Daily

daily@lists.cert.at

1 participants
3085 discussions

Tageszusammenfassung - 18.10.2021
by Daily end-of-shift report 18 Oct '21

18 Oct '21

===================== = End-of-Day report = ===================== Timeframe: Freitag 15-10-2021 18:00 − Montag 18-10-2021 18:00 Handler: Dimitri Robl Co-Handler: Wolfgang Menezes ===================== = News = ===================== ∗∗∗ Unternehmensbetrug: Diese Gefahren sollten Unternehmen und ihre MitarbeiterInnen kennen! ∗∗∗ --------------------------------------------- Internetbetrug betrifft nicht nur Privatpersonen, auch Unternehmen sind eine beliebte Zielscheibe für Cyberkriminelle. Angegriffen wird allerdings nicht nur die technische Infrastruktur von Unternehmen, vielmehr zielen Attacken hauptsächlich auf die MitarbeiterInnen ab. Im Rahmen des Projekts „CyberSec“ will sich die Watchlist Internet daher verstärkt dem Thema Unternehmensbetrug widmen, um Betriebe im Bereich der Internetsicherheit zu stärken. --------------------------------------------- https://www.watchlist-internet.at/news/unternehmensbetrug-diese-gefahren-so… ∗∗∗ REvil ransomware shuts down again after Tor sites were hijacked ∗∗∗ --------------------------------------------- The REvil ransomware operation has likely shut down once again after an unknown person hijacked their Tor payment portal and data leak blog. --------------------------------------------- https://www.bleepingcomputer.com/news/security/revil-ransomware-shuts-down-… ∗∗∗ Microsoft asks admins to patch PowerShell to fix WDAC bypass ∗∗∗ --------------------------------------------- Microsoft has asked system administrators to patch PowerShell 7 against two vulnerabilities allowing attackers to bypass Windows Defender Application Control (WDAC) enforcements and gain access to plain text credentials. --------------------------------------------- https://www.bleepingcomputer.com/news/microsoft/microsoft-asks-admins-to-pa… ∗∗∗ Warranty Repairs and Non-Removable Storage Risks, (Fri, Oct 15th) ∗∗∗ --------------------------------------------- I have been asked several times in recent months about addressing risks of warranty repair service of laptops/tablets. With each of these situations, the question boiled down to the same underlying issue: non-removable storage --------------------------------------------- https://isc.sans.edu/diary/rss/27938 ∗∗∗ Malicious PowerShell Using Client Certificate Authentication, (Mon, Oct 18th) ∗∗∗ --------------------------------------------- Attackers have many ways to protect their C2 servers from unwanted connections. They can check some specific headers, the user-agent, the IP address location (GeoIP), etc. I spotted an interesting PowerShell sample that implements a client certificate authentication mechanism to access its C2 server. --------------------------------------------- https://isc.sans.edu/diary/rss/27944 ∗∗∗ Security Risks with Private 5G in Manufacturing Companies ∗∗∗ --------------------------------------------- Private 5G is said to bring about the "democratization of communications." This technology allows private companies and local governments to take the driving seat in operating the latest information communication systems. --------------------------------------------- https://www.trendmicro.com/en_us/research/21/j/security-risks-with-private-… ∗∗∗ Ransomware in a global context ∗∗∗ --------------------------------------------- This report is the first step in what we hope will become an ongoing community effort to discover and share actionable information on malware trends. Over the last 16 years, we have processed more than 2 million files per day across 232 countries. --------------------------------------------- https://storage.googleapis.com/vtpublic/vt-ransomware-report-2021.pdf ∗∗∗ Case Study: From BazarLoader to Network Reconnaissance ∗∗∗ --------------------------------------------- BazarLoader Windows-based malware provides backdoor access that criminals can use to perform reconnaissance to map the victims network. --------------------------------------------- https://unit42.paloaltonetworks.com/bazarloader-network-reconnaissance/ ∗∗∗ This particularly dangerous phishing attack features a weaponized Excel file ∗∗∗ --------------------------------------------- Security researchers warn about a sneaky phishing campaign from one of the most creative cybercrime groups on the internet. --------------------------------------------- https://www.zdnet.com/article/this-particularly-dangerous-phishing-attack-f… ∗∗∗ Virus Bulletin: Old malware never dies – it just gets more targeted ∗∗∗ --------------------------------------------- Putting a precision payload on top of more generic malware makes perfect sense for malware operators --------------------------------------------- https://www.welivesecurity.com/2021/10/15/virus-bulletin-old-malware-never-… ∗∗∗ IcedID to XingLocker Ransomware in 24 hours ∗∗∗ --------------------------------------------- Towards the end of July, we observed an intrusion that began with IcedID malware and ended in XingLocker ransomware, a Mountlocker variant. XingLocker made its first appearance in early [...] --------------------------------------------- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-… ∗∗∗ ASEC Weekly Malware Statistics (October 4th, 2021 – October 10th, 2021) ∗∗∗ --------------------------------------------- The ASEC analysis team is using the ASEC automatic analysis system RAPIT to categorize and respond to known malware. This post will list weekly statistics collected from October 4th, 2021 (Monday) to October 10th, 2021 (Sunday). For the main category, info-stealer ranked top with 68.4%, followed by Downloader with 12.6%, RAT (Remote Administration Tool) malware with 8.6%, Backdoor Downloader with 6.3%, Ransomware with 3.7%, and Banking malware with 0.3%. --------------------------------------------- https://asec.ahnlab.com/en/27824/ ===================== = Vulnerabilities = ===================== ∗∗∗ WordPress: Beliebtes Plugin "WP Fastest Cache" braucht dringend ein Update ∗∗∗ --------------------------------------------- Jetzt updaten: Das Cache-Plugin WP Fastest Cache wies Schwachstellen auf, die WordPress-Installationen unter bestimmten Voraussetzungen angreifbar machten. --------------------------------------------- https://heise.de/-6220994 ∗∗∗ 2021-10 Security Bulletin: CTPView: HSTS not being enforced on CTPView server. (CVE-2021-0296) ∗∗∗ --------------------------------------------- The Juniper Networks CTPView server is not enforcing HTTP Strict Transport Security (HSTS). --------------------------------------------- https://kb.juniper.net/InfoCenter/index?page=content&id=JSA11210 ∗∗∗ 2021-10 Security Bulletin: Junos OS: MX Series: Receipt of specific packet on MS-MPC/MS-MIC causes line card reset (CVE-2021-31351) ∗∗∗ --------------------------------------------- An Improper Check for Unusual or Exceptional Conditions in packet processing on the MS-MPC/MS-MIC utilized by Juniper Networks Junos OS allows a malicious attacker to send a specific packet, triggering the MS-MPC/MS-MIC to reset, causing a Denial of Service (DoS). --------------------------------------------- https://kb.juniper.net/InfoCenter/index?page=content&id=JSA11216 ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (amd64-microcode, libreoffice, linux-4.19, and nghttp2), Fedora (chromium, libopenmpt, vim, and xen), openSUSE (firefox, kernel, krb5, libaom, and opera), Oracle (thunderbird), SUSE (firefox, firefox, rust-cbindgen, iproute2, javapackages-tools, javassist, mysql-connector-java, protobuf, python-python-gflags, and krb5), and Ubuntu (nginx). --------------------------------------------- https://lwn.net/Articles/873210/ ∗∗∗ 128 Technology Session Smart Router vulnerable to authentication bypass ∗∗∗ --------------------------------------------- https://jvn.jp/en/jp/JVN85073657/ ∗∗∗ Eclipse Jetty vulnerability CVE-2021-28165 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K15338344?utm_source=f5support&utm_mediu… ∗∗∗ Node.js vulnerabilities CVE-2021-3672 and CVE-2021-22931 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K53225395?utm_source=f5support&utm_mediu… ∗∗∗ OTRS: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K21-1077 ∗∗∗ Security Bulletin: IBM Cloud Pak for Integration is vulnerable to jzsip (CVE-2021-23413) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cloud-pak-for-integra… ∗∗∗ Security Bulletin: A vulnerability in Spring Framework affects IBM Watson Machine Learning Accelerator ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-spring… ∗∗∗ Security Bulletin: Cross site scripting vulnerability affecting Case Builder in IBM Business Automation Workflow – CVE-2021-29878 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-cross-site-scripting-vuln… ∗∗∗ Security Bulletin: Multiple Security Vulnerabilities Have been addressed in IBM Security Access Manager ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnera… ∗∗∗ Security Bulletin: IBM Cloud Pak for Integration is vulnerable to multiple Node.js vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cloud-pak-for-integra… ∗∗∗ Security Bulletin: IBM Cloud Pak for Integration is vulnerable to multiple Go vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cloud-pak-for-integra… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 15.10.2021
by Daily end-of-shift report 15 Oct '21

15 Oct '21

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 14-10-2021 18:00 − Freitag 15-10-2021 18:00 Handler: Dimitri Robl Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ Accenture confirms data breach after August ransomware attack ∗∗∗ --------------------------------------------- Global IT consultancy giant Accenture confirmed that LockBit ransomware operators stole data from its systems during an attack that hit the companys systems in August 2021. --------------------------------------------- https://www.bleepingcomputer.com/news/security/accenture-confirms-data-brea… ∗∗∗ BlackByte Ransomware – Pt. 1 In-depth Analysis ∗∗∗ --------------------------------------------- During a recent malware incident response case, we encountered an interesting piece of ransomware that goes by the name of BlackByte. --------------------------------------------- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/blackbyte-r… ∗∗∗ BlackByte Ransomware – Pt 2. Code Obfuscation Analysis ∗∗∗ --------------------------------------------- We received the original launcher file from an Incident Response case. It was about 630 KB of JScript code which was seemingly full of garbage code – hiding the real intent. --------------------------------------------- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/blackbyte-r… ∗∗∗ Employee offboarding: Why companies must close a crucial gap in their security strategy ∗∗∗ --------------------------------------------- There are various ways a departing employee could put your organization at risk of a data breach. How do you offboard employees the right way and ensure your data remains safe? --------------------------------------------- https://www.welivesecurity.com/2021/10/14/employee-offboarding-companies-cl… ∗∗∗ Ongoing Cyber Threats to U.S. Water and Wastewater Systems Sector Facilities ∗∗∗ --------------------------------------------- CISA, the Federal Bureau of Investigation (FBI), the Environmental Protection Agency (EPA), and the National Security Agency (NSA) have released a joint Cybersecurity Advisory (CSA) that details ongoing cyber threats to U.S. Water and Wastewater Systems (WWS) Sector. --------------------------------------------- https://us-cert.cisa.gov/ncas/current-activity/2021/10/14/ongoing-cyber-thr… ∗∗∗ A malware botnet has made more than $24.7 million since 2019 ∗∗∗ --------------------------------------------- The operators of a malware botnet known as MyKings are believed to have made more than $24.7 million through what security researchers call a "clipboard hijacker." --------------------------------------------- https://therecord.media/a-malware-botnet-has-made-more-than-24-7-million-si… ===================== = Vulnerabilities = ===================== ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- IBM hat 11 Security Bulletins veröffentlicht. --------------------------------------------- https://www.ibm.com/blogs/psirt/ ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (squashfs-tools, tomcat9, and wordpress), Fedora (openssh), openSUSE (kernel, mbedtls, and rpm), Oracle (httpd, kernel, and kernel-container), SUSE (firefox, kernel, and rpm), and Ubuntu (linux-azure, linux-azure-5.4). --------------------------------------------- https://lwn.net/Articles/873056/ ∗∗∗ ZDI-21-1211: (0Day) Fuji Electric Alpha5 A5V File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-21-1211/ ∗∗∗ ZDI-21-1210: (0Day) Fuji Electric Alpha5 Servo Operator C5P File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-21-1210/ ∗∗∗ ZDI-21-1209: (0Day) Fuji Electric Alpha5 Servo Operator C5P File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-21-1209/ ∗∗∗ ZDI-21-1208: (0Day) Fuji Electric Alpha5 Servo Operator C5P File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-21-1208/ ∗∗∗ Schneider Electric CNM ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-287-01 ∗∗∗ Uffizio GPS Tracker ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-287-02 ∗∗∗ Mitsubishi Electric MELSEC iQ-R Series ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-287-03 ∗∗∗ Siemens RUGGEDCOM ROX (Update A) ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-259-01 ∗∗∗ Apache Releases Security Advisory for Tomcat ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ncas/current-activity/2021/10/15/apache-releases-s… ∗∗∗ SYSS-2019-018/SYSS-2019-019: Unsichere Dateisystemberechtigungen und Installationsmodi in Ivanti DSM ∗∗∗ --------------------------------------------- https://www.syss.de/pentest-blog/syss-2019-018/syss-2019-019-unsichere-date… ∗∗∗ Change in Magniber Ransomware Vulnerability (CVE-2021-40444) ∗∗∗ --------------------------------------------- https://asec.ahnlab.com/en/27264/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 14.10.2021
by Daily end-of-shift report 14 Oct '21

14 Oct '21

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 13-10-2021 18:00 − Donnerstag 14-10-2021 18:00 Handler: Dimitri Robl Co-Handler: Wolfgang Menezes ===================== = News = ===================== ∗∗∗ Nach Datenleck: Hausdurchsuchung statt Dankeschön ∗∗∗ --------------------------------------------- Rund 700.000 Personen sind von einem Datenleck betroffen. Ein Programmierer hatte die Lücke entdeckt und gemeldet - und erhielt eine Anzeige. Von Moritz Tremmel (Datenleck, Server) --------------------------------------------- https://www.golem.de/news/nach-datenleck-hausdurchsuchung-statt-dankeschoen… ∗∗∗ Romance scams with a cryptocurrency twist – new research from SophosLabs ∗∗∗ --------------------------------------------- Romance scams and dating site treachery with a new twist - "theres an app for that!" --------------------------------------------- https://nakedsecurity.sophos.com/2021/10/13/romance-scams-with-a-cryptocurr… ∗∗∗ A Handshake with MySQL Bots ∗∗∗ --------------------------------------------- It’s well known that we just don’t put services or devices on the edge of the Internet without strong purpose justification. Services, whether maintained by end-users or administrators, have a ton of security challenges. Databases belong to a group that often needs direct access to the Internet - no doubt that security requirements are a priority here. --------------------------------------------- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/handshake-w… ∗∗∗ We analyzed 80 million ransomware samples – here’s what we learned ∗∗∗ --------------------------------------------- [...] VirusTotal’s first Ransomware Activity Report provides a holistic view of ransomware attacks by combining more than 80 million potential ransomware-related samples submitted over the last year and a half. --------------------------------------------- https://blog.google/technology/safety-security/we-analyzed-80-million-ranso… ∗∗∗ “Free Steam game” scams on TikTok are Among Us ∗∗∗ --------------------------------------------- We look at a dubious free game offer via TikTok, and explore what the site owners expect you to do in order to snag a supposed freebie. --------------------------------------------- https://blog.malwarebytes.com/scams/2021/10/free-steam-game-scams-on-tiktok… ∗∗∗ Wege in Fake-Shops ∗∗∗ --------------------------------------------- Betrügerische und unseriöse Shops sind ein großes Problem im Online-Handel. Doch wie kommen Konsumentinnen und Konsumenten eigentlich zu Fake-Shops? Mit dieser Frage hat sich die Watchlist Internet in den Sommermonaten beschäftigt. Klar wurde: Google- und Facebook-Werbung sind die größten Zubringer zu Fake-Shops. Über diese Wege kommt der Großteil der Opfer auf betrügerische Online-Shops. --------------------------------------------- https://www.watchlist-internet.at/news/wege-in-fake-shops/ ∗∗∗ Don’t get phished! How to be the one that got away ∗∗∗ --------------------------------------------- If it looks like a duck, swims like a duck, and quacks like a duck, then its probably a duck. Now, how do you apply the duck test to defense against phishing? --------------------------------------------- https://www.welivesecurity.com/2021/10/13/phishing-how-be-one-got-away/ ∗∗∗ New Yanluowang ransomware used in targeted attacks ∗∗∗ --------------------------------------------- New arrival to the targeted ransomware scene appears to be still in development. --------------------------------------------- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ya… ∗∗∗ Acer confirms second security breach this year ∗∗∗ --------------------------------------------- A spokesperson for Taiwanese computer maker Acer has confirmed today that the company suffered a second security breach this year after hackers advertised the sale of more than 60 GB of data on an underground cybercrime forum.The post Acer confirms second security breach this year appeared first on The Record by Recorded Future. --------------------------------------------- https://therecord.media/acer-confirms-second-security-breach-this-year/ ∗∗∗ Q&A: Secure PLC Programming Insights ∗∗∗ --------------------------------------------- Members of the Top 20 Secure PLC Coding Practices project recently joined Claroty’s Aperture podcast to discuss the group’s list of top 20 secure coding practices for programmable logic controllers (PLCs). What follows is an edited transcript of our discussion with Martin Scheu of SWITCH-CERT and Dirk Rotermund of gefeba Engineering GmbH. --------------------------------------------- https://claroty.com/2021/10/13/blog-qa-secure-plc-programming-insights/ ∗∗∗ Windows Oktober 2021-Updates: PrintNightmare-Stand und Netzwerk-Druckprobleme ∗∗∗ --------------------------------------------- Zum 12. Oktober 2021 hat Microsoft neue Schwachstellen im Umfeld der als PrintNightmare bekannten Sicherheitslücken per Update adressiert. Daher ein kurzer Blick auf das betreffende Thema, welches auch weiterhin nicht vom Tisch ist. --------------------------------------------- https://www.borncity.com/blog/2021/10/14/windows-oktober-2021-updates-print… ===================== = Vulnerabilities = ===================== ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- IBM hat 16 Security Bulletins veröffentlicht. --------------------------------------------- https://www.ibm.com/blogs/psirt/ ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Mageia (golang, grilo, mediawiki, plib, python-flask-restx, python-mpmath, thunderbird, and xstream/xmlpull/mxparser), Oracle (389-ds-base, grafana, httpd:2.4, kernel, libxml2, and openssl), Red Hat (httpd), and SUSE (kernel). --------------------------------------------- https://lwn.net/Articles/872945/ ∗∗∗ Loft Data Grids - Moderately critical - XML External Entity (XXE) Processing - SA-CONTRIB-2021-043 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2021-043 ∗∗∗ Juniper JUNOS und Juniper JUNOS Evolved: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K21-1070 ∗∗∗ Microsoft Exchange Server: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K21-1069 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 13.10.2021
by Daily end-of-shift report 13 Oct '21

13 Oct '21

===================== = End-of-Day report = ===================== Timeframe: Dienstag 12-10-2021 18:00 − Mittwoch 13-10-2021 18:00 Handler: Dimitri Robl Co-Handler: Wolfgang Menezes ===================== = News = ===================== ∗∗∗ MysterySnail attacks with Windows zero-day ∗∗∗ --------------------------------------------- We detected attacks with the use of an elevation of privilege exploit on multiple Microsoft Windows servers. Variants of the malware payload used along with the zero-day exploit were detected in widespread espionage campaigns. --------------------------------------------- https://securelist.com/mysterysnail-attacks-with-windows-zero-day/104509/ ∗∗∗ Defining Cobalt Strike Components So You Can BEA-CONfident in Your Analysis ∗∗∗ --------------------------------------------- Cobalt Strike is a commercial adversary simulation software that is marketed to red teams but is also stolen and actively used by a wide range of threat actors from ransomware operators to espionage-focused Advanced Persistent Threats (APTs). --------------------------------------------- https://www.mandiant.com/resources/defining-cobalt-strike-components ∗∗∗ 2021: Apples Jahr der Zero-Days ∗∗∗ --------------------------------------------- In dieser Woche hat Apple erneut eine bereits ausgenutzte iPhone-Lücke gepatcht. Seit Februar gab es mehr als ein Dutzend in den Systemen des Konzerns. --------------------------------------------- https://heise.de/-6215715 ∗∗∗ Azure Privilege Escalation via Service Principal Abuse ∗∗∗ --------------------------------------------- In this blog post, I’ll explain how a particular kind of attack path can emerge in Azure based on Azure’s RBAC system — an attack path we have seen in the vast majority of Azure tenants we’ve gotten access to. --------------------------------------------- https://posts.specterops.io/azure-privilege-escalation-via-service-principa… ===================== = Vulnerabilities = ===================== ∗∗∗ SAP-Patchday: NetWeaver AS & Environmental Compliance bargen kritische Lücken ∗∗∗ --------------------------------------------- Zum monatlichen Patchday hat SAP Updates für viele Produkte veröffentlicht. Zwei beseitigten Sicherheitsproblemen wurden CVSS-Scores nahe der 10 zugeordnet. --------------------------------------------- https://heise.de/-6215952 ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (flatpak and ruby2.3), Fedora (flatpak, httpd, mediawiki, redis, and xstream), openSUSE (kernel, libaom, libqt5-qtsvg, systemd, and webkit2gtk3), Red Hat (.NET 5.0, 389-ds-base, httpd:2.4, kernel, kernel-rt, libxml2, openssl, and thunderbird), Scientific Linux (389-ds-base, kernel, libxml2, and openssl), SUSE (apache2-mod_auth_openidc, curl, glibc, kernel, libaom, libqt5-qtsvg, systemd, and webkit2gtk3), and Ubuntu (squashfs-tools). --------------------------------------------- https://lwn.net/Articles/872843/ ∗∗∗ The October 2021 Security Update Review ∗∗∗ --------------------------------------------- The second Tuesday of the month is here, and that means the latest security updates from Adobe and Microsoft have arrived. --------------------------------------------- https://www.thezdi.com/blog/2021/10/12/the-october-2021-security-update-rev… ∗∗∗ Sicherheitsupdates für Exchange Server (Oktober 2021) ∗∗∗ --------------------------------------------- Microsoft hat zum 12. Oktober 2021 Sicherheitsupdates für Exchange Server 2013, Exchange Server 2016 und Exchange Server 2019 veröffentlicht. --------------------------------------------- https://www.borncity.com/blog/2021/10/13/sicherheitsupdates-fr-exchange-ser… ∗∗∗ ZDI-21-1147: Adobe Illustrator PDF File Parsing Memory Corruption Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-21-1147/ ∗∗∗ ZDI-21-1146: Adobe Illustrator PDF File Parsing Use-After-Free Information Disclosure Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-21-1146/ ∗∗∗ ZDI-21-1148: Linux Kernel eBPF Type Confusion Privilege Escalation Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-21-1148/ ∗∗∗ VMSA-2021-0021 ∗∗∗ --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2021-0021.html ∗∗∗ VMSA-2021-0022 ∗∗∗ --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2021-0022.html ∗∗∗ VMSA-2021-0023 ∗∗∗ --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2021-0023.html ∗∗∗ Apache HTTPD vulnerability CVE-2021-34798 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K72382141 ∗∗∗ Multiple Vulnerabilities in Brizy Page Builder Plugin Allow Site Takeover ∗∗∗ --------------------------------------------- https://www.wordfence.com/blog/2021/10/multiple-vulnerabilities-in-brizy-pa… ∗∗∗ Cross-Site Scripting in myfactory.FMS ∗∗∗ --------------------------------------------- https://www.redteam-pentesting.de/en/advisories/rt-sa-2021-001/ ∗∗∗ IPAS: Security Advisories for October 2021 ∗∗∗ --------------------------------------------- https://blogs.intel.com/technology/2021/10/intel-security-advisories-for-oc… ∗∗∗ SYSS-2021-014, SYSS-2021-015 und SYSS-2021-019: Schwachstellen in Softphones von Linphone und MicroSIP ∗∗∗ --------------------------------------------- https://www.syss.de/pentest-blog/syss-2021-014-syss-2021-015-und-syss-2021-… ∗∗∗ ThinkPad BIOS Vulnerabilities ∗∗∗ --------------------------------------------- http://support.lenovo.com/product_security/PS500444-THINKPAD-BIOS-VULNERABI… ∗∗∗ NetApp Clustered Data ONTAP X-Frame-Options Header Vulnerability ∗∗∗ --------------------------------------------- http://support.lenovo.com/product_security/PS500442-NETAPP-CLUSTERED-DATA-O… ∗∗∗ AMD x86 PREFETCH instruction related side-channels ∗∗∗ --------------------------------------------- http://support.lenovo.com/product_security/PS500445-AMD-X86-PREFETCH-INSTRU… ∗∗∗ Intel SGX SDK Advisory ∗∗∗ --------------------------------------------- http://support.lenovo.com/product_security/PS500443-INTEL-SGX-SDK-ADVISORY -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 12.10.2021
by Daily end-of-shift report 12 Oct '21

12 Oct '21

===================== = End-of-Day report = ===================== Timeframe: Montag 11-10-2021 18:00 − Dienstag 12-10-2021 18:00 Handler: Dimitri Robl Co-Handler: Wolfgang Menezes ===================== = News = ===================== ∗∗∗ Javascript: RSA-Schlüsselerzeugung mit vielen Nullen ∗∗∗ --------------------------------------------- Github sperrt unsichere SSH-Schlüssel, die durch einen Fehler in einer Javascript-Bibliothek erzeugt wurden. --------------------------------------------- https://www.golem.de/news/javascript-rsa-schluesselerzeugung-mit-vielen-nul… ∗∗∗ iOS 15.0.2 und watchOS 8.0.1: Viele Bugfixes – und wieder ein Exploit im Umlauf ∗∗∗ --------------------------------------------- Apple hat in der Nacht zum Dienstag seine iPhone-, iPad- und Apple-Watch-Betriebssysteme nachgebessert. Bei Telefon und Tablet geht es auch um die Sicherheit. --------------------------------------------- https://heise.de/-6214563 ∗∗∗ Johnson Controls: Lücken boten Remote-Zugriffsmöglichkeiten auf Videoüberwachung ∗∗∗ --------------------------------------------- Updates für die Videoüberwachungslösung exacqVision von Johnson Controls/Exacq Technologies schließen zwei Sicherheitslücken. Eine gilt als kritisch. --------------------------------------------- https://heise.de/-6215264 ∗∗∗ Vorsicht vor Microsoft-Anrufen ∗∗∗ --------------------------------------------- Legen Sie sofort auf, wenn Sie angeblich von Microsoft angerufen werden. Kriminelle geben sich als Microsoft-MitarbeiterInnen aus und behaupten, sie hätten auf Ihrem Computer einen Virus entdeckt. Die Fake-Microsoft-MitarbeiterInnen verwickeln Sie dann in ein Gespräch und bieten Ihnen an, das Problem gemeinsam zu lösen. Achtung: Es handelt sich um eine Betrugsmasche! --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-vor-microsoft-anrufen/ ∗∗∗ Photo editor Android app STILL sitting on Google Play store is malware ∗∗∗ --------------------------------------------- An Android app sitting on the Google Play store touts itself to be a photo editor app. But, it contains code that steals the users Facebook credentials to potentially run ad campaigns on the users behalf, with their payment information. The app has scored over 5K installs, with similar spyware apps having 500K+ installs. --------------------------------------------- https://www.bleepingcomputer.com/news/security/photo-editor-android-app-sti… ∗∗∗ How cyberattacks are changing according to new Microsoft Digital Defense Report ∗∗∗ --------------------------------------------- Get the latest expert insights on human-operated ransomware, phishing attacks, malware, and more to get ahead of these threats before they begin. --------------------------------------------- https://www.microsoft.com/security/blog/2021/10/11/how-cyberattacks-are-cha… ∗∗∗ SnapMC skips ransomware, steals data ∗∗∗ --------------------------------------------- Over the past few months NCC Group has observed an increasing number of data breach extortion cases, where the attacker steals data and threatens to publish said data online if the victim decides not to pay. Given the current threat landscape, most notable is the absence of ransomware or any technical attempt at disrupting the [...] --------------------------------------------- https://blog.fox-it.com/2021/10/11/snapmc-skips-ransomware-steals-data/ ∗∗∗ Reverse engineering and decrypting CyberArk vault credential files ∗∗∗ --------------------------------------------- This blog will be a technical deep-dive into CyberArk credential files and how the credentials stored in these files are encrypted and decrypted. I discovered it was possible to reverse engineer the encryption and key generation algorithms and decrypt the encrypted vault password. --------------------------------------------- https://blog.fox-it.com/2021/10/12/reverse-engineering-and-decrypting-cyber… ∗∗∗ New Trickbot and BazarLoader campaigns use multiple delivery vectors ∗∗∗ --------------------------------------------- Trickbot has been active since 2016 and is linked to a large number of malicious campaigns involving bitcoin mining and theft of banking information, personal identifying information (PII), and credentials. BazarLoader is a spinoff of this trojan, developed by the same authors. Both are particularly dangerous as they are easily modifiable and capable of delivering multi-stage payloads, as well as taking over computers entirely. --------------------------------------------- https://www.zscaler.com/blogs/security-research/new-trickbot-and-bazarloade… ∗∗∗ Inside Apple: How macOS attacks are evolving ∗∗∗ --------------------------------------------- Our Apple expert Thomas Reed went to the Objective by the Sea security conference. Heres what he learned about macOS attacks. --------------------------------------------- https://blog.malwarebytes.com/malwarebytes-news/2021/10/inside-apple-how-ma… ∗∗∗ ICS Patch Tuesday: Siemens and Schneider Electric Address Over 50 Vulnerabilities ∗∗∗ --------------------------------------------- Industrial giants Siemens and Schneider Electric on Tuesday released nearly a dozen security advisories describing a total of more than 50 vulnerabilities affecting their products. The companies have released patches and mitigations to address these vulnerabilities. --------------------------------------------- https://www.securityweek.com/ics-patch-tuesday-siemens-and-schneider-electr… ∗∗∗ ASEC Weekly Malware Statistics (September 27th, 2021 – October 3rd, 2021) ∗∗∗ --------------------------------------------- The ASEC analysis team is using the ASEC automatic analysis system RAPIT to categorize and respond to known malware. This post will list weekly statistics collected from September 27th, 2021 (Monday) to October 3rd, 2021 (Sunday). For the main category, info-stealer ranked top with 63.2%, followed by Downloader with 19.2%, RAT (Remote Administration Tool) malware with 10.7%, Backdoor Downloader with 3.7%, Ransomware with 1.9%, CoinMiner with 1.1%, and Banking malware with 0.2%. --------------------------------------------- https://asec.ahnlab.com/en/27577/ ===================== = Vulnerabilities = ===================== ∗∗∗ Angreifer könnten digitale Unterschrift in LibreOffice und OpenOffice fälschen ∗∗∗ --------------------------------------------- Es gibt wichtige Sicherheitsupdates für die Office-Pakete LibreOffice und OpenOffice. --------------------------------------------- https://heise.de/-6214784 ∗∗∗ Vulnerability Spotlight: Vulnerabilities in Anker Eufy Homebase could lead to code execution, buffer overflows ∗∗∗ --------------------------------------------- Cisco Talos recently discovered two vulnerabilities in the Anker Eufy Homebase. The Eufy Homebase 2 is the video storage and networking gateway that works with Anker’s Eufy Smarthome ecosystem. --------------------------------------------- https://blog.talosintelligence.com/2021/10/vuln-spotlight-anker-.html ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (firefox-esr, hiredis, and icu), Fedora (kernel), Mageia (libreoffice), openSUSE (chromium, firefox, git, go1.16, kernel, mbedtls, mupdf, and nodejs8), Oracle (firefox and kernel), Red Hat (firefox, grafana, kernel, kpatch-patch, and rh-mysql80-mysql), and SUSE (apache2, containerd, docker, runc, curl, firefox, kernel, libqt5-qtsvg, and squid). --------------------------------------------- https://lwn.net/Articles/872696/ ∗∗∗ # SSA-163251: Multiple Vulnerabilities in SINEC NMS ∗∗∗ --------------------------------------------- The latest update for SINEC NMS fixes multiple vulnerabilities. The most severe could allow an authenticated remote attacker to execute arbitrary code on the system, with system privileges, under certain conditions. Siemens has released an update for SINEC NMS and recommends to update to the latest version. --------------------------------------------- https://cert-portal.siemens.com/productcert/txt/ssa-163251.txt ∗∗∗ # SSA-173565: Denial-of-Service Vulnerability in RUGGEDCOM ROX Devices ∗∗∗ --------------------------------------------- The latest update for RUGGEDCOM ROX devices fixes a vulnerability that could allow an unauthenticated attacker to cause a permanent Denial-of-Service condition under certain conditions. Siemens has released updates for the affected products and recommends to update to the latest versions. --------------------------------------------- https://cert-portal.siemens.com/productcert/txt/ssa-173565.txt ∗∗∗ # SSA-178380: Denial-of-Service Vulnerability in SINUMERIK Controllers ∗∗∗ --------------------------------------------- A Denial-of-Service vulnerability found in SINUMERIK Controllers could allow an unauthenticated attacker with network access to the affected devices to cause system failure with total loss of availability. Siemens has released an update for the SINUMERIK 828D and recommends to update to the latest version. Siemens recommends specific countermeasures for products where updates are not, or not yet available. --------------------------------------------- https://cert-portal.siemens.com/productcert/txt/ssa-178380.txt ∗∗∗ # SSA-280624: Multiple Vulnerabilities in SCALANCE W1750D ∗∗∗ --------------------------------------------- The Scalance W1750D device contains multiple vulnerabilities that could allow an attacker to inject commands or trigger buffer overflows. Siemens is preparing updates and recommends countermeasures for products where updates are not, or not yet available. --------------------------------------------- https://cert-portal.siemens.com/productcert/txt/ssa-280624.txt ∗∗∗ Advantech WebAccess SCADA ∗∗∗ --------------------------------------------- This advisory contains mitigations for a Missing Authorization vulnerability in the Advantech WebAccess SCADA HMI platform. --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-285-01 ∗∗∗ Advantech WebAccess ∗∗∗ --------------------------------------------- This advisory contains mitigations for Heap-based Buffer Overflow, and Stack-based Buffer Overflow vulnerabilities in the Advantech WebAccess HMI platform. --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-285-02 ∗∗∗ Schneider Electric IGSS ∗∗∗ --------------------------------------------- This advisory contains mitigations for Classic Buffer Overflow, Unrestricted Upload of File with Dangerous Type, Path Traversal, and Missing Authentication for Critical Function vulnerabilities in Schneider Electric IGSS (Interactive Graphical SCADA System) software. --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-285-03 ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect AIX ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-data-risk-manager-is-… ∗∗∗ Security Bulletin: Multiple Apache PDFBox security vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-apache-pdfbox-se… ∗∗∗ Security Bulletin: A vulnerability in IBM WebSphere Application Server affects IBM Spectrum Scale packaged in IBM Elastic Storage Server (CVE-2020-5258) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-ibm-we… ∗∗∗ Foxit Reader & PhantomPDF: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K21-1053 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 11.10.2021
by Daily end-of-shift report 11 Oct '21

11 Oct '21

===================== = End-of-Day report = ===================== Timeframe: Freitag 08-10-2021 18:00 − Montag 11-10-2021 18:00 Handler: Dimitri Robl Co-Handler: Wolfgang Menezes ===================== = News = ===================== ∗∗∗ Missbrauch mit Malware-Befall: Microsoft deaktiviert Excel 4.0-Makros in Office ∗∗∗ --------------------------------------------- Gegen immer mehr Angriffe über Excel-Makros geht Microsoft nun vor: Standardmäßig werden alle Excel 4.0-Makros in Office 365 demnächst deaktiviert. --------------------------------------------- https://heise.de/-6213387 ∗∗∗ Kaufen Sie nicht in Shops mit @thateer.top Mail-Adressen ein! ∗∗∗ --------------------------------------------- Derzeit tauchen zahlreiche Fake-Shops im Internet auf, die alle ähnlich aufgebaut sind, die gleichen Texte verwenden und unter einer dieser E-Mail-Adressen erreichbar sind: [...] --------------------------------------------- https://www.watchlist-internet.at/news/kaufen-sie-nicht-in-shops-mit-thatee… ∗∗∗ Ransomware wegen Homeoffice auf dem Vormarsch ∗∗∗ --------------------------------------------- Bedingt durch die Coronavirus-Pandemie arbeiten seit 2020 Menschen vermehrt im Homeoffice. Leider konnte die Absicherung dieser Arbeitsplätze mit dieser Entwicklung nicht Schritt halten. Gleichzeitig hat die Cyberkriminalität mit der verstärkten Telearbeit in Unternehmen durch die Pandemiekrise weiter aufgerüstet und ihre [...] --------------------------------------------- https://www.borncity.com/blog/2021/10/11/ransomware-auf-dem-vormarsch/ ∗∗∗ The 5 Phases of Zero Trust Adoption ∗∗∗ --------------------------------------------- Zero trust aims to replace implicit trust with explicit, continuously adaptive trust across users, devices, networks, applications, and data. --------------------------------------------- https://www.darkreading.com/endpoint/the-5-phases-of-zero-trust-adoption ∗∗∗ Scanning for Previous Oracle WebLogic Vulnerabilities, (Sat, Oct 9th) ∗∗∗ --------------------------------------------- In the past few weeks, I have captured multiple instance of traffic related to some past Oracle vulnerabilities that have already been patched. The first is related to a RCE (CVE-2017-10271) that can be triggered to execute commands remotely by bypassing the CVE-2017-3506 patch's limitations. The POST contains an init.sh script which doesn't appear to be available for download. --------------------------------------------- https://isc.sans.edu/diary/rss/27918 ∗∗∗ Things that go "Bump" in the Night: Non HTTP Requests Hitting Web Servers, (Mon, Oct 11th) ∗∗∗ --------------------------------------------- If you are reviewing your web server logs periodically, you may notice some odd requests that are not HTTP requests in your logs. In particular if you have a web server listening on a non standard port. I want to quickly review some of the most common requests like that, that I am seeing: [...] --------------------------------------------- https://isc.sans.edu/diary/rss/27924 ∗∗∗ When criminals go corporate: Ransomware-as-a-service, bulk discounts and more ∗∗∗ --------------------------------------------- This summer, Abnormal Security discovered that some of its customers staff were receiving emails inviting them to install ransomware on a company computer in return for a $1m share of the "profits". --------------------------------------------- https://go.theregister.com/feed/www.theregister.com/2021/10/11/ransomware_a… ∗∗∗ CISA Releases Remote Access Guidance for Government Agencies ∗∗∗ --------------------------------------------- The United States Cybersecurity and Infrastructure Security Agency (CISA) last week announced the release a new guidance document: Trusted Internet Connections (TIC) 3.0 Remote User Use Case. --------------------------------------------- https://www.securityweek.com/cisa-releases-remote-access-guidance-governmen… ∗∗∗ InHand Router Flaws Could Expose Many Industrial Companies to Remote Attacks ∗∗∗ --------------------------------------------- Several serious vulnerabilities discovered by researchers in industrial routers made by InHand Networks could expose many organizations to remote attacks, and patches do not appear to be available. --------------------------------------------- https://www.securityweek.com/inhand-router-flaws-could-expose-many-industri… ∗∗∗ Protect your network ∗∗∗ --------------------------------------------- So, you know where your wallet is, yes? And your phone - it's in your pocket, or just over there on the table? Excellent. You might be reading this on your laptop, so you know where that is. You might have a snazzy Smart TV or two? Perhaps you have joined [...] --------------------------------------------- https://connect.geant.org/2021/10/11/protect-your-network ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (apache2, mediawiki, neutron, and tiff), Fedora (chromium, dr_libs, firefox, and grafana), Mageia (apache), openSUSE (chromium and rabbitmq-server), Oracle (kernel), Red Hat (firefox and httpd24-httpd), SUSE (rabbitmq-server), and Ubuntu (libntlm). --------------------------------------------- https://lwn.net/Articles/872547/ ∗∗∗ Security Advisory - Use-after-free Vulnerability in Huawei Products ∗∗∗ --------------------------------------------- https://www.huawei.com/en/psirt/security-advisories/2021/huawei-sa-20211008… ∗∗∗ Security Advisory - Path Traversal Vulnerability in Huawei PC Product ∗∗∗ --------------------------------------------- https://www.huawei.com/en/psirt/security-advisories/2021/huawei-sa-20211008… ∗∗∗ Security Bulletin: IBM App Connect Enterprise Certified Container Designers may be vulnerable to arbitrary code execution via CVE-2021-3757 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-app-connect-enterpris… ∗∗∗ Security Bulletin: IBM Cloud Pak for Integration is vulnerable to Go vulnerability CVE-2021-31525 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cloud-pak-for-integra… ∗∗∗ Security Bulletin: A vulnerability in Spring Framework affects IBM Watson Machine Learning Accelerator ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-spring… ∗∗∗ Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU – Jul 2021 – Includes Oracle Jul 2021 CPU ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sdk-java-technology-e… ∗∗∗ MediaWiki Extensions und Skins: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K21-1050 ∗∗∗ Apache OpenOffice und LibreOffice: Mehrere Schwachstellen ermöglichen Manipulation von Dateien ∗∗∗ --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K21-1051 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 08.10.2021
by Daily end-of-shift report 08 Oct '21

08 Oct '21

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 07-10-2021 18:00 − Freitag 08-10-2021 18:00 Handler: Dimitri Robl Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ Rapid RYUK Ransomware Attack Group Christened as FIN12 ∗∗∗ --------------------------------------------- Prolific ransomware cybercrime groups approach underscores a complicated, layered model of cybercrime. --------------------------------------------- https://www.darkreading.com/attacks-breaches/rapid-ryuk-ransomware-attack-g… ∗∗∗ Sorting Things Out - Sorting Data by IP Address, (Fri, Oct 8th) ∗∗∗ --------------------------------------------- One thing that is huge in making sense of large volumes of data is sorting. Which makes having good sorting tools and methods a big deal when you are working through findings in a security assessment of pentest. --------------------------------------------- https://isc.sans.edu/diary/rss/27916 ∗∗∗ Free BrewDog beer, with a side order of shareholder PII? ∗∗∗ --------------------------------------------- BrewDog exposed the details of over 200,000 ‘Equity for Punks’ shareholders for over 18 months plus many more customers. --------------------------------------------- https://www.pentestpartners.com/security-blog/free-brewdog-beer-with-a-side… ∗∗∗ FontOnLake: Previously unknown malware family targeting Linux ∗∗∗ --------------------------------------------- ESET researchers discover a malware family with tools that show signs they’re used in targeted attacks. --------------------------------------------- https://www.welivesecurity.com/2021/10/07/fontonlake-previously-unknown-mal… ∗∗∗ NSA Releases Guidance on Avoiding the Dangers of Wildcard TLS Certificates and ALPACA Techniques ∗∗∗ --------------------------------------------- The National Security Agency (NSA) has released a Cybersecurity Information (CSI) sheet with guidance to help secure the Department of Defense, National Security Systems, and Defense Industrial Base organizations from poorly implemented wildcard Transport Layer Security (TLS) certificates and the exploitation of Application Layer Protocols Allowing Cross-Protocol Attacks (ALPACA). --------------------------------------------- https://us-cert.cisa.gov/ncas/current-activity/2021/10/08/nsa-releases-guid… ∗∗∗ Microsoft to disable Excel 4.0 macros, one of the most abused Office features ∗∗∗ --------------------------------------------- Microsoft plans to disable a legacy feature known as Excel 4.0 macros, also XLM macros, for all Microsoft 365 users by the end of the year [...] --------------------------------------------- https://therecord.media/microsoft-to-disable-excel-4-0-macros-one-of-the-mo… ∗∗∗ Malicious PowerPoint Files Constantly Being Distributed ∗∗∗ --------------------------------------------- On April 2021, the ASEC analysis team introduced the malware delivered via PowerPoint files attached to email in the ASEC blog. The team has found continuous malicious activities that use PPAM files in the form of PowerPoint and thus is sharing them. --------------------------------------------- https://asec.ahnlab.com/en/26597/ ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Fedora (libssh), Mageia (firefox), Slackware (httpd), SUSE (xen), and Ubuntu (firefox and mysql-5.7). --------------------------------------------- https://lwn.net/Articles/872267/ ∗∗∗ Google Patches Four Severe Vulnerabilities in Chrome ∗∗∗ --------------------------------------------- Google this week announced the release of an updated Chrome version for Windows, Mac and Linux, to address a total of four high-severity vulnerabilities in the browser. --------------------------------------------- https://www.securityweek.com/google-patches-four-severe-vulnerabilities-chr… ∗∗∗ Apache Releases HTTP Server version 2.4.51 to Address Vulnerabilities Under Exploitation ∗∗∗ --------------------------------------------- On October 7, 2021, the Apache Software Foundation released Apache HTTP Server version 2.4.51 to address Path Traversal and Remote Code Execution vulnerabilities (CVE-2021-41773, CVE-2021-42013) in Apache HTTP Server 2.4.49 and 2.4.50. These vulnerabilities have been exploited in the wild. --------------------------------------------- https://us-cert.cisa.gov/ncas/current-activity/2021/10/07/apache-releases-h… ∗∗∗ Security Bulletin: IBM App Connect Enterprise Certified Container Designers may be vulnerable to arbitrary code execution via CVE-2021-23436 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-app-connect-enterpris… ∗∗∗ Security Bulletin: IBM App Connect Enterprise Certified Container could disclose sensitive information to a local user when it is configured to use an IBM Cloud API key to connect to cloud-based connectors (CVE-2021-29906) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-app-connect-enterpris… ∗∗∗ Security Bulletin: IBM App Connect Enterprise Certified Container Integration Servers may be vulnerable to a symlink attack due to CVE-2021-39135 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-app-connect-enterpris… ∗∗∗ Security Bulletin: Access Control Vulnerability Affects the User Interface of IBM Sterling File Gateway (CVE-2020-4654) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-access-control-vulnerabil… ∗∗∗ Security Bulletin: Node.js as used by IBM Security QRadar Packet Capture contains multiple vulnerabilities (CVE-2020-8201, CVE-2020-8252, CVE-2020-8251, CVE-2020-8277) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-node-js-as-used-by-ibm-se… ∗∗∗ Security Bulletin: IBM App Connect Enterprise Certified Container Integration Servers may be vulnerable to a symlink attack due to CVE-2021-39134 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-app-connect-enterpris… ∗∗∗ Security Bulletin: Multiple Apache PDFBox security vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-apache-pdfbox-se… ∗∗∗ Security Bulletin: IBM App Connect Enterprise Certified Container images may be vulnerable to Denial of Service attacks due to CVE-2021-23362 and CVE-2021-27290 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-app-connect-enterpris… ∗∗∗ Security Bulletin: IBM MQ Appliance is affected by a sensitive information disclosure vulnerability (CVE-2020-5008) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-appliance-is-affec… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM HTTP Server affect IBM Netezza Performance Portal ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Kyocera Drucker: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K21-1049 ∗∗∗ Johnson Controls exacqVision Server Bundle ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-280-01 ∗∗∗ Mobile Industrial Robots Vehicles and MiR Fleet Software ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-280-02 ∗∗∗ Johnson Controls exacqVision ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-280-03 ∗∗∗ Mitsubishi Electric MELSEC iQ-R Series C Controller Module ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-280-04 ∗∗∗ InHand Networks IR615 Router ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-280-05 ∗∗∗ FATEK Automation WinProladder ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-280-06 ∗∗∗ FATEK Automation Communication Server ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-280-07 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 07.10.2021
by Daily end-of-shift report 07 Oct '21

07 Oct '21

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 06-10-2021 18:00 − Donnerstag 07-10-2021 18:00 Handler: Dimitri Robl Co-Handler: Wolfgang Menezes ===================== = News = ===================== ∗∗∗ Air-Gap-Hack: LAN-Kabel als Antenne nutzen, um Daten auszuleiten ∗∗∗ --------------------------------------------- Auch wenn ein Netzwerk nicht mit dem Internet verbunden ist, lassen sich Daten ausleiten. Dazu hat ein Forscher ein LAN-Kabel zur Antenne umfunktioniert. --------------------------------------------- https://www.golem.de/news/air-gap-hack-lan-kabel-als-antenne-nutzen-um-date… ∗∗∗ Cisco schließt Root-Lücke in Intersight Virtual Appliance ∗∗∗ --------------------------------------------- Der Netzwerkausrüster Cisco hat für verschiedene Software wichtige Sicherheitsupdates veröffentlicht. --------------------------------------------- https://heise.de/-6211537 ∗∗∗ Neue Malware-Familie für Linux entdeckt ∗∗∗ --------------------------------------------- Die von ihren Entdeckern FontOnLake getaufte Malware-Familie aus trojanisierten Programmen, Backdoors und einem Rootkit eignet sich für gezielte Angriffe. --------------------------------------------- https://heise.de/-6211764 ∗∗∗ Tor Browser und Tails: Anonymisierender Browser & OS in abgesicherten Versionen ∗∗∗ --------------------------------------------- Etwas später als geplant ist eine neue Version der Linux-Distribution Tails erschienen. An Bord hat sie den ebenfalls taufrischen Tor Browser 10.5.8. --------------------------------------------- https://heise.de/-6211744 ∗∗∗ Hackers use stealthy ShellClient malware on aerospace, telco firms ∗∗∗ --------------------------------------------- Threat researchers investigating malware used to target companies in the aerospace and telecommunications sectors discovered a new threat actor that has been running cyber espionage campaigns since at least 2018. --------------------------------------------- https://www.bleepingcomputer.com/news/security/hackers-use-stealthy-shellcl… ∗∗∗ Unpatched Dahua cams vulnerable to unauthenticated remote access ∗∗∗ --------------------------------------------- Unpatched Dahua cameras are prone to two authentication bypass vulnerabilities, and a proof of concept exploit that came out today makes the case of upgrading pressing. --------------------------------------------- https://www.bleepingcomputer.com/news/security/unpatched-dahua-cams-vulnera… ∗∗∗ MacOS Security: What Security Teams Should Know ∗∗∗ --------------------------------------------- As more macOS patches emerge and cybercriminals and nation-states take aim at the platform, experts discuss how macOS security has evolved and how businesses can protect employees. --------------------------------------------- https://www.darkreading.com/edge-articles/mac-attacks-how-secure-are-the-ma… ∗∗∗ Ransomware in the CIS ∗∗∗ --------------------------------------------- Statistics on ransomware attacks in the CIS and technical descriptions of Trojans, including BigBobRoss/TheDMR, Crysis/Dharma, Phobos/Eking, Cryakl/CryLock, CryptConsole, Fonix/XINOF, Limbozar/VoidCrypt, Thanos/Hakbit and XMRLocker. --------------------------------------------- https://securelist.com/cis-ransomware/104452/ ∗∗∗ Apache HTTP Server CVE-2021-41773 Exploited in the Wild ∗∗∗ --------------------------------------------- On Monday, October 4, 2021, Apache published an advisory on CVE-2021-41773, an unauthenticated remote file disclosure vulnerability in HTTP Server version 2.4.49 (and only in 2.4.49). The vulnerability arises from the mishandling of URL-encoded path traversal characters in the HTTP GET request. Public proof-of-concept exploit code is widely available, and Apache and others have noted that this vulnerability is being exploited in the wild. While the original advisory indicated that CVE-2021-41773 was merely an information disclosure bug, both Rapid7 and community researchers have verified that the vulnerability can be used for remote code execution when mod_cgi is enabled. --------------------------------------------- https://www.rapid7.com/blog/post/2021/10/06/apache-http-server-cve-2021-417… ∗∗∗ Medtronics Insulin Pump Controllers Are Vulnerable to Hackers ∗∗∗ --------------------------------------------- The company just expanded its recall of insulin pump remote controllers that can be hijacked to alter insulin amounts. Medical device maker Medtronic has expanded its recall of remote controllers for its MiniMed 508 and MiniMed Paradigm insulin pumps. The reason? The devices are a potential cybersecurity risk. According to the Food and Drug Administration, unauthorized people could hijack the devices to alter how much insulin is delivered to a patient. --------------------------------------------- https://gizmodo.com/medtronics-insulin-pump-controllers-are-vulnerable-to-h… ∗∗∗ Life is Pane: Persistence via Preview Handlers ∗∗∗ --------------------------------------------- [...] The preview pane allows users to have a quick peek at the content of a selected file without actually having to open it. This feature is disabled on default Windows 10 builds, but can be enabled in the Explorer menu under View→Preview pane. While this seems relatively simple at face value, it is anything but under the hood. For example, how does Windows know how to display the contents of certain filetypes but not others? Are the previews controlled by Explorer or is it done in another process? Are these handlers abusable? We spent a few days exploring preview handlers to gain a deeper understanding of how they work and answer these questions. --------------------------------------------- https://posts.specterops.io/life-is-pane-persistence-via-preview-handlers-3… ∗∗∗ CVE-2021-26420: Remote Code Execution in SharePoint via Workflow Compilation ∗∗∗ --------------------------------------------- In June of 2021, Microsoft released a patch to correct CVE-2021-26420 - a remote code execution bug in the supported versions of Microsoft SharePoint Server. This bug was reported to the ZDI program by an anonymous researcher and is also known as ZDI-21-755. This blog takes a deeper look at the root cause of this vulnerability. --------------------------------------------- https://www.thezdi.com/blog/2021/10/5/cve-2021-26420-remote-code-execution-… ===================== = Vulnerabilities = ===================== ∗∗∗ Cisco Security Advisories ∗∗∗ --------------------------------------------- Cisco hat Security Advisories zu 16 Schwachstellen veröffentlicht. Keine davon wird als "Critical" eingestuft, sechs als "High". --------------------------------------------- https://tools.cisco.com/security/center/Search.x?publicationTypeIDs=1&first… ∗∗∗ IBM Security Bulletins 2021-10-07 ∗∗∗ --------------------------------------------- IBM hat 21 Security Bulletins veröffentlicht. --------------------------------------------- https://www.ibm.com/blogs/psirt/ ∗∗∗ Advisory: Cisco ATA19X Privilege Escalation and RCE ∗∗∗ --------------------------------------------- 1. Lack of User Privilege Separation Enforcement in Web Management Interface: The web management interface on the ATA191 does not necessarily prevent the “user” account from performing “admin”-privileged actions. As such, a user who logs in with “user” privileges is able to perform actions that should only be performed by an “admin” user. 2. Post-Authentication Command Injection Remote Code Execution (CVE-2021-34710): The web management interface suffers [...] --------------------------------------------- https://www.iot-inspector.com/blog/advisory-cisco-ata19x-privilege-escalati… ∗∗∗ CVE-2021-33602: Denial-of-Service (DoS) Vulnerabilty ∗∗∗ --------------------------------------------- A vulnerability affecting the F-Secure antivirus engine was discovered when the engine tries to unpack a zip archive (LZW decompression method), and this can crash the scanning engine. The vulnerability can be exploited remotely by an attacker. A successful attack will result in denial-of-service of the antivirus engine. --------------------------------------------- https://www.f-secure.com/en/business/support-and-downloads/security-advisor… ∗∗∗ Typo3: Neue Version schließt zwei Sicherheitslücken im CMS ∗∗∗ --------------------------------------------- Lücken im Content-Management-System hätten Angreifern schlimmstenfalls Admin-Rechte gewähren können. Die neue Typo3-Version 11.5 bannt die Gefahr. --------------------------------------------- https://heise.de/-6211486 ∗∗∗ High Severity Vulnerability Patched in Access Demo Importer Plugin ∗∗∗ --------------------------------------------- On August 9, 2021, the Wordfence Threat Intelligence team attempted to initiate the responsible disclosure process for a vulnerability that we discovered in Access Demo Importer, a WordPress plugin installed on over 20,000 [...] --------------------------------------------- https://www.wordfence.com/blog/2021/10/high-severity-vulnerability-patched-… ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (firefox-esr), Mageia (cockpit, fail2ban, libcryptopp, libss7, nodejs, opendmarc, and weechat), openSUSE (curl, ffmpeg, git, glibc, go1.16, libcryptopp, and nodejs8), SUSE (apache2, curl, ffmpeg, git, glibc, go1.16, grilo, libcryptopp, nodejs8, transfig, and webkit2gtk3), and Ubuntu (linux-oem-5.10 and python-bottle). --------------------------------------------- https://lwn.net/Articles/872154/ ∗∗∗ Apache OpenOffice: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K21-1041 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 06.10.2021
by Daily end-of-shift report 06 Oct '21

06 Oct '21

===================== = End-of-Day report = ===================== Timeframe: Dienstag 05-10-2021 18:00 − Mittwoch 06-10-2021 18:00 Handler: Dimitri Robl Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ Collaborative Research on the CONTI Ransomware Group ∗∗∗ --------------------------------------------- Ransomware remains one of the pre-eminent cyber threats, with the evolution in tactics, techniques and procedures (TTPs) amongst threat actor groups over recent years upping the stakes for both victims and defenders. --------------------------------------------- https://team-cymru.com/blog/2021/10/05/collaborative-research-on-the-conti-… ∗∗∗ Syniverse: Möglicherweise SMS von Milliarden Menschen gehackt ∗∗∗ --------------------------------------------- Hacker sind über Jahre in ein Unternehmen eingedrungen, das Anrufe und SMS zwischen Mobilfunkunternehmen austauscht. --------------------------------------------- https://www.golem.de/news/syniverse-moeglicherweise-sms-von-milliarden-mens… ∗∗∗ Threat hunting in large datasets by clustering security events ∗∗∗ --------------------------------------------- Security tools can produce very large amounts of data that even the most sophisticated organizations may struggle to manage. Big data processing tools, such as spark, can be a powerful tool in the arsenal of security teams. --------------------------------------------- https://blog.talosintelligence.com/2021/10/threat-hunting-in-large-datasets… ∗∗∗ Landespolizeidirektion Steiermark: Warnung vor Betrugsversuchen mittels LPD-SMS ∗∗∗ --------------------------------------------- Am Montag, 4. Oktober 2021, versendeten unbekannte Täter in betrügerischer Absicht SMS Nachrichten. Als Absender scheint "Landespolizeidirektion (LPD) auf". Die Polizei warnt eindringlich vor diesen Betrugsversuchen. --------------------------------------------- https://www.watchlist-internet.at/news/landespolizeidirektion-steiermark-wa… ∗∗∗ Unsere Tipps, um unseriöse Notfalldienste zu entlarven! ∗∗∗ --------------------------------------------- Bei Notfällen wie einem Rohrbruch, Stromausfall oder einem Gasgebrechen ist schnelle Hilfe notwendig. Häufig bleibt da für eine genaue Überprüfung der Handwerksdienste keine Zeit. --------------------------------------------- https://www.watchlist-internet.at/news/unsere-tipps-um-unserioese-notfalldi… ∗∗∗ Cybersecurity in Power Grids: Challenges and Opportunities. (arXiv:2105.00013v2 [cs.CR] UPDATED) ∗∗∗ --------------------------------------------- Increasing volatilities within power transmission and distribution forcepower grid operators to amplify their use of communication infrastructure tomonitor and control their grid. The resulting increase in communication creates a larger attack surface for malicious actors. --------------------------------------------- http://arxiv.org/abs/2105.00013 ===================== = Vulnerabilities = ===================== ∗∗∗ Actively exploited Apache 0-day also allows remote code execution ∗∗∗ --------------------------------------------- Proof-of-Concept (PoC) exploits for the Apache web server zero-day surfaced on the internet revealing that the vulnerability is far more critical than originally disclosed. These exploits show that the scope of the vulnerability transcends path traversal, allowing attackers remote code execution (RCE) abilities. --------------------------------------------- https://www.bleepingcomputer.com/news/security/actively-exploited-apache-0-… ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- IBM veröffentlicht 31 Security Bulletins. --------------------------------------------- https://www.ibm.com/blogs/psirt/ ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Fedora (cryptopp), Mageia (apache), Slackware (httpd), and Ubuntu (squid, squid3). --------------------------------------------- https://lwn.net/Articles/872029/ ∗∗∗ FortiWebManager - Injection vulnerabilities ∗∗∗ --------------------------------------------- https://www.fortiguard.com/psirt/FG-IR-20-027 ∗∗∗ FortiAnalyzer & FortiManager - Forticloud credentials observed in cleartext in the logfile ∗∗∗ --------------------------------------------- https://www.fortiguard.com/psirt/FG-IR-21-112 ∗∗∗ FortiSDNConnector - Credential leak ∗∗∗ --------------------------------------------- https://www.fortiguard.com/psirt/FG-IR-20-183 ∗∗∗ FortiClientEMS - Session cookie does not expire after logout ∗∗∗ --------------------------------------------- https://www.fortiguard.com/psirt/FG-IR-20-072 ∗∗∗ XSA-386 ∗∗∗ --------------------------------------------- https://xenbits.xen.org/xsa/advisory-386.html ∗∗∗ Samba: Mehrere Schwachstellen ermöglichen Denial of Service ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K21-1034 ∗∗∗ Mitsubishi Electric GOT and Tension Controller ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-278-01 ∗∗∗ Emerson WirelessHART Gateway ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-278-02 ∗∗∗ Moxa MXview Network Management Software ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-278-03 ∗∗∗ Medtronic MiniMed MMT-500/MMT-503 Remote Controllers (Update A) ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/ICSMA-18-219-02 ∗∗∗ CISA Releases Security Advisory for Honeywell Experion and ACE Controllers ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ncas/current-activity/2021/10/05/cisa-releases-sec… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 05.10.2021
by Daily end-of-shift report 05 Oct '21

05 Oct '21

===================== = End-of-Day report = ===================== Timeframe: Montag 04-10-2021 18:00 − Dienstag 05-10-2021 18:00 Handler: Wolfgang Menezes Co-Handler: Robert Waldner ===================== = News = ===================== ∗∗∗ New UEFI bootkit used to backdoor Windows devices since 2012 ∗∗∗ --------------------------------------------- A newly discovered and previously undocumented UEFI (Unified Extensible Firmware Interface) bootkit has been used by attackers to backdoor Windows systems by hijacking the Windows Boot Manager since at least 2012. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-uefi-bootkit-used-to-bac… ∗∗∗ HiKam - "Hi – Ich bin (nicht) deine Kamera" ∗∗∗ --------------------------------------------- Die Sicherheit von IoT-Geräten, wie z.B. Überwachungskameras, sollte viel mehr im Fokus von Herstellern und Nutzern liegen. In der Realität ist dies leider nicht der Fall. Jahr für Jahr werden mehr IoT-Geräte entdeckt, die eine P2P-Cloud-Verbindung nutzen. Der Defcon-Talk von Paul Marrapese letztes Jahr und die letzte Entdeckung von Mandiant beschreiben nur einen Auszug dessen, was sich in diesem Bereich der IT-Security abgespielt hat. Im Rahmen dieses Blogposts möchten wir Ihnen aktuelle Informationen zur zugrundeliegenden IoT-Sicherheitsproblematik anhand eines konkreten Gerätes vorstellen: die HiKam S6. --------------------------------------------- https://sec-consult.com/de/blog/detail/hikam-hi-ich-bin-nicht-deine-kamera/ ∗∗∗ Kleinanzeigenbetrug mit gefälschter Post-Website ∗∗∗ --------------------------------------------- Kriminelle verwenden eine gefälschte Post-Website www.post-service.online für Kleinanzeigenbetrug. Sie suchen nach hochpreisigen Angeboten und geben vor, den Kauf über einen erfundenen Kurierservice der Post abwickeln zu wollen. Ziel ist es, den Opfern das Geld aus der Tasche zu ziehen, denn in weiterer Folge werden Kreditkartendaten abgefragt und die Freigabe einer Zahlung verlangt. --------------------------------------------- https://www.watchlist-internet.at/news/kleinanzeigenbetrug-mit-gefaelschter… ===================== = Vulnerabilities = ===================== ∗∗∗ Löchrige UPnP-Umsetzung in alten Broadcom-SDKs macht Router angreifbar ∗∗∗ --------------------------------------------- Einige Routermodelle mit EoL-Status etwa von Linksys & Cisco sind dank Lücken in alten Broadcom-SDK-Versionen via UPnP angreifbar. Updates gibt es nicht. --------------------------------------------- https://heise.de/-6209100 ∗∗∗ Sicherheitsupdate: Angreifer könnten auf Dateien von Apache-Webservern zugreifen ∗∗∗ --------------------------------------------- Angreifer haben es derzeit auf Apache-Webserver abgesehen. Davon ist aber nur eine bestimmte Version bedroht. Die Path-Traversal-Lücke (CVE-2021-41773) betrifft ausschließlich die Apache-HTTP-Server-Version 2.4.49. --------------------------------------------- https://heise.de/-6209130 ∗∗∗ TYPO3-CORE-SA-2021-015: HTTP Host Header Injection in Request Handling ∗∗∗ --------------------------------------------- It has been discovered that TYPO3 CMS is susceptible to host spoofing due to improper validation of the HTTP Host header. TYPO3 uses the HTTP Host header, for example, to generate absolute URLs during the frontend rendering process. Since the host header itself is provided by the client, it can be forged to any value, even in a name-based virtual hosts environment. CVE-ID: CVE-2021-41114 --------------------------------------------- https://typo3.org/security/advisory/typo3-core-sa-2021-015 ∗∗∗ TYPO3-CORE-SA-2021-014: Cross-Site-Request-Forgery in Backend URI Handling ∗∗∗ --------------------------------------------- It has been discovered that the new TYPO3 v11 feature that allows users to create and share deep links in the backend user interface is vulnerable to cross-site-request-forgery. [...] To successfully carry out an attack, an attacker must trick his victim to access a compromised system. The victim must have an active session in the TYPO3 backend at that time. --------------------------------------------- https://typo3.org/security/advisory/typo3-core-sa-2021-014 ∗∗∗ Android Security Bulletin—October 2021 ∗∗∗ --------------------------------------------- The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Security patch levels of 2021-10-05 or later address all of these issues. --------------------------------------------- https://source.android.com/security/bulletin/2021-10-01 ∗∗∗ docker: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- Ein lokaler Angreifer kann mehrere Schwachstellen in docker ausnutzen, um seine Privilegien zu erhöhen oder Informationen offenzulegen. --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K21-1033 ∗∗∗ SYSS-2021-047: Authentication Bypass in Omikron MultiCash ∗∗∗ --------------------------------------------- In der Desktopanwendung MultiCash 4 können mittels der Rechte- und Passwortüberprüfung administrative Rechte über die Anwendung erlang werden. --------------------------------------------- https://www.syss.de/pentest-blog/syss-2021-047-authentication-bypass-in-omi… ∗∗∗ Security Bulletin: IBM Event Streams is potentially affected by multiple node vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-event-streams-is-pote… ∗∗∗ Security Bulletin: IBM Event Streams is affected by potential data integrity issue (CVE-2020-25649) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-event-streams-is-affe… ∗∗∗ Security Bulletin: IBM Event Streams is affected by multiple vulnerabilities in the Java runtime ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-event-streams-is-affe… ∗∗∗ Security Bulletin: The Community Edition of IBM ILOG CPLEX Optimization Studio is affected by a vulnerability in libcurl (CVE-2021-22925) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-the-community-edition-of-… ∗∗∗ Security Bulletin: The Community Edition of IBM ILOG CPLEX Optimization Studio is affected by a vulnerability in libcurl (CVE-2021-22924) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-the-community-edition-of-… ∗∗∗ Security Bulletin: The Community Edition of IBM ILOG CPLEX Optimization Studio is affected by a vulnerability in libcurl (CVE-2021-22945) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-the-community-edition-of-… ∗∗∗ Security Bulletin: Publicly disclosed vulnerabilities from Kernel affect IBM Netezza Host Management ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-publicly-disclosed-vulner… ∗∗∗ Security Bulletin: Apache Solr, shipped with IBM Operations Analytics – Log Analysis, susceptible to multiple vulnerabilities in Apache Tika ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-apache-solr-shipped-with-… ∗∗∗ Security Bulletin: Vulnerability in MetadataExtractor used by Apache Solr affect IBM Operations Analytics – Log Analysis Analysis (CVE-2019-14262) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-metadata… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily