Daily

daily@lists.cert.at

1 participants
3154 discussions

Tageszusammenfassung - Mittwoch 2-04-2014
by Daily end-of-shift report 02 Apr '14

02 Apr '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 01-04-2014 18:00 − Mittwoch 02-04-2014 18:00 Handler: Robert Waldner Co-Handler: n/a *** Whitehat Securitys Aviator browser is coming to Windows *** --------------------------------------------- I have had the privilege of knowing Jeremiah Grossman, the iCEO of Whitehat Security, for many years now. He has spoken on many occasions about web security and specifically web browser security or rather, the lack thereof. I recall at one point asking him, "OK, what do you use as a web browser?" He paused, smiled and said, "My own". That Cheshire cat response played over again in my head when Whitehat Security released their browser offering called Aviator. This is a --------------------------------------------- http://www.csoonline.com/article/2136258/application-security/whitehat-secu… *** 110,000 Wordpress Databases Exposed *** --------------------------------------------- For years now Ive been writing my various blog posts and I have used many different kinds of CMS platforms right back to posting using VI back in the 90s. My favourite platform that Ive used to create content has been Wordpress by far. I can almost here the security folks cringe. Yes, it is a massive headache to lockdown. But, I fight on as the user experience makes the pain worthwhile. OK, maybe worthwhile isnt the correct word. This is a platform that has had a long history of security --------------------------------------------- http://www.csoonline.com/article/2136246/application-security/110-000-wordp… *** "ct wissen Windows": So meistern Sie das Support-Ende von Windows XP *** --------------------------------------------- Pünktlich zum Support-Ende von Windows XP veröffentlichen wir mit dem "ct wissen Windows" ein Handbuch für alle Betroffenen. Es erläutert nicht nur, was das Support-Ende genau bedeutet, sondern liefert vor allem Praxis-Anleitungen. --------------------------------------------- http://www.heise.de/newsticker/meldung/c-t-wissen-Windows-So-meistern-Sie-d… *** Call for packets udp/137 broadcast, (Tue, Apr 1st) *** --------------------------------------------- One of our readers have reported that he has seen a broadcast traffic to udp/137 . He suspected that the traffic cause a denial of service to some of his systems. If you have seen such traffic and you would like to share some packets we would appreciate that. (c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. --------------------------------------------- http://isc.sans.edu/diary.html?storyid=17887&rss *** AlienVault Open Source SIM date_from SQL injection *** --------------------------------------------- AlienVault Open Source SIM (OSSIM) is vulnerable to SQL injection. A remote authenticated attacker could send specially-crafted SQL statements to the ISO27001Bar1.php script using the date_from parameter, which could allow the attacker to view, add, modify or delete information in the back-end database. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/92172 *** Password bug let me see shoppers credit cards in eBay ProStores, claims infosec bod *** --------------------------------------------- Online bazaar fixes store account hijack flaw, were told A serious vulnerability that potentially allowed shoplifters to empty eBay ProStores shops and swipe customer credit cards has been fixed according to the security researcher who says he found the hole. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/04/01/ebay_stores… *** Fake Google apps removed from Window Phone Store by Microsoft *** --------------------------------------------- Five phony Google apps appeared in the app store, each with a $1.99 price tag, before being removed by the company. --------------------------------------------- http://feedproxy.google.com/~r/SCMagazineHome/~3/fXb73Il-oZg/ *** Hack of Boxee.tv exposes password data, messages for 158,000 users *** --------------------------------------------- Huge file circulating online contains e-mail addresses, full message histories. --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/B676MRE54C8/ *** IT Analyst Highlights 6 IT Security 'Worst Practices' *** --------------------------------------------- In a new Network World article, prominent IT analyst and researcher Linda Musthaler is highlighting 6 'worst practices' that companies commit on their way to undermining, destabilizing, or just plain wrecking their IT security efforts: Failing to stay up-to-date with the latest technologies and techniques. Neglecting to take a comprehensive network security approach that also [...]The post IT Analyst Highlights 6 IT Security 'Worst Practices' appeared first on Seculert --------------------------------------------- http://www.seculert.com/blog/2014/04/it-analyst-highlights-6-it-security-wo… *** HP integrated Lights Out (iLO) IPMI Protocol Flaw Lets Remote Users Obtain Hashed Passwords *** --------------------------------------------- A vulnerability was reported in HP integrated Lights Out (iLO). A remote user can gain obtain hashed passwords. A remote user can invoke the IPMI 2.0 protocol to obtain the target user's salted SHA1 or MD5 hash. The vulnerability resides in the protocol design and is mandated by the IPMI 2.0 specification. --------------------------------------------- http://www.securitytracker.com/id/1029981 *** Extended Random: The PHANTOM NSA-RSA backdoor that never was *** --------------------------------------------- Profs paper was all about attacking Dual EC DRBG, not a Snowden-esque spy bombshell Over the last day or so the security press has been touting stories of a second NSA-induced backdoor in RSAs encryption software BSafe. But it appears to be more sound and fury than substance. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/04/02/extended_ra… *** Safari für Mac OS X: Update schließt Sicherheitslücken und bringt einige Neuerungen *** --------------------------------------------- Der Apple-Webbrowser ist für OS X Mavericks und OS X Mountain Lion in neuen Versionen verfügbar. Neben Patches gegen Sicherheitslücken gibt es Bugfixes und Änderungen an der Benachrichtigungsfunktion. --------------------------------------------- http://www.heise.de/security/meldung/Safari-fuer-Mac-OS-X-Update-schliesst-… *** [2014-04-02] Multiple vulnerabilities in Rhythm File Manager *** --------------------------------------------- An attacker being able to connect to the Android device (e.g. if he uses the same Wireless network), can access arbitrary local files from the device while the File Manager app is being used to stream media. Moreover, a malicious Android app or an attacker being able to connect to the Android device may issue system commands as the user "root" if "root browsing" is enabled. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2014… *** Analysis: Financial cyber threats in 2013. Part 1: phishing *** --------------------------------------------- It has been quite a few years since cybercriminals started actively stealing money from user accounts at online stores, e-payment systems and online banking systems. --------------------------------------------- http://www.securelist.com/en/analysis/204792330/Financial_cyber_threats_in_… *** Bugtraq: [IMF 2014] Call for Participation *** --------------------------------------------- See the program at: http://www.imf-conference.org/imf2014/program.html The conference will take place from Monday, May 12th through Wednesday, May 14th in Münster, Germany. Registration details: http://www.imf-conference.org/imf2014/registration.html --------------------------------------------- http://www.securityfocus.com/archive/1/531707 *** VU#917700: Huawei Echo Life HG8247 optical router XSS vulnerability *** --------------------------------------------- Vulnerability Note VU#917700 Huawei Echo Life HG8247 optical router XSS vulnerability Original Release date: 02 Apr 2014 | Last revised: 02 Apr 2014 Overview Huawei Echo Life HG8247 optical router contains a stored cross-site scripting (XSS) vulnerability Description It has been reported that Huawei Echo Life HG8247 optical routers running software version V1R006C00S120 or earlier contain a stored cross-site scripting (XSS) vulnerability. An unauthenticated attacker can perform a stored --------------------------------------------- http://www.kb.cert.org/vuls/id/917700

1 0

Tageszusammenfassung - Dienstag 1-04-2014
by Daily end-of-shift report 01 Apr '14

01 Apr '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 31-03-2014 18:00 − Dienstag 01-04-2014 18:00 Handler: Robert Waldner Co-Handler: n/a *** Report: RSA endowed crypto product with second NSA-influenced code *** --------------------------------------------- Extended Random like "dousing yourself with gasoline," professor warns. --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/TbwAXYKTq34/ *** Old School Code Injection in an ATM .dll *** --------------------------------------------- During our last ATM review engagement, we found some interesting executable files that were run by Windows Services under Local System account. These binaries had weak file permissions that allowed us to modify them using the standard ATM user account. As a proof of concept, I decided to inject some code into one of them to take full control of the system. This post is about the technique I used to inject the code into a .dll used by one of the Windows Services. I’m sure there are many --------------------------------------------- http://feedproxy.google.com/~r/SpiderlabsAnterior/~3/CRAp6jZhvVE/injecting-… *** A Look at the GnuTLS X.509 Verification Code Flaw *** --------------------------------------------- ... it was found that the GnuTLS X.509 certificate verification code fails to properly handle certain error conditions that may occur during the certificate verification process. While verifying the certificate, GnuTLS would report it as successful verification of the certificate, even though verification should have resulted in a failure. This means that invalid certificates may be accepted as valid, --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/iSFhF7R9kFI/ *** Creating an intelligent “sandbox” for coordinated malware eradication *** --------------------------------------------- Hello from China where I am presenting on coordinated malware eradication at the 2014 PC Security Labs Information Security Conference. Coordinated malware eradication was also the topic of my last blog. I said the antimalware ecosystem must begin to work with new types of partners if we are going to move from the current state of uncoordinated malware disruption, to a state of coordinated malware eradication. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2014/03/31/creating-an-intelligent-… *** Its not the breach that kills you, its the cover-up *** --------------------------------------------- Its how you handle yourself during and after a breach that will determine just how detrimental the breach actually is for your organization. --------------------------------------------- http://feedproxy.google.com/~r/SCMagazineHome/~3/Mi55LWhfA9c/ *** Managing Windows XP’s Risks in a Post-Support World *** --------------------------------------------- There are now less than two weeks left until Microsoft terminates support for the incredibly long-lived Windows XP. Rarely has a tech product lasted as long as XP has – from XP’s launch on October 25, 2001 to its last Patch Tuesday on April 8, 2014 a total of 12 years, 5 months, and two […]Post from: Trendlabs Security Intelligence Blog - by Trend MicroManaging Windows XP’s Risks in a Post-Support World --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/fSwrdK2qOeg/ *** EMC Cloud Tiering Appliance Request Validation Flaw Lets Remote Users View Files *** --------------------------------------------- A vulnerability was reported in EMC Cloud Tiering Appliance. A remote user can view files on the target system. The '/api/login' script does not properly validate user-supplied input. A remote user can supply a specially crafted XML External Entity (XXE) link to view files on target system with root privileges. --------------------------------------------- http://www.securitytracker.com/id/1029979 *** Grazer Linuxtage 2014: "Sicherheit im Netz" mit freier Software *** --------------------------------------------- Alternative Software-Szene lädt an der FH-Joanneum zu Workshops und Vorträgen --------------------------------------------- http://derstandard.at/1395363812795 *** Horde webmail - Open Redirect Vulnerability *** --------------------------------------------- An open redirect is an application that takes a parameter and redirects a user to the parameter value without any validation. This vulnerability is used in phishing attacks to get users to visit malicious sites without realizing it. --------------------------------------------- http://cxsecurity.com/issue/WLB-2014040004 *** ModSecurity HTTP Requests Chunked Encoding Security Bypass Vulnerability *** --------------------------------------------- Martin Holst Swende has reported a vulnerability in ModSecurity, which can be exploited by malicious people to bypass certain security restrictions. The vulnerability is caused due to an error in the "modsecurity_tx_init()" function (apache2/modsecurity.c), which can be exploited to bypass the HTTP request body processing via a specially crafted request using chunked encoding. --------------------------------------------- https://secunia.com/advisories/57444 *** ct-Special "Umstieg auf Linux" am Kiosk erhältlich *** --------------------------------------------- Umsteigen auf Linux – warum nicht? Linux bietet eine Menge Vorteile – nicht nur für XP-Anwender, die demnächst keine Sicherheits-Fixes von Microsoft mehr erhalten. Das neue Sonderheft der ct-Redaktion hilft beim sanften Umstieg von Windows auf Linux. --------------------------------------------- http://www.heise.de/newsticker/meldung/c-t-Special-Umstieg-auf-Linux-am-Kio… *** IBM WebSphere Portal Two Cross-Site Scripting Vulnerabilities *** --------------------------------------------- Two vulnerabilities have been reported in IBM WebSphere Portal, which can be exploited by malicious people to conduct cross-site scripting attacks. --------------------------------------------- https://secunia.com/advisories/57592 *** cPanel Multiple Vulnerabilities *** --------------------------------------------- Two weaknesses, a security issue, and multiple vulnerabilities have been reported in cPanel, which can be exploited by malicious, local users to disclose potentially sensitive information and manipulate certain data, by malicious users to disclose potentially sensitive information, conduct script insertion attacks, manipulate certain data, and compromise a vulnerable system and by malicious people to conduct spoofing and cross-site scripting attacks and bypass certain security restrictions. --------------------------------------------- https://secunia.com/advisories/57576 *** VU#893726: Zyxel P660 series modem/router denial of service vulnerability *** --------------------------------------------- Zyxel P660 series modem/router contains a denial of service vulnerability when parsing a high volume of SYN packets on the web management interface. --------------------------------------------- http://www.kb.cert.org/vuls/id/893726 *** Cisco Security Manager HTTP Header Redirection Vulnerability *** --------------------------------------------- A vulnerability in the web framework of Cisco Security Manager could allow an unauthenticated, remote attacker to inject a crafted HTTP header which will cause a web page redirection to a possible malicious website. The vulnerability is due to insufficient validation user input of user input before using it as an HTTP header value. An attacker could exploit this vulnerability by convincing a user to access a crafted URL. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco WSA HTTP Header Injection Vulnerability *** --------------------------------------------- A vulnerability in the web framework of Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to inject a crafted HTTP header that could cause a web page redirection to a possible malicious website. The vulnerability is due to insufficient validation of user input before using it as an HTTP header value. An attacker could exploit this vulnerability by persuading a user to access a crafted URL. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014…

1 0

Tageszusammenfassung - Montag 31-03-2014
by Daily end-of-shift report 31 Mar '14

31 Mar '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 28-03-2014 18:00 − Montag 31-03-2014 18:00 Handler: Robert Waldner Co-Handler: n/a *** Siemens ROS Improper Input Validation *** --------------------------------------------- Researcher Aivar Liimets from Martem Telecontrol Systems reported an improper input validation vulnerability in the Siemens Rugged Operating System (ROS), which could cause a denial-of-service (DoS) condition against the device's management web interface. Siemens coordinated the vulnerability details with NCCIC/ICS-CERT and has provided information for mitigation of the vulnerability.This vulnerability can be exploited remotely. --------------------------------------------- http://ics-cert.us-cert.gov/advisories/ICSA-14-087-01 *** WiFi Bug Plagues Philips Internet-Enabled TVs *** --------------------------------------------- Some versions of Philips internet-enabled SmartTVs are vulnerable to cookie theft and an array of other tricks that abuse a lax WiFi setting. --------------------------------------------- http://threatpost.com/wifi-bug-plagues-philips-internet-enabled-tvs/105119 *** VulDB: Adobe Reader 11.0.06 Sandbox erweiterte Rechte *** --------------------------------------------- Die Schwachstelle wurde am 28.03.2014 von VUPEN via Pwn2Own 2014 publiziert. Die Identifikation der Schwachstelle wird seit dem 20.12.2013 mit CVE-2014-0512 vorgenommen. Sie ist schwierig auszunutzen. Der Angriff kann über das Netzwerk erfolgen. Zur Ausnutzung ist keine spezifische Authentisierung erforderlich. Es sind zwar keine technische Details, jedoch ein privater Exploit zur Schwachstelle bekannt. --------------------------------------------- http://www.scip.ch/?vuldb.12723 *** Adobe Flash Player Bugs Let Remote Users Execute Arbitrary Code *** --------------------------------------------- A remote user can create specially crafted content that, when loaded by the target user on a Windows-based system, will trigger a use-after-free and execute arbitrary code on the target system [CVE-2014-0506]. The code will run with the privileges of the target user. VUPEN reported this vulnerability (via Pwn2Own at CanSecWest 2014). A remote user can create specially crafted content that, when loaded by the target user, will trigger a heap overflow and execute arbitrary code on the target system [CVE-2014-0510]. The code will run with the privileges of the target user. Zeguang Zhao and Liang Chen reported this vulnerability (via Pwn2Own at CanSecWest 2014). --------------------------------------------- http://www.securitytracker.com/id/1029969 --------------------------------------------- (Notiz: soweit wir bisher herausfinden konnten, sind noch keine Exploits dazu "in the wild" aufgetaucht.) --------------------------------------------- *** nginx 1.4.6/1.5.11 Heap-based buffer overflow in the SPDY *** --------------------------------------------- A bug in the experimental SPDY implementation in nginx was found, which might allow an attacker to cause a heap memory buffer overflow in a worker process by using a specially crafted request, potentially resulting in arbitrary code execution (CVE-2014-0133). The problem affects nginx 1.3.15 - 1.5.11, compiled with the ngx_http_spdy_module module (which is not compiled by default) and without --with-debug configure option, if the "spdy" option of the "listen" directive is used in a configuration file. The problem is fixed in nginx 1.5.12, 1.4.7. --------------------------------------------- http://cxsecurity.com/issue/WLB-2014030250 *** Chip.de-Forum offenbar gehackt: 2,5 Millionen Nutzerdaten betroffen *** --------------------------------------------- Forumsmitglieder wurden per Mail über Hack informiert - Passwörter wurden außerdem unzureichend geschützt --------------------------------------------- http://derstandard.at/1395363600546 *** Who's Behind the "BLS Weblearn" Credit Card Scam? *** --------------------------------------------- A new rash of credit and debit card scams involving bogus sub-$15 charges and attributed to a company called "BLS Weblearn" is part of a prolific international scheme designed to fleece unwary consumers. This post delves deeper into the history and identity of the credit card processing network that has been enabling this type of activity for years. --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/MxEDIVQPC94/ *** More Device Malware: This is why your DVR attacked my Synology Disk Station, (Mon, Mar 31st) *** --------------------------------------------- Last week, we reported that some of the hosts scanning for port 5000 are DVRs (to be more precise: Hikvision DVRs, commonly used to record video from surveillance cameras [1] ). Today, we were able to recover the malware responsible. You can download the malware here https://isc.sans.edu/diaryimages/hikvision.zip (password: infected) . The malware resides in /dev/cmd.so . A number of additional suspect files where located in the /dev directory which we still need to recover / analyze from the --------------------------------------------- http://isc.sans.edu/diary.html?storyid=17879&rss *** Crack team of cyber warriors arrives to SAVE UK from grid-crippling HACK ATTACKS *** --------------------------------------------- National CERT goes live today The UK is finally getting a national Computer Emergency Response Team (CERT), with the delayed launch of the organisation taking place today. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/03/31/cert_uk_lau… *** Cisco Security Response Team Opens Its Toolbox *** --------------------------------------------- With a variety of security tools, CSIRT is able to detect and analyze malicious traffic throughout the network, including virus propagation, targeted attacks, and commonplace exploits. Because CSIRT continually identifies new security threats, the team needs some historical look-back at what occurred on the network. They also need a solution that can dissect the finer details of security incidents while facing the ever-present restrictions with data storage. --------------------------------------------- https://blogs.cisco.com/security/cisco-security-response-team-opens-its-too…

1 0

Tageszusammenfassung - Freitag 28-03-2014
by Daily end-of-shift report 28 Mar '14

28 Mar '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 27-03-2014 18:00 − Freitag 28-03-2014 18:00 Handler: Robert Waldner Co-Handler: n/a *** New PGP keys *** --------------------------------------------- At CERT.at we had to phase out some old 1024 bit DSA keys as well as create new master-signing keys. This turned out to be a major effort. Key roll-overs are never easy.In order to easy the key roll-over pains, we created a key transition document. This document is signed by the old keys in order to prove authorship. ... --------------------------------------------- http://www.cert.at/services/blog/20140328155445-1086.html *** NTP Amplification, SYN Floods Drive Up DDoS Attack Volumes *** --------------------------------------------- The potency of distributed denial of service attacks has increased steadily but dramatically over the last 14 months. --------------------------------------------- http://threatpost.com/ntp-amplification-syn-floods-drive-up-ddos-attack-vol… *** Schneider Electric Serial Modbus Driver Buffer Overflow *** --------------------------------------------- OVERVIEW Carsten Eiram of Risk-Based Security has identified a stack-based buffer overflow vulnerability in Schneider Electric’s Serial Modbus Driver that affects 11 Schneider Electric products. Schneider Electric has produced patches that mitigate this vulnerability. This vulnerability can be exploited remotely. --------------------------------------------- http://ics-cert.us-cert.gov/advisories/ICSA-14-086-01 *** Apple Credential Phishing via appleidconfirm.net, (Thu, Mar 27th) *** --------------------------------------------- ISC user Craig Cox wrote in alerting us of a fairly sophisticated phishing campaign that is currently in progress. The website appleidconfirm.net has a seemingly realistic Apple login page that is being sent out by email. The site even includes JavaScript code which validates your Apple ID as an email in an attempt to obtain only valid credentials. Upon submitting what it considers valid credentials, youre redirected to the /?2 page of the site which contains another form which appears to --------------------------------------------- http://isc.sans.edu/diary.html?storyid=17869&rss *** SonicWALL Email Security Input Validation Flaw in License Management’ and ‘Advanced Pages Permits Cross-Site Scripting Attacks *** --------------------------------------------- A vulnerability was reported in SonicWALL Email Security. A remote user can conduct cross-site scripting attacks. The 'License Management' and 'Advanced' pages do not properly filter HTML code from user-supplied input before displaying the input. A remote user can cause arbitrary scripting code to be executed by the target user's browser. --------------------------------------------- http://www.securitytracker.com/id/1029965 *** Word and Excel Files Infected Using Windows PowerShell *** --------------------------------------------- Malware targeting Word and Excel files has been around for some time, but we recently encountered a new malware family, CRIGENT (also known as “Power Worm”) which brings several new techniques to the table. (We detect these files as W97M_CRIGENT.JER and X97M_CRIGENT.A.) Most significantly, instead of creating or including executable code, CRIGENT uses the Windows PowerShell --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/9hUmCpAOj9M/ *** OpenSSH 6.6 bypass SSHFP DNS RR checking by HostCertificate *** --------------------------------------------- I've been looking at handling host keys better, and tripped over this bug. Essentially, if the server offers a HostCertificate that the client doesn't accept, then the client doesn't then check for SSHFP records. --------------------------------------------- http://cxsecurity.com/issue/WLB-2014030239 *** [2014-03-28] Multiple vulnerabilities in Symantec LiveUpdate Administrator *** --------------------------------------------- Attackers are able to compromise Symantec LiveUpdate Administrator at the application and database levels because of vulnerable password reset functionality and SQL injection vulnerabilities. This enables access to credentials of update servers on the network without prior authentication. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2014… *** Python "os._get_masked_mode()" Race Condition Security Issue *** --------------------------------------------- A security issue has been reported in Python, which can be exploited by malicious, local users to potentially disclose or manipulate certain data. The security issue is caused due to a race condition within the "os._get_masked_mode()" function (Lib/os.py), which can be exploited to cause certain application-created files to be world-accessible. The security issue is reported in versions 3.4, 3.3, and 3.2. --------------------------------------------- https://secunia.com/advisories/57672 *** IBM Security Bulletin: IBM Operational Decision Manager and WebSphere ILOG JRules: Multiple security vulnerabilities in IBM JRE *** --------------------------------------------- This Security Bulletin addresses the security vulnerabilities that have shipped with the IBM Java Runtime Environment (JRE) included in IBM Operational Decision Manager and IBM ILOG JRules. IBM ODM and ILOG JRules now include the most recent version of the IBM JRE which fixes the security vulnerabilities reported in Oracles Critical Patch Update releases of January 2014. CVE(s): CVE-2014-0423, CVE-2014-0416 and CVE-2014-0411 Affected product(s) and affected version(s): IBM WebSphere ILOG --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** Cisco IOS Software High Priority Queue Denial of Service Vulnerability *** --------------------------------------------- A vulnerability in the packet driver code of Cisco IOS Software could allow an unauthenticated, remote attacker to cause a reload of the affected device, resulting in a denial of service (DoS) condition. CVE-2014-2131 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014…

1 0

Tageszusammenfassung - Donnerstag 27-03-2014
by Daily end-of-shift report 27 Mar '14

27 Mar '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 26-03-2014 18:00 − Donnerstag 27-03-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Allied Telesis AT-RG634A ADSL router unauthenticated webshell *** --------------------------------------------- Risk: High, Allied Telesis AT-RG634A ADSL Broadband router hidden administrative unauthenticated webshell .. --------------------------------------------- http://cxsecurity.com/issue/WLB-2014030221 *** HP Multiple StoreOnce Products Unauthorised Access Security Bypass Vulnerability *** --------------------------------------------- https://secunia.com/advisories/57601 *** Linux Kernel ath9k "ath_tx_aggr_sleep()" Race Condition Vulnerability *** --------------------------------------------- https://secunia.com/advisories/57468 *** When ZOMBIES attack: DDoS traffic triples as 20Gbps becomes the new normal *** --------------------------------------------- Junk traffic mostly floods in from botnets DDoS traffic has more than trebled since the start of 2013, according to a new study released on Thursday that fingers zombie networks as the primary source of junk traffic that can be used to flood websites. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/03/27/ddos_trends… *** DSA-2885-1 libyaml-libyaml-perl -- security update *** --------------------------------------------- Ivan Fratric of the Google Security Team discovered a heap-based buffer overflow vulnerability in LibYAML, a fast YAML 1.1 parser and emitter library. A remote attacker could provide a specially-crafted YAML document that, when parsed by an application using libyaml, would cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application. --------------------------------------------- https://www.debian.org/security/2014/dsa-2885 *** Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication *** --------------------------------------------- Cisco released its semiannual Cisco IOS Software Security Advisory Bundled Publication on March 26, 2014. In direct response to customer feedback, Cisco releases bundles of Cisco IOS Software Security Advisories on the fourth Wednesday of the month in March and September of each calendar year. The publication includes 5 Security Advisories that address vulnerabilities in Cisco IOS Software and 1 Security Advisory that addresses .. --------------------------------------------- http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar14.html *** Malware Hijacks Android Mobile Devices to Mine Cryptocurrency *** --------------------------------------------- Several bits of malware targeting Android mobile devices hijack the smartphone or tablets resources to mine digital currency such as Litecoin or Dogecoin. --------------------------------------------- http://threatpost.com/malware-hijacks-android-mobile-devices-to-mine-crypto…

1 0

Tageszusammenfassung - Donnerstag 27-03-2014
by Daily end-of-shift report 27 Mar '14

27 Mar '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 25-03-2014 18:00 − Mittwoch 26-03-2014 18:00 Handler: Robert Waldner Co-Handler: n/a *** A few updates on "The Moon" worm, (Tue, Mar 25th) *** --------------------------------------------- It has been over a month since we saw the "Moon" worm first exploiting various Linksys routers. I think it is time for a quick update to summarize some of the things we learned since then: Much of what we found so far comes thanks to the malware analysis done by Bernado Rodriges. Bernado used QEMU to run the code in a virtual environment. QEMU is as far as I know the only widely available virtualization technique that can simulate a MIPS CPU while running on an x86 host. --------------------------------------------- http://isc.sans.edu/diary.html?storyid=17855&rss *** WordPress Pingback-Funktion für DDoS-Attacken missbraucht *** --------------------------------------------- WordPress Pingback-Funktion für DDoS-Attacken missbraucht24. März 2014 In den letzten Tagen gab es zahlreiche Medienberichte zu DDoS-Angriffen durch Missbrauch der XML-RPC-Pingback-Funktion von WordPress. Einige dieser Beiträge möchte ich, zur weiterführenden Lektüre für Betroffene und Interessierte, im Folgenden auflisten. Blog Post von Daniel Cid vom Security-Dienstleister Sucuri mit Erklärungen zur Funktionsweise der Attacke. Weiters wird beschrieben, --------------------------------------------- http://www.cert.at/services/blog/20140324230619-1079.html *** Bugtraq: CVE-2013-6955 Synology DSM remote code execution *** --------------------------------------------- webman/imageSelector.cgi in Synology DiskStation Manager (DSM) 4.0 before 4.0-2259, 4.2 before 4.2-3243, and 4.3 before 4.3-3810 Update 1 allows remote attackers to append data to arbitrary files, and consequently execute arbitrary code, via a pathname in the SLICEUPLOAD X-TMP-FILE HTTP header. --------------------------------------------- http://www.securityfocus.com/archive/1/531602 *** OpenSSL 1.0.0l cache side-channel attack *** --------------------------------------------- Topic: OpenSSL 1.0.0l cache side-channel attack Risk: Medium Text:The Montgomery ladder implementation in OpenSSL through 1.0.0l does not ensure that certain swap operations have a constant-tim... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014030197 *** Xen HVMOP_set_mem_access Input Validation Flaw Lets Local Guest Users Deny Service on the Host System *** --------------------------------------------- A local user on the guest operating system can cause denial of service conditions on the host operating system. The HVMOP_set_mem_access HVM control operations does not properly validate input size. A local administrative user on an HVM guest operating system can consume excessive CPU resources on the host operating system. On version 4.2, only 64-bit versions of the hypervisor are affected. Device model emulators (qemu-dm) are affected. --------------------------------------------- http://www.securitytracker.com/id/1029956 *** Walkthrough of a Recent Zbot Infection and associated CnC Server *** --------------------------------------------- During routine ThreatLabZ log analysis, we encountered the following malicious Zbot executable connecting back to its CnC and exfiltrating data via POST requests. --------------------------------------------- http://feedproxy.google.com/~r/zscaler/research/~3/kygTD5dMmHo/walkthrough-… *** MIT Researchers Create Platform To Build Secure Web Apps That Never Leak Data *** --------------------------------------------- rjmarvin writes: "Researchers in the MIT Computer Science and Artificial Intelligence Laboratory have developed a platform for building secure web applications and services that never decrypt or leak data. MIT researcher Raluca Ada Popa, who previously worked on the Google and SAP-adopted CryptoDB, and her team, have put a longstanding philosophy into practice: to never store unencrypted data on servers. Theyve redesigned the entire approach to securing online data by creating Mylar, which --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/QIuCSrAxslY/story01.htm *** PAM timestamp internals bypass authentication *** --------------------------------------------- Topic: PAM timestamp internals bypass authentication Risk: Low Text:Hi When playing with some PAM modules for my own projects, I came across some implications of pam_timestamp (which is part ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014030216 *** Nmap-Erfinder rebootet Full Disclosure *** --------------------------------------------- Gordon 'Fyodor' Lyon hat die überraschend geschlossene Full-Disclosure-Mailingliste wiederbelebt. Er habe viel Erfahrung mit dem Administrieren von Mailinglisten und keine Angst vor rechtlichen Drohungen, sagt der Sicherheitsexperte. --------------------------------------------- http://www.heise.de/security/meldung/Nmap-Erfinder-rebootet-Full-Disclosure… *** TYPO3 CMS 6.2 LTS is now available *** --------------------------------------------- ... TYPO3 CMS 6.2 LTS, which was released today. As the second TYPO3 release with long-term support (LTS), TYPO3 CMS 6.2 LTS will receive at least three years of support from the development team behind the open-source software. --------------------------------------------- http://typo3.org/news/article/typo3-presents-the-latest-version-of-its-free… *** Jetzt VoIP-Passwort ändern: Kriminelle nutzen erbeutete Fritzbox-Daten aus *** --------------------------------------------- Die Fritzbox-Angreifer haben anscheinend lange Zeit unbemerkt Zugangsdaten gesammelt, ohne sie zu benutzen. Für die Nutzer hat das jetzt ein übles Nachspiel, denn die meisten Passwörter funktionieren weiterhin. Der Schaden geht in die Hunderttausende. --------------------------------------------- http://www.heise.de/security/meldung/Jetzt-VoIP-Passwort-aendern-Kriminelle… *** Splunk Unspecified Cross-Site Scripting Vulnerability *** --------------------------------------------- A vulnerability has been reported in Splunk, which can be exploited by malicious people to conduct cross-site scripting attacks. Certain unspecified input is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. The vulnerability is reported in versions prior to 5.0.8. --------------------------------------------- https://secunia.com/advisories/57554 *** libcURL Connection Re-use and Certificate Verification Security Issues *** --------------------------------------------- Multiple security issues have been reported in libcURL, which can be exploited by malicious people to conduct spoofing attacks and bypass certain security restrictions. --------------------------------------------- https://secunia.com/advisories/57434 *** 10 rules of thumb of internet safety *** --------------------------------------------- Malicious parties on the internet try to gain access to your computer, tablet or mobile phone and to intercept personal data. Malware, phishing and spam are frequently occurring threats. These 10 rules of thumb provide a basis to protect yourself against these threats. --------------------------------------------- http://www.ncsc.nl/english/services/expertise-advice/knowledge-sharing/fact… *** New Metasploit 4.9 Helps Evade Anti-Virus Solutions, Test Network Segmentation, and Increase Productivity for Penetration Testers *** --------------------------------------------- Metasploit 4.9 helps penetration testers evade anti-virus solutions, generate payloads, test network segmentation, and generally increase productivity through updated automation and reporting features. Since version 4.8, Metasploit has added 67 new exploits and 51 auxiliary and post-exploitation modules to both its commercial and open source editions, bringing our total module count up to 1,974. The new version is available immediately. --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2014/03/26/new-metas… *** [Honeypot Alert] JCE Joomla Extension Attacks *** --------------------------------------------- Our web honeypots picked up some increased exploit attempts for an old Joomla Content Editor (JCE) Extension vulnerability. Although this vulnerability is a few years old, botnet owners are heavily scanning for sites that are vulnerable and attempting to exploit them. --------------------------------------------- http://feedproxy.google.com/~r/SpiderlabsAnterior/~3/v7CME1mpcfQ/honeypot-a… *** Cisco IOS Software SSL VPN Denial of Service Vulnerability *** --------------------------------------------- A vulnerability in the Secure Sockets Layer (SSL) VPN subsystem of Cisco IOS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to a failure to process certain types of HTTP requests. To exploit the vulnerability, an attacker could submit crafted requests designed to consume memory to an affected device. An exploit could allow the attacker to consume and fragment memory on the affected device. This may cause reduced performance, a failure of certain processes, or a restart of the affected device. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco IOS Software Session Initiation Protocol Denial of Service Vulnerability *** --------------------------------------------- A vulnerability in the Session Initiation Protocol (SIP) implementation in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device. To exploit this vulnerability, affected devices must be configured to process SIP messages. Limited Cisco IOS Software and Cisco IOS XE Software releases are affected. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco IOS Software Crafted IPv6 Packet Denial of Service Vulnerability *** --------------------------------------------- A vulnerability in the implementation of the IP version 6 (IPv6) protocol stack in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause I/O memory depletion on an affected device that has IPv6 enabled. The vulnerability is triggered when an affected device processes a malformed IPv6 packet. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco IOS Software Network Address Translation Vulnerabilities *** --------------------------------------------- The Cisco IOS Software implementation of the Network Address Translation (NAT) feature contains two vulnerabilities when translating IP packets that could allow an unauthenticated, remote attacker to cause a denial of service condition. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco IOS Software Internet Key Exchange Version 2 Denial of Service Vulnerability *** --------------------------------------------- A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of the affected device that would lead to a denial of service (DoS) condition. The vulnerability is due to how an affected device processes certain malformed IKEv2 packets. An attacker could exploit this vulnerability by sending malformed IKEv2 packets to an affected device to be processed. An exploit could allow the attacker to cause a reload of the affected device that would lead to a DoS condition. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Web Browser Security Revisited (Part 5) *** --------------------------------------------- In Part 1 of this series, we discussed the importance of web browser security and some security-related issues that are common to all or many of the popular browsers today. In Part 2, we talked about some specific security mechanisms that are built into Internet Explorer and how they're implemented. In Part 3, we looked at how to configure IE for best security. In Part 4, we examined how to do the same with Google Chrome. This time, we'll look at ... Chrome for Business. --------------------------------------------- http://www.windowsecurity.com/articles-tutorials/Web_Application_Security/w… *** Vuln: Apple Mac OS X APPLE-SA-2014-02-25-1 Multiple Security Vulnerabilities *** --------------------------------------------- Apple Mac OS X is prone to multiple vulnerabilities. The update addresses new vulnerabilities that affect ATS, CFNetwork Cookies, CoreAnimation, CoreText, Date and Time, curl, QuickTime, QuickLook, Finder, and File Bookmark components. Attackers can exploit these issues to execute arbitrary code, gain unauthorized access, bypass security restrictions, and perform other attacks. Failed attacks may cause denial-of-service conditions. These issues affect OS X versions prior to 10.9.2. --------------------------------------------- http://www.securityfocus.com/bid/65777

1 0

Tageszusammenfassung - Dienstag 25-03-2014
by Daily end-of-shift report 25 Mar '14

25 Mar '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 24-03-2014 18:00 − Dienstag 25-03-2014 18:00 Handler: Robert Waldner Co-Handler: n/a *** Microsoft Security Advisory (2953095): Vulnerability in Microsoft Word Could Allow Remote Code Execution - Version: 1.0 *** --------------------------------------------- Microsoft is aware of a vulnerability affecting supported versions of Microsoft Word. At this time, we are aware of limited, targeted attacks directed at Microsoft Word 2010. The vulnerability could allow remote code execution if a user opens a specially crafted RTF file using an affected version of Microsoft Word, or previews or opens a specially crafted RTF email message in Microsoft Outlook while using Microsoft Word as the email viewer. --------------------------------------------- http://technet.microsoft.com/en-us/security/advisory/2953095 *** Security Advisory 2953095: recommendation to stay protected and for detections *** --------------------------------------------- Today, Microsoft released Security Advisory 2953095 to notify customers of a vulnerability in Microsoft Word. At this time, we are aware of limited, targeted attacks directed at Microsoft Word 2010. This blog will discuss mitigations and temporary defensive strategies that will help customers to protect themselves while we are working on a security update. This blog also provides some preliminary details of the exploit code observed in the wild. Mitigations and Workaround The in the wild --------------------------------------------- http://blogs.technet.com/b/srd/archive/2014/03/24/security-advisory-2953095… *** [dos] - Windows Media Player 11.0.5721.5230 - Memory Corruption PoC *** --------------------------------------------- #[+] Exploit Title: Windows Media Player 11.0.5721.5230 Memory Corruption PoC #[+] Date: 22-03-2014 #[+] Category: DoS/PoC #[+] Tested on: WinXp/Windows 7 Pro --------------------------------------------- http://www.exploit-db.com/exploits/32477 *** Security Notice- Allegro RomPager Information Disclosure Vulnerability in Multiple Huawei Routers *** --------------------------------------------- Huawei has noticed an information disclosure vulnerability on the RomPager embedded web server, which is developed by Allegro. The vulnerability affects Huawei HG520c, MT880, and MT886 access routers. --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-notices… *** Bugtraq: Deutsche Telekom CERT Advisory [DTC-A-20140324-001] vulnerabilities in cacti *** --------------------------------------------- Summary: Three vulnerabilities were found in cacti version 0.8.7g. The vulnerabilities are: 1) Stored Cross-Site Scripting (XSS) (via URL) 2) Missing CSRF (Cross-Site Request Forgery) token allows execution of arbitrary commands 3) The use of exec-like function calls without safety checks allow arbitrary commands --------------------------------------------- http://www.securityfocus.com/archive/1/531588 *** Bugtraq: Deutsche Telekom CERT Advisory [DTC-A-20140324-003] vulnerabilities in icinga *** --------------------------------------------- Two vulnerabilities were found in icinga version 1.9.1. These vulnerabilities are: 1) several buffer overflows 2) Off-by-one memory access --------------------------------------------- http://www.securityfocus.com/archive/1/531593 *** Bugtraq: Deutsche Telekom CERT Advisory [DTC-A-20140324-002] vulnerabilities in check_mk *** --------------------------------------------- Several vulnerabilities were found in check_mk version 1.2.2p2. The vulnerabilities are: 1 - Reflected Cross-Site Scripting (XSS) 2 - Stored Cross-Site Scripting (XSS) (via URL) 3 - Stored Cross-Site Scripting (XSS) (via external data, no link necessary) 4 - Stored Cross-Site Scripting (XSS) (via external data on service port, no link necessary) 5 - Missing CSRF (Cross-Site Request Forgery) token allows execution of arbitrary commands 6 - Multiple use of exec-like function calls which allow arbitrary commands 7 - Deletion of arbitrary files --------------------------------------------- http://www.securityfocus.com/archive/1/531594 *** Net-snmp snmptrapd Community String Processing Lets Remote Users Deny Service *** --------------------------------------------- A remote user can send a specially crafted SNMP trap request with an empty community string to trigger a flaw in newSVpv() and cause the target snmptrapd service to crash. Systems with the Perl handler enabled are affected. --------------------------------------------- http://www.securitytracker.com/id/1029950 *** Trojan.PWS.OSMP.21 infects payment terminals *** --------------------------------------------- March 25, 2014 Home users aren't the only ones being targeted by today's threats - various financial organisations are receiving their own share of attention from criminals who are crafting malicious applications for ATMs and payment terminals. Doctor Web has issued a warning regarding one such Trojan, namely, Trojan.PWS.OSMP.21. This malware is infecting the terminals of a major Russian payment system. --------------------------------------------- http://news.drweb.com/show/?i=4259&lng=en&c=9 *** RSA BSAFE Micro Edition Suite (MES) 4.0.x Denial Of Service *** --------------------------------------------- Summary: RSA BSAFE MES 4.0.5 contains fix for a security vulnerability that could potentially be exploited by malicious users to deny access to the affected system. Details: This vulnerability may cause unpredictable application behavior resulting in a server crash due to faulty certificate chain processing logic. --------------------------------------------- http://cxsecurity.com/issue/WLB-2014030193 *** PHP Fileinfo libmagic AWK File Processing Denial of Service Vulnerability *** --------------------------------------------- A vulnerability has been reported in PHP, which can be exploited by malicious people to cause a DoS (Denial of Service). The vulnerability is caused due to an error in the libmagic library bundled in the Fileinfo extension when processing certain AWK scripts, which can be exploited to cause excessive CPU resources consumption via a specially crafted AWK script file. --------------------------------------------- https://secunia.com/advisories/57564 *** OpenVZ update for kernel *** --------------------------------------------- OpenVZ has issued an update for kernel. This fixes multiple vulnerabilities, which can be exploited by malicious people to potentially compromise a vulnerable system. --------------------------------------------- https://secunia.com/advisories/57573 *** Password Hashing Competition *** --------------------------------------------- Theres a private competition to identify new password hashing schemes. Submissions are due at the end of the month. --------------------------------------------- https://www.schneier.com/blog/archives/2014/03/password_hashin.html

1 0

Tageszusammenfassung - Montag 24-03-2014
by Daily end-of-shift report 24 Mar '14

24 Mar '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 21-03-2014 18:00 − Montag 24-03-2014 18:00 Handler: Robert Waldner Co-Handler: n/a *** NSA Targets Sys Admins to Infiltrate Networks *** --------------------------------------------- The latest Snowden documents show how the National Security Agency targets system administrators, in particular their personal email and social media accounts, in order to access target networks. --------------------------------------------- http://threatpost.com/nsa-targets-sys-admins-to-infiltrate-networks/104953 *** IBM Security Bulletin: IBM Security Directory Server can be affected by a vulnerability in IBM WebSphere Application Server (CVE-2014-0411) *** --------------------------------------------- The IBM WebSphere Application Server component provided with IBM Security Directory Server is vulnerable to a transport layer security (TLS) timing attack. --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** BlackOS software package automates website hacking, costs $3,800 a year *** --------------------------------------------- An updated version of a malicious software package designed to automate the process of hacking websites is being offered up on underground markets for $3,800 a year, according to a blog by Trend Micro. --------------------------------------------- http://feedproxy.google.com/~r/SCMagazineHome/~3/yw9wyT8CoMQ/ *** WPA2 Wireless Security Crackable WIth "Relative Ease" *** --------------------------------------------- An anonymous reader writes "Achilleas Tsitroulis of Brunel University, UK, Dimitris Lampoudis of the University of Macedonia, Greece and Emmanuel Tsekleves of Lancaster University, UK, have investigated the vulnerabilities in WPA2 and present its weakness. They say that this wireless security system might now be breached with relative ease [original, paywalled paper] by a malicious attack on a network. --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/GNlVmrhVOM4/story01.htm *** Android update process gives malware a leg-up to evil: Indiana U *** --------------------------------------------- Old apps get access to privileges that didnt exist when they were written Researchers from Indiana University Bloomington have tagged a vulnerability in the way Android handles updates, which they say puts practically every Android device at risk of malicious software.… --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/03/23/android_upd… *** AWS urges developers to scrub GitHub of secret keys *** --------------------------------------------- Devs hit with unexpected bills after leaving secret keys exposed. Amazon Web Services (AWS) is urging developers using the code sharing site GitHub to check their posts to ensure they havent inadvertently exposed their log-in credentials. --------------------------------------------- http://www.itnews.com.au/News/375785,aws-urges-developers-to-scrub-github-o… *** D-Link DIR-600L Cross-Site Request Forgery Vulnerability *** --------------------------------------------- A vulnerability has been reported in D-Link DIR-600L, which can be exploited by malicious people to conduct cross-site request forgery attacks. The application allows users to perform certain actions via HTTP requests without performing proper validity checks to verify the requests. This can be exploited to e.g. change administrative credentials when a logged-in user visits a specially crafted web page. --------------------------------------------- https://secunia.com/advisories/57392 *** Array Networks vxAG / vAPV Undocumented Accounts Security Issues *** --------------------------------------------- Some security issues have been reported in Array Networks vxAG and vAPV, which can be exploited by malicious people to bypass certain security restrictions. The security issues are caused due to the device using certain undocumented user accounts with default credentials, which can be exploited to gain otherwise restricted access to the device. --------------------------------------------- https://secunia.com/advisories/57442 *** PayPal for Android SSL Certificate Validation Security Issue *** --------------------------------------------- MWR InfoSecurity has reported a security issue in PayPal for Android, which can be exploited by malicious people to conduct spoofing attacks. The security issue is caused due to an error when verifying server SSL certificate within the WebHybridClient class and can be exploited to spoof a HTTPS connection and e.g. conduct Man-in-the-Middle (MitM) attacks. --------------------------------------------- https://secunia.com/advisories/57351 *** php-font-lib "name" Cross-Site Scripting Vulnerability *** --------------------------------------------- Daniel C. Marques has reported a vulnerability in php-font-lib, which can be exploited by malicious people to conduct cross-site scripting attacks. Input passed via the "name" GET parameter to www/make_subset.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. --------------------------------------------- https://secunia.com/advisories/57558

1 0

Tageszusammenfassung - Freitag 21-03-2014
by Daily end-of-shift report 21 Mar '14

21 Mar '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 20-03-2014 18:00 − Freitag 21-03-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Taken in phishing attack, Microsoft's unmentionables aired by hacktivists *** --------------------------------------------- If Microsoft and eBay arent safe from social engineering attacks, who is? --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/B9IE0Uei57U/ *** Kaspersky Internet Security Regular Expression Patterns Processing Denial of Service Vulnerability *** --------------------------------------------- CXsecurity has discovered a vulnerability in Kaspersky Internet Security, which can be exploited by malicious people to cause a DoS (Denial of Service). The vulnerability is caused due to an error when processing regular expression patterns and can be exploited to exhaust CPU resources and render the system unusable. --------------------------------------------- https://secunia.com/advisories/57316 *** DotNetNuke Unspecified Script Insertion Vulnerability *** --------------------------------------------- A vulnerability has been reported in DotNetNuke, which can be exploited by malicious users to conduct script insertion attacks. Certain unspecified input is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed. --------------------------------------------- https://secunia.com/advisories/57429 *** WordPress WP-Filebase Download Manager Plugin Arbitrary Code Execution Vulnerability *** --------------------------------------------- A vulnerability has been reported in the WP-Filebase Download Manager plugin for WordPress, which can be exploited by malicious users to compromise a vulnerable system. ... Successful exploitation of this vulnerability requires access rights to upload files (e.g. "Editor" access rights). The vulnerability is reported in version 0.3.0.03. Prior versions may also be affected. --------------------------------------------- https://secunia.com/advisories/57456 *** Zeus variant blocks user activity with full-screen pop-ups *** --------------------------------------------- Infected users are forced to contend with open windows, which are actually legitimate sites being displayed on their desktops. --------------------------------------------- http://feedproxy.google.com/~r/SCMagazineHome/~3/KHHSZFOdcH0/ *** A peek inside a modular, Tor C&C enabled, Bitcoin mining malware bot *** --------------------------------------------- Cybercriminals continue to maliciously 'innovate', further confirming the TTP (tactics, techniques and procedure) observations we made in our Cybercrime Trends 2013 assessment back in December, 2013, namely, that the diverse cybercrime ecosystem is poised for exponential growth. Standardizing the very basics of fraudulent and malicious operations, throughout the years, cybercriminals have successfully achieved a state of malicious economies of scale... --------------------------------------------- http://feedproxy.google.com/~r/WebrootThreatBlog/~3/V6XSH_U-eoU/ *** Siemens SIMATIC S7-1200 Improper Input Validation Vulnerabilities *** --------------------------------------------- OVERVIEWSiemens has reported two improper input validation vulnerabilities discovered separately by Prof. Dr. Hartmut Pohl of softScheck GmbH and Arne Vidström of Swedish Defence Research Agency (FOI) in Siemens' SIMATIC S7-1200 PLC. Siemens has produced a new version that mitigates these vulnerabilities.These vulnerabilities could be exploited remotely.AFFECTED PRODUCTSThe following SIMATIC S7-1200 PLC versions are affected: --------------------------------------------- http://ics-cert.us-cert.gov/advisories/ICSA-14-079-01 *** Siemens SIMATIC S7-1200 Vulnerabilities *** --------------------------------------------- OVERVIEWSiemens, Ralf Spenneberg of OpenSource Training, Lucian Cojocar of EURECOM, Sascha Zinke from the FU Berlin's work team SCADACS, and Positive Technologies' researchers (Alexey Osipov, and Alex Timorin) have identified six vulnerabilities in the Siemens SIMATIC S7-1200 CPU family. Siemens has produced a new product release that mitigates these vulnerabilities.These vulnerabilities could be exploited remotely. --------------------------------------------- http://ics-cert.us-cert.gov/advisories/ICSA-14-079-02 *** Cisco AsyncOS Patch , (Fri, Mar 21st) *** --------------------------------------------- Cisco released a patch for AsyncOS, the operating system used in its E-Mail Security Appliance (ESA) and Security Management Appliance (SMA). The vulnerability is exploited by an authenticated attacker uploading a crafted blocklist file. The file has to be uploaded via FTP, so this vulnerability is only exploitable if the FTP service is enabled. Once the blacklist is pared, arbitrary commands are executed. This sounds like an OS command injection vulnerability. The parameters (assumed to be --------------------------------------------- http://isc.sans.edu/diary.html?storyid=17839&rss *** Linux Kernel Netfilter DCCP Processing Flaw Lets Remote Users Execute Arbitrary Code *** --------------------------------------------- Description: A vulnerability was reported in the Linux Kernel. A remote user can execute arbitrary code on the target system. A remote user can send specially crafted DCCP data to trigger a memory corruption flaw in 'nf_conntrack_proto_dccp.c' and execute arbitrary code on the target system. --------------------------------------------- http://www.securitytracker.com/id/1029945 *** Horde Framework Unserialize PHP Code Execution *** --------------------------------------------- Topic: Horde Framework Unserialize PHP Code Execution Risk: High Text:## # This module requires Metasploit --------------------------------------------- http://cxsecurity.com/issue/WLB-2014030175 *** Monitoring for unusual network traffic key to banking botnet detection *** --------------------------------------------- Malware authors have had great success targeting financial institutions in recent years, and in turn those organizations have a vested interest in improving their banking botnet detection capabilities. However, one expert says financial firms are failing because they ignore unusual network traffic. --------------------------------------------- http://searchsecurity.techtarget.com/news/2240216637/Monitoring-for-unusual… *** Nokia X Android smartphone security features detailed *** --------------------------------------------- ... the Nokia X comes with the required security features to protect the data stored on the device without downloading third-party security apps. The three main ways to protect the data on the Nokia X smartphone is the screen security, encryption, and SIM card lock. --------------------------------------------- http://gadgets.ndtv.com/mobiles/news/nokia-x-android-smartphone-security-fe… *** Linux Worm Darlloz Infects over 31,000 Devices in Four Months *** --------------------------------------------- The worm is designed to infect computers running Intel x86 architectures, but it's also capable of infecting devices running MIPS, ARM, PowerPC architectures. Routers, set-top boxes and other devices usually have this kind of architecture. Based on its investigation, Symantec has determined that the main goal of Darlloz is to abuse infected devices for crypto-currency mining. Once it's installed on a computer, the worm installs open source mining software (cpuminer). --------------------------------------------- http://news.softpedia.com/news/Linux-Worm-Darlloz-Infects-over-31-000-Devic… *** Mass-Produced ATM Skimmers, Rogue PoS Terminals via 3D Printing? *** --------------------------------------------- On several underground forums, a cybercriminal named gripper is selling ATM skimmers and fake POS terminals, and is making some very bold claims doing so: Figure 1. Underground advertisement. The cybercriminal claims that he can mass-produce VeriFone VerixV point-of-sale (PoS) devices. (Verifone is a US-based provider of POS terminals.) Some specific VeriFone products such as the Vx510... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/YmksHI4j1OM/ *** Spotlight on Java SE 8 Security *** --------------------------------------------- March 18, 2014 was the long anticipated release of Java SE 8. I though I would spotlight some of the key security features of Java 8 for readers. First, many are not aware of security improvements made to Java 7. Let's begin with a quick review the Java SE 7 security features that were rolled into Java SE 8. --------------------------------------------- http://www.securitycurmudgeon.com/2014/03/20/spotlight-on-java-se-8-securit… *** IBM Security Bulletin: IBM WebSphere MQ Internet Pass-Thru - Potential denial of service on the command port listener (CVE-2013-5401) *** --------------------------------------------- A denial of service vulnerability exists and could be exploited by a remotely connected user to stop the remote administration service. CVE(s): CVE-2013-5401 Affected product(s) and affected version(s): WebSphere MQIPT 2.1.0.0 WebSphere MQIPT 2.0.x Refer to the following reference URLs for remediation and additional vulnerability details: Source Bulletin: http://www-01.ibm.com/support/docview.wss?uid=swg21666863 X-Force Database: http://xforce.iss.net/xforce/xfdb/87297 --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** OpenSSL ECDSA Nonces Recovery Weakness *** --------------------------------------------- Yuval Yarom and Naomi Benger have reported a weakness in OpenSSL, which can be exploited by malicious, local users to disclose certain sensitive information. --------------------------------------------- https://secunia.com/advisories/57091 *** OpenSSH "child_set_env()" Security Bypass Security Issue *** --------------------------------------------- The security issue is caused due to an error within the "child_set_env()" function (usr.bin/ssh/session.c) and can be exploited to bypass intended environment restrictions by using a substring before a wildcard character. --------------------------------------------- https://secunia.com/advisories/57488 *** Oracle VirtualBox 3D Acceleration Multiple Privilege Escalation Vulnerabilities *** --------------------------------------------- Core Security has reported multiple vulnerabilities in Oracle VirtualBox, which can be exploited by malicious, local users in a guest virtual machine to gain escalated privileges. --------------------------------------------- https://secunia.com/advisories/57384 *** Cisco Hosted Collaboration Solution Packet Processing Denial of Service Vulnerability *** --------------------------------------------- A vulnerability has been reported in Cisco Hosted Collaboration Solution, which can be exploited by malicious people to cause a DoS (Denial of Service). --------------------------------------------- https://secunia.com/advisories/57496 *** Video zeigt Jailbreak von iOS 7.1 *** --------------------------------------------- Ein Entwickler hat seine Arbeit an einem Jailbreak von iOS 7.1 demonstriert. Apple hatte mit dem jüngsten iOS-Update die Schwachstellen geschlossen, die für den letzten Jailbreak zum Einsatz kamen. --------------------------------------------- http://www.heise.de/newsticker/meldung/Video-zeigt-Jailbreak-von-iOS-7-1-21…

1 0

Tageszusammenfassung - Donnerstag 20-03-2014
by Daily end-of-shift report 20 Mar '14

20 Mar '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 19-03-2014 18:00 − Donnerstag 20-03-2014 18:00 Handler: Alexander Riepl Co-Handler: Stephan Richter *** ZBOT Adds Clickbot Routine To Arsenal *** --------------------------------------------- The ZeuS/ZBOT malware family is probably one of the most well-known malware families today . It is normally known for stealing credentials associated with online banking accounts. However, ZBOT is no one-trick pony. Some ZBOT variants perform other routines like downloading or dropping other threats like ransomware. We recently came across one variant detected as TROJ_ZCLICK.A,... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/rrelQiGbzao/ *** New BlackOS Software Package Sold In Underground Forums *** --------------------------------------------- We recently came across this particular post in an underground forum: Figure 1. Underground forum post This particular post in Russian was advertising a new product, known as "BlackOS". Contrary to the name, it is not an operating system. However, it is definitely "black", or malicious: it is used to manage and redirect Internet traffic... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/mA8O58qz-TQ/ *** Phishing: Gehackter EA-Server hostet falsche Apple-Webseite *** --------------------------------------------- Kriminelle Hacker haben auf Servern des Spieleherstellers Electronic Arts eine gefälschte Webseite untergebracht, die Apple-IDs samt Passwörtern und Kreditkarteninformationen verlangt. Wie viele Nutzer ihre Daten dort eingegeben haben, ist nicht bekannt. --------------------------------------------- http://www.golem.de/news/phishing-gehackter-ea-server-hostet-falsche-apple-… *** "goto fail": Apple drängt Nutzer zum Update *** --------------------------------------------- Der Mac-Hersteller fordert inzwischen dazu auf, das Update auf OS X 10.9.2 alsbald möglich zu installieren - falls noch nicht geschehen. Ältere Versionen von OS X Mavericks und iOS weisen eine gravierende SSL-Schwachstelle auf. --------------------------------------------- http://www.heise.de/security/meldung/goto-fail-Apple-draengt-Nutzer-zum-Upd… *** Android: Sicherheitslücken wegen fehlender Updates bleiben Problem *** --------------------------------------------- 70 Prozent aller Android-Geräte weltweit besitzen eine Browser-Lücke, glaubt ein Forscher. Der simple Aufruf einer Website reicht, um sie auszunutzen. --------------------------------------------- http://www.heise.de/newsticker/meldung/Android-Sicherheitsluecken-wegen-feh… *** Analysis: Spam report: February 2014 *** --------------------------------------------- The share of spam in global email traffic decreased by 7.6 percentage points and averaged 65.7% in January. As forecasted, the drop in the share of spam was due to a lull early in January when there is less business activity and a large number of botnets are turned off. --------------------------------------------- http://www.securelist.com/en/analysis/204792328/Spam_report_February_2014 *** Protokollanalyse: Mogeln im Quizduell *** --------------------------------------------- Entwickler verlassen sich zu sehr auf HTTPS und verzichten auf grundlegende Sicherheitsmaßnahmen. Über eine Man-in-the-Middle-Attacke konnten Security-Forscher in den Datenverkehr zwischen App-Server und Apps hineinsehen - und entdeckten Sonderbares. --------------------------------------------- http://www.golem.de/news/protokollanalyse-mogeln-im-quizduell-1403-105276-r… *** Cisco IronPort AsyncOS Software for ESA and SMA File Validation Flaw Lets Remote Authenticated Users Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1029937 *** SA-CONTRIB-2014-033 - Nivo Slider - Cross Site Scripting *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2014-033Project: Nivo Slider (third-party module)Version: 7.xDate: 2014-March-19Security risk: Moderately criticalExploitable from: RemoteVulnerability: Cross Site ScriptingDescriptionNivo Slider provides a way to showcase featured content. Nivo Slider gives administrators a simple method of adding slides to the slideshow, an administration interface to configure slideshow settings, and simple slider positioning using the Drupal block system.The module doesnt... --------------------------------------------- https://drupal.org/node/2221481

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily