Daily

daily@lists.cert.at

1 participants
3137 discussions

Tageszusammenfassung - 12.07.2023
by Daily end-of-shift report 12 Jul '23

12 Jul '23

===================== = End-of-Day report = ===================== Timeframe: Dienstag 11-07-2023 18:00 − Mittwoch 12-07-2023 18:00 Handler: Michael Schlagenhaufer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Patchday: Microsoft meldet fünf Zero-Days, teils ohne Update ∗∗∗ --------------------------------------------- Der Juli-Patchday von Microsoft liefert viele Updates: 130 Lücken behandelt das Unternehmen. Darunter fünf Zero-Days. Eine Sicherheitslücke bleibt aber offen. --------------------------------------------- https://heise.de/-9213685 ∗∗∗ Teils kritische Sicherheitslücken in Citrix Secure Access Clients ∗∗∗ --------------------------------------------- Citrix hat Aktualisierungen für die Secure Access Clients veröffentlicht, die teils kritische Schwachstellen ausbessern. --------------------------------------------- https://heise.de/-9214076 ∗∗∗ Update gegen kritische Lücke in FortiOS/FortiProxy ∗∗∗ --------------------------------------------- Fortinet verteilt Sicherheitsupdates für FortiOS/FortiProxy. Sie schließen eine kritische Sicherheitslücke. --------------------------------------------- https://heise.de/-9214207 ∗∗∗ Patchday: Kritische Schwachstellen in Adobe Indesign und Coldfusion abgedichtet ∗∗∗ --------------------------------------------- Der Juli-Patchday von Adobe bringt Sicherheitsupdates für Indesign und Coldfusion. Sie schließen Lücken, die der Hersteller als kritisches Risiko einstuft. --------------------------------------------- https://heise.de/-9213920 ∗∗∗ Kernel-Treiber: Hacker überlisten Windows-Richtlinie durch alte Zertifikate ∗∗∗ --------------------------------------------- Indem sie ihre böswilligen Kerneltreiber mit alten Zertifikaten signierten, konnten Angreifer auf Windows-Systemen Vollzugriff erlangen. --------------------------------------------- https://www.golem.de/news/kernel-treiber-hacker-ueberlisten-windows-richtli… ∗∗∗ vm2 Project Discontinued ∗∗∗ --------------------------------------------- TL;DR The library contains critical security issues and should not be used for production! The maintenance of the project has been discontinued. Consider migrating your code to isolated-vm. --------------------------------------------- https://github.com/patriksimek/vm2/blob/master/README.md ∗∗∗ How to Harden WordPress With WP-Config & Avoid Data Exposure ∗∗∗ --------------------------------------------- What is wp-config.php?The wp-config.php file is a powerful core WordPress file that is vital for running your website. It contains important configuration settings for WordPress, including details on where to find the database, login credentials, name and host. This config file is also used to define advanced options for database elements, security keys, and developer options. In this post, we’ll outline some important website hardening recommendations for your wp-config file [...] --------------------------------------------- https://blog.sucuri.net/2023/07/tips-for-wp-config-how-to-avoid-sensitive-d… ∗∗∗ Python-Based PyLoose Fileless Attack Targets Cloud Workloads for Cryptocurrency Mining ∗∗∗ --------------------------------------------- A new fileless attack dubbed PyLoose has been observed striking cloud workloads with the goal of delivering a cryptocurrency miner, new findings from Wiz reveal. "The attack consists of Python code that loads an XMRig Miner directly into memory using memfd, a known Linux fileless technique," security researchers Avigayil Mechtinger, Oren Ofer, and Itamar Gilad said. --------------------------------------------- https://thehackernews.com/2023/07/python-based-pyloose-fileless-attack.html ∗∗∗ Dissecting a Clever Malware Sample for Optimized Detection and Protection ∗∗∗ --------------------------------------------- As part of our product lineup, we offer security monitoring and malware removal services to our Wordfence Care and Response customers. In case of a security incident, our incident response team will investigate the root cause, find and remove malware from your site, and help with other complications that may arise as a result of [...] --------------------------------------------- https://www.wordfence.com/blog/2023/07/dissecting-a-clever-malware-sample-f… ∗∗∗ Qbot, Guloader und SpinOk führen Mobile Malware-Ranking an ∗∗∗ --------------------------------------------- Bedrohungsindex von Checkpoint für Juni 2023 zeigt: Qbot ist noch immer die am meisten verbreitete Malware in Deutschland. --------------------------------------------- https://www.zdnet.de/88410517/qbot-guloader-und-spinok-fuehren-mobile-malwa… ∗∗∗ Security Flaws unraveled in Popular QuickBlox Chat and Video Framework could exposed sensitive data of millions ∗∗∗ --------------------------------------------- Check Point Research (CPR) in collaboration with Claroty Team82 uncovered major security vulnerabilities in the popular QuickBlox platform, used for telemedicine, finance and smart IoT devices If exploited, the vulnerabilities could allow threat actors to access applications’ user databases and expose sensitive data of millions. QuickBlox worked closely with Team82 and CPR to address our disclosure and has fixed the vulnerabilities via a new secure architecture design [...] --------------------------------------------- https://blog.checkpoint.com/security/security-flaws-unraveled-in-popular-qu… ∗∗∗ The Spies Who Loved You: Infected USB Drives to Steal Secrets ∗∗∗ --------------------------------------------- In the first half of 2023, Mandiant Managed Defense has observed a threefold increase in the number of attacks using infected USB drives to steal secrets. Mandiant tracked all of the cases and found that the majority of the incidents could be attributed to several active USB-based operation campaigns affecting both the public and private sectors globally. --------------------------------------------- https://www.mandiant.com/resources/blog/infected-usb-steal-secrets ∗∗∗ CISA and FBI Release Cybersecurity Advisory on Enhanced Monitoring to Detect APT Activity Targeting Outlook Online ∗∗∗ --------------------------------------------- The Cybersecurity and Infrastructure Security Agency (CISA) and Federal Bureau of Investigation (FBI) have released a joint Cybersecurity Advisory (CSA), Enhanced Monitoring to Detect APT Activity Targeting Outlook Online, to provide guidance to agencies and critical infrastructure organizations on enhancing monitoring in Microsoft Exchange Online environments. --------------------------------------------- https://www.cisa.gov/news-events/alerts/2023/07/12/cisa-and-fbi-release-cyb… ===================== = Vulnerabilities = ===================== ∗∗∗ FortiOS/FortiProxy - Proxy mode with deep inspection - Stack-based buffer overflow ∗∗∗ --------------------------------------------- A stack-based overflow vulnerability [CWE-124] in FortiOS & FortiProxy may allow a remote attacker to execute arbitrary code or command via crafted packets reaching proxy policies or firewall policies with proxy mode alongside SSL deep packet inspection. Workaround: Disable deep inspection on proxy policies or firewall policies with proxy mode. --------------------------------------------- https://fortiguard.fortinet.com/psirt/FG-IR-23-183 ∗∗∗ FortiAnalyzer & FortiManager - Path traversal in history downloadzip ∗∗∗ --------------------------------------------- An improper limitation of a pathname to a restricted directory (Path Traversal) vulnerability [CWE-23] in FortiAnalyzer and FortiManager management interface may allow a remote and authenticated attacker to retrieve arbitrary files from the underlying filesystem via specially crafted web requests. --------------------------------------------- https://fortiguard.fortinet.com/psirt/FG-IR-22-471 ∗∗∗ FortiExtender - Path Traversal vulnerability ∗∗∗ --------------------------------------------- An improper limitation of a pathname to a restricted directory (Path Traversal) vulnerability [CWE-22] in FortiExtender management interface may allow an unauthenticated and remote attacker to retrieve arbitrary files from the underlying filesystem via specially crafted web requests. --------------------------------------------- https://fortiguard.fortinet.com/psirt/FG-IR-22-039 ∗∗∗ FortiOS - Existing websocket connection persists after deleting API admin ∗∗∗ --------------------------------------------- An insufficient session expiration [CWE-613] vulnerability in FortiOS REST API may allow an attacker to reuse the session of a deleted user, should the attacker manage to obtain the API token. --------------------------------------------- https://fortiguard.fortinet.com/psirt/FG-IR-23-028 ∗∗∗ Interesting Arbitrary File Upload Vulnerability Patched in User Registration WordPress Plugin ∗∗∗ --------------------------------------------- On June 19, 2023, the Wordfence Threat Intelligence team identified and began the responsible disclosure process for an Arbitrary File Upload vulnerability in WPEverest’s User Registration plugin, which is actively installed on more than 60,000 WordPress websites. This vulnerability makes it possible for an authenticated attacker with minimal permissions, such as a subscriber, to upload [...] --------------------------------------------- https://www.wordfence.com/blog/2023/07/interesting-arbitrary-file-upload-vu… ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (erlang, symfony, thunderbird, and yajl), Fedora (cutter-re, kernel, rizin, and yt-dlp), Red Hat (grafana), SUSE (kernel and python-Django), and Ubuntu (dotnet6, dotnet7 and firefox). --------------------------------------------- https://lwn.net/Articles/937972/ ∗∗∗ ICS Patch Tuesday: Siemens, Schneider Electric Fix 50 Vulnerabilities ∗∗∗ --------------------------------------------- ICS Patch Tuesday: Siemens and Schneider Electric release nine new security advisories and fix 50 vulnerabilities in their industrial products. --------------------------------------------- https://www.securityweek.com/ics-patch-tuesday-siemens-schneider-electric-f… ∗∗∗ Mattermost security updates 7.10.4 / 7.9.6 / 7.8.8 (ESR) released ∗∗∗ --------------------------------------------- We’re informing you about a Mattermost security update, which addresses medium-level severity vulnerabilities. We highly recommend that you apply the update. The security update is available for Mattermost dot releases 7.10.4, 7.9.6 and 7.8.8 (Extended Support Release), for both Team Edition and Enterprise Edition. --------------------------------------------- https://mattermost.com/blog/mattermost-security-updates-7-10-4-7-9-6-7-8-8-… ∗∗∗ Windows 7/Server 2008 R2; Server 2012 R2: Updates (11. Juli 2023) ∗∗∗ --------------------------------------------- Zum 11. Juli 2023 wurden diverse Sicherheitsupdates für Windows Server 2008 R2 (im 4. ESU Jahr) sowie für Windows Server 2012/R2 veröffentlicht (die Updates lassen sich ggf. auch noch unter Windows 7 SP1 installieren). Hier ein Überblick über diese Updates --------------------------------------------- https://www.borncity.com/blog/2023/07/12/windows-7-server-2008-r2-server-20… ∗∗∗ Sandbox Escape ∗∗∗ --------------------------------------------- In vm2 for versions up to 3.9.19, Node.js custom inspect function allows attackers to escape the sandbox and run arbitrary code. --------------------------------------------- https://github.com//patriksimek/vm2/security/advisories/GHSA-g644-9gfx-q4q4 ∗∗∗ Sandbox Escape ∗∗∗ --------------------------------------------- In vm2 for versions up to 3.9.19, Promise handler sanitization can be bypassed, allowing attackers to escape the sandbox and run arbitrary code. --------------------------------------------- https://github.com//patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5 ∗∗∗ Citrix Secure Access client for Ubuntu Security Bulletin for CVE-2023-24492 ∗∗∗ --------------------------------------------- https://support.citrix.com/article/CTX564169/citrix-secure-access-client-fo… ∗∗∗ Citrix Secure Access client for Windows Security Bulletin for CVE-2023-24491 ∗∗∗ --------------------------------------------- https://support.citrix.com/article/CTX561480/citrix-secure-access-client-fo… ∗∗∗ Lenovo UDC Vulnerability ∗∗∗ --------------------------------------------- https://support.lenovo.com/product_security/PS500567-LENOVO-UDC-VULNERABILI… ∗∗∗ AMD SEV VM Power Side Channel Security Notice ∗∗∗ --------------------------------------------- https://support.lenovo.com/product_security/PS500569-AMD-SEV-VM-POWER-SIDE-… ∗∗∗ AMI MegaRAC SP-X BMC Vulnerabilities ∗∗∗ --------------------------------------------- https://support.lenovo.com/product_security/PS500568-AMI-MEGARAC-SP-X-BMC-V… ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ Rockwell Automation Select Communication Modules ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-193-01 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 11.07.2023
by Daily end-of-shift report 11 Jul '23

11 Jul '23

===================== = End-of-Day report = ===================== Timeframe: Montag 10-07-2023 18:00 − Dienstag 11-07-2023 18:00 Handler: Stephan Richter Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Exploit für Root-Lücke in VMware Aria Operations for Logs aufgetaucht ∗∗∗ --------------------------------------------- Teils kritische Sicherheitslücken in VMware Aria Operations for Logs stopfen Updates aus dem April. Jetzt ist Exploit-Code aufgetaucht, der eine Lücke angreift. --------------------------------------------- https://heise.de/-9212276 ∗∗∗ Fake-E-Mail einer EU-Förderung über 850.000 Euro im Umlauf ∗∗∗ --------------------------------------------- Aktuell kursiert ein gefälschtes E-Mail über eine EU-Förderung von 850.000 Euro. Der Zuschuss wurde angeblich für Unternehmen, Start-ups und Einzelpersonen mit innovativen Ideen entwickelt. Wer das Geld beantragen will, muss persönliche Daten an eine E-Mail-Adresse senden. Das Angebot ist aber Fake, antworten Sie nicht und verschieben Sie das E-Mail in Ihren Spam-Ordner. --------------------------------------------- https://www.watchlist-internet.at/news/fake-e-mail-einer-eu-foerderung-uebe… ∗∗∗ Roots of Trust are difficult ∗∗∗ --------------------------------------------- The phrase "Root of Trust" turns up at various points in discussions about verified boot and measured boot, and to a first approximation nobody is able to give you a coherent explanation of what it means[1]. The Trusted Computing Group has a fairly wordy definition, but (a) its a lot of words and (b) I dont like it, so instead Im going to start by defining a root of trust as "A thing that has to be trustworthy for anything else on your computer to be trustworthy". --------------------------------------------- https://mjg59.dreamwidth.org/66907.html ∗∗∗ It’s Raining Phish and Scams – How Cloudflare Pages.dev and Workers.dev Domains Get Abused ∗∗∗ --------------------------------------------- As they say, when it rains, it pours. Recently, we observed more than 3,000 phishing emails containing phishing URLs abusing services at workers.dev and pages.dev domains. --------------------------------------------- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/its-raining… ∗∗∗ Critical Foswiki Vulnerablities: A Logic Error Turned Remote Code Execution ∗∗∗ --------------------------------------------- We love open-source software. In context of our mission #moresecurity, Christian Pöschl, security consultant and penetration tester at usd HeroLab had a look at Foswiki as a research project. In this blog post, we summarize the journey to discover the functionality of Foswiki and identify multiple vulnerabilities, which ultimately allowed us to elevate privileges from a freshly registered user to full remote code execution on the server. All vulnerabilities were reported to the developers according to our Responsible Disclosure Policy. --------------------------------------------- https://herolab.usd.de/en/critical-foswiki-vulnerablities-a-logic-error-tur… ∗∗∗ Cybercriminals Evolve Antidetect Tooling for Mobile OS-Based Fraud ∗∗∗ --------------------------------------------- Cybercriminals continue to evolve their tactics, techniques, and procedures (TTPs) to defraud the customers of online banking, payment systems, advertising networks, and online marketplaces worldwide. Resecurity has observed a rising trend involving threat actors increased use of specialized mobile Android OS device spoofing tools. These tools enable fraudsters to impersonate compromised account holders and bypass anti-fraud controls effectively. --------------------------------------------- https://www.resecurity.com/blog/article/cybercriminals-evolve-antidetect-to… ∗∗∗ Lowering the Bar(d)? Check Point Research’s security analysis spurs concerns over Google Bard’s limitations ∗∗∗ --------------------------------------------- Check Point Research (CPR) releases an analysis of Google’s generative AI platform ‘Bard’, surfacing several scenarios where the platform permits cybercriminals’ malicious efforts. Check Point Researchers were able to generate phishing emails, malware keyloggers and basic ransomware code. --------------------------------------------- https://blog.checkpoint.com/security/lowering-the-bard-check-point-research… ∗∗∗ MISP 2.4.173 released with various bugfixes and improvements ∗∗∗ --------------------------------------------- We have added a new functionality allowing administrators to enable user self-service for forgotten passwords. When enabled, users will have an additional link below the login screen, allowing them to enter their e-mails and receive a token that can be used to reset their passwords. --------------------------------------------- https://github.com/MISP/MISP/releases/tag/v2.4.173 ∗∗∗ Unveiling the secrets: Exploring whitespace steganography for secure communication ∗∗∗ --------------------------------------------- In the realm of data security, there exists a captivating technique known as whitespace steganography. Unlike traditional methods of encryption, whitespace steganography allows for the hiding of sensitive information within whitespace characters, such as spaces, tabs, and line breaks. --------------------------------------------- https://cybersecurity.att.com/blogs/security-essentials/unveiling-the-secre… ∗∗∗ Defend Against the Latest Active Directory Certificate Services Threats ∗∗∗ --------------------------------------------- To help security professionals understand the complexities of AD CS and how to mitigate its abuse, Mandiant has published a hardening guide that focuses on the most impactful AD CS attack techniques and abuse scenarios we are seeing on the frontlines of the latest breaches and attacks. --------------------------------------------- https://www.mandiant.com/blog/resources/defend-ad-cs-threats ===================== = Vulnerabilities = ===================== ∗∗∗ Zero-Day für Safari geschlossen - Update: Zurückgezogen ∗∗∗ --------------------------------------------- Apple hat Montagabend eine schnelle Aktualisierung für seinen Browser ausgespielt. Betroffen von der offenbar bereits ausgenutzten Lücke: Macs und Mobilgeräte. [...] Apple hat die RSR-Updates für Mac, iPhone und iPad mittlerweile zurückgezogen. Grund ist offenbar, dass es verschiedene Websites gab, die nach dem Update Warnmeldungen ausspucken, dass der aktualisierte Safari-Browser "nicht mehr" unterstützt werde. Apple hat im User-Agent-String ein --------------------------------------------- https://heise.de/-9212228 ∗∗∗ Patchday: SAP warnt vor 16 Sicherheitslücken in der Business-Software ∗∗∗ --------------------------------------------- Am Juli-Patchday hat SAP 16 Sicherheitsmeldungen zur Geschäfts-Software aus dem Unternehmen veröffentlicht. Updates dichten auch eine kritische Lücke ab. --------------------------------------------- https://heise.de/-9213319 ∗∗∗ ABB: 2023-02-10 (**Updated 2023-07-10**) - Cyber Security Advisory - Drive Composer multiple vulnerabilities ∗∗∗ --------------------------------------------- Updated to reflect the latest version 2.8.2 of Drive Composer (both Entry and pro) where vulnerability CVE-2022-35737 has been resolved. Originally this vulnerability had not been resolved when this advisory was published alongside Drive Composer 2.8.1. --------------------------------------------- https://search.abb.com/library/Download.aspx?DocumentID=9AKK108467A7957 ∗∗∗ Siemens Security Advisories ∗∗∗ --------------------------------------------- Siemens has released 5 new and 12 updated Security Advisories. (CVSS Scores ranging from 5.3 to 10) --------------------------------------------- https://new.siemens.com/global/en/products/services/cert.html?d=2023-07 ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (mediawiki and node-tough-cookie), Red Hat (bind, kernel, kpatch-patch, and python38:3.8, python38-devel:3.8), SUSE (kernel, nextcloud-desktop, and python-tornado), and Ubuntu (dwarves-dfsg and thunderbird). --------------------------------------------- https://lwn.net/Articles/937879/ ∗∗∗ CVE-2023-29298: Adobe ColdFusion Access Control Bypass ∗∗∗ --------------------------------------------- Rapid7 discovered an access control bypass vulnerability affecting Adobe ColdFusion that allows an attacker to access the administration endpoints. --------------------------------------------- https://www.rapid7.com/blog/post/2023/07/11/cve-2023-29298-adobe-coldfusion… ∗∗∗ Technicolor: VU#913565: Hard-coded credentials in Technicolor TG670 DSL gateway router ∗∗∗ --------------------------------------------- https://kb.cert.org/vuls/id/913565 ∗∗∗ Mozilla: Security Vulnerabilities fixed in Firefox 115.0.2 and Firefox ESR 115.0.2 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2023-26/ ∗∗∗ Lenovo: NVIDIA Display Driver Advisory - June 2023 ∗∗∗ --------------------------------------------- http://support.lenovo.com/product_security/PS500566-NVIDIA-DISPLAY-DRIVER-A… ∗∗∗ Panasonic Control FPWin Pro7 ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-192-03 ∗∗∗ Rockwell Automation Enhanced HIM ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-192-01 ∗∗∗ Sensormatic Electronics iSTAR ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-192-02 ∗∗∗ TADDM affected by multiple vulnerabilities due to IBM Java and its runtime ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7009499 ∗∗∗ IBM Db2 with Federated configuration is vulnerable to arbitrary code execution. (CVE-2023-35012) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7010747 ∗∗∗ IBM Robotic Process Automation is vulnerable to disclosure of server version information (CVE-2023-35900) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7010895 ∗∗∗ IBM Sterling Connect:Express for UNIX browser UI is vulnerable to attacks that rely on the use of cookies without the SameSite attribute ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7010921 ∗∗∗ IBM Sterling Connect:Express for UNIX is vulnerable to server-side request forgery (SSRF) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7010923 ∗∗∗ IBM Sterling Connect:Express uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7010925 ∗∗∗ Vulnerability of System.Text.Encodings.Web.4.5.0 .dll has afftected to .NET Agent ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7010945 ∗∗∗ IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to multiple vulnerabilities in Python ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7011035 ∗∗∗ IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to multiple vulnerabilities in Perl ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7011033 ∗∗∗ IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to GNU Libtasn1 information disclosure vulnerability [CVE-2021-46848] ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7011037 ∗∗∗ Vulnerabilities have been identified in OpenSSL, Apache HTTP Server and other system libraries shipped with the DS8000 Hardware Management Console (HMC) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7006449 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 10.07.2023
by Daily end-of-shift report 10 Jul '23

10 Jul '23

===================== = End-of-Day report = ===================== Timeframe: Freitag 07-07-2023 18:00 − Montag 10-07-2023 18:00 Handler: Michael Schlagenhaufer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ 1,5 Millionen Installationen: Android-Malware im Google-Play-Store entdeckt ∗∗∗ --------------------------------------------- IT-Sicherheitsforscher haben zwei vermeintliche Dateimanager mit mehr als 1,5 Millionen Downloads im Google Play Store entdeckt. Es handelt sich um Spyware. --------------------------------------------- https://heise.de/-9211287 ∗∗∗ ARM-Grafikeinheit: Warnung vor Angriffen auf Sicherheitslücle in Treibern ∗∗∗ --------------------------------------------- Cyberkriminelle missbrauchen eine Sicherheitslücke in Treibern für ARMs Mali-Grafikeinheiten, um ihre Rechte auszuweiten oder Informationen abzugreifen. --------------------------------------------- https://heise.de/-9211310 ∗∗∗ BSI veröffentlicht Positionspapier zu Secured Applications for Mobile ∗∗∗ --------------------------------------------- Das Bundesamt für Sicherheit in der Informationstechnik (BSI) veröffentlicht ein aktuelles Positionspapier zum Thema „Secured Applications for Mobile“ (SAM). --------------------------------------------- https://www.bsi.bund.de/DE/Service-Navi/Presse/Alle-Meldungen-News/Meldunge… ∗∗∗ PoC Exploit Published for Recent Ubiquiti EdgeRouter Vulnerability ∗∗∗ --------------------------------------------- PoC exploit has been published for a recently patched Ubiquiti EdgeRouter vulnerability leading to arbitrary code execution. --------------------------------------------- https://www.securityweek.com/poc-exploit-published-for-recent-ubiquiti-edge… ∗∗∗ Was tun, wenn Sie bei einem problematischen Online-Shop bestellt haben? ∗∗∗ --------------------------------------------- Ihre Bestellung entspricht nicht Ihren Erwartungen? Die Qualität ist minderwertig, das Produkt etwas vollkommen anderes oder einfach Schrott? Eine Rücksendung ist teuer und nur nach China möglich? Dann haben Sie in einem problematischen bzw. unseriösen Online-Shop bestellt. Wir zeigen Ihnen, was Sie tun können. --------------------------------------------- https://www.watchlist-internet.at/news/was-tun-wenn-sie-bei-einem-problemat… ∗∗∗ Vorsicht: ‘Big Head’ Ransomware zeigt "Windows Update"-Benachrichtigung an ∗∗∗ --------------------------------------------- Ich nehme das Thema mal hier zur Vorsicht im Blog mit auf, vielleicht bewahrt es Einzelne aus der Leserschaft vor einem fatalen Fehler. Eine Big Head genannte Ransomware-Familie nutzt einen neuen Trick, um potentielle Opfer zu übertölpeln. --------------------------------------------- https://www.borncity.com/blog/2023/07/10/vorsicht-big-head-ransomware-zeigt… ∗∗∗ Advanced Vishing Attack Campaign “LetsCall” Targets Andriod Users ∗∗∗ --------------------------------------------- In a newly detected muli-stage vishing campaign attackers are using an advanced toolset dubbed LetsCall, featuring strong evasion tactics. --------------------------------------------- https://www.hackread.com/advanced-vishing-attack-letscall-andriod-users/ ===================== = Vulnerabilities = ===================== ∗∗∗ Ateme TITAN File 3.9 Job Callbacks SSRF File Enumeration ∗∗∗ --------------------------------------------- Authenticated Server-Side Request Forgery (SSRF) vulnerability exists in the Titan File video transcoding software. The application parses user supplied data in the job callback url GET parameter. Since no validation is carried out on the parameter, an attacker can specify an external domain and force the application to make an HTTP/DNS/File request to an arbitrary destination. --------------------------------------------- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5781.php ∗∗∗ SSD Advisory – EdgeRouters and AirCube miniupnpd Heap Overflow ∗∗∗ --------------------------------------------- A vulnerability in EdgeRouters’s and AirCube’s miniupnpd allows LAN attackers to cause the service to overflow an internal heap and potentially execute arbitrary code. --------------------------------------------- https://ssd-disclosure.com/ssd-advisory-edgerouters-and-aircube-miniupnpd-h… ∗∗∗ Codeschmuggel möglich: Hochriskante Sicherheitslücken in ArubaOS-Firmware ∗∗∗ --------------------------------------------- Die HPE-Tochter Aruba hat Aktualisierungen für die ArubaOS-Firmware veröffentlicht. Sie schließen hochriskante Sicherheitslücken, die Codeschmuggel erlauben. --------------------------------------------- https://heise.de/-9211464 ∗∗∗ Minecraft: Virtuelle Computer reißen Sicherheitslücken auf ∗∗∗ --------------------------------------------- In zwei Minecraft-Mods, die tatsächlich programmierbare Computer oder Roboter für das Spiel bereitstellen, klaffen kritische Sicherheitslücken. --------------------------------------------- https://heise.de/-9211864 ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (firefox-esr, fusiondirectory, ocsinventory-server, php-cas, and thunderbird), Fedora (dav1d, perl-CPAN, and yt-dlp), Red Hat (python39:3.9 and python39-devel:3.9), Slackware (mozilla), SUSE (prometheus-ha_cluster_exporter and prometheus-sap_host_exporter), and Ubuntu (ghostscript, linux-azure, linux-intel-iotg, linux-intel-iotg-5.15, and ruby-doorkeeper). --------------------------------------------- https://lwn.net/Articles/937803/ ∗∗∗ Limited disclosure of 6 vulnerabilities in OSNexus Quantastor ∗∗∗ --------------------------------------------- The story of DIVD case DIVD-2021-00020 is a story that started more then 1.5 years ago, when DIVD researcher Wietse Boondsta discovered six vulnerabilities ( CVE-2021-42079, CVE-2021-42080, CVE-2021-42080, CVE-2021-42080, CVE-2021-42080, and CVE-2021-4066 ) in OSNexus Quantastor. As per our CNA policy we tried to contact the vendor and this was not a smooth ride. We started the process in November 2021 and it took us a lot of effort, and help from NCSC-NL and its US partners [...] --------------------------------------------- https://csirt.divd.nl/2023/07/10/Limited-disclosure-OSNexus-vulnerabilities/ ∗∗∗ Festo: Several vulnerabilities in FactoryViews ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2023-013/ ∗∗∗ IBM Db2 JDBC driver is vulnerable to remote code execution. (CVE-2023-27869, CVE-2023-27867, CVE-2023-27868) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7010029 ∗∗∗ IBM Db2 has multiple denial of service vulnerablities with a specially crafted query ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7010557 ∗∗∗ IBM Db2 federated server is vulnerable to a denial of service when using a specially crafted wrapper using certain options. (CVE-2023-30442) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7010561 ∗∗∗ IBM Db2 db2set is vulnerable to arbitrary code execution. (CVE-2023-30431) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7010565 ∗∗∗ IBM Db2 is vulnerable to insufficient audit logging. (CVE-2023-23487) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7010567 ∗∗∗ IBM Db2 on Windows is vulnerable to privilege escalation. (CVE-2023-27558) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7010571 ∗∗∗ IBM Db2 is vulnerable to information disclosure due to improper privilege management when certain federation features are used. (CVE-2023-29256) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7010573 ∗∗∗ A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM WebSphere Remote Server (CVE-2023-35890) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7010577 ∗∗∗ Multiple Vulnerabilities in IBM Runtime Environment Java Technology Edition affects WebSphere eXtreme Scale ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7010585 ∗∗∗ The IBM Engineering Lifecycle Engineering product using IBM WebSphere Application Server Liberty is vulnerable to GraphQL - CVE-2023-28867 ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7010655 ∗∗∗ The IBM Engineering Lifecycle Engineering product using IBM WebSphere Application Server Liberty is vulnerable to spoofing - CVE-2022-39161 ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7010659 ∗∗∗ The IBM Engineering Lifecycle Engineering product using IBM WebSphere Application Server Liberty is vulnerable to spoofing - CVE-2022-39161 ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7010665 ∗∗∗ IBM App Connect Enterprise Certified Container DesignerAuthoring operands that use mapping assistance are vulnerable to denial of service due to [CVE-2023-25399] ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7010711 ∗∗∗ A vulnerability in Apache Commons Code affects IBM Robotic Process Automation and may result in a disclosure of sensitive information. (IBM X-Force ID: 177834) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7010725 ∗∗∗ IBM Db2 JDBC driver is vulnerable to remote code execution. (CVE-2023-27869, CVE-2023-27867, CVE-2023-27868) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7010029 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 07.07.2023
by Daily end-of-shift report 07 Jul '23

07 Jul '23

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 06-07-2023 18:00 − Freitag 07-07-2023 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Google Play apps with 1.5 million installs send your data to China ∗∗∗ --------------------------------------------- Security researchers discovered two malicious file management applications on Google Play with a collective installation count of over 1.5 million that collected excessive user data that goes well beyond whats needed to offer the promised functionality. [..] File Recovery and Data Recovery, identified as "com.spot.music.filedate" on devices, has at least 1 million installs. The install count for File Manager reads at least 500,000 and it can be identified on devices as "com.file.box.master.gkd." --------------------------------------------- https://www.bleepingcomputer.com/news/security/google-play-apps-with-15-mil… ∗∗∗ Iranian Hackers Sophisticated Malware Targets Windows and macOS Users ∗∗∗ --------------------------------------------- The Iranian nation-state actor known as TA453 has been linked to a new set of spear-phishing attacks that infect both Windows and macOS operating systems with malware."TA453 eventually used a variety of cloud hosting providers to deliver a novel infection chain that deploys the newly identified PowerShell backdoor GorjolEcho," Proofpoint said in a new report. --------------------------------------------- https://thehackernews.com/2023/07/iranian-hackers-sophisticated-malware.html ∗∗∗ BlackByte 2.0 Ransomware: Infiltrate, Encrypt, and Extort in Just 5 Days ∗∗∗ --------------------------------------------- Recently, Microsoft's Incident Response team investigated the BlackByte 2.0 ransomware attacks and exposed these cyber strikes' terrifying velocity and damaging nature. The findings indicate that hackers can complete the entire attack process, from gaining initial access to causing significant damage, in just five days. They waste no time infiltrating systems, encrypting important data, and demanding a ransom to release it. --------------------------------------------- https://thehackernews.com/2023/07/blackbyte-20-ransomware-infiltrate.html ∗∗∗ StackRot (CVE-2023-3269): Linux kernel privilege escalation vulnerability ∗∗∗ --------------------------------------------- A flaw was found in the handling of stack expansion in the Linux kernel 6.1 through 6.4, aka "Stack Rot". The maple tree, responsible for managing virtual memory areas, can undergo node replacement without properly acquiring the MM write lock, leading to use-after-free issues. An unprivileged local user could use this flaw to compromise the kernel and escalate their privileges. --------------------------------------------- https://github.com/lrh2000/StackRot ∗∗∗ Sie sollen eine „Erstattung aus dem Sozialfonds erhalten“? Ignorieren Sie diese SMS! ∗∗∗ --------------------------------------------- Unsere Leser:innen melden uns aktuell SMS, die im Namen des „Staates“ verschickt werden. Angeblich sollen Sie eine „Erstattung aus dem Sozialfonds“ erhalten. Achtung, Phishing-Alarm! Löschen Sie die SMS und geben Sie auf keinen Fall Ihre Kontodaten an. --------------------------------------------- https://www.watchlist-internet.at/news/sie-sollen-eine-erstattung-aus-dem-s… ∗∗∗ A Network of SOCs? ∗∗∗ --------------------------------------------- I wrote most of this text quickly in January 2021 when the European Commission asked me to apply my lessons learned from the CSIRTs Network to a potential European Network of SOCs. During 2022, the plans for SOC collaboration have been toned down a bit, the DIGITAL Europe funding scheme proposes multiple platforms where SOCs can work together. In 2023, the newly proposed “Cyber Solidarity Act” builds upon this and codifies the concept of a “national SOC” and “cross-border SOC platforms” into an EU regulation. --------------------------------------------- https://cert.at/en/blog/2023/7/a-network-of-socs ∗∗∗ Cybererpresser: Ransomware-Gruppe BianLian verzichtet auf Verschlüsselung ∗∗∗ --------------------------------------------- Die Hintermänner konzentrieren sich auf die Exfiltration von Daten. Sie reagieren auf die Veröffentlichung eines kostenlosen Entschlüsselungstools für die Ransomware BianLian. --------------------------------------------- https://www.zdnet.de/88410380/cybererpresser-ransomware-gruppe-bianlian-ver… ∗∗∗ CISA and Partners Release Joint Cybersecurity Advisory on Newly Identified Truebot Malware Variants ∗∗∗ --------------------------------------------- Today, the Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigations (FBI), the Multi-State Information Sharing and Analysis Center (MS-ISAC), and the Canadian Centre for Cyber Security (CCCS) released a joint Cybersecurity Advisory (CSA), Increased Truebot Activity Infects U.S. and Canada Based Networks, to help organizations detect and protect against newly identified Truebot malware variants. --------------------------------------------- https://www.cisa.gov/news-events/alerts/2023/07/06/cisa-and-partners-releas… ===================== = Vulnerabilities = ===================== ∗∗∗ Google Releases Android Patch Update for 3 Actively Exploited Vulnerabilities ∗∗∗ --------------------------------------------- Google has released its monthly security updates for the Android operating system, addressing 46 new software vulnerabilities. Among these, three vulnerabilities have been identified as actively exploited in targeted attacks. --------------------------------------------- https://thehackernews.com/2023/07/google-releases-android-patch-update.html ∗∗∗ Mastodon Social Network Patches Critical Flaws Allowing Server Takeover ∗∗∗ --------------------------------------------- Mastodon, a popular decentralized social network, has released a security update to fix critical vulnerabilities that could expose millions of users to potential attacks.Mastodon is known for its federated model, consisting of thousands of separate servers called "instances," and it has over 14 million users across more than 20,000 instances. The most critical vulnerability, CVE-2023-36460, [..] --------------------------------------------- https://thehackernews.com/2023/07/mastodon-social-network-patches.html ∗∗∗ CISA Releases Three Industrial Control Systems Advisories ∗∗∗ --------------------------------------------- * ICSA-23-187-01 PiiGAB M-Bus * ICSA-23-187-02 ABUS TVIP * ICSA-23-143-03 Mitsubishi Electric MELSEC Series CPU module (Update A) --------------------------------------------- https://www.cisa.gov/news-events/alerts/2023/07/06/cisa-releases-three-indu… ∗∗∗ VMSA-2023-0015 ∗∗∗ --------------------------------------------- CVSSv3 Range: 5.3 CVE(s): CVE-2023-20899 VMware SD-WAN contains a bypass authentication vulnerability. VMware has evaluated the severity of this issue to be in the moderate severity range with a maximum CVSSv3 base score of 5.3. Known Attack Vectors: An unauthenticated attacker can download the Diagnostic bundle of the application under VMware SD-WAN Management. --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2023-0015.html ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (debian-archive-keyring, libusrsctp, nsis, ruby-redcloth, and webkit2gtk), Fedora (firefox), Mageia (apache-ivy, cups, curaengine, glances, golang, keepass, libreoffice, minidlna, nodejs, opensc, perl-DBD-SQLite, python-setuptools, python-wheel, skopeo/buildah/podman, systemd, testng, and webkit2), SUSE (bind), and Ubuntu (Gerbv, golang-websocket, linux-gke, linux-intel-iotg, and linux-oem-5.17). --------------------------------------------- https://lwn.net/Articles/937616/ ∗∗∗ [R1] Nessus Agent Version 10.4.1 Fixes Multiple Vulnerabilities ∗∗∗ --------------------------------------------- Nessus Agent leverages third-party software to help provide underlying functionality. One of the third-party components (OpenSSL) was found to contain vulnerabilities, and updated versions have been made available by the provider.Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues. --------------------------------------------- https://www.tenable.com/security/tns-2023-24 ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 06.07.2023
by Daily end-of-shift report 06 Jul '23

06 Jul '23

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 05-07-2023 18:00 − Donnerstag 06-07-2023 18:00 Handler: Michael Schlagenhaufer Co-Handler: Robert Waldner ===================== = News = ===================== ∗∗∗ Silentbob Campaign: Cloud-Native Environments Under Attack ∗∗∗ --------------------------------------------- The activity, dubbed Silentbob in reference to an AnonDNS domain set up by the attacker, is said to be linked to the infamous cryptojacking group tracked as TeamTNT, citing overlaps in tactics, techniques, and procedures (TTPs). Alternatively, it could be the work of an "advanced copycat." --------------------------------------------- https://thehackernews.com/2023/07/silentbob-campaign-cloud-native.html ∗∗∗ Flutter Restrictions Bypass ∗∗∗ --------------------------------------------- This article investigates the Flutter framework (Google, n.d.) and the methods for bypassing its detections on iOS. CyberCX have also published the scripts used for this bypass for other mobile application security researchers to use in their workflow on our GitHub. --------------------------------------------- https://blog.cybercx.co.nz/flutter-restrictions-bypass ∗∗∗ TeamsPhisher: Tool automatisiert Angriffe auf Teams-Schwachstelle ∗∗∗ --------------------------------------------- Über eine Schwachstelle in Teams können Angreifer Malware unterjubeln. Ein jetzt veröffentlichtes Tool macht diese Attacken noch einfacher. --------------------------------------------- https://heise.de/-9208677 ∗∗∗ Wie steht’s eigentlich um Emotet? ∗∗∗ --------------------------------------------- Eine kurze Zusammenfassung zur aktuellen Situation um Emotet seit dessen "Comeback". --------------------------------------------- https://www.welivesecurity.com/deutsch/2023/07/06/wie-stehts-eigentlich-um-… ∗∗∗ How to delete saved addresses and credit cards in Firefox for improved security and privacy ∗∗∗ --------------------------------------------- If youre looking to get the most out of Firefox security and privacy, you might consider not only deleting all saved addresses and credit cards but also disabling the autofill option. --------------------------------------------- https://www.zdnet.com/article/how-to-delete-saved-addresses-and-credit-card… ===================== = Vulnerabilities = ===================== ∗∗∗ MOVEit Transfer: Service Pack schließt weitere kritische Lücke ∗∗∗ --------------------------------------------- Mit dem Service Pack für MOVEit Transfer im Juli schließt Progress weitere Sicherheitslücken. Eine davon stuft der Hersteller als kritisch ein. (CVE-2023-36932, CVE-2023-36933, CVE-2023-36934) --------------------------------------------- https://heise.de/-9208451 ∗∗∗ MOVEit Transfer 2020.1 (12.1) Service Pack (July 2023) ∗∗∗ --------------------------------------------- CVE-2023-36934 (CRITICAL): SQL Injection CVE-2023-36932 (HIGH): multiple SQL injections CVE-2023-36933 (HIGH): unhandled exception --------------------------------------------- https://community.progress.com/s/article/MOVEit-Transfer-2020-1-Service-Pac… ∗∗∗ Stackrot: Kernel-Schwachstelle ermöglicht Rechteausweitung unter Linux ∗∗∗ --------------------------------------------- Durch eine Sicherheitslücke im Speichermanagement-Subsystem des Linux-Kernels können Angreifer potenziell erweiterte Rechte erlangen. --------------------------------------------- https://www.golem.de/news/stackrot-kernel-schwachstelle-erlaubt-rechteauswe… ∗∗∗ Patchday: Vielfältige Attacken auf Android 11, 12 und 13 möglich ∗∗∗ --------------------------------------------- Es gibt wichtige Sicherheitsupdates für verschiedene Android-Versionen. Im schlimmsten Fall könnte Schadcode auf Geräte gelangen. --------------------------------------------- https://heise.de/-9208524 ∗∗∗ Taking over Milesight UR32L routers behind a VPN: 22 vulnerabilities and a full chain ∗∗∗ --------------------------------------------- In all, Cisco Talos is releasing 22 security advisories today, nine of which have a CVSS score greater than 8, associated with 69 CVEs. --------------------------------------------- https://blog.talosintelligence.com/talos-discovers-17-vulnerabilities-in-mi… ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (golang-yaml.v2, kernel, and mediawiki), Fedora (kernel and picocli), SUSE (bind and python-sqlparse), and Ubuntu (cpdb-libs). --------------------------------------------- https://lwn.net/Articles/937481/ *** IBM Security Bulletins *** --------------------------------------------- IBM i, IBM Rational Functional Tester, IBM Security Verify Access, IBM Cloud Pak, IBM Match 360, IBM Watson, IBM Integration Designer, IBM Sterling Connect:Direct File Agent, IBM Operations Analytics and TADDM. --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ Vulnerability in Cisco Enterprise Switches Allows Attackers to Modify Encrypted Traffic ∗∗∗ --------------------------------------------- Cisco says a high-severity vulnerability in Nexus 9000 series switches could allow attackers to intercept and modify encrypted traffic. Tracked as CVE-2023-20185, the issue impacts the ACI multi-site CloudSec encryption feature of the Nexus 9000 switches that are configured in application centric infrastructure (ACI) mode – typically used in data centers for controlling physical and virtual networks. --------------------------------------------- https://www.securityweek.com/vulnerability-in-cisco-enterprise-switches-all… ∗∗∗ Cisco ACI Multi-Site CloudSec Encryption Information Disclosure Vulnerability ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco Webex Meetings Web UI Vulnerabilities ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco Duo Authentication Proxy Information Disclosure Vulnerability ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco BroadWorks Privilege Escalation Vulnerability ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ ZDI-23-896: D-Link DAP-2622 DDP Change ID Password Auth Password Stack-based Buffer Overflow Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-23-896/ ∗∗∗ Wordfence Intelligence Weekly WordPress Vulnerability Report (June 26, 2023 to July 2, 2023) ∗∗∗ --------------------------------------------- https://www.wordfence.com/blog/2023/07/wordfence-intelligence-weekly-wordpr… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 05.07.2023
by Daily end-of-shift report 05 Jul '23

05 Jul '23

===================== = End-of-Day report = ===================== Timeframe: Dienstag 04-07-2023 18:00 − Mittwoch 05-07-2023 18:00 Handler: Michael Schlagenhaufer Co-Handler: Robert Waldner ===================== = News = ===================== ∗∗∗ Email crypto phishing scams: stealing from hot and cold crypto wallets ∗∗∗ --------------------------------------------- Here is how email phishing scams targeting hot and cold crypto wallets, such as Trezor and Ledger, work. --------------------------------------------- https://securelist.com/hot-and-cold-cryptowallet-phishing/110136/ ∗∗∗ Jetzt patchen! Über 335.000 SSL-VPN-Interfaces von Fortinet attackierbar ∗∗∗ --------------------------------------------- Sicherheitsforscher warnen vor weiteren Attacken auf eine kritische Lücke in FortiOS. Patches zum Schließen der Schwachstelle sind seit Wochen verfügbar. --------------------------------------------- https://heise.de/-9206478 ∗∗∗ Verbaucherzentralen warnen vor personalisiertem Phishing ∗∗∗ --------------------------------------------- Seit Anfang der Woche landen viele Phishingmails mit persönlicher Anrede betreffend der ING in Postfächern von Internetnutzern, warnen die Verbraucherzentralen. --------------------------------------------- https://heise.de/-9207386 ∗∗∗ TEMU Shopping App und temu.com: Problematische Angebote aus China ∗∗∗ --------------------------------------------- Wer sich aktuell durch Social Media bewegt, kommt kaum an Werbeschaltungen für die Shopping App TEMU vorbei. Die Plattform mit Sitz in Dublin und ihrem Ursprung in China startet aktuell eine Offensive auf den österreichischen und deutschen Markt. Die Produkte bei TEMU sind teils unfassbar günstig und für viele verlockend. Möglich ist das aber vor allem durch fragwürdige Geschäftspraktiken, teils mangelhafte Produkte und Nicht-Einhaltung rechtlicher Vorgaben. --------------------------------------------- https://www.watchlist-internet.at/news/temu-shopping-app-und-temucom-proble… ===================== = Vulnerabilities = ===================== ∗∗∗ Path traversal bypass & Denial of service in Kyocera TASKalfa 4053ci printer ∗∗∗ --------------------------------------------- CVE Number: CVE-2023-34259, CVE-2023-34260, CVE-2023-34261 Kyocera TASKalfa 4053ci printers are vulnerable to multiple vulnerabilities. The path traversal vulnerability can be used to access arbitrary files on the filesystem, even files that require root privileges. Also, the path traversal vulnerability can be used to conduct a denial-of-service (DoS). Due the username enumeration vulnerability, it is possible to identify valid user accounts. --------------------------------------------- https://sec-consult.com/vulnerability-lab/advisory/path-traversal-bypass-de… ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Fedora (firefox and python-reportlab), Slackware (mozilla), SUSE (dnsdist, grpc, protobuf, python-Deprecated, python-PyGithub, python-aiocontextvars, python-avro, python-bcrypt, python-cryptography, python- cryptography-vectors, python-google-api-core, pyt, kernel, kubernetes1.18, libdwarf, python311, qt6-base, rmt-server, and virtualbox), and Ubuntu (containerd, firefox, and python-django). --------------------------------------------- https://lwn.net/Articles/937368/ ∗∗∗ The "StackRot" kernel vulnerability ∗∗∗ --------------------------------------------- Ruihan Li has discloseda significant vulnerability introduced into the 6.1 kernel: A flaw was found in the handling of stack expansion in the Linux kernel 6.1 through 6.4, aka "Stack Rot". The maple tree, responsible for managing virtual memory areas, can undergo node replacement without properly acquiring the MM write lock, leading to use-after-free issues. An unprivileged local user could use this flaw to compromise the kernel and escalate their privileges. --------------------------------------------- https://lwn.net/Articles/937377/ ∗∗∗ Frauscher: Diagnostic System FDS001 for FAdC/FAdCi Path Traversal vulnerability ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2023-011/ ∗∗∗ IBM App Connect Enterprise and IBM Integration Bus are vulnerable to a remote attacker and denial of service due to Guava (CVE-2020-8908, CVE-2018-10237). ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7009535 ∗∗∗ A security vulnerability has been identified in IBM WebSphere Application Server shipped with Asset and Service Management (CVE-2023-35890) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7009537 ∗∗∗ IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to xml2js abitrary code execution vulnerability(CVE-2023-0842) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7009049 ∗∗∗ A security vulnerability has been identified in IBM WebSphere Application Server shipped with Tivoli Netcool\/OMNIbus WebGUI (CVE-2023-35890) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7009625 ∗∗∗ Multiple security vulnerabilities has been identified in IBM WebSphere Application Server shipped with Tivoli Netcool\/OMNIbus WebGUI - April 2023 CPU ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7009627 ∗∗∗ A security vulnerability has been identified in WebSphere Application Server traditional shipped with IBM Intelligent Operations Center(CVE-2023-35890) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7009635 ∗∗∗ IBM App Connect Enterprise and IBM Integration Bus are vulnerable to a remote attacker and denial of service due to Guava (CVE-2020-8908, CVE-2018-10237). ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7009535 ∗∗∗ IBM WebSphere Application Server could provide weaker than expected security (CVE-2023-35890) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7007857 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 04.07.2023
by Daily end-of-shift report 04 Jul '23

04 Jul '23

===================== = End-of-Day report = ===================== Timeframe: Montag 03-07-2023 18:00 − Dienstag 04-07-2023 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ DDoSia Attack Tool Evolves with Encryption, Targeting Multiple Sectors ∗∗∗ --------------------------------------------- The threat actors behind the DDoSia attack tool have come up with a new version that incorporates a new mechanism to retrieve the list of targets to be bombarded with junk HTTP requests in an attempt to bring them down.The updated variant, written in Golang, "implements an additional security mechanism to conceal the list of targets, which is transmitted from the [command-and-control] to the users," cybersecurity company Sekoia said in a technical write-up. --------------------------------------------- https://thehackernews.com/2023/07/ddosia-attack-tool-evolves-with.html ∗∗∗ Hunting for Bitwarden master passwords stored in memory ∗∗∗ --------------------------------------------- A blog post on how I was able to identify unknown master passwords stored in the memory of the Bitwarden web extension and desktop client, after a vault has been locked. I also cover the decisions made for developing a proof of concept to automate the process of extracting potential passwords. --------------------------------------------- https://redmaple.tech/blogs/2023/extract-bitwarden-vault-passwords/ ∗∗∗ Achtung Fake-Shop: sharkos.de ∗∗∗ --------------------------------------------- Sharkos – „Ihr Experte für Garten, Pools und Haushalt“. Das sehen wir anders. Der Online-Shop sieht zwar vielversprechend aus, wenn Sie dort bestellen, bekommen Sie aber trotz Zahlung keine Ware. Wir zeigen Ihnen, wie Sie Fake-Shops erkennen. --------------------------------------------- https://www.watchlist-internet.at/news/achtung-fake-shop-sharkosde/ ===================== = Vulnerabilities = ===================== ∗∗∗ Geräteverwaltung: hochriskante Schwachstelle in Ivanti Endpoint Manager ∗∗∗ --------------------------------------------- Eine Sicherheitslücke in der Geräte- und Softwareverwaltung von Ivanti für ChromeOS, Linux, macOS und Windows ermöglicht Angreifern aus dem Netz Codeschmuggel. --------------------------------------------- https://heise.de/-9206574 ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (ghostscript), Fedora (apache-ivy, chromium, golang-github-schollz-croc, golang-github-schollz-mnemonicode, and webkitgtk), SUSE (amazon-ecs-init, dnsdist, libcap, python-tornado, terraform, and xmltooling), and Ubuntu (imagemagick, openldap, php7.4, php8.1, and screen). --------------------------------------------- https://lwn.net/Articles/937292/ ∗∗∗ CISA issues warning for cardiac device system vulnerability ∗∗∗ --------------------------------------------- The Cybersecurity and Infrastructure Security Agency (CISA) warned of a severe vulnerability in a cardiac device from medical device company Medtronic. The issue – tracked as CVE-2023-31222 – carries a “critical” CVSS score of 9.8 out of 10 and affects the company’s Paceart Optima software that runs on a healthcare organization’s Windows server. --------------------------------------------- https://therecord.media/cisa-warning-for-cardiac-device-system-vulnerability ∗∗∗ Zyxel security advisory for buffer overflow vulnerability in 4G LTE and 5G NR outdoor routers ∗∗∗ --------------------------------------------- A buffer overflow vulnerability in the CGI program of some Zyxel 4G LTE and 5G NR outdoor routers could allow a remote authenticated attacker to cause denial of service (DoS) conditions by sending a crafted HTTP request to a vulnerable device. (CVE: CVE-2023-27989) --------------------------------------------- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-… ∗∗∗ Security Vulnerabilities fixed in Thunderbird 102.13 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2023-24/ ∗∗∗ Security Vulnerabilities fixed in Firefox ESR 102.13 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2023-23/ ∗∗∗ Security Vulnerabilities fixed in Firefox 115 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2023-22/ ∗∗∗ Vulnerability in the interface module SLC-0-GPNT00300 ∗∗∗ --------------------------------------------- https://psirt.bosch.com/security-advisories/bosch-sa-894143.html ∗∗∗ Security Advisory for the FL MGUARD family of devices ∗∗∗ --------------------------------------------- https://psirt.bosch.com/security-advisories/bosch-sa-833074.html ∗∗∗ IBM Integration Bus is vulnerable to a remote attack due to Apache Jena (CVE-2021-39239, CVE-2022-28890, CVE-2023-22665). ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7009371 ∗∗∗ Vulnerability in Spring Framework affects IBM Process Mining [CVE-2016-1000027] ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7009383 ∗∗∗ IBM Content Navigator is vulnerable to DoS due to Apache Commons FileUpload (CVE-2023-24998) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7002807 ∗∗∗ Vulnerability in IBM SDK Java Technology affects IBM Cloud Pak System (CVE-2021-35561) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7009441 ∗∗∗ Vulnerabilities in OpenSSL affect Cloud Pak System (CVE-2021-23840, CVE-2021-23841) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7005857 ∗∗∗ Multiple vulnerabilities in IBM Java SDK affect IBM License Metric Tool v9. ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7009457 ∗∗∗ Vulnerability of Newtonsoft.Json-12.0.1.22727.dll has afftected to .NET Agent ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7009459 ∗∗∗ Multiple CVEs may affect IBM\u00ae SDK, Java\u2122 Technology Edition shipped with IBM CICS TX Standard ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7009483 ∗∗∗ Multiple CVEs may affect IBM\u00ae SDK, Java\u2122 Technology Edition shipped with IBM CICS TX Advanced ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7009485 ∗∗∗ Multiple CVEs may affect IBM\u00ae SDK, Java\u2122 Technology Edition shipped with IBM TXSeries for Multiplatforms ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7009487 ∗∗∗ Vulnerabilities in Apache Struts affect IBM Tivoli Application Dependency Discovery Manager. (CVE-2023-34396, CVE-2023-34149) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7009497 ∗∗∗ TADDM affected by multiple vulnerabilities due to IBM Java and its runtime ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7009499 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 03.07.2023
by Daily end-of-shift report 03 Jul '23

03 Jul '23

===================== = End-of-Day report = ===================== Timeframe: Freitag 30-06-2023 18:00 − Montag 03-07-2023 18:00 Handler: Robert Waldner Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Beware: New RustBucket Malware Variant Targeting macOS Users ∗∗∗ --------------------------------------------- "This variant of RustBucket, a malware family that targets macOS systems, adds persistence capabilities not previously observed," Elastic Security Labs researchers said in a report published this week, adding it's "leveraging a dynamic network infrastructure methodology for command-and-control." --------------------------------------------- https://thehackernews.com/2023/07/beware-new-rustbucket-malware-variant.html ∗∗∗ Entschlüsselungstool: Sicherheitsforscher knacken Akira-Ransomware ∗∗∗ --------------------------------------------- Stimmten die Voraussetzungen, können Opfer des Erpressungstrojaner Akira ohne Lösegeld zu zahlen auf ihre Daten zugreifen. --------------------------------------------- https://heise.de/-9204932 ∗∗∗ Vorsicht vor Malvertising: Fake-WinSCP-Tool verbreitet BackCat-Ransomware ∗∗∗ --------------------------------------------- Die Hintermänner des Verschlüsselungstrojaners BlackCat (aka ALPHV) setzen auf einen weiteren Verbreitungsweg. --------------------------------------------- https://heise.de/-9204958 ∗∗∗ Vorsicht vor gefälschten Polizei-Mails ∗∗∗ --------------------------------------------- Aktuell geben sich Kriminelle per E-Mail als Polizei aus. Im Mail steht, dass Sie in der Anlage Ihre Einberufung finden und innerhalb von 48 Stunden antworten müssen. Ansonsten droht Ihnen eine Festnahme. Ignorieren Sie dieses E-Mail, es handelt sich um Betrug! --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-vor-gefaelschten-polizei-ma… ∗∗∗ CVE-2023-20864: Remote Code Execution in VMware Aria Operations for Logs ∗∗∗ --------------------------------------------- In this excerpt of a Trend Micro Vulnerability Research Service vulnerability report, Jonathan Lein and Dusan Stevanovic of the Trend Micro Research Team detail a recently patched remote code execution vulnerability in VMware Aria Operations for Logs (formerly vRealize). --------------------------------------------- https://www.zerodayinitiative.com/blog/2023/6/29/cve-2023-20864-remote-code… ===================== = Vulnerabilities = ===================== ∗∗∗ Sicherheitsupdates: Schadcode-Attacken auf HP-LaserJet-Pro-Drucker möglich ∗∗∗ --------------------------------------------- Mehrere LaserJet-Pro-Modelle von HP sind verwundbar. Sicherheitsupdates schaffen Abhilfe. --------------------------------------------- https://heise.de/-9205846 ∗∗∗ WP AutoComplete 1.0.4 - Unauthenticated SQLi ∗∗∗ --------------------------------------------- The WP AutoComplete Search WordPress plugin through 1.0.4 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX available to unauthenticated users, leading to an unauthenticated SQL injection. --------------------------------------------- https://www.exploit-db.com/exploits/51560 ∗∗∗ Sicherheitsupdate: Attacken auf WordPress-Plug-in Ultimate Member ∗∗∗ --------------------------------------------- Derzeit nutzen Angreifer eine kritische Lücke im WordPress-Plug-in Ultimate Member aus. Der Anbieter rät zu einem zügigen Update. --------------------------------------------- https://heise.de/-9204916 ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (cups, gst-plugins-bad1.0, gst-plugins-base1.0, gst-plugins-good1.0, python3.7, and yajl), Fedora (chromium, kubernetes, pcs, and webkitgtk), Scientific Linux (open-vm-tools), SUSE (iniparser, keepass, libvirt, prometheus-ha_cluster_exporter, prometheus-sap_host_exporter, rekor, terraform-provider-aws, terraform-provider-helm, and terraform-provider-null), and Ubuntu (python-reportlab and vim). --------------------------------------------- https://lwn.net/Articles/937189/ ∗∗∗ Root-Zugang zu Smarthome-Server Loxone Miniserver Go Gen. 2 (SySS-2023-004/-012/-013) ∗∗∗ --------------------------------------------- Durch verschiedene Schwachstellen kann ein Administrator Betriebssystemzugriff auf dem Loxone Miniserver Go im Kontext des root-Benutzers erreichen. --------------------------------------------- https://www.syss.de/pentest-blog/root-zugang-zu-smarthome-server-loxone-min… ∗∗∗ Multiple Vulnerabilities including Unauthenticated Remote Code Execution in Siemens A8000 ∗∗∗ --------------------------------------------- The vendor provides a patch which should be installed immediately. Customers should update to CPCI85 V05 or later version (https://support.industry.siemens.com/cs/ww/en/view/109804985/). - Unauthenticated Remote Code Execution (CVE-2023-28489) - Authenticated Command Injection (CVE-2023-33919) - Hard-coded Root Password (CVE-2023-33920) - Console Login via UART (CVE-2023-33921) --------------------------------------------- https://sec-consult.com/vulnerability-lab/advisory/multiple-vulnerabilities… ∗∗∗ Multiple vulnerabilities in SoftEther VPN and PacketiX VPN ∗∗∗ --------------------------------------------- https://jvn.jp/en/jp/JVN64316789/ ∗∗∗ ZDI-23-894: NETGEAR RAX30 UPnP Command Injection Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-23-894/ ∗∗∗ ZDI-23-893: NETGEAR Multiple Routers curl_post Improper Certificate Validation Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-23-893/ ∗∗∗ WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.6.4 – Authentication Bypass ∗∗∗ --------------------------------------------- https://cxsecurity.com/issue/WLB-2023070002 ∗∗∗ Watson CP4D Data Stores is vulnerable to Golang Go to a denial of service (CVE-2022-1962) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7009053 ∗∗∗ Watson CP4D Data Stores is vulnerable to Golang Go is vulnerable to HTTP request smuggling(CVE-2022-1705) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7009055 ∗∗∗ Watson AI Gateway for Cloud Pak for Data is vulnerable to an Ajv (aka Another JSON Schema Validator) could allow a remote attacker to execute arbitrary code on the system (CVE-2020-15366) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7009061 ∗∗∗ IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to xml2js abitrary code execution vulnerability(CVE-2023-0842) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7009049 ∗∗∗ IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to Node.js http-cache-semantics module denial of service ( CVE-2022-25881) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7009051 ∗∗∗ IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to Envoy security bypass ( CVE-2023-27488) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7009057 ∗∗∗ IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable ConfigObj denial of service ( CVE-2023-26112) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7009059 ∗∗∗ IBM Connect:Direct Web Services vulnerable to sensitive information exposure due to PostgreSQL (CVE-2023-2455) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7009293 ∗∗∗ IBM Connect:Direct Web Services vulnerable to sensitive information exposure due to PostgreSQL (CVE-2022-41862) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7009295 ∗∗∗ IBM Security Key Lifecycle Manager is vulnerable to Incorrect Permission Assignment for Critical Resource (CVE-2018-1750) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/733311 ∗∗∗ Multiple Vulnerabilities in CloudPak for Watson AIOPs ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7007837 ∗∗∗ Multiple vulnerabilities of Apache Groovy (groovy-all-2.3.11.jar) have affected APM JBoss and APM WebLogic Agent [CVE-202-17521, CVE-2016-6814, CVE-2015-3253] ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7009323 ∗∗∗ Multiple vulnerabilities of Apache Ant (ant-1.7.0.jar, ant-1.8.4.jar) have affected APM JBoss, APM WebLogic and APM SAP NetWeaver Java Stack Agents. ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7009321 ∗∗∗ Multiple vulnerabilities in the IBM SDK, Java Technology Edition affects APM Agents for Monitoring ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7009327 ∗∗∗ Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operand is vulnerable to DOS/loss of integrity/confidentiality [CVE-2023-21930 CVE-2023-21937 CVE-2023-21938 CVE-2023-21939 CVE-2023-21954 CVE-2023-21967 CVE-2023-21968] ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7009333 ∗∗∗ Watson CP4D Data Stores is vulnerable to Golang Go to a denial of service (CVE-2022-1962) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7009053 ∗∗∗ Multiple vulnerabilities in IBM Java SDK affects IBM WebSphere Application Server April 2023 CPU that is bundled with IBM WebSphere Application Server Patterns ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7009353 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 30.06.2023
by Daily end-of-shift report 30 Jun '23

30 Jun '23

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 29-06-2023 18:00 − Freitag 30-06-2023 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Torrent of image-based phishing emails are harder to detect and more convincing ∗∗∗ --------------------------------------------- The arms race between scammers and defenders continues. --------------------------------------------- https://arstechnica.com/?p=1951208 ∗∗∗ Spamdexing: What is SEO Spam & How to Remove It ∗∗∗ --------------------------------------------- Ever had an uninvited guest crash your party, resulting in chaos, confusion, and some unhappy visitors? Well, SEO spam is that party crasher - just for websites. Why should you care, you ask? Well, just imagine your meticulously crafted website content being replaced with unsolicited ads for services and products that would make your grandma blush. Or even worse, your loyal site visitors being redirected to shady third party websites. Not the picture of ideal user experience, --------------------------------------------- https://blog.sucuri.net/2023/06/spamdexing-what-is-seo-spam.html ∗∗∗ Cybercriminals Hijacking Vulnerable SSH Servers in New Proxyjacking Campaign ∗∗∗ --------------------------------------------- An active financially motivated campaign is targeting vulnerable SSH servers to covertly ensnare them into a proxy network. "This is an active campaign in which the attacker leverages SSH for remote access, running malicious scripts that stealthily enlist victim servers into a peer-to-peer (P2P) proxy network, such as Peer2Profit or Honeygain," Akamai researcher Allen West said [...] --------------------------------------------- https://thehackernews.com/2023/06/cybercriminals-hijacking-vulnerable-ssh.h… ∗∗∗ Its 2023 and memory overwrite bugs are not just a thing, theyre still number one ∗∗∗ --------------------------------------------- Cough, cough, use Rust. Plus: Eight more exploited bugs added to CISAs must-patch list The most dangerous type of software bug is the out-of-bounds write, according to MITRE this week. This type of flaw is responsible for 70 CVE-tagged holes in the US governments list of known vulnerabilities that are under active attack and need to be patched, we note. --------------------------------------------- https://go.theregister.com/feed/www.theregister.com/2023/06/29/cwe_top_25_2… ∗∗∗ Router-Malware: Aktuelle Kampagne des Mirai-Botnet greift viele Lücken an ∗∗∗ --------------------------------------------- Das Mirari-Botnet ist weiter aktiv. Die Drahtzieher nutzen in einer aktuellen Kampagne zahlreiche Sicherheitslücken, um diverse Internetrouter zu infizieren. --------------------------------------------- https://heise.de/-9203406 ∗∗∗ 200,000 WordPress Sites Exposed to Attacks Exploiting Flaw in ‘Ultimate Member’ Plugin ∗∗∗ --------------------------------------------- Attackers exploit critical vulnerability in the Ultimate Member plugin to create administrative accounts on WordPress websites. --------------------------------------------- https://www.securityweek.com/200000-wordpress-sites-exposed-to-attacks-expl… ∗∗∗ Neue browserbasierte Social-Engineering-Trends ∗∗∗ --------------------------------------------- Report von WatchGuard Threat Lab: Angreifer nutzen neue Wege, um im Internet surfende Anwender auszutricksen. --------------------------------------------- https://www.zdnet.de/88410262/neue-browserbasierte-social-engineering-trend… ∗∗∗ Malware Execution Method Using DNS TXT Record ∗∗∗ --------------------------------------------- AhnLab Security Emergency response Center (ASEC) has confirmed instances where DNS TXT records were being utilized during the execution process of malware. This is considered meaningful from various perspectives, including analysis and detection as this method has not been widely utilized as a means of executing malware. --------------------------------------------- https://asec.ahnlab.com/en/54916/ ∗∗∗ Malvertising Used as Entry Vector for BlackCat, Actors Also Leverage SpyBoy Terminator ∗∗∗ --------------------------------------------- We found that malicious actors used malvertising to distribute malware via cloned webpages of legitimate organizations. The distribution involved a webpage of the well-known application WinSCP, an open-source Windows application for file transfer. We were able to identify that this activity led to a BlackCat (aka ALPHV) infection, and actors also used SpyBoy, a terminator that tampers with protection provided by agents. --------------------------------------------- https://www.trendmicro.com/en_us/research/23/f/malvertising-used-as-entry-v… ∗∗∗ Decrypted: Akira Ransomware ∗∗∗ --------------------------------------------- Researchers for Avast have developed a decryptor for the Akira ransomware and released it for public download. The Akira ransomware appeared in March 2023 and since then, the gang claims successful attacks on various organizations in the education, finance and real estate industries, amongst others. --------------------------------------------- https://decoded.avast.io/threatresearch/decrypted-akira-ransomware/ ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (docker-registry, flask, systemd, and trafficserver), Fedora (moodle, python-reportlab, suricata, and vim), Red Hat (go-toolset and golang, go-toolset-1.19 and go-toolset-1.19-golang, go-toolset:rhel8, open-vm-tools, python27:2.7, and python3), SUSE (buildah, chromium, gifsicle, libjxl, sqlite3, and xonotic), and Ubuntu (linux, linux-allwinner, linux-allwinner-5.19, linux-aws, linux-aws-5.19, linux-azure, linux-gcp, linux-gcp-5.19, linux-hwe-5.19, linux-ibm, linux-kvm, linux-lowlatency, linux-oracle, linux-raspi, linux-starfive, linux-starfive-5.19, linux, linux-aws, linux-aws-5.15, linux-aws-5.4, linux-azure, linux-azure-5.15, linux-azure-5.4, linux-azure-fde-5.15, linux-bluefield, linux-gcp, linux-gcp-5.15, linux-gcp-5.4, linux-gke, linux-gke-5.15, linux-gkeop, linux-gkeop-5.15, linux-hwe-5.15, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, linux-oracle, linux-oracle-5.15, linux-oracle-5.4, linux-raspi, linux-raspi-5.4, and linux-oem-6.1). --------------------------------------------- https://lwn.net/Articles/936949/ ∗∗∗ Nessus Network Monitor 6.2.2 Fixes Multiple Vulnerabilities ∗∗∗ --------------------------------------------- https://www.tenable.com/security/tns-2023-23 ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 29.06.2023
by Daily end-of-shift report 29 Jun '23

29 Jun '23

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 28-06-2023 18:00 − Donnerstag 29-06-2023 18:00 Handler: Robert Waldner Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Linux version of Akira ransomware targets VMware ESXi servers ∗∗∗ --------------------------------------------- The Akira ransomware operation uses a Linux encryptor to encrypt VMware ESXi virtual machines in double-extortion attacks against companies worldwide. --------------------------------------------- https://www.bleepingcomputer.com/news/security/linux-version-of-akira-ranso… ∗∗∗ Exploit released for new Arcserve UDP auth bypass vulnerability ∗∗∗ --------------------------------------------- Data protection vendor Arcserve has addressed a high-severity security flaw in its Unified Data Protection (UDP) backup software that can let attackers bypass authentication and gain admin privileges. --------------------------------------------- https://www.bleepingcomputer.com/news/security/exploit-released-for-new-arc… ∗∗∗ Security Baseline for M365 Apps for enterprise v2306 ∗∗∗ --------------------------------------------- Microsoft is pleased to announce the release of the recommended security configuration baseline settings for Microsoft 365 Apps for enterprise, version 2306. --------------------------------------------- https://techcommunity.microsoft.com/t5/microsoft-security-baselines/securit… ∗∗∗ GuLoader- or DBatLoader/ModiLoader-style infection for Remcos RAT, (Thu, Jun 29th) ∗∗∗ --------------------------------------------- On Monday 2023-06-26, I received an email in one of my honeypot accounts, and the email led to a loader-based infection for Remcos RAT. The loader seems to be a GuLoader- or ModiLoader (DBatLoader)-style malware, but it's not like the GuLoader or ModiLoader samples I've run across so far. --------------------------------------------- https://isc.sans.edu/diary/rss/29990 ∗∗∗ Fluhorse: Flutter-Based Android Malware Targets Credit Cards and 2FA Codes ∗∗∗ --------------------------------------------- Cybersecurity researchers have shared the inner workings of an Android malware family called Fluhorse. The malware "represents a significant shift as it incorporates the malicious components directly within the Flutter code," Fortinet FortiGuard Labs researcher Axelle Apvrille said in a report published last week. --------------------------------------------- https://thehackernews.com/2023/06/fluhorse-flutter-based-android-malware.ht… ∗∗∗ Finding Gadgets for CPU Side-Channels with Static Analysis Tools ∗∗∗ --------------------------------------------- We have recently begun research on using static analysis tools to find Spectre-v1 gadgets. During this research, we discovered two gadgets, one in do_prlimit (CVE-2023-0458) and one in copy_from_user (CVE-2023-0459). In this writeup, we explain these issues and how we found them. --------------------------------------------- https://github.com/google/security-research/blob/master/pocs/cpus/spectre-g… ∗∗∗ Verantwortungsvolle Veröffentlichung einer Exploit-Kette, die auf die Implementierung der RFC-Schnittstelle im SAP Application Server für ABAP abzielt ∗∗∗ --------------------------------------------- In einer unabhängigen Analyse der serverseitigen Implementierung der proprietären Remote Function Call (RFC)-Schnittstelle in SAP NetWeaver Application Server ABAP und ABAP Platform (beide im Folgenden als AS ABAP bezeichnet) wurden von Fabian Hagg, Sicherheitsforscher im SEC Consult Vulnerability Lab und SAP Security Experte, eine Reihe von schwerwiegenden Implementierungs- und Designfehlern identifiziert. --------------------------------------------- https://sec-consult.com/de/blog/detail/verantwortungsvolle-veroeffentlichun… ∗∗∗ Das können Sie tun, wenn Kriminelle Ihren Online-Shop kopieren ∗∗∗ --------------------------------------------- Fake-Shops bieten im Internet Markenprodukte zu Spottpreisen an. Kriminelle bauen dabei die echten Webseiten einfach nach, sodass die Fälschung auf den ersten Blick oft gar nicht ersichtlich ist. Wir zeigen Ihnen, was Sie tun können, wenn Ihr Online-Shop betroffen ist und wie Sie Ihre Kund:innen schützen können. --------------------------------------------- https://www.watchlist-internet.at/news/das-koennen-sie-tun-wenn-kriminelle-… ∗∗∗ CISA and NSA Release Joint Guidance on Defending Continuous Integration/Continuous Delivery (CI/CD) Environments ∗∗∗ --------------------------------------------- Recognizing the various types of security threats that could affect CI/CD operations and taking steps to defend against each one is critical in securing a CI/CD environment. Organizations will find in this guide a list of common risks found in CI/CD pipelines and attack surfaces that could be exploited and threaten network security. --------------------------------------------- https://www.cisa.gov/news-events/alerts/2023/06/28/cisa-and-nsa-release-joi… ∗∗∗ Detection, Containment, and Hardening Opportunities for Privileged Guest Operations, Anomalous Behavior, and VMCI Backdoors on Compromised VMware Hosts ∗∗∗ --------------------------------------------- In Mandiant’s initial publication of this vulnerability, we covered the attackers’ exploitation of CVE-2023-20867, the harvesting of ESXi service account credentials on vCenter machines, and the implications of backdoor communications over VMCI socket. In this blog post, we will focus on the artifacts, logging options, and hardening steps to detect and prevent the following tactics and techniques seen being used by UNC3886. --------------------------------------------- https://www.mandiant.com/resources/blog/vmware-detection-containment-harden… ∗∗∗ Introducing KBOM – Kubernetes Bill of Materials ∗∗∗ --------------------------------------------- SBOM (Software Bill of Materials) is an accepted best practice to map the components and dependencies of your applications in order to better understand your applications’ risks. SBOMs are used as a basis for vulnerability assessment, licensing compliance, and more. There are plenty of available tools, such as Aqua Trivy, that help you easily generate SBOM for your applications. --------------------------------------------- https://blog.aquasec.com/introducing-kbom-kubernetes-bill-of-materials ===================== = Vulnerabilities = ===================== ∗∗∗ Drupal Security advisories 2023-06-28 ∗∗∗ --------------------------------------------- Drupal released 7 new security advisories. (1x Critical, 5x Moderatly Critical, 1x Less Critical) --------------------------------------------- https://www.drupal.org/security ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (chromium and maradns), SUSE (iniparser, kubernetes1.23, python-reportlab, and python-sqlparse), and Ubuntu (accountsservice and linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-dell300x, linux-gcp, linux-gcp-4.15, linux-hwe, linux-kvm, linux-oracle, linux-raspi2, linux-snapdragon). --------------------------------------------- https://lwn.net/Articles/936752/ *** IBM Security Bulletins *** --------------------------------------------- AIX, IBM QRadar SIEM, WebSphere Application Server, IBM Security SOAR, IBM Cloud Pak, CICS, IBM SDK, IBM Tivoli, FileNet Content Manager, Db2 Graph, IBM OpenPages and IBM Semeru Runtime. --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ WebKitGTK and WPE WebKit Security Advisory WSA-2023-0005 ∗∗∗ --------------------------------------------- https://webkitgtk.org/security/WSA-2023-0005.html ∗∗∗ F5: K000135262 : Apache Tomcat vulnerability CVE-2023-28709 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000135262 ∗∗∗ Stable Channel Update for ChromeOS/ChromeOS Flex ∗∗∗ --------------------------------------------- http://chromereleases.googleblog.com/2023/06/stable-channel-update-for_28.h… ∗∗∗ [R1] Nessus Version 10.5.3 Fixes Multiple Vulnerabilities ∗∗∗ --------------------------------------------- https://www.tenable.com/security/tns-2023-22 ∗∗∗ Delta Electronics InfraSuite Device Master ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-180-01 ∗∗∗ Ovarro TBox RTUs ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-180-03 ∗∗∗ Mitsubishi Electric MELSEC-F Series ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-180-04 ∗∗∗ Medtronic Paceart Optima System ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-180-01 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily