Daily

daily@lists.cert.at

1 participants
3084 discussions

Tageszusammenfassung - 24.04.2023
by Daily end-of-shift report 24 Apr '23

24 Apr '23

===================== = End-of-Day report = ===================== Timeframe: Freitag 21-04-2023 18:00 − Montag 24-04-2023 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Decoy Dog malware toolkit found after analyzing 70 billion DNS queries ∗∗∗ --------------------------------------------- A new enterprise-targeting malware toolkit called Decoy Dog has been discovered after inspecting anomalous DNS traffic that is distinctive from regular internet activity. --------------------------------------------- https://www.bleepingcomputer.com/news/security/decoy-dog-malware-toolkit-fo… ∗∗∗ Open Source: Gelöschte Curl-Instanz zerschießt Windows-Updates ∗∗∗ --------------------------------------------- Auch wenn Security-Scanner vor ungepatchter Software warnen, sollten Windows-Systemkomponenten wie Curl nicht manipuliert werden. --------------------------------------------- https://www.golem.de/news/open-source-geloeschte-curl-instanz-zerschiesst-w… ∗∗∗ New All-in-One "EvilExtractor" Stealer for Windows Systems Surfaces on the Dark Web ∗∗∗ --------------------------------------------- A new "all-in-one" stealer malware named EvilExtractor (also spelled Evil Extractor) is being marketed for sale for other threat actors to steal data and files from Windows systems. "It includes several modules that all work via an FTP service," Fortinet FortiGuard Labs researcher Cara Lin said. --------------------------------------------- https://thehackernews.com/2023/04/new-all-in-one-evilextractor-stealer.html ∗∗∗ XWorm RAT: Avira-Sicherheitsexperten warnen vor Malware ∗∗∗ --------------------------------------------- Sicherheitsexperten von Avira warnen vor der Malware XWorm RAT --------------------------------------------- https://heise.de/-8976282 ∗∗∗ "Notstart" über CAN-Bus-Hack: Altes Nokia-Handy erlaubt Auto-Diebstahl per Klick ∗∗∗ --------------------------------------------- Der jüngst aufgezeigte CAN-Injection-Angriff auf das Bussystem Controller Area Network zieht weitere Kreise. Es tauchen immer mehr Kits zum "Notstarten" auf. --------------------------------------------- https://heise.de/-8976444 ∗∗∗ Bumblebee-Malware: Opfersuche mit Malvertising für trojanisierte Installer ∗∗∗ --------------------------------------------- IT-Forscher haben trojanisierte Installer für professionelle Software entdeckt. Sie würden mit Malvertising beworben und enthielten den Schädling Bumblebee. --------------------------------------------- https://heise.de/-8977016 ∗∗∗ Fake-Shops für Autoreifen boomen ∗∗∗ --------------------------------------------- Sie suchen im Internet nach günstigen Autoreifen? Nehmen Sie den Online-Shop genau unter die Lupe, es kursieren unzählige Fake-Shops! Die betrügerischen Shops wirken sehr professionell, haben ein Impressum und unschlagbare Preise. Wir zeigen Ihnen, wie Sie Shops überprüfen. --------------------------------------------- https://www.watchlist-internet.at/news/fake-shops-fuer-autoreifen-boomen/ ∗∗∗ TP-Link WAN-side Vulnerability CVE-2023-1389 Added to the Mirai Botnet Arsenal ∗∗∗ --------------------------------------------- Last week, the Zero Day Initiative (ZDI) threat-hunting team observed new exploit attempts coming from our telemetry system in Eastern Europe indicating that the Mirai botnet has updated its arsenal to include CVE-2023-1389, also known as ZDI-CAN-19557/ZDI-23-451. --------------------------------------------- https://www.thezdi.com/blog/2023/4/21/tp-link-wan-side-vulnerability-cve-20… ∗∗∗ Updates and Timeline for 3CX and X_Trader Hacks ∗∗∗ --------------------------------------------- Mandiant revealed this week that the hack of 3CX was actually a double supply-chain hack that first involved hacking and compromising another companys software. Heres a timeline of the events. --------------------------------------------- https://zetter.substack.com/p/updates-and-timeline-for-3cx-and ∗∗∗ Knapp zwei Drittel der XIoT-Schwachstellen remote ausnutzbar ∗∗∗ --------------------------------------------- Sicherheitstechnisch droht uns wohl ein Desaster - ich habe den State of XIoT Security Report: 2H 2022 von Claroty bereits einige Tage vorliegen. Dieser zeigt zwar die positiven Auswirkungen verstärkter Schwachstellen-Forschung und höheren Investitionen der Anbieter im Hinblick auf die XIoT-Sicherheit. Aber die Botschaft ist auch, dass Zahl der entdeckten Schwachstellen in diesem Bereit um 80 % zugenommen hat. Viele XIoT-Schwachstellen sind zudem remote ausnutzbar. --------------------------------------------- https://www.borncity.com/blog/2023/04/23/knapp-zwei-drittel-der-xiot-schwac… ∗∗∗ ViperSoftX Updates Encryption, Steals Data ∗∗∗ --------------------------------------------- We observed cryptocurrency and information stealer ViperSoftX evading initial loader detection and making its lure more believable by making the initial package loader via cracks, keygens, activators, and packers non-malicious. We also noted more sophisticated encryption and basic anti-analysis techniques, such as byte remapping and web browser communication blocking. --------------------------------------------- https://www.trendmicro.com/en_us/research/23/d/vipersoftx-updates-encryptio… ∗∗∗ Fortune 500 at Risk: 250M Artifacts Exposed via Misconfigured Registries ∗∗∗ --------------------------------------------- What if you were told that you had a misconfigured registry with hundreds of millions of software artifacts containing highly confidential and sensitive proprietary code and secrets exposed in your environment right now? This would be what you’d call a really bad day for security. Recently, the Aqua Nautilus research team found just that in some of the world’s largest organizations, including five Fortune 500 companies. --------------------------------------------- https://blog.aquasec.com/250m-artifacts-exposed-via-misconfigured-registries ===================== = Vulnerabilities = ===================== ∗∗∗ Vulnerability Spotlight: Vulnerabilities in IBM AIX could lead to command injection with elevated privileges ∗∗∗ --------------------------------------------- The issue could then allow the malicious actor to generate arbitrary logs which can trigger malicious commands to be run with elevated privileges. --------------------------------------------- https://blog.talosintelligence.com/vuln-spotlight-ibm-aix-privilege-escalat… ∗∗∗ APC warns of critical unauthenticated RCE flaws in UPS software ∗∗∗ --------------------------------------------- APCs Easy UPS Online Monitoring Software is vulnerable to unauthenticated arbitrary remote code execution, allowing hackers to take over devices and, in a worst-case scenario, disabling its functionality altogether. --------------------------------------------- https://www.bleepingcomputer.com/news/security/apc-warns-of-critical-unauth… ∗∗∗ Jetzt patchen! Angreifer attackieren Druck-Management-Lösung Papercut MF/NG ∗∗∗ --------------------------------------------- Eine kritische Sicherheitslücke gefährdet Systeme, auf denen Papercut läuft. Sicherheitsupdates sind verfügbar. --------------------------------------------- https://heise.de/-8976755 ∗∗∗ Solarwinds-Update dichtet zwei hochriskante Sicherheitslücken ab ∗∗∗ --------------------------------------------- Solarwinds stopft mit Software-Updates mehrere Sicherheitslücken, zwei davon gelten als hochriskant. IT-Verantwortliche sollten zügig aktualisieren. --------------------------------------------- https://heise.de/-8976832 ∗∗∗ Sicherheitspatches: Angreifer könnten Nvidia Cuda, DGX-1 & Co. attackieren ∗∗∗ --------------------------------------------- Nvidia hat wichtige Sicherheitsupdates für verschiedene Produkte veröffentlicht. Admins sollten schnell handeln. --------------------------------------------- https://heise.de/-8976961 ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (389-ds-base, chromium, connman, curl, redis, and thunderbird), Fedora (ceph, doctl, dr_libs, ffmpeg, freeimage, golang-github-digitalocean-godo, insight, libreswan, mingw-binutils, mingw-freeimage, mingw-freetype, openvswitch, rnp, suricata, webkitgtk, and wireshark), Mageia (dnsmasq, emacs, openimageio, php-smarty, redis, squirrel/supertux, and tcpdump), Red Hat (emacs), and SUSE (avahi, chromium, dmidecode, indent, jettison, openssl, openstack-cinder, openstack-nova, python-oslo.utils, and ovmf). --------------------------------------------- https://lwn.net/Articles/930052/ ∗∗∗ Multiple Vulnerabilities in Autodesk® InfraWorks® Software ∗∗∗ --------------------------------------------- Autodesk® InfraWorks® has been affected by multiple vulnerabilities detailed below. Exploitation of these vulnerabilities may lead to remote code execution and/or denial-of-service to the software and user devices. Hotfixes are available in the Autodesk Desktop App or the Accounts Portal to help resolve these vulnerabilities. --------------------------------------------- https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0007 ∗∗∗ ZDI-23-451: (Pwn2Own) TP-Link Archer AX21 merge_country_config Command Injection Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-23-451/ ∗∗∗ ZDI-23-452: (Pwn2Own) TP-Link AX1800 hotplugd Firewall Rule Race Condition Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-23-452/ ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 21.04.2023
by Daily end-of-shift report 21 Apr '23

21 Apr '23

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 20-04-2023 18:00 − Freitag 21-04-2023 18:00 Handler: Michael Schlagenhaufer Co-Handler: Robert Waldner ===================== = News = ===================== ∗∗∗ GhostToken Flaw Could Let Attackers Hide Malicious Apps in Google Cloud Platform ∗∗∗ --------------------------------------------- Cybersecurity researchers have disclosed details of a now-patched zero-day flaw in Google Cloud Platform (GCP) that could have enabled threat actors to conceal an unremovable, malicious application inside a victims Google account. --------------------------------------------- https://thehackernews.com/2023/04/ghosttoken-flaw-could-let-attackers.html ∗∗∗ Kubernetes RBAC Exploited in Large-Scale Campaign for Cryptocurrency Mining ∗∗∗ --------------------------------------------- A large-scale attack campaign discovered in the wild has been exploiting Kubernetes (K8s) Role-Based Access Control (RBAC) to create backdoors and run cryptocurrency miners. "The attackers also deployed DaemonSets to take over and hijack resources of the K8s clusters they attack," cloud security firm Aqua said in a report shared with The Hacker News. --------------------------------------------- https://thehackernews.com/2023/04/kubernetes-rbac-exploited-in-large.html ∗∗∗ VoIP-Anbieter 3CX: Die doppelte Supply-Chain-Attacke ∗∗∗ --------------------------------------------- Eine Analyse zeigt, dass die Verteilung des kompromittierten VoIP-Clients von 3CX auf einen vorausgehenden Lieferketten-Angriff zurückgeht. --------------------------------------------- https://heise.de/-8974948 ∗∗∗ CVE-2022-29844: A Classic Buffer Overflow on the Western Digital My Cloud Pro Series PR4100 ∗∗∗ --------------------------------------------- This post covers an exploit chain demonstrated by Luca Moro (@johncool__) during Pwn2Own Toronto 2022. At the contest, he used a classic buffer overflow to gain code execution on the My Cloud Pro Series PR4100 Network Attached Storage (NAS) device. He also displayed a nifty message on the device. --------------------------------------------- https://www.zerodayinitiative.com/blog/2023/4/19/cve-2022-29844-a-classic-b… ∗∗∗ GitHub Announces New Security Improvements ∗∗∗ --------------------------------------------- GitHub this week introduced NPM package provenance and deployment protection rules and announced general availability of private vulnerability reporting. --------------------------------------------- https://www.securityweek.com/github-announces-new-security-improvements/ ∗∗∗ Abandoned WordPress Plugin Abused for Backdoor Deployment ∗∗∗ --------------------------------------------- Attackers are installing the abandoned Eval PHP plugin on compromised WordPress sites to inject PHP code into web pages. --------------------------------------------- https://www.securityweek.com/abandoned-wordpress-plugin-abused-for-backdoor… ∗∗∗ Online-Händler:innen aufgepasst: Kriminelle machen Fake-Bestellungen und holen sich per SEPA-Lastschrift das Geld zurück ∗∗∗ --------------------------------------------- Mit vermeintlichen Bestellungen versuchen Kriminelle derzeit an das Geld von Online-Händler:innen zu kommen: Kriminellen bestellen „unabsichtlich“ zu viel, verlangen anschließend den bereits bezahlten Betrag von den Händler:innen zurück. Gleichzeitig nutzen die Betrüger:innen die Funktion der SEPA-Lastschrift, bei der Zahlungsanfechtungen in einem bestimmten Zeitraum automatisch anerkannt werden. --------------------------------------------- https://www.watchlist-internet.at/news/online-haendlerinnen-aufgepasst-krim… ===================== = Vulnerabilities = ===================== ∗∗∗ WebKitGTK and WPE WebKit Security Advisory WSA-2023-0003 ∗∗∗ --------------------------------------------- CVE identifiers: CVE-2023-25358, CVE-2022-0108, CVE-2022-32885, CVE-2023-27932, CVE-2023-27954, CVE-2023-28205. Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. --------------------------------------------- https://webkitgtk.org/security/WSA-2023-0003.html ∗∗∗ VMSA-2023-0007 ∗∗∗ --------------------------------------------- VMware Aria Operations for Logs contains a deserialization vulnerability. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8. --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2023-0007.html ∗∗∗ OpenSSL: Input buffer over-read in AES-XTS implementation on 64 bit ARM (CVE-2023-1255) ∗∗∗ --------------------------------------------- Severity: Low Issue summary: The AES-XTS cipher decryption implementation for 64 bit ARM platform contains a bug that could cause it to read past the input buffer, leading to a crash. --------------------------------------------- https://www.openssl.org/news/secadv/20230420.txt ∗∗∗ Kritische Lücken bedrohen Cisco Industrial Network Director und Modeling Labs ∗∗∗ --------------------------------------------- Es gibt wichtige Sicherheitsupdates für mehrere Cisco-Produkte. Zwei Schwachstellen gelten als kritisch. --------------------------------------------- https://heise.de/-8975027 ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (golang-1.11 and libxml2), Fedora (chromium, dr_libs, frr, ruby, and runc), Oracle (java-11-openjdk and java-17-openjdk), Red Hat (emacs, httpd and mod_http2, kpatch-patch, and webkit2gtk3), SUSE (libmicrohttpd, nodejs16, ovmf, and wireshark), and Ubuntu (kauth and patchelf). --------------------------------------------- https://lwn.net/Articles/929828/ ∗∗∗ CISA Adds Three Known Exploited Vulnerabilities to Catalog ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/alerts/2023/04/21/cisa-adds-three-known-ex… ∗∗∗ IBM InfoSphere DataStage Flow Designer is vulnerable to Server-Side Request Forgery ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6509084 ∗∗∗ Python is vulnerable to CVE-2022-26488 used in IBM Maximo Application Suite ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6985049 ∗∗∗ iText.jar in Tom Sawyer Perspective is vulnerable to XML External Entity ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6985225 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 20.04.2023
by Daily end-of-shift report 20 Apr '23

20 Apr '23

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 19-04-2023 18:00 − Donnerstag 20-04-2023 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Schwachstelle ermöglicht es Dieben, iPhones zu übernehmen ∗∗∗ --------------------------------------------- Über eine Sicherheitslücke verschaffen sich Kriminelle Zugang zu den Apple-IDs ihrer Opfer. --------------------------------------------- https://futurezone.at/produkte/schwachstelle-diebstahl-iphones-uebernehmen-… ∗∗∗ Goldoson Android Malware Infects Over 100 Million Google Play Store Downloads ∗∗∗ --------------------------------------------- hA new Android malware strain named Goldoson has been detected in the official Google Play Store spanning more than 60 legitimate apps that collectively have over 100 million downloads. [..] Following responsible disclosure to Google, 36 of the 63 offending apps have been pulled from the Google Play Store. The remaining 27 apps have been updated to remove the malicious library. --------------------------------------------- https://thehackernews.com/2023/04/goldoson-android-malware-infects-over.html ∗∗∗ The Huge 3CX Breach Was Actually 2 Linked Supply Chain Attacks ∗∗∗ --------------------------------------------- The mass compromise of the VoIP firms customers is the first confirmed incident where one software supply chain attack enabled another, researchers say. --------------------------------------------- https://www.wired.com/story/3cx-supply-chain-attack-times-two/ ∗∗∗ ‘AuKill’ EDR killer malware abuses Process Explorer driver ∗∗∗ --------------------------------------------- The AuKill tool abuses an outdated version of the driver used by version 16.32 of the Microsoft utility, Process Explorer, to disable EDR processes before deploying either a backdoor or ransomware on the target system. --------------------------------------------- https://news.sophos.com/en-us/2023/04/19/aukill-edr-killer-malware-abuses-p… ∗∗∗ Breaking Docker Named Pipes SYSTEMatically: Docker Desktop Privilege Escalation – Part 2 ∗∗∗ --------------------------------------------- In the previous blog post, we described how the Docker research started and showed how we could gain a full privilege escalation through a vulnerability in Docker Desktop. In this follow-up blog post, we will show the other vulnerable functions we were able to exploit. --------------------------------------------- https://www.cyberark.com/resources/threat-research-blog/breaking-docker-nam… ∗∗∗ Vermehrte Angriffe auf Cisco Router und Switche mit Cisco IOS und IOS-XE ∗∗∗ --------------------------------------------- Mehrere Sicherheitsbehörden und Cisco selbst warnen vor der gehäuften Ausnutzung alter Schwachstellen in Cisco IOS und IOS-XE. --------------------------------------------- https://heise.de/-8973626 ∗∗∗ Wordfence Intelligence Weekly WordPress Vulnerability Report (Apr 10, 2023 to Apr 16, 2023) ∗∗∗ --------------------------------------------- Last week, there were 69 vulnerabilities disclosed in 60 WordPress plugins and 4 WordPress themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 32 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected. --------------------------------------------- https://www.wordfence.com/blog/2023/04/wordfence-intelligence-weekly-wordpr… ∗∗∗ LockBit-Ransomware bereitet Angriffe auf Apple vor ∗∗∗ --------------------------------------------- Hacker haben ihre Malware offenbar weiterentwickelt und eine neue Variante in Umlauf gebracht, die es auf Apple-Computer abgesehen hat. --------------------------------------------- https://www.zdnet.de/88408574/lockbit-ransomware-bereitet-angriffe-auf-appl… ∗∗∗ CISA and Partners Release Cybersecurity Best Practices for Smart Cities ∗∗∗ --------------------------------------------- Today, CISA, NSA, FBI, NCSC-UK, ACSC, CCCS and NCSC-NZ released a joint guide: Cybersecurity Best Practices for Smart Cities. Smart cities may create safer, more efficient, resilient communities through technological innovation and data-driven decision making. However, this opportunity also introduces potential vulnerabilities and weaknesses that—if exploited—could impact national security, economic security, public health and safety, and critical infrastructure operations. --------------------------------------------- https://www.cisa.gov/news-events/alerts/2023/04/19/cisa-and-partners-releas… ===================== = Vulnerabilities = ===================== ∗∗∗ Drupal core - Moderately critical - Access bypass - SA-CORE-2023-005 ∗∗∗ --------------------------------------------- Security risk: Moderately critical The file download facility doesnt sufficiently sanitize file paths in certain situations. This may result in users gaining access to private files that they should not have access to.Some sites may require configuration changes following this security release. --------------------------------------------- https://www.drupal.org/sa-core-2023-005 ∗∗∗ Cisco Security Advisories Published on April 19, 2023 - 2 Critical, 2 High, 2 Medium ∗∗∗ --------------------------------------------- * StarOS Software Key-Based SSH Authentication Privilege Escalation Vulnerability * SD-WAN vManage Software Arbitrary File Deletion Vulnerability * TelePresence Collaboration Endpoint and RoomOS Arbitrary File Write Vulnerabilities * Industrial Network Director Vulnerabilities * Modeling Labs External Authentication Bypass Vulnerability * BroadWorks Network Server TCP Denial of Service Vulnerability --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/Search.x?publicationTypeIDs… ∗∗∗ Mehrere Schadcode-Lücken in Foxit PDF geschlossen ∗∗∗ --------------------------------------------- Wer Foxit PDF Reader oder PDF Editor unter Windows nutzt, ist angreifbar. --------------------------------------------- https://heise.de/-8974063 ∗∗∗ Stable Channel Update for Desktop ∗∗∗ --------------------------------------------- The Stable and extended stable channel has been updated to 112.0.5615.137/138 for Windows and 112.0.5615.137 for Mac and 112.0.5615.165 for Linux which will roll out over the coming days/weeks. [..] Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. --------------------------------------------- http://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desk… ∗∗∗ Blubrry Addresses Authenticated Stored XSS Vulnerability in PowerPress WordPress Plugin ∗∗∗ --------------------------------------------- On April 5, 2023, our Wordfence Threat Intelligence team identified and began the responsible disclosure process for a stored Cross-Site Scripting (XSS) vulnerability in Blubrry’s PowerPress plugin, which is actively installed on more than 50,000 WordPress websites. --------------------------------------------- https://www.wordfence.com/blog/2023/04/blubrry-addresses-authenticated-stor… ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (golang-1.11), Fedora (chromium, golang-github-cenkalti-backoff, golang-github-cli-crypto, golang-github-cli-gh, golang-github-cli-oauth, golang-github-gabriel-vasile-mimetype, libpcap, lldpd, parcellite, tcpdump, thunderbird, and zchunk), Red Hat (java-11-openjdk, java-17-openjdk, and kernel), SUSE (chromium, dnsmasq, ImageMagick, nodejs16, openssl-1_0_0, openssl1, ovmf, and python-Flask), and Ubuntu (dnsmasq, libxml2, linux, linux-aws, linux-aws-5.4, linux-azure, linu linux-raspi-5.4, linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15 linux-oracle, linux-raspi2, linux-oem-5.17, linux-oem-6.0, linux-oem-6.1, and linux-snapdragon). --------------------------------------------- https://lwn.net/Articles/929671/ ∗∗∗ Chromium: CVE-2023-2136 Integer overflow in Skia ∗∗∗ --------------------------------------------- This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information. Google is aware that an exploit for CVE-2023-2136 exists in the wild. --------------------------------------------- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-2136 ∗∗∗ Spring Boot 2.7.11 available now fixing CVE-2023-20873 ∗∗∗ --------------------------------------------- https://spring.io/blog/2023/04/20/spring-boot-2-7-11-available-now-fixing-c… ∗∗∗ Spring Boot 3.0.6 available now fixing CVE-2023-20873 ∗∗∗ --------------------------------------------- https://spring.io/blog/2023/04/20/spring-boot-3-0-6-available-now-fixing-cv… ∗∗∗ Security Vulnerabilities have been identifed in the IBM WebSphere Liberty product as shipped with the IBM Security Verify Access products. ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6953617 ∗∗∗ Unprivileged GPU access vulnerability - CVE-2013-5987 ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/864038 ∗∗∗ Multiple vulnerabilities found in third party libraries used by IBM\u00ae MobileFirst Platform ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6984763 ∗∗∗ Multiple Vulnerabilities in Apache Commons Compress affect WebSphere Application Server used by IBM Maximo Application Suite ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6984785 ∗∗∗ IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to Node.js npm module information disclosure (CVE-2022-29244) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6984799 ∗∗∗ IBM WebSphere Application Server shipped with IBM Security Access Manager for Enterprise Single Sign-On is vulnerable to a denial of service due to Apache Commons FileUpload (CVE-2023-24998) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6984945 ∗∗∗ Unprivileged GPU access vulnerability - CVE-2013-5987 ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/864038 ∗∗∗ IBM Security Verify Governance is vulnerable to sensitive information exposure (CVE-2021-31403) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6984957 ∗∗∗ IBM Security Verify Governance is vulnerable to denial of service and security bypass (CVE-2018-10237, CVE-2020-8908) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6984959 ∗∗∗ IBM Security Verify Governance is vulnerable to a denial of service (CVE-2022-42004, CVE-2022-42003) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6984967 ∗∗∗ IBM Security Verify Governance is vulnerable to sensitive information exposure and denial of service (CVE-2021-31403, CVE-2021-33609) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6984971 ∗∗∗ IBM Security Verify Governance is vulnerable to denial of service (CVE-2022-24839) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6984973 ∗∗∗ IBM Security Verify Governance is vulnerable to arbitrary code execution (CVE-2020-10650) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6984963 ∗∗∗ IBM Security Verify Governance is vulnerable to denial of service ( CVE-2023-24998) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6984969 ∗∗∗ Security vulnerability has been identified in WebSphere Application Server shipped with WebSphere Service Registry and Repository (CVE-2023-24998) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6984965 ∗∗∗ IBM Rational Build Forge is vulnerable and could allow an unauthenticated attacker to obtain sensitive information due to the use of JSSE component (CVE-2021-35603) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6984975 ∗∗∗ IBM App Connect Enterprise is vulnerable to a denial of service due to the ua-parser-js module (CVE-2022-25927) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6984987 ∗∗∗ Multiple vulnerabilities may affect IBM\u00ae SDK, Java\u2122 Technology Edition ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6839127 ∗∗∗ Multiple vulnerabilities may affect IBM\u00ae SDK, Java\u2122 Technology Edition ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6967213 ∗∗∗ CVE-2022-3676 may affect IBM\u00ae SDK, Java\u2122 Technology Edition ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6839777 ∗∗∗ IBM Rational Build Forge is vulnerable and could allow attacker to obtain sensitive information due to the use of JSSE component(CVE-2021-35550) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6985007 ∗∗∗ CVE-2023-30441 affects IBM\u00ae SDK, Java\u2122 Technology Edition ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6985011 ∗∗∗ AIX is vulnerable to arbitrary command execution (CVE-2023-26286) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6983236 ∗∗∗ INEA ME RTU ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-110-01 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 19.04.2023
by Daily end-of-shift report 19 Apr '23

19 Apr '23

===================== = End-of-Day report = ===================== Timeframe: Dienstag 18-04-2023 18:00 − Mittwoch 19-04-2023 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Critical Patch Update: Oracle kümmert sich um 433 Sicherheitslücken ∗∗∗ --------------------------------------------- Der Softwarehersteller Oracle hat für seine Anwendungen zahlreiche Sicherheitsupdates veröffentlicht. Einige Lücken gelten als kritisch. --------------------------------------------- https://heise.de/-8971485 ∗∗∗ Sicherheitsupdates: Dell sichert seit 2022 verwundbare Laptops erst jetzt ab ∗∗∗ --------------------------------------------- BIOS-Updates für unter anderem Dell-Modelle der Alienware- und Inspiron-Serien schließen zwei Sicherheitslücken. --------------------------------------------- https://heise.de/-8971821 ∗∗∗ Wenn alte Router Firmengeheimnisse preisgeben ∗∗∗ --------------------------------------------- Bei der Stilllegung ihrer alten Hardware schütten viele Unternehmen das Kind mit dem Bade aus. --------------------------------------------- https://www.welivesecurity.com/deutsch/2023/04/18/wenn-alte-router-firmenge… ∗∗∗ Hackers actively exploit critical RCE bug in PaperCut servers ∗∗∗ --------------------------------------------- Print management software developer PaperCut is warning customers to update their software immediately, as hackers are actively exploiting flaws to gain access to vulnerable servers. --------------------------------------------- https://www.bleepingcomputer.com/news/security/hackers-actively-exploit-cri… ∗∗∗ Zaraza Bot Targets Google Chrome to Extract Login Credentials ∗∗∗ --------------------------------------------- The data-stealing malware threatens the cyber safety of individual and organizational privacy by infecting a range of Web browsers. --------------------------------------------- https://www.darkreading.com/remote-workforce/zaraza-bot-targets-google-chro… ∗∗∗ SecurePwn Part 1: Bypassing SecurePoint UTM’s Authentication (CVE-2023-22620) ∗∗∗ --------------------------------------------- While working on a recent customer penetration test, I discovered two fascinating and somewhat weird bugs in SecurePoint’s UTM firewall solution. The first one, aka CVE-2023-22620, is rated critical for an attacker to bypass the entire authentication and gain access to the firewall’s administrative panel. [...] The second one, aka CVE-2023-22897 is a heartbleed-like bug that allows the leaking of remote memory contents and is discussed in a second blog post. --------------------------------------------- https://www.rcesecurity.com/2023/04/securepwn-part-1-bypassing-securepoint-… ∗∗∗ SecurePwn Part 2: Leaking Remote Memory Contents (CVE-2023-22897) ∗∗∗ --------------------------------------------- While my last finding affecting SecurePoint’s UTM was quite interesting already, I was hit by a really hard OpenSSL Heartbleed flashback with this one. [...] I’ve responsibly coordinated both vulnerabilities with the vendor SecurePoint and notified them about both issues on 5th January 2023. They did an amazing job acknowledging the vulnerability and providing a fix within a single business day. I barely see (hardware) vendors reacting so fast. Well done! --------------------------------------------- https://www.rcesecurity.com/2023/04/securepwn-part-2-leaking-remote-memory-… ∗∗∗ Threat Actors Rapidly Adopt Web3 IPFS Technology ∗∗∗ --------------------------------------------- Web3 technologies are seeing widespread adoption — including by TAs. We discuss Web3 technology InterPlanetary File System (IPFS), and malicious use of it. --------------------------------------------- https://unit42.paloaltonetworks.com/ipfs-used-maliciously/ ∗∗∗ Play Ransomware Group Using New Custom Data-Gathering Tools ∗∗∗ --------------------------------------------- Tools allow attackers to harvest data typically locked by the operating system. --------------------------------------------- https://symantec-enterprise-blogs.security.com/threat-intelligence/play-ran… ∗∗∗ Raspberry Robin: Anti-Evasion How-To & Exploit Analysis ∗∗∗ --------------------------------------------- During the last year, Raspberry Robin has evolved to be one of the most distributed malware currently active. During this time, it is likely to be used by many actors to distribute their own malware such as IcedID, Clop ransomware and more. --------------------------------------------- https://research.checkpoint.com/2023/raspberry-robin-anti-evasion-how-to-ex… ∗∗∗ Breaking Docker Named Pipes SYSTEMatically: Docker Desktop Privilege Escalation – Part 2 ∗∗∗ --------------------------------------------- In the previous blog post, we described how the Docker research started and showed how we could gain a full privilege escalation through a vulnerability in Docker Desktop. In this follow-up blog [...] --------------------------------------------- https://www.cyberark.com/resources/threat-research-blog/breaking-docker-nam… ∗∗∗ DDosia Project: How NoName057(16) is trying to improve the efficiency of DDoS attacks ∗∗∗ --------------------------------------------- NoName057(16) is still conducting DDoS attacks on the websites of institutions and companies in European countries. The new Go variant of bots implemented an authentication mechanism to communicate with C2 servers and their proxies. Moreover, the mechanism also provides IP address blocklisting, presumably to hinder the tracking of the project. --------------------------------------------- https://decoded.avast.io/martinchlumecky/ddosia-project-how-noname05716-is-… ===================== = Vulnerabilities = ===================== ∗∗∗ Webbrowser: Neue Zero-Day-Lücke in Google Chrome ∗∗∗ --------------------------------------------- Im Webbrowser Chrome greifen Cyberkriminelle eine neue Zero-Day-Lücke in freier Wildbahn an. Google verteilt Software-Updates, um die Lücke zu schließen. --------------------------------------------- https://heise.de/-8971427 ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (asterisk), Fedora (lldpd and openssh), Red Hat (curl, kernel, and openvswitch2.13), SUSE (compat-openssl098, glib2, grafana, helm, libgit2, openssl, and openssl-1_1), and Ubuntu (linux, linux-aws, linux-aws-5.15, linux-azure, linux-azure-5.15, linux-azure-fde, linux-gcp, linux-gcp-5.15, linux-gke, linux-gke-5.15, linux-gkeop, linux-ibm, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-oracle, linux-oracle-5.15, linux-raspi, linux, linux-aws, linux-azure, linux-gcp, linux-hwe-5.19, linux-kvm, linux-lowlatency, linux-oracle, linux-raspi, and vim). --------------------------------------------- https://lwn.net/Articles/929533/ ∗∗∗ Research by Positive Technologies helps to fix vulnerabilities in Nokia NetAct network management system ∗∗∗ --------------------------------------------- Nokia has fixed five vulnerabilities in Nokia NetAct found by Positive Technologies experts Vladimir Razov and Alexander Ustinov. Nokia NetAct is used by more than 500 communications service providers to monitor and control telecommunication networks, base stations, and other systems. The vendor was notified of the threat as part of standard responsible disclosure and has fixed the vulnerabilities in new versions of the software. --------------------------------------------- https://www.ptsecurity.com/ww-en/about/news/research-by-positive-technologi… ∗∗∗ WordPress plugin "LIQUID SPEECH BALLOON” vulnerable to cross-site request forgery ∗∗∗ --------------------------------------------- https://jvn.jp/en/jp/JVN99657911/ ∗∗∗ Oracle Critical Patch Update Advisory - April 2023 ∗∗∗ --------------------------------------------- https://www.oracle.com/security-alerts/cpuapr2023.html ∗∗∗ K000133390 : Apache Tomcat vulnerability CVE-2022-45143 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000133390 ∗∗∗ K000133547 : Python urllib3 vulnerability CVE-2020-26137 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000133547 ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 18.04.2023
by Daily end-of-shift report 18 Apr '23

18 Apr '23

===================== = End-of-Day report = ===================== Timeframe: Montag 17-04-2023 18:00 − Dienstag 18-04-2023 18:00 Handler: Stephan Richter Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Recycled Core Routers Exposed Sensitive Corporate Network Info ∗∗∗ --------------------------------------------- Researchers warn about a dangerous wave of unwiped, secondhand core-routers found containing corporate network configurations, credentials, and application and customer data. --------------------------------------------- https://www.darkreading.com/vulnerabilities-threats/recycled-core-routers-e… ∗∗∗ YouTube Videos Distributing Aurora Stealer Malware via Highly Evasive Loader ∗∗∗ --------------------------------------------- Cybersecurity researchers have detailed the inner workings of a highly evasive loader named "in2al5d p3in4er" (read: invalid printer) thats used to deliver the Aurora information stealer malware. --------------------------------------------- https://thehackernews.com/2023/04/youtube-videos-distributing-aurora.html ∗∗∗ Memory corruption in JCRE: An unpatchable HSM may swallow your private key ∗∗∗ --------------------------------------------- The key has always been a core target of security protection. Due to the limitation of key slots, most cryptocurrency hardware wallets use MCU chips (such as STM32F205RE) to implement. However, people who have higher security requirements to safeguarding the private keys are often interested in Java cards [...] --------------------------------------------- https://hardenedvault.net/blog/2023-04-18-java-card-runtime-memory-corrupti… ∗∗∗ Living Off the Land (LOTL) attacks: Detecting ransomware gangs hiding in plain sight ∗∗∗ --------------------------------------------- [...] In order to truly protect ourselves from RaaS gangs, we have to ‘peel back the onion’, so to speak, and get a closer look at how, exactly, they behave. If we know how RaaS gangs evade detection once in a network, for example, we may be able to kick them out before they can do any damage. One of the most concerning behaviors we’ve observed from RaaS gangs is their use of Living off the Land (LOTL) attacks, where attackers leverage legitimate tools to evade detection, steal data, and more. --------------------------------------------- https://www.malwarebytes.com/blog/business/2023/04/living-off-the-land-lotl… ∗∗∗ New Captcha Protected Phishing Attack Targets Access to Payroll Files ∗∗∗ --------------------------------------------- We have discovered a new phishing attack that specifically targets individuals who need access to payroll files through Microsoft Teams. --------------------------------------------- https://cyberwarzone.com/new-captcha-protected-phishing-attack-targets-acce… ∗∗∗ Sicherheitsupdates: Trend Micro Security macht Windows-PCs verwundbar ∗∗∗ --------------------------------------------- Es gibt ein wichtiges Update für die Anti-Viren-Anwendung Trend Micro Security für Windows. --------------------------------------------- https://heise.de/-8969449 ∗∗∗ US-Behörde: Schwachstelle in altem macOS wird für Angriffe ausgenutzt ∗∗∗ --------------------------------------------- Nach Informationen der Cyber-Sicherheitsbehörde gibt es Hinweise auf aktiv durchgeführte Angriffe. Für sehr alte Macs liegen keine Patches vor. --------------------------------------------- https://heise.de/-8970903 ∗∗∗ Kleinanzeigenbetrug: Vorsicht, wenn jemand per Scheck bezahlen möchte ∗∗∗ --------------------------------------------- Sie verkaufen ein Fahrrad auf Ländleanzeiger.at. Ein Interessent meldet sich und möchte es kaufen. Weil der Interessent gerade keinen Zugriff auf sein Bankkonto hat, möchte er es per Scheck bezahlen. Nach einigen Tagen kommt tatsächlich ein Scheck an – aber mit einem viel zu hohen Betrag. Vorsicht: Der Scheck ist Fake. Brechen Sie den Kontakt ab, Sie werden betrogen. --------------------------------------------- https://www.watchlist-internet.at/news/kleinanzeigenbetrug-vorsicht-wenn-je… ∗∗∗ Shodan Verified Vulns 2023-04-01 ∗∗∗ --------------------------------------------- Mit Stand 2023-04-01 sieht Shodan in Österreich die folgenden Schwachstellen: Dieses Monat stechen keine wirklich nennenswerten Veränderungen ins Auge. --------------------------------------------- https://cert.at/de/aktuelles/2023/4/shodan-verified-vulns-2023-04-01 ∗∗∗ APT28 Exploits Known Vulnerability to Carry Out Reconnaissance and Deploy Malware on Cisco Routers ∗∗∗ --------------------------------------------- APT28 accesses poorly maintained Cisco routers and deploys malware on unpatched devices using CVE-2017-6742. --------------------------------------------- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-108 ∗∗∗ Windows 10/11: Microsoft veröffentlicht Fix für OOBE-Bitlocker-Ausfall-Bug ∗∗∗ --------------------------------------------- Microsoft propagiert zwar Bitlocker zur Verschlüsselung von Laufwerken unter Windows. Aber es gibt immer wieder Bugs, die die Verschlüsselung verhindern oder Dritten unbefugten Zugriff auf verschlüsselte Laufwerke ermöglichen. Ein Microsoft Supporter hat jetzt einen Fall enthüllt, bei dem Bitlocker in der Out-of-the-Box (OOBE) Phase der Windows-Installation nicht aktiviert wird. --------------------------------------------- https://www.borncity.com/blog/2023/04/18/windows-10-11-microsoft-verffentli… ∗∗∗ Automating Qakbot Detection at Scale With Velociraptor ∗∗∗ --------------------------------------------- This blog offers a practical methodology to extract configuration data from recent Qakbot samples. --------------------------------------------- https://www.rapid7.com/blog/post/2023/04/18/automating-qakbot-detection-at-… ===================== = Vulnerabilities = ===================== ∗∗∗ Garrett: PSA: upgrade your LUKS key derivation function ∗∗∗ --------------------------------------------- [...] the LUKS1 header format, and the only KDF supported in this format is PBKDF2. This is not a memory expensive KDF, and so is vulnerable to GPU-based attacks. But even so, systems using the LUKS2 header format used to default to argon2i, again not a memory expensive KDF. New versions default to argon2id, which is. You want to be using argon2id. --------------------------------------------- https://lwn.net/Articles/929343/ ∗∗∗ New sandbox escape PoC exploit available for VM2 library, patch now ∗∗∗ --------------------------------------------- Security researchers have released yet another sandbox escape proof of concept (PoC) exploit that makes it possible to execute unsafe code on the host running the VM2 sandbox. [...] --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-sandbox-escape-poc-explo… ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (protobuf), Fedora (libpcap, libxml2, openssh, and tcpdump), Mageia (kernel and kernel-linus), Oracle (firefox, kernel, kernel-container, and thunderbird), Red Hat (thunderbird), Scientific Linux (thunderbird), SUSE (gradle, kernel, nodejs10, nodejs12, nodejs14, openssl-3, pgadmin4, rubygem-rack, and wayland), and Ubuntu (firefox). --------------------------------------------- https://lwn.net/Articles/929389/ ∗∗∗ Multiple critical vulnerabilities in Strapi versions <=4.7.1 ∗∗∗ --------------------------------------------- Strapi had multiple critical vulnerabilities that could be chained together to gain unauthenticated remote code execution. This is my public disclosure of the vulnerabilities i found in strapi, how they were patched and some nonsensical ramblings. --------------------------------------------- https://www.ghostccamm.com/blog/multi_strapi_vulns/ ∗∗∗ Hiding in Plain Sight: Cross-Site Scripting Vulnerabilities Patched in Weaver Products ∗∗∗ --------------------------------------------- https://www.wordfence.com/blog/2023/04/hiding-in-plain-sight-cross-site-scr… ∗∗∗ Omron CS/CJ Series ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-108-01 ∗∗∗ Spring Security 6.1.0-RC1, 6.0.3, 5.8.3 and 5.7.8 released, fix CVE-2023-20862 ∗∗∗ --------------------------------------------- https://spring.io/blog/2023/04/17/spring-security-6-1-0-rc1-6-0-3-5-8-3-and… ∗∗∗ Kubernetes kube-apiserver vulnerability ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6982927 ∗∗∗ IBM Sterling Order Management Golang Go Vulnerability ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/search?q=IBM%20Sterling%20Order%… ∗∗∗ Security Bulletin: Multiple vulnerabilities affect IBM Db2® REST ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6984199 ∗∗∗ IBM InfoSphere Information Server is affected by a vulnerability in libcurl (CVE-2022-32221) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6984203 ∗∗∗ Vulnerabilities in IBM Java included with IBM Tivoli Monitoring. ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6854647 ∗∗∗ Security Bulletin: A security vulnerability has been identified in WebSphere Application Server and Websphere Liberty shipped with IBM Security Guardium Key Lifecycle Manager (SKLM/GKLM) (CVE-2023-24998)) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6984345 ∗∗∗ Security Bulletin: The IBM® Engineering Requirements Management DOORS/DWA vulnerabilities fixes for 9.7.2.6 ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6984347 ∗∗∗ Vulnerabilities in Apache Shiro (CVE-2022-40664) and Apache Commons FileUpload (CVE-2023-24998) affect IBM WebSphere Service Registry and Repository. ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6962169 ∗∗∗ Security Bulletin: Multiple vulnerabilities affect IBM Db2® REST ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6984413 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 17.04.2023
by Daily end-of-shift report 17 Apr '23

17 Apr '23

===================== = End-of-Day report = ===================== Timeframe: Freitag 14-04-2023 18:00 − Montag 17-04-2023 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Juice Jacking: FBI warnt ohne Anlass vor öffentlichen USB-Ladestationen ∗∗∗ --------------------------------------------- Angreifer könnten USB-Ladestationen an Flughäfen & Co. kompromittieren, um so Malware auf Smartphones zu schieben. Das ist jedoch nicht wirklich aktuell. --------------------------------------------- https://heise.de/-8966067 ∗∗∗ Zero-Day: Pinduoduo konnte Daten stehlen und Malware installieren ∗∗∗ --------------------------------------------- Die chinesische Android-App Pinduoduo konnte eine Zero-Day-Lücke in Android missbrauchen. Die CISA mahnt zum Anwenden des Android-Updates. --------------------------------------------- https://heise.de/-8968204 ∗∗∗ Sonderupdate: Google Chrome 112.0.5615.121 und Edge 112.0.1722.48 ∗∗∗ --------------------------------------------- Google hat zum 14. April 2023 außerplanmäßig Updates des Google Chrome Browsers 112 im Extended und Stable Channel für Mac, Linux und Windows freigegeben. Microsoft hat gleichzeitig den Edge Version 112 aktualisiert. Es sind Sicherheitsupdates, welche die als hoch eingestufte Schwachstelle CVE-2023-2033 schließen. --------------------------------------------- https://www.borncity.com/blog/2023/04/16/google-chrome-112-0-5615-121-sonde… ∗∗∗ Dating: Auf live-treffen.com & royacca.com chatten Sie kostenpflichtig mit Fake-Profilen ∗∗∗ --------------------------------------------- Auf den Dating-Plattformen live-treffen.com & royacca.com finden Sie schnell interessante Menschen. Ob es sich dabei um echte Personen handelt, ist unklar, denn die Plattformen nutzen „professionelle Animateure“, die mit Ihnen chatten. Das Problem dabei: Jede Nachricht kostet und Sie wissen nicht, ob Sie mit echten oder fiktiven Profilen schreiben. --------------------------------------------- https://www.watchlist-internet.at/news/dating-auf-live-treffencom-royaccaco… ∗∗∗ Android malware infiltrates 60 Google Play apps with 100M installs ∗∗∗ --------------------------------------------- A new Android malware named Goldoson has infiltrated the platforms official app store, Google Play, through 60 apps that collectively have 100 million downloads. --------------------------------------------- https://www.bleepingcomputer.com/news/security/android-malware-infiltrates-… ∗∗∗ Hackers start abusing Action1 RMM in ransomware attacks ∗∗∗ --------------------------------------------- Security researchers are warning that cybercriminals are increasingly using the Action1 remote access software for persistence on compromised networks and to execute commands, scripts, and binaries. --------------------------------------------- https://www.bleepingcomputer.com/news/security/hackers-start-abusing-action… ∗∗∗ QBot banker delivered through business correspondence ∗∗∗ --------------------------------------------- In early April, we detected a significant increase in attacks that use banking Trojans of the QBot family (aka QakBot, QuackBot, and Pinkslipbot). The malware would be delivered through e-mails that were based on real business letters the attackers had gotten access to. --------------------------------------------- https://securelist.com/qbot-banker-business-correspondence/109535/ ∗∗∗ FIN7 and Ex-Conti Cybercrime Gangs Join Forces in Domino Malware Attacks ∗∗∗ --------------------------------------------- A new strain of malware developed by threat actors likely affiliated with the FIN7 cybercrime group has been put to use by the members of the now-defunct Conti ransomware gang, indicating collaboration between the two crews. The malware, dubbed Domino, is primarily designed to facilitate follow-on exploitation on compromised systems, including delivering a lesser-known information stealer [...] --------------------------------------------- https://thehackernews.com/2023/04/fin7-and-ex-conti-cybercrime-gangs-join.h… ∗∗∗ Bypassing Windows Defender (10 Ways) ∗∗∗ --------------------------------------------- In this article I will be explaining 10 ways/techniques to bypass a fully updated Windows system with up-to-date Windows Defender intel in order to execute unrestricted code (other than permissions/ACLs, that is). --------------------------------------------- https://www.fo-sec.com/articles/10-defender-bypass-methods ∗∗∗ LockBit Ransomware Group Developing Malware to Encrypt Files on macOS ∗∗∗ --------------------------------------------- The LockBit ransomware gang is developing malware designed to encrypt files on macOS systems and researchers have analyzed if it poses a real threat. --------------------------------------------- https://www.securityweek.com/lockbit-ransomware-group-developing-malware-to… ∗∗∗ Trigona Ransomware Attacking MS-SQL Servers ∗∗∗ --------------------------------------------- AhnLab Security Emergency response Center (ASEC) has recently discovered the Trigona ransomware being installed on poorly managed MS-SQL servers. Trigona is a relatively recent ransomware that was first discovered in October 2022, and Unit 42 has recently published a report based on the similarity between Trigona and the CryLock ransomware. --------------------------------------------- https://asec.ahnlab.com/en/51343/ ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (chromium, rails, and ruby-rack), Fedora (firefox, ghostscript, libldb, samba, and tigervnc), Mageia (ceph, davmail, firefox, golang, jpegoptim, libheif, python-certifi, python-flask-restx, thunderbird, and tomcat), Oracle (firefox), Red Hat (firefox), Scientific Linux (firefox), SUSE (apache2-mod_auth_openidc, aws-nitro-enclaves-cli, container-suseconnect, firefox, golang-github-prometheus-prometheus, harfbuzz, java-1_8_0-ibm, kernel, liblouis, php7, tftpboot-installation images, tomcat, and wayland), and Ubuntu (chromium-browser, imagemagick, kamailio, and libreoffice). --------------------------------------------- https://lwn.net/Articles/929303/ ∗∗∗ K000133522 : Apache mod_proxy_wstunnel vulnerability CVE-2019-17567 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000133522?utm_source=f5support&utm_medi… ∗∗∗ Microsoft Defender Security Feature Bypass Vulnerability ∗∗∗ --------------------------------------------- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24934 ∗∗∗ Vulnerabilities in Samba shipped with IBM OS Image for Red Hat Enterprise Linux System (CVE-2022-32742) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6983851 ∗∗∗ IBM Workload Scheduler potentially affected by a vulnerability found in Json-smart library (CVE-2023-1370) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6984157 ∗∗∗ There is a security vulnerability in Node.js http-cache-semantics module used by IBM Maximo for Civil Infrastructure in Maximo Application Suite (CVE-2022-25881) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6984165 ∗∗∗ IBM Cloud Pak for Network Automation 2.4.5 addresses multiple security vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6984171 ∗∗∗ IBM Db2\u00ae Graph is vulnerable to remote execution of arbitrary commands due to Node.js CVE-2022-43548 ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6984185 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 14.04.2023
by Daily end-of-shift report 14 Apr '23

14 Apr '23

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 13-04-2023 18:00 − Freitag 14-04-2023 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ VoIP-Software von 3CX: Erste Analyse-Ergebnisse ∗∗∗ --------------------------------------------- 3CX hat erste Ergebnisse der IT-Sicherheitsspezialisten von Mandiant bezüglich des Einbruchs und Lieferkettenangriffs auf die VoIP-Software herausgegeben. --------------------------------------------- https://heise.de/-8962595 ∗∗∗ Netzwerkausrüster Juniper verteilt viele Sicherheits-Aktualisierungen ∗∗∗ --------------------------------------------- In diversen Produkten des Netzwerkausrüsters Juniper klaffen Sicherheitslücken, die der Hersteller mit Updates schließt. Sie sollten zügig installiert werden. --------------------------------------------- https://heise.de/-8951334 ∗∗∗ Jetzt patchen! QueueJumper-Lücke gefährdet hunderttausende Windows-Systeme ∗∗∗ --------------------------------------------- Sicherheitsforscher haben nach weltweiten Scans über 400.000 potenziell angreifbare Windows-Systeme entdeckt. Sicherheitspatches sind verfügbar. --------------------------------------------- https://heise.de/-8961420 ∗∗∗ Passwortschutz umgehbar: Drupal-Modul Protected Pages verwundbar ∗∗∗ --------------------------------------------- Angreifer könnten auf eigentlich durch Passwörter abgeschottete Drupal-Websites zugreifen. Ein Sicherheitsupdate ist verfügbar. --------------------------------------------- https://heise.de/-8959518 ∗∗∗ Cloudflare: Botnetzwerke setzen auf gehackte VPS statt auf IoT ∗∗∗ --------------------------------------------- Laut Cloudflare setzen Botnetze auf gehackte Virtual Private Server (VPS), beispielsweise von Start-ups, die deutlich mehr Leistung für DDoS-Angriffe bieten. --------------------------------------------- https://www.golem.de/news/cloudflare-botnetzwerke-setzen-auf-gehackte-vps-s… ∗∗∗ HTTP: Whats Left of it and the OCSP Problem, (Thu, Apr 13th) ∗∗∗ --------------------------------------------- It has been well documented that most "web" traffic these days uses TLS, either as traditional HTTPS or the more modern QUIC protocol. So it is always interesting to see what traffic remains as HTTP. --------------------------------------------- https://isc.sans.edu/diary/rss/29744 ∗∗∗ How to Set Up a Content Security Policy (CSP) in 3 Steps ∗∗∗ --------------------------------------------- What is a Content Security Policy (CSP)? A Content Security Policy (CSP) is a security feature used to help protect websites and web apps from clickjacking, cross-site scripting (XSS), and other malicious code injection attacks. At the most basic level, a CSP is a set of rules that restricts or green lights what content loads onto your website. It is a widely-supported security standard recommended to anyone who operates a website. --------------------------------------------- https://blog.sucuri.net/2023/04/how-to-set-up-a-content-security-policy-csp… ∗∗∗ RTM Locker: Emerging Cybercrime Group Targeting Businesses with Ransomware ∗∗∗ --------------------------------------------- Cybersecurity researchers have detailed the tactics of a "rising" cybercriminal gang called "Read The Manual" (RTM) Locker that functions as a private ransomware-as-a-service (RaaS) provider and carries out opportunistic attacks to generate illicit profit. --------------------------------------------- https://thehackernews.com/2023/04/rtm-locker-emerging-cybercrime-group.html ∗∗∗ Google, CISA Warn of Android Flaw After Reports of Chinese App Zero-Day Exploitation ∗∗∗ --------------------------------------------- The Android vulnerability CVE-2023-20963, reportedly exploited as a zero-day by a Chinese app against millions of devices, was added to CISA’s KEV catalog. --------------------------------------------- https://www.securityweek.com/google-cisa-warn-of-android-flaw-after-reports… ∗∗∗ Automating Qakbot decode at scale ∗∗∗ --------------------------------------------- This is a technical post covering methodology to extract configuration data from recent Qakbot samples. I will provide background on Qakbot, walk through decode themes in an easy to visualize manner. I will then share a Velociraptor artifact to detect and automate the decode process at scale. --------------------------------------------- https://www.rapid7.com/blog/post/2023/04/14/automating-qakbot-decode/ ===================== = Vulnerabilities = ===================== ∗∗∗ CISA Releases Sixteen Industrial Control Systems Advisories ∗∗∗ --------------------------------------------- CISA released sixteen Industrial Control Systems (ICS) advisories on April 13, 2023. * B. Braun Battery Pack SP with Wi-Fi * 13x Siemens * Datakit CrossCAD-WARE * Mitsubishi Electric GOC35 Series --------------------------------------------- https://www.cisa.gov/news-events/alerts/2023/04/13/cisa-releases-sixteen-in… ∗∗∗ Advisory SA23P002: Several Issues in B&R VC4 Visualization ∗∗∗ --------------------------------------------- An unauthenticated network-based attacker who successfully exploits these vulnerabilities could bypass the authentication mechanism of the VC4 visualization, read stack memory or execute code on an affected device. --------------------------------------------- https://www.br-automation.com/downloads_br_productcatalogue/assets/16810468… ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (haproxy and openvswitch), Fedora (bzip3, libyang, mingw-glib2, thunderbird, xorg-x11-server, and xorg-x11-server-Xwayland), and Ubuntu (apport, ghostscript, linux-bluefield, node-thenify, and python-flask-cors). --------------------------------------------- https://lwn.net/Articles/929107/ ∗∗∗ Cross-Site Scripting in Timesheet Tracking for Jira (SYSS-2022-050) ∗∗∗ --------------------------------------------- Über Cross-Site Scripting-Schwachstellen im Plug-in "Timesheet Tracking for Jira" kann Schadcode eingebaut werden, der von allen Besuchern ausgeführt wird. --------------------------------------------- https://www.syss.de/pentest-blog/cross-site-scripting-in-timesheet-tracking… ∗∗∗ CPE2023-001 – Regarding vulnerabilities for Office/Small Office Multifunction Printers, Laser Printers and Inkjet Printers – 14 April 2023 ∗∗∗ --------------------------------------------- Several vulnerabilities have been identified for certain Office/Small Office Multifunction Printers, Laser Printers and Inkjet Printers. --------------------------------------------- https://www.canon-europe.com/support/product-security-latest-news/ ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 13.04.2023
by Daily end-of-shift report 13 Apr '23

13 Apr '23

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 12-04-2023 18:00 − Donnerstag 13-04-2023 18:00 Handler: Stephan Richter Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ (Gepatchte aber dennoch) üble Sicherheitslücke in (einer optionalen Komponente von) Microsoft Windows ∗∗∗ --------------------------------------------- Es entbehrt nicht einer gewissen Ironie, dass die meisten Blogeinträge, welche sich in den letzten Monaten mit Sicherheitslücken in Produkten von Microsoft beschäftigt haben, von dem Mitarbeiter des CERT stammen, dessen Kenntnisse rund um Windows, Office und den ganzen Rest wohl mit Abstand am schwächsten sind - und damit herzlich willkommen zu einem weiteren Beitrag, welcher diese Kriterien vollständig erfüllt. --------------------------------------------- https://cert.at/de/blog/2023/4/gepatchte-aber-dennoch-uble-sicherheitslucke… ∗∗∗ NTP-Schwachstelle: Offenbar weniger bedrohlich als zunächst vermutet ∗∗∗ --------------------------------------------- Entwarnung: Nach der BSI-Warnung vor einer kritischen Lücke in NTP kommen IT-Experten bei der Analyse auf eine geringere Bedrohung. NTP will Patches liefern. --------------------------------------------- https://heise.de/-8949340 ∗∗∗ Uncommon infection methods—part 2 ∗∗∗ --------------------------------------------- Kaspersky researchers discuss infection methods used by Mirai-based RapperBot, Rhadamantys stealer, and CUEMiner: smart brute forcing, malvertising, and distribution through BitTorrent and OneDrive. --------------------------------------------- https://securelist.com/crimeware-report-uncommon-infection-methods-2/109522/ ∗∗∗ New Python-Based "Legion" Hacking Tool Emerges on Telegram ∗∗∗ --------------------------------------------- An emerging Python-based credential harvester and a hacking tool named Legion is being marketed via Telegram as a way for threat actors to break into various online services for further exploitation. --------------------------------------------- https://thehackernews.com/2023/04/new-python-based-legion-hacking-tool.html ∗∗∗ Indirect Prompt Injection Threats ∗∗∗ --------------------------------------------- If allowed by the user, Bing Chat can see currently open websites. We show that an attacker can plant an injection in a website the user is visiting, which silently turns Bing Chat into a Social Engineer who seeks out and exfiltrates personal information. The user doesnt have to ask about the website or do anything except interact with Bing Chat while the website is opened in the browser. --------------------------------------------- https://greshake.github.io/ ∗∗∗ Malware Disguised as Document from Ukraines Energoatom Delivers Havoc Demon Backdoor ∗∗∗ --------------------------------------------- [...] FortiGuard Labs has encountered a malicious spoofed document pretending to be from the Ukrainian company, Energoatom, a state-owned enterprise that operates Ukraine’s nuclear power plants. [...] Aside from highlighting the technical details of this latest multi-staged attack [...] this article also discusses some strange artifacts that make us think this could be a work-in-progress or part of a red-team exercise. --------------------------------------------- https://www.fortinet.com/blog/threat-research/malware-disguised-as-document… ∗∗∗ BSI-Studie: Gängige Mikrocontroller sind für Hardware-Angriffe anfällig ∗∗∗ --------------------------------------------- Bei Hardware-Sicherheitstoken und Krypto-Wallets, smarten Schlössern und Kassensystemen haben Hacker leichtes Spiel, warnen Fraunhofer-Forscher im BSI-Auftrag. --------------------------------------------- https://heise.de/-8949244 ∗∗∗ Vorsicht vor Fake Urlaubsangeboten! ∗∗∗ --------------------------------------------- Die Urlaubszeit rückt langsam aber sicher näher, das treibt auch Kriminelle auf den Plan. Betrügerische Anbieter wie Kofi Vermittlung (kofireisen.com) versuchen Sie mit angeblich günstigen Angeboten abzuzocken! Achten Sie bei der Urlaubsbuchung auf folgende Warnsignale für entspannte Ferien statt einer Kostenfalle! --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-vor-fake-urlaubsangeboten/ ∗∗∗ Vice Society: A Tale of Victim Data Exfiltration via PowerShell, aka Stealing off the Land ∗∗∗ --------------------------------------------- The Vice Society ransomware gang exfiltrated victim network data using a custom Microsoft PowerShell script. We dissect how each function of it works. --------------------------------------------- https://unit42.paloaltonetworks.com/vice-society-ransomware-powershell/ ===================== = Vulnerabilities = ===================== ∗∗∗ Softwareentwicklung: Jenkins-Plug-ins verwundbar, viele Updates stehen noch aus ∗∗∗ --------------------------------------------- Software-Entwicklungsumgebungen mit Jenkins sind attackierbar. Bislang sind nur wenige betroffene Plug-ins abgesichert. --------------------------------------------- https://heise.de/-8949204 ∗∗∗ Sicherheitsupdates: Netzwerkanalysetool Wireshark anfällig für DoS-Attacken ∗∗∗ --------------------------------------------- Die Wireshark-Entwickler haben zwei neue Versionen des Tools veröffentlicht. Darin haben sie unter anderem drei Sicherheitslücken geschlossen. --------------------------------------------- https://heise.de/-8949661 ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (chromium, firefox-esr, lldpd, and zabbix), Fedora (ffmpeg, firefox, pdns-recursor, polkit, and thunderbird), Oracle (kernel and nodejs:14), Red Hat (nodejs:14, openvswitch2.17, openvswitch3.1, and pki-core:10.6), Slackware (mozilla), SUSE (nextcloud-desktop), and Ubuntu (exo, linux, linux-kvm, linux-lts-xenial, linux-aws, smarty3, and thunderbird). --------------------------------------------- https://lwn.net/Articles/928976/ ∗∗∗ Windows 7/Server 2008 R2; Server 2012 R2: Updates (11. April 2023) ∗∗∗ --------------------------------------------- Zum 11. April 2023 wurden diverse Sicherheitsupdates für Windows Server 2008 R2 (im 4. ESU Jahr) sowie für Windows Server 2012/R2 veröffentlicht (die Updates lassen sich ggf. auch noch unter Windows 7 SP1). --------------------------------------------- https://www.borncity.com/blog/2023/04/13/windows-7-server-2008-r2-server-20… ∗∗∗ Patchday: Microsoft Office Updates (11. April 2023) ∗∗∗ --------------------------------------------- Am 11. April 2023 (zweiter Dienstag im Monat, Microsoft Patchday) hat Microsoft mehrere sicherheitsrelevante Updates für noch unterstützte Microsoft Office Versionen und andere Produkte veröffentlicht. Mit dem April 2023-Patchday endet der Support für Office 2013. --------------------------------------------- https://www.borncity.com/blog/2023/04/13/patchday-microsoft-office-updates-… ∗∗∗ Drupal: Protected Pages - Critical - Access bypass - SA-CONTRIB-2023-013 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2023-013 ∗∗∗ Critical Vulnerability in Hikvision Storage Solutions Exposes Video Security Data ∗∗∗ --------------------------------------------- https://www.securityweek.com/critical-vulnerability-in-hikvision-storage-so… ∗∗∗ Mattermost security updates 7.9.2 / 7.8.3 (ESR) / 7.7.4 / 7.1.8 (ESR) released ∗∗∗ --------------------------------------------- https://mattermost.com/blog/mattermost-security-updates-7-9-2-7-8-3-esr-7-7… ∗∗∗ Multiple Vulnerabilities in the Autodesk® AutoCAD® Desktop Software ∗∗∗ --------------------------------------------- https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0005 ∗∗∗ MISP 2.4.170 released with new features, workflow improvements and bugs fixed ∗∗∗ --------------------------------------------- https://github.com/MISP/MISP/releases/tag/v2.4.170 ∗∗∗ CVE-2023-0004 PAN-OS: Local File Deletion Vulnerability (Severity: MEDIUM) ∗∗∗ --------------------------------------------- https://security.paloaltonetworks.com/CVE-2023-0004 ∗∗∗ CVE-2023-0005 PAN-OS: Exposure of Sensitive Information Vulnerability (Severity: MEDIUM) ∗∗∗ --------------------------------------------- https://security.paloaltonetworks.com/CVE-2023-0005 ∗∗∗ CVE-2023-0006 GlobalProtect App: Local File Deletion Vulnerability (Severity: MEDIUM) ∗∗∗ --------------------------------------------- https://security.paloaltonetworks.com/CVE-2023-0006 ∗∗∗ Spring Framework 6.0.8, 5.3.27 and 5.2.24.RELEASE fix cve-2023-20863 ∗∗∗ --------------------------------------------- https://spring.io/blog/2023/04/13/spring-framework-6-0-8-5-3-27-and-5-2-24-… ∗∗∗ B. Braun Battery Pack SP with Wi-Fi ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-103-01 ∗∗∗ DataPower Operations Dashboard vulnerable to multiple CVEs ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6983234 ∗∗∗ AIX is vulnerable to arbitrary command execution due to invscout (CVE-2023-28528) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6983232 ∗∗∗ AIX is vulnerable to arbitrary command execution (CVE-2023-26286) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6983236 ∗∗∗ Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak. ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6983270 ∗∗∗ A CVE-2021-28165 vulnerability in Eclipse Jetty affects IBM Process Designer 8.5.7 shipped with IBM Business Automation Workflow ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6983272 ∗∗∗ Multiple security vulnerabilities has been identified in IBM WebSphere Application Server shipped with Tivoli Netcool\/OMNIbus WebGUI - January 2023 CPU plus deferred CVE-2022-21426 ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6983454 ∗∗∗ A security vulnerability has been identified in IBM WebSphere Application Server shipped with Tivoli Netcool\/OMNIbus WebGUI (CVE-2023-24998) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6983456 ∗∗∗ IBM Maximo Asset Management is vulnerable to HTML injection (CVE-2023-27864) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6983460 ∗∗∗ IBM Security Verify Governance is vulnerable to remote attacks to execute arbitrary code on the system [CVE-2013-4521, CVE-2013-2165 and CVE-2018-14667] ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6983480 ∗∗∗ IBM Security Verify Governance is vulnerable to a denial of service caused by multiple vulnerabilities. ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6983482 ∗∗∗ IBM App Connect Enterprise Certified Container DesignerAuthoring operands may be vulnerable to denial of service due to [CVE-2022-37603] ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6983484 ∗∗∗ A security vulnerability has been identified in IBM WebSphere Application Server and IBM WebSphere Application Server Liberty profile shipped with IBM Business Automation Workflow (CVE-2023-24998) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6983486 ∗∗∗ A vulnerability has been identified in IBM WebSphere Application Server Liberty profile shipped with IBM Business Automation Workflow (CVE-2023-0482) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6983490 ∗∗∗ A vulnerability has been identified in IBM WebSphere Application Server traditional and Liberty profile shipped with IBM Business Automation Workflow (IBM\u00ae Java SDK CPU January 2023) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6983492 ∗∗∗ AIX is vulnerable to arbitrary command execution (CVE-2023-26286) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6983236 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 12.04.2023
by Daily end-of-shift report 12 Apr '23

12 Apr '23

===================== = End-of-Day report = ===================== Timeframe: Dienstag 11-04-2023 18:00 − Mittwoch 12-04-2023 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Patchday: Angreifer infizieren Windows mit Nokoyawa-Ransomware ∗∗∗ --------------------------------------------- Microsoft hat wichtige Sicherheitsupdates für etwa Azure, Dynamics 365 und Windows veröffentlicht. --------------------------------------------- https://heise.de/-8935888 ∗∗∗ BSI warnt vor kritischen Zero-Day-Lücken im NTP-Server ∗∗∗ --------------------------------------------- Ein IT-Forscher hat fünf Sicherheitslücken im Zeitserver NTP gemeldet. Das BSI stuft die Lücken als kritisch ein. Ein Update steht bislang noch nicht bereit. --------------------------------------------- https://heise.de/-8948528 ∗∗∗ Warten auf Sicherheitspatches: BIOS-Lücken gefährden Lenovo-Laptops ∗∗∗ --------------------------------------------- Angreifer könnten Lenovo-Laptops attackieren und im schlimmsten Fall Schadcode ausführen. Updates sind noch nicht verfügbar. --------------------------------------------- https://heise.de/-8948481 ∗∗∗ Phishing-Alarm: „New Fax Document(s) has been received” ∗∗∗ --------------------------------------------- Derzeit werden willkürlich E-Mails an Unternehmen versendet, in denen behauptet wird, dass die Empfänger:innen ein neues Fax-Dokument erhalten hätten. Um das Dokument anzusehen, muss ein Link angeklickt werden. Achtung: Kriminelle versuchen das Microsoft-Konto der betroffenen Mitarbeiter:innen zu kapern. --------------------------------------------- https://www.watchlist-internet.at/news/phishing-alarm-new-fax-documents-has… ∗∗∗ Abo-Falle statt Kaffeemaschinen-Gewinnspiel im Namen von MediaMarkt ∗∗∗ --------------------------------------------- Auf Facebook wird ein betrügerisches Gewinnspiel im Namen von MediaMarkt durch Kriminelle beworben. Versprochen werden Kaffeemaschinen von DeLonghi für nur 1,95 Euro wegen einer angeblichen Vertragsauflösung zwischen dem Hersteller und MediaMarkt. Tatsächlich landen Sie hier aber in einer teuren Abo-Falle. Die Kaffeemaschinen gibt es nicht. --------------------------------------------- https://www.watchlist-internet.at/news/abo-falle-statt-kaffeemaschinen-gewi… ∗∗∗ Remote Code Execution (RCE) in Hashicorp Vault ∗∗∗ --------------------------------------------- Hashicorp's Vault is a secure, open-source secrets management tool that stores and provides access to sensitive information like API keys, passwords, and certificates. This vulnerability, in certain conditions, allows attackers to execute code remotely on the target system through a SQL injection attack. --------------------------------------------- https://www.oxeye.io/blog/rce-through-sql-injection-vulnerability-in-hashic… ∗∗∗ Hacked sites caught spreading malware via fake Chrome updates ∗∗∗ --------------------------------------------- Hackers are compromising websites to inject scripts that display fake Google Chrome automatic update errors that distribute malware to unaware visitors. --------------------------------------------- https://www.bleepingcomputer.com/news/security/hacked-sites-caught-spreadin… ∗∗∗ Guidance for investigating attacks using CVE-2022-21894: The BlackLotus campaign ∗∗∗ --------------------------------------------- This guide provides steps that organizations can take to assess whether users have been targeted or compromised by threat actors exploiting CVE-2022-21894 via a Unified Extensible Firmware Interface (UEFI) bootkit called BlackLotus. --------------------------------------------- https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-inves… ∗∗∗ The Service Accounts Challenge: Cant See or Secure Them Until Its Too Late ∗∗∗ --------------------------------------------- Heres a hard question to answer: How many service accounts do you have in your environment?. A harder one is: Do you know what these accounts are doing?. And the hardest is probably: If any of your service account was compromised and used to access resources would you be able to detect and stop that in real-time? --------------------------------------------- https://thehackernews.com/2023/04/the-service-accounts-challenge-cant-see.h… ∗∗∗ Another zero-click Apple spyware maker just popped up on the radar again ∗∗∗ --------------------------------------------- Malware reportedly developed by a little-known Israeli commercial spyware maker has been found on devices of journalists, politicians, and an NGO worker in multiple countries, say researchers. --------------------------------------------- https://go.theregister.com/feed/www.theregister.com/2023/04/12/quadream_spy… ∗∗∗ Recent IcedID (Bokbot) activity ∗∗∗ --------------------------------------------- This week, weve seen IcedID (Bokbot) distributed through thread-hijacked emails with PDF attachments. The PDF files have links that redirect to Google Firebase Storage URLs hosting password-protected zip archives. The password for the downloaded zip archive is shown in the PDF file. The downloaded zip archives contain EXE files that are digitally-signed using a certificate issued by SSL.com. --------------------------------------------- https://isc.sans.edu/diary/rss/29740 ∗∗∗ BumbleBee hunting with a Velociraptor ∗∗∗ --------------------------------------------- The various detection opportunities described in the report can be useful for organizations to detect an infection in its first stages and, therefore, prevent further malicious activity starting from BumbleBee. The detection opportunities rely on open-source tools (e.g., Velociraptor) and rules (e.g., Yara, Sigma) so they can be used by any company or the wider community. --------------------------------------------- https://sec-consult.com/blog/detail/bumblebee-hunting-with-a-velociraptor/ ∗∗∗ Cryptocurrency Stealer Malware Distributed via 13 NuGet Packages ∗∗∗ --------------------------------------------- Cybersecurity researchers have detailed the inner workings of the cryptocurrency stealer malware that was distributed via 13 malicious NuGet packages as part of a supply chain attack targeting .NET developers. The sophisticated typosquatting campaign, which was uncovered by JFrog late last month, impersonated legitimate packages to execute PowerShell code designed to retrieve a follow-on binary from a hard-coded server. --------------------------------------------- https://thehackernews.com/2023/04/cryptocurrency-stealer-malware.html ∗∗∗ Update Now! Severe Vulnerability Impacting 600,000 Sites Patched in Limit Login Attempts ∗∗∗ --------------------------------------------- On January 26, 2023, the Wordfence team responsibly disclosed an unauthenticated stored Cross-Site Scripting vulnerability in Limit Login Attempts, a WordPress plugin installed on over 600,000 sites that provides site owners with the ability to block IP addresses that have made repeated failed login attempts. --------------------------------------------- https://www.wordfence.com/blog/2023/04/update-now-severe-vulnerability-impa… ∗∗∗ On self-healing code and the obvious issue ∗∗∗ --------------------------------------------- While browsing the news in the morning Ive found an article on Ars Technica titles "Developer creates “self-healing” programs that fix themselves thanks to AI". Its about Wolverine, which is an automated extension of what was demoed during the GPT-4 reveal, i.e. the perceived ability of GPT-4 to understand error messages and suggest fixes. --------------------------------------------- https://gynvael.coldwind.pl/?id=766 ===================== = Vulnerabilities = ===================== ∗∗∗ Patchday: Fortinet schließt kritische und hochriskante Lücken ∗∗∗ --------------------------------------------- Am April-Patchday liefert Fortinet für zahlreiche Produkte Sicherheitsupdates aus. Eine der damit geschlossenen Lücken stuft der Hersteller als kritisch ein. --------------------------------------------- https://heise.de/-8939457 ∗∗∗ Patchday: Kritische Schadcode-Lücken in Adobe-Anwendungen geschlossen ∗∗∗ --------------------------------------------- Wer Anwendungen von Adobe nutzt, sollte diese aus Sicherheitsgründen auf den aktuellen Stand bringen. --------------------------------------------- https://heise.de/-8935948 ∗∗∗ Privilege Escalation Vulnerability Patched Promptly in WP Data Access WordPress Plugin ∗∗∗ --------------------------------------------- On April 5, 2023 the Wordfence Threat Intelligence team initiated the responsible disclosure process for a vulnerability we discovered in WP Data Access, a WordPress plugin that is installed on over 10,000 sites. This flaw makes it possible for an authenticated attacker to grant themselves administrative privileges via a profile update, [...] --------------------------------------------- https://www.wordfence.com/blog/2023/04/privilege-escalation-vulnerability-p… ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Fedora (chromium, ghostscript, glusterfs, netatalk, php-Smarty, and skopeo), Mageia (ghostscript, imgagmagick, ipmitool, openssl, sudo, thunderbird, tigervnc/x11-server, and vim), Oracle (curl, haproxy, and postgresql), Red Hat (curl, haproxy, httpd:2.4, kernel, kernel-rt, kpatch-patch, and postgresql), Slackware (mozilla), SUSE (firefox), and Ubuntu (dotnet6, dotnet7, firefox, json-smart, linux-gcp, linux-intel-iotg, and sudo). --------------------------------------------- https://lwn.net/Articles/928870/ ∗∗∗ Patchday: Windows 11/Server 2022-Updates (11. April 2023) ∗∗∗ --------------------------------------------- Am 11. April 2023 (zweiter Dienstag im Monat, Patchday bei Microsoft) hat Microsoft auch kumulative Updates für Windows 11 22H1 und 22H2 veröffentlicht. Zudem erhielt Windows Server 2022 ein Update. Hier einige Details zu diesen Updates, die Schwachstellen sowie Probleme [...] --------------------------------------------- https://www.borncity.com/blog/2023/04/12/patchday-windows-11-server-2022-up… ∗∗∗ FANUC ROBOGUIDE-HandlingPRO ∗∗∗ --------------------------------------------- Successful exploitation of this vulnerability could allow an attacker to read and/or overwrite files on the system running the affected software. --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-101-01 ∗∗∗ NVIDIA Display Driver Advisory - March 2023 ∗∗∗ --------------------------------------------- http://support.lenovo.com/product_security/PS500558-NVIDIA-DISPLAY-DRIVER-A… ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 11.04.2023
by Daily end-of-shift report 11 Apr '23

11 Apr '23

===================== = End-of-Day report = ===================== Timeframe: Freitag 07-04-2023 18:00 − Dienstag 11-04-2023 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ YouTube warnt vor täuschend echter Betrugsmasche ∗∗∗ --------------------------------------------- Derzeit werden Phishing-E-Mails im Namen von YouTube versandt, die eine glaubwürdige Mailadresse verwenden. --------------------------------------------- https://futurezone.at/digital-life/youtube-warnt-vor-taeuschend-echter-betr… ∗∗∗ Hijacking Arch Linux Packages by Repo Jacking GitHub Repositories ∗∗∗ --------------------------------------------- Repo jacking is an attack on GitHub repositories, where attackers are able to hijack GitHub repositories by reregistering previously used usernames. In this blog post, we discuss how many AUR packages (use GitHub packages that) are vulnerable to repo jacking attacks. --------------------------------------------- https://blog.nietaanraken.nl/posts/aur-packages-github-repo-jacking/ ∗∗∗ Stepping Insyde System Management Mode ∗∗∗ --------------------------------------------- In October of 2022, Intel’s Alder Lake BIOS source code was leaked online. [..] I obtained a copy of the leaked code and began to hunt for vulnerabilities. [..] All these vulnerabilities share a common root cause (insufficient input validation) and a common impact (SMRAM corruption). Their details are summarized in the following table [..] --------------------------------------------- https://research.nccgroup.com/2023/04/11/stepping-insyde-system-management-… ∗∗∗ Jetzt patchen! ALPHV-Ransomware schlüpft durch Veritas-Backup-Lücken ∗∗∗ --------------------------------------------- Angreifer nehmen derzeit drei Sicherheitslücken in Veritas Backup Exec ins Visier. Patches sind verfügbar. --------------------------------------------- https://heise.de/-8875233 ∗∗∗ MSI-Hack: Hardware-Hersteller warnt vor Fake-BIOS-Updates ∗∗∗ --------------------------------------------- Bei MSI ist es zu einem IT-Sicherheitsvorfall gekommen. Die Angreifer sollen Zugriff auf interne Daten gehabt haben. --------------------------------------------- https://heise.de/-8875303 ∗∗∗ Studie: Kriminelle schmuggeln Trojaner-Apps ab 2000 US-Dollar in Google Play ∗∗∗ --------------------------------------------- Für die Abzocke von Android-Nutzern bieten Kriminelle in Untergrundforen All-in-one-Trojaner-Pakete zum Verkauf an. --------------------------------------------- https://heise.de/-8927162 ∗∗∗ Microsoft Azure Users Warned of Potential Shared Key Authorization Abuse ∗∗∗ --------------------------------------------- An exploitation path involving Azure shared key authorization could allow full access to accounts and business data and ultimately lead to remote code execution (RCE), cloud security company Orca warns. --------------------------------------------- https://www.securityweek.com/microsoft-azure-users-warned-of-potential-shar… ∗∗∗ Webinar: Sicher unterwegs in Sozialen Netzwerken ∗∗∗ --------------------------------------------- Soziale Netzwerke sind längst unsere täglichen Begleiter geworden. Doch worauf muss ich eigentlich achten, wenn ich Plattformen wie Facebook oder Instagram sicher nutzen will? Das Webinar gibt Tipps zum verantwortungsvollen Umgang mit Sozialen Netzwerken. Nehmen Sie kostenlos teil: Dienstag 18. April 2023, 18:30 - 20:00 Uhr via zoom --------------------------------------------- https://www.watchlist-internet.at/news/webinar-sicher-unterwegs-in-sozialen… ∗∗∗ Amazon ruft an? Legen Sie auf! ∗∗∗ --------------------------------------------- Am Telefon stellen sich Kriminelle als Amazon-Mitarbeiter:innen vor und behaupten, dass Ihr Amazon-Konto gehackt wurde. Sie hätten verdächtige Bestellungen entdeckt. Die „Amazon-Mitarbeiter:innen“ bieten Ihnen an, die Bestellung zu stornieren und Ihr Konto zu schützen. Dabei handelt es sich aber um Betrug! Kriminelle versuchen Ihnen Geld, Ausweiskopien und Amazon-Zugangsdaten zu stehlen! --------------------------------------------- https://www.watchlist-internet.at/news/amazon-ruft-an-legen-sie-auf/ ∗∗∗ AlienFox: Toolkit zur Kompromittierung von E-Mail- und Webhosting-Diensten in der Cloud ∗∗∗ --------------------------------------------- [English]AlienFox ist ein Toolkit zur Kompromittierung von E-Mail- und Webhosting-Diensten. Dieses Toolkit ist hochgradig modular, liegt in mehreren Versionen vor und versucht Fehlkonfigurationen in der Cloud auszunutzen, um die Anmeldedaten für Dienste wie AWS, Microsoft 365, Google Workspace, 1und1 etc. abzugreifen. --------------------------------------------- https://www.borncity.com/blog/2023/04/11/alienfox-toolkit-zur-kompromittier… ∗∗∗ WinVerifyTrust Signature Validation Vulnerability ∗∗∗ --------------------------------------------- Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update the Security Updates table and to inform customers that the EnableCertPaddingCheck is available in all currently supported versions of Windows 10 and Windows 11. While the format is different from the original CVE published in 2013, the information herein remains unchanged from the original text published on December 10, 2013. --------------------------------------------- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2013-3900 ===================== = Vulnerabilities = ===================== ∗∗∗ Security Vulnerabilities fixed in Firefox 112, Firefox for Android 112, Focus for Android 112 ∗∗∗ --------------------------------------------- CVE-2023-29531, CVE-2023-29532, CVE-2023-29533, CVE-2023-29534, CVE-2023-29535, CVE-2023-29536, CVE-2023-29537, CVE-2023-29538, CVE-2023-29539, CVE-2023-29540, CVE-2023-29541, CVE-2023-29542, CVE-2023-29543, CVE-2023-29544, CVE-2023-29545, CVE-2023-29546, CVE-2023-29547, CVE-2023-29548, CVE-2023-29549, CVE-2023-29550, CVE-2023-29551 Davon 11x "Severity: high". --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2023-13/ ∗∗∗ Exploit-Code: Schadcode könnte aus JavaScript-Sandbox vm2 ausbrechen ∗∗∗ --------------------------------------------- Die populäre vm2-Sandbox hat eine kritische Sicherheitslücke und Exploit-Code ist bereits im Umlauf. --------------------------------------------- https://heise.de/-8875269 ∗∗∗ Patchday: SAP meldet 19 teils kritische Sicherheitslücken ∗∗∗ --------------------------------------------- Im April hat SAP 19 Schwachstellen in den eigenen Produkten mit Sicherheitsmeldungen bedacht. Davon stuft der Hersteller zwei als kritisch ein. --------------------------------------------- https://heise.de/-8931365 ∗∗∗ iOS 15, macOS 11 und 12: Apple schiebt Notfallfix nach ∗∗∗ --------------------------------------------- Nachdem iOS 16 und macOS 13 bereits voll gepatcht worden waren, legt Apple auch einen Fix für eine bereits ausgenutzte Lücke für ältere Betriebssysteme nach. --------------------------------------------- https://heise.de/-8922448 ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (openimageio and udisks2), Fedora (chromium, curl, kernel, mediawiki, and seamonkey), Oracle (httpd:2.4), Red Hat (httpd and mod_http2 and tigervnc), SUSE (ghostscript and kernel), and Ubuntu (irssi). --------------------------------------------- https://lwn.net/Articles/928667/ ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (keepalived and lldpd), Oracle (kernel), and SUSE (kernel, podman, seamonkey, and upx). --------------------------------------------- https://lwn.net/Articles/928736/ ∗∗∗ ICS Patch Tuesday: Siemens, Schneider Electric Address Dozens of Vulnerabilities ∗∗∗ --------------------------------------------- Siemens and Schneider Electric’s Patch Tuesday advisories for April 2023 address a total of 38 vulnerabilities found in their products. --------------------------------------------- https://www.securityweek.com/ics-patch-tuesday-siemens-schneider-electric-a… ∗∗∗ PHOENIX CONTACT: Directory Traversal Vulnerability in ENERGY AXC PU Web service ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2023-004/ ∗∗∗ Insyde BIOS Vulnerabilities ∗∗∗ --------------------------------------------- http://support.lenovo.com/product_security/PS500557 ∗∗∗ Lenovo XClarity Controller (XCC) Vulnerabilities ∗∗∗ --------------------------------------------- http://support.lenovo.com/product_security/PS500556-LENOVO-XCLARITY-CONTROL… ∗∗∗ Lenovo Smart Clock Essential Vulnerability ∗∗∗ --------------------------------------------- http://support.lenovo.com/product_security/PS500555-LENOVO-SMART-CLOCK-ESSE… ∗∗∗ IBM WebSphere Application Server and IBM WebSphere Application Server Liberty, which are bundled with IBM Cloud Pak for Applications, are vulnerable to a denial of service due to Apache Commons FileUpload (CVE-2023-24998) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6982187 ∗∗∗ IBM i components are affected by CVE-2021-4104 (log4j version 1.x) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6539162 ∗∗∗ IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in Apache Lucene ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6982359 ∗∗∗ IBM Watson Explorer affected by vulnerability in Apache Commons. ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6964808 ∗∗∗ A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM WebSphere Remote Server (CVE-2023-24998) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6982539 ∗∗∗ Vulnerabilities in OpenSSL affect QLogic 8Gb Intelligent Pass-thru Module and SAN Switch Module for IBM BladeCenter and QLogic Virtual Fabric Extension Module for IBM BladeCenter ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/888295 ∗∗∗ Vulnerabilities in cURL affect QLogic Virtual Fabric Extension Module for IBM BladeCenter ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/888299 ∗∗∗ A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Business Monitor (CVE-2023-24998) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6982833 ∗∗∗ Netcool Operations Insight v1.6.8 addresses multiple security vulnerabilities. ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6982841 ∗∗∗ The IBM\u00ae Engineering Lifecycle Engineering product using IBM Java - Eclipse OpenJ9 is vulnerable to CVE-2022-3676 ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6982847 ∗∗∗ Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to Webpack (CVE-2023-28154) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6982851 ∗∗∗ IBM Engineering Requirements Management DOORS Next is vulnerable to XML external entity (XXE) attacks due to a vulnerability in XML processing in Apache Jena, in versions up to 4.1.0 (CVE-2021-39239) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6981111 ∗∗∗ IBM Operational Decision Manager March 2023 - CVE-2014-0114, CVE-2019-10086, CVE-2023-24998 ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6982881 ∗∗∗ IBM WebSphere Application Server Liberty is vulnerable to a privilege escalation due to RESTEasy (CVE-2023-0482) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6982895 ∗∗∗ IBM WebSphere Application Server Liberty, which is bundled with IBM Cloud Pak for Applications, is vulnerable to a privilege escalation due to RESTEasy (CVE-2023-0482) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6982903 ∗∗∗ IBM WebSphere Application Server Liberty, which is bundled with IBM WebSphere Hybrid Edition, is vulnerable to a privilege escalation due to RESTEasy (CVE-2023-0482) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6982905 ∗∗∗ IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to a denial of service due to Apache Commons FileUpload (CVE-2023-24998) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6982047 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily