Daily

daily@lists.cert.at

1 participants
3181 discussions

Tageszusammenfassung - 19.05.2023
by Daily end-of-shift report 19 May '23

19 May '23

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 17-05-2023 18:00 − Freitag 19-05-2023 18:00 Handler: Michael Schlagenhaufer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Attacken könnten bevorstehen: Kritische Root-Lücken bedrohen Cisco-Switches ∗∗∗ --------------------------------------------- Cisco hat unter anderem mehrere kritische Sicherheitslücken in verschiedenen Small-Business-Switches geschlossen. Aber nicht alle Modelle bekommen Updates. --------------------------------------------- https://heise.de/-9059775 ∗∗∗ Passwortmanager KeePass: Sicherheitsforscher liest Master-Passwort aus ∗∗∗ --------------------------------------------- Einem Sicherheitsforscher ist es gelungen, Master-Passwörter von KeePass auszulesen. Entsprechende Angriffe sind allerdings aufwendig. --------------------------------------------- https://heise.de/-9059945 ∗∗∗ Zero-Days und mehr: Ein Blick auf Apples jüngste Sicherheitspatches ∗∗∗ --------------------------------------------- iOS 16.5, macOS 13.4 und die anderen Updates patchen wie üblich auch Sicherheitsfehler. Auch bereits ausgenutzte Fehler sind dabei. --------------------------------------------- https://heise.de/-9059799 ∗∗∗ Malware infizierte fast 10 Millionen Android-Handys ∗∗∗ --------------------------------------------- Zahlreiche Smartphones wurden mit vorinstallierter, schädlicher Software ausgeliefert. --------------------------------------------- https://futurezone.at/produkte/android-schadsoftware-infiziert-10-millionen… ∗∗∗ MalasLocker ransomware targets Zimbra servers, demands charity donation ∗∗∗ --------------------------------------------- A new ransomware operation is hacking Zimbra servers to steal emails and encrypt files. However, instead of demanding a ransom payment, the threat actors claim to require a donation to charity to provide an encryptor and prevent data leaking. --------------------------------------------- https://www.bleepingcomputer.com/news/security/malaslocker-ransomware-targe… ∗∗∗ Hackers target vulnerable Wordpress Elementor plugin after PoC released ∗∗∗ --------------------------------------------- Hackers are now actively probing for vulnerable Essential Addons for Elementor plugin versions on thousands of WordPress websites in massive Internet scans, attempting to exploit a critical account password reset flaw disclosed earlier in the month. --------------------------------------------- https://www.bleepingcomputer.com/news/security/hackers-target-vulnerable-wo… ∗∗∗ Playing for the Wrong Team: Dangerous Functionalities in Microsoft Teams Enable Phishing and Malware Delivery by Attackers ∗∗∗ --------------------------------------------- Microsoft is a major productivity partner for many organizations and enterprises. These organizations widely trust Microsoft Office’s suite of products as a reliable foundation for their daily cloud ecosystem needs. However, as Proofpoint has shown in the past, this migration to the cloud also introduces new kinds of threats. --------------------------------------------- https://www.proofpoint.com/us/blog/threat-insight/dangerous-functionalities… ∗∗∗ RATs found hiding in the npm attic ∗∗∗ --------------------------------------------- ReversingLabs researchers discovered two malicious packages that contained TurkoRat, an open source infostealer that lurked on npm for two months before being detected. --------------------------------------------- https://www.reversinglabs.com/blog/rats-found-hiding-in-the-npm-attic ∗∗∗ The Paillier Cryptosystem with Applications to Threshold ECDSA ∗∗∗ --------------------------------------------- You may have heard of RSA (b. 1977), but have you heard of its cousin, Paillier (b. 1999)? In this post, we provide a close look at the Paillier homomorphic encryption scheme [Paillier1999], what it offers, how it’s used in complex protocols, and how to implement it securely. --------------------------------------------- https://research.nccgroup.com/2023/05/19/the-paillier-cryptosystem-with-app… ∗∗∗ All your building are belong to us ∗∗∗ --------------------------------------------- TL;DR: Building Management Systems (BMS) bring new risks to businesses that haven’t had previous experience of securing Operational Technology (OT). While there might not be direct financial gain from hacking BMS, these systems can be a soft target for attackers to pivot into your business operations. IoT offerings in this space can help manage risk within your networks, but can also provide unintended access to sensitive information. --------------------------------------------- https://www.pentestpartners.com/security-blog/all-your-building-are-belong-… ∗∗∗ CVE-2023-20869/20870: Exploiting VMware Workstation at Pwn2Own Vancouver ∗∗∗ --------------------------------------------- This post covers an exploit chain demonstrated by Nguyễn Hoàng Thạch (@hi_im_d4rkn3ss) of STAR Labs SG Pte. Ltd. during the Pwn2Own Vancouver event in 2023. During the contest, he used an uninitialized variable bug and a stack-based buffer overflow in VMware to escalate from a guest OS to execute code on the underlying hypervisor. --------------------------------------------- https://www.thezdi.com/blog/2023/5/17/cve-2023-2086920870-exploiting-vmware… ∗∗∗ VSCode Security: Malicious Extensions Detected- More Than 45,000 Downloads- PII Exposed, and Backdoors Enabled ∗∗∗ --------------------------------------------- Highlights: CloudGuard Spectral detected malicious extensions on the VSCode marketplace Users installing these extensions were enabling attackers to steal PII records and to set remote shell to their machines Once detected, we’ve alerted VSCode on these extensions. Soon after notification, they were removed by the VSCode marketplace team. VSCode (short for Visual Studio Code) is a popular and free source code editor developed by Microsoft. --------------------------------------------- https://blog.checkpoint.com/securing-the-cloud/malicious-vscode-extensions-… ∗∗∗ Visualizing QakBot Infrastructure ∗∗∗ --------------------------------------------- This blog post seeks to draw out some high-level trends and anomalies based on our ongoing tracking of QakBot command and control (C2) infrastructure. By looking at the data with a broader scope, we hope to supplement other research into this particular threat family, which in general focuses on specific infrastructure elements; e.g., daily alerting on active C2 servers. --------------------------------------------- https://www.team-cymru.com/post/visualizing-qakbot-infrastructure ===================== = Vulnerabilities = ===================== ∗∗∗ File Chooser Field - Moderately critical - Server Side Request Forgery, Information Disclosure - SA-CONTRIB-2023-015 ∗∗∗ --------------------------------------------- The File Chooser Field allows users to upload files using 3rd party plugins such as Google Drive and Dropbox. This module fails to validate user input sufficiently which could under certain circumstances lead to a Server Side Request Forgery (SSRF) vulnerability [...] --------------------------------------------- https://www.drupal.org/sa-contrib-2023-015 ∗∗∗ SECURITY BULLETIN: May 2023 Security Bulletin for Trend Micro Apex Central ∗∗∗ --------------------------------------------- Trend Micro has released a new build for Trend Micro Apex Central that resolves several known vulnerabilities. --------------------------------------------- https://success.trendmicro.com/dcx/s/solution/000293107?language=en_US ∗∗∗ SECURITY BULLETIN: May 2023 Security Bulletin for Trend Micro Apex One ∗∗∗ --------------------------------------------- Trend Micro has released a new Critical Patch (CP) for Trend Micro Apex One and Trend Micro Apex One as a Service that resolves several known vulnerabilities. --------------------------------------------- https://success.trendmicro.com/dcx/s/solution/000293108?language=en_US ∗∗∗ Cisco Security Advisories 2023-05-17 ∗∗∗ --------------------------------------------- Cisco has published 9 security advisories: (1x Critical, 8x Medium) --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/Search.x?publicationTypeIDs… ∗∗∗ CISA Releases Five Industrial Control Systems Advisories ∗∗∗ --------------------------------------------- * ICSA-23-138-04 Johnson Controls OpenBlue Enterprise Manager Data Collector * ICSA-23-138-03 Hitachi Energy’s MicroSCADA Pro/X SYS600 Products * ICSA-23-138-02 Mitsubishi Electric MELSEC WS Series * ICSA-23-138-01 Carlo Gavazzi Powersoft * ICSA-20-051-02 Rockwell Automation FactoryTalk Diagnostics (Update B) --------------------------------------------- https://www.cisa.gov/news-events/alerts/2023/05/18/cisa-releases-five-indus… ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (chromium and libapache2-mod-auth-openidc), Fedora (clevis-pin-tpm2, greetd, keyring-ima-signer, libkrun, mirrorlist-server, nispor, nmstate, qt5-qtbase, rust-afterburn, rust-below, rust-bodhi-cli, rust-cargo-c, rust-coreos-installer, rust-fedora-update-feedback, rust-git-delta, rust-gst-plugin-reqwest, rust-pore, rust-rpm-sequoia, rust-sequoia-octopus-librnp, rust-sequoia-policy-config, rust-sequoia-sq, rust-sevctl, rust-tealdeer, and rust-ybaas), Oracle (apr-util, curl, emacs, firefox, kernel, libreswan, mysql, nodejs and nodejs-nodemon, openssh, thunderbird, and webkit2gtk3), Red Hat (apr-util, emacs, firefox, git, jenkins and jenkins-2-plugins, kernel, kpatch-patch, and thunderbird), Scientific Linux (apr-util, firefox, and thunderbird), Slackware (curl), SUSE (cups-filters, curl, java-1_8_0-openjdk, kernel, mysql-connector-java, and ovmf), and Ubuntu (cups-filters, git, linux-gcp-4.15, linux-oracle, linux-raspi, node-minimatch, ruby2.3, ruby2.5, ruby2.7, and runc). --------------------------------------------- https://lwn.net/Articles/932371/ ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Fedora (cups-filters, kitty, mingw-LibRaw, nispor, rust-ybaas, and rust-yubibomb), Mageia (kernel-linus), Red Hat (jenkins and jenkins-2-plugins), SUSE (openvswitch and ucode-intel), and Ubuntu (linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-5.15, linux-gke, linux-gke-5.15, linux-gkeop, linux-oracle-5.15, linux-ibm, linux-oracle, and linux-oem-6.0). --------------------------------------------- https://lwn.net/Articles/932464/ ∗∗∗ Path Traversal in SymBox, SymOS (SYSS-2023-014) ∗∗∗ --------------------------------------------- Das Webinterface von SymBox, SymOS ermöglicht ein Path Traversal, wodurch Zugriff auf Systemdateien außerhalb des Web Root erlangt werden kann. --------------------------------------------- https://www.syss.de/pentest-blog/path-traversal-in-symbox-symos-syss-2023-0… ∗∗∗ Spring Boot available now, fixing CVE-2023-20883 ∗∗∗ --------------------------------------------- https://spring.io/security/cve-2023-20883 ∗∗∗ Mattermost security updates 7.10.1 / 7.9.4 / 7.8.5 (ESR) released ∗∗∗ --------------------------------------------- https://mattermost.com/blog/mattermost-security-updates-7-10-1-7-9-4-7-8-5-… ∗∗∗ CPE2023-002 Vulnerabilities of IJ Network Tool regarding Wi-Fi connection setup – 18 May 2023 ∗∗∗ --------------------------------------------- https://www.canon-europe.com/support/product-security-latest-news/ ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 17.05.2023
by Daily end-of-shift report 17 May '23

17 May '23

===================== = End-of-Day report = ===================== Timeframe: Dienstag 16-05-2023 18:00 − Mittwoch 17-05-2023 18:00 Handler: Michael Schlagenhaufer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Hackers use Azure Serial Console for stealthy access to VMs ∗∗∗ --------------------------------------------- A financially motivated cybergang tracked by Mandiant as UNC3944 is using phishing and SIM swapping attacks to hijack Microsoft Azure admin accounts and gain access to virtual machines. --------------------------------------------- https://www.bleepingcomputer.com/news/security/hackers-use-azure-serial-con… ∗∗∗ Phishing: Streit um Google-TLDs .zip und .mov ∗∗∗ --------------------------------------------- IT- und Sicherheitsexperten streiten sich um die Sinnhaftigkeit und Risiken neuer gTLD. Neu sind die Probleme allerdings nicht. --------------------------------------------- https://www.golem.de/news/phishing-streit-um-google-tlds-zip-und-mov-2305-1… ∗∗∗ Minas – on the way to complexity ∗∗∗ --------------------------------------------- Kaspersky analysis of a complicated multi-stage attack dubbed Minas that features a number of detection evasion and persistence techniques and results in a cryptocurrency miner infection. --------------------------------------------- https://securelist.com/minas-miner-on-the-way-to-complexity/109692/ ∗∗∗ Wemo Wont Fix Smart Plug Vulnerability Allowing Remote Operation ∗∗∗ --------------------------------------------- IoT security research firm Sternum has discovered (and disclosed) a buffer overflow vulnerability in the Wemo Mini Smart Plug V2. The firms blog post is full of interesting details about how this device works (and doesnt), but a key takeaway is that you can predictably trigger a buffer overflow by passing the device a name longer than its 30-character limit -- a limit enforced solely by Wemos own apps -- with third-party tools. --------------------------------------------- https://it.slashdot.org/story/23/05/17/141200/wemo-wont-fix-smart-plug-vuln… ∗∗∗ Respawning Malware Persists on PyPI ∗∗∗ --------------------------------------------- A bad actor on GitHub laces his repositories with malware written in Python and hosted on PyPI. Minutes after his malware is taken down from PyPI, the same malware respawns on PyPI under a slightly different name. He then immediately updates all of his repositories to point to this new package. Most of his GitHub projects are bots or some variety of a stealer. --------------------------------------------- https://blog.phylum.io/respawning-malware-persists-on-pypi/ ∗∗∗ Neue Scam-Website im Umlauf: finanavas.com ∗∗∗ --------------------------------------------- Investmentbetrüger versuchen mit einer neuen Website Leuten Geld aus der Tasche zu ziehen. Sie nutzen Telegram, um "Investoren" um den Finger zu wickeln. --------------------------------------------- https://heise.de/-9058909 ∗∗∗ Abo-Falle statt Informationen zu Telefonnummern auf reversera.com/de ∗∗∗ --------------------------------------------- In einer Zeit ständiger betrügerischer Anrufe und „Cold-Calls“ ist ein Service, der einem Informationen zu Telefonnummern und den Besitzer:innen liefert, äußerst nützlich. Reversera.com/de der АLРНАСLІС LТD bietet angeblich genau das an. Tatsächlich spielte man uns im Test bei erfundenen Nummern ein Ergebnis vor. Um dieses einsehen zu können, hätten wir 50 Cent per Kreditkarte bezahlen müssen, doch die Zahlung führt in eine Abo-Falle! --------------------------------------------- https://www.watchlist-internet.at/news/abo-falle-statt-informationen-zu-tel… ∗∗∗ How to encrypt your email (and why you should) ∗∗∗ --------------------------------------------- If you send emails with sensitive or private info inside, you should consider email encryption. Heres what to know. --------------------------------------------- https://www.zdnet.com/article/how-to-encrypt-your-email-and-why-you-should/ ∗∗∗ WordPress 6.2.1 freigegeben ∗∗∗ --------------------------------------------- Die Entwickler haben zum 16. Mai 2023 WordPress Version 6.2.1 veröffentlicht. Es handelt sich um ein Wartungs- und Sicherheitsupdate, welches 30 Fehler behebt. Details lassen sich in den Veröffentlichungsmitteilungen nachlesen. --------------------------------------------- https://www.borncity.com/blog/2023/05/16/wordpress-6-2-1-freigegeben/ ∗∗∗ SIM Swapping and Abuse of the Microsoft Azure Serial Console: Serial Is Part of a Well Balanced Attack ∗∗∗ --------------------------------------------- In 2022, Mandiant identified attacker activity centered in Microsoft Azure that Mandiant attributed to UNC3944. Mandiant’s investigation revealed that the attacker employed malicious use of the Serial Console on Azure Virtual Machines (VM) to install third-party remote management software within client environments. This method of attack was unique in that it avoided many of the traditional detection methods employed within Azure and provided the attacker with full administrative access to the VM. Unfortunately, cloud resources are often poorly misunderstood, leading to misconfigurations that can leave these assets vulnerable to attackers. While methods of initial access, lateral movement, and persistence vary from one attacker to another, one thing is clear: Attackers have their eyes on the cloud. --------------------------------------------- https://www.mandiant.com/resources/blog/sim-swapping-abuse-azure-serial ∗∗∗ CISA and Partners Release BianLian Ransomware Cybersecurity Advisory ∗∗∗ --------------------------------------------- CISA, the Federal Bureau of Investigation (FBI), and the Australian Cyber Security Centre (ACSC) have released a joint Cybersecurity Advisory (CSA) with known BianLian ransomware and data extortion group technical details. Microsoft and Sophos contributed to the advisory. To reduce the likelihood and impact of BianLian and other ransomware incidents, CISA encourages organizations to implement mitigations recommended in this advisory. --------------------------------------------- https://www.cisa.gov/news-events/alerts/2023/05/16/cisa-and-partners-releas… ===================== = Vulnerabilities = ===================== ∗∗∗ Webbrowser: Kritische Sicherheitslücke in Google Chrome ∗∗∗ --------------------------------------------- Google hat ein Update für den Chrome-Webbrowser herausgegeben. Es schließt mindestens eine kritische Sicherheitslücke. Angreifer könnten Schadcode einschleusen. --------------------------------------------- https://heise.de/-9057932 ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (netatalk), Mageia (connman, firefox/nss/rootcerts, freeimage, golang, indent, kernel, python-django, python-pillow, and thunderbird), Red Hat (apr-util, firefox, java-1.8.0-ibm, libreswan, and thunderbird), SUSE (conmon, curl, java-11-openjdk, and libheif), and Ubuntu (libwebp, linux, linux-aws, linux-aws-5.15, linux-azure, linux-azure-5.15, linux-azure-fde, linux-azure-fde-5.15, linux-hwe-5.15, linux-ibm, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-oracle, linux, linux-aws, linux-aws-hwe, linux-kvm, linux, linux-aws, linux-azure, linux-azure-5.19, linux-kvm, linux-lowlatency, linux-raspi, node-eventsource, and openjdk-8, openjdk-lts, openjdk-17, openjdk-20). --------------------------------------------- https://lwn.net/Articles/932130/ ∗∗∗ Vulnerability Summary for the Week of May 8, 2023 ∗∗∗ --------------------------------------------- The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. NVD is sponsored by CISA. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available. --------------------------------------------- https://www.cisa.gov/news-events/bulletins/sb23-135 ∗∗∗ Path Traversal in IP-Symcon (SYSS-2023-014) ∗∗∗ --------------------------------------------- Das Webinterface von IP-Symcon ermöglicht ein Path Traversal, wodurch Zugriff auf Systemdateien außerhalb des Web Root erlangt werden kann. --------------------------------------------- https://www.syss.de/pentest-blog/path-traversal-in-ip-symcon-syss-2023-014 ∗∗∗ Security Advisory - Traffic Hijacking Vulnerability in Huawei Routers ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2023/huawei-sa-thvihr-70… ∗∗∗ Stored XSS Schwachstelle in der Umbenennen Funktionalität von Wekan (Open-Source Kanban) ∗∗∗ --------------------------------------------- https://sec-consult.com/de/vulnerability-lab/advisory/stored-xss-schwachste… ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 16.05.2023
by Daily end-of-shift report 16 May '23

16 May '23

===================== = End-of-Day report = ===================== Timeframe: Montag 15-05-2023 18:00 − Dienstag 16-05-2023 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a ===================== = News = ===================== ∗∗∗ VirusTotal AI code analysis expands Windows, Linux script support ∗∗∗ --------------------------------------------- Google has added support for more scripting languages to VirusTotal Code Insight, a recently introduced artificial intelligence-based code analysis feature. --------------------------------------------- https://www.bleepingcomputer.com/news/security/virustotal-ai-code-analysis-… ∗∗∗ Open-source Cobalt Strike port Geacon used in macOS attacks ∗∗∗ --------------------------------------------- Geacon, a Go-based implementation of the beacon from the widely abused penetration testing suite Cobalt Strike, is being used more and more to target macOS devices. --------------------------------------------- https://www.bleepingcomputer.com/news/security/open-source-cobalt-strike-po… ∗∗∗ Signals Defense With Faraday Bags & Flipper Zero, (Tue, May 16th) ∗∗∗ --------------------------------------------- There are situations where it is desired to block signals between devices. Commonly scenarios are when traveling, in a location of uncertain safety, or otherwise concerned with data privacy and geolocation. I was curious how well a faraday bags and similar products protected wireless communications. --------------------------------------------- https://isc.sans.edu/diary/rss/29840 ∗∗∗ Triple Threat: Breaking Teltonika Routers Three Ways ∗∗∗ --------------------------------------------- Comprehensive research was conducted on Teltonika Networks’ IIoT products, with a focus on industrial cellular devices widely used in various industries, specifically, the Teltonika Remote Management System, and RUT model routers. --------------------------------------------- https://claroty.com/team82/research/triple-threat-breaking-teltonika-router… ∗∗∗ You’ve been kept in the dark (web): exposing Qilin’s RaaS program ∗∗∗ --------------------------------------------- All you need to know about Qilin ransomware and its operations targeting critical sectors. --------------------------------------------- https://www.group-ib.com/blog/qilin-ransomware/ ∗∗∗ Seitenkanalangriff auf Cortex-M: Zugriff auf sensible Informationen ∗∗∗ --------------------------------------------- Auf der Blackhat Asia haben IT-Forscher Seitenkanalangriffe auf ARM-Cortex-M-Mikroprozessoren vorgestellt. Sie ermöglichen Zugriff auf sensible Informationen. --------------------------------------------- https://heise.de/-9057108 ∗∗∗ It’s always DNS, here’s why… ∗∗∗ --------------------------------------------- There’s an old adage in network and Internet support: When something breaks in any network “it was DNS”. Sadly it’s usually true. --------------------------------------------- https://www.pentestpartners.com/security-blog/its-always-dns-heres-why/ ∗∗∗ Vorsicht vor Anrufen von „austriamegachance.com“ ∗∗∗ --------------------------------------------- Ihr Telefon klingelt. Austria Mega Chance meldet sich, eine Lotto-Tipp-Dienstleistung. Ihnen werden hohe Gewinnchancen beim Lotto versprochen und eine Dienstleistung für Gemeinschaftstipps angeboten. Die aufdringliche Person entlockt Ihnen Kontodaten. Einige Zeit später werden Ihnen dann monatlich, ohne schriftliche Infos oder einen Vertrag unterschieben zu haben, knapp 70 Euro von Ihrem Konto abgebucht. Wir zeigen Ihnen, was Sie tun können! --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-vor-anrufen-von-austriamega… ∗∗∗ Microsoft SharePoint scannt Password-geschützte ZIP-Archive ∗∗∗ --------------------------------------------- Es sieht so aus, dass Microsoft in seinen Cloud-Speichern auch ZIP-Archive auf schädliche Inhalte (und ggf. weitere Inhalte) scannt – auch Archive, die vom Benutzer mit einem Kennwort vor der Einsichtnahme geschützt sind. --------------------------------------------- https://www.borncity.com/blog/2023/05/16/microsoft-sharepoint-scannt-passwo… ∗∗∗ The Dragon Who Sold His Camaro: Analyzing Custom Router Implant ∗∗∗ --------------------------------------------- Through our investigation, we have gained a deeper comprehension of the ways in which attackers are employing malware to target edge devices, particularly routers. Our efforts have led us to uncover several of the tactics and tools utilized by Camaro Dragon in their attacks. --------------------------------------------- https://research.checkpoint.com/2023/the-dragon-who-sold-his-camaro-analyzi… ∗∗∗ 8220 Gang Evolves With New Strategies ∗∗∗ --------------------------------------------- We observed the threat actor group known as “8220 Gang” employing new strategies for their respective campaigns, including exploits for the Linux utility “lwp-download” and CVE-2017-3506, an Oracle WebLogic vulnerability. --------------------------------------------- https://www.trendmicro.com/en_us/research/23/e/8220-gang-evolution-new-stra… ∗∗∗ How to Write a PoC for an Uninitialized Smart Contract Vulnerability in BadgerDAO Using Foundry ∗∗∗ --------------------------------------------- In this post, we’re going to learn how Foundry can be used to write a proof of concept (PoC) for uninitialized smart contract vulnerabilities. --------------------------------------------- https://www.cyberark.com/resources/threat-research-blog/how-to-write-a-poc-… ===================== = Vulnerabilities = ===================== ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- IBM Cloud Pak for Network Automation, IBM Control Desk, IBM Maximo, IBM Edge Application Manager, IBM Cloud Automation Manager, Tivoli Monitoring, IBM Business Monitor, IBM Business Automation Workflow Enterprise Service Bus, WebSphere Application Server, Tivoli Application Dependency Discovery Manager, IBM Operations Analytics - Predictive Insights, IBM Security Verify Information Queue. --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ CISA Releases Three Industrial Control Systems Advisories ∗∗∗ --------------------------------------------- * ICSA-23-136-02 Rockwell ArmorStart * ICSA-23-136-03 Rockwell Automation FactoryTalk Vantagepoint * ICSA-23-136-01 Snap One OvrC Cloud --------------------------------------------- https://www.cisa.gov/news-events/alerts/2023/05/16/cisa-releases-three-indu… ∗∗∗ JavaScript-Sandbox vm2: PoC zeigt neuen Sandbox-Ausbruch ∗∗∗ --------------------------------------------- Eine kritische Lücke in der JavaScript-Sandbox vm2 können Angreifer zum Ausbruch missbrauchen. Aktualisierte Software steht bereit, die die Lücken schließt. --------------------------------------------- https://heise.de/-9056842 ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (epiphany-browser, python-ipaddress, and sqlparse), Fedora (python-django3 and qemu), Red Hat (apr-util, autotrace, bind, bind9.16, container-tools:4.0, container-tools:rhel8, ctags, curl, device-mapper-multipath, dhcp, edk2, emacs, freeradius:3.0, freerdp, frr, gcc-toolset-12-binutils, git, git-lfs, go-toolset:rhel8, grafana, grafana-pcp, gssntlmssp, Image Builder, kernel, kernel-rt, libarchive, libreswan, libtar, libtiff, mingw-expat, mysql:8.0, net-snmp, pcs, php:7.4, poppler, postgresql-jdbc, python-mako, python27:2.7, python38:3.8 and python38-devel:3.8, python39:3.9 and python39-devel:3.9, samba, sysstat, tigervnc, unbound, virt:rhel and virt-devel:rhel, wayland, webkit2gtk3, xorg-x11-server, and xorg-x11-server-Xwayland), SUSE (dmidecode, postgresql13, prometheus-sap_host_exporter, python-cryptography, rekor, and thunderbird), and Ubuntu (firefox, matrix-synapse, and mysql-8.0). --------------------------------------------- https://lwn.net/Articles/932033/ ∗∗∗ D-Link DIR-2150 DIR-2150 Firmware Release Notes v1.06 ∗∗∗ --------------------------------------------- https://support.dlink.com.au/Download/download.aspx?product=DIR-2150 ∗∗∗ XSA-431 ∗∗∗ --------------------------------------------- https://xenbits.xen.org/xsa/advisory-431.html ∗∗∗ Zahlreiche Schwachstellen in Serenity and StartSharp Software ∗∗∗ --------------------------------------------- https://sec-consult.com/de/vulnerability-lab/advisory/zahlreiche-schwachste… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 15.05.2023
by Daily end-of-shift report 15 May '23

15 May '23

===================== = End-of-Day report = ===================== Timeframe: Freitag 12-05-2023 18:00 − Montag 15-05-2023 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ The .zip gTLD: Risks and Opportunities, (Fri, May 12th) ∗∗∗ --------------------------------------------- About ten years ago, ICANN started the "gTLD" program. "Generic TLDs" allows various brands to register their own trademark as a TLD. Instead of "google.com", you now can have ".google"! Applying for a gTLD isn't cheap, and success isn't guaranteed. But since its inception, dozens of new gTLDs have been approved and started to be used [1]. The reputation of these new gTLDs has been somewhat mixed. --------------------------------------------- https://isc.sans.edu/diary/rss/29838 ∗∗∗ XWorm Malware Exploits Follina Vulnerability in New Wave of Attacks ∗∗∗ --------------------------------------------- Cybersecurity researchers have discovered an ongoing phishing campaign that makes use of a unique attack chain to deliver the XWorm malware on targeted systems. Securonix, which is tracking the activity cluster under the name MEME#4CHAN, said some of the attacks have primarily targeted manufacturing firms and healthcare clinics located in Germany. --------------------------------------------- https://thehackernews.com/2023/05/xworm-malware-exploits-follina.html ∗∗∗ CLR SqlShell Malware Targets MS SQL Servers for Crypto Mining and Ransomware ∗∗∗ --------------------------------------------- Poorly managed Microsoft SQL (MS SQL) servers are the target of a new campaign thats designed to propagate a category of malware called CLR SqlShell that ultimately facilitates the deployment of cryptocurrency miners and ransomware. --------------------------------------------- https://thehackernews.com/2023/05/clr-sqlshell-malware-targets-ms-sql.html ∗∗∗ New MichaelKors Ransomware-as-a-Service Targeting Linux and VMware ESXi Systems ∗∗∗ --------------------------------------------- A new ransomware-as-service (RaaS) operation called MichaelKors has become the latest file-encrypting malware to target Linux and VMware ESXi systems as of April 2023. The development points to cybercriminal actors increasingly setting their eyes on the ESXi, cybersecurity firm CrowdStrike said in a report shared with The Hacker News. --------------------------------------------- https://thehackernews.com/2023/05/new-michaelkors-ransomware-as-service.html ∗∗∗ WordPress Field Builder Plugin Vulnerability Exploited in Attacks Two Days After Patch ∗∗∗ --------------------------------------------- PoC exploit targeting an XSS vulnerability in the Advanced Custom Fields WordPress plugin started being used in malicious attacks two days after patch. --------------------------------------------- https://www.securityweek.com/wordpress-field-builder-plugin-vulnerability-e… ∗∗∗ Webinar: Smartphone, Tablet & Co. sicher nutzen ∗∗∗ --------------------------------------------- Wie kann ich meine persönlichen Daten am Smartphone, Tablet & Co. schützen? In diesem Webinar zeigen wir Ihnen die wichtigsten Sicherheitseinstellungen – von Berechtigungen über Datenschutz bis hin zu Nutzungszeiten. Nehmen Sie kostenlos teil: Dienstag 23. Mai 2023, 18:30 - 20:00 Uhr via zoom --------------------------------------------- https://www.watchlist-internet.at/news/webinar-smartphone-tablet-co-sicher-… ∗∗∗ Mit diesen 3 Einstellungen schützen Sie Ihr Smartphone ∗∗∗ --------------------------------------------- Sie denken Ihr Smartphone ist mit einer Bildschirmsperre vor fremden Zugriffen gut geschützt? Falsch! Kriminelle finden Wege, um in gestohlene oder verlorene Smartphones einzudringen. Im schlimmsten Fall greifen sie auf Ihre Banking-App zu und räumen Ihr Konto ab. Wir zeigen Ihnen 3 wichtige Einstellungen, um Ihr Smartphone bei Verlust oder Diebstahl zu schützen. --------------------------------------------- https://www.watchlist-internet.at/news/mit-diesen-3-einstellungen-schuetzen… ∗∗∗ Ransomware tracker: The latest figures [May 2023] ∗∗∗ --------------------------------------------- Note: this Ransomware Tracker is updated on the second Sunday of each month to stay current Although ransomware attacks overall were down in April compared to the prior month, attacks against healthcare organizations shot up to one of its highest levels in years as hospitals and doctors offices increasingly find themselves targeted by hackers. --------------------------------------------- https://therecord.media/ransomware-tracker-the-latest-figures ===================== = Vulnerabilities = ===================== ∗∗∗ Industrial Cellular Routers at Risk: 11 New Vulnerabilities Expose OT Networks ∗∗∗ --------------------------------------------- Several security vulnerabilities have been disclosed in cloud management platforms associated with three industrial cellular router vendors that could expose operational technology (OT) networks to external attacks. The findings were presented by Israeli industrial cybersecurity firm OTORIO at the Black Hat Asia 2023 conference last week. The 11 vulnerabilities allow "remote code execution and full control over hundreds of thousands of devices and OT networks - in some cases, even those not actively configured to use the cloud." --------------------------------------------- https://thehackernews.com/2023/05/industrial-cellular-routers-at-risk-11.ht… ∗∗∗ Screen SFT DAB 600/C: Multiple Vulnerabilities ∗∗∗ --------------------------------------------- * Authentication Bypass Account Creation Exploit * Authentication Bypass Password Change Exploit * Authentication Bypass Erase Account Exploit * Authentication Bypass Admin Password Change Exploit * Authentication Bypass Reset Board Config Exploit * Unauthenticated Information Disclosure (userManager.cgx) --------------------------------------------- https://www.zeroscience.mk/en/vulnerabilities/ ∗∗∗ SECURITY BULLETIN: May 2023 Security Bulletin for Trend Micro Mobile Security (Enterprise) ∗∗∗ --------------------------------------------- CVE Identifier(s): CVE-2023-32521 through CVE-2023-32528 Trend Micro has released a new build for Trend Micro Mobile Security (Enterprise) that resolves several vulnerabilities. --------------------------------------------- https://success.trendmicro.com/dcx/s/solution/000293106?language=en_US ∗∗∗ Multiple Vulnerabilities in Kiddoware Kids Place Parental Control Android App ∗∗∗ --------------------------------------------- Multiple vulnerabilities have been identified in the Kiddoware Kids Place Parental Control Android App. Users of the parent's web dashboard can be attacked via cross site scripting or cross site request forgery vulnerabilities, or attackers may upload arbitrary files to the children's devices. Furthermore, children are able to bypass any restrictions without the parents noticing. --------------------------------------------- https://sec-consult.com/vulnerability-lab/advisory/multiple-vulnerabilities… ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (golang-websocket, kernel, postgresql-11, and thunderbird), Fedora (firefox, kernel, libreswan, libssh, tcpreplay, and thunderbird), SUSE (dcmtk, gradle, libraw, postgresql12, postgresql13, postgresql14, and postgresql15), and Ubuntu (firefox, nova, and thunderbird). --------------------------------------------- https://lwn.net/Articles/931892/ ∗∗∗ VM2 Security Advisory: Inspect Manipulation ∗∗∗ --------------------------------------------- A threat actor can edit options for console.log. --------------------------------------------- https://github.com//patriksimek/vm2/security/advisories/GHSA-p5gc-c584-jj6v ∗∗∗ VM2 Security Advisory: Sandbox Escape ∗∗∗ --------------------------------------------- A threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. --------------------------------------------- https://github.com//patriksimek/vm2/security/advisories/GHSA-whpj-8f3w-67p5 ∗∗∗ WAGO: Unauthenticated command execution via Web-based-management ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2023-007/ ∗∗∗ Helmholz: Multiple vulnerabilites in myREX24 and myREX24.virtual ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2023-008/ ∗∗∗ MB Connect Line: Multiple vulnerabilities in mbConnect24 and mymbConnect24 ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2023-002/ ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 12.05.2023
by Daily end-of-shift report 12 May '23

12 May '23

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 11-05-2023 18:00 − Freitag 12-05-2023 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Windows: Windows-Sicherheitspatch kann Bootmedien unbrauchbar machen ∗∗∗ --------------------------------------------- Aktuell lässt sich Secure Boot in Windows durch eine Lücke umgehen. Bis die gefixt ist, wird es wohl noch bis 2024 dauern - aus Gründen. --------------------------------------------- https://www.golem.de/news/windows-windows-sicherheitspatch-kann-bootmedien-… ∗∗∗ New Stealthy Variant of Linux Backdoor BPFDoor Emerges from the Shadows ∗∗∗ --------------------------------------------- A previously undocumented and mostly undetected variant of a Linux backdoor called BPFDoor has been spotted in the wild, cybersecurity firm Deep Instinct said in a technical report published this week. "BPFDoor retains its reputation as an extremely stealthy and difficult-to-detect malware with this latest iteration," security researchers Shaul Vilkomir-Preisman and Eliran Nissan said. --------------------------------------------- https://thehackernews.com/2023/05/new-variant-of-linux-backdoor-bpfdoor.html ∗∗∗ Malicious Actors Exploit CVE-2023-27350 in PaperCut MF and NG ∗∗∗ --------------------------------------------- This joint advisory provides detection methods for exploitation of CVE-2023-27350 as well and indicators of compromise (IOCs) associated with Bl00dy Ransomware Gang activity. FBI and CISA strongly encourage users and administrators to immediately apply patches, and workarounds if unable to patch. FBI and CISA especially encourage organizations who did not patch immediately to assume compromise and hunt for malicious activity using the detection signatures in this CSA. --------------------------------------------- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-131a ∗∗∗ Mehrere Sicherheitslücken in VMwares Cloud-Management Aria Operations ∗∗∗ --------------------------------------------- Patches schließen mehrere Sicherheitslücken, die die Ausweitung von Rechten innerhalb von VMwares Cloud-Management Aria Operationse erlauben. --------------------------------------------- https://heise.de/-9012909 ∗∗∗ Verschlüsselungstrojaner: Es gibt Hoffnung für BlackCat-Opfer ∗∗∗ --------------------------------------------- Stimmen die Voraussetzungen, können Opfer des Verschlüsselungstrojaner BlackCat wieder auf ihre Daten zugreifen. --------------------------------------------- https://heise.de/-9010373 ∗∗∗ Shopsystem: Kritische Sicherheitslücke in Prestashop wird angegriffen ∗∗∗ --------------------------------------------- Eine kritische Sicherheitslücke klafft im Shopping-System Prestashop. Angreifer missbrauchen sie bereits. Ein aktueller Softwarestand schützt. --------------------------------------------- https://heise.de/-9010286 ∗∗∗ Cisco: SD-WAN-Zertifikate abgelaufen, jetzt updaten! ∗∗∗ --------------------------------------------- Cisco Systems weist seine Kundschaft darauf hin, dass einige SD-WAN Appliances der vEdge-Reihe dringende Updates benötigen. --------------------------------------------- https://heise.de/-9014471 ∗∗∗ Enforce Zero Trust in Microsoft 365 – Part 2: Protect against external users and applications ∗∗∗ --------------------------------------------- In the first blog post of this series, we have seen how strong authentication, i.e., Multi-Factor Authentication (MFA), could be enforced for users using a free Azure Active Directory subscription within the Microsoft 365 environment. In this blog post, we will continue to harden the configuration of our Azure AD tenant to enforce Zero Trust [...] --------------------------------------------- https://blog.nviso.eu/2023/05/12/enforce-zero-trust-in-microsoft-365-part-2… ===================== = Vulnerabilities = ===================== ∗∗∗ Severe Security Flaw Exposes Over a Million WordPress Sites to Hijack ∗∗∗ --------------------------------------------- The issue, tracked as CVE-2023-32243, has been addressed by the plugin maintainers in version 5.7.2 that was shipped on May 11, 2023. Essential Addons for Elementor has over one million active installations. --------------------------------------------- https://thehackernews.com/2023/05/severe-security-flaw-exposes-over.html ∗∗∗ VMSA-2023-0009: VMware Aria Operations (formerly vRealize Operations) ∗∗∗ --------------------------------------------- CVSSv3 Range: 6.4-8.8 CVE(s): CVE-2023-20877, CVE-2023-20878, CVE-2023-20879, CVE-2023-20880 VMware Aria Operations update addresses multiple Local Privilege Escalations and a Deserialization issue --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2023-0009.html ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (postgresql-13 and webkit2gtk), Fedora (git), SUSE (helm and skopeo), and Ubuntu (cinder, nova, python-glance-store, and python-os-brick). --------------------------------------------- https://lwn.net/Articles/931760/ ∗∗∗ Case update: DIVD-2022-00068 - Multiple vulnerabilities identified within White Rabbit Switch from CERN ∗∗∗ --------------------------------------------- Last event: 11 Apr 2023 - CERN released White Rabbit Switch 6.0.2, which contains a fix for CVE-2023-22577 and CVE-2023-22581. --------------------------------------------- https://csirt.divd.nl/cases/DIVD-2022-00068/ ∗∗∗ Beekeeper Studio vulnerable to code injection ∗∗∗ --------------------------------------------- https://jvn.jp/en/jp/JVN11705010/ ∗∗∗ [R1] Nessus Version 10.5.2 Fixes Multiple Vulnerabilities ∗∗∗ --------------------------------------------- https://www.tenable.com/security/tns-2023-20 ∗∗∗ IBM WebSphere Application Server, which is bundled with IBM Cloud Pak for Applications, is vulnerable to an XML External Entity (XXE) Injection vulnerability (CVE-2023-27554) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6989667 ∗∗∗ IBM WebSphere Application Server, which is bundled with IBM WebSphere Hybrid Edition, is vulnerable to an XML External Entity (XXE) Injection vulnerability (CVE-2023-27554) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6989665 ∗∗∗ Deserialization vulnerability affect IBM Business Automation Workflow BPM Event Emitters - CVE-2022-1471 ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6988027 ∗∗∗ Multiple Vulnerabilities in Multicloud Management Security Services ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6991215 ∗∗∗ IBM i Modernization Engine for Lifecycle Integration is vulnerable to cross-site scripting (CVE-2022-0225) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6991217 ∗∗∗ A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM WebSphere Remote Server (CVE-2023-27554) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6991213 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 11.05.2023
by Daily end-of-shift report 11 May '23

11 May '23

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 10-05-2023 18:00 − Donnerstag 11-05-2023 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Interview: Hacker Witold Waligóra über Seitenkanalangriffe ∗∗∗ --------------------------------------------- Wir haben beim Hacker Witold Waligóra nachgehakt, was man mit Seitenkanalattacken erreichen kann und wie man sich dagegen schützt. --------------------------------------------- https://heise.de/-8983428 ∗∗∗ Smishing: Vorsicht vor betrügerischer Reisepass-SMS! ∗∗∗ --------------------------------------------- Haben Sie ein SMS bekommen, in dem behauptet wird Ihr Reisepass wäre fertig? Klicken Sie nicht auf den Link "oesterreich.at-anmelden.net", es handelt sich um einen Betrugsversuch! --------------------------------------------- https://www.watchlist-internet.at/news/smishing-vorsicht-vor-betruegerische… ∗∗∗ Fake in-browser Windows updates push Aurora info-stealer malware ∗∗∗ --------------------------------------------- A recently spotted malvertising campaign tricked users with an in-browser Windows update simulation to deliver the Aurora information stealing malware. --------------------------------------------- https://www.bleepingcomputer.com/news/security/fake-in-browser-windows-upda… ∗∗∗ RapperBot DDoS malware adds cryptojacking as new revenue stream ∗∗∗ --------------------------------------------- New samples of the RapperBot botnet malware have added cryptojacking capabilites to mine for cryptocurrency on compromised Intel x64 machines. --------------------------------------------- https://www.bleepingcomputer.com/news/security/rapperbot-ddos-malware-adds-… ∗∗∗ Multiple Ransomware Groups Adapt Babuk Code to Target ESXi VMs ∗∗∗ --------------------------------------------- Two years ago, a popular ransomware-as-a-service groups source code got leaked. Now other ransomware groups are using it for their own purposes. --------------------------------------------- https://www.darkreading.com/cloud/multiple-ransomware-groups-adapt-babuk-co… ∗∗∗ New ransomware trends in 2023 ∗∗∗ --------------------------------------------- On the eve of the global Anti-Ransomware Day, Kaspersky researchers share an overview of the key trends observed among ransomware groups. --------------------------------------------- https://securelist.com/new-ransomware-trends-in-2023/109660/ ∗∗∗ Analysis of CLR SqlShell Used to Attack MS-SQL Servers ∗∗∗ --------------------------------------------- This blog post will analyze the CLR SqlShell malware that is being used to target MS-SQL servers. Similar to WebShell, which can be installed on web servers, SqlShell is a malware strain that supports various features after being installed on an MS-SQL server, such as executing commands from threat actors and carrying out all sorts of malicious behavior. --------------------------------------------- https://asec.ahnlab.com/en/52479/ ===================== = Vulnerabilities = ===================== ∗∗∗ Experts share details of five flaws that can be chained to hack Netgear RAX30 Routers ∗∗∗ --------------------------------------------- Researchers disclosed the details of five vulnerabilities that can be chained to take over some Netgear router models. --------------------------------------------- https://securityaffairs.com/146111/hacking/netgear-router-exploit-2.html ∗∗∗ Zyxel Chained Remote Code Execution ∗∗∗ --------------------------------------------- This module exploits multiple vulnerabilities in the `zhttpd` binary (/bin/zhttpd) and `zcmd` binary (/bin/zcmd). It is present on more than 40 Zyxel routers and CPE devices. The remote code execution vulnerability can be exploited by chaining the local file disclosure vulnerability in the zhttpd binary that allows an unauthenticated attacker to read the entire configuration of the router [..] --------------------------------------------- https://cxsecurity.com/issue/WLB-2023050030 ∗∗∗ Multiple vulnerabilities in Danfoss EM100 ∗∗∗ --------------------------------------------- Multiple injection-related vulnerabilities exist in a set of Danfoss products, among which the EM100. These vulnerabilities should be considered serious and could lead to the full compromise of your system. It is advised to phase out the EM100, as its vendor Danfoss confirms the EM100 to be End of Life and that it will not be releasing a patch for this product. [..] If this is not possible, ensure it is not connected to the public Internet. --------------------------------------------- https://csirt.divd.nl/cases/DIVD-2023-00021/ ∗∗∗ Wordfence Intelligence Weekly WordPress Vulnerability Report (May 1, 2023 to May 7, 2023) ∗∗∗ --------------------------------------------- Last week, there were 58 vulnerabilities disclosed in 43 WordPress Plugins and 3 WordPress themes that have been added to the Wordfence Intelligence Vulnerability Database [..] Review those vulnerabilities in this report now to ensure your site is not affected. --------------------------------------------- https://www.wordfence.com/blog/2023/05/wordfence-intelligence-weekly-wordpr… ∗∗∗ CISA Releases Fifteen Industrial Control Systems Advisories ∗∗∗ --------------------------------------------- * ICSA-23-131-01 Siemens Solid Edge * ICSA-23-131-02 Siemens SCALANCE W1750D * ICSA-23-131-03 Siemens Siveillance * ICSA-23-131-04 Siemens SIMATIC Cloud Connect 7 * ICSA-23-131-05 Siemens SINEC NMS Third-Party * ICSA-23-131-06 Siemens SCALANCE LPE9403 * ICSA-23-131-07 Sierra Wireless AirVantage * ICSA-23-131-08 Teltonika Remote Management System and RUT Model Routers * ICSA-23-131-09 Rockwell Automation Kinetix 5500 EtherNetIP Servo Drive * ICSA-23-131-10 Rockwell Automation Arena Simulation Software * ICSA-23-131-11 BirdDog Cameras & Encoders * ICSA-23-131-12 SDG PnPSCADA * ICSA-23-131-13 PTC Vuforia Studio * ICSA-23-131-14 Rockwell PanelView 800 * ICSA-23-131-15 Rockwell ThinManager --------------------------------------------- https://www.cisa.gov/news-events/alerts/2023/05/11/cisa-releases-fifteen-in… ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (firefox-esr and nvidia-graphics-drivers-legacy-390xx), Fedora (firefox, java-11-openjdk, LibRaw, moodle, python-django3, and vtk), Slackware (mozilla), SUSE (buildah, cloud-init, container-suseconnect, firefox, golang-github-prometheus-prometheus, kernel, and ntp), and Ubuntu (heat, linux-azure-fde-5.15, linux-raspi, linux-oem-5.17, linux-oem-6.0, linux-raspi, linux-raspi-5.4, linux-raspi2, neutron, openvswitch, and sqlparse). --------------------------------------------- https://lwn.net/Articles/931638/ ∗∗∗ ThinkPad Dock Firmware Update Tool Elevation of Privilege Vulnerability ∗∗∗ --------------------------------------------- http://support.lenovo.com/product_security/PS500562-THINKPAD-DOCK-DRIVER-EL… ∗∗∗ CVE-2023-0008 PAN-OS: Local File Disclosure Vulnerability in the PAN-OS Web Interface (Severity: MEDIUM) ∗∗∗ --------------------------------------------- https://security.paloaltonetworks.com/CVE-2023-0008 ∗∗∗ CVE-2023-0007 PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Panorama Web Interface (Severity: MEDIUM) ∗∗∗ --------------------------------------------- https://security.paloaltonetworks.com/CVE-2023-0007 ∗∗∗ Security vulnerabilities have been identified in IBM Db2 shipped with IBM Security Guardium Key Lifecycle Manager (CVE-2022-43930, CVE-2014-3577, CVE-2022-43927, CVE-2022-43929) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6989465 ∗∗∗ IBM Content Manager Enterprise Edition is affected by a vulnerability in Eclipse Openj9 ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6987029 ∗∗∗ Content Manager Enterprise Edition is affected by a vulnerability in FasterXML jackson ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6856659 ∗∗∗ Content Manager Enterprise Edition is affected by a vulnerability in FasterXML jackson ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6856661 ∗∗∗ Content Manager Enterprise Edition is affected by a vulnerability in FasterXML jackson ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6856663 ∗∗∗ A security vulnerability has been identified in IBM WebSphere Application Server shipped with Tivoli Netcool\/OMNIbus WebGUI - IBM\u00ae Java SDK CVE-2023-30441 ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6989589 ∗∗∗ A security vulnerability has been identified in IBM WebSphere Application Server shipped with Tivoli Netcool\/OMNIbus WebGUI (CVE-2023-24966) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6989591 ∗∗∗ A security vulnerability has been identified in IBM WebSphere Application Server shipped with Tivoli Netcool\/OMNIbus WebGUI (CVE-2022-39161) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6989593 ∗∗∗ Vega Vulnerabilities affect IBM Decision Optimization in IBM Cloud Pak for Data (CVE-2023-26486, CVE-2023-26487) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6989625 ∗∗∗ IBM WebSphere Application Server is vulnerable to an XML External Entity (XXE) Injection vulnerability (CVE-2023-27554) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6989451 ∗∗∗ Multiple Security Vulnerabilities have been fixed in IBM Security Verify Access ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6989653 ∗∗∗ A security vulnerability has been identified in IBM WebSphere Application Server shipped with Asset and Service Management (CVE-2023-27554) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6989657 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 10.05.2023
by Daily end-of-shift report 10 May '23

10 May '23

===================== = End-of-Day report = ===================== Timeframe: Dienstag 09-05-2023 18:00 − Mittwoch 10-05-2023 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Patchday: Adobe schließt Schadcode-Lücke in Substance 3D Painter ∗∗∗ --------------------------------------------- Es gibt wichtige Sicherheitsupdates für Adobe Substance 3D Painter. Wer damit 3D-Modelle bearbeitet, sollte die Anwendung aktualisieren. --------------------------------------------- https://heise.de/-8991973 ∗∗∗ Microsoft Patchday: Angreifer verschaffen sich System-Rechte unter Windows ∗∗∗ --------------------------------------------- Microsoft schließt unter anderem in Windows mehrere kritische Schadcode-Lücken. Attacken laufen bereits, weitere könnten bevorstehen. --------------------------------------------- https://heise.de/-8991967 ∗∗∗ Kritische Schwachstellen ermöglichen Übernahme von Aruba Access Points ∗∗∗ --------------------------------------------- Die HPE-Tochter Aruba schließt mehrere, zum Teil kritische Sicherheitslücken in den Access Points. Angreifer aus dem Netz könnten Schadcode einschleusen. --------------------------------------------- https://heise.de/-8992292 ∗∗∗ Patchday: 18 Sicherheitsnotizen zu teils kritischen Lücken in SAP-Software ∗∗∗ --------------------------------------------- Am Mai-Patchday dichtet SAP zum Teil kritische Sicherheitslücken in der Software des Unternehmens ab. IT-Verantwortliche sollten die Updates zügig anwenden. --------------------------------------------- https://heise.de/-8992005 ∗∗∗ Root-Rechte für lokale Angreifer dank Lücken im Linux-Kernel ∗∗∗ --------------------------------------------- In zwei Komponenten des Linuxkernels verstecken sich Sicherheitslücken, die lokalen Angreifern eine Rootshell spendieren. Ein erster Exploit ist öffentlich. --------------------------------------------- https://heise.de/-8992648 ∗∗∗ Easily bypassed patch makes zero-click Outlook flaw exploitable again (CVE-2023-29324) ∗∗∗ --------------------------------------------- Among the vulnerabilities fixed by Microsoft on May 2023 Patch Tuesday is CVE-2023-29324, a bug in the Windows MSHTML platform that Microsoft rates as “important.” Akamai’s research team and Ben Barnea, the researcher who’s credited with finding the flaw, disagree with that assessment, because “the new vulnerability [CVE-2023-29324] re-enables the exploitation of a critical vulnerability [CVE-2023-23397] that was seen in the wild and used by APT operators.” --------------------------------------------- https://www.helpnetsecurity.com/2023/05/10/cve-2023-29324/ ∗∗∗ Vorsicht vor betrügerischem Tier-, Welpen- und Katzenhandel im Internet ∗∗∗ --------------------------------------------- Vermehrt werden der Watchlist Internet aktuell betrügerische Tierangebote aus dem Internet und auf Social Media wie Facebook gemeldet. Süße Bilder junger Kätzchen und Hunde auf Websites, die Vertrauen schaffen sollen, verleiten zu einer unüberlegten Bestellung und Vorabzahlung. Eine Lieferung erfolgt nie – egal wie vielen Zahlungsaufforderungen der kriminellen Züchter:innen nachgekommen wird! --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-vor-betruegerischem-tier-we… ∗∗∗ Free Tool Unlocks Some Encrypted Data in Ransomware Attacks ∗∗∗ --------------------------------------------- "White Phoenix" automated tool for recovering data on partially encrypted files hit with ransomware is available on GitHub. --------------------------------------------- https://www.darkreading.com/attacks-breaches/free-tool-unlocks-some-encrypt… ∗∗∗ PwnAssistant - Controlling /homes via a Home Assistant RCE ∗∗∗ --------------------------------------------- [..] we decided to look into the very established and known open-source automation ecosystem known as Home Assistant. [..] So without further ado, come with us on this journey to understanding the Home Assistant architecture, enumerating the attack surface and trawling for pre-authentication vulnerabilities within the code base. --------------------------------------------- https://www.elttam.com/blog/pwnassistant/ ∗∗∗ Xjquery Wave of WordPress SocGholish Injections ∗∗∗ --------------------------------------------- By the end of March, 2023, we started noticing a new wave of SocGholish injections that used the intermediary xjquery[.]com domain. It appeared to be another evolution of the same malware. This time, however, attackers were using the same tricks in a different way. --------------------------------------------- https://blog.sucuri.net/2023/05/xjquery-wave-of-wordpress-socgholish-inject… ∗∗∗ ESET APT Activity Report Q4 2022–Q1 2023 ∗∗∗ --------------------------------------------- An overview of the activities of selected APT groups investigated and analyzed by ESET Research in Q4 2022 and Q1 2023 --------------------------------------------- https://www.welivesecurity.com/2023/05/09/eset-apt-activity-report-q42022-q… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (emacs), Fedora (chromium, community-mysql, and LibRaw), Red Hat (nodejs nodejs-nodemon, nodejs:18, and webkit2gtk3), Slackware (mozilla), SUSE (amazon-ssm-agent, conmon, distribution, docker-distribution, google-cloud-sap-agent, ignition, kernel, ntp, prometheus-ha_cluster_exporter, protobuf-c, python-cryptography, runc, and shim), and Ubuntu (ceph, freetype, and node-css-what). --------------------------------------------- https://lwn.net/Articles/931488/ ∗∗∗ ICS Patch Tuesday: Siemens, Schneider Electric Address Few Dozen Vulnerabilities ∗∗∗ --------------------------------------------- Siemens and Schneider Electric’s Patch Tuesday advisories for May 2023 address a few dozen vulnerabilities found in their products. --------------------------------------------- https://www.securityweek.com/ics-patch-tuesday-siemens-schneider-electric-a… ∗∗∗ Chipmaker Patch Tuesday: Intel, AMD Address Over 100 Vulnerabilities ∗∗∗ --------------------------------------------- Intel and AMD have informed their customers about a total of more than 100 vulnerabilities found in their products. --------------------------------------------- https://www.securityweek.com/chipmaker-patch-tuesday-intel-amd-address-over… ∗∗∗ Hitachi Energy MSM ∗∗∗ --------------------------------------------- CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Hitachi Energy Equipment: Modular Switchgear Monitoring (MSM) Vulnerabilities: Improper Restriction of Excessive Authentication Attempts, Authentication Bypass by Capture-replay, Code Injection, Improper Restriction of Operations within the Bounds of a Memory Buffer, NULL Pointer Dereference, Insufficient Entropy --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-129-02 ∗∗∗ Vulnerability Spotlight: Authentication bypass, use-after-free vulnerabilities found in a library for the µC/OS open-source operating system ∗∗∗ --------------------------------------------- TALOS-2022-1680 (CVE-2022-41985) could allow an attacker to bypass the authentication protocol on the operating system, or cause a denial-of-service, by sending the targeted machine a specially crafted set of network packets. --------------------------------------------- https://blog.talosintelligence.com/vulnerability-spotlight-authentication-b… ∗∗∗ SLP Protocol Denial-of-Service Guidance ∗∗∗ --------------------------------------------- http://support.lenovo.com/product_security/PS500563-SLP-PROTOCOL-DENIAL-OF-… ∗∗∗ Multi-vendor BIOS Security Vulnerabilities (May 2023) ∗∗∗ --------------------------------------------- http://support.lenovo.com/product_security/PS500559-MULTI-VENDOR-BIOS-SECUR… ∗∗∗ ThinkPad Dock Driver Elevation of Privilege Vulnerability ∗∗∗ --------------------------------------------- http://support.lenovo.com/product_security/PS500562-THINKPAD-DOCK-DRIVER-EL… ∗∗∗ [R1] Nessus Network Monitor Version 6.2.1 Fixes Multiple Vulnerabilities ∗∗∗ --------------------------------------------- https://www.tenable.com/security/tns-2023-19 ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 09.05.2023
by Daily end-of-shift report 09 May '23

09 May '23

===================== = End-of-Day report = ===================== Timeframe: Montag 08-05-2023 18:00 − Dienstag 09-05-2023 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ A new, stealthier type of Typosquatting attack spotted targeting NPM ∗∗∗ --------------------------------------------- Attackers have been using lowercase letters in package names on the Node Package Manager (NPM) registry for potential malicious package impersonation. This deceptive tactic presents a dangerous twist on a well-known attack method -- "Typosquatting." --------------------------------------------- https://checkmarx.com/blog/a-new-stealthier-type-of-typosquatting-attack-sp… ∗∗∗ AndoryuBot DDoS Botnet Exploiting Ruckus AP Vulnerability ∗∗∗ --------------------------------------------- Owners of Ruckus access points (APs) have been warned that a DDoS botnet named AndoryuBot has been exploiting a recently patched vulnerability to hack devices. The vulnerability in question is tracked as CVE-2023-25717 and it was patched by Ruckus in February in many of its wireless APs. --------------------------------------------- https://www.securityweek.com/andoryubot-ddos-botnet-exploiting-ruckus-ap-vu… ∗∗∗ Building Automation System Exploit Brings KNX Security Back in Spotlight ∗∗∗ --------------------------------------------- A public exploit targeting building automation systems has brought KNX security back into the spotlight, with industrial giant Schneider Electric releasing a security bulletin to warn customers about the potential risks. --------------------------------------------- https://www.securityweek.com/building-automation-system-exploit-brings-knx-… ∗∗∗ Buchen Sie Ihre Unterkunft nicht über booked.net oder hotel-mix.de ∗∗∗ --------------------------------------------- Sie suchen eine Unterkunft? Buchen Sie lieber nicht auf booked.net oder hotel-mix.de, denn die beiden Buchungsplattformen listen Unterkünfte, die keinen Vertrag mit der Plattform haben. In der gebuchten Unterkunft angekommen, kann es Ihnen passieren, dass die Betreiber:innen gar nichts von Ihrer Buchung wissen und Sie kurzfristig eine neue Schlafmöglichkeit suchen müssen. --------------------------------------------- https://www.watchlist-internet.at/news/buchen-sie-ihre-unterkunft-nicht-ueb… ∗∗∗ New phishing-as-a-service tool “Greatness” already seen in the wild ∗∗∗ --------------------------------------------- A previously unreported phishing-as-a-service (PaaS) offering named “Greatness” has been used in several phishing campaigns since at least mid-2022. Greatness incorporates features seen in some of the most advanced PaaS offerings, such as multi-factor authentication (MFA) bypass, IP filtering and integration with Telegram bots. --------------------------------------------- https://blog.talosintelligence.com/new-phishing-as-a-service-tool-greatness… ===================== = Vulnerabilities = ===================== ∗∗∗ WordPress Plugin "Newsletter" vulnerable to cross-site scripting ∗∗∗ --------------------------------------------- WordPress Plugin "Newsletter" provided by Stefano Lissa & The Newsletter Team contains a cross-site scripting vulnerability (CWE-79). An arbitrary script may be executed on the web browser of the user who is logging in to the WordPress using the plugin. --------------------------------------------- https://jvn.jp/en/jp/JVN59341308/ ∗∗∗ WordPress Plugin "VK Blocks" and "VK All in One Expansion Unit" vulnerable to cross-site scripting ∗∗∗ --------------------------------------------- * An arbitrary script may be executed on the web browser of the user who is logging in to the product - CVE-2023-27923, CVE-2023-28367 * An arbitrary script may be executed on the web browser of the user who is accessing the site using the product - CVE-2023-27925, CVE-2023-27926 --------------------------------------------- https://jvn.jp/en/jp/JVN95792402/ ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Fedora (java-11-openjdk-portable and rubygem-redcarpet), Red Hat (autotrace, bind, buildah, butane, conmon, containernetworking-plugins, curl, device-mapper-multipath, dhcp, edk2, emacs, fence-agents, freeradius, freerdp, frr, fwupd, gdk-pixbuf2, git, git-lfs, golang-github-cpuguy83-md2man, grafana, grafana-pcp, gstreamer1-plugins-good, Image Builder, jackson, kernel, kernel-rt, krb5, libarchive, libguestfs-winsupport, libreswan, libtiff, libtpms, lua, mysql, net-snmp, openssh, openssl, pcs, php:8.1, pki-core, podman, poppler, postgresql-jdbc, python-mako, qemu-kvm, samba, skopeo, sysstat, tigervnc, toolbox, unbound, webkit2gtk3, wireshark, xorg-x11-server, and xorg-x11-server-Xwayland), SUSE (cfengine, cfengine-masterfiles, go1.19, go1.20, libfastjson, python-cryptography, and python-ujson), and Ubuntu (mysql-5.7). --------------------------------------------- https://lwn.net/Articles/931384/ ∗∗∗ Citrix ADC and Citrix Gateway Security Bulletin ∗∗∗ --------------------------------------------- * CVE-2023-24488, Cross site scripting, CVSS 6.1 * CVE-2023-24487, Arbitrary file read, CVSS 6.3 --------------------------------------------- https://support.citrix.com/article/CTX477714/citrix-adc-and-citrix-gateway-… ∗∗∗ SSA-932528 V1.0: Multiple File Parsing Vulnerabilities in Solid Edge ∗∗∗ --------------------------------------------- https://cert-portal.siemens.com/productcert/html/ssa-932528.html ∗∗∗ SSA-892048 V1.0: Third-Party Component Vulnerabilities in SINEC NMS before V1.0.3.1 ∗∗∗ --------------------------------------------- https://cert-portal.siemens.com/productcert/html/ssa-892048.html ∗∗∗ SSA-789345 V1.0: Code Execution Vulnerabilities in Siveillance Video Event and Management Servers ∗∗∗ --------------------------------------------- https://cert-portal.siemens.com/productcert/html/ssa-789345.html ∗∗∗ SSA-555292 V1.0: Security Vulnerabilities Fixed in SIMATIC Cloud Connect 7 V2.1 ∗∗∗ --------------------------------------------- https://cert-portal.siemens.com/productcert/html/ssa-555292.html ∗∗∗ SSA-516174 V1.0: Wi-Fi Encryption Bypass Vulnerabilities in SCALANCE W1750D ∗∗∗ --------------------------------------------- https://cert-portal.siemens.com/productcert/html/ssa-516174.html ∗∗∗ SSA-325383 V1.0: Multiple Vulnerabilities in SCALANCE LPE9403 before V2.1 ∗∗∗ --------------------------------------------- https://cert-portal.siemens.com/productcert/html/ssa-325383.html ∗∗∗ F5: K000133759 : Python vulnerability CVE-2020-26116 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000133759 ∗∗∗ F5: K000134496 : Jettison vulnerability CVE-2022-45685 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000134496 ∗∗∗ Security vulnerabilities have been identified in IBM DB2 shipped with IBM License Metric Tool v9. ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6988953 ∗∗∗ Tensorflow is vulnerable to security CVEs used in IBM Maximo Application Suite - Monitor Component ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6988959 ∗∗∗ IBM WebSphere Application Server is vulnerable to cross-site scripting in the Admin Console (CVE-2023-24966) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6986333 ∗∗∗ TensorFlow is vulnerable to security CVEs used in IBM Maximo Application Suite - Monitor Component ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6988979 ∗∗∗ Ansi-html is vulnerable to CVE-2021-23424 used in IBM Maximo Application Suite ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6988981 ∗∗∗ Node-forge is vulnerable to security CVEs used in IBM Maximo Application Suite - Monitor Component ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6988969 ∗∗∗ Apache Log4j is vulnerable to CVE-2021-45105 and CVE-2021-45046 used in IBM Maximo Application Suite - Monitor Component ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6988975 ∗∗∗ Vulnerabilities in OpenSSL affect QLogic 8Gb Intelligent Pass-thru Module and SAN Switch Module for IBM BladeCenter and QLogic Virtual Fabric Extension Module for IBM BladeCenter ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/888295 ∗∗∗ IBM Cloud Pak for Network Automation 2.4.6 fixes multiple security vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6989099 ∗∗∗ CVE-2023-24536, CVE-2023-24537 and CVE-2023-24534 may affect IBM CICS TX Standard ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6989115 ∗∗∗ CVE-2023-24536, CVE-2023-24537, CVE-2023-24534 may affect IBM CICS TX Advanced ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6989117 ∗∗∗ A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM WebSphere Remote Server (CVE-2022-39161) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6989119 ∗∗∗ WebSphere Application Server Liberty is vulnerable to CVE-2022-3509 and CVE-2022-3171 used in IBM Maximo Application Suite - Monitor Component ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6989133 ∗∗∗ IBM WebSphere Application Server Liberty and Open Liberty is vulnerable to CVE-2022-22475 used in IBM Maximo Application Suite - Monitor Component ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6989131 ∗∗∗ IBM WebSphere Application Server Liberty is vulnerable to CVE-2022-22393 used in IBM Maximo Application Suite - Monitor Component ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6989127 ∗∗∗ A security vulnerability has been identified in IBM WebSphere Application Server shipped with Asset and Service Management (CVE-2022-39161) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6989145 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 08.05.2023
by Daily end-of-shift report 08 May '23

08 May '23

===================== = End-of-Day report = ===================== Timeframe: Freitag 05-05-2023 18:00 − Montag 08-05-2023 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Meet Akira — A new ransomware operation targeting the enterprise ∗∗∗ --------------------------------------------- The new Akira ransomware operation has slowly been building a list of victims as they breach corporate networks worldwide, encrypt files, and then demand million-dollar ransoms. --------------------------------------------- https://www.bleepingcomputer.com/news/security/meet-akira-a-new-ransomware-… ∗∗∗ Datenleck: Firmware- und Bootguard-Schlüssel von MSI veröffentlicht ∗∗∗ --------------------------------------------- Eine Ransomwaregruppe hat nach einem Hack etliche interne Daten von MSI veröffentlicht. Darunter auch private Schlüssel zum Signieren. --------------------------------------------- https://www.golem.de/news/datenleck-firmware-und-bootguard-schluessel-von-m… ∗∗∗ New Cactus ransomware encrypts itself to evade antivirus ∗∗∗ --------------------------------------------- While the new threat actor adopted the usual tactics seen in ransomware attacks - file encryption and data theft - it added its own touch to avoid detection. [..] Researchers at Kroll corporate investigation and risk consulting firm believe that Cactus obtains initial access into the victim network by exploiting known vulnerabilities in Fortinet VPN appliances. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-cactus-ransomware-encryp… ∗∗∗ Breaking down Reverse shell commands ∗∗∗ --------------------------------------------- In pentesting assessments and CTFs we always need reverse shells to execute commands on target machine once we have exploited a system and have a command injection at some point in our engagement. For that we have an awesome project: revshells.com or reverse-shell-generator where we have a ton of reverse shell payloads listed. This blog post tries to explain their working. --------------------------------------------- https://adityatelange.in/blog/revshells/ ∗∗∗ Quickly Finding Encoded Payloads in Office Documents ∗∗∗ --------------------------------------------- Malicious documents like this RevengeRAT ppam file found on MalwareBazaar contain VBA code that you can analyze with oledump.py. Some shortcuts can be used [..] But there is a quicker method: let zipdump.py produce JSON output that contains the decompressed content of each file, and then let base64dump.py consume this JSON output. --------------------------------------------- https://isc.sans.edu/diary/rss/29818 ∗∗∗ Dependabot Confusion: Gaining Access to Private GitHub Repositories using Dependabot ∗∗∗ --------------------------------------------- Dependabot is one of the most widely deployed tools to improve software supply chain security. But like all other software, it is not immune to security vulnerabilities. By using it, users take on the risk that any vulnerabilities in Dependabot itself may lead to the compromise of the very supply chain they are trying to secure. This article is about a vulnerability in Dependabot that allowed arbitrary user to gain access to a subset of GitHub repositories that have Dependabot enabled. --------------------------------------------- https://giraffesecurity.dev/posts/dependabot-confusion/ ∗∗∗ Microsoft-Webbrowser: Edge 113 schließt Sicherheitslücken ∗∗∗ --------------------------------------------- Microsoft hat den Webbrowser Edge in Version 113 veröffentlicht. Einige Funktionen haben die Entwickler darin verbessert sowie Schwachstellen abgedichtet. --------------------------------------------- https://heise.de/-8990437 ∗∗∗ Achtung! Diese Kosmetika sind gesundheitsschädigend! ∗∗∗ --------------------------------------------- Derzeit warnen die Agentur für Gesundheit und Ernährungssicherheit (AGES) und das Bundesamt für Verbrauchergesundheit (BAVG) vor kosmetischen Produkten, die verbotene und gesundheitsschädigende Duftstoffe enthalten. Die Produkte werden vor allem online verkauft. Wir zeigen Ihnen, von welchen Produkten Sie lieber die Finger lassen sollten. --------------------------------------------- https://www.watchlist-internet.at/news/achtung-diese-kosmetika-sind-gesundh… ∗∗∗ Webinar: Sicher (ver)kaufen über Willhaben, Shpock & Co. ∗∗∗ --------------------------------------------- Was muss ich beachten, wenn ich auf Kleinanzeigenplattformen wie Willhaben, Shpock, Vinted & Co. etwas als Privatperson kaufen oder verkaufen möchte? Unser Rechtsexperte der Internet Ombudsstelle gibt Tipps für die sichere Abwicklung solcher Online-Geschäfte. Nehmen Sie kostenlos teil: Dienstag 16. Mai 2023, 18:30 - 20:00 Uhr via zoom --------------------------------------------- https://www.watchlist-internet.at/news/webinar-sicher-verkaufen-ueber-willh… ∗∗∗ PRFs, PRPs and other fantastic things ∗∗∗ --------------------------------------------- A few weeks ago I ran into a conversation on Twitter about the weaknesses of applied cryptography textbooks, and how they tend to spend way too much time lecturing people about Feistel networks and the boring details of AES. Some of the folks in this conversation suggested that instead of these things, we should be into more fundamental topics like “what is a pseudorandom function.” --------------------------------------------- https://blog.cryptographyengineering.com/2023/05/08/prfs-prps-and-other-fan… ∗∗∗ WordPress plugin vulnerability puts two million websites at risk ∗∗∗ --------------------------------------------- Millions of WordPress-powered websites are using the Advanced Custom Fields and Advanced Custom Fields Pro plugins, which security researchers say have been vulnerable to cross-site scripting (XSS) attacks. --------------------------------------------- https://grahamcluley.com/wordpress-plugin-vulnerability-puts-two-million-we… ∗∗∗ Cisco SPA112 2-Port Telefonadapter unsicher, es bleibt nur noch entsorgen ∗∗∗ --------------------------------------------- Die US-Anbieter Cisco warnt in eine Meldung vor einer kritischen Schwachstelle in einem seiner Telefonadapter. Diese Schwachstelle ermöglicht einem Angreifer die Kontrolle über das Gerät zu übernehmen. Leider bleibt betroffenen Nutzern nur, diesen Telefonadapter zu entsorgen [...] --------------------------------------------- https://www.borncity.com/blog/2023/05/06/cisco-spa112-2-port-telefonadapter… ===================== = Vulnerabilities = ===================== ∗∗∗ ads-tec: Multiple Vulnerabilities in IRF1000, IRF2000 and IRF3000 ∗∗∗ --------------------------------------------- Vendor: ads-tec Industrial IT GmbH Product name: IRF1000, IRF3000, IRF3000 CVE Numbers: CVE-2014-3669, CVE-2014-8142, CVE-2014-9425, CVE-2015-0231, CVE-2015-2348, CVE-2015-2787, CVE-2015-3414, CVE-2015-3415, CVE-2015-4602, CVE-2015-6835, CVE-2015-8876, CVE-2016-10161, CVE-2016-7124, CVE-2016-7411, CVE-2016-9138, CVE-2017-11142, CVE-2017-12933, CVE-2017-8923 CVSS Score: up to 9.8 --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2023-009/ ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Fedora (rust-cargo-c, rust-coreos-installer, rust-fedora-update-feedback, rust-git-delta, rust-gst-plugin-reqwest, rust-pore, rust-rpm-sequoia, rust-sequoia-octopus-librnp, rust-sequoia-policy-config, rust-sequoia-sq, rust-sevctl, rust-tealdeer, and rust-ybaas), Mageia (avahi, git, imagemagick, libfastjson, libxml2, parcellite, and virtualbox), SUSE (containerd, dnsmasq, ffmpeg, git, indent, installation-images, java-17-openjdk, maven and recommended update for antlr3, minlog, sbt, xmvn, ncurses, netty, netty-tcnative, openssl-1_0_0, python-Django1, redis, shim, terraform-provider-helm, and zstd), and Ubuntu (erlang, mysql-5.7, mysql-8.0, ruby2.3, ruby2.5, ruby2.7, and webkit2gtk). --------------------------------------------- https://lwn.net/Articles/931259/ ∗∗∗ 3 Schwachstellen in MS Azure API-Management entdeckt ∗∗∗ --------------------------------------------- Sicherheitsforscher des israelischen Sicherheitsanbieters Ermetic haben drei Schwachstellen in Microsofts Azure API-Management entdeckt. Zwei SSRF-Schwachstellen (Server-Side Request Forgery) und ein Problem beim uneingeschränkten Datei-Upload schaffen Risiken für die Microsoft Cloud-Umgebung. Die Schwachstellen können von böswilligen Akteuren missbraucht werden [...] --------------------------------------------- https://www.borncity.com/blog/2023/05/06/3-schwachstellen-in-ms-azure-api-m… ∗∗∗ Multiple vulnerabilities in IBM Java SDK (January 2023) affect IBM InfoSphere Information Server ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6988347 ∗∗∗ Security Vulnerabilities in IBM WebSphere Liberty and xml2js affect IBM Voice Gateway ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6988603 ∗∗∗ Vulnerability in Jettison affects IBM Process Mining . CVE-2023-1436 ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6988673 ∗∗∗ Vulnerabilities have been identified in IBM WebSphere Application Server traditional and Liberty profile shipped with IBM Business Automation Workflow (CVE-2023-24966, CVE-2022-39161) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6988885 ∗∗∗ Atlas eDiscovery Process Management is affected by a vulnerable dom4j-1.6.1.jar ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6988889 ∗∗∗ Atlas eDiscovery Process Management is affected by a vulnerable xstream-1.4.17.jar ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6988899 ∗∗∗ Atlas eDiscovery Process Management is affected by a vulnerable poi-ooxml-3.9.jar ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6988895 ∗∗∗ Atlas eDiscovery Process Management is affected by a vulnerable org.apache.xerces_2.9.0.v201101211617-4.8.0.jar ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6988893 ∗∗∗ Atlas eDiscovery Process Management is affected by a vulnerable xmlbeans-2.3.0.jar ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6988897 ∗∗∗ Vulnerability in paramiko affects IBM Cloud Pak for Data System 2.0 (CPDS 2.0) [CVE-2022-24302] ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6988909 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 05.05.2023
by Daily end-of-shift report 05 May '23

05 May '23

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 04-05-2023 18:00 − Freitag 05-05-2023 18:00 Handler: Robert Waldner Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ What is XML-RPC? Security Risks & How to Disable ∗∗∗ --------------------------------------------- In this article, we will discuss what xmlrpc.php is, why disabling it can improve your website’s security, and how to determine if it’s currently active on your WordPress site. --------------------------------------------- https://blog.sucuri.net/2023/05/what-is-xml-rpc-security-risks-how-to-disab… ∗∗∗ Fleckpe Android Malware Sneaks onto Google Play Store with Over 620,000 Downloads ∗∗∗ --------------------------------------------- The list of the offending apps is as follows: - Beauty Camera Plus - Beauty Photo Camera - Beauty Slimming Photo Editor - Fingertip Graffiti - GIF Camera Editor - HD 4K Wallpaper - Impressionism Pro Camera - Microclip Video Editor - Night Mode Camera Pro - Photo Camera Editor - Photo Effect Editor --------------------------------------------- https://thehackernews.com/2023/05/fleckpe-android-malware-sneaks-onto.html ∗∗∗ Packagist Repository Hacked: Over a Dozen PHP Packages with 500 Million Compromised ∗∗∗ --------------------------------------------- PHP software package repository Packagist revealed that an "attacker" gained access to four inactive accounts on the platform to hijack over a dozen packages with over 500 million installs to date. "The attacker forked each of the packages and replaced the package description in composer.json with their own message but did not otherwise make any malicious changes," [..] --------------------------------------------- https://thehackernews.com/2023/05/packagist-repository-hacked-over-dozen.ht… ∗∗∗ An overview of the OSI model and its security threats ∗∗∗ --------------------------------------------- The OSI model is a representation of how communications between devices occur. The conceptual model makes it easier to understand how data is transmitted. In its complex process, threat actors have found ways to exploit and compromise systems. It is very important to identify the kind of attacks and vulnerabilities available on each layer and implement proper defense strategies to protect a network. --------------------------------------------- https://www.tripwire.com/state-of-security/overview-osi-model-and-its-secur… ∗∗∗ „Login mit neuem Gerät“: Kriminelle versenden personalisierte E-Mail im Namen der BAWAG ∗∗∗ --------------------------------------------- Kriminelle versenden derzeit betrügerische Nachrichten im Namen der BAWAG. Die E-Mails sind personalisiert und daher besonders glaubwürdig. Sie werden zwar nicht mit Ihrem Namen, allerdings mit ihrer E-Mail-Adresse angesprochen. In der Nachricht behaupten die Kriminellen, dass mit einem neuen Gerät auf Ihr Konto zugegriffen wurde. --------------------------------------------- https://www.watchlist-internet.at/news/login-mit-neuem-geraet-kriminelle-ve… ===================== = Vulnerabilities = ===================== ∗∗∗ ZDI-23-547: (0Day) Linux Kernel IPv6 RPL Protocol Reachable Assertion Denial-of-Service Vulnerability ∗∗∗ --------------------------------------------- This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Linux Kernel. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-23-547/ ∗∗∗ Sante DICOM Viewer Vulnerabilites ∗∗∗ --------------------------------------------- https://www.zerodayinitiative.com/advisories/ZDI-23-523/ https://www.zerodayinitiative.com/advisories/ZDI-23-524/ https://www.zerodayinitiative.com/advisories/ZDI-23-525/ https://www.zerodayinitiative.com/advisories/ZDI-23-526/ https://www.zerodayinitiative.com/advisories/ZDI-23-527/ --------------------------------------------- https://www.zerodayinitiative.com/advisories/published/ ∗∗∗ Synology-SA-23:04 VPN Plus Server ∗∗∗ --------------------------------------------- A vulnerability allows remote attackers to inject SQL commands via a susceptible version of Synology VPN Plus Server. Affected Products: VPN Plus Server for SRM 1.3, VPN Plus Server for SRM 1.2 --------------------------------------------- https://www.synology.com/en-global/security/advisory/Synology_SA_23_04 ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- IBM Elastic Storage System, IBM Spectrum Scale, IBM Maximo Application Suite, IBM Cognos Command Center, AIX, IBMid, IBM SAN Volume Controller, IBM CICS TX, IBM PowerVM Novalink, IBM Process Mining, IBM Cognos Analytics, IBM Planning Analytics. --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (chromium, evolution, and odoo), Fedora (java-11-openjdk), Oracle (samba), Red Hat (libreswan and samba), Slackware (libssh), SUSE (amazon-ssm-agent, apache2-mod_auth_openidc, cmark, containerd, editorconfig-core-c, ffmpeg, go1.20, harfbuzz, helm, java-11-openjdk, java-1_8_0-ibm, liblouis, podman, and vim), and Ubuntu (linux-aws, linux-aws-hwe, linux-intel-iotg, and linux-oem-6.1). --------------------------------------------- https://lwn.net/Articles/931050/ ∗∗∗ K000134469 : MySQL vulnerability CVE-2023-21963 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000134469 ∗∗∗ Spring Cloud Data Flow 2.10.3 Released ∗∗∗ --------------------------------------------- https://spring.io/blog/2023/05/05/spring-cloud-data-flow-2-10-3-released -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily