Daily

daily@lists.cert.at

1 participants
3249 discussions

Tageszusammenfassung - 26.08.2022
by Daily end-of-shift report 26 Aug '22

26 Aug '22

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 25-08-2022 18:00 − Freitag 26-08-2022 18:00 Handler: Thomas Pribitzer Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Living off the land, AD CS style ∗∗∗ --------------------------------------------- Unless you have been living under a rock for the last year or so, Active Directory Certificate Services (AD CS) abuse continues to be a hot topic in offensive security, ever since the excellent research released by Will Schroeder (@harmj0y) and Lee Christensen (@tifkin_). --------------------------------------------- https://www.pentestpartners.com/security-blog/living-off-the-land-ad-cs-sty… ∗∗∗ Threat Assessment: Black Basta Ransomware ∗∗∗ --------------------------------------------- Black Basta is ransomware as a service (RaaS) that first emerged in April 2022. However, evidence suggests that it has been in development since February. The Black Basta operator(s) use the double extortion technique, meaning that in addition to encrypting files on the systems of targeted organizations and demanding ransom to make decryption possible, they also maintain a dark web leak site where they threaten to post sensitive information if an organization chooses not to pay ransom. --------------------------------------------- https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomwar… ∗∗∗ Automatic Execution of Code Upon Package Download on Python Package Manager ∗∗∗ --------------------------------------------- Automatic code execution is triggered upon downloading approximately one third of the packages on PyPi. A worrying feature in pip/PyPi allows code to automatically run when developers are merely downloading a package. --------------------------------------------- https://checkmarx.com/blog/automatic-execution-of-code-upon-package-downloa… ===================== = Vulnerabilities = ===================== ∗∗∗ Lücken in Ciscos FXOS und NX-OS ermöglichen Übernahme der Kontrolle ∗∗∗ --------------------------------------------- In Ciscos Router- und Firewall-Betriebssystemen FXOS und NX-OS hätten Angreifer beliebigen Code mit root-Rechten ausführen können. Updates stehen bereit. --------------------------------------------- https://heise.de/-7244032 ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (zlib), Fedora (dotnet3.1, firefox, java-1.8.0-openjdk-aarch32, thunderbird, and zlib), Mageia (canna, chromium-browser-stable, dovecot, firefox/nss, freeciv, freetype2, gnutls, kernel, kernel-linus, kicad, ldb/samba/sssd, libgsasl, microcode, nodejs, rsync, thunderbird, and unbound), Oracle (php:7.4 and systemd), Scientific Linux (firefox, rsync, systemd, and thunderbird), Slackware (vim), and SUSE (bluez, gstreamer-plugins-good, java-1_7_1-ibm, java-1_8_0-ibm, kernel, libcroco, postgresql10, postgresql13, python-lxml, and webkit2gtk3). --------------------------------------------- https://lwn.net/Articles/906232/ ∗∗∗ CISA Adds Ten Known Exploited Vulnerabilities to Catalog ∗∗∗ --------------------------------------------- CISA has added ten new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise. --------------------------------------------- https://us-cert.cisa.gov/ncas/current-activity/2022/08/25/cisa-adds-ten-kno… ∗∗∗ [R1] Nessus Agent Version 8.3.4 Fixes Multiple Vulnerabilities ∗∗∗ --------------------------------------------- Custom audit files bring tremendous power and flexibility when assessing the configuration of your assets. Two separate vulnerabilities that utilize this custom Audit functionality were identified, reported and fixed. With the release of Nessus Agent 8.3.4, Tenable has mitigated the reported issues by enabling the ability to sign and verify custom audit files. --------------------------------------------- https://www.tenable.com/security/tns-2022-17 ∗∗∗ ABB Security Advisory: ARM600 Cyber Security Notification: UEFI vulnerability ∗∗∗ --------------------------------------------- https://search.abb.com/library/Download.aspx?DocumentID=2NGA001477&Language… ∗∗∗ Security Bulletin: Vulnerability in IBM Java Runtime(CVE-2021-35603) affects DB2 Recovery Expert for Linux, Unix and Windows ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-ibm-java… ∗∗∗ Security Bulletin: Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnera… ∗∗∗ Security Bulletin: IBM MQ is vulnerable to issues with libcurl (CVE-2022-27780, CVE-2022-30115) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-is-vulnerable-to-i… ∗∗∗ Security Bulletin: IBM DataPower Gateway vulnerable to CSRF attack ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-datapower-gateway-vul… ∗∗∗ Security Bulletin: IBM Maximo Asset Management and the IBM Maximo Manage application in IBM Maximo Application Suite are vulnerable to cross-site scripting (CVE-2022-35714) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-maximo-asset-manageme… ∗∗∗ Security Bulletin: Multiple vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: IBM Security Directory Integrator as shipped with IBM Security Directory Suite is affected by Apache Log4j vulnerability (CVE-2021-4104) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-directory-in… ∗∗∗ Security Bulletin: Enterprise Content Management System Monitor is affected by a vulnerability in Java SE related to the JSSE component ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-enterprise-content-manage… ∗∗∗ F5: K42795243: Apache Xalan Java Library vulnerability CVE-2022-34169 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K42795243 ∗∗∗ WebKitGTK and WPE WebKit Security Advisory WSA-2022-0008 ∗∗∗ --------------------------------------------- https://webkitgtk.org/security/WSA-2022-0008.html ∗∗∗ vBulletin Connect: Schwachstelle ermöglicht nicht spezifizierten Angriff ∗∗∗ --------------------------------------------- https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1190 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 25.08.2022
by Daily end-of-shift report 25 Aug '22

25 Aug '22

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 24-08-2022 18:00 − Donnerstag 25-08-2022 18:00 Handler: Thomas Pribitzer Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ PyPI packages hijacked after developers fall for phishing emails ∗∗∗ --------------------------------------------- A phishing campaign caught yesterday was seen targeting maintainers of Python packages published to the PyPI registry. Python packages exotel and spam are among hundreds seen laced with malware after attackers successfully compromised accounts of maintainers who fell for the phishing email. --------------------------------------------- https://www.bleepingcomputer.com/news/security/pypi-packages-hijacked-after… ∗∗∗ More hackers adopt Sliver toolkit as a Cobalt Strike alternative ∗∗∗ --------------------------------------------- Threat actors are dumping the Cobalt Strike penetration testing suite in favor of similar frameworks that are less known. After Brute Ratel, the open-source, cross-platform kit called Sliver is becoming an attractive alternative. --------------------------------------------- https://www.bleepingcomputer.com/news/security/more-hackers-adopt-sliver-to… ∗∗∗ Twilio hackers hit over 130 orgs in massive Okta phishing attack ∗∗∗ --------------------------------------------- Threat analysts have discovered the phishing kit responsible for thousands of attacks against 136 high-profile organizations that have compromised 9,931 accounts. --------------------------------------------- https://www.bleepingcomputer.com/news/security/twilio-hackers-hit-over-130-… ∗∗∗ MagicWeb: NOBELIUM’s post-compromise trick to authenticate as anyone ∗∗∗ --------------------------------------------- Microsoft security researchers have discovered a post-compromise capability we’re calling MagicWeb, which is used by a threat actor we track as NOBELIUM to maintain persistent access to compromised environments. --------------------------------------------- https://www.microsoft.com/security/blog/2022/08/24/magicweb-nobeliums-post-… ∗∗∗ whids - Open Source EDR for Windows ∗∗∗ --------------------------------------------- EDR with artifact collection driven by detection. The detection engine is built on top of a previous project Gene specially designed to match Windows events against user defined rules. --------------------------------------------- https://github.com/0xrawsec/whids ∗∗∗ EDR: Nachfolger der Antiviren-Software kämpfen mit altbekannten Problemen ∗∗∗ --------------------------------------------- Die Security-Industrie preist Endpoint Detection & Response als das bessere Antivirus an. Tests zeigen, dass es oft an den gleichen Problemen scheitert. --------------------------------------------- https://heise.de/-7241955 ∗∗∗ Firefox ESR, Thunderbird: Angreifer könnten Nutzereingaben abfangen ∗∗∗ --------------------------------------------- Es gibt wichtige Sicherheitsupdates für den Mailclient Thunderbird und den Webbrowser Firefox ESR. --------------------------------------------- https://heise.de/-7242897 ∗∗∗ Doxing – was ist das und wie schützt man sich davor? ∗∗∗ --------------------------------------------- Doxing kann jeden treffen - hier erfahren Sie, wie Sie die Wahrscheinlichkeit verringern können, dass Ihre persönlichen Daten als Waffe gegen Sie eingesetzt werden. --------------------------------------------- https://www.welivesecurity.com/deutsch/2022/08/25/doxing-was-ist-das-und-wi… ∗∗∗ Vorsicht vor Coin-Fallen auf Dating-Portalen ∗∗∗ --------------------------------------------- Sie wollen herausfinden, ob es Ihrer Internetbekanntschaft wirklich ernst ist? Haben Sie Geld für Coins oder Guthaben investiert, um mit Ihrer Bekanntschaft zu chatten, es kommt aber nie zu einem persönlichen Treffen? Hier erfahren Sie alles über die Maschen von moderierten Dating-Portalen. --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-vor-coin-fallen-auf-dating-… ∗∗∗ Preparing Critical Infrastructure for Post-Quantum Cryptography ∗∗∗ --------------------------------------------- CISA has released CISA Insights: Preparing Critical Infrastructure for Post-Quantum Cryptography, which outlines the actions that critical infrastructure stakeholders should take now to prepare for their future migration to the post-quantum cryptographic standard that the National Institute of Standards and Technology (NIST) will publish in 2024. --------------------------------------------- https://us-cert.cisa.gov/ncas/current-activity/2022/08/24/preparing-critica… ∗∗∗ Palo Alto warns of firewall vulnerability used in DDoS attack on service provider ∗∗∗ --------------------------------------------- Palo Alto Networks is urging customers to patch a line of firewall products after finding that the vulnerability was used in a distributed denial-of-service (DDoS) attack. On August 19, the company made all patches available for CVE-2022-0028 – which affects the PA-Series, VM-Series and CN-Series of the PAN-OS firewall software. --------------------------------------------- https://therecord.media/palo-alto-warns-of-firewall-vulnerability-used-in-d… ∗∗∗ New Golang Ransomware Agenda Customizes Attacks ∗∗∗ --------------------------------------------- A new piece of ransomware written in the Go language has been targeting healthcare and education enterprises in Asia and Africa. This ransomware is called Agenda and is customized per victim. --------------------------------------------- https://www.trendmicro.com/en_us/research/22/h/new-golang-ransomware-agenda… ===================== = Vulnerabilities = ===================== ∗∗∗ VU#309662: Signed third party UEFI bootloaders are vulnerable to Secure Boot bypass ∗∗∗ --------------------------------------------- The following vendor-specific bootloaders were found vulnerable: Inherently vulnerable bootloader to bypass Secure Boot New Horizon Datasys Inc (CVE-2022-34302) UEFI Shell execution to bypass Secure Boot CryptoPro Secure Disk (CVE-2022-34301) Eurosoft (UK) Ltd (CVE-2022-34303) Microsoft has provided details with their KB5012170 article released on August 9th 2022. Note, these updates can be delivered from your OEM vendor or the OS vendor to install an updated Secure Boot Forbidden Signature Database (DBX). --------------------------------------------- https://kb.cert.org/vuls/id/309662 ∗∗∗ Movable Type XMLRPC API vulnerable to command injection ∗∗∗ --------------------------------------------- Movable Type XMLRPC API provided by Six Apart Ltd. contains a command injection vulnerability. --------------------------------------------- https://jvn.jp/en/jp/JVN57728859/ ∗∗∗ Commerce Elavon - Moderately critical - Access bypass - SA-CONTRIB-2022-053 ∗∗∗ --------------------------------------------- Project: Commerce Elavon Security risk: Moderately critical Vulnerability: Access bypass Description: This module enables you to accept payments from the Elavon payment provider. [..] This vulnerability is mitigated by the fact that an attacker must be able to spoof the Elavon DNS received by your site. --------------------------------------------- https://www.drupal.org/sa-contrib-2022-053 ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (firefox-esr, libxslt, and open-vm-tools), Fedora (dotnet6.0 and firefox), Oracle (curl, firefox, rsync, and thunderbird), Red Hat (curl, firefox, php:7.4, rsync, systemd, and thunderbird), SUSE (bluez, chromium, freerdp, glibc, gnutls, kernel, postgresql10, raptor, rubygem-rails-html-sanitizer, and spice), and Ubuntu (firefox, linux, linux-kvm, linux-lts-xenial, linux-aws, linux-azure-fde, open-vm-tools, and varnish). --------------------------------------------- https://lwn.net/Articles/906055/ ∗∗∗ Atlassian Bitbucket: Schwachstelle ermöglicht Codeausführung ∗∗∗ --------------------------------------------- Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Atlassian Bitbucket ausnutzen, um beliebigen Programmcode auszuführen. --------------------------------------------- https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1185 ∗∗∗ HCL Notes und Domino: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen ∗∗∗ --------------------------------------------- Ein entfernter, anonymer Angreifer kann eine Schwachstelle in HCL Notes und HCL Domino ausnutzen, um Sicherheitsvorkehrungen zu umgehen. --------------------------------------------- https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1180 ∗∗∗ Mattermost security updates 7.1.3 (ESR), 7.0.2, 6.3.10 (ESR) released ∗∗∗ --------------------------------------------- We’re informing you about a Mattermost security update, which addresses a medium-level severity vulnerability. We highly recommend that you apply the update. The security update is available for Mattermost dot releases 7.1.3 (Extended Support Release), 7.0.2, and 6.3.10 (Extended Support Release) for both Team Edition and Enterprise Edition. --------------------------------------------- https://mattermost.com/blog/mattermost-security-updates-7-1-3-esr-7-0-2-6-3… ∗∗∗ Cisco Releases Security Updates for Multiple Products ∗∗∗ --------------------------------------------- Cisco has released security updates for vulnerabilities affecting ACI Multi-Site Orchestrator, FXOS, and NX-OS software. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. --------------------------------------------- https://us-cert.cisa.gov/ncas/current-activity/2022/08/25/cisco-releases-se… ∗∗∗ SMA100 Exposure of Sensitive Information to an Unauthorized Actor ∗∗∗ --------------------------------------------- A vulnerability in the SonicWall SMA100 appliance could potentially expose sensitive information i.e., third-party packages and library versions used in the appliance firmware to a pre-authenticated actor.IMPORTANT: SMA 1000 series products are not affected by this vulnerability. --------------------------------------------- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0020 ∗∗∗ SonicWall SMA100 Post-Auth Heap-based Buffer Overflow Vulnerability ∗∗∗ --------------------------------------------- A Heap-based Buffer Overflow vulnerability in the SonicWall SMA100 appliance allows a remote authenticated attacker to cause Denial of Service (DoS) on the appliance or potentially lead to code execution. This vulnerability impacts 10.2.1.5-34sv and earlier versions.IMPORTANT: SMA 1000 series products are not affected by this vulnerability. CVE: CVE-2022-2915 --------------------------------------------- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0019 ∗∗∗ Security Bulletin: IBM Connect:Direct Web Services vulnerable to remote security bypass due to PostgreSQL (CVE-2022-1552) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-connectdirect-web-ser… ∗∗∗ Security Bulletin: IBM MQ Appliance is vulnerable to a denial of service due to Linux Kernel (CVE-2020-35513) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-appliance-is-vulne… ∗∗∗ FATEK Automation FvDesigner ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-22-237-01 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 24.08.2022
by Daily end-of-shift report 24 Aug '22

24 Aug '22

===================== = End-of-Day report = ===================== Timeframe: Dienstag 23-08-2022 18:00 − Mittwoch 24-08-2022 18:00 Handler: Michael Schlagenhaufer Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ Fake Chrome extension Internet Download Manager has 200,000 installs ∗∗∗ --------------------------------------------- Google Chrome extension Internet Download Manager installed by more than 200,000 users is adware. --------------------------------------------- https://www.bleepingcomputer.com/news/security/fake-chrome-extension-intern… ∗∗∗ Hackers use AiTM attack to monitor Microsoft 365 accounts for BEC scams ∗∗∗ --------------------------------------------- A new business email compromise (BEC) campaign has been discovered combining sophisticated spear-phishing with Adversary-in-The-Middle (AiTM) tactics to hack corporate executives Microsoft 365 accounts, even those protected by MFA. --------------------------------------------- https://www.bleepingcomputer.com/news/security/hackers-use-aitm-attack-to-m… ∗∗∗ Ransomware updates & 1-day exploits ∗∗∗ --------------------------------------------- In this report, we discuss the new multi-platform ransomware RedAlert (aka N13V) and Monster, as well as private 1-day exploits for the CVE-2022-24521 vulnerability. --------------------------------------------- https://securelist.com/ransomware-updates-1-day-exploits/107291/ ∗∗∗ Monster Libra (TA551/Shathak) --> IcedID (Bokbot) --> Cobalt Strike & DarkVNC, (Wed, Aug 24th) ∗∗∗ --------------------------------------------- On Monday, 2022-08-22, I generated an IcedID (Bokbot) infection based on Monster Libra (also known as TA551 or Shathak). --------------------------------------------- https://isc.sans.edu/diary/rss/28974 ∗∗∗ Bomber is an application that scans SBoMs for security vulnerabilities. ∗∗∗ --------------------------------------------- So youve asked a vendor for an Software Bill of Materials (SBOM) for one of their products, and they provided one to you in a JSON file... now what? --------------------------------------------- https://github.com/devops-kung-fu/bomber ∗∗∗ Cyber-Angriff: Griechischer Gasnetzbetreiber Desfa Opfer von Ransomware-Gang ∗∗∗ --------------------------------------------- Die Ransomware-Gang hinter Ragnar Locker ist in die Netze des Betreibers des griechischen Erdgas-Netzes Desfa eingebrochen. Die Versorgung bleibt gesichert. --------------------------------------------- https://heise.de/-7241322 ∗∗∗ Einbruch bei Plex: Daten abgezogen, Passwortänderung nötig ∗∗∗ --------------------------------------------- Bösartige Akteure sind offenbar in die Datenbanken des Streaming-Dienstes und Medienservers Plex eingebrochen. Dort konnten sie persönliche Daten stehlen. --------------------------------------------- https://heise.de/-7241975 ∗∗∗ Ethernet LEDs Can Be Used to Exfiltrate Data From Air-Gapped Systems ∗∗∗ --------------------------------------------- A researcher from the Ben-Gurion University of the Negev in Israel has published a paper describing a method that can be used to silently exfiltrate data from air-gapped systems using the LEDs of various types of networked devices. --------------------------------------------- https://www.securityweek.com/ethernet-leds-can-be-used-exfiltrate-data-air-… ∗∗∗ Old, Inconspicuous Vulnerabilities Commonly Targeted in OT Scanning Activity ∗∗∗ --------------------------------------------- Data collected by IBM shows that old and inconspicuous vulnerabilities affecting industrial products are commonly targeted in scanning activity seen by organizations that use operational technology (OT). --------------------------------------------- https://www.securityweek.com/old-inconspicuous-vulnerabilities-commonly-tar… ∗∗∗ HavanaCrypt Ransomware tarnt sich als Google Update ∗∗∗ --------------------------------------------- Die neu entdeckte HavanaCrypt Ransomware nutzt ausgefeilte Techniken und verkleidet sich als Google Update. Lösegeldforderungen gab es bisher nicht. --------------------------------------------- https://www.zdnet.de/88403049/havanacrypt-ransomware-tarnt-sich-als-google-… ∗∗∗ But You Told Me You Were Safe: Attacking the Mozilla Firefox Sandbox (Part 2) ∗∗∗ --------------------------------------------- In this blog post, we discuss a second prototype pollution vulnerability that allowed the execution of attacker-controlled JavaScript in the privileged parent process, escaping the sandbox. --------------------------------------------- https://www.thezdi.com/blog/2022/8/23/but-you-told-me-you-were-safe-attacki… ∗∗∗ BitRAT and XMRig CoinMiner Being Distributed via Windows License Verification Tool ∗∗∗ --------------------------------------------- The ASEC analysis team has recently discovered the distribution of BitRAT and XMRig CoinMiner disguised as a Windows license verification tool. --------------------------------------------- https://asec.ahnlab.com/en/37939/ ∗∗∗ AsyncRAT Being Distributed in Fileless Form ∗∗∗ --------------------------------------------- The ASEC analysis team has recently discovered that malicious AsyncRAT codes are being distributed in fileless form. --------------------------------------------- https://asec.ahnlab.com/en/37954/ ===================== = Vulnerabilities = ===================== ∗∗∗ Gefährliche Lücken bedrohen Sicherheit von kritischen Infrastrukturen ∗∗∗ --------------------------------------------- Angreifer könnten Industrie-Steuerungssysteme attackieren und im schlimmsten Fall die volle Kontrolle erlangen. Sicherheitsupdates sind verfügbar. --------------------------------------------- https://heise.de/-7241733 ∗∗∗ Updates für GitLab schließen kritische Sicherheitslücke ∗∗∗ --------------------------------------------- Für die GitLab Community- und Enterprise-Edition haben die Entwickler aktualisierte Versionen veröffentlicht, die eine kritische Sicherheitslücke schließen. --------------------------------------------- https://heise.de/-7241481 ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Fedora (vim), SUSE (cosign, dpdk, freeciv, gfbgraph, kernel, nim, p11-kit, perl-HTTP-Daemon, python-lxml, and python-treq), and Ubuntu (linux-oem-5.14, open-vm-tools, and twisted). --------------------------------------------- https://lwn.net/Articles/905853/ ∗∗∗ Oracle SBC: Multiple Security Vulnerabilities Leading to Unauthorized Access and Denial of Service ∗∗∗ --------------------------------------------- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/oracle-sbc-… ∗∗∗ Security Bulletin: IBM Security Identity Governance and Intelligence is vulnerable to sensitive information exposure (CVE-2021-35550) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-identity-gov… ∗∗∗ Security Bulletin: A security vulnerability has been identified in in IBM Java SDK shipped with IBM Tivoli Business Service Manager (CVE-2021-35603) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: IBM Spectrum Discover is vulnerable to multiple vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-spectrum-discover-is-… ∗∗∗ Security Bulletin: IBM Security Verify Governance is vulnerable to Denial of Service (CVE-2021-35578) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-verify-gover… ∗∗∗ Security Bulletin: IBM Security Identity Governance and Intelligence is vulnerable to exposure of sensitive information (CVE-2021-35603) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-identity-gov… ∗∗∗ Security Bulletin: IBM Security Verify Governance is vulnerable to identity spoofing due to IBM WebSphere Application Server Liberty (CVE-2022-22475) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-verify-gover… ∗∗∗ Security Bulletin: IBM QRadar SIEM includes components with multiple known vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-qradar-siem-includes-… ∗∗∗ VMSA-2022-0024 ∗∗∗ --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2022-0024.html ∗∗∗ vim: Schwachstelle ermöglicht Codeausführung ∗∗∗ --------------------------------------------- https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1157 ∗∗∗ Jenkins Plugins: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1166 ∗∗∗ F-Secure Produkte: Mehrere Schwachstellen ermöglichen Denial of Service ∗∗∗ --------------------------------------------- https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1165 ∗∗∗ tribe29 checkmk: Schwachstelle ermöglicht Offenlegung von Informationen ∗∗∗ --------------------------------------------- https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1160 ∗∗∗ Mozilla Releases Security Updates for Firefox, Firefox ESR, and Thunderbird ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ncas/current-activity/2022/08/23/mozilla-releases-… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 23.08.2022
by Daily end-of-shift report 23 Aug '22

23 Aug '22

===================== = End-of-Day report = ===================== Timeframe: Montag 22-08-2022 18:00 − Dienstag 23-08-2022 18:00 Handler: Michael Schlagenhaufer Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ Internet-Kernprotokoll: Das Transmission Control Protocol erhält Update ∗∗∗ --------------------------------------------- TCP ist der Motor des Internet. Mit einem gerade aktualisierten RFC bekommt er eine Generalüberholung. Aber kann er sich gegen neue Konkurrenz behaupten? --------------------------------------------- https://heise.de/-7239713 ∗∗∗ Cyber-Attacken: CISA warnt vor Angriffen auf neu entdeckte Sicherheitslücken ∗∗∗ --------------------------------------------- Die US-Cybersicherheitsbehörde CISA warnt vor einigen erst seit Kurzem bekannten Sicherheitslücken. Cyberkriminelle greifen diese bereits aktiv an. --------------------------------------------- https://heise.de/-7240372 ∗∗∗ Whos Looking at Your security.txt File? ∗∗∗ --------------------------------------------- In April 2022, the RFC related to the small file “security.txt” was released. It was already popular for a while, but an RFC is always a good way to “promote” some best practices! If you're unaware of this file, it helps to communicate security contacts (email addresses, phone, ...) to people who would like to contact you to report an issue with your website or your organization. --------------------------------------------- https://isc.sans.edu/diary/rss/28972 ∗∗∗ Researchers Find Counterfeit Phones with Backdoor to Hack WhatsApp Accounts ∗∗∗ --------------------------------------------- Budget Android device models that are counterfeit versions associated with popular smartphone brands are harboring multiple trojans designed to target WhatsApp and WhatsApp Business messaging apps. --------------------------------------------- https://thehackernews.com/2022/08/researchers-find-counterfeit-phones.html ∗∗∗ New Air-Gap Attack Uses MEMS Gyroscope Ultrasonic Covert Channel to Leak Data ∗∗∗ --------------------------------------------- A novel data exfiltration technique has been found to leverage a covert ultrasonic channel to leak sensitive information from isolated, air-gapped computers to a nearby smartphone that doesn't even require a microphone to pick up the sound waves. --------------------------------------------- https://thehackernews.com/2022/08/new-air-gap-attack-uses-mems-gyroscope.ht… ∗∗∗ If you havent patched Zimbra holes by now, assume youre toast ∗∗∗ --------------------------------------------- Heres how to detect an intrusion via vulnerable email systems Organizations that didnt immediately patch their Zimbra email systems should assume miscreants have already found and exploited the bugs, and should start hunting for malicious activity across IT networks, according to Uncle Sam. --------------------------------------------- https://go.theregister.com/feed/www.theregister.com/2022/08/23/cisa_zimbra_… ∗∗∗ Ransomware Gang Leaks Data Allegedly Stolen From Greek Gas Supplier ∗∗∗ --------------------------------------------- The cybergang behind the Ragnar Locker ransomware has published more than 360 gigabytes of data allegedly stolen from Greece’s largest natural gas supplier Desfa.Established in 2007 as a subsidiary of Depa (Public Gas Corporation of Greece), Desfa operates both the country’s natural gas transmission system and its gas distribution networks. --------------------------------------------- https://www.securityweek.com/ransomware-gang-leaks-data-allegedly-stolen-gr… ∗∗∗ Online-Marktplatz: Vorsicht, wenn Käufer:innen Links zu Kurierdiensten und Zahlungsplattformen schicken ∗∗∗ --------------------------------------------- Sie verkaufen über willhaben, laendleanzeiger.at, shpock und Co? Nehmen Sie sich vor betrügerischen Käufer:innen in Acht. --------------------------------------------- https://www.watchlist-internet.at/news/online-marktplatz-vorsicht-wenn-kaeu… ∗∗∗ The Rise of Data Exfiltration and Why It Is a Greater Risk Than Ransomware ∗∗∗ --------------------------------------------- Threat actors have been searching for another opportunity – and found one. It's called data exfiltration, or exfil, a type of espionage causing headaches at organizations worldwide. Let's take a look. --------------------------------------------- https://thehackernews.com/2022/08/the-rise-of-data-exfiltration-and-why.html ===================== = Vulnerabilities = ===================== ∗∗∗ GitLab Critical Security Release: 15.3.1, 15.2.3, 15.1.5 ∗∗∗ --------------------------------------------- Today we are releasing versions 15.3.1, 15.2.3, 15.1.5 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. --------------------------------------------- https://about.gitlab.com/releases/2022/08/22/critical-security-release-gitl… ∗∗∗ SECURITY BULLETIN AVEVA-2022-005 ∗∗∗ --------------------------------------------- Multiple vulnerabilities in AVEVA Edge (formerly known as InduSoft Web Studio). Rating: High --------------------------------------------- https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-up… ∗∗∗ [CVE-2020-2733] JD Edwards EnterpriseOne Tools admin password not adequately protected ∗∗∗ --------------------------------------------- JD Edwards EnterpriseOne Tools 9.2 or lower versions allow unauthenticated attackers to bypass the authentication and get Administrator rights on the system. --------------------------------------------- https://redrays.io/cve-2020-2733-jd-edwards/ ∗∗∗ Einbruchsgefahr: Über 80.000 Hikvision-Kameras verwundbar ∗∗∗ --------------------------------------------- Hikvision hat zwar Updates für die Kameras veröffentlicht, mehr als 2300 Firmen ignorieren diese jedoch. Angreifer könnten dadurch in deren Netze einbrechen. --------------------------------------------- https://heise.de/-7239986 ∗∗∗ Firefox 104: Verbesserungen am PDF-Viewer und Stromverbrauch-Profiler ∗∗∗ --------------------------------------------- Die neue Version von Firefox bringt neben sechs gefixten Sicherheitslücken auch Re-Snapping sowie die Möglichkeit, im PDF-Viewer zu unterschreiben. --------------------------------------------- https://heise.de/-7240408 ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Oracle (kernel and kernel-container), SUSE (bluez, gimp, rubygem-rails-html-sanitizer, systemd-presets-common-SUSE, and u-boot), and Ubuntu (libxslt). --------------------------------------------- https://lwn.net/Articles/905730/ ∗∗∗ Security Bulletin: Vulnerability in SANNav Software used by IBM b-type SAN directors and switches. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-sannav-s… ∗∗∗ Security Bulletin: Multiple security vulnerabilities have been identified in dojo library shipped with IBM Security Guardium Key Lifecycle Manager (SKLM/GKLM) (CVE-2019-10785, CVE-2020-5259, CVE-2020-4051, CVE-2018-15494, CVE-2021-23450) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnera… ∗∗∗ Security Bulletin: IBM has announced a release for IBM Security Verify Governance in response to a security vulnerability (CVE-2021-22931) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-has-announced-a-relea… ∗∗∗ Security Bulletin: IBM has announced a release for IBM Security Verify Governance in response to a security vulnerability (CVE-2022-21824) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-has-announced-a-relea… ∗∗∗ Security Bulletin: IBM Security Verify Governance is vulnerable to multiple security issues due to Node.js ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-verify-gover… ∗∗∗ Security Bulletin: IBM MQ is vulnerable to issues with libcurl (CVE-2022-27780, CVE-2022-30115) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-is-vulnerable-to-i… ∗∗∗ Security Bulletin: IBM Sterling Connect:Direct for UNIX is vulnerable to denial of service due to Google Gson (CVE-2022-25647) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sterling-connectdirec… ∗∗∗ Security Bulletin: IBM Security Verify Governance is vulnerable to arbitrary code execution due to Apache Log4j (CVE-2021-4104) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-verify-gover… ∗∗∗ Security Bulletin: IBM Sterling B2B Integrator vulnerable to multiple vulnerabilities due to Apache Commons Compress ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sterling-b2b-integrat… ∗∗∗ D-LINK Router: Schwachstelle ermöglicht Denial of Service ∗∗∗ --------------------------------------------- https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1151 ∗∗∗ Trellix Data Loss Prevention: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen ∗∗∗ --------------------------------------------- https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1149 ∗∗∗ xpdf: Schwachstelle ermöglicht Codeausführung ∗∗∗ --------------------------------------------- https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1144 ∗∗∗ PowerDNS: Schwachstelle ermöglicht Denial of Service ∗∗∗ --------------------------------------------- https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1152 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 22.08.2022
by Daily end-of-shift report 22 Aug '22

22 Aug '22

===================== = End-of-Day report = ===================== Timeframe: Freitag 19-08-2022 18:00 − Montag 22-08-2022 18:00 Handler: Michael Schlagenhaufer Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ 241 npm and PyPI packages caught dropping Linux cryptominers ∗∗∗ --------------------------------------------- More than 200 malicious packages were discovered infiltrating the PyPI and npm open source registries this week. These packages are largely typosquats of widely used libraries and each one of them downloads a Bash script on Linux systems that run cryptominers. --------------------------------------------- https://www.bleepingcomputer.com/news/security/241-npm-and-pypi-packages-ca… ∗∗∗ New tool checks if in-app mobile browsers inject risky code on sites ∗∗∗ --------------------------------------------- A new online tool named InAppBrowser lets you analyze the behavior of in-app browsers embedded within mobile apps and determine if they inject privacy-threatening JavaScript into websites you visit. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-tool-checks-if-in-app-mo… ∗∗∗ LockBit claims ransomware attack on security giant Entrust, leaks data ∗∗∗ --------------------------------------------- The LockBit ransomware gang has claimed responsibility for the June cyberattack on digital security giant Entrust. --------------------------------------------- https://www.bleepingcomputer.com/news/security/lockbit-claims-ransomware-at… ∗∗∗ Multi-Faktor-Authentisierung umgehen: Malware klaut automatisiert Cookies ∗∗∗ --------------------------------------------- Um Multi-Faktor-Authentisierung umgehen zu können, klauen Kriminelle vermehrt Browser-Cookies mittels Malware. --------------------------------------------- https://www.golem.de/news/multi-faktor-authentisierung-umgehen-malware-klau… ∗∗∗ Meet Borat RAT, a New Unique Triple Threat ∗∗∗ --------------------------------------------- Atlanta-based cyber risk intelligence company, Cyble discovered a new Remote Access Trojan (RAT) malware. What makes this particular RAT malware distinct enough to be named after the comic creation of Sacha Baron Cohen? --------------------------------------------- https://thehackernews.com/2022/08/meet-borat-rat-new-unique-triple-threat.h… ∗∗∗ Sicherer im Internet surfen: Obacht vor gefälschten DDoS-Check-Websites ∗∗∗ --------------------------------------------- Wer im Internet ohne Nachzudenken klickt, kann sich schnell einen Trojaner einfangen. Nun warnen Sicherheitsforscher vor einer weiteren Malware-Masche. --------------------------------------------- https://heise.de/-7238985 ∗∗∗ Bösartige Apps im Google Play Store: Mehr als zwei Millionen Downloads ∗∗∗ --------------------------------------------- Bitdefender hat 35 bösartige Apps in Googles Play Store entdeckt. Sie kommen zusammen auf mehr als zwei Millionen Downloads. --------------------------------------------- https://heise.de/-7239109 ∗∗∗ Kriminelle kapern Facebook-Konten und bewerben Fake-Investment-Plattformen ∗∗∗ --------------------------------------------- Tom und zahlreiche andere Personen wurden von Claudia auf Facebook bei einem Beitrag markiert. Der Beitrag ist ein Link zu einem Artikel, wie man mit einer Investment-Plattform in kurzer Zeit viel Geld verdienen kann. Vorsicht: Dabei handelt es sich um Betrug. --------------------------------------------- https://www.watchlist-internet.at/news/kriminelle-kapern-facebook-konten-un… ∗∗∗ Network Security Trends: Recent Exploits Observed in the Wild Include Remote Code Execution, Cross-Site Scripting and More ∗∗∗ --------------------------------------------- Recent exploits observed in the wild are highlighted based on the availability of proofs of concept, the severity of the vulnerabilities the exploits are based on and the ease of exploitation. --------------------------------------------- https://unit42.paloaltonetworks.com/recent-exploits-network-security-trends/ ∗∗∗ Hackers are using this sneaky exploit to bypass Microsofts multi-factor authentication ∗∗∗ --------------------------------------------- Attackers guessed the password of a dormant account and were able to apply their own MFA to it - providing access to the victims network. --------------------------------------------- https://www.zdnet.com/article/hackers-are-using-this-sneaky-trick-to-exploi… ∗∗∗ Sicherheitslücken - jetzt auch in deiner Appliance ∗∗∗ --------------------------------------------- Die Entwickler des quelloffenen Frameworks YARA haben vor knapp zwei Wochen fast schon heimlich still und leise eine neue Version veröffentlicht, v4.2.3, welche in der medialen Berichterstattung beinahe untergegangen ist. --------------------------------------------- https://cert.at/de/blog/2022/8/sicherheitslucken-jetzt-auch-in-deiner-appli… ∗∗∗ CISA Adds One Known Exploited Vulnerabilities to Catalog ∗∗∗ --------------------------------------------- CISA has added a new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. --------------------------------------------- https://us-cert.cisa.gov/ncas/current-activity/2022/08/22/cisa-adds-one-kno… ∗∗∗ Sicherheit: Wenn plötzlich ein (Fake-)"Office 365-Paket" per Post kommt ∗∗∗ --------------------------------------------- Kleine Warnung, die sich vor allem an unerfahrene Leser dieses Blogs bzw. Nutzer richtet. Kriminelle verschicken wohl Päckchen an (vorwiegend ältere Leute), in denen vorgeblich ein Microsoft Office enthalten ist. --------------------------------------------- https://www.borncity.com/blog/2022/08/21/sicherheit-wenn-pltzlich-ein-offic… ===================== = Vulnerabilities = ===================== ∗∗∗ Uncovering a ChromeOS remote memory corruption vulnerability ∗∗∗ --------------------------------------------- Microsoft discovered a memory corruption vulnerability in a ChromeOS component that could have been triggered remotely, allowing attackers to perform either a denial-of-service (DoS) or, in extreme cases, remote code execution (RCE). --------------------------------------------- https://www.microsoft.com/security/blog/2022/08/19/uncovering-a-chromeos-re… ∗∗∗ "As Nasty as Dirty Pipe" — 8 Year Old Linux Kernel Vulnerability Uncovered ∗∗∗ --------------------------------------------- Details of an eight-year-old security vulnerability in the Linux kernel have emerged that the researchers say is "as nasty as Dirty Pipe." Dubbed DirtyCred by a group of academics from Northwestern University, the security weakness exploits a previously unknown flaw (CVE-2022-2588) to escalate privileges to the maximum level. --------------------------------------------- https://thehackernews.com/2022/08/as-nasty-as-dirty-pipe-8-year-old-linux.h… ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (jetty9 and kicad), Fedora (community-mysql and trafficserver), Gentoo (chromium, gettext, tomcat, and vim), Mageia (apache-mod_wsgi, libitrpc, libxml2, teeworlds, wavpack, and webkit2), Red Hat (podman), Slackware (vim), SUSE (java-1_8_0-openjdk, nodejs10, open-iscsi, rsync, and trivy), and Ubuntu (exim4). --------------------------------------------- https://lwn.net/Articles/905590/ ∗∗∗ YARA 4.2.3 Released, (Sat, Aug 20th) ∗∗∗ --------------------------------------------- https://isc.sans.edu/diary/rss/28964 ∗∗∗ Security Bulletin: This Power System update is being released to address CVE 2021-29891 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-this-power-system-update-… ∗∗∗ Security Bulletin: This Power System update is being released to address CVE-2019-16649 and CVE-2019-16650 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-this-power-system-update-… ∗∗∗ Security Bulletin: Vulnerabilities with OpenJDK affect IBM Cloud Object Storage Systems (August 2022v1) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-with-open… ∗∗∗ Security Bulletin: This Power System update is being released to address CVE 2022-0778 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-this-power-system-update-… ∗∗∗ Security Bulletin: A vulneraqbility in SQLite affects IBM Cloud Application Performance Managment R esponse Time Monitoring RRT Agent (CVE-2021-45346) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulneraqbility-in-sqlit… ∗∗∗ Security Bulletin: Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnera… ∗∗∗ Security Bulletin: Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnera… ∗∗∗ Security Bulletin: Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnera… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 19.08.2022
by Daily end-of-shift report 19 Aug '22

19 Aug '22

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 18-08-2022 18:00 − Freitag 19-08-2022 18:00 Handler: Thomas Pribitzer Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Honeypot Attack Summaries with Python ∗∗∗ --------------------------------------------- We are lucky to have a variety of tools available to enrich existing honeypot data, but also automate that enrichment. I put together a script to try and help myself achieve a simple goal. --------------------------------------------- https://isc.sans.edu/diary/rss/28956 ∗∗∗ Fake DDoS Pages On WordPress Sites Lead to Drive-By-Downloads ∗∗∗ --------------------------------------------- Under normal circumstances, DDoS pages usually don’t affect users much — they simply perform a check or request a skill testing question in order to proceed to the desired webpage. However, a recent surge in JavaScript injections targeting WordPress sites has resulted in fake DDoS prevent prompts which lead victims to download remote access trojan malware. --------------------------------------------- https://blog.sucuri.net/2022/08/fake-ddos-pages-on-wordpress-lead-to-drive-… ∗∗∗ But You Told Me You Were Safe: Attacking the Mozilla Firefox Renderer (Part 1) ∗∗∗ --------------------------------------------- At Pwn2Own Vancouver 2022, Manfred Paul compromised the Mozilla Firefox browser using a full chain exploit that broke the mold. Although his exploit used some memory corruptions, the vulnerable code was written in a memory-safe programming language: JavaScript! --------------------------------------------- https://www.zerodayinitiative.com/blog/2022/8/17/but-you-told-me-you-were-s… ∗∗∗ Auch TikTok-App soll mit internem iPhone-Browser spionieren können ∗∗∗ --------------------------------------------- Nachdem das Problem bereits bei Facebook und Instagram aufgedeckt worden war, hat sich ein Sicherheitsforscher nun auch den chinesischen Videodienst angesehen. --------------------------------------------- https://heise.de/-7235891 ∗∗∗ Aktive Angriffe auf iPhones, iPads und Macs: Was Nutzer jetzt tun sollten ∗∗∗ --------------------------------------------- Erneut warnt Apple vor schweren Sicherheitslücken, die wohl aktiv ausgenutzt werden. Es gibt Patches, aber nicht für alle Systeme und Bugs. Ein Überblick. --------------------------------------------- https://heise.de/-7237518 ∗∗∗ Back in Black: Unlocking a LockBit 3.0 Ransomware Attack ∗∗∗ --------------------------------------------- This post explores some of the TTPs employed by a threat actor who were observed deploying LockBit 3.0 ransomware during an incident response engagement. --------------------------------------------- https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-… ∗∗∗ SAP Vulnerability Exploited in Attacks After Details Disclosed at Hacker Conferences ∗∗∗ --------------------------------------------- The US Cybersecurity and Infrastructure Security Agency (CISA) has added a critical SAP vulnerability to its Known Exploited Vulnerabilities Catalog less than one week after its details were disclosed at the Black Hat and Def Con hacker conferences. --------------------------------------------- https://www.securityweek.com/sap-vulnerability-exploited-attacks-after-deta… ∗∗∗ Fake-Shop-Alarm: getvoltplug.com hilft Ihnen nicht beim Stromsparen ∗∗∗ --------------------------------------------- In Zeiten der Energiekrise wirbt getvoltplug.com mit einem attraktiven Angebot: Ein Gerät soll Ihnen helfen bis zu 90% Ihrer Stromrechnung zu sparen. Aber Achtung! Dieses Gerät existiert gar nicht, es handelt sich um Betrug. --------------------------------------------- https://www.watchlist-internet.at/news/fake-shop-alarm-getvoltplugcom-hilft… ∗∗∗ Wissen: Webseite als kompromittiert gemeldet? Wie geht man vor? ∗∗∗ --------------------------------------------- Wer eine Webseite betreibt, wird möglicherweise gelegentlich mit dem Problem konfrontiert, dass diese von Sicherheitsportalen oder Benutzern als "riskant" gemeldet wird. Dann stellt sich die Frage, wie man vorgehen könnte, um herauszufinden, ob dies ein Fehlalarm ist oder die Webseite kompromittiert wurde. --------------------------------------------- https://www.borncity.com/blog/2022/08/19/wissen-webseite-als-kompromittiert… ∗∗∗ Ukraine war spotlights agriculture sectors vulnerability to cyber attack ∗∗∗ --------------------------------------------- The agriculture sector is highly vulnerable to cyber-attacks given its low downtime tolerance, insufficient cyber defenses, and far-reaching ripple effects of disruption. We assess those future threats to the agriculture section will mainly include financially motivated ransomware actors and disruptive attacks carried out by state-sponsored APTs. --------------------------------------------- http://blog.talosintelligence.com/2022/08/ukraine-and-fragility-of-agricult… ∗∗∗ Business Email Compromise Attack Tactics ∗∗∗ --------------------------------------------- Is BEC more damaging than ransomware? What tactics are BEC actors using? How can organizations bolster their defenses? --------------------------------------------- https://www.trendmicro.com/en_us/ciso/22/h/business-email-compromise-bec-at… ===================== = Vulnerabilities = ===================== ∗∗∗ ZDI-22-1076: PDF-XChange Editor submitForm Out-Of-Bounds Read Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-22-1076/ ∗∗∗ DSA-2022-241: Dell EMC PowerFlex Rack Security Update for Multiple Third-Party Component Vulnerabilities ∗∗∗ --------------------------------------------- Dell EMC PowerFlex Rack remediation is available for multiple security vulnerabilities that could be exploited by malicious users to compromise the affected system. --------------------------------------------- https://www.dell.com/support/kbdoc/de-at/000202540/dsa-2022-241-dell-emc-po… ∗∗∗ Virenscanner: Schwachstelle von McAfee erleichtert Angreifern das Einnisten ∗∗∗ --------------------------------------------- Angreifer hätten aufgrund einer Sicherheitslücke im Virenschutz McAfee Security Scan Plus ihre Rechte erhöhen können. Das erleichterte das Einnisten im System. --------------------------------------------- https://heise.de/-7235809 ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (ruby-tzinfo), Mageia (nvidia-current and nvidia390), SUSE (python-PyYAML, ucode-intel, and zlib), and Ubuntu (linux-aws, postgresql-10, postgresql-12, postgresql-14, and rsync). --------------------------------------------- https://lwn.net/Articles/905265/ ∗∗∗ vim: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in vim ausnutzen, um beliebigen Programmcode auszuführen, Dateien zu manipulieren oder einen Denial of Service Zustand herbeizuführen. --------------------------------------------- https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1076 ∗∗∗ Security Advisory - JAD-AL50: Permission Bypass Vulnerability in Huawei Products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2022/huawei-sa-20220819-… ∗∗∗ Security Bulletin: IBM MQ Explorer is vulnerable to an XML External Entity Injection (XXE) attack (CVE-2022-22489) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-explorer-is-vulner… ∗∗∗ Security Bulletin: Vulnerability in SANNav Software used by IBM b-type SAN directors and switches. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-sannav-s… ∗∗∗ Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands may be vulnerable to loss of confidentiality due to CVE-2022-35948 and CVE-2022-35949 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-app-connect-enterpris… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by multiple vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by multiple vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Security Bulletin: IBM Spectrum Discover is vulnerable to Docker CLI (CVE-2021-41092) and Apache Log4j (CVE-2021-4104, CVE-2022-23302, CVE-2022-23305, CVE-2022-23307) weaknesses ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-spectrum-discover-is-… ∗∗∗ Security Bulletin: IBM Spectrum Control is vulnerable to multiple weaknesses related to IBM WebSphere Application Server Liberty and OpenSSL (CVE-2022-2068, CVE-2022-2097, CVE-2022-22475) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-spectrum-control-is-v… ∗∗∗ Security Bulletin: IBM DataPower Gateway affected by vulnerabilities in ICU [CVE-2017-14952 and CVE-2020-10531] ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-datapower-gateway-aff… ∗∗∗ Security Bulletin: Vulnerability in SANNav Software used by IBM b-type SAN directors and switches. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-sannav-s… ∗∗∗ Security Bulletin: Vulnerability in Eclipse Jetty affects IBM Process Mining . CVE-2022-2048 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-eclipse-… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 18.08.2022
by Daily end-of-shift report 18 Aug '22

18 Aug '22

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 17-08-2022 18:00 − Donnerstag 18-08-2022 18:00 Handler: Michael Schlagenhaufer Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ BlackByte ransomware gang is back with new extortion tactics ∗∗∗ --------------------------------------------- The BlackByte ransomware is back with version 2.0 of their operation, including a new data leak site utilizing new extortion techniques borrowed from LockBit. --------------------------------------------- https://www.bleepingcomputer.com/news/security/blackbyte-ransomware-gang-is… ∗∗∗ Microsoft Sysmon can now block malicious EXEs from being created ∗∗∗ --------------------------------------------- Microsoft has released Sysmon 14 with a new FileBlockExecutable option that lets you block the creation of malicious executables, such as EXE, DLL, and SYS files, for better protection against malware. --------------------------------------------- https://www.bleepingcomputer.com/news/microsoft/microsoft-sysmon-can-now-bl… ∗∗∗ Schwere Lücken: Vorsicht bei VPN-Nutzung auf Apple-Geräten ∗∗∗ --------------------------------------------- Wer über Apples iOS einen VPN-Dienst nutzt, ist nicht so sicher unterwegs, wie man es eigentlich vermuten würde. --------------------------------------------- https://futurezone.at/produkte/schwere-luecken-vorsicht-vpn-apple-iphone-ip… ∗∗∗ Clop: Ransomwaregruppe erpresst wohl falsches Wasserwerk ∗∗∗ --------------------------------------------- Eine Ransomwaregruppe hat sich nach einem Hack eines Wasserversorgungsunternehmens in Großbritannien offenbar vertan und ein anderes Werk erpresst. --------------------------------------------- https://www.golem.de/news/clop-ransomwaregruppe-erpresst-scheinbar-falsches… ∗∗∗ Hacking: Der Bad-USB-Stick Rubber Ducky wird noch gefährlicher ∗∗∗ --------------------------------------------- Mit einer neuen Version des Bad-USB-Sticks Rubber Ducky lassen sich Rechner noch leichter angreifen und neuerdings auch heimlich Daten ausleiten. --------------------------------------------- https://www.golem.de/news/hacking-der-bad-usb-stick-rubber-ducky-wird-noch-… ∗∗∗ Hackers Using Bumblebee Loader to Compromise Active Directory Services ∗∗∗ --------------------------------------------- The malware loader known as Bumblebee is being increasingly co-opted by threat actors associated with BazarLoader, TrickBot, and IcedID in their campaigns to breach target networks for post-exploitation activities. --------------------------------------------- https://thehackernews.com/2022/08/hackers-using-bumblebee-loader-to.html ∗∗∗ Deluge of of entries to Spamhaus blocklists includes various household names ∗∗∗ --------------------------------------------- Nastymail tracking service blames sloppy sending practices for swelling lists of dangerous mailers Spam-tracking service Spamhaus reported Tuesday that some of the worlds biggest brands are getting loose with their email practices, causing its spam blocklists (SBL) to swell significantly. --------------------------------------------- https://go.theregister.com/feed/www.theregister.com/2022/08/18/deluge_of_en… ∗∗∗ Real-Time Behavior-Based Detection on Android Reveals Dozens of Malicious Apps on Google Play Store ∗∗∗ --------------------------------------------- Cybersecurity researchers identify 35 apps, many downloaded over 100,000 times, that have been serving up malware to millions of Android users. --------------------------------------------- https://www.bitdefender.com/blog/labs/real-time-behavior-based-detection-on… ∗∗∗ PayPal Phishing Scam Uses Invoices Sent Via PayPal ∗∗∗ --------------------------------------------- Scammers are using invoices sent through PayPal.com to trick recipients into calling a number to dispute a pending charge. --------------------------------------------- https://krebsonsecurity.com/2022/08/paypal-phishing-scam-uses-invoices-sent… ∗∗∗ ASEC Weekly Malware Statistics (August 8th, 2022 – August 14th, 2022) ∗∗∗ --------------------------------------------- This post will list weekly statistics collected from August 8th, 2022 (Monday) to August 14th, 2022 (Sunday). --------------------------------------------- https://asec.ahnlab.com/en/37837/ ∗∗∗ Analyzing the Hidden Danger of Environment Variables for Keeping Secrets ∗∗∗ --------------------------------------------- While DevOps practitioners use environment variables to regularly keep secrets in applications, these could be conveniently abused by cybercriminals for their malicious activities, as our analysis shows. --------------------------------------------- https://www.trendmicro.com/en_us/research/22/h/analyzing-hidden-danger-of-e… ===================== = Vulnerabilities = ===================== ∗∗∗ Aktive Exploits: macOS 12.5.1, iOS 15.6.1 und iPadOS 15.6.1 verfügbar ∗∗∗ --------------------------------------------- Apple legt nochmals Aktualisierungen für seine 2021er Betriebssysteme vor. Grund sind wichtige Sicherheitsfixes. Für die Apple Watch kommt ein Extra-Update. --------------------------------------------- https://heise.de/-7223549 ∗∗∗ Cisco Secure Web Appliance Privilege Escalation Vulnerability ∗∗∗ --------------------------------------------- A vulnerability in the web management interface of Cisco AsyncOS for Cisco Secure Web Appliance, formerly Cisco Web Security Appliance (WSA), could allow an authenticated, remote attacker to perform a command injection and elevate privileges to root. --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Webkonferenzen: Teils kritische Lücken in Zoom ∗∗∗ --------------------------------------------- In mehreren Zoom-Varianten stecken teilweise kritische Sicherheitslücken. Updates sollen sie abdichten. Mac-Nutzer müssen erneut aktualisieren. --------------------------------------------- https://heise.de/-7223873 ∗∗∗ TP-Link: Schadcode-Schmuggel durch Sicherheitslücke in Routern ∗∗∗ --------------------------------------------- Sicherheitsforscher aus Vietnam haben im WLAN-Router TL-WR841N von TP-Link einen kritischen Fehler festgestellt, der Code-Ausführung auf dem Gerät ermöglicht. --------------------------------------------- https://heise.de/-7224392 ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (chromium, epiphany-browser, freecad, and schroot), Fedora (freeciv, microcode_ctl, qemu, and rsync), Oracle (httpd), SUSE (aws-efs-utils, python-ansi2html, python-py, python-pytest-html, python-pytest-metadata, python-pytest-rerunfailures, python-coverage, python-oniconfig, python-unittest-mixins, bluez, curl, gnutls, kernel, ntfs-3g_ntfsprogs, podman, and ucode-intel), and Ubuntu (zlib). --------------------------------------------- https://lwn.net/Articles/905072/ ∗∗∗ Apache ActiveMQ Artemis: Schwachstelle ermöglicht Darstellen falscher Informationen ∗∗∗ --------------------------------------------- Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Apache ActiveMQ Artemis ausnutzen, um falsche Informationen darzustellen. --------------------------------------------- https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1069 ∗∗∗ TypeORM 0.3.7 Information Disclosure ∗∗∗ --------------------------------------------- TypeORM 0.3.7 Information Disclosure Risk: I found what I think is a vulnerability in the latest typeorm 0.3.7. --------------------------------------------- https://cxsecurity.com/issue/WLB-2022080057 ∗∗∗ DSA-2022-238: Dell Client BIOS Security Update for Multiple Tianocore EDK2 Vulnerabilities ∗∗∗ --------------------------------------------- https://www.dell.com/support/kbdoc/de-at/000202475/dsa-2022-238-dell-client… ∗∗∗ Security Bulletin: Vulnerability in Moment affects IBM Process Mining . CVE-2022-31129 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-moment-a… ∗∗∗ Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU – Apr 2022 – Includes Oracle April 2022 CPU (minus CVE-2022-21426)affects IBM Security Verify Governance, Identity Manager virtual appliance component ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sdk-java-technology-e… ∗∗∗ Security Bulletin: Vulnerability in FasterXML jackson-databind affects IBM Process Mining . CVE-2020-36518 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-fasterxm… ∗∗∗ Security Bulletin: AIX is vulnerable to arbitrary command execution (CVE-2022-1292 and CVE-2022-2068) or an attacker may obtain sensitive information (CVE-2022-2097) due to OpenSSL ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-aix-is-vulnerable-to-arbi… ∗∗∗ Security Bulletin: Multiple vulnerabilities due to OpenSSL and Node js which affect IBM App Connect Enterprise and IBM Integration Bus ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple Vulnerabilities in Node.js affect IBM Cloud Pak System ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: An Eclipse Jetty vulnerability affects IBM Rational Functional Tester ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-an-eclipse-jetty-vulnerab… ∗∗∗ Security Bulletin: Samba for IBM i is vulnerable to attacker obtaining sensitive information due to a memory leak with SMB1 requests (CVE-2022-32742) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-samba-for-ibm-i-is-vulner… ∗∗∗ Security Bulletin: Vulnerability in Eclipse Jetty affects IBM Process Mining . CVE-2020-36518 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-eclipse-… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 17.08.2022
by Daily end-of-shift report 17 Aug '22

17 Aug '22

===================== = End-of-Day report = ===================== Timeframe: Dienstag 16-08-2022 18:00 − Mittwoch 17-08-2022 18:00 Handler: Stephan Richter Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ Malware devs already bypassed Android 13s new security feature ∗∗∗ --------------------------------------------- Android malware developers are already adjusting their tactics to bypass a new Restricted settings security feature introduced by Google in the newly released Android 13. --------------------------------------------- https://www.bleepingcomputer.com/news/security/malware-devs-already-bypasse… ∗∗∗ SocGholish: 5+ Years of Massive Website Infections ∗∗∗ --------------------------------------------- Earlier this June, we shared information about the ongoing NDSW/NDSX malware campaign which has been one of the most common website infections detected and cleaned by our remediation team in the last few years.This NDSW/NDSX malware — also referred to as FakeUpdates or SocGholish by other research groups — is responsible for redirecting site visitors to malicious pages designed to trick victims into loading and installing fake browser updates. --------------------------------------------- https://blog.sucuri.net/2022/08/socgholish-5-years-of-massive-website-infec… ∗∗∗ RubyGems now requires multi-factor auth for top package maintainers ∗∗∗ --------------------------------------------- Sign-on you crazy diamond: RubyGems.org, the Ruby programming communitys software package registry, now requires maintainers of popular "gems" to secure their accounts using multi-factor authentication (MFA). --------------------------------------------- https://www.theregister.com/2022/08/16/rubygems_package_registry_mfa/ ∗∗∗ Phishing Site used to Spread Typhon Stealer ∗∗∗ --------------------------------------------- During a routine threat hunting exercise, Cyble Research Labs (CRL) came across a Twitter post wherein researchers mentioned a URL that hosts a Windows executable payload with the name systemupdate.exe. --------------------------------------------- https://blog.cyble.com/2022/08/16/phishing-site-used-to-spread-typhon-steal… ∗∗∗ Cisco-ASA-Firewalls hacken per Metasploit und Open-Source-Tools ∗∗∗ --------------------------------------------- Ein Forscher hat zahlreiche Tools und Metasploit-Module zum Hacken von Cisco-Firewalls veröffentlicht. Ein aktuelles Update hilft nicht gegen eines der Tools. --------------------------------------------- https://heise.de/-7222976 ∗∗∗ Achtung: Disney+ Phishing-Mails im Umlauf! ∗∗∗ --------------------------------------------- Besitzen Sie ein Disney+ Konto? Dann nehmen Sie sich vor betrügerischen Phishing-Nachrichten in Acht. Kriminelle versenden massenhaft E-Mails, in denen behauptet wird, Sie müssten Ihre Zahlungsinformationen aktualisieren, da Ihr Abonnement abgelaufen sei. --------------------------------------------- https://www.watchlist-internet.at/news/achtung-disney-phishing-mails-im-uml… ∗∗∗ How a spoofed email passed the SPF check and landed in my inbox ∗∗∗ --------------------------------------------- The Sender Policy Framework can’t help prevent spam and phishing if you allow billions of IP addresses to send as your domain. --------------------------------------------- https://www.welivesecurity.com/2022/08/16/spoofed-email-passed-spf-check-in… ∗∗∗ Los VMware, noch einmal! ∗∗∗ --------------------------------------------- In den Monaten April und Mai dieses Jahres veröffentlichte VMware zwei Security Advisories (VMSA-2022-0011 & VMSA-2022-0014) zu schwerwiegenden Sicherheitslücken in mehreren Produkten, zu denen teilweise bereits Patches zur Verfügung standen. Besagte Sicherheitsaktualisierungen wurden daraufhin von verschiedenen Bedrohungsakteuren untersucht und dienten als Basis für erste Exploits, welche wiederum bereits binnen 48 Stunden nach dem Erscheinen der Advisories genutzt wurden um großflächig Systeme zu kompromittieren. --------------------------------------------- https://cert.at/de/blog/2022/8/los-vmware-machs-nochmal ∗∗∗ GCP, therefore IAM ∗∗∗ --------------------------------------------- Managing access authorization for your cloud assets is a challenging task. Certainly, when dealing with multiple public/private resources, environments, services, providers, and users. --------------------------------------------- https://blog.checkpoint.com/2022/08/17/gcp-therefore-iam/ ∗∗∗ Vulnerability Spotlight: Vulnerabilities in WWBN AVideo web app could lead to command injection, authentication bypass ∗∗∗ --------------------------------------------- Cisco Talos recently discovered multiple vulnerabilities in the WWBN AVideo web application that could allow an attacker to carry out a wide range of malicious actions, including command injection and authentication bypass. --------------------------------------------- http://blog.talosintelligence.com/2022/08/vuln-spotlight-wwbn-avideo-stream… ∗∗∗ Top Five Patch Management & Process Best Practices ∗∗∗ --------------------------------------------- Explore the top patch management best practices to mitigate the growing threat of vulnerability exploits in your organization. --------------------------------------------- https://www.trendmicro.com/en_us/ciso/22/h/patch-management-process-best-pr… ===================== = Vulnerabilities = ===================== ∗∗∗ RTLS systems vulnerable to MiTM attacks, location manipulation ∗∗∗ --------------------------------------------- Security researchers have uncovered multiple vulnerabilities impacting UWB (ultra-wideband) RTLS (real-time locating systems), enabling threat actors to conduct man-in-the-middle attacks and manipulate tag geo-location data. --------------------------------------------- https://www.bleepingcomputer.com/news/security/rtls-systems-vulnerable-to-m… ∗∗∗ IBM Security Bulletins 2022-08-16 ∗∗∗ --------------------------------------------- IBM Cloud Pak System, BM Security Verify Governance, IBM Sterling Connect:Direct for Microsoft Windows, IBM InfoSphere Identity Insight, PowerVC. --------------------------------------------- https://www.ibm.com/blogs/psirt/ ∗∗∗ Google Chrome-Update: Exploit im Umlauf ∗∗∗ --------------------------------------------- Google hat in Chrome mehrere Sicherheitslücken gestopft. Mindestens eine davon gilt dem Hersteller als kritisch. Für eine weitere kursiert bereits ein Exploit. --------------------------------------------- https://heise.de/-7222389 ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (epiphany-browser, net-snmp, webkit2gtk, and wpewebkit), Fedora (python-yara and yara), Red Hat (kernel and kpatch-patch), SUSE (ceph, compat-openssl098, java-1_8_0-openjdk, kernel, python-Twisted, rsync, and webkit2gtk3), and Ubuntu (pyjwt and unbound). --------------------------------------------- https://lwn.net/Articles/904955/ ∗∗∗ Quarterly Security Patches Released for Splunk Enterprise ∗∗∗ --------------------------------------------- Splunk this week announced the release of a new set of quarterly patches, to address multiple vulnerabilities in Splunk Enterprise. --------------------------------------------- https://www.securityweek.com/quarterly-security-patches-released-splunk-ent… ∗∗∗ WAGO: Multiple Products Series affected by multiple CODESYS vulnerabilities ∗∗∗ --------------------------------------------- VDE-2022-031Vendor(s)WAGO GmbH & Co. KGProduct(s) Article No° Product Name Affected Version(s) 752-8303/8000-0002EC300 750-8100/xxx-xxxPFC 100 750-8102/xxx-xxxPFC 100 750-8101/xxx-xxxPFC 100 750-8217/xxx-xxxPFC 200 750-8216/xxx-xxxPFC 200 750-8215/xxx-xxxPFC 200 750-8214/xxx-xxxPFC 200 750-8213/xxx-xxxPFC 200 750-8212/xxx-xxxPFC 200 750-8211/xxx-xxxPFC 200 750-8210/xxx-xxxPFC 200 750-8207/xxx-xxxPFC 200 750-8206/xxx-xxxPFC 200 750-8204/xxx-xxxPFC 200 750-8203/xxx-xxxPFC 200 --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2022-031/ ∗∗∗ WAGO: Multiple product series affected by multiple CODESYS vulnerabilities ∗∗∗ --------------------------------------------- VDE-2022-035Vendor(s)WAGO GmbH & Co. KGProduct(s) Article No° Product Name Affected Version(s) 751-9301CC100 752-8303/8000-0002EC300 750-8100/xxx-xxxPFC 100 750-8102/xxx-xxxPFC 100 750-8101/xxx-xxxPFC 100 750-8216/xxx-xxxPFC 200 750-8215/xxx-xxxPFC 200 750-8214/xxx-xxxPFC 200 750-8213/xxx-xxxPFC 200 750-8212/xxx-xxxPFC 200 750-8211/xxx-xxxPFC 200 750-8210/xxx-xxxPFC 200 750-8207/xxx-xxxPFC 200 750-8206/xxx-xxxPFC 200 750-8204/xxx-xxxPFC 200 750-8203/xxx-xxxPFC 200 750-8202/xxx-xxxPFC --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2022-035/ ∗∗∗ Microsoft Windows Defender: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1053 ∗∗∗ Ansible Automation Platform: Schwachstelle ermöglicht Privilegieneskalation ∗∗∗ --------------------------------------------- https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1058 ∗∗∗ Delta Industrial Automation DRAS ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-22-228-03 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 16.08.2022
by Daily end-of-shift report 16 Aug '22

16 Aug '22

===================== = End-of-Day report = ===================== Timeframe: Freitag 12-08-2022 18:00 − Dienstag 16-08-2022 18:00 Handler: Stephan Richter Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ SOVA malware adds ransomware feature to encrypt Android devices ∗∗∗ --------------------------------------------- The SOVA Android banking trojan continues to evolve with new features, code improvements, and the addition of a new ransomware feature that encrypts files on mobile devices. --------------------------------------------- https://www.bleepingcomputer.com/news/security/sova-malware-adds-ransomware… ∗∗∗ John Deere: Hacker präsentiert Jailbreak für Traktoren ∗∗∗ --------------------------------------------- Nicht nur Telefonhersteller vernageln ihre Geräte. Der Hacker Sick Codes zeigt, wie Root-Zugriff auf die Systeme der Traktoren zu erlangen ist. --------------------------------------------- https://www.golem.de/news/john-deere-ein-hacker-praesentiert-ein-jailbreak-… ∗∗∗ Threat in your browser: what dangers innocent-looking extensions hold for users ∗∗∗ --------------------------------------------- In this research, we observed various types of threats that mimic useful web browser extensions, and the number of users attacked by them. --------------------------------------------- https://securelist.com/threat-in-your-browser-extensions/107181/ ∗∗∗ Two more malicious Python packages in the PyPI ∗∗∗ --------------------------------------------- We used our internal automated system for monitoring open-source repositories and discovered two other malicious Python packages in the PyPI. --------------------------------------------- https://securelist.com/two-more-malicious-python-packages-in-the-pypi/10721… ∗∗∗ Disrupting SEABORGIUM’s ongoing phishing operations ∗∗∗ --------------------------------------------- The Microsoft Threat Intelligence Center (MSTIC) has observed and taken actions to disrupt campaigns launched by SEABORGIUM in campaigns involve persistent phishing and credential theft campaigns leading to intrusions and data theft. --------------------------------------------- https://www.microsoft.com/security/blog/2022/08/15/disrupting-seaborgiums-o… ∗∗∗ Realtek SDK SIP ALG Vulnerability: A Big Deal, but not much you can do about it. CVE 2022-27255, (Sun, Aug 14th) ∗∗∗ --------------------------------------------- On Friday, Octavio Gianatiempo & Octavio Galland released details about a vulnerability in Realtek's eCos SDK. --------------------------------------------- https://isc.sans.edu/diary/rss/28940 ∗∗∗ Finanzsanierungen nicht mit Krediten verwechseln! ∗∗∗ --------------------------------------------- Kreditsuchende stoßen bei ihren Recherchen immer wieder auf Werbeanzeigen für Finanzsanierungsangebote. Achtung: Bei Finanzsanierungsangeboten handelt es sich um keine Kredite, sondern um eine sogenannte Schuldenregulierung. Diese ist in Österreich kostenlos erhältlich, weshalb bei kostenpflichtigen Angeboten zu Abstand zu raten ist! --------------------------------------------- https://www.watchlist-internet.at/news/finanzsanierungen-nicht-mit-krediten… ∗∗∗ Typosquatting Campaign Targeting Python’s Top Packages, Dropping GitHub Hosted Malware with DGA Capabilities ∗∗∗ --------------------------------------------- On Saturday, August 13th, Checkmarx’s Software Supply Chain Security Typosquatting engine detected a large-scale attack on the Python ecosystem with multi-stage persistent malware. --------------------------------------------- https://checkmarx.com/blog/typosquatting-campaign-targeting-pythons-top-pac… ∗∗∗ What Exposed OPA Servers Can Tell You About Your Applications ∗∗∗ --------------------------------------------- This blog entry discusses what an OPA is and what it’s for, what we’ve discovered after identifying 389 exposed OPA servers via Shodan, and how exposed OPAs can negatively impact your applications’ overall security. --------------------------------------------- https://www.trendmicro.com/en_us/research/22/h/what-exposed-opa-servers-can… ===================== = Vulnerabilities = ===================== ∗∗∗ Evil PLC Attack: Using a Controller as Predator Rather than Prey ∗∗∗ --------------------------------------------- Team82 has developed a novel attack that weaponizes programmable logic controllers (PLCs) in order to exploit engineering workstations and further invade OT and enterprise networks. --------------------------------------------- https://claroty.com/team82/blog/evil-plc-attack-using-a-controller-as-preda… ∗∗∗ Process injection: breaking all macOS security layers with a single vulnerability ∗∗∗ --------------------------------------------- In this post, we will first describe what process injection is, then the details of this vulnerability and finally how we abused it. --------------------------------------------- https://sector7.computest.nl/post/2022-08-process-injection-breaking-all-ma… ∗∗∗ Database Integrity Vulnerabilities in Boeing’s Onboard Performance Tool ∗∗∗ --------------------------------------------- Security gaps in older, unprotected Windows desktop versions of Boeing’s Onboard Performance Tool (OPT) could make certain Electronic Flight Bags (EFB) more susceptible to attack. --------------------------------------------- https://www.pentestpartners.com/security-blog/database-integrity-vulnerabil… ∗∗∗ IBM Security Bulletins 2022-08-15 ∗∗∗ --------------------------------------------- IBM Sterling B2B Integrator, IBM SPSS Modeler, IBM Cloud Pak System, IBM Sterling File Gateway --------------------------------------------- https://www.ibm.com/blogs/psirt/ ∗∗∗ Zoom für macOS: Update-Funktion reißt Sicherheitslücke ∗∗∗ --------------------------------------------- Die populäre Videokonferenz-App hat auf dem Mac einmal mehr ein Security-Problem. Nutzer sollten dringend aktualisieren. Perfekt ist der Fix noch nicht. --------------------------------------------- https://heise.de/-7219942 ∗∗∗ DefCon 30: Unsicherheiten durch Microsoft in UEFI Secure Boot ∗∗∗ --------------------------------------------- Microsofts ausschweifende Signier-Praxis produziert Schwachstellen der Secure-Boot-Umgebung. Das kritisierten Sicherheitsforscher auf der DefCon 30. --------------------------------------------- https://heise.de/-7221728 ∗∗∗ Fernwartung: Kritische Sicherheitslücken in HPE Integrated Lights-Out (iLO) ∗∗∗ --------------------------------------------- Die Fernverwaltung HPE Integrated Lights-Out ermöglichte Angreifern das Einschmuggeln von Schadcode. Aktualisierte Software behebt die Fehler. --------------------------------------------- https://heise.de/-7219923 ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (trafficserver), Fedora (freeciv, gnutls, kernel, libldb, mingw-gdk-pixbuf, owncloud-client, rust-ffsend, samba, thunderbird, and zlib), Gentoo (apache, binutils, chromium, glibc, gstreamer, libarchive, libebml, nokogiri, puma, qemu, xen, and xterm), Mageia (golang, libtiff, poppler, python-django, and ruby-sinatra), Red Hat (.NET 6.0 and .NET Core 3.1), SUSE (chromium, cifs-utils, kernel, open-iscsi, and trousers), and Ubuntu (webkit2gtk). --------------------------------------------- https://lwn.net/Articles/904741/ ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by CentOS (kernel), Debian (kernel), Fedora (webkit2gtk3), Oracle (.NET 6.0, .NET Core 3.1, kernel, and kernel-container), Slackware (rsync), and SUSE (canna, ceph, chromium, curl, kernel, opera, python-Twisted, and seamonkey). --------------------------------------------- https://lwn.net/Articles/904842/ ∗∗∗ Vulnerability Spotlight: Three vulnerabilities in HDF5 file format could lead to remote code execution ∗∗∗ --------------------------------------------- Cisco Talos recently discovered three vulnerabilities in a library that works with the HDF5 file format that could allow an attacker to execute remote code on a targeted device. --------------------------------------------- http://blog.talosintelligence.com/2022/08/vuln-spotlight-hdf5-library.html ∗∗∗ TRUMPF: Products prone to Unified Automation vulnerabilities ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2022-034/ ∗∗∗ Google Android: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1042 ∗∗∗ CoreDNS: Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen ∗∗∗ --------------------------------------------- https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1047 ∗∗∗ ESRI ArcGIS: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1046 ∗∗∗ npm: Schwachstelle ermöglicht Manipulation von Dateien ∗∗∗ --------------------------------------------- https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1049 ∗∗∗ vim: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1048 ∗∗∗ Yokogawa CENTUM Controller FCS ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-22-228-01 ∗∗∗ LS ELECTRIC PLC and XG5000 ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-22-228-02 ∗∗∗ Softing Secure Integration Server ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-22-228-04 ∗∗∗ B&R Industrial Automation Automation Studio 4 ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-22-228-05 ∗∗∗ Emerson Proficy Machine Edition ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-22-228-06 ∗∗∗ Sequi PortBloque S ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-22-228-07 ∗∗∗ Two DoS vulnerabilities eliminated from Mitsubishi industrial controllers ∗∗∗ --------------------------------------------- https://www.ptsecurity.com/ww-en/about/news/two-dos-vulnerabilities-elimina… ∗∗∗ Multiple Vulnerabilities in Samba ∗∗∗ --------------------------------------------- https://www.qnap.com/en-us/security-advisory/QSA-22-22 ∗∗∗ Multiple Vulnerabilities in Apache HTTP Server ∗∗∗ --------------------------------------------- https://www.qnap.com/en-us/security-advisory/QSA-22-23 ∗∗∗ Remote Support Authentication Vulnerability in IBM Spectrum Virtualize and Lenovo Storage V Series ∗∗∗ --------------------------------------------- http://support.lenovo.com/product_security/PS500514-REMOTE-SUPPORT-AUTHENTI… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 12.08.2022
by Daily end-of-shift report 12 Aug '22

12 Aug '22

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 11-08-2022 18:00 − Freitag 12-08-2022 18:00 Handler: Stephan Richter Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ I’m a security reporter and got fooled by a blatant phish ∗∗∗ --------------------------------------------- Think youre too smart to be fooled by a phisher? Think again. --------------------------------------------- https://arstechnica.com/?p=1873356 ∗∗∗ The Importance of Website Logs ∗∗∗ --------------------------------------------- In this post, we’ll explain why logs are so important and help you understand how to use website logs to level up your security and maintain compliance. --------------------------------------------- https://blog.sucuri.net/2022/08/importance-of-website-logs-for-security.html ∗∗∗ Conti Cybercrime Cartel Using BazarCall Phishing Attacks as Initial Attack Vector ∗∗∗ --------------------------------------------- A trio of offshoots from the notorious Conti cybercrime cartel have resorted to the technique of call-back phishing as an initial access vector to breach targeted networks. --------------------------------------------- https://thehackernews.com/2022/08/conti-cybercrime-cartel-using-bazarcall.h… ∗∗∗ Sloppy Software Patches Are a ‘Disturbing Trend’ ∗∗∗ --------------------------------------------- The Zero Day Initiative has found a concerning uptick in security updates that fail to fix vulnerabilities. --------------------------------------------- https://www.wired.com/story/software-patch-flaw-uptick-zdi/ ∗∗∗ Monster Libra (TA551/Shathak) pushes IcedID (Bokbot) with Dark VNC and Cobalt Strike ∗∗∗ --------------------------------------------- Since 2019, threat actor Monster Libra (also known as TA551 or Shathak) has pushed different families of malware. --------------------------------------------- https://isc.sans.edu/diary/rss/28934 ∗∗∗ Details zum Einbruch bei Cisco – Einfallstor persönliches Google-Konto ∗∗∗ --------------------------------------------- Cisco wurde Opfer eines Cyber-Angriffs, bei dem Kriminelle Zugriff auf das interne Netz erlangten. Jetzt veröffentlicht das Unternehmen Details dazu. --------------------------------------------- https://heise.de/-7218236 ∗∗∗ Input-Device-Monitoring bei Windows: Finde die Wanze! ∗∗∗ --------------------------------------------- Für moderne Malware, die im Userland agiert, sind forensische Aufspürmethoden für Abhörversuche quasi nicht existent. Ein Forscherteam will Abhilfe schaffen. --------------------------------------------- https://heise.de/-7218864 ∗∗∗ O’Neill-Kleidung online kaufen? Nicht auf backmanboats.com! ∗∗∗ --------------------------------------------- Wir erhalten immer wieder Meldungen zu Online-Shops, die entweder gar keine Ware verschicken oder etwas, das nichts mit der Produktbeschreibung zu tun hat. Haben Sie ein teures Marken T-Shirt bestellt, aber eine billige Kopie erhalten? Solche Online-Shops nennt man Markenfälscher, da sie angeben, bekannte Marken wie O'Neill zu verkaufen. --------------------------------------------- https://www.watchlist-internet.at/news/oneill-kleidung-online-kaufen-nicht-… ∗∗∗ CISA Adds Two Known Exploited Vulnerabilities to Catalog ∗∗∗ --------------------------------------------- CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. --------------------------------------------- https://us-cert.cisa.gov/ncas/current-activity/2022/08/11/cisa-adds-two-kno… ∗∗∗ Windows Sicherheitsupdate KB5012170 für Secure Boot DBX (9. August 2022) ∗∗∗ --------------------------------------------- Noch ein kurzer Nachtrag vom Patchday, 9. August 2022. Dort wurde auch ein Sicherheitsupdate für das Secure Boot Modul durch Microsoft bereitgestellt. --------------------------------------------- https://www.borncity.com/blog/2022/08/12/windows-sicherheitsupdate-kb501217… ===================== = Vulnerabilities = ===================== ∗∗∗ Researchers Find Vulnerability in Software Underlying Discord, Microsoft Teams, and Other Apps ∗∗∗ --------------------------------------------- The popular apps used by millions of users all run the same software, called Electron. --------------------------------------------- https://www.vice.com/en/article/m7gb7y/researchers-find-vulnerability-in-so… ∗∗∗ Groupware Zimbra "trivial angreifbar" – Admins sollten schnell updaten ∗∗∗ --------------------------------------------- Mit der Verkettung zweier Security-Bugs in der Groupware haben Angreifer seit Ende Juni tausende Zimbra-Installationen übernommen. --------------------------------------------- https://heise.de/-7218354 ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (gnutls28, libtirpc, postgresql-11, and samba), Fedora (microcode_ctl, wpebackend-fdo, and xen), Oracle (.NET 6.0, galera, mariadb, and mysql-selinux, and kernel), SUSE (dbus-1 and python-numpy), and Ubuntu (booth). --------------------------------------------- https://lwn.net/Articles/904549/ ∗∗∗ OT Security Firm Warns of Safety Risks Posed by Alerton Building System Vulnerabilities ∗∗∗ --------------------------------------------- OT and IoT cybersecurity company SCADAfence has discovered potentially serious vulnerabilities in a widely used building management system made by Alerton, a brand of industrial giant Honeywell. --------------------------------------------- https://www.securityweek.com/ot-security-firm-warns-safety-risks-posed-aler… ∗∗∗ Realtek SDK Vulnerability Exposes Routers From Many Vendors to Remote Attacks ∗∗∗ --------------------------------------------- A serious vulnerability affecting the eCos SDK made by Taiwanese semiconductor company Realtek could expose the networking devices of many vendors to remote attacks. --------------------------------------------- https://www.securityweek.com/realtek-sdk-vulnerability-exposes-routers-many… ∗∗∗ Bitdefender: Schwachstelle in Device42 ∗∗∗ --------------------------------------------- Wegen einer mittlerweile behobenen Schwachstelle in Device42 gibt Bitdefender eine Empfehlung zum Update auf die Version 18.01.00 von Device42. --------------------------------------------- https://www.zdnet.de/88402845/bitdefender-schwachstelle-in-device42/ ∗∗∗ Vulnerabilities on Xiaomi’s mobile payment mechanism which could allow forged transactions : A Check Point Research analysis ∗∗∗ --------------------------------------------- Check Point Research (CPR) analyzed the payment system built into Xiaomi smartphones powered by MediaTek chips CPR found vulnerabilities that could allow forging of payment and disabling the payment system directly. --------------------------------------------- https://blog.checkpoint.com/2022/08/12/vulnerabilities-on-xiaomis-mobile-pa… ∗∗∗ VU#309662: Signed third party UEFI bootloaders are vulnerable to Secure Boot bypass ∗∗∗ --------------------------------------------- https://kb.cert.org/vuls/id/309662 ∗∗∗ Security Bulletin: Watson Knowledge Catalog InstaScan is vulnerable to an XML External Entity (XXE) Injection vulnerability due to IBM WebSphere Application Server Liberty ( CVE-2021-20492 ) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-watson-knowledge-catalog-… ∗∗∗ Security Bulletin: IBM Sterling Connect:Direct File Agent is vulnerable to remote code execution due to Apache Commons Configuration (CVE-2022-33980) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sterling-connectdirec… ∗∗∗ Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for July 2022 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnera… ∗∗∗ Security Bulletin: Operations Dashboard is vulnerable to remote connection exploit by Go CVE-2022-30629 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-operations-dashboard-is-v… ∗∗∗ Security Bulletin: Automation Assets in IBM Cloud Pak for Integration is vulnerable to remote code execution due to ejs [CVE-2022-29078] ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-automation-assets-in-ibm-… ∗∗∗ Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus are vulnerable to a remote authenticated attacker due to Node.js (CVE-2022-29244, CVE-2022-33987) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-app-connect-enterpris… ∗∗∗ Security Bulletin: IBM Java SDK and IBM Java Runtime for IBM i are vulnerable to unauthenticated attacker to cause a denial of service or low integrity impact due to multiple vulnerabilities. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-java-sdk-and-ibm-java… ∗∗∗ PostgreSQL: Schwachstelle ermöglicht Codeausführung ∗∗∗ --------------------------------------------- https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1013 ∗∗∗ Emerson ROC800, ROC800L and DL8000 ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-22-223-04 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily