Daily

daily@lists.cert.at

1 participants
3190 discussions

Tageszusammenfassung - Montag 24-06-2013
by Daily end-of-shift report 24 Jun '13

24 Jun '13

======================= = End-of-Shift report = ======================= Timeframe: Freitag 21-06-2013 18:00 − Montag 24-06-2013 18:00 Handler: Matthias Fraidl Co-Handler: Otmar Lendl *** Tausende Domains *** --------------------------------------------- Die Adressen verschiedener Dienste wie LinkedIn, Yelp oder Fidelity wurden durch einen menschlichen Fehler für mehrere Stunden auf andere Webseiten umgeleitet. Cisco geht von 5000 betroffenen Domains aus. --------------------------------------------- http://www.heise.de/security/meldung/Tausende-Domains-1894195.html *** Dirt Jumper DDoS Variant Drive 'Much More Powerful' Than Predecessors *** --------------------------------------------- A variant of the Dirt Jumper DDoS engine called Drive has been detected. Drive includes new capabilities and has already targeted a number popular destinations on the Internet. --------------------------------------------- http://threatpost.com/dirt-jumper-ddos-variant-drive-much-more-powerful-tha… *** Security Bulletin: WebSphere Commerce Java API Documentation Frame Injection Vulnerability (CVE-2013-1571) *** --------------------------------------------- Java API Documentation contains a frame injection vulnerability. --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_web… *** WordPress Maintenance Mode Plugin Cross-site request forgery vulnerability *** --------------------------------------------- WordPress Maintenance Mode Plugin Cross-site request forgery vulnerability --------------------------------------------- http://xforce.iss.net/xforce/xfdb/85146 *** Adobe Flash spoof leads to infectious audio ads *** --------------------------------------------- We've seen quite a few audio ads infecting users recently. We think it's a good idea to go over an in-depth look at how they infect your computer and how to remediation them. As you can see in this first picture, this is another Adobe Flash spoof that launches its signature update window. --------------------------------------------- http://blog.webroot.com/2013/06/21/adobe-flash-spoof-leads-to-infectious-au… *** Device-disabling Fake AV migrates to Android phones, demands ransom *** --------------------------------------------- Long the bane of computer users, Fake antivirus may extort Android owners, too. --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/esDZHzGloyI/ *** Google Translate Cross Site Request Forgery *** --------------------------------------------- 1)Vulnerability Description I discovered a new CSRF vulnerability on translate.google.com web site which could allow an attacker to insert items (Words/Phrases/Urls and related translations) into the user's Phrasebook. Furthermore an attacker could also inserta potentially malicious Urls - into the above mentioned Phrasebook - towards which the victim could be redirected simply clicking on the "Go to <website>" right-click option on translate.google.com. --------------------------------------------- http://cxsecurity.com/issue/WLB-2013060181 *** McAfee ePolicy Orchestrator 4.6.5 SQL injection & directory traversal *** --------------------------------------------- Main Features: Remote command execution on the ePo server. Remote command execution on the Managed stations (one ring to rule them all). File upload on the ePo server. Active Directory credentials stealing. --------------------------------------------- http://cxsecurity.com/issue/WLB-2013060183 *** Datenpanne bei Facebook *** --------------------------------------------- Nicht-öffentliche Telefonnummern und E-Mai-Adressen von ungefähr sechs Millionen Facebook-Usern wurden fälschlich an andere Facebook-Nutzer weitergegeben. --------------------------------------------- http://www.heise.de/security/meldung/Datenpanne-bei-Facebook-1894855.html *** Vuln: HAProxy CVE-2013-2175 Multiple Denial of Service Vulnerabilities *** --------------------------------------------- HAProxy is prone to multiple denial-of-service vulnerabilities. Exploiting these issues allow remote attackers to trigger denial-of-service conditions. --------------------------------------------- http://www.securityfocus.com/bid/60588 *** Is SSH no more secure than telnet?, (Sun, Jun 23rd) *** --------------------------------------------- In SSHs default (and most common) deployment: Yes. It is no more secure than telnet, but it can be better. Apologies to Ian Betteridge If you ask any sysadmin, they say that SSH is more secure than telnet, and theyll likely comment that opening telnet up to the Internet is reckless. One can simulate asking general opinion with a little googling: "ssh is more secure than telnet": 11,500 "telnet is more secure than ssh": 81 So, the Conventional Wisdom is that --------------------------------------------- http://isc.sans.edu/diary.html?storyid=16049&rss *** ZPanel 10.0.0.2 htpasswd Module Username Command Execution *** --------------------------------------------- This module exploits a vulnerability found in ZPanel's htpasswd module. When creating .htaccess using the htpasswd module, the username field can be used to inject system commands, which is passed on to a system() function for executing the system's htpasswd's command. --------------------------------------------- http://cxsecurity.com/issue/WLB-2013060193 *** Bugtraq: Linksys X3000 - Multiple Vulnerabilities *** --------------------------------------------- The vulnerability is caused by missing input validation in the ping_ip parameter and can be exploited to inject and execute arbitrary shell commands. You need to be authenticated to the device or you have to find other methods for inserting the malicious commands. --------------------------------------------- http://www.securityfocus.com/archive/1/526945 *** Wordpress: Update schließt zwölf Sicherheitslücken *** --------------------------------------------- Mit dem Update auf Version 5.3.2 schließt Wordpress Schwachstellen, die mit Cross-Site-Scripting, Server-Side-Request-Forgery- und Denial-of-Service-Attacken ausgenutzt werden können. --------------------------------------------- http://www.heise.de/security/meldung/Wordpress-Update-schliesst-zwoelf-Sich… *** Beware Of HTML5 Development Risks *** --------------------------------------------- Local storage is a big change from HTML of the past, where browsers could only use cookies to store small bits of information, such as session tokens, for managing identity. HTML5 changes this with sessionStorage, localStorage, and client-side databases to allow developers to store vast amounts of data in the browser that is all accessible from JavaScript. --------------------------------------------- http://www.darkreading.com/applications/beware-of-html5-development-risks/2… *** Apple Phishing Scams on the Rise *** --------------------------------------------- Apple has one of the more gilded consumer brands and the company spends a lot of time and money to keep it that way. Consumers love Apple. Scammers and attackers do too, though, and security researchers in recent months have seen a major spike in the volume of phishing emails abusing Apple's brand, most of which are focused on stealing users' Apple IDs and payment information. --------------------------------------------- https://threatpost.com/apple-phishing-scams-on-the-rise/

1 0

Tageszusammenfassung - Freitag 21-06-2013
by Daily end-of-shift report 21 Jun '13

21 Jun '13

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 20-06-2013 18:00 − Freitag 21-06-2013 18:00 Handler: Matthias Fraidl Co-Handler: Stephan Richter *** Common Web Vulnerabilities Plague Top WordPress Plug-Ins *** --------------------------------------------- Top WordPress plug-ins and themes remain vulnerable to common Web-based attacks such as cross-site scripting and SQL injection. --------------------------------------------- http://threatpost.com/common-web-vulnerabilities-plague-top-wordpress-plug-… *** New E-Shop sells access to thousands of malware-infected hosts, accepts Bitcoin *** --------------------------------------------- By Dancho Danchev Thanks to the buzz generated over the widespread adoption of the decentralized P2P based E-currency, Bitcoin, we continue to observe an overall increase in international underground market propositions that accept it as means for fellow cybercriminals to pay for the goods/services that they want to acquire. --------------------------------------------- http://blog.webroot.com/2013/06/20/new-e-shop-sells-access-to-thousands-of-… *** Trojan.APT.Seinup Hitting ASEAN *** --------------------------------------------- The FireEye research team has recently identified a number of spear phishing activities targeting Asia and ASEAN. Of these, one of the spear phishing documents was suspected to have used a potentially stolen document as a decoy. --------------------------------------------- http://www.fireeye.com/blog/technical/malware-research/2013/06/trojan-apt-s… *** PoisonIvy Uses Legitimate Application as Loader *** --------------------------------------------- I recently obtained a PoisonIvy sample which uses a legitimate application in an effort to stay under the radar. In this case, the PoisonIvy variant detected as BKDR_POISON.BTA (named as newdev.dll) took advantage of a technique known as a DLL preloading attack (aka binary planting) instead of exploiting previously known techniques. The malware was located [...] --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/C9_ZJyLJ1YA/ *** WordPress Slash WP theme XSS and Content Spoofing vulnerabilities *** --------------------------------------------- Topic: WordPress Slash WP theme XSS and Content Spoofing vulnerabilities Risk: Low Text:I want to warn you about multiple vulnerabilities in Slash WP theme for WordPress. This is commercial theme for WP. These ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2013060173 *** BSI nimmt WordPress, Typo3 & Co. unter die Security-Lupe *** --------------------------------------------- Das Bundesamt für Sicherheit in der Informationstechnologie hat im Rahmen einer Studie das Sicherheitsniveau der gängigen Content Management Systeme analysiert. Die Gefahr geht demnach zu bis zu 95 Prozent von Add-Ons aus. --------------------------------------------- http://www.heise.de/security/meldung/BSI-nimmt-WordPress-Typo3-Co-unter-die… *** Login Security module for Drupal soft blocking security bypass *** --------------------------------------------- Login Security module for Drupal could allow a remote attacker to bypass security restrictions, caused by incorrect use of string filtering. When the soft blocking option is disabled, an attacker could exploit this vulnerability to gain unauthorized access to the vulnerable application. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/85135 *** OpenStack python-keystoneclient memcache signing/encryption security bypass *** --------------------------------------------- OpenStack python-keystoneclient could allow a remote attacker to bypass security restrictions, caused by an error in the memcache signing/encryption feature. An attacker could exploit this vulnerability by inserting malicious data to the memcache backend to bypass security and gain unauthorized access to the vulnerable application. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/85139 *** Is Hotel WiFi Secure? *** --------------------------------------------- When you check in to a hotel, you assume that the company will keep you and your valuables safe by not sharing your room keys and providing a safe for your belongings. But a much greater threat could be lurking in your rented room - the free WiFi connection that most lodging providers offer. --------------------------------------------- http://blog.hotspotshield.com/2013/06/17/hotel-wifi-security/ *** Avaya Aura Session Manager ISC BIND Record Handling Lockup Vulnerability *** --------------------------------------------- Avaya has acknowledged a vulnerability in Avaya Aura Session Manager, which can be exploited by malicious people to cause a DoS (Denial of Service). --------------------------------------------- https://secunia.com/advisories/53906 *** Hitachi Cosminexus Products Oracle Java Multiple Vulnerabilities *** --------------------------------------------- Hitachi has acknowledged multiple vulnerabilities in multiple Cosminexus products, which can be exploited by malicious, local users to disclose certain sensitive information, manipulate certain data, and gain escalated privileges and by malicious people to conduct spoofing attacks, disclose certain sensitive information, manipulate certain data, cause a DoS (Denial of Service), and compromise a vulnerable system. --------------------------------------------- https://secunia.com/advisories/53759 *** How to backdoor an encryption app *** --------------------------------------------- Over the past week or so theres been a huge burst of interest in encryption software. Applications like Silent Circle and RedPhone have seen a major uptick in new installs. CryptoCat alone has seen a zillion new installs, prompting several infosec researchers to nearly die of irritation. --------------------------------------------- http://blog.cryptographyengineering.com/2013/06/how-to-backdoor-encryption-… *** Hackers and viruses now stalking smart phones *** --------------------------------------------- Computer viruses have plagued consumers for many years now, causing companies to spend heavily on installing every kind of firewall known to mankind to keep their security software updated. --------------------------------------------- http://www.nation.co.ke/oped/Opinion/Hackers-and-viruses-now-stalking-smart… *** Buffalo WZR-HP-G300NH2 Cross-Site Request Forgery Vulnerability *** --------------------------------------------- A vulnerability has been reported in Buffalo WZR-HP-G300NH2, which can be exploited by malicious people to conduct cross-site request forgery attacks. --------------------------------------------- https://secunia.com/advisories/53750 *** Oracle Solaris Multiple Vulnerabilities *** --------------------------------------------- Oracle has acknowledged multiple vulnerabilities in multiple packages included in Solaris, which can be exploited by malicious users to cause a DoS (Denial of Service) and by malicious people to compromise an application using the library. --------------------------------------------- https://secunia.com/advisories/53843

1 0

Tageszusammenfassung - Donnerstag 20-06-2013
by Daily end-of-shift report 20 Jun '13

20 Jun '13

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 19-06-2013 18:00 − Donnerstag 20-06-2013 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Multiple Vulnerabilities in Cisco TelePresence TC and TE Software *** --------------------------------------------- Cisco TelePresence TC and TE Software contain two vulnerabilities in the implementation of the Session Initiation Protocol (SIP) that could allow an unauthenticated remote attacker to cause a denial of service (DoS) condition. Additionally, Cisco TelePresence TC Software contain an adjacent root access vulnerability that could allow an attacker on the same physical or logical Layer-2 network as the affected system to gain an unauthenticated root shell. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Vuln: OTRS CVE-2013-4088 Remote Security Bypass Vulnerability *** --------------------------------------------- OTRS is prone to a remote security-bypass vulnerability. Attackers can exploit this issue to bypass security restrictions and obtain sensitive information; other attacks may also be possible. --------------------------------------------- http://www.securityfocus.com/bid/60688 *** Anonymous' #OpPetrol: What is it, What to Expect, Why Care? *** --------------------------------------------- Last month, the hacker collective Anonymous announced their intention to launch cyber attacks against the petroleum industry (under the code name #OpPetrol) that is expected to last up to June 20. Their claimed reason for this attack is primarily due to petroleum being sold with the US dollar instead of currency of the country where... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/wIkmxr0Tz_A/ *** LinkedIn auf indische Webseite umgeleitet *** --------------------------------------------- Das Karriereportal LinkedIn war in den letzten Stunden nur hin und wieder zu erreichen. Das Karriereportal wurde auf fremde Seiten umgeleitet. Die Einen sprechen von "menschlichen Fehlern", die anderen von einem Angriff. --------------------------------------------- http://www.heise.de/security/meldung/LinkedIn-auf-indische-Webseite-umgelei… *** VLC Media Player Unspecified Vulnerabilities *** --------------------------------------------- Some vulnerabilities with an unknown impact have been reported in VLC Media Player. The vulnerabilities are caused due to unspecified errors. No further information is currently available. --------------------------------------------- https://secunia.com/advisories/53656 *** Blog: Apple of discord *** --------------------------------------------- As Apple's popularity grows, so does the desire among fraudsters to make money from the people who own the company's devices. The cybercriminals are aiming to steal Apple ID data which provides access to users' personal information stored in iCloud (e.g., photographs, contacts, documents, email, etc.) as well as to the purchases made in the company's iTunes Store. Many malicious users go further and try to the steal bank card details used to pay for those purchases. --------------------------------------------- http://www.securelist.com/en/blog/8108/Apple_of_discord

1 0

Tageszusammenfassung - Mittwoch 19-06-2013
by Daily end-of-shift report 19 Jun '13

19 Jun '13

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 18-06-2013 18:00 − Mittwoch 19-06-2013 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Sybase EAServer Multiple Vulnerabilities *** --------------------------------------------- Multiple vulnerabilities have been reported in Sybase EAServer, which can be exploited by malicious people to bypass certain security restrictions, disclose certain sensitive information, and compromise a vulnerable system. --------------------------------------------- https://secunia.com/advisories/53733 *** Java SE Critical Patch Update - June 2013 *** --------------------------------------------- Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply CPU fixes as soon as possible. This Critical Patch Update contains 40 new security fixes across Java SE products of which 4 are applicable to server deployments of Java. --------------------------------------------- http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.ht… *** Java 7 update 25 released (Tue, Jun 18th) *** --------------------------------------------- http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.ht… (c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. --------------------------------------------- http://isc.sans.edu/diary.html?storyid=16025 *** Critical Update Plugs 40 Security Holes in Java *** --------------------------------------------- Oracle today released a critical patch update for its Java software that fixes at least 40 security vulnerabilities in this widely deployed program and browser plugin. Updates are available for Java 7 on both Mac and Windows. --------------------------------------------- https://krebsonsecurity.com/2013/06/critical-update-plugs-40-security-holes… *** Siemens WinCC 7.2 Multiple Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for vulnerabilities that impact the Siemens WinCC Web Navigator 7.2. --------------------------------------------- http://ics-cert.us-cert.gov/advisories/ICSA-13-169-02 *** Remote code execution vuln appears in Puppet *** --------------------------------------------- Big trouble in automated clouds - Puppet Labs has blasted out a security advisory about a vulnerability in the popular infrastructure management tool Puppet. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2013/06/18/puppet_secu… *** Solaris 10 patch cluster File clobbering vulnerability *** --------------------------------------------- Topic: Solaris 10 patch cluster File clobbering vulnerability Risk: Medium Text:File clobbering vulnerability in Solaris 10 patch cluster 3/27/2013 Larry W. Cashdollar @_larry0 Hello, The 147147-2... --------------------------------------------- http://cxsecurity.com/issue/WLB-2013060154 *** Joomla 1.5.26, 2.5.11, 3.1.1 crypto vulnerability *** --------------------------------------------- Topic: Joomla 1.5.26, 2.5.11, 3.1.1 crypto vulnerability Risk: Medium Text:# Vulnerable Application All current and past versions of Joomla (http://www.joomla.org) up to 1.5.26, 2.5.11, 3.1.1. Also th... --------------------------------------------- http://cxsecurity.com/issue/WLB-2013060146 *** Symantec Endpoint Protection Manager Buffer Overflow Vulnerability *** --------------------------------------------- A vulnerability has been reported in Symantec Endpoint Protection Manager, which can be exploited by malicious people to compromise a vulnerable system. --------------------------------------------- https://secunia.com/advisories/53864 *** Angestellte wollen Hilfe bei IT-Sicherheit *** --------------------------------------------- Der Umgang mit Informationstechnik gehört auch für Angestellte in kleinen und mittelständischen Unternehmen zum täglichen Alltag. Einer Studie zufolge fühlten sie sich bei dieser Aufgabe jedoch vielfach alleingelassen. --------------------------------------------- http://futurezone.at/b2b/16584-angestellte-wollen-hilfe-bei-it-sicherheit.p…

1 0

Tageszusammenfassung - Dienstag 18-06-2013
by Daily end-of-shift report 18 Jun '13

18 Jun '13

======================= = End-of-Shift report = ======================= Timeframe: Montag 17-06-2013 18:00 − Dienstag 18-06-2013 18:00 Handler: Robert Waldner Co-Handler: n/a *** Siemens SIMATIC WinCC Web Navigator Bugs Let Remote Users Inject SQL Commands and Login to the System *** --------------------------------------------- Siemens SIMATIC WinCC Web Navigator Bugs Let Remote Users Inject SQL Commands and Login to the System --------------------------------------------- http://www.securitytracker.com/id/1028672 *** New Regulation for EU cybersecurity agency ENISA, with new duties *** --------------------------------------------- European Union (EU) cybersecurity agency, ENISA has today (18th June) received a new Regulation, granting it a seven year mandate with an expanded set of duties. --------------------------------------------- http://www.enisa.europa.eu/media/press-releases/new-regulation-for-eu-cyber… *** Tools - ProcDOT 1.0 released *** --------------------------------------------- I am happy to announce that the first release (1.0) of my visual malware analysis tool ProcDOT (I already mentioned the beta in a recent blog post) is now available. This tool processes Sysinternals Process Monitor (Procmon) logfiles and PCAP-logs (Windump, Tcpdump) to generate a graph via the GraphViz suite. This graph visualizes any relevant activities (customizable) and can be interactively analyzed. --------------------------------------------- https://www.cert.at/services/blog/20130618112047-852_en.html *** Wall Street sets example for testing security defenses *** --------------------------------------------- Quantum Dawn 2 will test institutions playbooks while also finding more efficient ways to share real-time information --------------------------------------------- http://www.csoonline.com/article/735068/wall-street-sets-example-for-testin… *** iOS: Sicherheitsmängel im "Persönlichen Hotspot" *** --------------------------------------------- iOS wählt die Passwörter für mobiles Tethering nicht wirklich zufällig. Mobile Hotspots können in wenigen Sekunden geknackt werden. --------------------------------------------- http://www.heise.de/security/meldung/iOS-Sicherheitsmaengel-im-Persoenliche… *** Windows-Härter überführt SSL-Spione *** --------------------------------------------- Microsofts Gratis-Schutzprogramm EMET soll in Version 4.0 nicht nur besser vor Cyber-Angriffen schützen, es ist auch deutlich benutzerfreundlicher geworden. Die empfohlenen Schutzeinstellungen aktiviert man mit wenigen Klicks. --------------------------------------------- http://www.heise.de/newsticker/meldung/Windows-Haerter-ueberfuehrt-SSL-Spio… *** Apache XML Security Multiple Vulnerabilities *** --------------------------------------------- Apache XML Security Multiple Vulnerabilities --------------------------------------------- https://secunia.com/advisories/53590 *** Graphical Tools Help Security Experts Track Cyber-Attacks in Real Time *** --------------------------------------------- "... it looks like a fantastic image from something in the world of science fiction. Streams of data flow from the globe representing the Internet. Attack vectors are highlighted in red. You can watch the changes as the attacks progress." --------------------------------------------- http://www.eweek.com/security/graphical-tools-help-security-experts-track-c… *** Security Vulnerability in Siemens COMOS 9.2/10.0 *** --------------------------------------------- Siemens has discovered a vulnerability in the client library of the database system COMOS which might allow attackers to escalate their privileges for database access. The attacker would need local access as authenticated user to exploit the vulnerability. --------------------------------------------- http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemen…

1 0

Tageszusammenfassung - Montag 17-06-2013
by Daily end-of-shift report 17 Jun '13

17 Jun '13

======================= = End-of-Shift report = ======================= Timeframe: Freitag 14-06-2013 18:00 − Montag 17-06-2013 18:00 Handler: Robert Waldner Co-Handler: n/a *** [webapps] - LibrettoCMS 2.2.2 - Arbitrary File Upload *** --------------------------------------------- LibrettoCMS is provided a file upload function to unauthenticated users. Allows for write/read/edit/delete download arbitrary file uploaded , which results attacker might arbitrary write/read/edit/delete files and folders. --------------------------------------------- http://www.exploit-db.com/exploits/26213 *** Adobe Flash exploit grabs video and audio, long after “fix” *** --------------------------------------------- Demonstration code shows a new trick defeats Flash privacy fix. --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/72PWd3AAReE/ *** Microsoft Sharepoint (Cloud) Persistent Script Insertion *** --------------------------------------------- Topic: Microsoft Sharepoint (Cloud) Persistent Script Insertion Risk: Low Text:Title: Microsoft SharePoint (Cloud) - Persistent Exception-Handling Web Vulnerability Date: == 2013-06-14 Re... --------------------------------------------- http://cxsecurity.com/issue/WLB-2013060124 *** Avira AntiVir Engine Denial Of Service / Filter Evasion *** --------------------------------------------- Topic: Avira AntiVir Engine Denial Of Service / Filter Evasion Risk: Medium Text: LSE Leading Security Experts GmbH - Security Advisory 2013-06-13 Avira AntiVir Engine -- Denial of Service / Filtering E... --------------------------------------------- http://cxsecurity.com/issue/WLB-2013060123 *** Siemens OpenScape Branch / Session Border Controller XSS / Disclosure / Injection *** --------------------------------------------- Topic: Siemens OpenScape Branch / Session Border Controller XSS / Disclosure / Injection Risk: Medium Text:SEC Consult Vulnerability Lab Security Advisory == title: Multiple vulner... --------------------------------------------- http://cxsecurity.com/issue/WLB-2013060121 *** Firefox und Twitter schützen vor eingeschleusten Skripten *** --------------------------------------------- "Du kommst hier nicht rein" heißt es für Schadcode, wenn man als Webseiten-Betreiber den HTTP-Header "Content Security Policy" benutzt. Google, Mozilla und Twitter gehen mit gutem Beispiel voran. --------------------------------------------- http://www.heise.de/newsticker/meldung/Firefox-und-Twitter-schuetzen-vor-ei… *** Security Bulletin: WebSphere Commerce vulnerability could allow disclosure of user personal data (CVE-2013-0523) *** --------------------------------------------- Some WebSphere Commerce data may be encrypted using an encryption algorithm that is susceptible to a padding oracle attack which may allow for the disclosure of user personal data. CVE(s): ... --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_web… *** Joomla com_extplorer Components shell upload Vulnerability *** --------------------------------------------- Topic: Joomla com_extplorer Components shell upload Vulnerability Risk: Medium Text: # ISlamic Republic Of Iran Security Team # Www.IrIsT.Ir ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2013060127 *** Microsoft Outlook Vulnerability S/MIME Loss of Integrity *** --------------------------------------------- Topic: Microsoft Outlook Vulnerability S/MIME Loss of Integrity Risk: Medium Text:** Attention script bunnies: This is not an RCE, XSS, etc. Please move along :) ** Microsoft Outlook (all versions) suffers ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2013060129 *** Mozilla Firefox and Microsoft Internet Explorer DoS vulnerability *** --------------------------------------------- Topic: Mozilla Firefox and Microsoft Internet Explorer DoS vulnerability Risk: Medium Text:I want to warn you about Denial of Service vulnerability in Mozilla Firefox and Microsoft Internet Explorer. Earlier Jean ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2013060128 *** Vulnerability Disclosure – Open or Private? *** --------------------------------------------- At the end of May, two Google security engineers announced Mountain View’s new policy regarding zero-day bugs and disclosure. They strongly suggested that information about zero-day exploits currently in the wild should be released no more than seven days after the vendor has been notified. Ideally, the notification or patch should come from the vendor, [...]Post from: Trendlabs Security Intelligence Blog - by Trend MicroVulnerability Disclosure – Open or Private? --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/1qT_zYH1FxU/ *** Oracle Java pre-announcement: Upcoming JRE patch will plug 37 remotely exploitable holes. --------------------------------------------- See http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.ht…, (Mon, Jun 17th) --------------------------------------------- http://isc.sans.edu/diary.html?storyid=16013&rss *** Fortinet FortiOS (FortiGate) Guest User Permission Security Bypass Security Issue *** --------------------------------------------- Fortinet FortiOS (FortiGate) Guest User Permission Security Bypass Security Issue --------------------------------------------- https://secunia.com/advisories/53875 *** Debian Security Advisory for fail2ban *** --------------------------------------------- When using Fail2ban to monitor Apache logs, improper input validation in log parsing could enable a remote attacker to trigger an IP ban on arbitrary addresses, thus causing a denial of service. --------------------------------------------- http://www.debian.org/security/2013/dsa-2708

1 0

Tageszusammenfassung - Freitag 14-06-2013
by Daily end-of-shift report 14 Jun '13

14 Jun '13

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 13-06-2013 18:00 − Freitag 14-06-2013 18:00 Handler: Matthias Fraidl Co-Handler: Stephan Richter *** Java SE Critical Patch Update - June 2013 - Pre-Release Announcement *** --------------------------------------------- This Critical Patch Update Pre-Release Announcement provides advance information about the Oracle Java SE Critical Patch Update for June 2013, which will be released on Tuesday, June 18, 2013. While this Pre-Release Announcement is as accurate as possible at the time of publication, the information it contains may change before publication of the Critical Patch Update Advisory. --------------------------------------------- http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.ht… *** MtGox Phishing Campaign Hits Bing, Yahoo! *** --------------------------------------------- An active phishing campaign targeting account holders at popular Bitcoin exchange MtGox.com has hijacked the top search results at Bing and Yahoo.com, redirecting unwary clickers to mtpox.com, a look-alike domain and Web site that was registered on June 12, 2013, less than 24 hours ago. --------------------------------------------- https://krebsonsecurity.com/2013/06/mtgox-phishing-campaign-hits-bing-yahoo *** How cybercriminals apply Quality Assurance (QA) to their malware campaigns before launching them *** --------------------------------------------- By Dancho Danchev In 2013, the use of basic Quality Assurance (QA) practices has become standard practice for cybercrininals when launching a new campaign. In an attempt to increase the probability of a successful outcome for their campaigns � think malware infection, increased visitor-to-malware infected conversion, improved conversion of blackhat SEO acquired traffic leading to the purchase of counterfeit pharmaceutical items etc. --------------------------------------------- http://blog.webroot.com/2013/06/14/how-cybercriminals-apply-quality-assuran… *** Critical vulnerabilities in Siemens OpenScape Branch & SBC *** --------------------------------------------- Siemens OpenScape Branch & SBC are vulnerable to critical vulnerabilities such as unauthenticated execution of OS commands or file disclosure. Attackers are able to take over the operating system and potentially intercept VoIP traffic or phone calls. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2013… *** AirLive IP cameras plain text information disclosure *** --------------------------------------------- AirLive IP cameras could allow a remote attacker to obtain sensitive information, caused by retrieving users details and passwords stored as plain text in a backup file. An attacker could exploit this vulnerability to obtain sensitive information. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/84933 *** OWASP Top 10 2013 released *** --------------------------------------------- The Open Web Application Security Project's top 10 most critical web application security risks, has been updated and a new list has been published. Last updated back in 2010, the organization has published the new list wherein the importance of cross-site scripting (XSS) and cross-site request forgery (CRSF) has been diluted a little while risks related to broken session management and authentication has moved up a notch. --------------------------------------------- https://www.owasp.org/index.php/Top10 *** Linux-Kernel-Exploit wurde auf Android portiert *** --------------------------------------------- Eine gefährliche Sicherheitslücke, die unter Linux längst gepatcht wurde, wird nun unter Android ausgenutzt. Laut Symantec ist es Entwicklern von Schadsoftware gelungen, den Exploit zu portieren. Abhilfe durch eine neue Android-Version gibt es zunächst nicht. --------------------------------------------- http://www.golem.de/news/privilege-escalation-linux-kernel-exploit-wurde-au… *** Big browser builders scramble to fix cross-platform zero-day flaw *** --------------------------------------------- Browser manufacturers will release an update in the next few weeks to block a new type of malware that exploits a cross-platform flaw that allows attackers access to Mac, PC, mobile, and even games console internet users. --------------------------------------------- http://www.theregister.co.uk/2013/06/13/cross_platform_browser_flaw_in_wild/ *** Hintergrund: XSS-Bremse Content Security Policy *** --------------------------------------------- Cross-Site-Scripting (XSS) ist eine der größten Plagen, mit denen Webmaster zu kämpfen haben. Selbst Banken und Bezahldienstleistern wie PayPal gelingt es nicht, das gefährliche Einschleusen von Fremdcode zu verhindern. Der neue Standard "Content Security Policy" soll endlich Abhilfe schaffen. --------------------------------------------- http://www.heise.de/security/artikel/XSS-Bremse-Content-Security-Policy-188…

1 0

Tageszusammenfassung - Donnerstag 13-06-2013
by Daily end-of-shift report 13 Jun '13

13 Jun '13

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 12-06-2013 18:00 − Donnerstag 13-06-2013 18:00 Handler: Matthias Fraidl Co-Handler: Robert Waldner *** BlackBerry Issues Z10, PlayBook Security Advisories *** --------------------------------------------- BlackBerry has issued security advisories warning of vulnerabilities in the Z10 smartphone and PlayBook tablet. --------------------------------------------- http://threatpost.com/blackberry-issues-z10-playbook-security-advisories/ *** NanoBB 0.7 - Multiple Vulnerabilities *** --------------------------------------------- An attacker might execute arbitrary SQL commands on the database server with this vulnerability. User tainted data is used when creating the database query that will be executed on the database management system (DBMS). --------------------------------------------- http://www.exploit-db.com/exploits/26126 *** Vuln: WordPress crypt_private() Method Remote Denial of Service Vulnerability *** --------------------------------------------- WordPress is prone to a remote denial-of-service vulnerability. Attackers can exploit this issue to consume CPU and memory resources, denying service to legitimate users. WordPress 3.5.1 is vulnerable; other versions may also be affected. --------------------------------------------- http://www.securityfocus.com/bid/60477 *** Rogue ads lead to SafeMonitorApp Potentially Unwanted Application (PUA) *** --------------------------------------------- By Dancho Danchev Our sensors just picked up yet another rogue ad enticing users into installing the SafeMonitorApp, a potentially unwanted application (PUA) that socially engineers users into giving away their privacy through deceptive advertising of the rogue application's 'features'. --------------------------------------------- http://blog.webroot.com/2013/06/13/rogue-ads-lead-to-safemonitorapp-potenti… *** Swedens data protection Authority bans Google cloud services over privacy concerns *** --------------------------------------------- In a landmark ruling, Swedens data protection authority (the Swedish Data Inspection Board) this week issued a decision that prohibits the nations public sector bodies from using the cloud service Google Apps...... --------------------------------------------- http://www.privacysurgeon.org/blog/incision/swedens-data-protection-authori… *** Enterprises spend too much time on attack prevention, not enough on mitigating a breach *** --------------------------------------------- The biggest security mistake enterprises make is focusing too much time and too many resources on preventing cyberattacks and not enough time and money on mitigation once a breach occurs, said Dave Monnier, security evangelist and fellow at non-profit Internet security research firm Team Cymru." --------------------------------------------- http://www.fierceenterprisecommunications.com/story/enterprises-spend-too-m… *** Blog: AutoRun. Reloaded *** --------------------------------------------- Recent months have produced little of interest among worms written in Java and script languages such as JavaScript and VBScript. The main reason behind this was the limited proficiency of the virus writers, whose creations were anything but remarkable. However, a couple of malware samples grabbed our attention; their complexity is testimony to the fact that professionals sometimes get involved as well. --------------------------------------------- http://www.securelist.com/en/blog/8107/AutoRun_Reloaded *** Microsoft botnet smackdown caused collateral damage, failed to kill target *** --------------------------------------------- Zombies just wont stay underground Microsoft is attracting fresh criticism for its handling of the Citadel botnet takedown, with some security researchers pointing to signs that the zombie network is already rising from the grave again. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2013/06/13/ms_citadel_… *** Medical Devices Hard-Coded Passwords *** --------------------------------------------- ALERTSUMMARYResearchers Billy Rios and Terry McCorkle of Cylance have reported a hard-coded password vulnerability affecting a wide variety of medical devices. According to the report, the vulnerability could be exploited to potentially change critical settings and/or modify device firmware. ICS-CERT has been working closely with the Food and Drug Administration (FDA) on these issues. ICS-CERT and the FDA have notified the affected vendors of the report and have asked the vendors to confirm the --------------------------------------------- http://ics-cert.us-cert.gov/alerts/ICS-ALERT-13-164-01 *** Researchers Claim Wi-Fi Threat Is A Serious Danger To iPhone Users *** --------------------------------------------- The way certain iOS devices, like iPhones or iPads, automatically connect to Wi-Fi networks could place users at serious risk. Security firm SkyCure said it had discovered a feature in iPhone devices running on certain networks, including Vodafone, that would connect automatically to a Wi-Fi network with a specified SSID, such as 'BTWiFi'. --------------------------------------------- http://www.techweekeurope.co.uk/news/researchers-claim-wi-fi-threat-is-a-se…

1 0

Tageszusammenfassung - Mittwoch 12-06-2013
by Daily end-of-shift report 12 Jun '13

12 Jun '13

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 11-06-2013 18:00 − Mittwoch 12-06-2013 18:00 Handler: Matthias Fraidl Co-Handler: Robert Waldner *** Microsoft Security Bulletin Summary for June 2013 --------------------------------------------- - Cumulative Security Update for Internet Explorer - Vulnerability in Windows Kernel Could Allow Information Disclosure - Vulnerability in Kernel-Mode Driver Could Allow Denial of Service - Vulnerability in Windows Print Spooler Components Could Allow Elevation of Privilege - Vulnerability in Microsoft Office Could Allow Remote Code Execution --------------------------------------------- http://technet.microsoft.com/en-us/security/bulletin/ms13-jun *** Microsoft schließt sie nicht alle *** --------------------------------------------- Am Juni-Patchday hat Microsoft zahlreihe Lücken in Windows, Internet Explorer und Office geschlossen. Eine Rechteausweitungslücke, für die bereits ein Exploit im Netz kursiert, hat die Redmonder Softwareschmiede dabei jedoch offenbar ausgelassen. --------------------------------------------- http://www.heise.de/security/meldung/Microsoft-schliesst-sie-nicht-alle-188… *** Juni-Updates für Flash-Player und Co. *** --------------------------------------------- Eine Lücke, viele Updates: Adobe hat ein kritisches Sicherheitsloch gestopft und neue Flash- und Air-Versionen für sämtliche Plattformen veröffentlicht. --------------------------------------------- http://www.heise.de/security/meldung/Juni-Updates-fuer-Flash-Player-und-Co-… *** HP integrated Lights Out (iLO) Unspecified Bug Lets Remote Users Gain Access *** --------------------------------------------- HP integrated Lights Out (iLO) Unspecified Bug Lets Remote Users Gain Access --------------------------------------------- http://www.securitytracker.com/id/1028661 *** glibc 2.17+ XDM crypto() NULL pointer deref *** --------------------------------------------- Topic: glibc 2.17+ XDM crypto() NULL pointer deref Risk: Medium Text:Its been suggested we get a CVE id assigned for this recent fix to the xdm display/login manager from X.Org: http://cgit.f... --------------------------------------------- http://cxsecurity.com/issue/WLB-2013060101 *** Weitere XSS-Lücke bei ClickandBuy geschlossen *** --------------------------------------------- Nachdem heise Security über eine XSS-Lücke beim Zahlungsabwickler berichtete, erreichte uns vor kurzem schon der nächste Hinweis auf eine weitere Lücke. --------------------------------------------- http://www.heise.de/security/meldung/Weitere-XSS-Luecke-bei-ClickandBuy-ges… *** Vuln: HP Data Protector CVE-2013-2333 Remote Code Execution Vulnerability *** --------------------------------------------- HP Data Protector CVE-2013-2333 Remote Code Execution Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/60309 *** WordPress Mail Subscribe List Plugin Script Insertion Vulnerability *** --------------------------------------------- WordPress Mail Subscribe List Plugin Script Insertion Vulnerability --------------------------------------------- https://secunia.com/advisories/53732 *** Hewlett Packards Weboberfläche "System Management Homepage" angreifbar *** --------------------------------------------- Die Weboberfläche zur Verwaltung von ProLiant- und Integrity-Servern enthält eine kritische Sicherheitslücke. --------------------------------------------- http://www.heise.de/security/meldung/Hewlett-Packards-Weboberflaeche-System…

1 0

Tageszusammenfassung - Dienstag 11-06-2013
by Daily end-of-shift report 11 Jun '13

11 Jun '13

======================= = End-of-Shift report = ======================= Timeframe: Montag 10-06-2013 18:00 − Dienstag 11-06-2013 18:00 Handler: Matthias Fraidl Co-Handler: Stephan Richter *** CERT Warns of Vulnerabilities in HP Insight Diagnostics *** --------------------------------------------- CERT warns of an unpatched vulnerability in HPs Insight Diagnostics server management software that could lead to remote code execution attacks. --------------------------------------------- http://threatpost.com/cert-warns-of-vulnerabilities-in-hp-insight-diagnosti… *** Apple iOS and Mac OS X security bypass *** --------------------------------------------- Apple iOS and Mac OS X security bypass --------------------------------------------- http://xforce.iss.net/xforce/xfdb/84809 *** The Value of a Hacked Email Account *** --------------------------------------------- One of the most-viewed stories on this site is a blog post+graphic that I put together last year to illustrate the ways that bad guys can monetize hacked computers. But just as folks who dont bank online or store sensitive data on their PCs often have trouble understanding why someone would want to hack into their systems, many people do not fully realize how much they have invested in their email accounts until those accounts are in the hands of cyber thieves. --------------------------------------------- https://krebsonsecurity.com/2013/06/the-value-of-a-hacked-email-account *** NSA Whistleblower Article Redirects to Malware *** --------------------------------------------- The Washington Free Beacons website has been attacked and malware is redirecting visitors to a site hosting the ZeroAccess rootkit and scareware. --------------------------------------------- http://threatpost.com/nsa-whistleblower-article-redirects-to-malware/ *** Debian Security Advisory DSA-2706 chromium-browser *** --------------------------------------------- Several vulnerabilities have been discovered in the Chromium web browser. --------------------------------------------- http://www.debian.org/security/2013/dsa-2706 *** Cisco ASA Ethernet Information Leak *** --------------------------------------------- Exploit for hosts which use a network device driver that pads ethernet frames with data which vary from one packet to another, likely taken from kernel memory, system memory allocated to the device driver, or a hardware buffer on its network interface card. --------------------------------------------- http://cxsecurity.com/issue/WLB-2013060088 *** MobileIron Virtual Smartphone Platform Privilege Escalation Exploit 0day *** --------------------------------------------- The MobileIron VSP appliance provides a restricted "clish" java application that can be used for performing a minimal amount of configuration and requires an "enable" password for elevated privileges. --------------------------------------------- http://cxsecurity.com/issue/WLB-2013060085 *** Going Solo: Self-Propagating ZBOT Malware Spotted *** --------------------------------------------- Who says you can't teach old malware new tricks? Recently, we reported on how ZBOT had made a comeback of sorts in 2013; this was followed by media reports that it was now spreading via Facebook. Now, we have spotted a new ZBOT variant that can spread on its own. --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/9Agp1TYzr9c/ *** Microsoft FixIt Tool Blocks Java Attacks in IE *** --------------------------------------------- Java is a security headache, not just for users and Oracle, its provider, but also for other software companies that have to deal with it, as well. Microsoft has taken steps to address this problem by releasing a FixIt tool that is designed to block all of the Web-based Java attack vectors in Internet Explorer, ... --------------------------------------------- http://threatpost.com/microsoft-fixit-tool-blocks-java-attacks-in-ie/ *** Store passwords the right way in your application *** --------------------------------------------- I suspect most of our readers know this, but it cant hurt to repeat this every so often as there is a lot of confusion on the issue. One thing that gets to me is seeing reports of website compromises that claim "the passwords were hashed with SHA-256". Well at face value that means 90% of the passwords were decoded before the news hit. --------------------------------------------- http://isc.sans.edu/diary.html?storyid=15974 *** [remote] - Java Web Start Double Quote Injection Remote Code Execution *** --------------------------------------------- Java Web Start Double Quote Injection Remote Code Execution --------------------------------------------- http://www.exploit-db.com/exploits/26123 *** WordPress 3.5.1 Denial of Service *** --------------------------------------------- Version 3.5.1 (latest) of popular blogging engine WordPress suffers from remote denial of service vulnerability. The bug exists in encryption module (class-phpass.php). --------------------------------------------- http://cxsecurity.com/issue/WLB-2013060091

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily