Daily

daily@lists.cert.at

1 participants
3085 discussions

Tageszusammenfassung - Dienstag 27-01-2015
by Daily end-of-shift report 27 Jan '15

27 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 26-01-2015 18:00 − Dienstag 27-01-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Java is the biggest vulnerability for US computers *** --------------------------------------------- Oracles Java poses the single biggest security risk to US desktops, according to a new report from Copenhagen-based security vendor Secunia ApS, because of its penetration rate, number of vulnerabilities, and patch status.According to the report, 48 percent of users arent running the .. --------------------------------------------- http://www.csoonline.com/article/2875535/application-security/java-is-the-b… *** Beyond "fake invoice" scams - crooks can get money out of real invoices, too! *** --------------------------------------------- If I told you to change your record of a suppliers bank account so I got all the payments, would you do so? 1000s of companies did, and didnt spot the misdirected payments until an average of $100,000 had gone west... --------------------------------------------- https://nakedsecurity.sophos.com/2015/01/26/beyond-fake-invoice-scams-crook… *** ENISA draws the Cyber Threat Landscape 2014: 15 top cyber threats, cyber threat agents, cyber-attack methods and threat trends for emerging technology areas *** --------------------------------------------- ENISA's Threat Landscape 2014 (ETL 2014) published today is the third yearly report in sequence, consolidating and analysing the top cyber threats and the evolution, encountered in 2014. ENISA Threat Landscape 2014, an activity contributing towards achieving the objectives formulated in the Cyber Security Strategy for the EU, stresses the importance of threat analysis and the identification of emerging trends in cyber security. --------------------------------------------- http://www.enisa.europa.eu/media/press-releases/enisa-draws-the-cyber-threa… *** Critical glibc update (CVE-2015-0235) in gethostbyname() calls *** --------------------------------------------- A heap-based buffer overflow was found in glibc's __nss_hostname_digits_dots() function, which is used by the gethostbyname() and gethostbyname2() glibc function calls. A remote attacker able to make an application call either of these functions could use this flaw to execute arbitrary code with the permissions of the user running the application. --------------------------------------------- http://ma.ttias.be/critical-glibc-update-cve-2015-0235-gethostbyname-calls/ *** Security updates available for Adobe Flash Player *** --------------------------------------------- Adobe has released security updates for Adobe Flash Player for Windows, Macintosh and Linux. These updates address vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe is aware of reports that CVE-2015-0311 is actively being exploited in the wild via drive-by-download attacks against systems running Internet Explorer and Firefox on Windows 8.1 and below. Adobe recommends .. --------------------------------------------- https://helpx.adobe.com/security/products/flash-player/apsb15-03.html

1 0

Tageszusammenfassung - Montag 26-01-2015
by Daily end-of-shift report 26 Jan '15

26 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 23-01-2015 18:00 − Montag 26-01-2015 18:00 Handler: Robert Waldner Co-Handler: n/a *** System Center Endpoint Protection support for Windows Server 2003 *** --------------------------------------------- >From July 14, 2015, Windows Server 2003 will cease to be a supported operating system. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/01/23/system-center-endpoint-p… *** Sicherheitslücke in Millionen Android-Geräten: Google empfiehlt Chrome oder Firefox als Abhilfe *** --------------------------------------------- Scharfe Kritik gibt es seit bekannt wurde, dass Google Sicherheitslücken im alten Standard-Browser von Android nicht mehr schließen will. Die Abhilfe, die Google nun empfiehlt, ist nicht so recht befriedigend. --------------------------------------------- http://heise.de/-2528130 *** OS X 10.10.2: Apple patcht "Thunderstrike"-Angriff und Googles Zeroday-Lücken *** --------------------------------------------- In der jüngsten Yosemite-Beta sollen gleich mehrere problematische Fehler behoben sein. Wann die Finalversion erscheint, bleibt unklar. Der Entdeckter von "Thunderstrike" kritisierte Apple. --------------------------------------------- http://www.heise.de/newsticker/meldung/OS-X-10-10-2-Apple-patcht-Thunderstr… *** Firewall-Update: IPFire 2.15 auf Core Update 86 aktualisiert *** --------------------------------------------- Die Aktualisierung stopft etliche Sicherheitslücken in diversen Paketen. Die Entwickler empfehlen daher dringend, das Update umgehend einzuspielen und die Firewall anschließend neu zu starten. --------------------------------------------- http://heise.de/-2528391 *** Adobe stiftet Verwirrung mit falschen Versionsangaben für Flash *** --------------------------------------------- Die Flash-Macher haben die kritische Lücke in ihrer Software endlich geschlossen. Leider vermitteln sie auf der offiziellen Flash-Webseite noch den Eindruck, die verwundbare Version wäre die neueste und damit sicher. --------------------------------------------- http://www.heise.de/newsticker/meldung/Adobe-stiftet-Verwirrung-mit-falsche… *** Factsheet: Help! My website is vulnerable to SQL injection *** --------------------------------------------- SQL injection is a popular and frequently used attack on websites, which attackers use to steal large volumes of (client) information. Although there are other types of attacks for capturing this information, SQL injection appears to be a frequently used method.A website becomes vulnerable to SQL injection when attackers are able to influence the queries sent by a website to a database. --------------------------------------------- https://www.ncsc.nl/english/services/expertise-advice/knowledge-sharing/fac… *** Demystifying Cross-Site Request Forgery *** --------------------------------------------- Continuously ranked in the OWASP Top Ten, a large majority of the development community still doesnt understand Cross-Site Request Forgery (CSRF). After years of penetration tests and code reviews, my experiences show that a high percentage of applications, especially new applications, do not have proper CSRF protections in place. This post provides a refresher on CSRF and provides a common defense for this issue. --------------------------------------------- http://software-security.sans.org/blog/2015/01/23/demystifying-cross-site-r… *** Analyzing CVE-2015-0311: Flash Zero Day Vulnerability *** --------------------------------------------- Last week a major zero-day vulnerability (was found in Adobe Flash Player. Over the weekend, Adobe started releasing an update to fix the vulnerability: users who have enabled auto-update have already received the newest version (16.0.0.296). Our analysis has confirmed that the vulnerable code has been modified. --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/2RZECpZzdak/ *** Cisco 2900 Series Integrated Services Router Network-Based Application Recognition Denial of Service Vulnerability *** --------------------------------------------- A vulnerability in the Network-Based Application Recognition (NBAR) protocol process of the Cisco 2900 Series Integrated Services Router could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability occurs when the NBAR process locks. An attacker could exploit this vulnerability by sending simple IP version 4 (IPv4) packets through the router. An exploit could allow the attacker to cause a DoS condition that would require a router restart. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015…

1 0

Tageszusammenfassung - Freitag 23-01-2015
by Daily end-of-shift report 23 Jan '15

23 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 22-01-2015 18:00 − Freitag 23-01-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Malvertising leading to Flash Zero Day via Angler Exploit Kit *** --------------------------------------------- Background As part of our daily research activity, we came across this blog mentioning an Angler Exploit Kit (EK) instance serving a possible zero day Adobe Flash exploit .. --------------------------------------------- http://research.zscaler.com/2015/01/malvertising-leading-to-flash-zero-day.… *** UPDATED: Security updates available for Adobe Flash Player (APSB15-02) *** --------------------------------------------- A Security Bulletin (APSB15-02) has been published regarding security updates for Adobe Flash Player. These updates address a vulnerability (CVE-2015-0310) that .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1157 *** New RATs Emerge from Leaked Njw0rm Source Code *** --------------------------------------------- In the middle of my research on the remote access Trojan (RAT) known as 'njrat' or 'Njw0rm', I stumbled upon dev-point.com, a site that disguises itself as a site for 'IT enthusiasts' but actually hosts various downloaders, different types of spyware, and RATs. I explored the site and found that they host .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/new-rats-emerge-… *** Multiple vulerabilities in McAffee products *** --------------------------------------------- http://www.securitytracker.com/id/1031618 http://www.securitytracker.com/id/1031617 http://www.securitytracker.com/id/1031616 *** Google Apps Flaw Allowed Hacker to Hijack Account and Disable Two-factor Authentication *** --------------------------------------------- A critical cross-site scripting (XSS) vulnerability in the Google Apps administrator console allowed cyber criminals to force a Google Apps admins to execute just about .. --------------------------------------------- http://thehackernews.com/2015/01/google-account-hacking.html *** Google veröffentlicht weitere OS-X-Lücken *** --------------------------------------------- Im vergangenen Jahr gegründet, dreht Googles Project Zero derzeit so etwas wie eine Vorstellungstour bei den großen Softwareherstellern. Wenn auch wohl nicht ganz in deren Sinne. Nach einer Reihe von Fehlern in Microsofts Windows, ist nun offenbar Apples OS X an der Reihe. --------------------------------------------- http://derstandard.at/2000010780464 *** Microsoft lässt Server-2003-Lücke ungepatcht *** --------------------------------------------- Eine Sicherheitslücke im Netzwerkerkennungsdienst NLA von Windows Server 2003 wird nicht geschlossen, obwohl das Betriebssystem eigentlich noch Sicherheitsupdates erhalten sollte. --------------------------------------------- http://heise.de/-2526994 *** Scareware App Downloaded Over a Million Times from Google Play *** --------------------------------------------- We have recently been investigating an antivirus app in the Google Play store that was displaying fake virus detection results to scare users into purchasing .. --------------------------------------------- http://researchcenter.paloaltonetworks.com/2015/01/scareware-app-downloaded… *** Adobe will Flash-Lücke erst nächste Woche schliessen *** --------------------------------------------- Im Flash Player klafft eine kritische Lücke, über die Angreifer das System komplett übernehmen können. Diese wird bereits aktiv ausgenutzt. Adobe will sich trotzdem bis nächste Woche mit dem Patch Zeit lassen. --------------------------------------------- http://heise.de/-2527107 *** The Likelihood of Cyber-Terrorism Today *** --------------------------------------------- Introduction The virtual space has over time become something of real importance for business, politics, work, communities and communications. In becoming gradually more and more dependent and addicted to the Internet, .. --------------------------------------------- http://resources.infosecinstitute.com/likelihood-cyber-terrorism-today/ *** How Vulnerabilities Happen: Input Validation Problems, (Fri, Jan 23rd) *** --------------------------------------------- We would like to thank Richard Ackroyd of RandomStormfor reporting a critical input validation error in our site to us. As we have done before, here is how it happened so hopefully you can learn from it as well. Lets start with a bit of ,, --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19221 *** The Internet of Gas Station Tank Gauges *** --------------------------------------------- Automated tank gauges (ATGs) are used to monitor fuel tank inventory levels, track deliveries, raise alarms that indicate problems with the tank or gauge (such as a fuel spill), and to perform leak tests in accordance with environmental regulatory .. --------------------------------------------- https://community.rapid7.com/community/infosec/blog/2015/01/22/the-internet… *** Siemens SIMATIC S7-1200 CPU Web Vulnerability *** --------------------------------------------- This advisory provides mitigation details for an open redirect vulnerability in the SIMATIC S7-1200 CPU family. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-022-01 *** 1&1: Kundenportal akzeptierte jedes Passwort *** --------------------------------------------- Durch eine schwerwiegende Panne stand ein Reseller-Kundenportal von 1&1 sperrangelweit offen. Mit einem beliebigen Passwort bekam man administrativen Zugriff auf Hosting-Pakete und Domains - offenbar sogar auf 1und1.de, gmx.de und web.de. --------------------------------------------- http://heise.de/-2527421 *** Deja vu: PHP-Entwickler schliessen Sicherheitslücke zum zweiten Mal *** --------------------------------------------- Sicherheitsforscher Stefan Esser hat wieder zugeschlagen: Dieses Mal musste er eine von ihm entdeckte Lücke zweimal stopfen lassen. Diese erlaubt es, PHP-Applikationen unter bestimmten Bedingungen aus der Ferne anzugreifen. --------------------------------------------- http://heise.de/-2527525

1 0

Tageszusammenfassung - Donnerstag 22-01-2015
by Daily end-of-shift report 22 Jan '15

22 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 21-01-2015 18:00 − Donnerstag 22-01-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** "Zero-Day"-Sicherheitslücke in Adobe Flash Player (aktiv ausgenützt) *** --------------------------------------------- Wie der bekannte Sicherheitsforscher "Kafeine" in seinem Blog berichtet (http://malware.dontneedcoffee.com/2015/01/unpatched-vulnerability-0day-in-f…), scheint es eine neue, noch ungepatchte Sicherheitslücke im Adobe Flash Player zu geben, die aktiv von zumindest einem Exploit Kit ausgenützt wird. --------------------------------------------- https://cert.at/warnings/all/20150122.html *** Security updates available for Adobe Flash Player (APSB15-02) *** --------------------------------------------- A Security Bulletin (APSB15-02) has been published regarding security updates for Adobe Flash Player. These updates address a vulnerability (CVE-2015-0310) that could be used to circumvent memory randomization mitigations on the Windows platform. Adobe is aware of reports that an .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1157 *** Security Advisory - Vulnerabilities in Pagelines/Platform theme for WordPress *** --------------------------------------------- Users of both the Pagelines and Platform themes should update as soon as possible. During a routine audit for our WAF, we found two dangerous issues: A Privilege Escalation vulnerability .. --------------------------------------------- http://blog.sucuri.net/2015/01/security-advisory-vulnerabilities-in-pagelin… *** Tubrosa threat drives millions of views to scammers' YouTube gaming videos *** --------------------------------------------- Cybercriminals are fraudulently earning advertising revenue by spreading click-fraud threat Trojan.Tubrosa, which sends compromised computers to their .. --------------------------------------------- http://www.symantec.com/connect/blogs/tubrosa-threat-drives-millions-views-… *** CTB-Locker Ransomware Includes Freemium Feature, Extends Deadline *** --------------------------------------------- Last July we came across a crypto-ransomware variant known as Critroni or Curve-Tor-Bitcoin (CTB) Locker. We observed recent improvements to the CTB malware, which now offer a 'free decryption' service, extended deadline to .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/ctb-locker-ranso… *** Multiple vulnerabilities in third-party Drupal-modules *** --------------------------------------------- https://www.drupal.org/node/2411737 https://www.drupal.org/node/2411539 https://www.drupal.org/node/2411527 *** Energy Harvesting: Tastatur erkennt Benutzer durch Eigenheiten beim Tippen *** --------------------------------------------- Tippe, und ich sage dir, wer du bist: Forscher in den USA und China haben eine Tastatur entwickelt, die ihren Besitzer am Tippen erkennt. Das könnte eine Ergänzung zu herkömmlichen Passwörtern sein. Die Tastatur gewinnt per Energy Harvesting elektrische Energie aus den Tippbewegungen. --------------------------------------------- http://www.golem.de/news/energy-harvesting-tastatur-erkennt-benutzer-durch-… *** Is 123456 Really The Most Common Password? *** --------------------------------------------- I recently worked with SplashData to compile their 2014 Worst Passwords List and yes, 123456 tops the list. In the data set of 3.3 million passwords I used for SplashData, almost 20,000 of those were in fact 123456. But how often do you really see people using that, or the second most common .. --------------------------------------------- https://xato.net/passwords/123456-common-password/ *** An analysis of Regins Hopscotch and Legspin *** --------------------------------------------- Perhaps one of the most interesting things we observed in the Regin malware operation are the forgotten codenames for some of its modules. We decided to analyse two of these modules in more detail. --------------------------------------------- http://securelist.com/blog/research/68438/an-analysis-of-regins-hopscotch-a… *** Confluence Security Advisory - 2015-01-21 *** --------------------------------------------- We have discovered and fixed a vulnerability in our fork of WebWork. Attackers can use this vulnerability to execute Java code of their choice on systems that use this framework. The attacker needs to have an account and be able to access the Confluence web interface. --------------------------------------------- https://confluence.atlassian.com/display/DOC/Confluence+Security+Advisory+-… *** Yes, Every Freeware Download Site is Serving Crapware *** --------------------------------------------- When we wrote about what happens when you install the top ten apps from CNET Downloads, about half of the comments were from people saying, 'Well you should download from a trusted source.' The only problem is that there isn't a freeware download site that is free of crapware or adware. And here's the result of our investigation to prove it. --------------------------------------------- http://www.howtogeek.com/207692/yes-every-freeware-download-site-is-serving… *** Contact Form 3.82 - Unauthorized Language Manipulation *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7761 *** Dataurization of URLs for A More Effective Phishing Campaign *** --------------------------------------------- Phishing with data: URIs is not a new idea. The concept is relatively simple, taking advantage of many user's inexperience with how data: URIs function in order to trick them into entering credentials into a phishing page. We've seen this .. --------------------------------------------- https://thehackerblog.com/dataurization-of-urls-for-a-more-effective-phishi…

1 0

Tageszusammenfassung - Mittwoch 21-01-2015
by Daily end-of-shift report 21 Jan '15

21 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 20-01-2015 18:00 − Mittwoch 21-01-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Windows Firewall Hook Enumeration *** --------------------------------------------- tl;dr: We're going look in detail at Microsoft Windows Firewall Hook drivers from Windows 2000, XP and 20003. This functionality was leverage ... --------------------------------------------- https://www.nccgroup.com/en/blog/2015/01/windows-firewall-hook-enumeration/ *** DSA-3133 privoxy - security update *** --------------------------------------------- https://www.debian.org/security/2015/dsa-3133 *** Siemens SCALANCE X-300/X408 Switch Family DOS Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for denial-of-service vulnerabilities in the Siemens SCALANCE X-300/X408 switch family. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-020-01 *** Schneider Electric ETG3000 FactoryCast HMI Gateway Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for multiple vulnerabilities in Schneider Electric's ETG3000 series FactoryCast HMI Gateways. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-020-02 *** Oracle Critical Patch Update Advisory - January 2015 *** --------------------------------------------- Description A Critical Patch Update (CPU) is a collection of patches for multiple security vulnerabilities. Critical Patch Update patches are usually cumulative, but each advisory describes only the security fixes added since the .. --------------------------------------------- http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html *** Google publiziert ungepatchte Lücke in OS X 10.9.5 *** --------------------------------------------- Nachdem der Internetriese im Rahmen seiner Responsible-Disclosure-Politik in den vergangenen Monaten gleich drei offene Windows-Lücken öffentlich machte, ist nun erstmals auch Apple dran. Der Konzern hatte offenbar nicht in der geforderten Zeit reagiert. --------------------------------------------- http://heise.de/-2523449 *** Cisco 2015 Annual Security Report: Java ist sicherer geworden *** --------------------------------------------- 2013 war kein gutes Jahr für Java, denn etliche Sicherheitslücken sorgten für verunsicherte Anwender. Gut, dass Oracle offenbar die richtigen Weichen gestellt hat, denn im vergangenen Jahr wurden deutlich weniger Lücken festgestellt. --------------------------------------------- http://heise.de/-2523408 *** Windows Server 2003 Reaches End of Life In July *** --------------------------------------------- Several readers sent word that were now less than six months away from the end of support for Windows Server 2003. Though the operating systems usage peaked in 2009, it still runs on millions of machines, and many IT departments are just now starting to look at replacements. Although .. --------------------------------------------- http://tech.slashdot.org/story/15/01/21/0423229/windows-server-2003-reaches… *** Bash data exfiltration through DNS (using bash builtin functions) *** --------------------------------------------- After gaining 'blind' command execution access to a compromised Linux host, data exfiltration can be difficult when the system ibinbash2s protected by a firewall. --------------------------------------------- https://forsec.nl/2015/01/bash-data-exfiltration-through-dns-using-bash-bui… *** Discovering and remediating an active but disused botnet *** --------------------------------------------- On a network I help manage, we kept getting malicious DNS alerts for 'luna1.pw' on an appliance we had installed. Due to the way the network was configured, we were able to see the name request coming in but no traffic activity. This .. --------------------------------------------- http://colin.keigher.ca/2015/01/discovering-and-remediating-active-but.html *** rt-sa-2014-010 *** --------------------------------------------- The signature check of FRITZ!Box firmware images is flawed. Malicious code can be injected into firmware images without breaking the RSA signature. The code will be executed either if a manipulated firmware image is uploaded by the victim or if the victim confirms an update on the webinterface during a MITM attack. --------------------------------------------- https://www.redteam-pentesting.de/advisories/rt-sa-2014-010.txt *** Unpatched Vulnerability (0day) in Flash Player is being exploited by Angler EK *** --------------------------------------------- This is a fast post. I will update it heavily in the coming hours/days. I spotted an instance of Angler EK which is sending three different bullets targeting Flash Player : --------------------------------------------- http://malware.dontneedcoffee.com/2015/01/unpatched-vulnerability-0day-in-f…

1 0

Tageszusammenfassung - Dienstag 20-01-2015
by Daily end-of-shift report 20 Jan '15

20 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 19-01-2015 18:00 − Dienstag 20-01-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** How Was Your Credit Card Stolen? *** --------------------------------------------- Almost once a week, I receive an email from a reader who has suffered credit card fraud and is seeking help figuring out which hacked merchant was responsible. I generally reply that this is a fruitless pursuit, and instead encourage readers to keep a close eye on their card statements and .. --------------------------------------------- http://krebsonsecurity.com/2015/01/how-was-your-credit-card-stolen/ *** Symantec Data Center Security: Server Advanced, Multiple Security Issues on Management Server and Protection Policies Rule Bypass *** --------------------------------------------- The management server for Symantec Critical System Protection (SCSP) 5.2.9 and Data Center Security: Server Advanced (SDCS:SA) 6.0.x is susceptible to security issues which could enable privileged access to the management server. Rules in the prevention policies could be bypassed if deployed to SCSP/SDCS:SA agents to restrict access to specific host functionality. --------------------------------------------- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=se… *** Verschlüsselung: Neue Angriffe auf RC4 *** --------------------------------------------- Zwei Forscherteams kündigen unabhängig voneinander an, bald neue Angriffe gegen den RC4-Verschlüsselungsalgorithmus vorzustellen. Knapp ein Prozent der Webserver setzt immer noch ausschließlich auf RC4. --------------------------------------------- http://www.golem.de/news/verschluesselung-neue-angriffe-auf-rc4-1501-111805… *** PlugX Malware Found in Official Releases of League of Legends, Path of Exile *** --------------------------------------------- Hacks in Taiwan (HITCON), a security conference hosted in that country, has discovered an attack involving several online games. Official releases of two popular online games were found to be compromised, downloading malware onto computers. HITCON worked with Trend Micro to provide a clean-up .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/plugx-malware-fo… *** Symantec Critical System Protection Multiple Flaws Let Remote Authenticated Users Execute Arbitrary Code, Inject SQL Commands, Conduct Cross-Site Scripting Attacks, and Obtain Potentially Sensitive Information *** --------------------------------------------- Multiple vulnerabilities were reported in Symantec Critical System Protection. A remote authenticated user can execute arbitrary code on the target system. A remote user can conduct cross-site scripting attacks. A remote authenticated .. --------------------------------------------- http://www.securitytracker.com/id/1031566 *** Moodle Bugs Permit Cross-Site Scripting, Cross-Site Request Forgery, and Information Disclosure Attacks *** --------------------------------------------- Multiple vulnerabilities were reported in Moodle. A remote user can cause denial of service conditions. A remote user can conduct cross-site scripting and cross-site request forgery attacks. A remote user can obtain potentially sensitive information. --------------------------------------------- http://www.securitytracker.com/id/1031557 *** F-Secure: Bios-Trojaner aufzuspüren, ist "fast aussichtslos" *** --------------------------------------------- Weil die Antivirenhersteller keine Muster von Regierungs-Malware haben, die PC-Komponenten auf Firmware-Ebene infiziert, können sie diese kaum entdecken. Mikko Hypponen von F-Secure sieht vor allem die Hardwarehersteller in der Pflicht. --------------------------------------------- http://www.golem.de/news/f-secure-bios-trojaner-aufzuspueren-ist-fast-aussi… *** Glorious Leaders Not-That-Glorious Malwares - Part 2 *** --------------------------------------------- This is second (and last) part of the analysis of Korean Central News Agency Malware. If you havent read the first part yet, I would suggest reading that first here. First of all I should mention that its not launch.exe and .. --------------------------------------------- https://www.codeandsec.com/Glorious-Leaders-Not-That-Glorious-Malwares-Part… *** Owning Modems And Routers Silently *** --------------------------------------------- Do you have cable internet? Own a surfboard modem? Since most of my buddies in AZ do, I sent them to this page and to my amusement, they got knocked off the net for a few minutes. How? Javascript. Specifically a CSRF in the Motorolla Surfboard. --------------------------------------------- http://www.gironsec.com/blog/2015/01/owning_modems_and_routers_silently/ *** Libavcodec: Fehler erlauben Codeausführung in VLC-Codecbibliothek *** --------------------------------------------- Speziell präparierte Videodateien können zur Codeausführung unter anderem in VLC genutzt werden. Dessen Entwickler verhalten sich aber zurückhaltend, zudem werfen die Berichte einige Fragen auf. --------------------------------------------- http://www.golem.de/news/libavcodec-fehler-erlauben-codeausfuehrung-in-vlc-… *** Go Static or Go Home - Inviting the Trojan Horse Inside *** --------------------------------------------- And then, after all that spending on all that complexity for defense, some of us go on to install a DCMS (Dynamic Content Management System) as our public-facing web server. This approach is like building a mighty walled city and then inviting the Trojan horse inside, or making Achilles invulnerable to harm except for his heel. --------------------------------------------- http://queue.acm.org/detail.cfm?id=2721993 *** ENISA Warns of Internet Vulnerabilities (InfoRiskToday) *** --------------------------------------------- The Internet infrastructure remains susceptible to a variety of threats, including routing attacks, DNS spoofing and poisoning attacks and distributed denial-of-service disruptions. But a number of best practices can help prevent related exploits, a new EU government study says. --------------------------------------------- http://www.inforisktoday.com/enisa-warns-internet-vulnerabilities-a-7814 *** Session Hijacking Cheat Sheet *** --------------------------------------------- 'Session Hijacking' is an old and routine topic in the field of application security. To make it more interesting, in this article, we are going to focus on different ways it can be performed. Introduction for beginners Web .. --------------------------------------------- http://resources.infosecinstitute.com/session-hijacking-cheat-sheet/ *** Paper: Nesting doll: unwrapping Vawtrak *** --------------------------------------------- Raul Alvarez unwraps the many layers of an increasingly prevalent banking trojan.Banking trojans remain one of the most prevalent kinds of malware. Among them, trojans based on Zeus have long been the most prevalent, but in recent months a relatively new trojan has been challenging the reign of Zeus: Vawtrak.Also known as Neverquest or Snifula, Vawtrak initially targeted users of Japanese banking systems, but it has since broadened its scope. In a recent paper (pdf), Sophos researcher James --------------------------------------------- http://www.virusbtn.com/blog/2015/01_20.xml *** GoDaddy CSRF Vulnerability Allows Domain Takeover *** --------------------------------------------- tl;dr: An attacker can leverage a CSRF vulnerability to take over domains registered with GoDaddy. The vulnerability has been patched. --------------------------------------------- http://breakingbits.net/2015/01/18/taking-over-godaddy-accounts-using-csrf/ *** Finding Privilege Escalation Flaws in Linux *** --------------------------------------------- We often tend to ignore privilege escalation flaws. In order to take advantage of these vulnerabilities, an attacker first needs to have access to the system itself. But in particular for systems that many users have access to, it can be difficult to monitor them all for compromised .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19207

1 0

Tageszusammenfassung - Montag 19-01-2015
by Daily end-of-shift report 19 Jan '15

19 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 16-01-2015 18:00 − Montag 19-01-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Survey says security products waste our time *** --------------------------------------------- A survey of information-technology professionals published on Friday found that the average large organization has to sift through nearly 17,000 malware alerts each week to find the 19 percent that are considered reliable. The efforts at .. --------------------------------------------- http://arstechnica.com/security/2015/01/survey-says-security-products-waste… *** A Lot of Security Purchases Remain Shelfware *** --------------------------------------------- Companies may be investing more in security, but many are either underutilizing their new purchases or not using them at all, an Osterman Research survey shows. --------------------------------------------- http://www.darkreading.com/a-lot-of-security-purchases-remain-shelfware/d/d… *** Report: Mercenaries Behind APT Attacks *** --------------------------------------------- An increasing number of sophisticated cyber-attacks are not being launched by governments - or their intelligence services - but rather by opportunistic mercenaries who sell whatever they can steal to the highest bidder, according to a new .. --------------------------------------------- http://www.inforisktoday.com/report-mercenaries-behind-apt-attacks-a-7806 *** Dridex Banking Trojan Begins 2015 with a Bang *** --------------------------------------------- In October, we called out a series of attacks installing the Dridex Trojan using macros in Microsoft Word documents. Those attacks continued over the last few ... --------------------------------------------- http://researchcenter.paloaltonetworks.com/2015/01/dridex-banking-trojan-be… *** Use-after-Free: New Protections, and how to Defeat them *** --------------------------------------------- The Problem Memory corruption has plagued computers for decades, and these bugs can often be transformed into working cyber-attacks. Memory corruption is a situation where an attacker (malicious user of an application or network protocol) is .. --------------------------------------------- http://labs.bromium.com/2015/01/17/use-after-free-new-protections-and-how-t… *** Bypassing the Android PIN using fast tapping - Lock screens are still hard *** --------------------------------------------- It turns out that during that brief period we have access to the phone and if we time our actions right, we can start programs or change settings by quickly tapping on the screen. Surely it's a bit tedious to do so, but .. --------------------------------------------- http://itinsight.hu/en/posts/articles/2015-01-28-android-bypass/ *** New Guide by ENISA: Actionable Information for Security Incident Response *** --------------------------------------------- ENISA publishes a good practice guide on Actionable Information for Security Incident Response, aiming to provide a picture of the challenges national CERTs and other security organizations encounter ... --------------------------------------------- http://www.enisa.europa.eu/media/press-releases/new-guide-by-enisa-actionab… *** VB2014 paper: OPSEC for security researchers *** --------------------------------------------- Vicente Diaz teaches researchers the basics of OPSEC.Since the close of the VB2014 conference in Seattle in October, we have been sharing VB2014 conference papers as well as video recordings of the presentations. Today, we have added OPSEC for security researchers by Kaspersky researchers Vicente .. --------------------------------------------- http://www.virusbtn.com/blog/2015/01_19.xml *** DSA-3131 xdg-utils - security update *** --------------------------------------------- John Houwer discovered a way to cause xdg-open, a tool that automaticallyopens URLs in a users preferred application, to execute arbitrarycommands remotely. --------------------------------------------- https://www.debian.org/security/2015/dsa-3131 *** Hacked. A Short Story. *** --------------------------------------------- It all started when I was asked (as a freelancer) to configure exim4, so that newsletters would not fall into spam folders. They even sent me a link to a tutorial. I thought the work would take a couple of hours, including the DNS update, but I was wrong. After logging in as root, I started my favorite .. --------------------------------------------- http://kukuruku.co/hub/infosec/hacked-a-short-story-of-a-hack *** 2013-11-08: Remote code execution vulnerability in CAP 501 / CAP 505 / SMS 510 *** --------------------------------------------- http://search.abb.com/library/Download.aspx?DocumentID=1MRS757865&LanguageC… *** Tyupkin ATM Malware Analysis *** --------------------------------------------- Introduction Some time ago, Kaspersky discovered and reported a new type of malicious program called Tyupkin, which targets ATM machines by moving beyond targeting consumers with card skimmers that steal debit card numbers to directly getting cash .. --------------------------------------------- http://resources.infosecinstitute.com/tyupkin-atm-malware-analysis/ *** China: Attacke gegen Microsofts Outlook *** --------------------------------------------- Offenbar Versuch einer Man-in-the-Middle-Attacke - Angreifer wollten Verschlüsselung austricksen --------------------------------------------- http://derstandard.at/2000010596970 *** Certified Secure Advisory 14-01-2015-0.1 - PolarSSL *** --------------------------------------------- During a routine research session, Certified Secure found a "Use of uninitialized memory" vulnerability in the PolarSSL (https://polarssl.org) library. The vulnerability is present in the asn1_get_sequence_of routine that is .. --------------------------------------------- https://www.certifiedsecure.com/polarssl-advisory/ *** Traffic Patterns For CryptoWall 3.0 *** --------------------------------------------- This is a guest diary submitted by Brad Duncan. Various sources have reported version 3 of CryptoWall has appeared [1] [2] [3]. This malware is currently seen from exploit kits and phishing emails. CryptoWall is one of many ransomware trojans that encrypt the personal files on your computer .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19203

1 0

Tageszusammenfassung - Freitag 16-01-2015
by Daily end-of-shift report 16 Jan '15

16 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 15-01-2015 18:00 − Freitag 16-01-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Definitions matter. For crying out loud, securobods, BE SPECIFIC - ENISA *** --------------------------------------------- Use your words or the DDoSers will GET you.... Definitions matter when your infrastructure is under threat says European Union Agency for Network and Information Security (ENISA). --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/01/15/if_you_want… *** Critical Patch Update - January 2015 - Pre-Release Announcement *** --------------------------------------------- This Critical Patch Update Pre-Release Announcement provides advance information about the Oracle Critical Patch Update for January 2015, which will be released on Tuesday, January 20, 2015. While this Pre-Release Announcement is as accurate as possible at the time of publication, the information it contains may change before publication of the Critical Patch Update Advisory. --------------------------------------------- http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html *** Google AdWords Campaigns Hijacked by Malvertisers *** --------------------------------------------- Two Google AdWords campaigns have been hijacked by malvertisers and users are being redirected to fraud sites without even clicking the poisoned ads. --------------------------------------------- http://threatpost.com/google-adwords-campaigns-hijacked-by-malvertisers/110… *** Telekom-Tools für sichere Server-Konfiguration *** --------------------------------------------- Die Telekom nimmt Admins an die Hand und liefert kostenlose Tools, die bei der Härtung von nginx, MySQL und Co. helfen. --------------------------------------------- http://heise.de/-2517840 *** Sicherheitsfirmen warnen vor "Je Suis Charlie"-Trojaner *** --------------------------------------------- Vermeintliches Solidaritätsvideo lädt tatsächlich Schadsoftware auf den Rechner --------------------------------------------- http://derstandard.at/2000010489196 *** Seven Months' Worth of Mistakes: A Longitudinal Study of Typosquatting Abuse *** --------------------------------------------- In particular we reveal that, even though 95 percent of the popular domains we investigated are actively targeted by typosquatters, only few trademark owners protect themselves against this practice by proactively registering their own typosquatting domains. A small fraction of those typosquatted domains -- such as gooogle.com for google.com -- were registered by the legitimate website in a bid to foil typosquatters. --------------------------------------------- https://lirias.kuleuven.be/bitstream/123456789/471369/3/typos-final.pdf *** Employee Threat Assessment Template for Large Organizations *** --------------------------------------------- Despite the popular image of the hacker cracking distant servers from his basement, studies show that people with legitimate access to your information pose an even bigger threat. And when information is stolen from within, it's often harder to trace and determine the extent of the problem. The larger your [...]The post Employee Threat Assessment Template for Large Organizations appeared first on InfoSec Institute. --------------------------------------------- http://resources.infosecinstitute.com/employee-threat-assessment-template-l… *** Details zur kritischen Lücke im Telnet-Server von Windows *** --------------------------------------------- Auf einer chinesischen Website ist eine detaillierte Analyse der gerade erst gepatchten Telnet-Lücke aufgetaucht - und ein Proof-of-Concept. --------------------------------------------- http://heise.de/-2518951 *** Cisco Adaptive Security Appliance DHCPv6 Relay Denial of Service Vulnerability *** --------------------------------------------- CVE-2015-0578 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Cisco Hosted WebEx Meeting Center Information Disclosure *** --------------------------------------------- CVE-2015-0590 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** T-Mobile Internet Manager UpdateCfg.ini SEH buffer overflow *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/99945 *** Alienvault OSSIM Web UI command execution *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/99951 *** Arbiter Systems 1094B GPS Clock Spoofing Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a GPS clock spoofing vulnerability in the Arbiter Systems 1094B clock. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-14-345-01 *** GE Proficy HMI/SCADA CIMPLICITY CimView Memory Access Violation *** --------------------------------------------- This advisory provides mitigation details for a memory access violation vulnerability in GE's CIMPLICITY CimView application. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-14-289-02 *** Windows: Impersonation Check Bypass With CryptProtectMemory and CRYPTPROTECTMEMORY_SAME_LOGON flag *** --------------------------------------------- Platform: Windows 7, 8.1 Update 32/64 bit Class: Security Bypass/Information Disclosure The function CryptProtectMemory allows an application to encrypt memory for one of three scenarios, process, logon session and computer. When using the logon session option (CRYPTPROTECTMEMORY_SAME_LOGON flag) the encryption key is generated based on the logon session identifier, this is for sharing memory between processes running within the same logon. --------------------------------------------- https://code.google.com/p/google-security-research/issues/detail?id=128 *** DSA-3129 rpm - security update *** --------------------------------------------- Two vulnerabilities have been discovered in the RPM package manager. --------------------------------------------- https://www.debian.org/security/2015/dsa-3129 *** Information Disclosure in Direct Mail Subscription (direct_mail_subscription) *** --------------------------------------------- It has been discovered that the extension "Direct Mail Subscription" (direct_mail_subscription) is susceptible to Information Disclosure. --------------------------------------------- http://www.typo3.org/news/article/information-disclosure-in-direct-mail-sub… *** WiFi File Browser Pro v2.0.8 Code Execution Vulnerability *** --------------------------------------------- Topic: WiFi File Browser Pro v2.0.8 Code Execution Vulnerability Risk: High Text:Document Title: WiFi File Browser Pro v2.0.8 - Code Execution Vulnerability References (Source): == http:/... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015010087

1 0

Tageszusammenfassung - Donnerstag 15-01-2015
by Daily end-of-shift report 15 Jan '15

15 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 14-01-2015 18:00 − Donnerstag 15-01-2015 18:00 Handler: Alexander Riepl Co-Handler: Stephan Richter *** CryptoWall 3.0 Uses I2P Anonymity Network For CC Communications (SecurityWeek) *** --------------------------------------------- Almost two months have passed since the developers of CryptoWall released an updated version of the threat, but now they’re back to work. The malware, distributed via spam and malvertising campaigns, helped cybercriminals make a lot of money last year so it’s not surprising that its authors continue improving it. --------------------------------------------- http://www.securityweek.com/cryptowall-30-uses-i2p-anonymity-network-cc-com… *** AdSense Abused with Malvertising Campaign *** --------------------------------------------- Last weekend we noticed a large number of requests to scan websites for malware because they randomly redirected to some "magazine" websites. Most of them mentioned the lemode-mgz .com site. In all cases, the symptoms were the same. Some users randomly got redirected when they clicked on links or loaded new pages. They all reported... --------------------------------------------- http://blog.sucuri.net/2015/01/adsense-abused-with-malvertising-campaign.ht… *** Anatomy Of A Cyber-Physical Attack (Dark Reading) *** --------------------------------------------- "If you only consider hackers, you don’t have to be concerned that much. They won't be able to take down a power grid or blow up chemical facilities," says Ralph Langer, founder of Langner Communications and a top Stuxnet expert. The danger is when attackers have an understanding of the physical and engineering aspects of the plant or site they are targeting, he says. --------------------------------------------- http://www.darkreading.com/vulnerabilities---threats/anatomy-of-a-cyber-phy… *** Kritik an Apples Zwei-Faktor-Schutz *** --------------------------------------------- Apples zweistufige Bestätigung deckt mehrere Cloud-Dienste des Konzerns gar nicht ab, bemängelt eine Nutzerin - ein Angreifer könne auf diese Weise tiefe Einblicke erhalten. --------------------------------------------- http://heise.de/-2517903 *** Private Schlüssel: Gitrob sucht sensible Daten bei Github *** --------------------------------------------- Immer wieder tauchen Daten wie private Schlüssel oder Passwörter in Github-Repositories auf. Mit Hilfe von Gitrob sollen diese gefunden werden können, um sich besser zu schützen. Das öffnet aber auch die Möglichkeiten für einen interessanten Angriff. --------------------------------------------- http://www.golem.de/news/private-schluessel-gitrob-sucht-sensible-daten-bei… *** Security and Military Experts Fall For "Open" Wi-Fi *** --------------------------------------------- According to The Local, an English-language newspaper in Sweden, Gustav Nipe watched earlier this week as around 100 politicians, military officers and journalists logged into a network called “Open Guest” and proceeded to search for various non-work-related things including “forest hikes” and monitor eBay auctions. --------------------------------------------- https://www.f-secure.com/weblog/archives/00002783.html *** ATM: Attacking Multichannel Fraud (InfoRiskToday) *** --------------------------------------------- The increasing globalization of fraud perpetrated by sophisticated organized crime rings has spurred unprecedented growth in cross-channel attacks, security experts from three of the world's leading ATM manufacturers say. That's why ATM deployers can no longer build defenses that focus solely on the ATM channel, executives from Diebold Inc., Wincor Nixdorf AG and NCR Corp. say in this final part of an exclusive three-part interview with Information Security Media Group. --------------------------------------------- http://www.inforisktoday.com/interviews/atm-attacking-multichannel-fraud-i-… *** Patchday: Adobe schließt neun Lücken in Flash *** --------------------------------------------- Die Lücken, die Adobe nun in Flash geschlossen hat, betreffen alle Plattformen. Nutzer sollten die Updates schnellstmöglich installieren, da sie Angriffe aus dem Netz ermöglichen. --------------------------------------------- http://heise.de/-2517426 *** Cybercrime: Hacking als aufstrebender Wirtschaftszweig in Österreich *** --------------------------------------------- Internet-Sicherheitsbericht 2014 präsentiert - Ungeschützte Smartphones und Tablets als Ziele --------------------------------------------- http://derstandard.at/2000010445114 *** JSA10669 - 2015-01 Security Bulletin: Junos: Multiple vulnerabilities in libxml2 library *** --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10669&actp=RSS *** JSA10667 - 2015-01 Security Bulletin: Junos: Privilege escalation vulnerability (CVE-2014-6384) *** --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10667&actp=RSS *** Cisco Identity Services Engine Cross-Site Scripting Vulnerability *** --------------------------------------------- CVE-2014-8022 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco Unified Communications Domain Manager Admin GUI DoS Vulnerability *** --------------------------------------------- CVE-2015-0591 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Simple Security plugin for WordPress wp-admin/users.php script cross-site scripting *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/99931 *** SA-CONTRIB-2015-022 - nodeauthor - Cross Site Scripting (XSS) - Unsupported *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-022Project: nodeauthor (third-party module)Version: 7.xDate: 2015-January-14Security risk: 12/25 ( Moderately Critical) AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross Site ScriptingDescriptionThis module displays node author information in a jQuery slider.The module doesnt sufficiently sanitize Profile2 fields in a provided block.This vulnerability is mitigated by the fact that an attacker must have a user account allowed to --------------------------------------------- https://www.drupal.org/node/2407401 *** SA-CONTRIB-2015-021 - Content Analysis - Cross Site Scripting (XSS) *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-021Project: Content Analysis (third-party module)Version: 6.xDate: 2014-January-14Security risk: 16/25 ( Critical) AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site ScriptingDescriptionThe Content Analysis module is an API designed to help modules that need to analyze content.The module fails to sanitize user input in log messages, leading to a Cross Site Scripting (XSS) vulnerability.This vulnerability is mitigated by the fact --------------------------------------------- https://www.drupal.org/node/2407395 *** SA-CONTRIB-2015-020 - Contact Form Fields - Cross Site Request Forgery (CSRF) *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-020Project: Contact form fields (third-party module)Version: 6.xDate: 2014-January-14Security risk: 13/25 ( Moderately Critical) AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site Request ForgeryDescriptionThe Contact Form Fields module enables you to create additional fields to site-wide contact form.Some links were not properly protected from CSRF. A malicious user could cause an administrator to delete fields by getting the --------------------------------------------- https://www.drupal.org/node/2407357 *** SA-CONTRIB-2015-018 - Video - Cross Site Scripting (XSS) *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-018Project: Video (third-party module)Version: 7.xDate: 2015-January-14Security risk: 13/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross Site ScriptingDescriptionThis module enables you to upload, convert and playback videos.The module doesnt sufficiently sanitize node titles when using the video WYSIWYG plugin, thereby opening a Cross Site Scripting (XSS) vulnerability.This vulnerability is mitigated by --------------------------------------------- https://www.drupal.org/node/2407341 *** SA-CONTRIB-2015-015 - Term Merge - Cross Site Scripting (XSS) *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-015Project: Term merge (third-party module)Version: 7.xDate: 2015-January-14Security risk: 12/25 ( Moderately Critical) AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site ScriptingDescriptionThis module enables you to merge (synonymous) taxonomy terms among themselves.The module doesnt sufficiently filter user input under certain conditions, thereby opening a Cross Site Scripting (XSS) vulnerability.This vulnerability is --------------------------------------------- https://www.drupal.org/node/2407315 *** PHPKIT result cross-site scripting *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/99904

1 0

Tageszusammenfassung - Mittwoch 14-01-2015
by Daily end-of-shift report 14 Jan '15

14 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 13-01-2015 18:00 − Mittwoch 14-01-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** AMD plugs firmware holes that allowed command injection *** --------------------------------------------- Bug your notherboard vendor for a fix, says boffin VID Chip maker AMD has patched holes across its firmware lines that could allow hackers to inject malware. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/01/14/amd_plugs_c… *** Hintergrund: Universeller SSL-Tester SSLyze *** --------------------------------------------- SSL mit Kommandozeilen-Tools von Hand zu testen, ist mühselig; SSLyze nimmt Admins viel dieser Arbeit ab. --------------------------------------------- http://www.heise.de/security/artikel/Universeller-SSL-Tester-SSLyze-2470008… *** Patchday: Microsoft stopft acht Lücken in Windows *** --------------------------------------------- Am Januar-Patchday überrascht die Firma damit, ausschließlich Lücken in Windows zu schließen. Für den Internet Explorer wird lediglich ein Patch vom Dezember noch einmal aufgewärmt. --------------------------------------------- http://www.heise.de/newsticker/meldung/Patchday-Microsoft-stopft-acht-Lueck… *** MMD-0030-2015 New ELF malware on Shellshock: the ChinaZ *** --------------------------------------------- BackgroundThe bash Shellshock vulnerability is still proven to be one of the fastest way to spread ELF malware infection to NIX boxes in internet, along with Linux system that is still serving the vulnerable version. This fact that is not knowing only by internet security folks, but by the threat actors themself. Previously we announced linux/Mayhem malwarere was utilizing the shellshock previously, and now ELF malware actors in China is starting to utilized set of tools to spread more... --------------------------------------------- http://blog.malwaremustdie.org/2015/01/mmd-0030-2015-new-elf-malware-on.html *** Security updates available for Adobe Flash Player *** --------------------------------------------- Adobe has released security updates for Adobe Flash Player for Windows, Macintosh and Linux. These updates address vulnerabilities that could potentially allow an attacker to take control of the affected system. ... CVE number: CVE-2015-0301, CVE-2015-0302, CVE-2015-0303, CVE-2015-0304, CVE-2015-0305, CVE-2015-0306, CVE-2015-0307, CVE-2015-0308, CVE-2015-0309 --------------------------------------------- http://helpx.adobe.com/security/products/flash-player/apsb15-01.html *** Asus schließt kritische Router-Lücke *** --------------------------------------------- Liefert wenige Tage nach Bekanntwerden Updates für zahlreiche Geräte --------------------------------------------- http://derstandard.at/2000010378742 *** Amsterdam 2015 FIRST Technical Colloquium *** --------------------------------------------- The FIRST Amsterdam Technical Colloquium (TC) 2015 will be hosted by Cisco Systems in Amsterdam, Netherlands. The event will be a plenary style conference held on the 5th and 6th of May 2015, with optional, free training sessions on May 4th. FIRST is looking for speakers that would like to present at this Technical Colloquium. This is a GREAT opportunity to give something back to FIRST and the industry, while practicing your speaking skills and sharing your hard work. --------------------------------------------- http://www.first.org/events/colloquia/amsterdam2015 *** At this rate it will hit the launch codes in... 5.3 minutes. *** --------------------------------------------- Hello everyone, in this post I would like to analyze an Android application which purpose is to manage and generate passwords securely. On their Play Store page they claim to use DES to encrypt passwords on local device and that DES key is derivated from you PIN code... --------------------------------------------- https://bughardy.me/at-this-rate-it-will-hit-the-launch-codes-in-5-3-minute… *** MSRT January 2015 - Dyzap *** --------------------------------------------- This month we added the Win32/Emotet and Win32/Dyzap malware families to the Malicious Software Removal Tool. Both Emotet and Dyzap are trojans that steal personal information, including banking credentials. In a previous blog we detailed how Emotet targets German-language banking websites. In this blog, we will focus on Dyzap - another prevalent banking trojan that predominantly targets English-speaking countries. Dyzap variants target credentials for online banking, crypto... --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/01/13/msrt-january-2015-dyzap.… *** 4 Mega-Vulnerabilities Hiding in Plain Sight (Dark Reading) *** --------------------------------------------- How four recently discovered, high-impact vulnerabilities provided "god mode" access to 90% of the Internet for 15 years, and what that means for the future. --------------------------------------------- http://www.darkreading.com/vulnerabilities---threats/4-mega-vulnerabilities… *** Phony Oracle Patches Making the Rounds *** --------------------------------------------- Attackers are circulating fake fixes for Oracle error messages and the company is warning users not to download any patches that don't come directly from Oracle. --------------------------------------------- http://threatpost.com/phony-oracle-patches-making-the-rounds/110415 *** Akamai: Probleme mit alten SSL-Implementierungen *** --------------------------------------------- Akamai verarbeitet eine Billiarde an Verbindungen pro Jahr. Brian Sniffen gibt Einblicke, was das bedeutet - und welche Schwierigkeiten darin bestehen, alte SSL-Implementierungen auszusperren. (Akamai, Android) --------------------------------------------- http://www.golem.de/news/akamai-probleme-mit-alten-ssl-implementierungen-15… *** JSA10670 - 2015-01 Security Bulletin: Junos: Malformed BGP FlowSpec prefix triggers rpd crash (CVE-2014-6386) *** --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10670&actp=RSS *** JSA10668 - 2015-01 Security Bulletin: Junos: Fragmented OSPFv3 packets with IPsec AH may trigger kernel crash (CVE-2014-6385) *** --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10668&actp=RSS *** JSA10666 - 2015-01 Security Bulletin: Junos: Firewall filter fails to match on port (CVE-2014-6383) *** --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10666&actp=RSS *** JSA10665 - 2015-01 Security Bulletin: Junos: jpppd core when MX Series router receives crafted PAP Authenticate-Request (CVE-2014-6382) *** --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10665&actp=RSS *** Cisco ASA DHCPv6 Relay DoS Vulnerability *** --------------------------------------------- CVE-2015-0578 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Cisco TelePresence VCS and Expressway High CPU Utilization Vulnerability *** --------------------------------------------- CVE-2015-0579 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Cisco AsyncOS ISQ XSS Vulnerability *** --------------------------------------------- CVE-2015-0577 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Cisco AnyConnect User Interface Dialog Rendered When Connecting to Arbitrary Hosts Vulnerability *** --------------------------------------------- CVE-2014-3314 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** VU#117604: Panasonic Arbitrator Back-End Server (BES) uses unencrypted communication *** --------------------------------------------- Vulnerability Note VU#117604 Panasonic Arbitrator Back-End Server (BES) uses unencrypted communication Original Release date: 13 Jan 2015 | Last revised: 13 Jan 2015 Overview Panasonic Arbitrator Back-End Server (BES) uses an unencrypted channel to transmit data. Description CWE-319: Cleartext Transmission of Sensitive InformationPanasonic Arbitrator Back-End Server (BES) uses an unencrypted channel to transmit data between the client and server. It has been reported that Active Directory --------------------------------------------- http://www.kb.cert.org/vuls/id/117604 *** Mozilla Firefox Multiple Flaws Let Remote Users Execute Arbitrary Code, Conduct Cross-Site Request Forgery Attacks, and Obtain Potentially Sensitive Information *** --------------------------------------------- http://www.securitytracker.com/id/1031533 *** Foxit MobilePDF 4.4.0 Local File Inclusion / Arbitrary File Upload *** --------------------------------------------- Topic: Foxit MobilePDF 4.4.0 Local File Inclusion / Arbitrary File Upload Risk: High Text:Document Title: Foxit MobilePDF v4.4.0 iOS - Multiple Web Vulnerabilities References (Source): == http://w... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015010071 *** Lexmark MarkVision Enterprise Arbitrary File Upload *** --------------------------------------------- This module exploits a code execution flaw in Lexmark MarkVision Enterprise before 2.1. A directory traversal in the fdFileUploadServlet servlet allows an unauthenticated attacker to upload arbitrary files, including arbitrary JSP code. This module has been tested successfully on Lexmark MarkVision Enterprise 2.0 with Windows 2003 SP2. --------------------------------------------- http://www.exploit-db.com/exploits/35776/ *** Dell iDRAC IPMI 1.5 - Insufficient Session ID Randomness *** --------------------------------------------- This tool checks whether a BMC machine is vulnerable to CVE-2014-8272 (http://www.kb.cert.org/vuls/id/843044) by logging the TemporarySessionID/SessionID in each IPMI v1.5 session, and checking that these values are incremental... --------------------------------------------- http://www.exploit-db.com/exploits/35770/ *** Simple Security <= 1.1.5 - Two Cross-Site Scripting (XSS) Vulnerabilities *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7753

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily