Daily

daily@lists.cert.at

1 participants
3190 discussions

Tageszusammenfassung - Donnerstag 10-04-2014
by Daily end-of-shift report 10 Apr '14

10 Apr '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 09-04-2014 18:00 − Donnerstag 10-04-2014 18:00 Handler: Alexander Riepl Co-Handler: Stephan Richter *** Hintergrund: Passwörter in Gefahr - was nun? *** --------------------------------------------- Durch Heartbleed sind theoretisch schon wieder viele Millionen Passwörter in Gefahr. Sicherheitsexperten raten dazu, alle zu ändern. heise-Security-Chefredakteur Jürgen Schmidt schätzt das anders ein. --------------------------------------------- http://www.heise.de/security/artikel/Passwoerter-in-Gefahr-was-nun-2167584.… *** Heartbleed: 600.000 Server immer noch ungeschützt *** --------------------------------------------- Die Sicherheitslücke Heartbleed zieht immer weitere Kreise. Möglicherweise wurde die Schwachstelle schon seit Monaten ausgenutzt. --------------------------------------------- http://futurezone.at/digital-life/heartbleed-600-000-server-immer-noch-unge… *** Sicherheitslücke: Unternehmen können für Schäden durch Heartbleed haftbar sein *** --------------------------------------------- Der Heartbleed-Bug gilt als eine der gravierendsten Sicherheitslücken aller Zeiten. Millionen SSL-gesicherte Websites waren betroffen, erste Missbrauchsfälle sind bekanntgeworden. Können Unternehmen und Admins, die den Fehler nicht behoben haben, für Schäden belangt werden? Golem.de hat nachgefragt. (Ruby, OpenSSL) --------------------------------------------- http://www.golem.de/news/sicherheitsluecke-unternehmen-koennen-fuer-schaede… *** Smartphones vom SSL-GAU (fast) nicht betroffen *** --------------------------------------------- Keine der wichtigen Smartphone-Plattformen setzt in der aktuellen Version eine der für Heartbleed anfälligen OpenSSL-Bibliotheken ein. Lediglich Android-Nutzer mit einer mittelalten Version benötigen ein Update. --------------------------------------------- http://www.heise.de/security/meldung/Smartphones-vom-SSL-GAU-fast-nicht-bet… *** OpenSSL-Bug: Spuren von Heartbleed schon im November 2013 *** --------------------------------------------- Ein Systemadministrator hat angeblich in einem Logfile vom November letzten Jahres Exploit-Code für den Heartbleed-Bug gefunden. Die EFF ruft andere Administratoren zu Nachforschungen auf. (Technologie, Server) --------------------------------------------- http://www.golem.de/news/openssl-bug-spuren-von-heartbleed-schon-im-novembe… *** Kriminalität: Der Untergrund ist digital *** --------------------------------------------- Wie lässt sich gemeinsam gegen die Kriminalität 2.0 vorgehen? Die Antwort auf dem Kongress des Verbandes für Sicherheitstechnik: Verzahnung, engere Kooperationen, Zusammenarbeit & und Hoffen auf aktive Bürger und die Vorratsdatenspeicherung. --------------------------------------------- http://www.heise.de/security/meldung/Kriminalitaet-Der-Untergrund-ist-digit… *** Windows XP: Wechselmuffel im Patch-Dilemma *** --------------------------------------------- Das offizielle Ende des XP-Supports bedeutet nicht, dass keine Patches mehr im Netz auftauchen dürften. Für Nutzer könnte es aber gefährlich werden, solche Dateien zu installieren. (Microsoft, Spam) --------------------------------------------- http://www.golem.de/news/windows-xp-wechselmuffel-im-patch-dilemma-1404-105… *** "Heartbleed"-Lücke - Chance nutzen *** --------------------------------------------- Wie F-Secure in einem Blog-Post schreibt, sollten Administratoren die Aufräumarbeiten im Zuge der "Heartbleed"-Lücke auch gleich nutzen, um die entsprechenden Konfigurationen auf aktuellen Stand zu bringen. F-Secure empfiehlt dazu den OWASP Transport Layer Protection Cheat Sheet, wir schliessen uns dem an und ergänzen um das Better Crypto Hardening Paper (PDF) von bettercrypto.org. --------------------------------------------- http://www.cert.at/services/blog/20140409164644-1090.html *** JSA10623 - 2014-04 Out of Cycle Security Bulletin: Multiple products affected by OpenSSL "Heartbleed" issue (CVE-2014-0160) *** --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10623&actp=RSS *** JSA10618 - 2014-04 Security Bulletin: Junos: Kernel panic processing high rate of crafted IGMP packets (CVE-2014-0614) *** --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10618&actp=RSS *** OpenVPN Access Server OpenSSL TLS Heartbeat Information Disclosure Vulnerability *** --------------------------------------------- https://secunia.com/advisories/57755 *** Multiple Vulnerabilities in Cisco ASA Software *** --------------------------------------------- Cisco Adaptive Security Appliance (ASA) Software is affected by the following vulnerabilities: Cisco ASA ASDM Privilege Escalation Vulnerability Cisco ASA SSL VPN Privilege Escalation Vulnerability Cisco ASA SSL VPN Authentication Bypass Vulnerability Cisco ASA SIP Denial of Service Vulnerability --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-…

1 0

Tageszusammenfassung - Mittwoch 9-04-2014
by Daily end-of-shift report 09 Apr '14

09 Apr '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 08-04-2014 18:00 − Mittwoch 09-04-2014 18:00 Handler: Robert Waldner Co-Handler: n/a *** Security updates available for Adobe Flash Player (APSB14-09) *** --------------------------------------------- A Security Bulletin (APSB14-09) has been published regarding security updates for Adobe Flash Player. These updates address critical vulnerabilities, and Adobe recommends users update their product installations to the latest versions using the instructions referenced in the security bulletin. --------------------------------------------- http://blogs.adobe.com/psirt/?p=1081 *** Assessing risk for the April 2014 security updates *** --------------------------------------------- Today we released four security bulletins addressing 11 unique CVE’s. Two bulletins have a maximum severity rating of Critical while the other two have a maximum severity rating of Important. We hope that the table below helps you prioritize the deployment of the updates appropriately for your environment. --------------------------------------------- http://blogs.technet.com/b/srd/archive/2014/04/08/assessing-risk-for-the-ap… *** Summary for April 2014 - Version: 1.0 *** --------------------------------------------- * Vulnerabilities in Microsoft Word and Office Web Apps Could Allow Remote Code Execution * Cumulative Security Update for Internet Explorer * Vulnerability in Windows File Handling Component Could Allow Remote Code Execution * Vulnerability in Microsoft Publisher Could Allow Remote Code Execution --------------------------------------------- http://technet.microsoft.com/en-ca/security/bulletin/ms14-apr *** WordPress 3.8.2 Security Release *** --------------------------------------------- WordPress 3.8.2 is now available. This is an important security release for all previous versions and we strongly encourage you to update your sites immediately. This releases fixes a weakness that could let an attacker force their way into your site by forging authentication cookies --------------------------------------------- http://wordpress.org/news/2014/04/wordpress-3-8-2/ *** OSISoft PI Interface for DNP3 Improper Input Validation *** --------------------------------------------- OVERVIEWAdam Crain of Automatak and Chris Sistrunk, Sr. Consultant for Mandiant, have identified an improper input validation vulnerability in the OSIsoft PI Interface for DNP3 product. OSIsoft has produced an update that mitigates this vulnerability. OSIsoft and Automatak have tested the new version to validate that it resolves the vulnerabilityThis vulnerability can be remotely exploited. --------------------------------------------- http://ics-cert.us-cert.gov/advisories/ICSA-14-098-01 *** WellinTech KingSCADA Stack-Based Buffer Overflow *** --------------------------------------------- An anonymous researcher working with HP’s Zero Day Initiative has identified a stack-based buffer overflow in the WellinTech KingSCADA Stack. WellinTech has produced a patch that mitigates this vulnerability.This vulnerability could be exploited remotely. --------------------------------------------- http://ics-cert.us-cert.gov/advisories/ICSA-14-098-02 *** OpenSSL Heartbeat Extension Vulnerability in Multiple Cisco Products *** --------------------------------------------- Multiple Cisco products incorporate a version of the OpenSSL package affected by a vulnerability that could allow an unauthenticated, remote attacker to retrieve memory in chunks of 64 kilobytes from a connected client or server. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** The April 2014 Security Updates *** --------------------------------------------- Today, we release four bulletins to address 11 CVEs in Microsoft Windows, Internet Explorer and Microsoft Office. --------------------------------------------- http://blogs.technet.com/b/msrc/archive/2014/04/08/the-april-2014-security-… *** Heartbleed SSL-GAU: Neue Zertifikate braucht das Land *** --------------------------------------------- Ein simples Update reicht nicht: Nach der OpenSSL-Lücke müssen Serverbetreiber Zertifikate austauschen. Bei manchen CAs geht das kostenlos, andere Zertifikats-Anbieter und Hoster belassen es bei Warnungen. --------------------------------------------- http://www.heise.de/newsticker/meldung/Heartbleed-SSL-GAU-Neue-Zertifikate-… *** Juniper SSL VPN (IVEOS) OpenSSL TLS Heartbeat Information Disclosure Vulnerability *** --------------------------------------------- Juniper has acknowledged a vulnerability in Juniper SSL VPN (IVEOS), which can be exploited by malicious people to disclose potentially sensitive information. --------------------------------------------- https://secunia.com/advisories/57758 *** Bugtraq: CVE-2014-0160 mitigation using iptables *** --------------------------------------------- Following up on the CVE-2014-0160 vulnerability, heartbleed. We've created some iptables rules to block all heartbeat queries using the very powerful u32 module. The rules allow you to mitigate systems that can't yet be patched by blocking ALL the heartbeat handshakes. We also like the capability to log external scanners :) --------------------------------------------- http://www.securityfocus.com/archive/1/531779 *** Heartbleed vendor notifications, (Wed, Apr 9th) *** --------------------------------------------- As people are running around having an entertaining day we thought it might be a good idea to keep track of the various vendor notifications. Id like to start a list here and either via comments or sending it let us know of vendor notifications relating to this issue. Please provide comments to the original article relating to the vulnerability itself, and use this post to only provide links to vendor notifications rather than articles etc about the issue. --------------------------------------------- http://isc.sans.edu/diary.html?storyid=17929&rss *** Bugtraq: SQL Injection in Orbit Open Ad Server *** --------------------------------------------- High-Tech Bridge Security Research Lab discovered vulnerability in Orbit Open Ad Server, which can be exploited to perform SQL Injection attacks, alter SQL requests to database of vulnerable application and potentially gain control over the vulnerable website. --------------------------------------------- http://www.securityfocus.com/archive/1/531781 *** Office für Mac: Update stopft kritische Lücke *** --------------------------------------------- Mit einer neuen OS-X-Version von Office 2011 hat Microsoft die RTF-Schwachstelle in Word beseitigt. Die Aktualisierung soll verschiedene Probleme in Outlook, Excel und Word beheben. --------------------------------------------- http://www.heise.de/security/meldung/Office-fuer-Mac-Update-stopft-kritisch… *** Sophos Web Appliance Security Bypass Vulnerability *** --------------------------------------------- A vulnerability has been reported in Sophos Web Appliance, which can be exploited by malicious people to bypass certain security restrictions. The vulnerability is caused due to an unspecified error related to the "Change Password" dialog box and can be exploited to change the administrative password. --------------------------------------------- https://secunia.com/advisories/57706 *** Security Notice-Statement on OpenSSL Heartbeat Extension Vulnerability *** --------------------------------------------- Huawei has noticed information regarding OpenSSL heartbeat extension security vulnerability and immediately launched a thorough investigation. The investigation is still ongoing. Huawei PSIRT will keep updating the SN and will provide conclusions as soon as possible. Please stay tuned. --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-notices…

1 0

Tageszusammenfassung - Dienstag 8-04-2014
by Daily end-of-shift report 08 Apr '14

08 Apr '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 07-04-2014 18:00 − Dienstag 08-04-2014 18:00 Handler: Robert Waldner Co-Handler: n/a *** Der GAU für Verschlüsselung im Web: Horror-Bug in OpenSSL *** --------------------------------------------- Ein äußerst schwerwiegender Programmierfehler gefährdet offenbar Verschlüsselung, Schlüssel und Daten der mit OpenSSL gesicherten Verbindungen im Internet. Angesichts der Verbreitung der OpenSource-Biliothek eine ziemliche Katastrophe. --------------------------------------------- http://www.heise.de/security/meldung/Der-GAU-fuer-Verschluesselung-im-Web-H… *** VU#568252: Websense Triton Unified Security Center 7.7.3 information disclosure vulnerability *** --------------------------------------------- Vulnerability Note VU#568252 Websense Triton Unified Security Center 7.7.3 information disclosure vulnerability Original Release date: 07 Apr 2014 | Last revised: 07 Apr 2014 Overview Websense Triton Unified Security Center 7.7.3 and possibly earlier versions contains an information disclosure vulnerability which could allow an authenticated attacker to view stored credentials of a possibly higher privileged user. Description CWE-200: Information ExposureWhen logged into the Websense Triton --------------------------------------------- http://www.kb.cert.org/vuls/id/568252 *** Energieversorger testet Sicherheit – und fällt durch *** --------------------------------------------- In „Stirb langsam 4.0“ fahren Cyber-Gauner übers Internet die komplette Stromversorgung im Osten der USA herunter. Ein unrealistisches Szenario? Nicht ganz ... --------------------------------------------- http://www.heise.de/newsticker/meldung/Energieversorger-testet-Sicherheit-u… *** The Muddy Waters of XP End-of-Life and Public Disclosures *** --------------------------------------------- Security researchers who have privately disclosed Windows XP vulnerabilities to Microsoft may never see patches for their bugs with XPs end of life date at hand. Will there be a rash of public disclosures? --------------------------------------------- http://threatpost.com/the-muddy-waters-of-xp-end-of-life-and-public-disclos… *** 2013 wurden Daten von über 500 Millionen Nutzern geklaut *** --------------------------------------------- Daten von mehr als einer halben Milliarde Internet-Nutzer sind im vergangenen Jahr nach Berechnung von IT-Sicherheitsexperten bei Online-Angriffen gestohlen worden. --------------------------------------------- http://futurezone.at/digital-life/2013-wurden-daten-von-ueber-500-millionen… *** Hintergrund: ct-Fritzbox-Test spürt verborgene Geräte auf *** --------------------------------------------- Manche Nutzer des Fritzbox-Tests erhalten unerwartete Ergebnisse. Nicht selten sind WLAN-APs, Repeater oder andere AVM-Geräte die Ursache. Darüber hinaus gibt es auch einige Fehlerquellen, die einen händischen Test erforderlich machen können. --------------------------------------------- http://www.heise.de/newsticker/meldung/Hintergrund-c-t-Fritzbox-Test-spuert… *** The 2013 Internet Security Threat Report: Year of the Mega Data Breach *** --------------------------------------------- Once again, it’s time to reveal the latest findings from our Internet Security Threat Report (ISTR), which looks at the current state of the threat landscape, based on our research and analysis from the past year. Key trends from this year’s report include the large increase in data breaches and targeted attacks, the evolution of mobile malware and ransomware, and the potential threat posed by the Internet of Things. --------------------------------------------- http://www.symantec.com/connect/blogs/2013-internet-security-threat-report-… *** Cacti Multiple Vulnerabilities *** --------------------------------------------- Some vulnerabilities have been reported in Cacti, which can be exploited by malicious users to conduct script insertion and SQL injection attacks and compromise a vulnerable system. * CVE-2014-2326 * CVE-2014-2708 * CVE-2014-2709 --------------------------------------------- https://secunia.com/advisories/57647 *** Open-Xchange Email Autoconfiguration Information Disclosure Weakness *** --------------------------------------------- A weakness has been reported in Open-Xchange, which can be exploited by malicious people to disclose certain sensitive information. The weakness is caused due to the application communicating certain information via parameters of a GET request when using the email autoconfiguration, which can be exploited to disclose the account password. --------------------------------------------- https://secunia.com/advisories/57654 *** VU#345337: J2k-Codec contains multiple exploitable vulnerabilities *** --------------------------------------------- Vulnerability Note VU#345337 J2k-Codec contains multiple exploitable vulnerabilities Original Release date: 08 Apr 2014 | Last revised: 08 Apr 2014 Overview J2k-Codec contains multiple exploitable vulnerabilities, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description J2k-Codec is a JPEG 2000 decoding library for Windows. J2k-Codec contains multiple exploitable exploitable vulnerabilities that can lead to arbitrary code execution. --------------------------------------------- http://www.kb.cert.org/vuls/id/345337

1 0

Tageszusammenfassung - Montag 7-04-2014
by Daily end-of-shift report 07 Apr '14

07 Apr '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 04-04-2014 18:00 − Montag 07-04-2014 18:00 Handler: Robert Waldner Co-Handler: n/a *** BSI-Webseite mit Prüfung ob die eigene Emailadresse im aktuellen Fall betroffen ist *** --------------------------------------------- Im Rahmen eines laufenden Ermittlungsverfahrens der Staatsanwaltschaft Verden (Aller) ist erneut ein Fall von großflächigem Identitätsdiebstahl aufgedeckt worden. ... Diese Webseite bietet eine Überprüfungsmöglichkeit, ob Sie von dem Identitätsdiebstahl betroffen sind. --------------------------------------------- https://www.sicherheitstest.bsi.de/ *** VirusShield: Nur ein Logo - sonst nichts *** --------------------------------------------- Die App VirusShield für Android erreichte innerhalb kürzester Zeit enorme Verkaufszahlen. Jedoch: Die App tut überhaupt nichts. (Google, Virenscanner) --------------------------------------------- http://www.golem.de/news/virusshield-nur-ein-logo-sonst-nichts-1404-105677-… *** Hash-Funktion: Entwurf für SHA-3-Standard liegt vor *** --------------------------------------------- Die US-Behörde Nist hat einen Entwurf für die Standardisierung der Hashfunktion SHA-3 vorgelegt. Drei Monate lang besteht nun die Möglichkeit, diesen zu kommentieren. (Technologie, Verschlüsselung) --------------------------------------------- http://www.golem.de/news/hash-funktion-entwurf-fuer-sha-3-standard-liegt-vo… *** Those strange e-mails with URLs in them can lead to Android malware, (Sat, Apr 5th) *** --------------------------------------------- Youve probably gotten a few of these e-mails over the last few months (I saw the first one of this latest kind in early Feb), we got one to the handlers list earlier this week which prompted this diary. They seem pretty innocuous, they have little or no text and a URL like the one shown below. Note: the above link doesnt lead to the malware anymore, so I didnt obscure it. Most seem to be sent from Yahoo! (or Yahoo!-related e-mail addresses), so they may be coming from addresses that were --------------------------------------------- http://isc.sans.edu/diary.html?storyid=17909&rss *** XMPP-Layer Compression Uncontrolled Resource Consumption *** --------------------------------------------- Topic: XMPP-Layer Compression Uncontrolled Resource Consumption Risk: Medium Text:Uncontrolled Resource Consumption with XMPP-Layer Compression Original Release Date: 2014-04-04 Last Updated: 2014-04-04 ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014040034 *** Fake Voting Campaign Steals Facebook Users’ Identities *** --------------------------------------------- Contributor: Parag SawantPhishers continuously come up with various plans to enhance their chances of harvesting users’ sensitive information. Symantec recently observed a phishing campaign where data is collected through a fake voting site which asks users to decide whether boys or girls are greater.read more --------------------------------------------- http://www.symantec.com/connect/blogs/fake-voting-campaign-steals-facebook-… *** Advice for Enterprises in 2014: Protect Your Core Data *** --------------------------------------------- Some companies may think – “if it can happen to a spy agency, there’s nothing we could do. We should just give up and not protect our data anymore.” Others may say: “let’s build a bigger wall around our data.” Both approaches are incorrect. Obviously, you have to protect your data. However, neither can enterprises just try and protect everything with the same rigor. ... What an enterprise needs to focus on is what really needs to be protected. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/advice-for-enter… *** Microsoft spells out new rules for exiling .EXEs *** --------------------------------------------- Microsoft has updated the methodology it uses to define adware, a move designed to make it clearer just what the company considers worthy for removal by its malware tools. ... The kinds of “unwanted behaviours” that Redmond is looking for will be familiar to anyone whos been burned by mistakenly clicking on the link, with lack of user choice or control topping the list. --------------------------------------------- http://www.theregister.co.uk/2014/04/07/microsoft_puts_adware_in_the_crossh… *** Netgear schließt Hintertür in Modemrouter DGN1000 *** --------------------------------------------- Die Firma hat ein Firmware-Update veröffentlicht, das die Hintertür auf Port 32764 des DSL-Modemrouters schließen soll. Über die Lücke können Angreifer die Passwörter der Geräte abgreifen. --------------------------------------------- http://www.heise.de/security/meldung/Netgear-schliesst-Hintertuer-in-Modemr… *** RSA Data Loss Prevention Security Bypass Security Issue *** --------------------------------------------- A security issue has been reported in RSA Data Loss Prevent, which can be exploited by malicious users to bypass certain security restrictions. The security issue is caused due an error within the session management and can be exploited to access otherwise restricted content. --------------------------------------------- https://secunia.com/advisories/57464

1 0

Tageszusammenfassung - Freitag 4-04-2014
by Daily end-of-shift report 04 Apr '14

04 Apr '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 03-04-2014 18:00 − Freitag 04-04-2014 18:00 Handler: Robert Waldner Co-Handler: n/a *** SMBEXEC Rapid Post Exploitation Tool *** --------------------------------------------- Smbexec is a tool that you can use for penetration testing domain controllers, the program allows to run post exploitation for domain accounts and expand the access to targeted network. this makes pentester have a full access without any privilege requirement. --------------------------------------------- http://www.sectechno.com/2014/03/30/smbexec-rapid-post-exploitation-tool/ *** IBM Security Bulletin: Fixes available for Cross Site Scripting vulnerabilities in IBM WebSphere Portal (CVE-2014-0828 and CVE-2014-0901) *** --------------------------------------------- Fixes are available for Cross Site Scripting vulnerabilities in IBM WebSphere Portal. CVE(s): CVE-2014-0828 and CVE-2014-0901 --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletin: WebSphere Partner Gateway Advanced/Enterprise is affected by vulnerabilities that exist in the IBM SDK for Java (CVE-2014-0411) *** --------------------------------------------- WebSphere Partner Gateway Advanced/Enterprise uses IBM SDK for Java that is based on Oracle JDK . Oracle has released January 2014 critical patch updates (CPU) which contain security vulnerability fixes. The IBM SDK for Java has been updated to incorporate these fixes. CVE(s): CVE-2014-0411 --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** OTRS Help Desk clickjacking *** --------------------------------------------- OTRS Help Desk could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could send a specially-crafted HTTP request to hijack the victim's click actions or launch other client-side browser attacks. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/92233 *** iOS 7.1 bug enables iCloud account deletion, disabling Find My iPhone, without password *** --------------------------------------------- A bug demonstrated by a YouTube user on Wednesday may enable a thief to delete an iCloud account, disable Find My iPhone, and ultimately restore the device, without the need of a password. --------------------------------------------- http://feedproxy.google.com/~r/SCMagazineHome/~3/kToL7uqo4FE/ *** Your files held hostage by CryptoDefense? Dont pay up! The decryption key is on your hard drive *** --------------------------------------------- Blunder discovered in latest ransomware infecting PCs A basic rookie programming error has crippled an otherwise advanced piece of ransomware dubbed CryptoDefense – but the crap coders are still pulling in more than $30,000 a month from unwary punters.… --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/04/03/cryptodefen… *** Advance Notification Service for the April 2014 Security Bulletin Release *** --------------------------------------------- Today we provide advance notification for the release of four bulletins, two rated Critical and two rated Important in severity. These updates address issues in Microsoft Windows, Office and Internet Explorer. The update provided through MS14-017 fully addresses the Microsoft Word issue first described in Security Advisory 2953095. This advisory also included a Fix it to disable opening rich-text format (RTF) files within Microsoft Word. Once the security update is applied, you should disable --------------------------------------------- http://blogs.technet.com/b/msrc/archive/2014/04/03/advance-notification-ser… *** Schneider Electric OPC Factory Server Buffer Overflow *** --------------------------------------------- OVERVIEW Researcher Wei Gao, formerly of IXIA, has identified a buffer overflow vulnerability in the Schneider Electric OPC Factory Server (OFS) application. Schneider Electric has produced a patch that mitigates this vulnerability. Wei Gao has tested the patch to validate that it resolves the vulnerability.This vulnerability could be exploited remotely. --------------------------------------------- http://ics-cert.us-cert.gov/advisories/ICSA-14-093-01 *** Adware: A new approach *** --------------------------------------------- Here at the Microsoft Malware Protection Center (MMPC) we understand advertising is part of the modern computing experience. However, we want to give our customers choice and control regarding what happens with their computers. To that end we have recently undergone some changes to both the criteria we use to classify a program as adware and how we remediate it when we find it. This blog will help explain the new criteria and how it affects some programs. Our updated objective criteria --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2014/04/03/adware-a-new-approach.as… *** Zeus malware found with valid digital certificate *** --------------------------------------------- A recently discovered variant of the Zeus banking Trojan was found to use a legitimate digital signature to avoid detection from Web browsers and anti-virus systems.Security vendor Comodo reported Thursday finding the variant 200 times while monitoring and analyzing data from users of its Internet security system. The variant includes the digital signature, a rootkit and a data-stealing malware component."Malware with a valid digital signature is an extremely dangerous situation," the --------------------------------------------- http://www.csoonline.com/article/2140021/data-protection/zeus-malware-found… *** Linux-PAM "pam_timestamp" Module Two Directory Traversal Vulnerabilities *** --------------------------------------------- Two vulnerabilities have been reported in Linux-PAM, which can be exploited by malicious people to bypass certain security restrictions. --------------------------------------------- https://secunia.com/advisories/57317 *** E-Mail-Konten gehackt: BSI will Millionen betroffene Nutzer informieren *** --------------------------------------------- Behörden und Provider wollen die Nutzer über den Hack von E-Mail-Konten informieren. Wie und wann die Aktion starten soll, steht aber noch nicht fest. (Spam, Computer) --------------------------------------------- http://www.golem.de/news/e-mail-konten-gehackt-bsi-will-millionen-betroffen… *** TLS-Bibliotheken: Fehler finden mit fehlerhaften Zertifikaten *** --------------------------------------------- Mit Hilfe von fehlerhaften X.509-Zertifikaten haben Forscher zahlreiche zum Teil sicherheitskritische Bugs in TLS-Bibliotheken gefunden. Erneut wurde dabei eine gravierende Sicherheitslücke in GnuTLS entdeckt. (Browser, Technologie) --------------------------------------------- http://www.golem.de/news/tls-bibliotheken-fehler-finden-mit-fehlerhaften-ze… *** Cisco Emergency Responder - Multiple vulnerabilities *** --------------------------------------------- Cross-Site Scripting - http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… Cross-Site Request Forgery - http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… Open Redirect - http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… Dynamic Content Modification - http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** PHP 5.4.27 released, (Fri, Apr 4th) *** --------------------------------------------- A new version of PHP has been released. The announcement comments: "The PHP development team announces the immediate availability of PHP 5.4.27. 6 bugs were fixed in this release, including CVE-2013-7345 in fileinfo module." --------------------------------------------- http://isc.sans.edu/diary.html?storyid=17901&rss *** April 8th: Not Just About XP *** --------------------------------------------- April 8th will soon be upon us! And that means…Countdown Clocks…the end of extended support for Windows XP. But not just XP. Office 2003 is also reaching its life.And thats especially important to know because theres currently an Office vulnerability in the wild.Microsoft released its Security Bulletin Advance Notification yesterday: And the good news is: a patch for the Word vulnerability appears to be in the pipeline. --------------------------------------------- http://www.f-secure.com/weblog/archives/00002690.html *** Dealing with Disaster - A Short Malware Incident Response, (Fri, Apr 4th) *** --------------------------------------------- I had a client call me recently with a full on service outage - his servers werent reachable, his VOIP phones were giving him more static than voice, and his Exchange server wasnt sending or receiving mail - pretty much everything was offline. I VPNd in (I was not onsite) and started with the firewall, because things were bad enough thats all I could initially get to from a VPN session. --------------------------------------------- http://isc.sans.edu/diary.html?storyid=17905&rss *** Cisco IOS XR Software ICMPv6 Redirect Vulnerability *** --------------------------------------------- A vulnerability in Internet Control Message Protocol version 6 (ICMPv6) processing of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to affect IPv4 and IPv6 traffic passing through an affected device. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Researchers Uncover Interesting Browser-Based Botnet *** --------------------------------------------- Security researchers discovered an odd DDoS attack against several sites recently that relied on a persistent cross-site scripting vulnerability in a major video Web site and hijacked users’ browsers in order to flood the site with traffic. The attack on the unnamed site involved the use of injected Javascript on the site which would execute in […] --------------------------------------------- http://threatpost.com/researchers-uncover-interesting-browser-based-botnet/…

1 0

Tageszusammenfassung - Donnerstag 3-04-2014
by Daily end-of-shift report 03 Apr '14

03 Apr '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 02-04-2014 18:00 − Donnerstag 03-04-2014 18:00 Handler: Robert Waldner Co-Handler: n/a *** Researchers Divulge 30 Oracle Java Cloud Service Bugs *** --------------------------------------------- Upset with the vulnerability handling process at Oracle, researchers yesterday disclosed over two dozen issues with the company’s Java Cloud Service platform. --------------------------------------------- http://threatpost.com/researchers-divulge-30-oracle-java-cloud-service-bugs… *** Ad Violations: Why Search Engines Won’t Display Your Site If it’s Infected With Malware *** --------------------------------------------- As your site’s webmaster, have you ever seen an e-mail from Google like this: Hello, We wanted to alert you that one of your sites violates our advertising policies. Therefore, we won’t be able to run any of your ads that link to that site, and any new ads pointing to that site will alsoRead More --------------------------------------------- http://feedproxy.google.com/~r/sucuri/blog/~3/kz7JGX2ydIU/ad-violations-why… *** IBM Lotus Web Content Managemen cross-site scripting *** --------------------------------------------- IBM Lotus Web Content Management is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/90566 *** Watching the watchers, (Thu, Apr 3rd) *** --------------------------------------------- A lot of companies today have various IDS and IPS devices implemented in their internal network (especially if you must be compliant with PCI DSS, for example). So these devices get implemented to monitor various traffic at various interfaces/perimeters in a company, but the question I got asked is how can we be sure that the IDS/IPS is doing its job? Obviously, some simple monitoring should be in place – this typically consists of pinging the device or collecting various counters such --------------------------------------------- http://isc.sans.edu/diary.html?storyid=17895&rss *** Macro-Enabled Files Used as Infection Vectors (Again) *** --------------------------------------------- Macro-based attacks were popular in the early 2000s, but they gained much notoriety with the much publicized coverage of the Melissa virus. However, macro-based attacks soon began to drop off the radar. One major reason for this would be the security measures implemented by Microsoft to address malicious macro files. Another probable reason would also […]Post from: Trendlabs Security Intelligence Blog - by Trend MicroMacro-Enabled Files Used as Infection Vectors (Again) --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/1X49GtDdVuU/ *** New Check_MK stable release 1.2.4p1 *** --------------------------------------------- The most important changes are security patches for two CVEs (CVE-2014-2330 and CVE-2014-2331) which have been published on 2014-03-24 and 2014-03-28 on the bugtraq mailinglist. The mail from 2014-03-24 contained wrong information on the not-fixed issues, which had been corrected with the mail from 2014-03-28. All of the reported security related issues are fixed with this release. --------------------------------------------- http://lists.mathias-kettner.de/pipermail/checkmk-announce/2014-April/00008… *** A Series of Introductory Malware Analysis Webcasts *** --------------------------------------------- If you are looking to get started with malware analysis, tune into the webcast series I created to illustrate key tools and techniques for examining malicious software. --------------------------------------------- http://blog.zeltser.com/post/80874760857/introductory-malware-analysis-webc… *** Twelve sources of global cyber attack maps *** --------------------------------------------- 1 - Cyber Warfare Real Time Map by Kaspersky 2 - Top Daily DDoS Attacks Worldwide by Google 3 - Security Tachometer by Deutche Telekom 4 - Cyberfeed Live Botnet Map by AnubisNetworks 5 - Real-time Web Monitor by Akamai 6 - IpViking Live Map by Norse 7 - Honeypots from the Honeynet Project 8 - Global Activity Maps by Arbor 9 - Global Botnet Threat Activity Map by Trend Micro 10 - DDoS Attacks by ShadowServer 11 - Internet Malicious Activity Maps by TeamCymru 12 - Globe and WorldMap by F-Secure --------------------------------------------- http://sseguranca.blogspot.com.br/2014/03/ten-sources-of-global-cyber-attac… *** SNMPCheck - Enumerate the SNMP devices *** --------------------------------------------- Like to snmpwalk, snmpcheck allows you to enumerate the SNMP devices and places the output in a very human readable friendly format. It could be useful for penetration testing or systems monitoring. --------------------------------------------- http://hack-tools.blackploit.com/2014/04/snmpcheck-enumerate-snmp-devices.h… *** The Right Stuff: Staffing Your Corporate SOC *** --------------------------------------------- In my experience, passing a certification exam or getting a degree simply shows that a potential employee is a good test-taker or has the determination to plow through a degree program. Neither substitutes for the wealth of experience SOC analysts need to be good at their jobs. Don’t get me wrong. Certification programs can be an important piece of a cyber-security practitioner’s complete education. --------------------------------------------- http://www.darkreading.com/operations/careers-and-people/the-right-stuff-st… *** FortiBalancer SSH Access Security Bypass Vulnerability *** --------------------------------------------- A vulnerability has been reported in FortiBalancer, which can be exploited by malicious people to bypass certain security restrictions. The vulnerability is caused due to a configuration error related to SSH access and can be exploited to gain otherwise restricted SSH access. The vulnerability is reported in FortiBalancer 400, 1000, 2000, and 3000. --------------------------------------------- https://secunia.com/advisories/57673 *** Sicherheit: Fahnder entdecken Datensatz mit 18 Millionen Mailkonten *** --------------------------------------------- Schon wieder ist eine Datei mit Millionen gehackten Mailkonten sichergestellt worden. Alle großen deutschen E-Mail-Provider und mehrere internationale Anbieter sollen betroffen sein. (Spam, Computer) --------------------------------------------- http://www.golem.de/news/sicherheit-fahnder-entdecken-datensatz-mit-18-mill… *** Tool Estimates Incident Response Cost for Businesses *** --------------------------------------------- A new tool called CyberTab will help businesses estimate the cost of real and potential cyberattacks, and the amount a company could possibly save by investing in preventative measures and technologies. --------------------------------------------- http://threatpost.com/tool-estimates-incident-response-cost-for-businesses/… *** Bugtraq: [softScheck] Denial of Service in Microsoft Office 2007-2013 *** --------------------------------------------- softScheck has identified a Denial of Service vulnerability in Microsoft Outlook 2007-2013. A remote attacker can send a plaintext email containing an XML bomb as the message body, causing Outlook to freeze while opening the email. This forces the user to terminate the Outlook process. In the default Outlook configuration, in which email contents are displayed in a reading pane in the main window, the impact is more severe: Outlook will freeze while starting and will not be able to start anymore, since it tries to open and display the email during startup. To resolve the issue, Outlook needs to be started in safe mode and the email needs to be deleted. --------------------------------------------- http://www.securityfocus.com/archive/1/531722 *** DFRWS EU 2014 Annual Conference *** --------------------------------------------- DFRWS has a long history of being the foremost digital forensics research venue and has decided to hold a sister conference to bring the same opportunities to Europe. The first annual DFRWS EU conference will be held from May 7 to 9, 2014 in Amsterdam, NL. --------------------------------------------- http://www.dfrws.org/2014eu/ *** Cisco IOS Software IKE Main Mode Vulnerability *** --------------------------------------------- A vulnerability in the Internet Key Exchange (IKE) module of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to delete established security associations on an affected device. The vulnerability is due to improper handling of rogue IKE Main Mode packets. An attacker could exploit this vulnerability by sending a crafted IKE Main Mode packet to an affected device. An exploit could allow the attacker to cause valid, established IKE security associations on an affected device to drop. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014…

1 0

Tageszusammenfassung - Mittwoch 2-04-2014
by Daily end-of-shift report 02 Apr '14

02 Apr '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 01-04-2014 18:00 − Mittwoch 02-04-2014 18:00 Handler: Robert Waldner Co-Handler: n/a *** Whitehat Securitys Aviator browser is coming to Windows *** --------------------------------------------- I have had the privilege of knowing Jeremiah Grossman, the iCEO of Whitehat Security, for many years now. He has spoken on many occasions about web security and specifically web browser security or rather, the lack thereof. I recall at one point asking him, "OK, what do you use as a web browser?" He paused, smiled and said, "My own". That Cheshire cat response played over again in my head when Whitehat Security released their browser offering called Aviator. This is a --------------------------------------------- http://www.csoonline.com/article/2136258/application-security/whitehat-secu… *** 110,000 Wordpress Databases Exposed *** --------------------------------------------- For years now Ive been writing my various blog posts and I have used many different kinds of CMS platforms right back to posting using VI back in the 90s. My favourite platform that Ive used to create content has been Wordpress by far. I can almost here the security folks cringe. Yes, it is a massive headache to lockdown. But, I fight on as the user experience makes the pain worthwhile. OK, maybe worthwhile isnt the correct word. This is a platform that has had a long history of security --------------------------------------------- http://www.csoonline.com/article/2136246/application-security/110-000-wordp… *** "ct wissen Windows": So meistern Sie das Support-Ende von Windows XP *** --------------------------------------------- Pünktlich zum Support-Ende von Windows XP veröffentlichen wir mit dem "ct wissen Windows" ein Handbuch für alle Betroffenen. Es erläutert nicht nur, was das Support-Ende genau bedeutet, sondern liefert vor allem Praxis-Anleitungen. --------------------------------------------- http://www.heise.de/newsticker/meldung/c-t-wissen-Windows-So-meistern-Sie-d… *** Call for packets udp/137 broadcast, (Tue, Apr 1st) *** --------------------------------------------- One of our readers have reported that he has seen a broadcast traffic to udp/137 . He suspected that the traffic cause a denial of service to some of his systems. If you have seen such traffic and you would like to share some packets we would appreciate that. (c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. --------------------------------------------- http://isc.sans.edu/diary.html?storyid=17887&rss *** AlienVault Open Source SIM date_from SQL injection *** --------------------------------------------- AlienVault Open Source SIM (OSSIM) is vulnerable to SQL injection. A remote authenticated attacker could send specially-crafted SQL statements to the ISO27001Bar1.php script using the date_from parameter, which could allow the attacker to view, add, modify or delete information in the back-end database. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/92172 *** Password bug let me see shoppers credit cards in eBay ProStores, claims infosec bod *** --------------------------------------------- Online bazaar fixes store account hijack flaw, were told A serious vulnerability that potentially allowed shoplifters to empty eBay ProStores shops and swipe customer credit cards has been fixed according to the security researcher who says he found the hole. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/04/01/ebay_stores… *** Fake Google apps removed from Window Phone Store by Microsoft *** --------------------------------------------- Five phony Google apps appeared in the app store, each with a $1.99 price tag, before being removed by the company. --------------------------------------------- http://feedproxy.google.com/~r/SCMagazineHome/~3/fXb73Il-oZg/ *** Hack of Boxee.tv exposes password data, messages for 158,000 users *** --------------------------------------------- Huge file circulating online contains e-mail addresses, full message histories. --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/B676MRE54C8/ *** IT Analyst Highlights 6 IT Security 'Worst Practices' *** --------------------------------------------- In a new Network World article, prominent IT analyst and researcher Linda Musthaler is highlighting 6 'worst practices' that companies commit on their way to undermining, destabilizing, or just plain wrecking their IT security efforts: Failing to stay up-to-date with the latest technologies and techniques. Neglecting to take a comprehensive network security approach that also [...]The post IT Analyst Highlights 6 IT Security 'Worst Practices' appeared first on Seculert --------------------------------------------- http://www.seculert.com/blog/2014/04/it-analyst-highlights-6-it-security-wo… *** HP integrated Lights Out (iLO) IPMI Protocol Flaw Lets Remote Users Obtain Hashed Passwords *** --------------------------------------------- A vulnerability was reported in HP integrated Lights Out (iLO). A remote user can gain obtain hashed passwords. A remote user can invoke the IPMI 2.0 protocol to obtain the target user's salted SHA1 or MD5 hash. The vulnerability resides in the protocol design and is mandated by the IPMI 2.0 specification. --------------------------------------------- http://www.securitytracker.com/id/1029981 *** Extended Random: The PHANTOM NSA-RSA backdoor that never was *** --------------------------------------------- Profs paper was all about attacking Dual EC DRBG, not a Snowden-esque spy bombshell Over the last day or so the security press has been touting stories of a second NSA-induced backdoor in RSAs encryption software BSafe. But it appears to be more sound and fury than substance. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/04/02/extended_ra… *** Safari für Mac OS X: Update schließt Sicherheitslücken und bringt einige Neuerungen *** --------------------------------------------- Der Apple-Webbrowser ist für OS X Mavericks und OS X Mountain Lion in neuen Versionen verfügbar. Neben Patches gegen Sicherheitslücken gibt es Bugfixes und Änderungen an der Benachrichtigungsfunktion. --------------------------------------------- http://www.heise.de/security/meldung/Safari-fuer-Mac-OS-X-Update-schliesst-… *** [2014-04-02] Multiple vulnerabilities in Rhythm File Manager *** --------------------------------------------- An attacker being able to connect to the Android device (e.g. if he uses the same Wireless network), can access arbitrary local files from the device while the File Manager app is being used to stream media. Moreover, a malicious Android app or an attacker being able to connect to the Android device may issue system commands as the user "root" if "root browsing" is enabled. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2014… *** Analysis: Financial cyber threats in 2013. Part 1: phishing *** --------------------------------------------- It has been quite a few years since cybercriminals started actively stealing money from user accounts at online stores, e-payment systems and online banking systems. --------------------------------------------- http://www.securelist.com/en/analysis/204792330/Financial_cyber_threats_in_… *** Bugtraq: [IMF 2014] Call for Participation *** --------------------------------------------- See the program at: http://www.imf-conference.org/imf2014/program.html The conference will take place from Monday, May 12th through Wednesday, May 14th in Münster, Germany. Registration details: http://www.imf-conference.org/imf2014/registration.html --------------------------------------------- http://www.securityfocus.com/archive/1/531707 *** VU#917700: Huawei Echo Life HG8247 optical router XSS vulnerability *** --------------------------------------------- Vulnerability Note VU#917700 Huawei Echo Life HG8247 optical router XSS vulnerability Original Release date: 02 Apr 2014 | Last revised: 02 Apr 2014 Overview Huawei Echo Life HG8247 optical router contains a stored cross-site scripting (XSS) vulnerability Description It has been reported that Huawei Echo Life HG8247 optical routers running software version V1R006C00S120 or earlier contain a stored cross-site scripting (XSS) vulnerability. An unauthenticated attacker can perform a stored --------------------------------------------- http://www.kb.cert.org/vuls/id/917700

1 0

Tageszusammenfassung - Dienstag 1-04-2014
by Daily end-of-shift report 01 Apr '14

01 Apr '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 31-03-2014 18:00 − Dienstag 01-04-2014 18:00 Handler: Robert Waldner Co-Handler: n/a *** Report: RSA endowed crypto product with second NSA-influenced code *** --------------------------------------------- Extended Random like "dousing yourself with gasoline," professor warns. --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/TbwAXYKTq34/ *** Old School Code Injection in an ATM .dll *** --------------------------------------------- During our last ATM review engagement, we found some interesting executable files that were run by Windows Services under Local System account. These binaries had weak file permissions that allowed us to modify them using the standard ATM user account. As a proof of concept, I decided to inject some code into one of them to take full control of the system. This post is about the technique I used to inject the code into a .dll used by one of the Windows Services. I’m sure there are many --------------------------------------------- http://feedproxy.google.com/~r/SpiderlabsAnterior/~3/CRAp6jZhvVE/injecting-… *** A Look at the GnuTLS X.509 Verification Code Flaw *** --------------------------------------------- ... it was found that the GnuTLS X.509 certificate verification code fails to properly handle certain error conditions that may occur during the certificate verification process. While verifying the certificate, GnuTLS would report it as successful verification of the certificate, even though verification should have resulted in a failure. This means that invalid certificates may be accepted as valid, --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/iSFhF7R9kFI/ *** Creating an intelligent “sandbox” for coordinated malware eradication *** --------------------------------------------- Hello from China where I am presenting on coordinated malware eradication at the 2014 PC Security Labs Information Security Conference. Coordinated malware eradication was also the topic of my last blog. I said the antimalware ecosystem must begin to work with new types of partners if we are going to move from the current state of uncoordinated malware disruption, to a state of coordinated malware eradication. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2014/03/31/creating-an-intelligent-… *** Its not the breach that kills you, its the cover-up *** --------------------------------------------- Its how you handle yourself during and after a breach that will determine just how detrimental the breach actually is for your organization. --------------------------------------------- http://feedproxy.google.com/~r/SCMagazineHome/~3/Mi55LWhfA9c/ *** Managing Windows XP’s Risks in a Post-Support World *** --------------------------------------------- There are now less than two weeks left until Microsoft terminates support for the incredibly long-lived Windows XP. Rarely has a tech product lasted as long as XP has – from XP’s launch on October 25, 2001 to its last Patch Tuesday on April 8, 2014 a total of 12 years, 5 months, and two […]Post from: Trendlabs Security Intelligence Blog - by Trend MicroManaging Windows XP’s Risks in a Post-Support World --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/fSwrdK2qOeg/ *** EMC Cloud Tiering Appliance Request Validation Flaw Lets Remote Users View Files *** --------------------------------------------- A vulnerability was reported in EMC Cloud Tiering Appliance. A remote user can view files on the target system. The '/api/login' script does not properly validate user-supplied input. A remote user can supply a specially crafted XML External Entity (XXE) link to view files on target system with root privileges. --------------------------------------------- http://www.securitytracker.com/id/1029979 *** Grazer Linuxtage 2014: "Sicherheit im Netz" mit freier Software *** --------------------------------------------- Alternative Software-Szene lädt an der FH-Joanneum zu Workshops und Vorträgen --------------------------------------------- http://derstandard.at/1395363812795 *** Horde webmail - Open Redirect Vulnerability *** --------------------------------------------- An open redirect is an application that takes a parameter and redirects a user to the parameter value without any validation. This vulnerability is used in phishing attacks to get users to visit malicious sites without realizing it. --------------------------------------------- http://cxsecurity.com/issue/WLB-2014040004 *** ModSecurity HTTP Requests Chunked Encoding Security Bypass Vulnerability *** --------------------------------------------- Martin Holst Swende has reported a vulnerability in ModSecurity, which can be exploited by malicious people to bypass certain security restrictions. The vulnerability is caused due to an error in the "modsecurity_tx_init()" function (apache2/modsecurity.c), which can be exploited to bypass the HTTP request body processing via a specially crafted request using chunked encoding. --------------------------------------------- https://secunia.com/advisories/57444 *** ct-Special "Umstieg auf Linux" am Kiosk erhältlich *** --------------------------------------------- Umsteigen auf Linux – warum nicht? Linux bietet eine Menge Vorteile – nicht nur für XP-Anwender, die demnächst keine Sicherheits-Fixes von Microsoft mehr erhalten. Das neue Sonderheft der ct-Redaktion hilft beim sanften Umstieg von Windows auf Linux. --------------------------------------------- http://www.heise.de/newsticker/meldung/c-t-Special-Umstieg-auf-Linux-am-Kio… *** IBM WebSphere Portal Two Cross-Site Scripting Vulnerabilities *** --------------------------------------------- Two vulnerabilities have been reported in IBM WebSphere Portal, which can be exploited by malicious people to conduct cross-site scripting attacks. --------------------------------------------- https://secunia.com/advisories/57592 *** cPanel Multiple Vulnerabilities *** --------------------------------------------- Two weaknesses, a security issue, and multiple vulnerabilities have been reported in cPanel, which can be exploited by malicious, local users to disclose potentially sensitive information and manipulate certain data, by malicious users to disclose potentially sensitive information, conduct script insertion attacks, manipulate certain data, and compromise a vulnerable system and by malicious people to conduct spoofing and cross-site scripting attacks and bypass certain security restrictions. --------------------------------------------- https://secunia.com/advisories/57576 *** VU#893726: Zyxel P660 series modem/router denial of service vulnerability *** --------------------------------------------- Zyxel P660 series modem/router contains a denial of service vulnerability when parsing a high volume of SYN packets on the web management interface. --------------------------------------------- http://www.kb.cert.org/vuls/id/893726 *** Cisco Security Manager HTTP Header Redirection Vulnerability *** --------------------------------------------- A vulnerability in the web framework of Cisco Security Manager could allow an unauthenticated, remote attacker to inject a crafted HTTP header which will cause a web page redirection to a possible malicious website. The vulnerability is due to insufficient validation user input of user input before using it as an HTTP header value. An attacker could exploit this vulnerability by convincing a user to access a crafted URL. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco WSA HTTP Header Injection Vulnerability *** --------------------------------------------- A vulnerability in the web framework of Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to inject a crafted HTTP header that could cause a web page redirection to a possible malicious website. The vulnerability is due to insufficient validation of user input before using it as an HTTP header value. An attacker could exploit this vulnerability by persuading a user to access a crafted URL. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014…

1 0

Tageszusammenfassung - Montag 31-03-2014
by Daily end-of-shift report 31 Mar '14

31 Mar '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 28-03-2014 18:00 − Montag 31-03-2014 18:00 Handler: Robert Waldner Co-Handler: n/a *** Siemens ROS Improper Input Validation *** --------------------------------------------- Researcher Aivar Liimets from Martem Telecontrol Systems reported an improper input validation vulnerability in the Siemens Rugged Operating System (ROS), which could cause a denial-of-service (DoS) condition against the device's management web interface. Siemens coordinated the vulnerability details with NCCIC/ICS-CERT and has provided information for mitigation of the vulnerability.This vulnerability can be exploited remotely. --------------------------------------------- http://ics-cert.us-cert.gov/advisories/ICSA-14-087-01 *** WiFi Bug Plagues Philips Internet-Enabled TVs *** --------------------------------------------- Some versions of Philips internet-enabled SmartTVs are vulnerable to cookie theft and an array of other tricks that abuse a lax WiFi setting. --------------------------------------------- http://threatpost.com/wifi-bug-plagues-philips-internet-enabled-tvs/105119 *** VulDB: Adobe Reader 11.0.06 Sandbox erweiterte Rechte *** --------------------------------------------- Die Schwachstelle wurde am 28.03.2014 von VUPEN via Pwn2Own 2014 publiziert. Die Identifikation der Schwachstelle wird seit dem 20.12.2013 mit CVE-2014-0512 vorgenommen. Sie ist schwierig auszunutzen. Der Angriff kann über das Netzwerk erfolgen. Zur Ausnutzung ist keine spezifische Authentisierung erforderlich. Es sind zwar keine technische Details, jedoch ein privater Exploit zur Schwachstelle bekannt. --------------------------------------------- http://www.scip.ch/?vuldb.12723 *** Adobe Flash Player Bugs Let Remote Users Execute Arbitrary Code *** --------------------------------------------- A remote user can create specially crafted content that, when loaded by the target user on a Windows-based system, will trigger a use-after-free and execute arbitrary code on the target system [CVE-2014-0506]. The code will run with the privileges of the target user. VUPEN reported this vulnerability (via Pwn2Own at CanSecWest 2014). A remote user can create specially crafted content that, when loaded by the target user, will trigger a heap overflow and execute arbitrary code on the target system [CVE-2014-0510]. The code will run with the privileges of the target user. Zeguang Zhao and Liang Chen reported this vulnerability (via Pwn2Own at CanSecWest 2014). --------------------------------------------- http://www.securitytracker.com/id/1029969 --------------------------------------------- (Notiz: soweit wir bisher herausfinden konnten, sind noch keine Exploits dazu "in the wild" aufgetaucht.) --------------------------------------------- *** nginx 1.4.6/1.5.11 Heap-based buffer overflow in the SPDY *** --------------------------------------------- A bug in the experimental SPDY implementation in nginx was found, which might allow an attacker to cause a heap memory buffer overflow in a worker process by using a specially crafted request, potentially resulting in arbitrary code execution (CVE-2014-0133). The problem affects nginx 1.3.15 - 1.5.11, compiled with the ngx_http_spdy_module module (which is not compiled by default) and without --with-debug configure option, if the "spdy" option of the "listen" directive is used in a configuration file. The problem is fixed in nginx 1.5.12, 1.4.7. --------------------------------------------- http://cxsecurity.com/issue/WLB-2014030250 *** Chip.de-Forum offenbar gehackt: 2,5 Millionen Nutzerdaten betroffen *** --------------------------------------------- Forumsmitglieder wurden per Mail über Hack informiert - Passwörter wurden außerdem unzureichend geschützt --------------------------------------------- http://derstandard.at/1395363600546 *** Who's Behind the "BLS Weblearn" Credit Card Scam? *** --------------------------------------------- A new rash of credit and debit card scams involving bogus sub-$15 charges and attributed to a company called "BLS Weblearn" is part of a prolific international scheme designed to fleece unwary consumers. This post delves deeper into the history and identity of the credit card processing network that has been enabling this type of activity for years. --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/MxEDIVQPC94/ *** More Device Malware: This is why your DVR attacked my Synology Disk Station, (Mon, Mar 31st) *** --------------------------------------------- Last week, we reported that some of the hosts scanning for port 5000 are DVRs (to be more precise: Hikvision DVRs, commonly used to record video from surveillance cameras [1] ). Today, we were able to recover the malware responsible. You can download the malware here https://isc.sans.edu/diaryimages/hikvision.zip (password: infected) . The malware resides in /dev/cmd.so . A number of additional suspect files where located in the /dev directory which we still need to recover / analyze from the --------------------------------------------- http://isc.sans.edu/diary.html?storyid=17879&rss *** Crack team of cyber warriors arrives to SAVE UK from grid-crippling HACK ATTACKS *** --------------------------------------------- National CERT goes live today The UK is finally getting a national Computer Emergency Response Team (CERT), with the delayed launch of the organisation taking place today. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/03/31/cert_uk_lau… *** Cisco Security Response Team Opens Its Toolbox *** --------------------------------------------- With a variety of security tools, CSIRT is able to detect and analyze malicious traffic throughout the network, including virus propagation, targeted attacks, and commonplace exploits. Because CSIRT continually identifies new security threats, the team needs some historical look-back at what occurred on the network. They also need a solution that can dissect the finer details of security incidents while facing the ever-present restrictions with data storage. --------------------------------------------- https://blogs.cisco.com/security/cisco-security-response-team-opens-its-too…

1 0

Tageszusammenfassung - Freitag 28-03-2014
by Daily end-of-shift report 28 Mar '14

28 Mar '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 27-03-2014 18:00 − Freitag 28-03-2014 18:00 Handler: Robert Waldner Co-Handler: n/a *** New PGP keys *** --------------------------------------------- At CERT.at we had to phase out some old 1024 bit DSA keys as well as create new master-signing keys. This turned out to be a major effort. Key roll-overs are never easy.In order to easy the key roll-over pains, we created a key transition document. This document is signed by the old keys in order to prove authorship. ... --------------------------------------------- http://www.cert.at/services/blog/20140328155445-1086.html *** NTP Amplification, SYN Floods Drive Up DDoS Attack Volumes *** --------------------------------------------- The potency of distributed denial of service attacks has increased steadily but dramatically over the last 14 months. --------------------------------------------- http://threatpost.com/ntp-amplification-syn-floods-drive-up-ddos-attack-vol… *** Schneider Electric Serial Modbus Driver Buffer Overflow *** --------------------------------------------- OVERVIEW Carsten Eiram of Risk-Based Security has identified a stack-based buffer overflow vulnerability in Schneider Electric’s Serial Modbus Driver that affects 11 Schneider Electric products. Schneider Electric has produced patches that mitigate this vulnerability. This vulnerability can be exploited remotely. --------------------------------------------- http://ics-cert.us-cert.gov/advisories/ICSA-14-086-01 *** Apple Credential Phishing via appleidconfirm.net, (Thu, Mar 27th) *** --------------------------------------------- ISC user Craig Cox wrote in alerting us of a fairly sophisticated phishing campaign that is currently in progress. The website appleidconfirm.net has a seemingly realistic Apple login page that is being sent out by email. The site even includes JavaScript code which validates your Apple ID as an email in an attempt to obtain only valid credentials. Upon submitting what it considers valid credentials, youre redirected to the /?2 page of the site which contains another form which appears to --------------------------------------------- http://isc.sans.edu/diary.html?storyid=17869&rss *** SonicWALL Email Security Input Validation Flaw in License Management’ and ‘Advanced Pages Permits Cross-Site Scripting Attacks *** --------------------------------------------- A vulnerability was reported in SonicWALL Email Security. A remote user can conduct cross-site scripting attacks. The 'License Management' and 'Advanced' pages do not properly filter HTML code from user-supplied input before displaying the input. A remote user can cause arbitrary scripting code to be executed by the target user's browser. --------------------------------------------- http://www.securitytracker.com/id/1029965 *** Word and Excel Files Infected Using Windows PowerShell *** --------------------------------------------- Malware targeting Word and Excel files has been around for some time, but we recently encountered a new malware family, CRIGENT (also known as “Power Worm”) which brings several new techniques to the table. (We detect these files as W97M_CRIGENT.JER and X97M_CRIGENT.A.) Most significantly, instead of creating or including executable code, CRIGENT uses the Windows PowerShell --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/9hUmCpAOj9M/ *** OpenSSH 6.6 bypass SSHFP DNS RR checking by HostCertificate *** --------------------------------------------- I've been looking at handling host keys better, and tripped over this bug. Essentially, if the server offers a HostCertificate that the client doesn't accept, then the client doesn't then check for SSHFP records. --------------------------------------------- http://cxsecurity.com/issue/WLB-2014030239 *** [2014-03-28] Multiple vulnerabilities in Symantec LiveUpdate Administrator *** --------------------------------------------- Attackers are able to compromise Symantec LiveUpdate Administrator at the application and database levels because of vulnerable password reset functionality and SQL injection vulnerabilities. This enables access to credentials of update servers on the network without prior authentication. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2014… *** Python "os._get_masked_mode()" Race Condition Security Issue *** --------------------------------------------- A security issue has been reported in Python, which can be exploited by malicious, local users to potentially disclose or manipulate certain data. The security issue is caused due to a race condition within the "os._get_masked_mode()" function (Lib/os.py), which can be exploited to cause certain application-created files to be world-accessible. The security issue is reported in versions 3.4, 3.3, and 3.2. --------------------------------------------- https://secunia.com/advisories/57672 *** IBM Security Bulletin: IBM Operational Decision Manager and WebSphere ILOG JRules: Multiple security vulnerabilities in IBM JRE *** --------------------------------------------- This Security Bulletin addresses the security vulnerabilities that have shipped with the IBM Java Runtime Environment (JRE) included in IBM Operational Decision Manager and IBM ILOG JRules. IBM ODM and ILOG JRules now include the most recent version of the IBM JRE which fixes the security vulnerabilities reported in Oracles Critical Patch Update releases of January 2014. CVE(s): CVE-2014-0423, CVE-2014-0416 and CVE-2014-0411 Affected product(s) and affected version(s): IBM WebSphere ILOG --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** Cisco IOS Software High Priority Queue Denial of Service Vulnerability *** --------------------------------------------- A vulnerability in the packet driver code of Cisco IOS Software could allow an unauthenticated, remote attacker to cause a reload of the affected device, resulting in a denial of service (DoS) condition. CVE-2014-2131 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014…

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily