Daily

daily@lists.cert.at

1 participants
3150 discussions

Tageszusammenfassung - 07.02.2024
by Daily end-of-shift report 07 Feb '24

07 Feb '24

===================== = End-of-Day report = ===================== Timeframe: Dienstag 06-02-2024 18:00 − Mittwoch 07-02-2024 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Fortinet snafu: Critical FortiSIEM CVEs are duplicates, issued in error ∗∗∗ --------------------------------------------- It turns out that critical Fortinet FortiSIEM vulnerabilities tracked as CVE-2024-23108 and CVE-2024-23109 are not new and have been published this year in error. --------------------------------------------- https://www.bleepingcomputer.com/news/security/fortinet-snafu-critical-fort… ∗∗∗ Schlüssel ausgelesen: Bastler umgeht Bitlocker-Schutz mit Raspberry Pi Pico ∗∗∗ --------------------------------------------- Möglich war ihm dies durch das Abfangen der Kommunikation des auf dem Mainboard des Notebooks verlöteten TPM-Chips mit der CPU. [..] Auf die Möglichkeit solcher Angriffe auf Systeme mit externen TPM-Chips wiesen Sicherheitsforscher schon im Sommer 2021 hin. Grund dafür sei die unverschlüsselte Übertragung des Verschlüsselungsschlüssels, so dass sich der Schlüssel einfach über die Kontakte des TPMs abfangen lasse, hieß es schon damals. --------------------------------------------- https://www.golem.de/news/schluessel-ausgelesen-bastler-umgeht-bitlocker-sc… ∗∗∗ Unleashing the Power of Scapy for Network Fuzzing ∗∗∗ --------------------------------------------- Cybersecurity is a critical aspect of any network or software system, and fuzzing is arguably one of the most potent techniques used to identify such security vulnerabilities. Fuzzing involves injecting unexpected or invalid data into the system, which can trigger unforeseen behaviours, potentially leading to security breaches or crashes. Scapy is one of the many tools that can be used for fuzzing, and it stands out as a versatile and efficient option. --------------------------------------------- https://www.darkrelay.com/post/unleashing-the-power-of-scapy-for-network-fu… ∗∗∗ Anydesk-Einbruch: Französisches BSI-Pendant vermutet Dezember als Einbruchsdatum ∗∗∗ --------------------------------------------- Der IT-Sicherheitsvorfall bei Anydesk datiert womöglich auf den Dezember 2023, wie den Hinweisen der französischen IT-Sicherheitsbehörde zu entnehmen ist. --------------------------------------------- https://www.heise.de/news/Anydesk-Einbruch-datiert-vermutlich-auf-Dezember-… ∗∗∗ E-Mail von DNS EU ist betrügerisch ∗∗∗ --------------------------------------------- Derzeit erhalten viele Website-Betreiber:innen E-Mails von einer vermeintlichen Firma namens DNS EU. Im E-Mail behauptet das Unternehmen, dass es einen „Registrierungsantrag“ für eine Domain erhalten hat, die Ihrer eigenen Domain sehr ähnlich ist. Ihnen wird angeboten, diese Domain für € 297,50 zu kaufen. Ignorieren Sie dieses E-Mail, das Angebot ist Fake. --------------------------------------------- https://www.watchlist-internet.at/news/e-mail-von-dns-eu-ist-betruegerisch/ ∗∗∗ Vermehrte Ransomware-Angriffe mit Lockbit 3.0 ∗∗∗ --------------------------------------------- In den letzten Tagen sind österreichische Unternehmen und Organisationen vermehrt von Angriffen mit der Ransomware Lockbit 3.0 betroffen. Dabei handelt es sich um Ransomware-as-a-Service, was es einer Vielzahl von Kriminellen ermöglicht, unabhängig voneinander zu agieren und eine grössere Anzahl von Zielen zu attackieren. Bedrohungsakteure, die im Rahmen ihrer Angriffe Lockbit 3.0 einsetzen erlangen vor allem über den Missbrauch von RDP-Verbindungen (beispielsweise unter Einsatz anderweitig gestohlener Zugangsdaten) und die Ausnutzung von Schwachstellen in aus dem Internet erreichbaren Applikationen Zugang zu den Netzwerken ihrer Opfer. Wir empfehlen nachdrücklich, die eigenen Sicherheitsmaßnahmen zu überprüfen [..] --------------------------------------------- https://cert.at/de/aktuelles/2024/2/vermehrte-ransomware-angriffe-mit-lockb… ∗∗∗ Cyber Security Glossary: The Ultimate List ∗∗∗ --------------------------------------------- If you have anything to do with cyber security, you know it employs its own unique and ever-evolving language. Jargon and acronyms are the enemies of clear writing—and are beloved by cyber security experts. So Morphisec has created a comprehensive cyber security glossary that explains commonly used cybersecurity terms, phrases, and technologies. We designed this list to demystify the terms that security professionals use when describing security tools, threats, processes, and techniques. We will periodically update it, and hope you find it useful. --------------------------------------------- https://blog.morphisec.com/cyber-security-glossary ===================== = Vulnerabilities = ===================== ∗∗∗ Kritische Sicherheitslücke in JetBrains TeamCity On-Premises ∗∗∗ --------------------------------------------- Das Softwareunternehmen JetBrains hat Informationen über eine kritische Sicherheitslücke in JetBrains TeamCity On-Premises veröffentlicht. Eine Ausnutzung der Schwachstelle, CVE-2024-23917, erlaubt unauthentifizierten Angreifer:innen mit HTTP(s)-Zugriff auf eine verwundbare Instanz von TeamCity das Umgehen von Authentifizierungskontrollen und somit die vollständige Übernahme der betroffenen Installation. --------------------------------------------- https://cert.at/de/aktuelles/2024/2/kritische-sicherheitslucke-in-jetbrains… ∗∗∗ Shim: Kritische Schwachstelle gefährdet Secure Boot unter Linux ∗∗∗ --------------------------------------------- In einer von den meisten gängigen Linux-Distributionen verwendeten EFI-Anwendung namens Shim wurde eine kritische Schwachstelle entdeckt, die es Angreifern ermöglicht, Schadcode auszuführen und die vollständige Kontrolle über ein Zielsystem zu übernehmen. Ausgenutzt werden könne der Fehler durch eine speziell gestaltete HTTP-Anfrage, die zu einem kontrollierten Out-of-bounds-Schreibvorgang führe, heißt es in der Beschreibung zu CVE-2023-40547. --------------------------------------------- https://www.golem.de/news/shim-kritische-schwachstelle-gefaehrdet-secure-bo… ∗∗∗ Zeroshell vulnerable to OS command injection ∗∗∗ --------------------------------------------- Zeroshell Linux distribution contains an OS command injection vulnerability. This vulnerability was reported on August 2020. The Zeroshell project reached EOL on April 2021. The communication with the developer was established on November 2023, and this JVN publication was agreed upon. --------------------------------------------- https://jvn.jp/en/jp/JVN44033918/ ∗∗∗ Cisco: (High) ClamAV OLE2 File Format Parsing Denial of Service Vulnerability ∗∗∗ --------------------------------------------- A vulnerability in the OLE2 file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. CVE-2024-20290 --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco: (Critical) Cisco Expressway Series Cross-Site Request Forgery Vulnerabilities ∗∗∗ --------------------------------------------- Multiple vulnerabilities in the Cisco Expressway Series could allow an unauthenticated, remote attacker to conduct cross-site request forgery (CSRF) attacks, which could allow the attacker to perform arbitrary actions on an affected device. CVE-2024-20255, CVE-2024-20254, CVE-2024-20252 --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ SolarWinds Platform 2024.1 Release Notes ∗∗∗ --------------------------------------------- SQL Injection Remote Code Execution Vulnerability was found using an update statement in the SolarWinds Platform. This vulnerability requires user authentication to be exploited and has not been reported outside of the initial report by the researcher. 8.0 High, CVE-2023-50395, CVE-2023-35188 --------------------------------------------- https://documentation.solarwinds.com/en/success_center/orionplatform/conten… ∗∗∗ VMware Aria: Sicherheitslücken erlauben etwa Rechteausweitung ∗∗∗ --------------------------------------------- Insgesamt fünf Sicherheitslücken dichtet VMware in Aria Operations for Networks – ehemals mit dem Namen vRealize im Umlauf – mit aktualisierter Software ab. Der Schweregrad reicht nach Einschätzung der Entwickler des Unternehmens bis zur Risikostufe "hoch". Bösartige Akteure können durch die Schwachstellen unbefugt ihre Rechte an verwundbaren Systemen erhöhen. --------------------------------------------- https://www.heise.de/-9621415 ∗∗∗ Rechtausweitung durch Lücken in Veeam Recovery Orchestrator möglich ∗∗∗ --------------------------------------------- Veeam flickt die Recovery Orchestrator-Software. Sicherheitslücken darin erlauben bösartigen Akteuren die Ausweitung von Rechten. --------------------------------------------- https://www.heise.de/-9621609 ∗∗∗ Sicherheitsupdates: Dell schließt ältere Lücken in Backuplösungen wie Avamar ∗∗∗ --------------------------------------------- Schwachstellen in Komponenten von Drittanbietern gefährden die Sicherheit von Dell-Backup-Software. Sicherheitsupdates sind verfügbar. --------------------------------------------- https://www.heise.de/9621283 ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Red Hat (gimp) and Ubuntu (firefox, linux-oracle, linux-oracle-5.15, and python-django). --------------------------------------------- https://lwn.net/Articles/961173/ ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ Google Chrome 121.0.6167.160/161 / 120.0.6099.283 mit Sicherheitsfixes ∗∗∗ --------------------------------------------- https://www.borncity.com/blog/2024/02/07/google-chrome-121-0-6167-160-161-1… ∗∗∗ [R1] Nessus Version 10.7.0 Fixes Multiple Vulnerabilities ∗∗∗ --------------------------------------------- https://www.tenable.com/security/tns-2024-01 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 06.02.2024
by Daily end-of-shift report 06 Feb '24

06 Feb '24

===================== = End-of-Day report = ===================== Timeframe: Montag 05-02-2024 18:00 − Dienstag 06-02-2024 18:00 Handler: Michael Schlagenhaufer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Rust Won’t Save Us: An Analysis of 2023’s Known Exploited Vulnerabilities ∗∗∗ --------------------------------------------- We have analyzed all critical vulnerabilities from the CISA KEV catalog starting from January 2023 through January 2024, categorized the vulnerability root causes, and attempted to analyze if the current efforts in the information security industry match with the current threat vectors being abused. --------------------------------------------- https://www.horizon3.ai/analysis-of-2023s-known-exploited-vulnerabilities/ ∗∗∗ Unseriöse Dirndl-Shops drohen mit Anzeige? Ignorieren Sie die Nachrichten! ∗∗∗ --------------------------------------------- Zahlreiche Betroffene wenden sich aktuell an die Watchlist Internet, weil unseriöse Bekleidungs- und Dirndl-Shops Monate nach den Bestellungen versuchen, Kund:innen einzuschüchtern und zu einer Zahlung zu drängen. Da völlig falsche Produkte geliefert wurden, besteht aber kein Grund zur Zahlung und somit auch kein Grund zur Sorge! --------------------------------------------- https://www.watchlist-internet.at/news/unserioese-dirndl-shops-drohen-mit-a… ∗∗∗ How are user credentials stolen and used by threat actors? ∗∗∗ --------------------------------------------- You’ve probably heard the phrase, “Attackers don’t hack anyone these days. They log on.” In this blog, we describe the various tools and techniques bad actors are using to steal credentials so they can log on with valid account details, and outline our recommendations for defense. --------------------------------------------- https://blog.talosintelligence.com/how-are-user-credentials-stolen-and-used… ∗∗∗ Navigating the Rising Tide of CI/CD Vulnerabilities: The Jenkins and TeamCity Case Studies ∗∗∗ --------------------------------------------- In the evolving landscape of cybersecurity, a new threat has emerged, targeting the core of software development processes. Recently, an alarming incident has brought to light a significant vulnerability in Jenkins CI/CD servers. Approximately 45,000 Jenkins servers have been left exposed to remote code execution (RCE) attacks, leveraging multiple exploit public POCs. This breach is not just a standalone event but a symptom of a growing trend of attacks on Continuous Integration/Continuous Deployment (CI/CD) software supply chains. --------------------------------------------- https://checkmarx.com/blog/navigating-the-rising-tide-of-ci-cd-vulnerabilit… ∗∗∗ Experts Detail New Flaws in Azure HDInsight Spark, Kafka, and Hadoop Services ∗∗∗ --------------------------------------------- Three new security vulnerabilities have been discovered in Azure HDInsights Apache Hadoop, Kafka, and Spark services that could be exploited to achieve privilege escalation and a regular expression denial-of-service (ReDoS) condition. [..] Following responsible disclosure, Microsoft has rolled out fixes as part of updates released on October 26, 2023. --------------------------------------------- https://thehackernews.com/2024/02/high-severity-flaws-found-in-azure.html ∗∗∗ Exploring the (Not So) Secret Code of Black Hunt Ransomware ∗∗∗ --------------------------------------------- In this analysis we examined the BlackHunt sample shared on X (formerly Twitter). During our analysis we found notable similarities between BlackHunt ransomware and LockBit, which suggested that it uses leaked code of Lockbit. In addition, it uses some techniques similar to REvil ransomware. --------------------------------------------- https://www.rapid7.com/blog/post/2024/02/05/exploring-the-not-so-secret-cod… ===================== = Vulnerabilities = ===================== ∗∗∗ Patchday Android: Kritische Schadcode-Lücke auf Systemebene geschlossen ∗∗∗ --------------------------------------------- Mehrere Sicherheitslücken gefährden Android-Geräte. Für bestimmte Smartphones und Tablets sind Updates erschienen. --------------------------------------------- https://www.heise.de/-9619910 ∗∗∗ Sicherheitsupdate: Mehrere Lücken gefährden Server-Monitoring-Tool Nagios XI ∗∗∗ --------------------------------------------- Unter bestimmten Bedingungen können Angreifer Schadcode auf Server mit Nagios XI laden. Ein Sicherheitsupdate schließt diese und weitere Schwachstellen. --------------------------------------------- https://www.heise.de/-9620155 ∗∗∗ Kritische Schwachstellen in Multifunktions- und Laserdruckern von Canon ∗∗∗ --------------------------------------------- Canon warnt vor kritischen Sicherheitslücken in einigen SOHO-Multifunktions- und Laserdruckern. Gegenmaßnahmen sollen helfen. --------------------------------------------- https://www.heise.de/-9620345 ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by CentOS (firefox, gstreamer1-plugins-bad-free, and tigervnc), Debian (ruby-sanitize), Fedora (kernel, kernel-headers, qt5-qtwebengine, and runc), Oracle (gnutls, kernel, libssh, rpm, runc, and tigervnc), Red Hat (runc), and SUSE (bouncycastle, jsch, python, and runc). --------------------------------------------- https://lwn.net/Articles/961083/ ∗∗∗ WebKitGTK and WPE WebKit Security Advisory WSA-2024-0001 ∗∗∗ --------------------------------------------- CVE identifiers: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213, CVE-2023-40414, CVE-2023-42833, CVE-2014-1745 --------------------------------------------- https://webkitgtk.org/security/WSA-2024-0001.html ∗∗∗ CISA Adds One Known Exploited Vulnerability to Catalog ∗∗∗ --------------------------------------------- Google Chromium V8 Type Confusion Vulnerability CVE-2023-4762 --------------------------------------------- https://www.cisa.gov/news-events/alerts/2024/02/06/cisa-adds-one-known-expl… ∗∗∗ MISP 2.4.184 released with performance improvements, security and bugs fixes. ∗∗∗ --------------------------------------------- A series of security fixes were done in this release, the vulnerabilities are accessible to authenticated users, especially those with specific privileges like Org admin. We urge users to update to this version especially if you have different organisations having access to your instances. --------------------------------------------- https://github.com/MISP/MISP/releases/tag/v2.4.184 ∗∗∗ ZDI-24-086: TP-Link Omada ER605 Access Control Command Injection Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-24-086/ ∗∗∗ ZDI-24-085: (Pwn2Own) TP-Link Omada ER605 DHCPv6 Client Options Stack-based Buffer Overflow Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-24-085/ ∗∗∗ ZDI-24-087: (Pwn2Own) Western Digital MyCloud PR4100 RESTSDK Server-Side Request Forgery Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-24-087/ ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ Pilz: Multiple products affected by uC/HTTP vulnerability ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2024-002/ ∗∗∗ HID Global Encoders ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-24-037-01 ∗∗∗ HID Global Reader Configuration Cards ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-24-037-02 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 05.02.2024
by Daily end-of-shift report 05 Feb '24

05 Feb '24

===================== = End-of-Day report = ===================== Timeframe: Freitag 02-02-2024 18:00 − Montag 05-02-2024 18:00 Handler: Michael Schlagenhaufer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Newest Ivanti SSRF zero-day now under mass exploitation ∗∗∗ --------------------------------------------- An Ivanti Connect Secure and Ivanti Policy Secure server-side request forgery (SSRF) vulnerability tracked as CVE-2024-21893 is currently under mass exploitation by multiple attackers. --------------------------------------------- https://www.bleepingcomputer.com/news/security/newest-ivanti-ssrf-zero-day-… ∗∗∗ Cyberangriff: Fernwartungssoftware-Anbieter Anydesk gehackt ∗∗∗ --------------------------------------------- Anydesk ist Opfer eines Cyberangriffs geworden. Die Folgen sind noch nicht klar, aber möglicherweise gravierend. --------------------------------------------- https://www.golem.de/news/cyberangriff-fernwartungssoftware-anbieter-anydes… ∗∗∗ Darknet: Anydesk-Zugangsdaten in Hackerforen aufgetaucht ∗∗∗ --------------------------------------------- Quelle der Daten ist nach aktuellen Erkenntnissen wohl nicht der jüngste Sicherheitsvorfall bei Anydesk. Ein Passwortwechsel wird dennoch empfohlen. --------------------------------------------- https://www.golem.de/news/darknet-anydesk-zugangsdaten-in-hackerforen-aufge… ∗∗∗ How to hack the Airbus NAVBLUE Flysmart+ Manager ∗∗∗ --------------------------------------------- Airbus Navblue Flysmart+ Manager allowed attackers to tamper with the engine performance calculations and intercept data. Flysmart+ is a suite of apps for pilot EFBs, helping deliver efficient and safe departure and arrival of flights. Researchers from Pen Test Partners discovered a vulnerability in Navblue Flysmart+ Manager that can be exploited [...] --------------------------------------------- https://securityaffairs.com/158661/hacking/airbus-flysmart-flaw.html ∗∗∗ Encrypted Attacks: Impact on Public Sector ∗∗∗ --------------------------------------------- Following FBI and CISA warnings to public sector defenders in November regarding increased targeting by infamous ransomware groups, the imperative to understand and defend against evolving - and increasingly covert - cyber threats has intensified. According to Zscaler ThreatLabz analysis of the 2023 threat landscape, 86% of threats hide within encrypted traffic. What does this mean for the public sector? --------------------------------------------- https://www.zscaler.com/blogs/security-research/encrypted-attacks-impact-pu… ∗∗∗ Hacking a Smart Home Device ∗∗∗ --------------------------------------------- How I reverse engineered an ESP32-based smart home device to gain remote control access and integrate it with Home Assistant. --------------------------------------------- https://jmswrnr.com/blog/hacking-a-smart-home-device ∗∗∗ Videokonferenz voller KI-Klone: Angestellter schickt Betrügern 24 Millionen Euro ∗∗∗ --------------------------------------------- Bislang werden im Rahmen der "Chef-Masche" Angestellte zumeist von einer Person überzeugt, Geld herauszugeben. Ein Fall in Hongkong hat nun eine neue Qualität. --------------------------------------------- https://www.heise.de/-9618064.html ∗∗∗ Hartkodiertes Passwort: Wärmepumpen von Alpha Innotec und Novelan angreifbar ∗∗∗ --------------------------------------------- Ein IT-Forscher hat in der Firmware von Alpha Innotec- und Novelan-Wärmepumpen das hartkodierte Root-Passwort gefunden. Updates bieten Abhilfe. --------------------------------------------- https://www.heise.de/-9618846.html ∗∗∗ Ivanti Zero Day – Threat Actors observed leveraging CVE-2021-42278 and CVE-2021-42287 for quick privilege escalation to Domain Admin ∗∗∗ --------------------------------------------- TL;dr NCC Group has observed what we believe to be the attempted exploitation of CVE-2021-42278 and CVE-2021-42287 as a means of privilege escalation, following the successful compromise of an Ivanti Secure Connect VPN using the following zero-day vulnerabilities reported by Volexity1 on 10/01/2024: [...] --------------------------------------------- https://research.nccgroup.com/2024/02/05/ivanti-zero-day-threat-actors-obse… ∗∗∗ Achtung: E-Card mit 500 Euro Guthaben für Apothekenkäufe ist Fake ∗∗∗ --------------------------------------------- Auf Facebook wird eine „E-Card-Gutscheinkarte“ beworben. Wenn Sie eine kurze Umfrage ausfüllen und 2 Euro überweisen, erhalten Sie angeblich 500 Euro für Apothekeneinkäufe. Achtung, dabei handelt es sich um Betrug. Ein solches Angebot gibt es nicht! --------------------------------------------- https://www.watchlist-internet.at/news/achtung-e-card-mit-500-euro-guthaben… ∗∗∗ Sicherheitsvorfall bei der AnyDesk Software GmbH ∗∗∗ --------------------------------------------- Der deutsche Softwarehersteller AnyDesk Software GmbH, Entwickler der Fernwartungssoftware AnyDesk, hat am Abend des 02.02.2024 im Rahmen einer Pressemeldung über einen erfolgreichen Angriff gegen seine Infrastruktur informiert. Laut dem Unternehmen wurde direkt nach Entdeckung des Vorfalles ein externer Sicherheitsdienstleister zur Behandlung des Vorfalls hinzugezogen und die zuständigen Behörden informiert. Weiters gibt das Unternehmen an, dass keinerlei private Schlüssel, [...] --------------------------------------------- https://cert.at/de/aktuelles/2024/2/sicherheitsvorfall-bei-der-anydesk-soft… ===================== = Vulnerabilities = ===================== ∗∗∗ Docker, Kubernetes und co.: Hacker können aus Containern auf Hostsysteme zugreifen ∗∗∗ --------------------------------------------- Die Schwachstellen dafür beziehen sich auf Buildkit und das CLI-Tool runc. Eine davon erreicht mit einem CVSS von 10 den maximal möglichen Schweregrad. --------------------------------------------- https://www.golem.de/news/docker-kubernetes-und-co-hacker-koennen-aus-conta… ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (rear, runc, sudo, and zbar), Fedora (chromium, grub2, libebml, mingw-python-pygments, and python-aiohttp), Gentoo (FreeType, GNAT Ada Suite, Microsoft Edge, NBD Tools, OpenSSL, QtGui, SDDM, Wireshark, and Xen), Mageia (dracut, glibc, nss and firefox, openssl, packages, perl, and thunderbird), Slackware (libxml2), SUSE (java-11-openjdk, java-17-openjdk, perl, python-uamqp, slurm, and xerces-c), and Ubuntu (libssh and openssl). --------------------------------------------- https://lwn.net/Articles/960952/ ∗∗∗ 2024-02-05: Cyber Security Advisory - B&R Automation Runtime FTP uses unsecure encryption mechanisms ∗∗∗ --------------------------------------------- https://www.br-automation.com/fileadmin/SA23P004_FTP_uses_unsecure_encrypti… ∗∗∗ Canon: CPE2024-001 – Regarding vulnerabilities for Small Office Multifunction Printers and Laser Printers – 05 February 2024 ∗∗∗ --------------------------------------------- https://www.canon-europe.com/support/product-security-latest-news/ ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ QNAP: Neue Firmware-Versionen beheben Befehlsschmuggel-Lücke ∗∗∗ --------------------------------------------- https://www.heise.de/-9617332.html ∗∗∗ IT-Sicherheitsüberwachung Juniper JSA für mehrere Attacken anfällig ∗∗∗ --------------------------------------------- https://www.heise.de/-9617677.html ∗∗∗ HCL schließt Sicherheitslücken in Bigfix, Devops Deploy und Launch ∗∗∗ --------------------------------------------- https://www.heise.de/-9618224.html -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 02.02.2024
by Daily end-of-shift report 02 Feb '24

02 Feb '24

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 01-02-2024 18:00 − Freitag 02-02-2024 18:00 Handler: Thomas Pribitzer Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Abschaltbefehl: US-Behörden müssen Ivanti-Geräte vom Netz nehmen ∗∗∗ --------------------------------------------- In einer Notfallanordnung trägt die US-Cybersicherheitsbehörde betroffenen Stellen auf, in den nächsten Stunden zu handeln. Ivanti-Geräte sollen vom Netz. --------------------------------------------- https://www.heise.de/news/Abschaltbefehl-US-Behoerden-muessen-Ivanti-Geraet… ∗∗∗ Bericht: Wie Angreifer in das Netzwerk von Cloudflare eingedrungen sind ∗∗∗ --------------------------------------------- Nach Abschluss der Untersuchungen eines IT-Sicherheitsvorfalls schildert der CDN-Betreiber Cloudflare, wie die Attacke abgelaufen ist. --------------------------------------------- https://www.heise.de/news/Bericht-Wie-Angreifer-in-das-Netzwerk-von-Cloudfl… ∗∗∗ VajraSpy: Ein Patchwork-Sammelsurium voller Spionage-Apps ∗∗∗ --------------------------------------------- ESET-Forscher entdeckten mehrere Android-Apps, die VajraSpy beinhalten, ein RAT, der von der Patchwork APT-Gruppe verwendet wird. --------------------------------------------- https://www.welivesecurity.com/fr/cybersecurite/vajraspy-ein-patchwork-samm… ∗∗∗ Scheinbar harmloser PDF-Viewer leert Bankkonten ahnungsloser Android-Nutzer:innen ∗∗∗ --------------------------------------------- Derzeit ist eine neue Welle von Schadsoftware im Umlauf, die bereits in der Vergangenheit zahlreiche Bankkonten leergeräumt hat. Es handelt sich dabei um den Banking-Trojaner Anatsa, der über die Installation von Apps wie PDF Viewer oder PDF Reader über den Google Play Store verbreitet wird. --------------------------------------------- https://www.watchlist-internet.at/news/scheinbar-harmloser-pdf-viewer-leert… ∗∗∗ Exploring the Latest Mispadu Stealer Variant ∗∗∗ --------------------------------------------- Evaluation of a new variant of Mispadu, a banking Trojan, highlights how infostealers evolve over time and can be hard to pin to past campaigns. --------------------------------------------- https://unit42.paloaltonetworks.com/mispadu-infostealer-variant/ ∗∗∗ How Memory Forensics Revealed Exploitation of Ivanti Connect Secure VPN Zero-Day Vulnerabilities ∗∗∗ --------------------------------------------- As outlined in the previous blog series, while Volexity leveraged network packet captures and disk images to reconstruct parts of the attack, it was ultimately a memory sample that allowed Volexity to confirm exploitation. --------------------------------------------- https://www.volexity.com/blog/2024/02/01/how-memory-forensics-revealed-expl… ∗∗∗ Threat Actors Installing Linux Backdoor Accounts ∗∗∗ --------------------------------------------- Threat actors install malware by launching brute force and dictionary attacks against Linux systems that are poorly managed, such as using default settings or having a simple password. --------------------------------------------- https://asec.ahnlab.com/en/61185/ ∗∗∗ How We Were Able to Infiltrate Attacker Telegram Bots ∗∗∗ --------------------------------------------- It is not uncommon for attackers to publish malicious packages that exfiltrate victims’ data to them using Telegram bots. However, what if we could eavesdrop on what the attacker sees? --------------------------------------------- https://checkmarx.com/blog/how-we-were-able-to-infiltrate-attacker-telegram… ∗∗∗ Jenkins Vulnerability Estimated to Affect 43% of Cloud Environments ∗∗∗ --------------------------------------------- >From our scans on the Orca Cloud Security Platform, we found that 43% of organizations operate at least one unmanaged Jenkins server in their environment. --------------------------------------------- https://orca.security/resources/blog/jenkins-arbitrary-file-read-vulnerabil… ===================== = Vulnerabilities = ===================== ∗∗∗ CISA-Warnung: Alte iPhone-Schwachstelle wird aktiv ausgenutzt ∗∗∗ --------------------------------------------- Eine von Apple gestopfte Kernel-Lücke wird der US-Sicherheitsbehörde zufolge für Angriffe aktiv genutzt. Für ältere iPhones scheint es keinen Patch zu geben. --------------------------------------------- https://www.heise.de/news/CISA-Warnung-Alte-iPhone-Schwachstelle-wird-aktiv… ∗∗∗ Sicherheitsupdate: IBM-Sicherheitslösung QRadar SIEM unter Linux angreifbar ∗∗∗ --------------------------------------------- Mehrere Komponenten eines Add ons von IBMs Security Information and Event Management-System QRadar sind verwundbar. --------------------------------------------- https://www.heise.de/news/Sicherheitsupdate-IBM-Sicherheitsloesung-QRadar-S… ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (chromium, man-db, and openjdk-17), Fedora (chromium, indent, jupyterlab, kernel, and python-notebook), Gentoo (glibc), Oracle (firefox, thunderbird, and tigervnc), Red Hat (rpm), SUSE (cpio, gdb, gstreamer, openconnect, slurm, slurm_18_08, slurm_20_02, slurm_20_11, slurm_22_05, slurm_23_02, squid, webkit2gtk3, and xerces-c), and Ubuntu (imagemagick and xorg-server, xwayland). --------------------------------------------- https://lwn.net/Articles/960604/ ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ QNAP Security Advisories ∗∗∗ --------------------------------------------- https://www.qnap.com/en-us/security-advisories/ ∗∗∗ Moby and Open Container Initiative Release Critical Updates for Multiple Vulnerabilities Affecting Docker-related Components ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/alerts/2024/02/01/moby-and-open-container-… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 01.02.2024
by Daily end-of-shift report 01 Feb '24

01 Feb '24

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 31-01-2024 18:00 − Donnerstag 01-02-2024 18:00 Handler: Michael Schlagenhaufer Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ Exploit released for Android local elevation flaw impacting 7 OEMs ∗∗∗ --------------------------------------------- A proof-of-concept (PoC) exploit for a local privilege elevation flaw impacting at least seven Android original equipment manufacturers (OEMs) is now publicly available on GitHub. However, as the exploit requires local access, its release will mostly be helpful to researchers. --------------------------------------------- https://www.bleepingcomputer.com/news/security/exploit-released-for-android… ∗∗∗ Hackers push USB malware payloads via news, media hosting sites ∗∗∗ --------------------------------------------- A financially motivated threat actor using USB devices for initial infection has been found abusing legitimate online platforms, including GitHub, Vimeo, and Ars Technica, to host encoded payloads embedded in seemingly benign content. --------------------------------------------- https://www.bleepingcomputer.com/news/security/hackers-push-usb-malware-pay… ∗∗∗ The Fun and Dangers of Top Level Domains (TLDs), (Wed, Jan 31st) ∗∗∗ --------------------------------------------- In the beginning, life was easy. We had a very limited set of top-level domains: .com, .edu, .gov, ..int, org, .mil, .net, .org, .edu. In addition, we had .arpa for infrastructure use and various two letter country level domains. [..] But yesterday, I noticed some news about a new interesting TLD that you may want to consider adopting: .internal. --------------------------------------------- https://isc.sans.edu/diary/rss/30608 ∗∗∗ FritzFrog Returns with Log4Shell and PwnKit, Spreading Malware Inside Your Network ∗∗∗ --------------------------------------------- The threat actor behind a peer-to-peer (P2P) botnet known as FritzFrog has made a return with a new variant that leverages the Log4Shell vulnerability to propagate internally within an already compromised network. --------------------------------------------- https://thehackernews.com/2024/02/fritzfrog-returns-with-log4shell-and.html ∗∗∗ Stealthy Persistence & PrivEsc in Entra ID by using the Federated Auth Secondary Token-signing Cert. ∗∗∗ --------------------------------------------- Microsoft Entra ID (formerly known as Azure AD) offers a feature called federation that allows you to delegate authentication to another Identity Provider (IdP), such as AD FS with on-prem Active Directory. When users log in, they will be redirected to the external IdP for authentication, before being redirected back to Entra ID who will then verify the successful authentication on the external IdP and the user’s identity. [..] The external IdP signs the token with a private key, which has an associated public key stored in a certificate. [..] In this post, I’ll show you where this certificate can be found and how attackers can add it (given the necessary privileges) and use it to forge malicious tokens. Finally, I will provide some recommendations for defense in light of this. --------------------------------------------- https://medium.com/tenable-techblog/stealthy-persistence-privesc-in-entra-i… ∗∗∗ OAS Engine Deep Dive: Abusing low-impact vulnerabilities to escalate privileges ∗∗∗ --------------------------------------------- Open Automation Software recently released patches for multiple vulnerabilities in their OAS Engine. Cisco Talos publicly disclosed these issues after working with Open Automation Software to ensure that patches were available for users. Now that a fix has been released with Version 19, we want to take the time to dive into a few of these vulnerabilities and show how a handful of bugs that could be viewed as low-impact could be exploited as a series to carry out various malicious actions, even going as far to gaining access to the underlying system. --------------------------------------------- https://blog.talosintelligence.com/oas-engine-deep-dive/ ===================== = Vulnerabilities = ===================== ∗∗∗ Mastodon: Diebstahl beliebiger Identitäten im föderierten Kurznachrichtendienst ∗∗∗ --------------------------------------------- Angreifer können jeden beliebigen Account übernehmen und fälschen. [..] Die Sicherheitslücke hat die CVE-ID CVE-2024-23832 erhalten und hat immerhin 9,4 von 10 CVSS-Punkten. Es handelt sich nach Einschätzung des Mastodon-Teams um eine leicht aus der Ferne ausnutzbare Lücke, die keinerlei Vorbedingungen mitbringt. Weder muss der Angreifer über besondere Privilegien verfügen, noch einen legitimen Nutzer austricksen, etwa mit einem gefälschten Link. Weitere Details verraten die Entwickler erst am 15. Februar. --------------------------------------------- https://www.heise.de/-9615961 ∗∗∗ Security Update for Ivanti Connect Secure and Ivanti Policy Secure Gateways ∗∗∗ --------------------------------------------- Update 1 February: A patch addressing all known vulnerabilities is now available for Ivanti Connect Secure version 22.5R2.2 and Ivanti Policy Secure 22.5R1.1. --------------------------------------------- https://www.ivanti.com/blog/security-update-for-ivanti-connect-secure-and-i… ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (debian-security-support, firefox-esr, openjdk-11, and python-asyncssh), Fedora (glibc, python-templated-dictionary, thunderbird, and xorg-x11-server-Xwayland), Gentoo (Chromium, Google Chrome, Microsoft Edge and WebKitGTK+), Red Hat (firefox, gnutls, libssh, thunderbird, and tigervnc), SUSE (mbedtls, rear116, rear1172a, runc, squid, and tinyssh), and Ubuntu (glibc and runc). --------------------------------------------- https://lwn.net/Articles/960436/ ∗∗∗ Gessler GmbH WEB-MASTER ∗∗∗ --------------------------------------------- Successful exploitation of these vulnerabilities could allow a user to take control of the web management of the device. An attacker with access to the device could also extract and break the password hashes for all users stored on the device. CVSS v3 9.8 --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-24-032-01 ∗∗∗ Entity Delete Log - Moderately critical - Access bypass - SA-CONTRIB-2024-007 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2024-007 ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ Lexmark Security Advisories ∗∗∗ --------------------------------------------- https://www.lexmark.com/en_us/solutions/security/lexmark-security-advisorie… ∗∗∗ Juniper: (Critical) 2024-01 Security Bulletin: JSA Series: Multiple vulnerabilities resolved in JSA Applications ∗∗∗ --------------------------------------------- https://supportportal.juniper.net/s/article/2024-01-Security-Bulletin-JSA-S… ∗∗∗ Juniper: (Medium) 2024-01 Security Bulletin: JSA Series: Multiple vulnerabilities resolved in 7.5.0 UP7 IF04 ∗∗∗ --------------------------------------------- https://supportportal.juniper.net/s/article/2024-01-Security-Bulletin-JSA-S… ∗∗∗ Wordfence Intelligence Weekly WordPress Vulnerability Report (January 22, 2024 to January 28, 2024) ∗∗∗ --------------------------------------------- https://www.wordfence.com/blog/2024/02/wordfence-intelligence-weekly-wordpr… ∗∗∗ AVEVA Edge products (formerly known as InduSoft Web Studio) ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-24-032-03 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 31.01.2024
by Daily end-of-shift report 31 Jan '24

31 Jan '24

===================== = End-of-Day report = ===================== Timeframe: Dienstag 30-01-2024 18:00 − Mittwoch 31-01-2024 18:00 Handler: Thomas Pribitzer Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Debian, Ubuntu und mehr: glibc-Schwachstelle ermöglicht Root-Zugriff unter Linux ∗∗∗ --------------------------------------------- Darüber hinaus wurden weitere Schwachstellen in der Gnu-C-Bibliothek aufgedeckt. Eine davon existiert wohl schon seit über 30 Jahren. --------------------------------------------- https://www.golem.de/news/debian-ubuntu-und-mehr-glibc-schwachstelle-ermoeg… ∗∗∗ Tracking 15 Years of Qakbot Development ∗∗∗ --------------------------------------------- Qakbot (aka QBot or Pinkslipbot) is a malware trojan that has been used to operate one of the oldest and longest running cybercriminal enterprises. Qakbot has evolved from a banking trojan to a malware implant that can be used for lateral movement and the eventual deployment of ransomware. In August 2023, the Qakbot infrastructure was dismantled by law enforcement. However, just several months later in December 2023, the fifth (and latest) version of Qakbot was released, [...] --------------------------------------------- https://www.zscaler.com/blogs/security-research/tracking-15-years-qakbot-de… ∗∗∗ Ransomware: Online-Tool entschlüsselt unter Umständen BlackCat & Co. ∗∗∗ --------------------------------------------- Stimmen die Voraussetzungen, können Ransomwareopfer auf einer Website Daten entschlüsseln, ohne Lösegeld zu zahlen. --------------------------------------------- https://www.heise.de/-9614278.html ∗∗∗ A zero-day vulnerability (and PoC) to blind defenses relying on Windows event logs ∗∗∗ --------------------------------------------- A zero-day vulnerability that, when triggered, could crash the Windows Event Log service on all supported (and some legacy) versions of Windows could spell trouble for enterprise defenders. Discovered by a security researcher named Florian and reported to Microsoft, the vulnerability is yet to be patched. In the meantime, the researcher has gotten the go-ahead from the company to publish a PoC exploit. --------------------------------------------- https://www.helpnetsecurity.com/2024/01/31/windows-event-log-vulnerability/ ∗∗∗ Cutting Edge: Suspected APT Targets Ivanti Connect Secure VPN in New Zero-Day Exploitation ∗∗∗ --------------------------------------------- Update (Jan. 31): We released a follow-up blog post containing additional details from our investigations into this threat, along with more recommendations for defenders. Note: This is a developing campaign under active analysis by Mandiant and Ivanti. We will continue to add more indicators, detections, and information to this blog post as needed. --------------------------------------------- https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-d… ∗∗∗ CISA and FBI Release Secure by Design Alert Urging Manufacturers to Eliminate Defects in SOHO Routers ∗∗∗ --------------------------------------------- Today, CISA and the Federal Bureau of Investigation (FBI) published guidance on Security Design Improvements for SOHO Device Manufacturers as a part of the new Secure by Design (SbD) Alert series that focuses on how manufacturers should shift the burden of security away from customers by integrating security into product design and development. --------------------------------------------- https://www.cisa.gov/news-events/alerts/2024/01/31/cisa-and-fbi-release-sec… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (bind9 and glibc), Fedora (ncurses), Gentoo (containerd, libaom, and xorg-server, xwayland), Mageia (python-pillow and zlib), Oracle (grub2 and tomcat), Red Hat (avahi, c-ares, container-tools:3.0, curl, firefox, frr, kernel, kernel-rt, kpatch-patch, libfastjson, libmicrohttpd, linux-firmware, oniguruma, openssh, perl-HTTP-Tiny, python-pip, python-urllib3, python3, rpm, samba, sqlite, tcpdump, thunderbird, tigervnc, and virt:rhel and virt-devel:rhel modules), SUSE (python-Pillow, slurm, slurm_20_02, slurm_20_11, slurm_22_05, slurm_23_02, and xen), and Ubuntu (libde265, linux-nvidia, mysql-8.0, openldap, pillow, postfix, and xorg-server, xwayland). --------------------------------------------- https://lwn.net/Articles/960248/ ∗∗∗ Mattermost security updates 9.4.2 / 9.3.1 / 9.2.5 / 8.1.9 (ESR) released ∗∗∗ --------------------------------------------- We’re informing you about a Mattermost security update, which addresses low- to medium-level severity vulnerabilities. We highly recommend that you apply the update. --------------------------------------------- https://mattermost.com/blog/mattermost-security-updates-9-4-2-9-3-1-9-2-5-8… ∗∗∗ CISA ICS Advisories ∗∗∗ --------------------------------------------- - Hitron Systems Security Camera DVR - Rockwell Automation ControlLogix and GuardLogix - Rockwell Automation FactoryTalk Service Platform - Rockwell Automation LP30/40/50 and BM40 Operator Interface --------------------------------------------- https://www.cisa.gov/news-events/cybersecurity-advisories?f%5B0%5D=advisory… ∗∗∗ CISA Adds One Known Exploited Vulnerability to Catalog ∗∗∗ --------------------------------------------- CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2022-48618 Apple Multiple Products Improper Authentication Vulnerability --------------------------------------------- https://www.cisa.gov/news-events/alerts/2024/01/31/cisa-adds-one-known-expl… ∗∗∗ Security Advisory Report - OBSO-2401-03 ∗∗∗ --------------------------------------------- A Command injection vulnerability has been identified in the MyPortal@Work application of Atos OpenScape Business which, if successfully exploited, could allow a malicious actor to execute arbitrary scripts on a client machine. The severity is rated high. Customers are advised to update the systems with the available fix release. --------------------------------------------- https://networks.unify.com/security/advisories/OBSO-2401-03.pdf ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ Google Chrome: Update schließt vier Sicherheitslücken ∗∗∗ --------------------------------------------- https://www.heise.de/-9613823.html ∗∗∗ SVD-2024-0112: Third-Party Package Updates in Splunk Add-on Builder - January 2024 ∗∗∗ --------------------------------------------- https://advisory.splunk.com//advisories/SVD-2024-0112 ∗∗∗ SVD-2024-0111: Sensitive Information Disclosure to Internal Log Files in Splunk Add-on Builder ∗∗∗ --------------------------------------------- https://advisory.splunk.com//advisories/SVD-2024-0111 ∗∗∗ SVD-2024-0110: Session Token Disclosure to Internal Log Files in Splunk Add-on Builder ∗∗∗ --------------------------------------------- https://advisory.splunk.com//advisories/SVD-2024-0110 ∗∗∗ The WordPress 6.4.3 Security Update – What You Need to Know ∗∗∗ --------------------------------------------- https://www.wordfence.com/blog/2024/01/the-wordpress-6-4-3-security-update-… ∗∗∗ Tor Code Audit Finds 17 Vulnerabilities ∗∗∗ --------------------------------------------- https://www.securityweek.com/tor-code-audit-finds-17-vulnerabilities/ ∗∗∗ Update #5: Kritische Sicherheitslücken in Ivanti Connect Secure und Ivanti Policy Secure - aktiv ausgenützt - Patches verfügbar ∗∗∗ --------------------------------------------- https://cert.at/de/warnungen/2024/1/kritische-sicherheitslucken-in-ivanti-c… ∗∗∗ List of Security Fixes and Improvements in Veeam Backup for Nutanix AHV ∗∗∗ --------------------------------------------- https://www.veeam.com/kb4236 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 30.01.2024
by Daily end-of-shift report 30 Jan '24

30 Jan '24

===================== = End-of-Day report = ===================== Timeframe: Montag 29-01-2024 18:00 − Dienstag 30-01-2024 18:00 Handler: Thomas Pribitzer Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Ransomwareattacke: Hacker greifen interne Daten von Schneider Electric ab ∗∗∗ --------------------------------------------- Angeblich steckt die Ransomwaregruppe Cactus hinter dem Angriff. Sie hat offenbar mehrere TByte an Daten exfiltriert und fordert ein Lösegeld. --------------------------------------------- https://www.golem.de/news/ransomwareattacke-hacker-greifen-interne-daten-vo… ∗∗∗ What did I say to make you stop talking to me?, (Tue, Jan 30th) ∗∗∗ --------------------------------------------- We use Cowrie to emulate an SSH and Telnet server for our honeypots. Cowrie is great software maintained by Michel Oosterhof. --------------------------------------------- https://isc.sans.edu/diary/rss/30604 ∗∗∗ New ZLoader Malware Variant Surfaces with 64-bit Windows Compatibility ∗∗∗ --------------------------------------------- Threat hunters have identified a new campaign that delivers the ZLoader malware, resurfacing nearly two years after the botnets infrastructure was dismantled in April 2022. --------------------------------------------- https://thehackernews.com/2024/01/new-zloader-malware-variant-surfaces.html ∗∗∗ Is Your SAP Cloud Connector Safe? The Risk You Can’t Ignore ∗∗∗ --------------------------------------------- In this article, we will discuss security issues and provide recommendations to mitigate the risks associated with using SAP CC on the Windows platform. --------------------------------------------- https://redrays.io/blog/sap-cloud-connector-security/ ∗∗∗ Ransomware-Bericht: Immer weniger Opfer zahlen Lösegeld ∗∗∗ --------------------------------------------- Sicherheitsforscher zeigen aktuelle Trends bei Verschlüsselungstrojanern auf. Unter anderem schrumpfen die Summen von Lösegeldern. --------------------------------------------- https://www.heise.de/news/Ransomware-Bericht-Immer-weniger-Opfer-zahlen-Loe… ∗∗∗ Lieber nicht: Abnehm-Pillen von Keto Base ∗∗∗ --------------------------------------------- In einem gefälschten Online-Artikel werden Abnehm-Pillen von Keto Base beworben. Angeblich wurde dieses „Wundermittel“ zum schnellen Abnehmen in der TV-Show „Höhle des Löwen“ vorgestellt und finanziert. Dabei handelt es sich aber um Fake News. Dieses Angebot ist unseriös und schädigt im schlimmsten Fall Ihrer Gesundheit. --------------------------------------------- https://www.watchlist-internet.at/news/lieber-nicht-abnehm-pillen-von-keto-… ∗∗∗ Trigona Ransomware Threat Actor Uses Mimic Ransomware ∗∗∗ --------------------------------------------- AhnLab SEcurity intelligence Center (ASEC) has recently identified a new activity of the Trigona ransomware threat actor installing Mimic ransomware. --------------------------------------------- https://asec.ahnlab.com/en/61000/ ∗∗∗ DarkGate malware delivered via Microsoft Teams - detection and response ∗∗∗ --------------------------------------------- While most end users are well-acquainted with the dangers of traditional phishing attacks, such as those delivered via email or other media, a large proportion are likely unaware that Microsoft Teams chats could be a phishing vector. --------------------------------------------- https://cybersecurity.att.com/blogs/security-essentials/darkgate-malware-de… ===================== = Vulnerabilities = ===================== ∗∗∗ DLL Proxying: Trend Micro liefert Updates, weitere Hersteller angreifbar ∗∗∗ --------------------------------------------- Bei Antivirenprogrammen mehrerer Hersteller haben IT-Forscher DLL-Proxying-Schwachstellen gefunden. Trend Micro hat schon Updates. --------------------------------------------- https://www.heise.de/news/DLL-Proxying-Trend-Micro-liefert-Updates-weitere-… ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (pillow, postfix, and redis), Fedora (python-templated-dictionary and selinux-policy), Red Hat (gnutls, kpatch-patch, libssh, and tomcat), and Ubuntu (amanda, ceph, linux-azure, linux-azure-4.15, linux-kvm, and tinyxml). --------------------------------------------- https://lwn.net/Articles/960008/ ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ XSA-450 ∗∗∗ --------------------------------------------- https://xenbits.xen.org/xsa/advisory-450.html ∗∗∗ XSA-449 ∗∗∗ --------------------------------------------- https://xenbits.xen.org/xsa/advisory-449.html ∗∗∗ Festo: Multiple products contain CoDe16 vulnerability ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2023-063/ ∗∗∗ Pilz: Vulnerabiiity in PASvisu and PMI v8xx ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2023-050/ ∗∗∗ Emerson Rosemount GC370XA, GC700XA, GC1500XA ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-24-030-01 ∗∗∗ Mitsubishi Electric FA Engineering Software Products ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-24-030-02 ∗∗∗ Mitsubishi Electric MELSEC WS Series Ethernet Interface Module ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-24-030-03 ∗∗∗ Zyxel security advisory for post-authentication command injection vulnerability in NAS products ∗∗∗ --------------------------------------------- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 29.01.2024
by Daily end-of-shift report 29 Jan '24

29 Jan '24

===================== = End-of-Day report = ===================== Timeframe: Freitag 26-01-2024 18:00 − Montag 29-01-2024 18:00 Handler: Thomas Pribitzer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Token-Leak: Quellcode von Mercedes-Benz lag wohl frei zugänglich im Netz ∗∗∗ --------------------------------------------- Ein Authentifizierungstoken von Mercedes-Benz lag wohl für mehrere Monate in einem öffentlichen Github-Repository - mit weitreichenden Zugriffsrechten. --------------------------------------------- https://www.golem.de/news/token-leak-quellcode-von-mercedes-benz-lag-wohl-f… ∗∗∗ Exploit Flare Up Against Older Altassian Confluence Vulnerability, (Mon, Jan 29th) ∗∗∗ --------------------------------------------- Last October, Atlassian released a patch for CVE-2023-22515 [1]. This vulnerability allowed attackers to create new admin users in Confluence. Today, I noticed a bit a "flare up" in a specific exploit variant. --------------------------------------------- https://isc.sans.edu/diary/rss/30600 ∗∗∗ Trusted Domain, Hidden Danger: Deceptive URL Redirections in Email Phishing Attacks ∗∗∗ --------------------------------------------- In this ever-evolving landscape of cyberthreats, email has become a prime target for phishing attacks. Cybercriminals continue to adapt and employ more sophisticated methods to effectively deceive users and bypass detection measures. One of the most prevalent tactics nowadays involves exploiting legitimate platforms for redirection through deceptive links. In this blog post, well explore how trusted platforms are increasingly being exploited as redirectors, [...] --------------------------------------------- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trusted-dom… ∗∗∗ Albabat, Kasseika, Kuiper: New Ransomware Gangs Rise with Rust and Golang ∗∗∗ --------------------------------------------- Cybersecurity researchers have detected in the wild yet another variant of the Phobos ransomware family known as Faust. Fortinet FortiGuard Labs, which detailed the latest iteration of the ransomware, said its being propagated by means of an infection that delivers a Microsoft Excel document (.XLAM) containing a VBA script. --------------------------------------------- https://thehackernews.com/2024/01/albabat-kasseika-kuiper-new-ransomware.ht… ∗∗∗ Jetzt updaten! Exploits für kritische Jenkins-Sicherheitslücke im Umlauf ∗∗∗ --------------------------------------------- Für die in der vergangenen Woche bekanntgewordene kritische Sicherheitslücke in Jenkins ist Exploit-Code aufgetaucht. Höchste Zeit zum Aktualisieren! --------------------------------------------- https://www.heise.de/-9611923.html ∗∗∗ Erpressung in Südwestfalen: Akira kam mit geratenem Passwort ins kommunale Netz ∗∗∗ --------------------------------------------- Ein nun vorliegender forensischer Bericht stellt dem kommunalen IT-Verbund ein mittelprächtiges Zeugnis aus. Die Krisenbewältigung läuft weiter. --------------------------------------------- https://www.heise.de/-9610102.html ∗∗∗ 10 things to do to improve your online privacy ∗∗∗ --------------------------------------------- Its Data Privacy Week so here are 10 tips from our VP of Consumer Privacy, Oren Arar, about how to stay private online. --------------------------------------------- https://www.malwarebytes.com/blog/personal/2024/01/10-things-to-do-to-impro… ∗∗∗ So werden Sie bei der Wohnungssuche abgezockt ∗∗∗ --------------------------------------------- Zentrale Lage, frisch renoviert, hochwertige Möbel - und das vergleichsweise günstig. Wer auf Wohnungssuche ist, stößt früher oder später auf ein solches Angebot und ist überwältigt. Leider handelt es sich hierbei sehr wahrscheinlich um ein betrügerisches Inserat. Kriminelle versuchen Ihnen mit einmaligen Angeboten, Vorauszahlungen zu entlocken. Wir zeigen Ihnen, wie Sie bei der Wohnungssuche nicht betrogen werden. --------------------------------------------- https://www.watchlist-internet.at/news/so-werden-sie-bei-der-wohnungssuche-… ∗∗∗ Akira Ransomware and exploitation of Cisco Anyconnect vulnerability CVE-2020-3259 ∗∗∗ --------------------------------------------- In several recent incident response missions, the Truesec CSIRT team made forensic observations indicating that the old vulnerability CVE-2020-3259 is likely to be actively exploited --------------------------------------------- https://www.truesec.com/hub/blog/akira-ransomware-and-exploitation-of-cisco… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by CentOS (gstreamer-plugins-bad-free, java-1.8.0-openjdk, java-11-openjdk, kernel, LibRaw, python-pillow, and xorg-x11-server), Debian (gst-plugins-bad1.0, libspreadsheet-parsexlsx-perl, mariadb-10.3, and slurm-wlm), Fedora (atril, dotnet8.0, gnutls, prometheus-podman-exporter, python-jinja2, sudo, and vips), Oracle (frr, kernel, php:8.1, python-urllib3, python3.9, rpm, sqlite, and tomcat), Slackware (pam), SUSE (cpio, rear23a, rear27a, sevctl, and xorg-x11-server), and Ubuntu (exim4 and firefox). --------------------------------------------- https://lwn.net/Articles/959882/ ∗∗∗ Vulnerabilities in WatchGuard, Panda Security Products Lead to Code Execution ∗∗∗ --------------------------------------------- Two memory safety vulnerabilities in WatchGuard and Panda Security products could lead to code execution with System privileges. --------------------------------------------- https://www.securityweek.com/vulnerabilities-in-watchguard-panda-security-p… ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ Trumpf: Multiple products contain WIBU CodeMeter vulnerabilities ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2024-001/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 26.01.2024
by Daily end-of-shift report 26 Jan '24

26 Jan '24

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 25-01-2024 18:00 − Freitag 26-01-2024 18:00 Handler: Thomas Pribitzer Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Über Push-Benachrichtigungen: Prominente iOS-Apps spähen heimlich Gerätedaten aus ∗∗∗ --------------------------------------------- Zu den Datensammlern zählen wohl iOS-Apps namhafter Onlinedienste wie Tiktok, Facebook, Instagram, Threads, Linkedin, Bing und X. --------------------------------------------- https://www.golem.de/news/ueber-push-benachrichtigungen-prominente-ios-apps… ∗∗∗ MFA war inaktiv: Microsoft deckt auf, wie Hacker an interne Mails kamen ∗∗∗ --------------------------------------------- Die Angreifer haben laut Microsoft zuerst einen Testaccount mit inaktiver MFA infiltriert - unter Einsatz einer Proxy-Infrastruktur. --------------------------------------------- https://www.golem.de/news/mfa-war-inaktiv-microsoft-deckt-auf-wie-hacker-an… ∗∗∗ Präparierte URL kann für Juniper-Firewalls und Switches gefährlich werden ∗∗∗ --------------------------------------------- Entwickler von Juniper haben in Junos OS mehrere Sicherheitslücken geschlossen. Noch sind aber nicht alle Updates verfügbar. --------------------------------------------- https://www.heise.de/-9609333.html ∗∗∗ Verwirrend: Internet-Domain fritz.box zeigt NFT-Galerie statt Router-Verwaltung ∗∗∗ --------------------------------------------- Bereits vor einer Woche haben Unbekannte die Domain "fritz.box" für sich registriert. Ihr Vorhaben ist unklar, Fritz-Besitzer sollten sich vorsehen. --------------------------------------------- https://www.heise.de/-9610149.html ∗∗∗ Blackwood hackers hijack WPS Office update to install malware ∗∗∗ --------------------------------------------- A previously unknown advanced threat actor tracked as Blackwood is using sophisticated malware called NSPX30 in cyberespionage attacks against companies and individuals. --------------------------------------------- https://www.bleepingcomputer.com/news/security/blackwood-hackers-hijack-wps… ∗∗∗ Midnight Blizzard: Guidance for responders on nation-state attack ∗∗∗ --------------------------------------------- The Microsoft security team detected a nation-state attack on our corporate systems on January 12, 2024, and immediately activated our response process to investigate, disrupt malicious activity, mitigate the attack, and deny the threat actor further access. --------------------------------------------- https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-… ∗∗∗ A Batch File With Multiple Payloads, (Fri, Jan 26th) ∗∗∗ --------------------------------------------- Windows batch files (.bat) are often seen by people as very simple but they can be pretty complex or.. contain interesting encoded payloads! I found one that contains multiple payloads decoded and used by a Powershell process. The magic is behind how comments can be added to such files. --------------------------------------------- https://isc.sans.edu/diary/rss/30592 ∗∗∗ Erbschaft per SMS: Ignorieren Sie diese betrügerische Nachricht ∗∗∗ --------------------------------------------- Immer wieder warnen wir vor E-Mails, in denen Betrüger:innen das große Geld versprechen: Millionengewinne, eine Spende oder eine Erbschaft sollen die Empfänger:innen plötzlich reich machen. Aktuell setzen Kriminelle jedoch nicht nur auf E-Mails, sondern auch auf SMS, um mit potenziellen Opfern in Kontakt zu treten. Danach läuft die Masche wie gewohnt ab: Mit Angeboten, die zu schön sind, um wahr zu sein, werden gutgläubige Opfer um ihr Geld gebracht. --------------------------------------------- https://www.watchlist-internet.at/news/erbschaft-per-sms-ignorieren-sie-die… ∗∗∗ Assessing and mitigating supply chain cybersecurity risks ∗∗∗ --------------------------------------------- Blindly trusting your partners and suppliers on their security posture is not sustainable – it’s time to take control through effective supplier risk management --------------------------------------------- https://www.welivesecurity.com/en/business-security/assessing-mitigating-cy… ∗∗∗ Cybersecurity for Industrial Control Systems: Best practices ∗∗∗ --------------------------------------------- Network segmentation, software patching, and continual threats monitoring are key cybersecurity best practices for Industrial Control Systems (ICS). --------------------------------------------- https://cybersecurity.att.com/blogs/security-essentials/cybersecurity-for-i… ∗∗∗ Guidance: Assembling a Group of Products for SBOM ∗∗∗ --------------------------------------------- Today, CISA published Guidance on Assembling a Group of Products created by the Software Bill of Materials (SBOM) Tooling & Implementation Working Group, one of the five SBOM community-driven workstreams facilitated by CISA. CISA’s community-driven working groups publish documents and reports to advance and refine SBOM and ultimately promote adoption. Specifically, software producers often need to assemble and test products together before releasing them to customers. --------------------------------------------- https://www.cisa.gov/news-events/alerts/2024/01/26/guidance-assembling-grou… ===================== = Vulnerabilities = ===================== ∗∗∗ Cisco Unified Communications Products Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- Version 1.1 - Updated list of affected products and products confirmed not vulnerable. --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Jenkins CLI PoC CVE-2024-23897 ∗∗∗ --------------------------------------------- Remote Code Execution: Jenkins CLI arbitrary read (CVE-2024-23897 applies to versions below 2.442 and LTS 2.426.3) --------------------------------------------- https://github.com/gquere/pwn_jenkins/blob/master/README.md#jenkins-cli-arb… ∗∗∗ Microsoft Edge 121 unterstützt moderne Codecs und stopft Sicherheitslecks ∗∗∗ --------------------------------------------- Microsoft hat den Webbrowser Edge in Version 121 herausgegeben. Sie stopft eine kritische Sicherheitslücke und liefert Support für AV1-Videos. --------------------------------------------- https://www.heise.de/-9609475.html ∗∗∗ Diesmal bitte patchen: Security-Update behebt kritische Schwachstelle in GitLab ∗∗∗ --------------------------------------------- GitLab 16.x enthält fünf Schwachstellen, von denen eine als kritisch eingestuft ist. Patchen ist nicht selbstverständlich, wie jüngst eine Untersuchung zeigte. --------------------------------------------- https://www.heise.de/-9609319.html ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (xorg-server), Fedora (chromium, dotnet8.0, firefox, freeipa, and thunderbird), Red Hat (avahi, c-ares, curl, edk2, expat, freetype, frr, git, gnutls, grub2, kernel, kernel-rt, libcap, libfastjson, libssh, libtasn1, libxml2, linux-firmware, ncurses, oniguruma, openssh, openssl, perl-HTTP-Tiny, protobuf-c, python-urllib3, python3, python3.9, rpm, samba, shadow-utils, sqlite, tcpdump, tomcat, and virt:rhel and virt-devel:rhel modules), SUSE (cpio, jasper, rear23a, thunderbird, and xorg-x11-server), and Ubuntu (jinja2, kernel, linux, linux-aws, linux-aws-5.15, linux-gcp, linux-gcp-5.15, linux-gke, linux-gkeop, linux-gkeop-5.15, linux-hwe-5.15, linux-ibm, linux-ibm-5.15, linux-kvm, linux-lowlatency-hwe-5.15, linux-raspi, linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-bluefield, linux-gcp, linux-gcp-5.4, linux-gkeop, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-iot, linux-oracle, linux-oracle-5.4, linux-raspi, linux-raspi-5.4, linux-xilinx-zynqmp, linux, linux-aws, linux-aws-6.2, linux-azure, linux-azure-6.2, linux-azure-fde-6.2, linux-gcp, linux-hwe-6.5, linux-laptop, linux-lowlatency, linux-lowlatency-hwe-6.5, linux-oem-6.5, linux-oracle, linux-raspi, linux-starfive, linux, linux-aws, linux-aws-hwe, linux-gcp, linux-gcp-4.15, linux-hwe, linux-kvm, linux-oracle, linux, linux-aws, linux-kvm, linux-lts-xenial, linux-aws, linux-azure, linux-azure-5.15, linux-azure-fde, linux-azure-fde-5.15, linux-oem-6.1, and mariadb, mariadb-10.3, mariadb-10.6). --------------------------------------------- https://lwn.net/Articles/959640/ ∗∗∗ 2024-01 Reference Advisory: Junos OS and Junos OS Evolved: Impact of Terrapin SSH Attack (CVE-2023-48795) ∗∗∗ --------------------------------------------- https://supportportal.juniper.net/s/article/2024-01-Reference-Advisory-Juno… ∗∗∗ 2024-01 Out-of-Cycle Security Bulletin: Junos OS: SRX Series and EX Series: Multiple vulnerabilities in J-Web have been addressed ∗∗∗ --------------------------------------------- https://supportportal.juniper.net/s/article/2024-01-Out-of-Cycle-Security-B… ∗∗∗ Security Vulnerabilities fixed in Focus for iOS 122 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2024-03/ ∗∗∗ Open redirect in parameter might affect IBM Storage Defender Data Protect. ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7106918 ∗∗∗ AIX is vulnerable to a denial of service (CVE-2023-5678, CVE-2023-6129, CVE-2023-6237) and an attacker may obtain sensitive information (CVE-2023-5363) due to OpenSSL ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7111837 ∗∗∗ IBM Sterling Connect:Direct for UNIX is vulnerable to multiple issues due to Eclipse Jetty. ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7111880 ∗∗∗ Vulnerabilities in GNU Binutils, Bootstrap, PortSmash, Node.js, and libarchive might affect IBM Storage Defender Data Protect. ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7091980 ∗∗∗ Multiple vulnerabilities in IBM Semeru Runtime may affect IBM Decision Optimization for IBM Cloud Pak for Data (CVE-2023-22006, CVE-2023-22036 & CVE-2023-22049) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7112089 ∗∗∗ IBM Security Directory Integrator affected by multiple vulnerabilities affecting IBM Java SDK ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7047118 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 25.01.2024
by Daily end-of-shift report 25 Jan '24

25 Jan '24

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 24-01-2024 18:00 − Donnerstag 25-01-2024 18:00 Handler: Michael Schlagenhaufer Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ New CherryLoader Malware Mimics CherryTree to Deploy PrivEsc Exploits ∗∗∗ --------------------------------------------- A new Go-based malware loader called CherryLoader has been discovered by threat hunters in the wild to deliver additional payloads onto compromised hosts for follow-on exploitation. --------------------------------------------- https://thehackernews.com/2024/01/new-cherryloader-malware-mimics.html ∗∗∗ SystemBC Malwares C2 Server Analysis Exposes Payload Delivery Tricks ∗∗∗ --------------------------------------------- Cybersecurity researchers have shed light on the command-and-control (C2) server of a known malware family called SystemBC. --------------------------------------------- https://thehackernews.com/2024/01/systembc-malwares-c2-server-analysis.html ∗∗∗ Memory Scanning for the Masses ∗∗∗ --------------------------------------------- In this blog post we will go into a user-friendly memory scanning Python library that was created out of the necessity of having more control during memory scanning. --------------------------------------------- https://research.nccgroup.com/2024/01/25/memory-scanning-for-the-masses/ ∗∗∗ ADCS Attack Paths in BloodHound — Part 1 ∗∗∗ --------------------------------------------- This blog post details the ESC1 domain escalation requirements and explains how BloodHound incorporates the relevant components. --------------------------------------------- https://posts.specterops.io/adcs-attack-paths-in-bloodhound-part-1-799f3d3b… ∗∗∗ CERT.at/GovCERT Austria PGP Teamkey Rotation ∗∗∗ --------------------------------------------- Da diese in einem Monat ablaufen, haben wir gestern neue PGP Keys für team(a)cert.at, reports(a)cert.at, team(a)govcert.gv.at sowie reports(a)govcert.gv.at generiert und ausgerollt. --------------------------------------------- https://cert.at/de/aktuelles/2024/1/certatgovcert-austria-pgp-teamkey-rotat… ∗∗∗ Ablauf einer Schwachstellen-Information durch CERT.at am Beispiel Ivanti Connect Secure VPN (CVE-2024-21887, CVE-2023-46805) ∗∗∗ --------------------------------------------- Nach der Veröffentlichung begann nun der normale Prozess für CERTs weltweit, ebenso natürlich für CERT.at ... die Verbreitung der Information über die Schwachstellen vorzubreiten beziehungsweise zu finalisieren. Die CERTs veröffentlichten und sendeten ihre Warnung aus. Unsere Warnung, die laufend aktualisiert wird, wurde Donnerstag 11.01.24 gegen Mittag ins Netz gestellt, über den freien RSS-Feed für Abonnenten zugänglich gemacht und ausgesandt. --------------------------------------------- https://cert.at/de/blog/2024/1/ablauf-einer-schwachstellen-information-durc… ===================== = Vulnerabilities = ===================== ∗∗∗ Konfigurationsfehler: Unzählige Kubernetes-Cluster sind potenziell angreifbar ∗∗∗ --------------------------------------------- Viele Nutzer räumen der Gruppe system:authenticated ihres GKE-Clusters aufgrund einer Fehlannahme zu viele Rechte ein - mit gravierenden Folgen. --------------------------------------------- https://www.golem.de/news/konfigurationsfehler-unzaehlige-kubernetes-cluste… ∗∗∗ Trend Micro Apex Central: Update schließt im zweiten Anlauf Sicherheitslücken ∗∗∗ --------------------------------------------- Mehrere Sicherheitslücken in Trend Micros Apex Central ermöglichen Angreifern etwa, Schadcode einzuschleusen. Ein erstes Update machte Probleme. --------------------------------------------- https://www.heise.de/news/Trend-Micro-Apex-Central-Update-schliesst-im-zwei… ∗∗∗ Tausende Gitlab-Server noch für Zero-Click-Kontoklau anfällig ∗∗∗ --------------------------------------------- IT-Forscher haben das Netz durchforstet und dabei mehr als 5000 verwundbare Gitlab-Server gefunden. Angreifer können dort einfach Konten übernehmen. --------------------------------------------- https://www.heise.de/news/Tausende-Gitlab-Server-noch-fuer-Zero-Click-Konto… ∗∗∗ Cisco: Lücke erlaubt komplette Übernahme von Unified Communication-Produkten ∗∗∗ --------------------------------------------- Cisco warnt vor einer kritischen Lücke in Unified Communication-Produkten, durch die Angreifer die Kontrolle übernehmen können. --------------------------------------------- https://www.heise.de/news/Cisco-Luecke-erlauben-komplette-Uebernahme-von-Un… ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (chromium, firefox-esr, php-phpseclib, phpseclib, thunderbird, and zabbix), Fedora (dotnet7.0, firefox, fonttools, and python-jinja2), Mageia (avahi and chromium-browser-stable), Oracle (java-1.8.0-openjdk, java-11-openjdk, LibRaw, openssl, and python-pillow), Red Hat (gnutls, kpatch-patch, php:8.1, and squid:4), SUSE (apache-parent, apache-sshd, bluez, cacti, cacti-spine, erlang, firefox, java-11-openjdk, opera, python-Pillow, tomcat, tomcat10, [...] --------------------------------------------- https://lwn.net/Articles/959455/ ∗∗∗ Potentielle Remote Code Execution in Jenkins - Patch verfügbar ∗∗∗ --------------------------------------------- Mit der neuesten Version der CI/CD-Plattform Jenkins haben die Entwickler:innen neun Sicherheitslücken behoben - darunter befindet sich auch eine kritische Schwachstelle, CVE-2024-23987. --------------------------------------------- https://cert.at/de/aktuelles/2024/1/potentielle-remote-code-execution-in-je… ∗∗∗ Swift Mailer - Moderately critical - Access bypass - SA-CONTRIB-2024-006 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2024-006 ∗∗∗ Open Social - Moderately critical - Information Disclosure - SA-CONTRIB-2024-005 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2024-005 ∗∗∗ Open Social - Moderately critical - Access bypass - SA-CONTRIB-2024-004 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2024-004 ∗∗∗ Two-factor Authentication (TFA) - Moderately critical - Access bypass - SA-CONTRIB-2024-003 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2024-003 ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ Publish SBA-ADV-20200707-02: CloudLinux CageFS Insufficiently Restric… ∗∗∗ --------------------------------------------- https://github.com/sbaresearch/advisories/commit/fd86295907334f9cd81d8c1a7f… ∗∗∗ Publish SBA-ADV-20200707-01: CloudLinux CageFS Token Disclosure ∗∗∗ --------------------------------------------- https://github.com/sbaresearch/advisories/commit/c2db0b1da76486e2876f1c64f9… ∗∗∗ SystemK NVR 504/508/516 ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-24-025-02 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily