *** Warning - Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System *** --------------------------------------------- Are you also the one who downloaded Linux Mint on February 20th? You may have been Infected! Linux Mint is one of the best and popular Linux distros available today, but if you have downloaded and installed the operating system recently you .. --------------------------------------------- https://thehackernews.com/2016/02/linux-mint-hack.html *** DSA-3479 graphite2 - security update *** --------------------------------------------- Multiple vulnerabilities have been found in the Graphite font renderingengine which might result in denial of service or the execution ofarbitrary code if a malformed font file is processed. --------------------------------------------- https://www.debian.org/security/2016/dsa-3479 *** Synology NAS DSM 5.2 Remote Code Execution (RCE) *** --------------------------------------------- RCE in Synology NAS DSM 5.2 due to lack of input sanitisation. RCE triggered indirectly via port forwarding mechanism in the NAS UI. --------------------------------------------- http://rileykidd.com/2016/01/12/synology-nas-dsm-5-2-remote-code-execution-… *** A Skeleton Key of Unknown Strength *** --------------------------------------------- TL;DR: The glibc DNS bug (CVE-2015-7547) is unusually bad. Even Shellshock and Heartbleed tended to affect things we knew were on the network and knew we had to defend. This affects a universally used library (glibc) at a universally used protocol (DNS). Generic tools that we didn't even know had network surface (sudo) are thus exposed, as is software written in .. --------------------------------------------- http://dankaminsky.com/2016/02/20/skeleton/ *** Sicherheitsforscher: Piraten-App-Store vorübergehend in Apples App Store *** --------------------------------------------- Über mehrere Monate hat eine in Apples offiziellem Software-Laden erhältliche, als Übersetzungs-Tool getarnte iOS-App ihren Nutzern offenbar gecrackte Apps zum Download angeboten. --------------------------------------------- http://heise.de/-3113988 *** Deutschland: "Bundestrojaner" ist einsatzbereit *** --------------------------------------------- Nach monatelangen Vorbereitungen steht den Ermittlernin Deutschland eine eigene Software für Online-Durchsuchungen zur Verfügung. --------------------------------------------- http://futurezone.at/netzpolitik/deutschland-bundestrojaner-ist-einsatzbere… *** Neue Masche: Krypto-Trojaner Locky über Javascript-Dateien verbreitet *** --------------------------------------------- Nachdem der Verschlüsselungs-Trojaner zunächst vor allem über Office-Dateien verbreitet wurde, verschicken die Täter jetzt Skripte. Dadurch ist ein Ludwigsluster Wursthersteller unfreiwillig zur Anlaufstelle der Locky-Opfer geworden. --------------------------------------------- http://heise.de/-3113689

1 0

Tageszusammenfassung - Freitag 19-02-2016
by Daily end-of-shift report 19 Feb '16

19 Feb '16

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 18-02-2016 18:00 − Freitag 19-02-2016 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Maimed Ramnit Still Lurking in the Shadow *** --------------------------------------------- https://www.fireeye.com/blog/threat-research/2016/02/maimed_ramnit_still.ht… *** ZDI-16-172: Google Chrome Pdfium JPEG2000 Out-Of-Bounds Read Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Google Chrome. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-16-172/ *** Mutliple vulnerabilities in SAP 3D Visual Enterprise Viewer SketchUp document *** --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-16-176/ http://www.zerodayinitiative.com/advisories/ZDI-16-175/ http://www.zerodayinitiative.com/advisories/ZDI-16-174/ http://www.zerodayinitiative.com/advisories/ZDI-16-173/ *** Krypto-Trojaner Locky wütet in Deutschland: Über 5000 Infektionen pro Stunde *** --------------------------------------------- Die neue Ransomware Locky findet hierzulande offenbar massenhaft Opfer, darunter auch ein Fraunhofer-Institut. Inzwischen haben die Täter ihrem Schädling sogar Deutsch beigebracht. --------------------------------------------- http://heise.de/-3111774 *** B+B SmartWorx VESP211 Authentication Bypass Vulnerability *** --------------------------------------------- This advisory contains mitigation details for an authentication bypass vulnerability in B+B SmartWorx's VESP211 serial servers. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-16-049-01 *** AMX Multiple Products Credential Management Vulnerabilities *** --------------------------------------------- This advisory contains mitigations details for hard-coded passwords in multiple AMX products. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-16-049-02 *** Privilege Escalation: Schon wieder Sicherheitslücke bei Comodo *** --------------------------------------------- Ein unsicheres Standardpasswort in der Comodo-Internet-Security-Suite ermöglicht es Angreifern, ihre Rechte zu erweitern, um beliebige Programme auszuführen. Auf dem Rechner selbst - aber möglicherweise auch aus der Ferne. --------------------------------------------- http://www.golem.de/news/privilege-escalation-schon-wieder-sicherheitslueck… *** Citrix NetScaler Application Delivery Controller and NetScaler Gateway Multiple Security Updates *** --------------------------------------------- http://support.citrix.com/article/CTX206001

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily