Daily

daily@lists.cert.at

1 participants
3085 discussions

Tageszusammenfassung - Dienstag 24-03-2015
by Daily end-of-shift report 24 Mar '15

24 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 23-03-2015 18:00 − Dienstag 24-03-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** DMARC and Spam: Why It Matters *** --------------------------------------------- Recently I discussed how TorrentLocker spam was using email authentication for its spam runs. At the time, I suggested that these spam runs were using email authentication to gather information about victim networks and potentially improve the ability to evade spam filters. DomainKeys Identified Mail's (DKIM) own specification mentions the possibility of messages with from "trusted sources" and with a... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/W3IX-WkypVo/ *** Why enterprise IT and security teams should talk more *** --------------------------------------------- The "It wont happen to me" mentality combined with communication gaps between the IT and security teams greatly increases enterprises risk of being breached. --------------------------------------------- http://www.scmagazine.com/why-enterprise-it-and-security-teams-should-talk-… *** Xen shows off 35-piece cloudpocalypse collection *** --------------------------------------------- The latest fixing fashions for open-source hypervisors hit the catwalk The Xen Project has fixed 35 flaws, all rated critical, for versions 4.3 and 4.4 of its flagship hypervisor. The fixes appear to correspond to flaws identified after the late February 2014 cloudpocalypse, when major cloud providers feared they would once again need to reboot substantial parts of their server fleets to keep them secure. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/03/24/xen_shows_o… *** Four advantages of an identity behavior-based approach to cybersecurity *** --------------------------------------------- With an ever-increasing number of data breaches, more money is being poured into IT security budgets. According to Gartner, the average global security budget increased 8 percent from 2013 to 2014 and... --------------------------------------------- http://www.net-security.org/article.php?id=2243 *** KNX-Schwachstellen: Spielen mit den Lichtern der anderen *** --------------------------------------------- Das aktuelle KNX-Protokoll abzusichern, halten die Entwickler nicht für nötig. Denn Angreifer brauchen physischen Zugriff auf das System. Doch den bekommen sie leichter als gedacht - und können dann sogar Türöffner und Alarmanlagen steuern. --------------------------------------------- http://www.golem.de/news/knx-schwachstellen-spielen-mit-den-lichtern-der-an… *** BlackHat talk hibernated over 0-day in SAPs Afaria mobile manager *** --------------------------------------------- Researcher has form as a gent: he held back disclosure of medical records leak Alexander Polyakov has been forced to withdraw a talk detailing dangerous vulnerabilities into SAPs mobile device management product Afaria scheduled to be given at BlackHat Asia Pacific this week. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/03/24/sap_blackha… *** Google deckt erneut Missbrauch im SSL-Zertifizierungssystem auf *** --------------------------------------------- Über das Public-Key-Pinning im Webbrowser Chrome ist Google auf gefälschte Zertifikate für Google-Domains gestoßen. Diese werden von der Root-CA CNNIC beglaubigt, der viele Betriebssysteme und Browser beim Aufbau verschlüsselter Verbindungen vertrauen. --------------------------------------------- http://heise.de/-2583414 *** The importance of standards in electronic identification and trust services providers *** --------------------------------------------- ENISA publishes a new report on the importance of standards in the area of electronic identification and trust services providers. --------------------------------------------- http://www.enisa.europa.eu/media/news-items/the-importance-of-standards-in-… *** Full, cracked version of NanoCore RAT leaked, onslaught of infection attempts expected *** --------------------------------------------- NanoCore, a lesser-known remote access Trojan (RAT), has recently been spotted being delivered to employees of energy companies in Asia and the Middle East via spear-phishing emails impersonating a le... --------------------------------------------- http://www.net-security.org/malware_news.php?id=2995 *** Android Installer Hijacking Vulnerability Could Expose Android Users to Malware *** --------------------------------------------- Executive Summary We discovered a widespread vulnerability in Google's Android OS we are calling "Android Installer Hijacking", estimated to impact 49.5 percent of all current Android users. In detail: Android Installer Hijacking allows an attacker... --------------------------------------------- http://researchcenter.paloaltonetworks.com/2015/03/android-installer-hijack… *** The average DDoS attack tripled in volume *** --------------------------------------------- The average packet volume for DDoS attacks increased 340 percent to 4.36 million packets per second (Mpps), and the average bit volume swelled 245 percent to 12.1 Gbps in the final quarter of 2014, ac... --------------------------------------------- http://www.net-security.org/secworld.php?id=18125 *** Privilege Gone Wild 2: Over 25% of Organizations Have No Privileged Access Controls *** --------------------------------------------- BeyondTrust recently conducted a survey, with over 700 respondents, to explore how organizations view the risk of misuse from privileged account misuse, as well as trends in addressing and mitigating those risks. --------------------------------------------- http://blog.beyondtrust.com/privilege-gone-wild-2-over-25-of-organizations-… *** Is Your Multi-Factor Authentication Solution the Real Thing? *** --------------------------------------------- In infosec, multi-factor authentication is often considered a positive, constructive element of layered security. However, some people have an oversimplified view. With multi-factor authentication, there are many nuances to consider. At BSides Austin I presented on this topic. When shopping for a multi-factor authentication solution, what should you look for? There are over 200 multi-factor authentication vendors, how do you evaluate the best one for your needs? You can weed out more the half --------------------------------------------- https://www.alienvault.com/blogs/security-essentials/is-your-multi-factor-a… *** Why Website Reinfections Happen *** --------------------------------------------- I joined Sucuri a little over a month ago. My job is actually as a Social Media Specialist, but we have this process where regardless of your job you have to learn what website infections look like and more importantly, how to clean them. It's this idea that regardless of you are you must always... --------------------------------------------- http://blog.sucuri.net/2015/03/why-website-reinfections-happen.html *** HP Security Bulletins *** --------------------------------------------- *** HPSBST03196 rev.1- HP StoreEver MSL6480 Tape Library running OpenSSL, Remote Code Execution *** https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04599191 *** HPSBGN03299 rev.1 - HP IceWall SSO Dfw, SSO Certd, MCRP, and Federation Agent running OpenSSL, Remote Disclosure of Information, Unauthorized Access *** https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04604357 *** HPSBHF03289 rev.1- HP ThinClient PCs running ThinPro Linux, Remote Code Execution, Denial of Service, Disclosure of information *** https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04602055 *** HPSBMU03220 rev.1 - HP Shunra Network Appliance / HP Shunra Wildcat Appliance, Remote Execution of Code *** https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04518183 *** HPSBMU03297 rev.1- HP Helion Application Lifecycle Service (ALS) for Linux, Remote Code Execution *** https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04599861 *** HPSBMU03301 rev.1 - HP BladeSystem c-Class Onboard Administrator running OpenSSL, Remote Disclosure of Information *** https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04609844 *** HPSBHF03151 rev.1 - HP Integrated Lights-Out 2 and 4 (iLO 2, iLO 4), Chassis Management (iLO CM), Remote Denial of Service, Remote Execution of Code, Elevation of Privilege *** https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04486432 *** HPSBHF03275 rev.1 - HP Integrated Lights-Out 2, 3, and 4 (iLO 2, iLO 3, iLO 4), Remote Disclosure of Information *** https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04582218 *** HPSBHF03276 rev.1 - HP Integrated Lights-Out 2, 3, and 4 (iLO 2, iLO 3, iLO 4), Remote Unauthorized Access, Denial of Service (Dos) *** https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04582368 *** HPSBMU03292 rev.1 - HP Operations Orchestration Authentication Bypass *** https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04595607 *** HPSBMU03291 rev.1 - HP Operations Orchestration running Powershell Operations, Remote Disclosure of Information *** https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04595417 *** HPSBMU03263 rev.1 - HP Insight Control running OpenSSL, Remote Disclosure of Information *** https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04574073 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: IBM InfoSphere Balanced Warehouse C3000, C4000, IBM Smart Analytics System 1050, 2050 and 5710 are affected by vulnerabilities in NTP (CVE-2014-9293, CVE-2014-9294, CVE-2014-9297, CVE-2014-9298) *** http://www.ibm.com/support/docview.wss?uid=swg21699578 *** IBM Security Bulletin: Vulnerabilities in IBM Rational ClearQuest (CVE-2014-8925) *** http://www.ibm.com/support/docview.wss?uid=swg21699148 *** IBM Security Bulletin: IBM Forms Experience Builder is affected by a Dojo Toolkit vulnerability (CVE-2014-8917) *** http://www.ibm.com/support/docview.wss?uid=swg21697448 *** IBM Security Bulletin: IBM Security Identity Manager Adapters passwords exposed in log files (CVE-2014-8923) *** http://www.ibm.com/support/docview.wss?uid=swg21699902 *** IBM Security Bulletin: Multiple vulnerabilities IBM Java SDK affect IBM Rational Connector for SAP Solution Manager (CVE-2014-3566 CVE-2014-6457) *** http://www.ibm.com/support/docview.wss?uid=swg21698921 *** IBM Security Bulletin: Vulnerability in IBM Java SDK affects IBM Sterling Connect:Direct for Microsoft Windows (CVE-2014-3065) *** http://www.ibm.com/support/docview.wss?uid=swg21696456 *** IBM Security Bulletin: Multiple vulnerabilities in Java Runtime affect XIV Management Tools (CVE-2015-0410) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005143 *** IBM Security Bulletin: Multiple vulnerabilities IBM Java SDK affect IBM Rational Connector for SAP Solution Manager (CVE-2014-6593 CVE-2015-0410) *** http://www.ibm.com/support/docview.wss?uid=swg21698695 *** IBM Security Bulletin: Vulnerability in Apache Struts affects SAN Volume Controller and Storwize Family (CVE-2014-7809) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005037 *** IBM Security Bulletin: Multiple Kerberos (krb5) vulnerabilities affect PowerKVM (Multiple CVEs) *** http://www.ibm.com/support/docview.wss?uid=isg3T1022076 *** IBM Security Bulletin: Security Bulletin: IBM i is affected by the following SAMBA vulnerabilities: CVE-2015-0240 *** http://www.ibm.com/support/docview.wss?uid=nas8N1020638 *** EMC Documentum xMS information disclosure *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/101741 *** DSA-3203 tor - security update *** --------------------------------------------- Several denial-of-service issues have been discovered in Tor, aconnection-based low-latency anonymous communication system. --------------------------------------------- https://www.debian.org/security/2015/dsa-3203 *** InBoundio Marketing Plugin <= 2.0.3 - Shell Upload *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7864

1 0

Tageszusammenfassung - Montag 23-03-2015
by Daily end-of-shift report 23 Mar '15

23 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 20-03-2015 18:00 − Montag 23-03-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Apple: Those security holes we fixed last week? Youre going to need to repatch *** --------------------------------------------- Turns out those bugs werent quite squished Apple has released a follow-up to last weeks security update after finding a pair of flaws that are still vulnerable on patched systems. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/03/20/apple_remem… *** Drupal Compromise Analysis Including Indicators of Compromise *** --------------------------------------------- I would like to thank fellow SpiderLabs Researcher Chaim Sanders and Dennis Wilson, Bryant Smith and Casey Critchfield for their help with gathering data and analyzing this attack. Analysis of a real Drupal compromise In this blog post, we will... --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/Drupal-Compromise-Analy… *** Operation Woolen Goldfish, a hacking campaign in the wild *** --------------------------------------------- Security experts at Trend micro uncovered a new hacking campaign dubbed Operation Woolen Goldfish likely run by a threat actor group known as Rocket Kitten. Security experts at Trend Micro have uncovered a new cyber espionage campaign that is targeting a number of European organisations and businesses. The attackers run a spear phishing campaign that... --------------------------------------------- http://securityaffairs.co/wordpress/35128/cyber-crime/operation-woolen-gold… *** PoSeidon the most sophisticated PoS malware until now *** --------------------------------------------- Cisco Security Team has spotted in the wild a new Point-of-Sale malware dubbed PoSeidon that is more sophisticated than previously detected PoS malware. Expert at Cisco have discovered a new Point-of-Sale (PoS) malware dubbed PoSeidon. The experts have discovered many similarities with the popular Zeus Trojan and use sophisticated methods to find card data respect other POS malware like BlackPoS, which was used... --------------------------------------------- http://securityaffairs.co/wordpress/35181/cyber-crime/poseidon-pos-malware.… *** CREEPS rejoice: Small biz Cisco phones open to eavesdrop 0-day *** --------------------------------------------- Open phones may crop up on Shodan Creeps can listen in to conversations placed over vulnerable Cisco small business phones. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/03/23/creeps_rejo… *** New Dridex malware evades detection with AutoClose function *** --------------------------------------------- Security experts at Proofpoint have discovered a new phishing campaign that exploits a Dridex variant that evades detection with AutoClose function. Criminal crews behind the Dridex banking malware are very prolific and are improving the popular malicious code. Recently we have discussed about a Dridex variant which was spread through phishing messages with Microsoft Office documents embedding malicious macros. The attackers exploited social engineering technique to lure... --------------------------------------------- http://securityaffairs.co/wordpress/35197/cyber-crime/new-dridex-malware.ht… *** Adobe CVE-2011-2461 Remains Exploitable Four Years After Patch *** --------------------------------------------- A Flash vulnerability that Adobe patched four years ago actually remains exploitable according to a presentation given by a pair of researchers at the TROOPERS security conference. --------------------------------------------- http://threatpost.com/adobe-cve-2011-2461-remains-exploitable-four-years-af… *** Watch for updated router firmware!, (Mon, Mar 23rd) *** --------------------------------------------- With the OpenSSL updates this week I am sure you are all diligently testing and deploying to all your vulnerable servers. Something you may not have though of is that most SOHO routers run some kind of *nix variant and will most likely make use of OpenSSL. Be sure to watch for new firmware for those devices as well. On Friday I chatted to two of the larger manufacturers and neither had any timeline for deploying new firmware containing the OpenSSL patches and both said to watch for --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19497&rss *** BIOS-Rootkit LightEater: In den dunklen Ecken abseits des Betriebssystems *** --------------------------------------------- Ein Rootkit, das unabhängig vom Betriebssystem operiert, sämtlichen Speicher auslesen kann und durch den Tausch der Festplatte im System nicht gestoppt wird - was klingt wie eine IT-Gruselgeschichte haben zwei Forscher nun öffentlich präsentiert. --------------------------------------------- http://heise.de/-2582782 *** VU#631788: Multiple BIOS implementations permit unsafe SMM function calls to memory locations outside of SMRAM *** --------------------------------------------- Vulnerability Note VU#631788 Multiple BIOS implementations permit unsafe SMM function calls to memory locations outside of SMRAM Original Release date: 20 Mar 2015 | Last revised: 20 Mar 2015 Overview Multiple BIOS implementations permit unsafe System Management Mode (SMM) function calls to memory locations outside of SMRAM. Description Multiple BIOS implementations permit unsafe System Management Mode (SMM) function calls to memory locations outside of SMRAM. According to Corey Kallenberg --------------------------------------------- http://www.kb.cert.org/vuls/id/631788 *** Multiple Vulnerabilities in OpenSSL (March 2015) Affecting Cisco Products *** --------------------------------------------- cisco-sa-20150320-openssl --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** DSA-3199 xerces-c - security update *** --------------------------------------------- Anton Rager and Jonathan Brossard from the Salesforce.com ProductSecurity Team and Ben Laurie of Google discovered a denial of servicevulnerability in xerces-c, a validating XML parser library for C++. Theparser mishandles certain kinds of malformed input documents, resultingin a segmentation fault during a parse operation. An unauthenticatedattacker could use this flaw to cause an application using thexerces-c library to crash. --------------------------------------------- https://www.debian.org/security/2015/dsa-3199 *** DSA-3202 mono - security update *** --------------------------------------------- Researchers at INRIA and Xamarin discovered several vulnerabilities inmono, a platform for running and developing applications based on theECMA/ISO Standards. Monos TLS stack contained several problems thathampered its capabilities: those issues could lead to clientimpersonation (via SKIP-TLS), SSLv2 fallback, and encryption weakening(via FREAK). --------------------------------------------- https://www.debian.org/security/2015/dsa-3202 *** Bugtraq: FreeBSD Security Advisory FreeBSD-SA-15:06.openssl [REVISED] *** --------------------------------------------- http://www.securityfocus.com/archive/1/534943 *** Xen Project 4.4.2 *** --------------------------------------------- We are pleased to announce the release of Xen 4.4.2. This is available immediately from its git repository http://xenbits.xen.org/gitweb/?p=xen.git;a=shortlog;h=refs/heads/stable-4.4 (tag RELEASE-4.4.2) or from this download page This fixes the following critical vulnerabilities:... --------------------------------------------- http://www.xenproject.org/downloads/xen-archives/xen-44-series/xen-442.html *** Xen Project 4.3.4 *** --------------------------------------------- We are pleased to announce the release of Xen 4.3.4. This is available immediately from its git repository http://xenbits.xen.org/gitweb/?p=xen.git;a=shortlog;h=refs/heads/stable-4.3 (tag RELEASE-4.3.4) or from this page. Note that this is expected to be the last release of the 4.3 stable series. The tree will be switched to security only maintenance mode after this release. This fixes the following critical vulnerabilities:... --------------------------------------------- http://www.xenproject.org/downloads/xen-archives/xen-43-series/xen-434.html *** SA-CONTRIB-2015-066 - Tracking Code - Cross Site Request Forgery (CSRF) *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-066Project: Tracking Code (third-party module)Version: 7.xDate: 2015-March-04Security risk: 13/25 ( Moderately Critical) AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site Request ForgeryDescriptionTracking Code module allows you to create tracking code snippets and control their visibility.The module doesnt sufficiently protect some URLs against CSRF. A malicious user can cause an administrator to disable tracking codes by getting --------------------------------------------- https://www.drupal.org/node/2445961 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect Sterling Connect:Enterprise for UNIX (CVE-2014-3569, CVE-2015-0204, CVE-2014-3570, CVE-2014-3572, CVE-2014-8275) *** http://www.ibm.com/support/docview.wss?uid=swg21699211 *** IBM Security Bulletin: TLS padding vulnerability affects IBM API Management (CVE-2014-8730) *** http://www.ibm.com/support/docview.wss?uid=swg21699160 *** IBM Security Bulletin: IBM Content Collector affected by vulnerability in IBM Dojo Toolkit (CVE-2014-8917) *** http://www.ibm.com/support/docview.wss?uid=swg21694603 *** IBM Security Bulletin: Multiple security vulnerabilities in IBM Java Runtime affect IBM Rational ClearCase (CVE-2014-3566, CVE-2014-6457) *** http://www.ibm.com/support/docview.wss?uid=swg21698748 *** IBM Security Bulletin: XML External Entity Processing in Castor might affect IBM Business Process Manager (CVE-2014-3004) *** http://www.ibm.com/support/docview.wss?uid=swg21690565 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Tivoli Storage Productivity Center July 2014 CPU *** http://www.ibm.com/support/docview.wss?uid=swg21695005 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Financial Transaction Manager for ACH Services, Check Services and Corporate Payment Services (CVE-2014-6593, CVE-2015-0410) *** http://www.ibm.com/support/docview.wss?uid=swg21698702 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Rational Performance Tester (CVE-2014-3566, CVE-2014-6457, CVE-2014-6593, CVE-2015-0410) *** http://www.ibm.com/support/docview.wss?uid=swg21699032 *** IBM Security Bulletin: IBM Forms Viewer can crash based on an embedded PNG image (CVE-2014-9495, CVE-2015-0973) *** http://www.ibm.com/support/docview.wss?uid=swg21697791

1 0

Tageszusammenfassung - Freitag 20-03-2015
by Daily end-of-shift report 20 Mar '15

20 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 19-03-2015 18:00 − Freitag 20-03-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Paper: Dylib hijacking on OS X *** --------------------------------------------- Patrick Wardle shows how OS X is also vulnerable to once common Windows attacks.A few years ago, DLL hijacking on Windows was really hot, despite the fact that the concept had been discussed by none other than the NSA as far .. --------------------------------------------- http://www.virusbtn.com/blog/2015/03_19.xml?rss *** FindPOS: New POS Malware Family Discovered *** --------------------------------------------- Unit 42 has discovered a new Point of Sale (POS) malware family, which includes multiple variants created as early as November 2014. Over the past few weeks we have been analyzing this malware family, which .. --------------------------------------------- http://researchcenter.paloaltonetworks.com/2015/03/findpos-new-pos-malware-… *** Multiple vulnerabilities in Cisco products *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=37934 http://tools.cisco.com/security/center/viewAlert.x?alertId=37947 http://tools.cisco.com/security/center/viewAlert.x?alertId=37946 *** Security Update 2015-003 *** --------------------------------------------- https://support.apple.com/kb/HT204563 *** Who Develops Code for IT Support Scareware Websites? *** --------------------------------------------- When investigating a website used as part of an IT support scam, I came across a web page that attempted to fool the visitor into thinking that the persons system was infected. The goal was to persuade the potential victim to call a Microsoft Certified Live Technician at the designated phone number .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19489&rss *** CryptoWall 3.0 Ransomware Partners With FAREIT Spyware *** --------------------------------------------- Crypto-ransomware is once again upping the ante with its routines. We came across one crypto-ransomware variant that's combined with spyware - a first for crypto-ransomware. This development just comes at the heels of the discovery that .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/cryptowall-3-0-r… *** Rockwell Automation FactoryTalk DLL Hijacking Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for multiple DLL Hijacking vulnerabilities in a software component included with Rockwell Automation's FactoryTalk View Studio product. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-062-02 *** CVE-2015-0336 (Flash up to 16.0.0.305) and Exploit Kits *** --------------------------------------------- As reported by Malwarebytes and FireEye, Nuclear Pack is now taking advantage of a vulnerability patched with the last version of Flash Player ( 17.0.0.134 ) --------------------------------------------- http://malware.dontneedcoffee.com/2015/03/cve-2015-0336-flash-up-to-1600305… *** Erhebliche Sicherheitsmängel bei Geschenkkarten *** --------------------------------------------- Geschenkkarten lassen sich erschreckend einfach manipulieren, wird in der aktuellen Ausgabe des Computermagazins c’t gewarnt. Während Geldscheine mit immer mehr Sicherheitsmerkmalen gegen Fälschungen geschützt werden, sieht das bei den beliebten Geschenkkarten völlig anders aus. "Mit simplen Tricks .. --------------------------------------------- http://derstandard.at/2000013205756 *** Android Security Symposium, co-organized by SBA Research *** --------------------------------------------- https://www.sba-research.org/events/android-security-symposium-co-organized… *** Apple: Anti-Viren-Apps für iOS "irreführend" *** --------------------------------------------- Als Begründung für den plötzlichen Rauswurf von Anti-Viren-Software aus dem App Store hat Apple einem Bericht zufolge angeführt, diese Apps könnten Nutzer glauben lassen, es gäbe Viren für iOS. --------------------------------------------- http://heise.de/-2581916

1 0

Tageszusammenfassung - Donnerstag 19-03-2015
by Daily end-of-shift report 19 Mar '15

19 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 18-03-2015 18:00 − Donnerstag 19-03-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Sicherheitsforscher: Unsichtbare Apps unter iOS 8 weiterhin möglich *** --------------------------------------------- Mit einer neuen Methode ist es möglich, für den Nutzer praktisch unsichtbare iOS-Software zu installieren und diese als Spyware einzusetzen, erklärt ein Sicherheitsforscher – dies funktioniere auch auf Jailbreak-freien iPhones. --------------------------------------------- http://heise.de/-2579429 *** Experten warnen vor Risiken vernetzter medizinischer Geräte *** --------------------------------------------- "Wenn vernetztes Gerät in menschlichen Körper implantiert wurde, sind Konsequenzen eines Cyberangriffs besonders bedrohlich" --------------------------------------------- http://derstandard.at/2000013144564 *** Drupal Core - Moderately Critical - Multiple Vulnerabilities - SA-CORE-2015-001 *** --------------------------------------------- https://www.drupal.org/SA-CORE-2015-001 *** SA-CONTRIB-2015-079 - Chaos tool suite (ctools) - Multiple vulnerabilities *** --------------------------------------------- https://www.drupal.org/node/2454909 *** SA-CONTRIB-2015-078 - Webform - Cross Site Scripting (XSS) *** --------------------------------------------- https://www.drupal.org/node/2454903 *** Introduction to GSM Security *** --------------------------------------------- Introduction The Global System for Mobile Communication or GSM is a wireless communication that uses digital technology and is widely deployed across the globe for mobile communications, such as mobile phones. This technology utilizes microwaves, and its signal transmission is divided by time, .. --------------------------------------------- http://resources.infosecinstitute.com/introduction-to-gsm-security/ *** New BIOS Implant, Vulnerability Discovery Tool to Debut at CanSecWest *** --------------------------------------------- Researchers are expected to present at CanSecWest a BIOS rootkit that automates BIOS vulnerability discovery and implants persistent malware. --------------------------------------------- http://threatpost.com/new-bios-implant-vulnerability-discovery-tool-to-debu… *** Freak-Attacke: Noch immer tausende Android- und iOS-Apps gefährdet *** --------------------------------------------- Im Vergleich zu früheren OpenSSL-Lücken wie Heartbleed sind die Auswirkungen der vor einigen Wochen aufgetauchten Freak-Attacke vergleichsweise begrenzt. Dies liegt nicht zuletzt daran, dass für einen Angriff sowohl Client als auch Server verwundbar sein müssen, und mittlerweile viele Browser-Hersteller mit Updates die entsprechende Lücke abgedichtet haben. --------------------------------------------- http://derstandard.at/2000013168279 *** Cisco will an falsche Adressen liefern, um NSA zu täuschen *** --------------------------------------------- Router und andere Hardware soll an leerstehende Wohnungen versandt werden, um Empfänger zu verschleiern --------------------------------------------- http://derstandard.at/2000013170564 *** Ransomware - should you pay? *** --------------------------------------------- The big question, usually left unanswered in technical discussions of ransomware, is, "Should you pay?" We help you make up your mind. --------------------------------------------- https://nakedsecurity.sophos.com/2015/03/19/ransomware-should-you-pay/ *** Critical Vulnerability in Microsoft Translator hub writeup *** --------------------------------------------- A month back I was hunting for Vulnerabilities in Microsoft Web services, as Microsoft has large online infrastructure, finding a vulnerability which could lead to Microsoft hall of fame for security researchers wasn't difficult. While browsing around their online services, one of their services, .. --------------------------------------------- https://haiderm.com/critical-vulnerability-in-microsoft-translator-hub-writ… *** The Impacts of a Hacked Website *** --------------------------------------------- Today, with the proliferation of open-source technologies like WordPress, Joomla! and other Content Management Systems (CMS) people around the world are able to quickly establish a virtual presence with little to no cost. In the process however, a lot is being lost in terms of what it means to own a .. --------------------------------------------- http://blog.sucuri.net/2015/03/the-impacts-of-a-hacked-website.html *** Intrusion Detection (IDS) for Analysts *** --------------------------------------------- IDS device installed? Check. IDS seeing traffic? Check. IDS generating Events? Check. Analysts investigating Events? Ummm .. Investigating IDS alerts is a process like any other; however the variable nature of Information Security often makes this process difficult to adhere to. Maintaining .. --------------------------------------------- https://www.alienvault.com/blogs/security-essentials/intrusion-detection-id… *** OpenSSL Security Advisory [19 Mar 2015] *** --------------------------------------------- https://www.openssl.org/news/secadv_20150319.txt *** Google Analytics by Yoast <= 5.3.2 - Stored Cross-Site Scripting (XSS) *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7856 *** Erschlichenes Zertifikat: Microsoft antwortet vier Jahre nicht auf Warnung *** --------------------------------------------- Zum fälschlicherweise ausgestellten Zertifikat für die Microsoft-Domain live.fi sind weitere Details bekannt. Demnach hatte sich Microsoft Wochen Zeit gelassen, um zu reagieren. In einem ähnlichen Fall ließ Microsoft sogar vier Jahre verstreichen. --------------------------------------------- http://www.golem.de/news/gefaelschtes-zertifikat-microsoft-antwortet-vier-j… *** TLS-Zertifikate: Comodo stellt fälschlicherweise Microsoft-Zertifikat aus *** --------------------------------------------- Für die Domain live.fi, die Microsoft für die finnische Version seiner Live-Services nutzt, ist ein unberechtigtes Zertifikat von Comodo ausgestellt worden. Dabei wird eine Reihe von Schwächen des Zertifikatssystems deutlich. --------------------------------------------- http://www.golem.de/news/tls-zertifikate-comodo-stellt-gefaelschtes-microso… *** Aktiver Angriff auf Shop-System xt:Commerce *** --------------------------------------------- Angreifer nutzen die Sicherheitslücke in einem Versionszweig des Online-Shop-Systems xt:Commerce aktiv aus, um an sensible Kundendaten zu gelangen. Wer den Hotfix noch nicht eingespielt hat, sollte dies jetzt schleunigst tun. --------------------------------------------- http://heise.de/-2580640 *** Cisco IOS Software Autonomic Networking Infrastructure Overwrite Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=37935 *** Linux-Entwickler erschweren Rowhammer-Angriffe *** --------------------------------------------- Momentan kann ein Programm mit einfachen Nutzerrechten beim Kernel erfragen, wo im Speicher die Daten eines Prozesses liegen. Das vereinfacht den Rowhammer-Angriff. Ab Linux .. --------------------------------------------- http://heise.de/-2580654

1 0

Tageszusammenfassung - Mittwoch 18-03-2015
by Daily end-of-shift report 18 Mar '15

18 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 17-03-2015 18:00 − Mittwoch 18-03-2015 18:00 Handler: Robert Waldner Co-Handler: n/a *** Malware Hunting with the Sysinternals Tools *** --------------------------------------------- This session provides an overview of several Sysinternals tools, including Process Monitor, Process Explorer, and Autoruns, focusing on the features useful for malware analysis and removal. These utilities enable deep inspection and control of processes, file system and registry activity, and autostart execution points. Mark Russinovich demonstrates their malware-hunting capabilities by presenting several real-world cases that used the tools to identify and clean malware, and concludes by... --------------------------------------------- http://blog.malwareresearch.institute/video/2015/03/17/malware-hunting-with… *** Pass the hash!, (Wed, Mar 18th) *** --------------------------------------------- No, this isnt about sharing a hallucinogen-laced bong for a smoke. The hash were referring to here is the one that Wikipedia aptly but unhelpfully defines as a derivation of data, notably used in cryptographic hash functions. Passing the hash is a form of login credential theft that is quite prevalent. In it, an attacker captures the encoded session password (the hash) from one computer, and then re-uses it to illicitly access another computer. On (most configurations of) the Microsoft Windows... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19479&rss *** SSL Labs unveils free open source tool, new APIs *** --------------------------------------------- Qualys SSL Labs now includes free assessment APIs, accompanied by a free open source tool that can be used for bulk and automated testing of websites. These new enhancements provide the same results a... --------------------------------------------- http://www.net-security.org/secworld.php?id=18096 *** Apple-Browser: Update für drei Safari-Versionen behebt Sicherheitslücken *** --------------------------------------------- Apple hat in der Nacht zum Mittwoch Aktualisierungen für Safari unter OS X Mountain Lion, OS X Mavericks und OS X Yosemite veröffentlicht. Damit werden teils schwerwiegende Fehler ausgebügelt. --------------------------------------------- http://www.heise.de/newsticker/meldung/Apple-Browser-Update-fuer-drei-Safar… *** Fatally flawed RC4 should just die, shout angry securobods *** --------------------------------------------- Its the Swiss Cheese of infosec and were all gazing through its holes Security researchers have banged another nail into the coffin of the ageing RC4 encryption algorithm. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/03/18/kill_rc4_sa… *** Mobile Android, iOS Apps Still Vulnerable to FREAK Attacks *** --------------------------------------------- FireEye scanned iOS and Android apps downloaded billions of times in aggregate and determined that, despite the availability of patches, because the apps still connect to vulnerable HTTPS servers, they're subject to FREAK attacks. --------------------------------------------- http://threatpost.com/mobile-android-ios-apps-still-vulnerable-to-freak-att… *** Cisco Content Services Switch (11500) Unauthenticated Port Forwarding Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=37889 *** VU#868948: HP ArcSight contains multiple vulnerabilities *** --------------------------------------------- Vulnerability Note VU#868948 HP ArcSight contains multiple vulnerabilities Original Release date: 17 Mar 2015 | Last revised: 17 Mar 2015 Overview HP ArcSight contains multiple vulnerabilities. Description CWE-434: Unrestricted Upload of File with Dangerous Type - CVE PendingHP ArcSight Logger 5.3.1.6838.0 configuration import file upload capability does not sanitize file names, which allows a remote, authenticated attacker to put arbitrary files into the document root. This vulnerability... --------------------------------------------- http://www.kb.cert.org/vuls/id/868948 *** Security Advisory - Resource Management Vulnerability in the AR1220 *** --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** Security Advisory - Directory File Deletion Vulnerability in UDS *** --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** Security Advisory - Multiple Injection Vulnerabilities in UDS *** --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** [DSA 3195-1] php5 security update *** --------------------------------------------- Multiple vulnerabilities have been discovered in the PHP language: CVE-2015-2305 - Guido Vranken discovered a heap overflow in the ereg extension (only applicable to 32 bit systems). ... CVE-2015-0231 - Stefan Esser discovered a use-after-free in the unserialisation of objects. CVE-2015-0232 - Alex Eubanks discovered incorrect memory management in the exif extension. CVE-2015-0273 - Use-after-free in the unserialisation of DateTimeZone. --------------------------------------------- https://lists.debian.org/debian-security-announce/2015/msg00080.html *** XZERES 442SR Wind Turbine Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a cross-site request forgery vulnerability in XZERES's 442SR turbine generator operating system. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-076-01 *** Honeywell XL Web Controller Directory Traversal Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a directory traversal vulnerability in Honeywell's XL Web Controller. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-076-02

1 0

Tageszusammenfassung - Dienstag 17-03-2015
by Daily end-of-shift report 17 Mar '15

17 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 16-03-2015 18:00 − Dienstag 17-03-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** 3046310 - Improperly Issued Digital Certificates Could Allow Spoofing - Version: 1.0 *** --------------------------------------------- Microsoft is aware of an improperly issued SSL certificate for the domain “live.fi” that could be used in attempts to spoof content, perform phishing attacks, or perform man-in-the-middle attacks. It cannot be used to issue other certificates, impersonate other domains, or sign code. This issue affects all supported releases of Microsoft Windows. Microsoft is not currently aware of attacks related to this issue. --------------------------------------------- https://technet.microsoft.com/en-us/library/security/3046310 *** Man who obtained Windows Live cert said his warnings went unanswered *** --------------------------------------------- "I tried, just for fun," said man who reported hole to Microsoft and authorities. --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/GS2QPGGMdJ0/ *** Forthcoming OpenSSL releases *** --------------------------------------------- The OpenSSL project team would like to announce the forthcoming release of OpenSSL versions 1.0.2a, 1.0.1m, 1.0.0r and 0.9.8zf. These releases will be made available on 19th March. They will fix a number of security defects. The highest severity defect fixed by these releases is classified as "high" severity. --------------------------------------------- https://mta.openssl.org/pipermail/openssl-users/2015-March/000778.html *** From PEiD To YARA, (Tue, Mar 17th) *** --------------------------------------------- Some time ago, Jim Clausing had a diary entry about PeID (a packer identifier) and since then he has a PEiD signature database on his handler page. Now, wouldnt it be great if we could reuse these signatures? For example as YARA rules? Thats why I wrote a Python program that converts PEiD signatures to YARA rules: peid-userdb-to-yara-rules.py Here is an example: PEiD signature: [!EP (ExE Pack) V1.0 - Elite Coding Group] signature = 60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 ep_only = true Generated... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19473&rss *** Zweifaktor-Dienst Authy ließ jeden rein *** --------------------------------------------- Zwei-Faktor-Authentifizierung ist eine sichere Sache - wenn sie denn funktioniert. Authy, das von vielen prominenten Sites eingesetzt wird, ließ sich bis vor kurzem mit dem Generalschlüssel "../sms" umgehen. --------------------------------------------- http://heise.de/-2576764 *** D-Link patches critical flaws in wireless range extender, Wi-Fi cameras firmware *** --------------------------------------------- D-Link has released new firmware for its DAP-1320 wireless range extender and the DCS-93xL family of Wi-Fi cameras in order to patch two critical vulnerabilities that can lead to device hijacking. ... --------------------------------------------- www.net-security.org/secworld.php?id=18093 *** Search for vulnerable servers unearths weak, thousands-times repeated RSA keys *** --------------------------------------------- A group of researchers from the Information Security Group from Royal Holloway, University of London, wanted to see how many TLS servers still supported the weak, export-grade (512-bit) RSA public key... --------------------------------------------- http://www.net-security.org/secworld.php?id=18094 *** Cisco Virtual TelePresence Server Serial Console Privileged Access Vulnerability *** --------------------------------------------- Cisco Virtual TelePresence Server Software contains a vulnerability that could allow an authenticated, local attacker to gain unauthorized access with elevated privileges. Updates are available. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=37869 *** DSA-3192 checkpw - security update *** --------------------------------------------- Hiroya Ito of GMO Pepabo, Inc. reported that checkpw, a passwordauthentication program, has a flaw in processing account names whichcontain double dashes. A remote attacker can use this flaw to cause adenial of service (infinite loop). --------------------------------------------- https://www.debian.org/security/2015/dsa-3192 *** Intel Network Adapter Diagnostic Driver IOCTL Handling Vulnerability *** --------------------------------------------- Topic: Intel Network Adapter Diagnostic Driver IOCTL Handling Vulnerability Risk: High Text:/* Intel Network Adapter Diagnostic Driver IOCTL Handling Vulnerability Vendor: Intel Product webpage: http://www.intel.co... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015030110 *** TYPO3 CMS 6.2.11 released *** --------------------------------------------- The TYPO3 Community announces the version 6.2.11 LTS of the TYPO3 Enterprise Content Management System. --------------------------------------------- http://www.typo3.org/news/article/typo3-cms-6211-released/ *** HPSBHF03293 rev.1 - HP Virtual Connect 8Gb 24-Port FC Module running OpenSSL and Bash, Remote Denial of Service (DoS), Code Execution, Disclosure of Information *** --------------------------------------------- Potential security vulnerabilities have been identified with HP Virtual Connect 8Gb 24-Port FC Module running OpenSSL and Bash including: The OpenSSL vulnerability known as "Heartbleed" which could be exploited remotely resulting in Denial of Service (DoS) or disclosure of information. The SSLv3 vulnerability known as "Padding Oracle on Downgraded Legacy Encryption" also known as "Poodle", which could be exploited remotely resulting in disclosure of information. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_…

1 0

Tageszusammenfassung - Montag 16-03-2015
by Daily end-of-shift report 16 Mar '15

16 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 13-03-2015 18:00 − Montag 16-03-2015 18:00 Handler: Robert Waldner Co-Handler: n/a *** ICS-CERT Monitor Quarterly Report - Phishing Reigns Supreme (March 12, 2015) *** --------------------------------------------- According to a quarterly report from the US Industrial Control System Computer Emergency Response Team (ICS-CERT), industrial control systems were targets of cyber attacks at least 245 times in the 12-month period between October 1, 2013 and September 30, 2014....... --------------------------------------------- http://www.sans.org/newsletters/newsbites/r/17/20/200 *** Security Advisory - NTPd Security Vulnerability in Multiple Huawei Products *** --------------------------------------------- Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote attackers to execute arbitrary code via a crafted packet. Multiple Huawei products have this vulnerability. ( Vulnerability ID: HWPSIRT-2014-1276) --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** TeslaCrypt ransomware attacks gamers - "all your files are belong to us!" *** --------------------------------------------- TeslaCrypt is a new ransomware that goes above and beyond CryptoLocker in the types of files it seeks out to hold for ransom, including those related to video games. SophosLabs dug in to find out what TeslaCrypt has in store for gamers, and everyone else. --------------------------------------------- https://nakedsecurity.sophos.com/2015/03/16/teslacrypt-ransomware-attacks-g… *** Safari: Alte Sicherheitslücke speichert URLs auch im Private-Browsing-Modus *** --------------------------------------------- Normalerweise sollte ein Browser alle angesurften Adressen vergessen, wenn er im 'Privatmodus' genutzt wird. Apples Safari tut das allerdings nicht - die besuchten Adressen landen in einer ungeschützten Datenbank. --------------------------------------------- http://heise.de/-2575426 *** Attacks Only Get Better: Password Recovery Attacks Against RC4 in TLS *** --------------------------------------------- We provide new attacks against RC4 in TLS that are focussed on recovering user passwords, still the pre-eminent means of user authentication on the Web today. Our attacks enhance the statistical techniques used in the previous attacks and exploit specific features of the password setting to produce attacks that are much closer to being practical. We report on extensive simulations that illustrate this. --------------------------------------------- http://www.isg.rhul.ac.uk/tls/RC4mustdie.html *** Talk at Troopers15 *** --------------------------------------------- Peter Kieseberg and Sebastian Schrittwieser give a talk about 'iAnalyze - Automated security analysis of iOS apps' at the 'Hacking Mobiles Vol. 2.1 - MMA: Mobile Malicious Apps' workshop, which is held at Troopers15 conference in Heidelberg, Germany. --------------------------------------------- https://www.sba-research.org/2015/03/16/talk-at-troopers15/ *** Cisco Security Advisories *** * Cisco AnyConnect Secure Mobility Client Arbitrary File Write Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=37863 * Cisco AnyConnect Secure Mobility Client Hostscan Path Traversal Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=37862 * Cisco AnyConnect Secure Mobility Client Arbitrary Code Execution Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=37861 * Cisco AnyConnect Secure Mobility Client Arbitrary Code Execution Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=37860

1 0

Tageszusammenfassung - Freitag 13-03-2015
by Daily end-of-shift report 13 Mar '15

13 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 12-03-2015 18:00 − Freitag 13-03-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Security updates available for Adobe Flash Player (APSB15-05) *** --------------------------------------------- A Security Bulletin (APSB15-05) has been published regarding security updates for Adobe Flash Player. These updates address critical vulnerabilities, and Adobe recommends users update their product installations to the latest versions using the instructions referenced in the security bulletin. This... --------------------------------------------- https://blogs.adobe.com/psirt/?p=1185 *** After Delays, Samsung Patches Social Media Vulnerability in Millions of Devices *** --------------------------------------------- Samsung patched a vulnerability last month in SNS Provider that if exploited could have given attackers the ability to access to any personal information users stored on Facebook, LinkedIn and Twitter. --------------------------------------------- http://threatpost.com/after-delays-samsung-patches-social-media-vulnerabili… *** Blind SQL Injection against WordPress SEO by Yoast, (Fri, Mar 13th) *** --------------------------------------------- WordPress has released an advisory for the WordPress plugin SEO by Yoast. Version up to and including 1.7.3.3 can be exploited with a blind SQL injection. According to WordPress, this plugin has more than one million downloads. A description of the SQL injection with proof of concept is described here and the latest update is available here. [1] https://wordpress.org/plugins/wordpress-seo/ [2] https://downloads.wordpress.org/plugin/wordpress-seo.1.7.4.zip [3] --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19457&rss *** Achievement Locked: New Crypto-Ransomware Pwns Video Gamers *** --------------------------------------------- Gamers may be used to paying to unlock downloadable content in their favorite games, but a new crypto-ransomware variant aims to make gamers pay to unlock what they already own. Data files for more than 20 games can be affected by the threat, increasing what is already a large target for cybercriminals. Another file type... --------------------------------------------- http://labs.bromium.com/2015/03/12/achievement-locked-new-crypto-ransomware… *** VIRLOCK Combines File Infection and Ransomware *** --------------------------------------------- Analysis by Jaaziel Carlos, Jonh Chua, and Rodwin Fuentes Ransomware has become one of the biggest problems for end users are as of late. In the past months alone, we have reported on several variants of both ransomware and crypto-ransomware, each with their own "unique" routines. We recently came across one malware family, detected as... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/eJWas-XoY6I/ *** Microsoft EMET 5.2 is available, (Fri, Mar 13th) *** --------------------------------------------- Microsoft has announced a new release of the Enhanced Mitigation Experience Toolkit (EMET) 5.2. The main the main changes and improvements as the following: Control Flow Guard:EMETs native DLLs have been compiled with Control Flow Guard(CFG). CFG is a new feature introduced in Visual Studio 2015 (and supported by Windows 8.1 and Windows 10) that helps detect and stop attempts of code hijacking. EMET native DLLs (i.e. EMET.DLL) are injected into the application process EMET protects. Since we --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19461&rss *** Adobe schließt kritische Lücken in Flash *** --------------------------------------------- Ein neues Update für den Flash-Player schließt elf Sicherheitslücken und ist für alle Plattformen verfügbar. Eine zügige Installation ist ratsam, da Angreifer im schlimmsten Fall das System übernehmen könnten. --------------------------------------------- http://heise.de/-2574278 *** Bootschleife nach SHA-2-Update für Windows 7 *** --------------------------------------------- Böse Überraschung für einige Nutzer mit Linux-Dual-Boot: Ein Windows-7-Update vom letzten Patchday stürzt den Rechner in eine Bootschleife. Das scheint allerdings nur beim Booten über das klassische BIOS aufzutreten, UEFI-Nutzer haben Glück. --------------------------------------------- http://heise.de/-2574289 *** BlackBerry has no fix for devices vulnerable to FREAK security flaw *** --------------------------------------------- Summary:The company, lauded for having the worlds most protected devices for encrypted messaging, warns that devices will be vulnerable to a serious security flaw until a patch is released. --------------------------------------------- http://www.zdnet.com/article/blackberry-slow-to-respond-to-freak-flaw-says-… *** Mozilla Releases Open Source Masche Forensics Tool *** --------------------------------------------- Mozilla has released an open source memory forensics tool that some college students designed and built during the company's recent Winter of Security event. The new tool, known as Masche, is designed specifically for investigating server memory and has the advantage of being able to scan running processes without causing any problems with the machine. --------------------------------------------- http://threatpost.com/mozilla-releases-open-source-masche-forensics-tool/11… *** Google-Panne: Inhaberdaten von 300.000 geschützten Domains einsehbar *** --------------------------------------------- Google bietet seinen Kunden die Möglichkeit, Domains zu registrieren, ohne dass dabei persönliche Daten in den Whois-Einträgen auftauchen. Durch einen Bug waren die Informationen trotzdem abrufbar. --------------------------------------------- http://heise.de/-2574423 *** Bypassing ASLR with CVE-2015-0071: An Out-of-Bounds Read Vulnerability *** --------------------------------------------- Almost every Patch Tuesday cycle contains one bulletin that (for convenience) rolls up multiple Internet Explorer vulnerabilities into a single bulletin. February's Patch Tuesday cumulative IE bulletin (MS15-009) included a fix for a particularly interesting vulnerability that could be used to bypass one of the key anti-exploit technologies in use today, address space layout randomization... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/35xufNRKED8/ *** Security Afterworks: Cybercrime - Lessons From the Field & Best Of Troopers15 *** --------------------------------------------- Cybercrime – wie reagieren nach einem Vorfall? Die Frage ist schon längst nicht mehr ob, sondern wann Sie zum Ziel werden. Andreas Tomek informiert beim Security Afterworks im April über Lessons from the field – Incident Response & Cybercrime in Österreich. Danach geht es mit den Hot Topics der Troopers15 weiter. Lassen Sie sich von uns auf den neuesten Stand bringen! Dienstag, 14. April 2015 16.30 Uhr ab 17.30 Uhr gemütlicher Ausklang SBA Research --------------------------------------------- https://www.sba-research.org/events/security-afterworks-cybercrime-lessons-… https://www.sba-research.org/wp-content/uploads/2015/03/Security-Afterworks… *** Cisco FREAKs out, starts epic OpenSSL bug-splat *** --------------------------------------------- Happy weekend, network admins Cisco admins will be watching and waiting for fixes, with the company announcing that many of its OpenSSL implementations are carrying a bunch of post-POODLE fleas. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/03/13/cisco_freak… *** Samsung SNS Provider Application For Android Access Theft *** --------------------------------------------- Topic: Samsung SNS Provider Application For Android Access Theft Risk: Low Text: Fundacion Dr. Manuel Sadosky - Programa STIC Advisory www.fundacionsadosky.org.ar *Vulnerabilities in the Samsung SNS ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015030093 *** HP Security Bulletins *** --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** DSA-3186 nss - security update *** --------------------------------------------- It was discovered that the Mozilla Network Security Service library(nss) incorrectly handled certain ASN.1 lengths. A remote attacker couldpossibly use this issue to perform a data-smuggling attack. --------------------------------------------- https://www.debian.org/security/2015/dsa-3186 *** DSA-3185 libgcrypt11 - security update *** --------------------------------------------- Multiple vulnerabilities were discovered in libgcrypt: --------------------------------------------- https://www.debian.org/security/2015/dsa-3185 *** DSA-3184 gnupg - security update *** --------------------------------------------- Multiple vulnerabilities were discovered in GnuPG, the GNU Privacy Guard: --------------------------------------------- https://www.debian.org/security/2015/dsa-3184 *** WPML Multiple Vulnerabilities (Including SQLi) *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7843 *** Schneider Electric Pelco DS-NVs Buffer Overflow Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a buffer overflow vulnerability in the Schneider Electric Pelco DS-NVs software package. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-071-01 *** Xen Multiple Flaws Let Local Guest Users Deny Service or Obtain Information From Other Guest Systems *** --------------------------------------------- http://www.securitytracker.com/id/1031806

1 0

Tageszusammenfassung - Donnerstag 12-03-2015
by Daily end-of-shift report 12 Mar '15

12 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 11-03-2015 18:00 − Donnerstag 12-03-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Cyber Security in Supply Chain Management: Part 1 *** --------------------------------------------- Introduction Cyber security is generally thought of as various types of security devices like firewalls, Web Application Firewall (WAF), IDS/IPS, SIEM, DLP etc. to safeguard network, applications and data. But what if, for example, the deployed security solutions have a bug inside? The latest example of this is exposing of a vulnerability in Lenovo notebooks. --------------------------------------------- http://resources.infosecinstitute.com/cyber-security-in-supply-chain-manage… *** Paper: Windows 10 patching process may leave enterprises vulnerable to zero-day attacks *** --------------------------------------------- Aryeh Goretsky gives advice on how to adapt to Windows 10s patching strategy.Patching is hard, especially when the code base is old and the bugs are buried deeply. This was highlighted once again this week when Microsoft released a patch for a vulnerability that was thought to have been patched almost five years ago, but which could still be exploited.In fact, six out of the last eight Patch Tuesdays have included patches that have caused problems for some Windows users.Probably in response to... --------------------------------------------- http://www.virusbtn.com/blog/2015/03_12.xml?rss *** Microsoft SHA-2 Advisory Causing "Infinite Loop" Issues *** --------------------------------------------- Windows users are having issues with a security update issued this week meant to add SHA-2 code-signing and verification support to Windows 7 and Windows Server 2008 R2 machines. --------------------------------------------- http://threatpost.com/microsoft-sha-2-advisory-causing-infinite-loop-issues… *** Schwerwiegende Sicherheitslücke im Shop-System xt:Commerce *** --------------------------------------------- Derzeit klafft eine Sicherheitslücke im aktuellen Versionszweig des verbreiteten Online-Shop-Systems xt:Commerce. Ein Patch ist bereits verfügbar. --------------------------------------------- http://heise.de/-2573755 *** Who got the bad SSL Certificate? Using tshark to analyze the SSL handshake., (Thu, Mar 12th) *** --------------------------------------------- Ever wonder if any of your users connect to sites with bad SSL certificates? I ran into this issue recently when debugging some SSL issues, and ended up with thisquick tshark and shell script trickto extract the necessary information from a packet capture. First, you may want to compare the host name your clients connect to, to the host name returned as part of the certificate. While the Host header is encrypted and not accessible, modern SSL libraries use Server Name Indication (SNI) as part... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19455&rss *** Defending Against PoS RAM Scrapers *** --------------------------------------------- Stealing payment card data has become an everyday crime that yields quick monetary gains. Attackers aim to steal the data stored in the magnetic stripe of payment cards, optionally clone the cards, and run charges on the accounts associated with them. The topic of PoS RAM scraper malware always prompts businesses and retailers to ask... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/CYPwDbRGFfc/ *** Dropbox Patches Remotely Exploitable Vulnerability in SDK *** --------------------------------------------- Developers at Dropbox recently fixed a remotely exploitable vulnerability in the Android SDK version of the app that enabled attackers to connect applications on some devices to a Dropbox account without the users consent. --------------------------------------------- http://threatpost.com/dropbox-patches-remotely-exploitable-vulnerability-in… *** Inverted WordPress Trojan *** --------------------------------------------- Trojan (or trojan horse) is software that does (or pretends to be doing) something useful but also contains a secret malicious payload that inconspicuously does something bad. In WordPress, typical trojans are plugins and themes (usually pirated) which may have backdoors, or send out spam, create doorways, inject hidden links or malware. The trojan modelRead More --------------------------------------------- http://blog.sucuri.net/2015/03/inverted-wordpress-trojan.html *** RSA Digital Certificate Manager Input Validation Flaws Permit Cross-Site Scripting and Denial of Service Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1031912 *** EMC Secure Remote Services GHOST / SQL Injection / Command Injection *** --------------------------------------------- Topic: EMC Secure Remote Services GHOST / SQL Injection / Command Injection Risk: High Text:ESA-2015-040: EMC Secure Remote Services Virtual Edition Security Update for Multiple Vulnerabilities CVE Identifier: CVE-2... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015030076 *** Google Android Integer Oveflow / Heap Corruption *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2015030079 *** phpMyAdmin Bug May Disclose CSRF Token to Remote Users *** --------------------------------------------- http://www.securitytracker.com/id/1031871 *** Elipse E3 Process Control Vulnerability (Update A) *** --------------------------------------------- This updated advisory is a follow-up to the original advisory titled ICSA-15-069-04 Elipse E3 Process Control Vulnerability that was published March 10, 2015, on the NCCIC/ICS-CERT web site. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-069-04A *** IBM Security Bulletin: Apache Tomcat request smuggling affects Algo Audit and Compliance (CVE-2014-0227) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21698437 *** IBM Security Bulletin: IBM PowerVC - Ceilometer DB2/MongoDB Backend Password Leak (CVE-2013-6384) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=nas8N1020585 *** IBM Security Bulletin: GNU C library (glibc) vulnerability affects IBM/Cisco Switches and Directors (CVE-2015-0235) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ssg1S1005122 *** IBM Security Bulletin: Multiple IBM InfoSphere Information Server components are affected by a vulnerability in the XML4C parser (CVE-2014-8901) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21696312 *** SA-CONTRIB-2015-077 - OG tabs - Cross Site Scripting (XSS) *** --------------------------------------------- https://www.drupal.org/node/2450427 *** SA-CONTRIB-2015-076 - Image Title - Cross Site Scripting (XSS) *** --------------------------------------------- https://www.drupal.org/node/2450393 *** SA-CONTRIB-2015-075 - Perfecto - Open Redirect *** --------------------------------------------- https://www.drupal.org/node/2450391 *** SA-CONTRIB-2015-074 - Site Documentation - Cross Site Scripting (XSS) *** --------------------------------------------- https://www.drupal.org/node/2450387 *** Pie Register 2.0.14 - Cross Site Scripting (XSS) *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7842

1 0

Tageszusammenfassung - Mittwoch 11-03-2015
by Daily end-of-shift report 11 Mar '15

11 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 10-03-2015 18:00 − Mittwoch 11-03-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Inside the EquationDrug Espionage Platform *** --------------------------------------------- EquationDrug represents the main espionage platform from the Equation Group. It's been in use for over 10 years, replacing EquationLaser until it was itself replaced itself by the even more sophisticated GrayFish platform. --------------------------------------------- http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage… *** DroppedIn: Remotely Exploitable Vulnerability in the Dropbox SDK for Android *** --------------------------------------------- The IBM X-Force Application Security Research Team has discovered a vulnerability in the Dropbox SDK for Android (CVE-2014-8889) which allows attackers to connect applications on mobile devices to a Dropbox account controlled by the attacker without the victim's knowledge or authorization. This is a serious flaw in the authentication mechanism within any Android app using a Dropbox SDK Version 1.5.4 through 1.6.1 (note: this vulnerability was resolved in Dropbox SDK for Android v1.6.2). --------------------------------------------- http://securityintelligence.com/droppedin-remotely-exploitable-vulnerabilit… *** Unpatched security vulnerabilities affecting Facebook *** --------------------------------------------- A web security researcher from Portugal has discovered several vulnerabilities affecting Facebook that he considers to be serious, but hasnt had much success convincing the company of that, so he sha... --------------------------------------------- http://www.net-security.org/secworld.php?id=18069 *** Reconnect tool for hacking Facebook is publicly available *** --------------------------------------------- The security expert Egor Homakov from Sakurity firm has released the Reconnect tool that allows hackers to hijack accounts on sites that use Facebook logins. The security expert Security Egor Homakov has developed a hacking tool dubbed Reconnect that exploit a flaw in Facebook to hijack accounts on sites that use Facebook logins. Homakov, with works for... --------------------------------------------- http://securityaffairs.co/wordpress/34705/hacking/reconnect-hacking-faceboo… *** DDoS on UPNP Devices *** --------------------------------------------- Denial of service (DOS) attack is an attempt to make a machine or a network resource unavailable to its users. It basically consists of methods to temporarily or indefinitely interrupt or suspend services of a host connected to the Internet, and these attacks are sent by one person or a system. One common method of... --------------------------------------------- http://resources.infosecinstitute.com/ddos-upnp-devices/ *** Full details on CVE-2015-0096 and the failed MS10-046 Stuxnet fix *** --------------------------------------------- In early January 2015, researcher Michael Heerklotz approached the Zero Day Initiative with details of a vulnerability in the Microsoft Windows operating system. We track this issue as ZDI-15-086. Unless otherwise noted, the technical details in this blog post are based on his detailed research. --------------------------------------------- http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Full-details-on-CVE-… *** Threatglass has pcap files with exploit kit activity, (Tue, Mar 10th) *** --------------------------------------------- Threatglassis a one way to find up-to-date examples of exploit kit traffic. Not all of it is exploit kit traffic, but all of it represents some sort of malicious activity. Threatglassdoesnt explain what type of traffic youre looking at from the pcaps the site provides. Letslook at a page from last week on Thursday, March 5th 2015 [1]. This one isexploit kit activity. In the image below, youll find a link to the packet capture in the lower right-hand corner" /> Download the pcap and open... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19433&rss *** n00bs CTF Labs by Infosec Institute *** --------------------------------------------- n00bs CTF (Capture the Flag) Labs is a web application presented by Infosec Institute. It has 15 mini Capture the Flag challenges intended for beginners and newbies in the information security field or for any average infosec enthusiasts who haven't attended hacker conventions yet. So what is a CTF? In hacker conventions, CTF or Capture... --------------------------------------------- http://resources.infosecinstitute.com/n00bs-ctf-labs-infosec-institute/ *** Achtung: Panda-Virenscanner zerschießt Windows, nicht Neustarten! *** --------------------------------------------- Die Antivirenschutz-Produkte von Panda Security haben wegen fehlerhaften Signaturen etliche Windows-Rechner lahm gelegt. Wer betroffen ist, soll die Füße still halten und das System nicht neu starten - da es unter Umständen nicht mehr hochfährt. --------------------------------------------- http://heise.de/-2573233 *** Panda Antivirus: Gravierender Fehler im Virenscanner löscht Systemdateien *** --------------------------------------------- Ein gravierender Fehler in Pandas Antivirensoftware kann unter Umständen zu einem vollkommen unbrauchbaren System führen. Panda bestätigt das Problem. Golem.de hat erste Hinweise erhalten, wie der Fehler zu stoppen ist. (Virenscanner, Applikationen) --------------------------------------------- http://www.golem.de/news/panda-antivirus-gravierender-fehler-im-virenscanne… *** Doctor Web: February 2015 virus activity review *** --------------------------------------------- March 4, 2015 The shortest month of the year had its share of new malware. In early February, Doctor Web security researchers finished examining a complex multi-purpose malicious program for Linux, while at month's end, they published the results of their analysis of a new version of a backdoor for Mac OS X. As before, malicious programs for Android remained active throughout the month. PRINCIPAL TRENDS IN JANUARY New Linux Trojans Virus makers are still showing an interest in Mac OS X. --------------------------------------------- http://news.drweb.com/show/?i=9316&lng=en&c=9 *** Ein Blick in die Zukunft der Handy-Malware *** --------------------------------------------- Kaspersky hat eine Analyse zu einer Android-Malware veröffentlicht, die zwar aktuell nur in Russland aktiv ist, aber einen Vorgeschmack gibt, was demnächst auch bei uns passieren könnte: Wichtige Punkte daraus: Das Teil ist inzwischen so modular und gut geschützt, wie typische Windows Malware Frameworks Es enthält Code zum Anmelden des Opfers bei diversen Premium-Services Dabei kann es automatisch... --------------------------------------------- http://www.cert.at/services/blog/20150311102554-1454.html *** DSA-3177 mod-gnutls - security update *** --------------------------------------------- Thomas Klute discovered that in mod-gnutls, an Apache module providingSSL and TLS encryption with GnuTLS, a bug caused the servers clientverify mode not to be considered at all, in case the directorysconfiguration was unset. Clients with invalid certificates were thenable to leverage this flaw in order to get access to that directory. --------------------------------------------- https://www.debian.org/security/2015/dsa-3177 *** DSA-3182 libssh2 - security update *** --------------------------------------------- Mariusz Ziulek reported that libssh2, a SSH2 client-side library, wasreading and using the SSH_MSG_KEXINIT packet without doing sufficientrange checks when negotiating a new SSH session with a remote server. Amalicious attacker could man in the middle a real server and cause aclient using the libssh2 library to crash (denial of service) orotherwise read and use unintended memory areas in this process. --------------------------------------------- https://www.debian.org/security/2015/dsa-3182 *** Manage Engine AD Audit Manager Plus Cross Site Scripting *** --------------------------------------------- Topic: Manage Engine AD Audit Manager Plus Cross Site Scripting Risk: Low Text: # Title:- Reflected cross-site scripting(XSS) Vulnerability in Manage Engine AD Audit Manager Plus Admin Panel(Bui... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015030060 *** tcpdump Denial Of Service / Code Execution *** --------------------------------------------- Topic: tcpdump Denial Of Service / Code Execution Risk: High Text:Hi, please find tcpdump 4.7.2 source code at: http://www.ca.tcpdump.org/beta/tcpdump-4.7.2.tar.gz http://www.ca.tcpdu... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015030064 *** Cisco Intrusion Prevention System MainApp Secure Socket Layer Denial of Service Vulnerability *** --------------------------------------------- cisco-sa-20150311-ips --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Multiple Vulnerabilities in Cisco TelePresence Video Communication Server, Cisco Expressway, and Cisco TelePresence Conductor *** --------------------------------------------- cisco-sa-20150311-vcs --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** IBM Security Bulletin: Multiple vulnerabilities fixed in Current Release of Liberty for Java for IBM Bluemix (CVE-2012-6153, CVE-2014-3577, CVE-2015-0178) *** --------------------------------------------- 2015-03-11T10:06:12-04:00 --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21696864 *** Citrix XenServer Multiple Security Updates *** --------------------------------------------- A number of security vulnerabilities have been identified in Citrix XenServer. These vulnerabilities could, if exploited, allow ... --------------------------------------------- http://support.citrix.com/article/CTX200484 *** HPSBNS03280 rev.1 - HP NonStop Servers running SAMBA, Remote Execution of Arbitrary Code *** --------------------------------------------- A potential security vulnerability has been identified with HP NonStop Servers running SAMBA. The vulnerability could be exploited remotely resulting in execution of arbitrary code. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** HPSBUX03281 SSRT101968 rev.1 - HP-UX running Java7, Remote Unauthorized Access, Disclosure of Information and Other Vulnerabilities *** --------------------------------------------- Potential security vulnerabilities have been identified in the Java Runtime Environment (JRE) and the Java Developer Kit (JDK) running on HP-UX. These vulnerabilities could allow remote unauthorized access, disclosure of information, and other vulnerabilities. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** USN-2524-1: eCryptfs vulnerability *** --------------------------------------------- Ubuntu Security Notice USN-2524-110th March, 2015ecryptfs-utils vulnerabilityA security issue affects these releases of Ubuntu and its derivatives: Ubuntu 14.10 Ubuntu 14.04 LTS Ubuntu 12.04 LTS Ubuntu 10.04 LTSSummarySensitive information in encrypted home and Private directories could beexposed if an attacker gained access to your files.Software description ecryptfs-utils - eCryptfs cryptographic filesystem utilities DetailsSylvain Pelissier discovered that eCryptfs did not generate a random --------------------------------------------- http://www.ubuntu.com/usn/usn-2524-1/ *** USN-2522-3: ICU vulnerabilities *** --------------------------------------------- Ubuntu Security Notice USN-2522-310th March, 2015icu vulnerabilitiesA security issue affects these releases of Ubuntu and its derivatives: Ubuntu 12.04 LTSSummaryICU could be made to crash or run programs as your login if it processedspecially crafted data. Software description icu - International Components for Unicode library DetailsUSN-2522-1 fixed vulnerabilities in ICU. On Ubuntu 12.04 LTS, the fontpatches caused a regression when using LibreOffice Calc. The patches havenow been updated --------------------------------------------- http://www.ubuntu.com/usn/usn-2522-3/ *** VU#794095: Telerik Analytics Monitor Library allows DLL hijacking *** --------------------------------------------- Vulnerability Note VU#794095 Telerik Analytics Monitor Library allows DLL hijacking Original Release date: 10 Mar 2015 | Last revised: 10 Mar 2015 Overview Telerik Analytics Monitor Library is a third-party application analytics service that collects detailed application metrics for vendors. Some versions of the Telerik library allow DLL hijacking, allowing an attacker to load malicious code in the context of the Telerik-based application. Description CWE-114: Process ControlTelerik --------------------------------------------- http://www.kb.cert.org/vuls/id/794095 *** WordPress SEO by Yoast <= 1.7.3.3 - Blind SQL Injection *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7841

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily