Daily

daily@lists.cert.at

1 participants
3085 discussions

Tageszusammenfassung - 12.07.2021
by Daily end-of-shift report 12 Jul '21

12 Jul '21

===================== = End-of-Day report = ===================== Timeframe: Freitag 09-07-2021 18:00 − Montag 12-07-2021 18:00 Handler: Stephan Richter Co-Handler: Robert Waldner ===================== = News = ===================== ∗∗∗ Conti Unpacked | Understanding Ransomware Development As a Response to Detection ∗∗∗ --------------------------------------------- Not yet two years old and already in its seventh iteration, Ransomware as a Service variant Conti has proven to be an agile and adept malware threat, capable of both autonomous and guided operation and with unparalleled encryption speed. [...] In this report, we describe in unprecedented detail the rapid evolution of this ransomware and how it has adapted quickly to defenders’ attempts to detect and analyze it. --------------------------------------------- https://labs.sentinelone.com/conti-unpacked-understanding-ransomware-develo… ∗∗∗ Ransomware tracker: the latest figures ∗∗∗ --------------------------------------------- Ransomware attacks have been dominating the headlines, thanks to high-profile incidents against organizations including Colonial Pipeline, JBS, and Kaseya. But an analysis of attacks against certain sectors shows that not all industries are impacted to the same degree... --------------------------------------------- https://therecord.media/ransomware-tracker-the-latest-figures/ ===================== = Vulnerabilities = ===================== ∗∗∗ Serv-U Remote Memory Escape Vulnerability CVE-2021-35211 ∗∗∗ --------------------------------------------- UPDATE July 10, 2021: NOTE: This security vulnerability only affects Serv-U Managed File Transfer and Serv-U Secure FTP and does not affect any other SolarWinds or N-able (formerly SolarWinds MSP) products. SolarWinds was recently notified by Microsoft of a security vulnerability related to Serv-U Managed File Transfer Server and Serv-U Secured FTP and have developed a hotfix to resolve this vulnerability. --------------------------------------------- https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35211 ∗∗∗ Jetzt patchen! Sicherheitspatch schließt REvil-Lücke in Kaseya VSA ∗∗∗ --------------------------------------------- Admins sollten die IT-Management-Software VSA von Kaseya zügig aktualisieren. Angreifer nutzen derzeit mehrere Sicherheitslücken aus. --------------------------------------------- https://heise.de/-6134473 ∗∗∗ SECURITY BULLETIN: Trend Micro Worry-Free Business Security Incorrect Permission Assignment Denial-of-Service Vulnerability ∗∗∗ --------------------------------------------- Trend Micro has released new patches for Trend Micro Worry-Free Business Security 10.0 SP1 and Worry-Free Business Security Services that resolve an incorrect permission assignment denial-of-service vulnerability. --------------------------------------------- https://success.trendmicro.com/solution/000286856 ∗∗∗ Security updates for Saturday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (gitlab, nodejs, openexr, php, php7, rabbitmq, ruby-addressable, and spice), Fedora (suricata), Gentoo (binutils, docker, runc, and tor), Mageia (avahi, botan2, connman, gstreamer1.0-plugins, htmldoc, jhead, libcroco, libebml, libosinfo, openexr, php, php-smarty, pjproject, and python), openSUSE (apache2, bind, bouncycastle, ceph, containerd, docker, runc, cryptctl, curl, dovecot23, firefox, graphviz, gstreamer-plugins-bad, java-1_8_0-openj9, java-1_8_0-openjdk, libass, libjpeg-turbo, libopenmpt, libqt5-qtwebengine, libu2f-host, libwebp, libX11, lua53, lz4, nginx, ovmf, postgresql10, postgresql12, python-urllib3, qemu, roundcubemail, solo, thunderbird, ucode-intel, wireshark, and xterm), and SUSE (permissions). --------------------------------------------- https://lwn.net/Articles/862487/ ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Fedora (djvulibre), Gentoo (connman, gnuchess, openexr, and xen), openSUSE (arpwatch, avahi, dbus-1, dhcp, djvulibre, freeradius-server, fribidi, gstreamer, gstreamer-plugins-bad, gstreamer-plugins-base, gstreamer-plugins-good, gstreamer-plugins-ugly, gupnp, hivex, icinga2, jdom2, jetty-minimal, kernel, kubevirt, libgcrypt, libnettle, libxml2, openexr, openscad, pam_radius, polkit, postgresql13, python-httplib2, python-py, python-rsa, qemu, redis, rubygem-actionpack-5_1, salt, snakeyaml, squid, tpm2.0-tools, and xstream), Red Hat (xstream), and SUSE (bluez, csync2, dbus-1, jdom2, postgresql13, redis, slurm_20_11, and xstream). --------------------------------------------- https://lwn.net/Articles/862673/ ∗∗∗ Security Bulletin: Vulnerability in IBM Guardium Data Encryption (GDE) (CVE-2021-20414) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-ibm-guar… ∗∗∗ Security Bulletin: IBM App Connect Enterprise v11 is affected by vulnerabilities in Node.js (CVE-2021-23358) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-app-connect-enterpris… ∗∗∗ Security Bulletin: IBM MQ Appliance affected by a cross-site request forgery vulnerability (CVE-2020-4938) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-appliance-affected… ∗∗∗ Security Bulletin: Apache CXF Vulnerability Affects IBM Global Mailbox (CVE-2021-22696) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-apache-cxf-vulnerability-… ∗∗∗ Security Bulletin: glibc vulnerability affects IBM Elastic Storage System (CVE-2020-27618) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-glibc-vulnerability-affec… ∗∗∗ Security Bulletin: Event Streams documentation for generating .p12 files incorrectly adds the CA key into the file (CVE-2021-29792) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-event-streams-documentati… ∗∗∗ Security Bulletin: Multiple vulnerabilities in Tivoli Netcool/OMNIbus WebGUI (CVE-2021-29803, CVE-2021-29804, CVE-2021-29805, CVE-2021-29822) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: IBM MQ Appliance is affected by Mozilla Network Security Services (NSS) vulnerability (CVE-2020-25648) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-appliance-is-affec… ∗∗∗ Security Bulletin: IBM MQ Appliance is affected by multiple AngularJS vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-appliance-is-affec… ∗∗∗ Security Bulletin: There are multiple vulnerabilities in the Linux Kernel used in IBM Elastic Storage System ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-there-are-multiple-vulner… ∗∗∗ Critical ForgeRock Access Management Vulnerability ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ncas/current-activity/2021/07/12/critical-forgeroc… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 09.07.2021
by Daily end-of-shift report 09 Jul '21

09 Jul '21

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 08-07-2021 18:00 − Freitag 09-07-2021 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Kaseya warns of phishing campaign pushing fake security updates ∗∗∗ --------------------------------------------- Kaseya has warned customers that an ongoing phishing campaign attempts to breach their networks by spamming emails bundling malicious attachments and embedded links posing as legitimate VSA security updates. --------------------------------------------- https://www.bleepingcomputer.com/news/security/kaseya-warns-of-phishing-cam… ∗∗∗ Clarified Guidance for CVE-2021-34527 Windows Print Spooler Vulnerability ∗∗∗ --------------------------------------------- On Tuesday July 6, 2021, Microsoft issued CVE-2021-34527 regarding a Windows Print Spooler vulnerability. Updates were released on July 6 and 7 which addressed the vulnerability for all supported Windows versions. We encourage customers to update as soon as possible. CVE-2021-34527 – Windows Print Spooler Remote Code Execution Vulnerability. Following the out of band release (OOB) we investigated claims regarding the effectiveness of the security update and questions around the suggested mitigations. --------------------------------------------- https://msrc-blog.microsoft.com:443/2021/07/08/clarified-guidance-for-cve-2… ∗∗∗ Hancitor tries XLL as initial malware file, (Fri, Jul 9th) ∗∗∗ --------------------------------------------- On Thursday 2021-07-08, for a short while when Hancitor was initially active, if any victims clicked on a malicious link from the malspam, they would receive a XLL file instead of a malicious Word doc. I tried one of the email links in my lab and received the malicious XLL file. After other researchers reported they were receiving Word documents, I tried a few hours later and received a Word document instead. --------------------------------------------- https://isc.sans.edu/diary/rss/27618 ∗∗∗ Sicherheitsupdates: Admin-Lücke bedroht Cisco Business Process Automation ∗∗∗ --------------------------------------------- Der Netzwerkausrüster Cisco hat für verschiedene Produkte Patches veröffentlicht, die mehrere Sicherheitslücken schließen. --------------------------------------------- https://heise.de/-6133522 ∗∗∗ ZLoader Adopts New Macro-Related Delivery Technique in Recent Attacks ∗∗∗ --------------------------------------------- The ZLoader malware family has switched to a new delivery mechanism in recent spam campaigns, fetching malicious code only after the initial attachment has been opened, McAfee reports. --------------------------------------------- https://www.securityweek.com/zloader-adopts-new-macro-related-delivery-tech… ∗∗∗ CVE-2021-28474: SharePoint Remote Code Execution via Server-Side Control Interpretation Conflict ∗∗∗ --------------------------------------------- In May of 2021, Microsoft released a patch to correct CVE-2021-28474, a remote code execution bug in supported versions of Microsoft SharePoint Server. This bug was reported to ZDI by an anonymous researcher and is also known as ZDI-21-574. This blog takes a deeper look at the root cause of this vulnerability. --------------------------------------------- https://www.thezdi.com/blog/2021/7/7/cve-2021-28474-sharepoint-remote-code-… ∗∗∗ Ransomwhere project wants to create a database of past ransomware payments ∗∗∗ --------------------------------------------- A new website launched this week wants to create a crowdfunded, free, and open database of past ransomware payments in the hopes of expanding visibility into the broader picture of the ransomware ecosystem. --------------------------------------------- https://therecord.media/ransomwhere-project-wants-to-create-a-database-of-p… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (apache2 and scilab), Fedora (chromium and perl-Mojolicious), Gentoo (inspircd, redis, and wireshark), and Mageia (fluidsynth, glib2.0, gnome-shell, grub2, gupnp, hivex, libupnp, redis, and zstd). --------------------------------------------- https://lwn.net/Articles/862299/ ∗∗∗ Rockwell Automation MicroLogix 1100 ∗∗∗ --------------------------------------------- This advisory contains mitigations for an Improper Input Validation vulnerability in Rockwell Automation MicroLogix 1100. --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-189-01 ∗∗∗ MDT AutoSave ∗∗∗ --------------------------------------------- This advisory contains mitigations for Inadequate Encryption Strength, SQL Injection, Relative Path Traversal, Command Injection, Uncontrolled Search Path Element, Generation of Error Message Containing Sensitive Information, and Unrestricted Upload of File with Dangerous Type in MDT Software in MDT Autosave Products. --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-189-02 ∗∗∗ Vulnerabilities in CODESYS V2 runtime systems ∗∗∗ --------------------------------------------- BOSCH-SA-475180: The control systems SYNAX, Visual Motion, IndraLogic, IndraMotion MTX, IndraMotion MLC and IndraMotion MLD contain PLC technology from CODESYS GmbH. The manufacturer CODESYS GmbH published a security bulletin (1) about a weakness in the protocol for the communication between the PLC runtime and clients. By exploiting the vulnerability, attackers can send crafted communication packets which may result in a denial of service condition or allow in worst case remote code execution. --------------------------------------------- https://psirt.bosch.com/security-advisories/bosch-sa-475180.html ∗∗∗ voidtools "Everything" vulnerable to HTTP header injection ∗∗∗ --------------------------------------------- https://jvn.jp/en/jp/JVN68971465/ ∗∗∗ Apache Pulsar vulnerability CVE-2021-22160 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K68146245 ∗∗∗ Apache vulnerability CVE-2021-30641 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K13815051 ∗∗∗ Advisory: Denial of service vulnerability on Automation Runtime webserver ∗∗∗ --------------------------------------------- https://www.br-automation.com/downloads_br_productcatalogue/assets/16254055… ∗∗∗ Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to a security vulnerability (CVE-2020-4590) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-has-announced-a-relea… ∗∗∗ Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to a security vulnerability (CVE-2019-17006, CVE-2019-17023, CVE-2020-12403) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-has-announced-a-relea… ∗∗∗ Security Bulletin: IBM InfoSphere Information Server is vulnerable to SQL injection ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-infosphere-informatio… ∗∗∗ Security Bulletin: IBM InfoSphere Information Server is vulnerable to a denial of service vulnerability in Angular.js ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-infosphere-informatio… ∗∗∗ Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to a security vulnerability (CVE-2020-11868, CVE-2020-13817) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-has-announced-a-relea… ∗∗∗ Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Apache Solr ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-infosphere-informatio… ∗∗∗ Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to a security vulnerability (CVE-2020-14579, CVE-2020-14578, CVE-2020-14577) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-has-announced-a-relea… ∗∗∗ Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to a security vulnerability (CVE-2020-14782) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-has-announced-a-relea… ∗∗∗ Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to a security vulnerability (CVE-2020-10531) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-has-announced-a-relea… ∗∗∗ Security Bulletin: IBM InfoSphere Information Analyzer is vulnerable to cross-site scripting. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-infosphere-informatio… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 08.07.2021
by Daily end-of-shift report 08 Jul '21

08 Jul '21

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 07-07-2021 18:00 − Donnerstag 08-07-2021 18:00 Handler: Thomas Pribitzer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ iCloud-Problem erlaubte Password-Brute-Force – Apple streitet mit Entdecker ∗∗∗ --------------------------------------------- Einem Sicherheitsexperten gelang es, über eine Race Condition und zahlreiche IPs bestimmte Apple-IDs zurückzusetzen. Angeblich waren auch iPhone-PINs bedroht. --------------------------------------------- https://heise.de/-6120219 ∗∗∗ Vorsicht vor betrügerischen und unseriösen Apps! ∗∗∗ --------------------------------------------- Für das Smartphone gibt es zahlreiche Apps, die den Alltag erleichtern. Es gibt aber auch Apps, die das Leben erschweren können: Unseriöse Anwendungen entpuppen sich oftmals als teure Abo-Fallen oder als Datenkraken. Auch Apps, die die Geräte der NutzerInnen mit Schadsoftware infizieren, sind eine beliebte Masche von Cyberkriminellen. Wir zeigen Ihnen, wie Sie sich davor schützen können. --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-vor-betruegerischen-und-uns… ∗∗∗ Kubernetes gefährdet ∗∗∗ --------------------------------------------- Kubernetes Container und Cluster werden immer beliebter, geraten dadurch aber auch ins Visier von Hackern. Palo Alto Networks und Red Hat erläutern das unterschätzte Sicherheitsrisiko und wie Kubernetes-Instanzen zu Gefahrenherden werden. --------------------------------------------- https://www.zdnet.de/88395662/kubernetes-gefaehrdet/ ∗∗∗ Using Sudo with Python For More Security Controls, (Thu, Jul 8th) ∗∗∗ --------------------------------------------- I'm a big fan of the Sudo[1] command. This tool, available on every UNIX flavor, allows system administrators to provide access to certain users/groups to certain commands as root or another user. This is performed with a lot of granularity in the access rights and logging/reporting features. I'm using it for many years and I'm still learning great stuff about it. Yesterday, at the Pass-The-Salt[2] conference, Peter Czanik presented a great feature of Sudo (available since version 1.9): the ability to extend features using Python modules! --------------------------------------------- https://isc.sans.edu/diary/rss/27614 ∗∗∗ Diving Deeper Into the Kaseya VSA Attack: REvil Returns and Other Hackers Are Riding Their Coattails ∗∗∗ --------------------------------------------- On, July 2nd, a massive ransomware attack was launched against roughly 50 managed services providers (MSPs) by criminals associated with the REvil ransomware-as-a-service (RaaS) group. The attack leveraged the on-premises servers deployed by IT Management Software vendor Kaseya. --------------------------------------------- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/diving-deep… ∗∗∗ Magecart Swiper Uses Unorthodox Concatenation ∗∗∗ --------------------------------------------- MageCart is the name given to the roughly one dozen groups of cyber criminals targeting e-commerce websites with the goal of stealing credit card numbers and selling them on the black market. They remain an ever-growing threat to website owners. We’ve said many times on this blog that the attackers are constantly using new techniques to evade detection. In this post I will go over a case involving one such MageCart group. --------------------------------------------- https://blog.sucuri.net/2021/07/magecart-swiper-uses-unorthodox-concatenati… ∗∗∗ Microsoft struggles to wake from PrintNightmare: Latest print spooler patch can be bypassed, researchers say ∗∗∗ --------------------------------------------- I pity the spool / Updated / Any celebrations that Microsofts out-of-band patch had put a stop PrintNightmare shenanigans may have been premature. --------------------------------------------- https://go.theregister.com/feed/www.theregister.com/2021/07/07/printnightma… ∗∗∗ Kaseya Left Customer Portal Vulnerable to 2015 Flaw in its Own Software ∗∗∗ --------------------------------------------- Last week cybercriminals deployed ransomware to 1,500 organizations that provide IT security and technical support to many other companies. The attackers exploited a vulnerability in software from Kaseya, a Miami-based company whose products help system administrators manage large networks remotely. Now it appears Kaseyas customer service portal was left vulnerable until last week to a data-leaking security flaw that was first identified in the same software six years ago. --------------------------------------------- https://krebsonsecurity.com/2021/07/kaseya-left-customer-portal-vulnerable-… ∗∗∗ 3 things the Kaseya attack can teach us about ransomware recovery ∗∗∗ --------------------------------------------- Some lessons on dealing with ransomware recovery, thanks to the admirable transparency of a Dutch MSP impacted by the REvil attack on Kaseya. --------------------------------------------- https://blog.malwarebytes.com/ransomware/2021/07/3-things-the-kaseya-attack… ∗∗∗ Non-Malicious Android Crypto Mining Apps Scam Users at Scale ∗∗∗ --------------------------------------------- With no bad behavior, the mobile apps are difficult to detect by automated security scans --------------------------------------------- https://www.securityweek.com/non-malicious-android-crypto-mining-apps-scam-… ∗∗∗ Ransomware as a service: Negotiators are now in high demand ∗∗∗ --------------------------------------------- RaaS groups are hiring negotiators whose primary role is to force victims to pay up. --------------------------------------------- https://www.zdnet.com/article/ransomware-as-a-service-negotiators-between-h… ∗∗∗ Global Phishing Campaign Targets Energy Sector and its Suppliers ∗∗∗ --------------------------------------------- Our research team has found a sophisticated campaign, active for at least one year, targeting large international companies in the energy, oil & gas, and electronics industries. The attack also targets oil & gas suppliers, possibly indicating that this is only the first stage in a wider campaign. --------------------------------------------- https://www.intezer.com/blog/research/global-phishing-campaign-targets-ener… ===================== = Vulnerabilities = ===================== ∗∗∗ Android Patchday Juli ∗∗∗ --------------------------------------------- Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Google Android ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen, seine Privilegien zu erhöhen oder Informationen offenzulegen. --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K21-0725 ∗∗∗ Angreifer können Sicherheitslücken in Ressourcenplanungstool Sage X3 kombinieren ∗∗∗ --------------------------------------------- Systeme mit Sage X3 sind unter anderem über eine kritische Schwachstelle mit Höchstwertung attackierbar. --------------------------------------------- https://heise.de/-6132418 ∗∗∗ Vulnerability Spotlight: Information disclosure, privilege escalation vulnerabilities in IOBit Advanced SystemCare Ultimate ∗∗∗ --------------------------------------------- Cisco Talos recently discovered multiple vulnerabilities in IOBit Advanced SystemCare Ultimate. IOBit Advanced SystemCare Ultimate is a system optimizer that promises to remove unwanted files and [...] --------------------------------------------- https://blog.talosintelligence.com/2021/07/vuln-spotlight-iobit0-.html ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by CentOS (linuxptp), Fedora (kernel and php), Gentoo (bladeenc, blktrace, jinja, mechanize, privoxy, and rclone), Oracle (linuxptp, ruby:2.6, and ruby:2.7), Red Hat (kernel and kpatch-patch), SUSE (kubevirt), and Ubuntu (avahi). --------------------------------------------- https://lwn.net/Articles/862163/ ∗∗∗ Cisco Releases Security Updates for Multiple Products ∗∗∗ --------------------------------------------- Cisco has released security updates to address vulnerabilities in multiple Cisco products. An attacker could exploit some of these vulnerabilities to take control of an affected system. For updates addressing lower severity vulnerabilities, see the Cisco Security Advisories page. CISA encourages users and administrators to review the following Cisco advisories and apply the necessary updates: [...] --------------------------------------------- https://us-cert.cisa.gov/ncas/current-activity/2021/07/08/cisco-releases-se… ∗∗∗ Kaseya VSA Limited Disclosure ∗∗∗ --------------------------------------------- Why we are only disclosing limited details on the Kaseya vulnerabilities / Last weekend we found ourselves in the middle of a storm. A storm created by the ransomware attacks executed via Kaseya VSA, using a vulnerability which we confidentially disclosed to Kaseya, together with six other vulnerabilities.Ever since we released the news that we indeed notified Kaseya of a vulnerability used in the ransomware attack, we have been getting requests to release details about these vulnerabilities and [...] --------------------------------------------- https://csirt.divd.nl/2021/07/07/Kaseya-Limited-Disclosure/ ∗∗∗ Security Bulletin: CVE-2021-28165 In Eclipse Jetty CPU usage can reach 100% upon receiving a large invalid TLS frame. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-cve-2021-28165-in-eclipse… ∗∗∗ Security Bulletin: CVE-2021-27568 An issue was discovered in netplex json-smart-v1, an exception is thrown from a function ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-cve-2021-27568-an-issue-w… ∗∗∗ Security Bulletin: CVE-2021-29711 Agent Upgrade through CLI requires inconsistent permission. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-cve-2021-29711-agent-upgr… ∗∗∗ Security Bulletin: A vulnerability in WebSphere Application Server Liberty affects IBM CICS TX on Cloud ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-websph… ∗∗∗ Security Bulletin: CVE-2020-27223 when Jetty handles a request containing multiple Accept headers the server may enter a denial of service (DoS) state ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-cve-2020-27223-when-jetty… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 07.07.2021
by Daily end-of-shift report 07 Jul '21

07 Jul '21

===================== = End-of-Day report = ===================== Timeframe: Dienstag 06-07-2021 18:00 − Mittwoch 07-07-2021 18:00 Handler: Stephan Richter Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ WildPressure targets the macOS platform ∗∗∗ --------------------------------------------- We found new malware samples used in WildPressure campaigns: newer version of the C++ Milum Trojan, a corresponding VBScript variant with the same version number, and a Python script working on both Windows and macOS. --------------------------------------------- https://securelist.com/wildpressure-targets-macos/103072/ ∗∗∗ Why I Love (Breaking Into) Your Security Appliances ∗∗∗ --------------------------------------------- David "moose" Wolpoff, CTO at Randori, discusses security appliances and VPNs and how attackers only have to "pick one lock" to invade an enterprise through them. --------------------------------------------- https://threatpost.com/breaking-into-security-appliances/167584/ ∗∗∗ Dozens of Vulnerable NuGet Packages Allow Attackers to Target .NET Platform ∗∗∗ --------------------------------------------- An analysis of off-the-shelf packages hosted on the NuGet repository has revealed 51 unique software components to be vulnerable to actively exploited, high-severity vulnerabilities, once again underscoring the threat posed by third-party dependencies to the software development process. --------------------------------------------- https://thehackernews.com/2021/07/dozens-of-vulnerable-nuget-packages.html ∗∗∗ Fake-Shops für Fahrräder und E-Bikes haben Saison! ∗∗∗ --------------------------------------------- Auf bike-heller.de und mister24bike.de wird ein riesiges Sortiment an Fahrrädern und E-Bikes lagernd und sofort lieferbar angeboten. Allein das sollte stutzig machen, da viele seriöse Händler mitten in der Saison schon ausverkauft sind. --------------------------------------------- https://www.watchlist-internet.at/news/fake-shops-fuer-fahrraeder-und-e-bik… ∗∗∗ Understanding REvil: The Ransomware Gang Behind the Kaseya Attack ∗∗∗ --------------------------------------------- Ransomware cases worked by Unit 42 consultants in the first six months of 2021 reveal insights into the preferred tactics of REvil threat actors. --------------------------------------------- https://unit42.paloaltonetworks.com/revil-threat-actors/ ∗∗∗ Update - Kaseya VSA Ransomwarevorfall: Sicht auf Österreich ∗∗∗ --------------------------------------------- In Folge dieses Vorfalls ist nun auch eine Spam-Kampagne, welche Schadsoftware (Cobalt Strike) im Anhang ausliefert und vorgibt, ein legitimes Update für Kaseya VSA zu sein, in Erscheinung getreten. --------------------------------------------- https://cert.at/de/aktuelles/2021/7/kaseya-vsa-ransomwarevorfall ∗∗∗ How to Tighten IoT Security for Healthcare Organization ∗∗∗ --------------------------------------------- This post will first explore some of the ways IoT is revolutionizing medical care, then identify some of the potential problems posed by connected devices in a medical setting. --------------------------------------------- https://blog.checkpoint.com/2021/06/21/how-to-tighten-iot-security-for-heal… ===================== = Vulnerabilities = ===================== ∗∗∗ Printnightmare: Erste Patches für Windows-Sicherheitslücke ∗∗∗ --------------------------------------------- Durch ein Problem mit dem Windows-Druck-Spooler können Angreifer Code aus der Ferne ausführen. Erste Patches stehen bereit, aber noch nicht für alles. (Windows, Drucker) --------------------------------------------- https://www.golem.de/news/printnightmare-erste-patches-fuer-windows-sicherh… ∗∗∗ Kasperskys Passwort-Manager gefährdete Benutzer mit ratbaren Passwörtern ∗∗∗ --------------------------------------------- Wegen einer gründlich verpatzten Umsetzung ließen sich die vom Kaspersky Passwort-Manager vorgeschlagenen, scheinbar zufälligen Passwörter einfach erraten. --------------------------------------------- https://heise.de/-6130796 ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Fedora (glibc), Gentoo (doas, firefox, glib, schismtracker, and tpm2-tss), Mageia (httpcomponents-client), openSUSE (virtualbox), Red Hat (linuxptp), Scientific Linux (linuxptp), and Ubuntu (libuv1 and php7.2, php7.4). --------------------------------------------- https://lwn.net/Articles/862044/ ∗∗∗ This serious Wi-Fi bug can break your iPhone, but heres how to protect yourself ∗∗∗ --------------------------------------------- Walking past a Wi-Fi hotspot with a specific name can cause big problems for your iPhone. And the scary thing is that its easy to do. --------------------------------------------- https://www.zdnet.com/article/serious-wi-fi-bug-can-break-your-iphone-but-h… ∗∗∗ Security Advisory - Bluetooth Function Denial of Service Vulnerability in Some Huawei Smartphone Products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2021/huawei-sa-20210707-… ∗∗∗ Security Bulletin: Netty Vulnerability Affects IBM Watson Machine Learning on CP4D (CVE-2021-21409) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-netty-vulnerability-affec… ∗∗∗ Security Bulletin: Multiple vulnerabilities in Apache JSON Small and Fast Parser (json-smart) and Underscore affect IBM Spectrum Symphony ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: IBM App Connect Enterprise Certified Container could allow a privileged user to obtain sensitive information from internal log files (CVE-2021-29759) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-app-connect-enterpris… ∗∗∗ Security Bulletin: IBM App Connect Enterprise Certified Container may be affected by a ReDoS flaw when processing URLs (CVE-2021-33502) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-app-connect-enterpris… ∗∗∗ Security Bulletin: Castor Vulnerability Affects IBM Control Center (CVE-2014-3004) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-castor-vulnerability-affe… ∗∗∗ Security Bulletin: Golang Go Vulnerability Affects IBM Watson Machine Learning on CP4D (CVE-2020-29652) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-golang-go-vulnerability-a… ∗∗∗ Security Bulletin: Vulnerabilities in the Python, Python cryptography , and Urllib3 affect IBM Spectrum Discover. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-the-py… ∗∗∗ Security Bulletin: IBM Cloud Pak for Integration is vulnerable to underscore vulnerability (CVE-2021-23358) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cloud-pak-for-integra… ∗∗∗ Security Bulletin: Apache Log4j Vulnerability Affects IBM Control Center (CVE-2020-9488) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-apache-log4j-vulnerabilit… ∗∗∗ Philips Vue PACS ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsma-21-187-01 ∗∗∗ Moxa NPort IAW5000A-I/O Series Serial Device Server ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-187-01 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 06.07.2021
by Daily end-of-shift report 06 Jul '21

06 Jul '21

===================== = End-of-Day report = ===================== Timeframe: Montag 05-07-2021 18:00 − Dienstag 06-07-2021 18:00 Handler: Stephan Richter Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ How to protect your site against lethal unauthorized code injections ∗∗∗ --------------------------------------------- Lethal unauthorized code injections like XXS (cross site scripting) attacks are some of the most dynamic cyber-attacks. They are often very difficult to detect and can result in credit card theft, fraud, and endpoint data breaches, having a huge impact on small to medium sized businesses. --------------------------------------------- https://cybersecurity.att.com/blogs/security-essentials/how-to-protect-your… ∗∗∗ Python DLL Injection Check, (Tue, Jul 6th) ∗∗∗ --------------------------------------------- They are many security tools that inject DLL into processes running on a Windows system. The classic examples are anti-virus products. --------------------------------------------- https://isc.sans.edu/diary/rss/27608 ∗∗∗ Kaseya VSA: Wie die Lieferketten-Angriffe abliefen und was sie für uns bedeuten ∗∗∗ --------------------------------------------- Auch wer nicht davon betroffen ist, sollte sich klarmachen, was da gerade geschieht. Denn Angriffe wie der aktuelle REvil-Coup werden die IT-Welt verändern. --------------------------------------------- https://heise.de/-6129656 ∗∗∗ Kaseya Case Update 3 ∗∗∗ --------------------------------------------- Since the first signs of an incident last Friday evening the DIVD has continued to monitor the internet for instances of Kaseya VSA that remained online. We are happy to report a steady decrease in the number of online servers. --------------------------------------------- https://csirt.divd.nl/2021/07/06/Kaseya-Case-Update-3/ ===================== = Vulnerabilities = ===================== ∗∗∗ Authentified RFI to RCE Nagios/NagiosXI exploitation ∗∗∗ --------------------------------------------- An authenticated attacker may remotely inject and execute arbitrary code in Nagios and Nagios XI products. --------------------------------------------- https://github.com/ArianeBlow/NagiosXI-EmersonFI ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (python-django), Debian (libuv1, libxstream-java, and php7.3), Fedora (rabbitmq-server), Gentoo (glibc, google-chrome, libxml2, and postsrsd), openSUSE (libqt5-qtwebengine and roundcubemail), SUSE (python-rsa), and Ubuntu (djvulibre). --------------------------------------------- https://lwn.net/Articles/861972/ ∗∗∗ [20210705] - Core - XSS in com_media imagelist ∗∗∗ --------------------------------------------- https://developer.joomla.org:443/security-centre/860-20210705-core-xss-in-c… ∗∗∗ [20210704] - Core - Privilege escalation through com_installer ∗∗∗ --------------------------------------------- https://developer.joomla.org:443/security-centre/859-20210704-core-privileg… ∗∗∗ [20210703] - Core - Lack of enforced session termination ∗∗∗ --------------------------------------------- https://developer.joomla.org:443/security-centre/858-20210703-core-lack-of-… ∗∗∗ [20210702] - Core - DoS through usergroup table manipulation ∗∗∗ --------------------------------------------- https://developer.joomla.org:443/security-centre/857-20210702-core-dos-thro… ∗∗∗ [20210701] - Core - XSS in JForm Rules field ∗∗∗ --------------------------------------------- https://developer.joomla.org:443/security-centre/856-20210701-core-xss-in-j… ∗∗∗ Paessler PRTG: Schwachstelle ermöglicht Cross-Site Scripting ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K21-0719 ∗∗∗ MediaWiki: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K21-0718 ∗∗∗ QNAP NAS HBS 3: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K21-0717 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 05.07.2021
by Daily end-of-shift report 05 Jul '21

05 Jul '21

===================== = End-of-Day report = ===================== Timeframe: Freitag 02-07-2021 18:00 − Montag 05-07-2021 18:00 Handler: Stephan Richter Co-Handler: Robert Waldner ===================== = News = ===================== ∗∗∗ Kaseya VSA Ransomwarevorfall: Sicht auf Österreich ∗∗∗ --------------------------------------------- In den Medien wird aktuell über einen Ransomwarevorfall, welcher eine große Anzahl an Firmen betrifft, berichtet 1 2. Folgend diesen Berichten gelang es der Ransomware-Gruppe "REvil" über das Einschleusen von Code in die Software-Lösung "Kaseya VSA", welche zum Remote-Monitoring und -Management für IT bei Managed Service Providern (MSP) eingesetzt wird, die Ransomware "Sodinokibi" automatisiert an die MSPs und somit auch an deren Kunden --------------------------------------------- https://cert.at/de/aktuelles/2021/7/kaseya-vsa-ransomwarevorfall ∗∗∗ Free Micropatches for PrintNightmare Vulnerability (CVE-2021-34527) ∗∗∗ --------------------------------------------- Update 7/5/2021: Security researcher cube0x0 discovered another attack vector for this vulnerability, which significantly expands the set of affected machines. While the original attack vector was Print System Remote Protocol [MS-RPRN], the same attack delivered via Print System Asynchronous Remote Protocol [MS-PAR] does not require Windows server to be a domain controller, or Windows 10 machine to have UAC User Account Control disabled or PointAndPrint NoWarningNoElevationOnInstall enabled. --------------------------------------------- https://blog.0patch.com/2021/07/free-micropatches-for-printnightmare.html ∗∗∗ Another 0-Day Looms for Many Western Digital Users ∗∗∗ --------------------------------------------- Countless Western Digital customers saw their MyBook Live network storage drives remotely wiped in the past month thanks to a bug in a product line the company stopped supporting in 2015, as well as a previously unknown zero-day flaw. But there is a similarly serious zero-day flaw present in a much broader range of newer Western Digital MyCloud network storage devices that will remain unfixed for many customers who cant or wont upgrade to the latest operating system. --------------------------------------------- https://krebsonsecurity.com/2021/07/another-0-day-looms-for-many-western-di… ∗∗∗ Spam per Termineinladung: So schützen Sie sich! ∗∗∗ --------------------------------------------- Sie haben plötzlich im Lotto gewonnen. Jemand will Ihnen aus reiner Nächstenliebe Geld spenden. Außerdem müssen Sie unbedingt auf dieser einen Trading-Plattform investieren. Gewinne garantiert! Viele von uns kennen solche Versprechungen wohl. Spam-Mails sind nichts Neues mehr. Daher überlegen sich Kriminelle immer wieder neue Möglichkeiten, um an das Geld ihrer Opfer zu kommen. Derzeit sehr beliebt: Kalender-Spam! --------------------------------------------- https://www.watchlist-internet.at/news/spam-per-termineinladung-so-schuetze… ∗∗∗ Telnet service left enabled and without a password on SIMATIC HMI Comfort Panels ∗∗∗ --------------------------------------------- Siemens SIMATIC HMI Comfort Panels, devices meant to provide visualization of data received from industrial equipment, are exposing their Telnet service without any form of authentication, security researchers have discovered. Tracked as CVE-2021-31337, the vulnerability was revealed earlier this week. All SIMATIC HMI Comfort Panels models are believed to be impacted, except panels for SINAMICS Medium Voltage Products (SL150, SM150, and SM150i), where the Telnet service is disabled by default. --------------------------------------------- https://therecord.media/telnet-service-left-enabled-and-without-a-password-… ∗∗∗ MISP 2.4.145 and 2.4.146 released (Improved warning-lists) ∗∗∗ --------------------------------------------- MISP 2.4.145 and 2.4.146 released including a massive update to the MISP warning-lists, various improvements and security fixes. --------------------------------------------- https://github.com/MISP/MISP/releases/tag/v2.4.145 ===================== = Vulnerabilities = ===================== ∗∗∗ ZDI-21-779: Advantech WebAccess Node BwFreRPT Stack-based Buffer Overflow Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on affected installations of Advantech WebAccess Node. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-21-779/ ∗∗∗ ZDI-21-778: Advantech WebAccess Node BwImgExe Stack-based Buffer Overflow Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on affected installations of Advantech WebAccess Node. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-21-778/ ∗∗∗ ZDI-21-777: Autodesk Design Review PDF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on affected installations of Autodesk Design Review. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-21-777/ ∗∗∗ ZDI-21-776: Autodesk Design Review DWF File Parsing Memory Corruption Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on affected installations of Autodesk Design Review. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-21-776/ ∗∗∗ ZDI-21-775: Autodesk Design Review DWFX File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability ∗∗∗ --------------------------------------------- This vulnerability allows remote attackers to disclose sensitive information on affected installations of Autodesk Design Review. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-21-775/ ∗∗∗ ControlTouch serial number can be misused to access customer configuration ∗∗∗ --------------------------------------------- ABB is aware of a privately reported vulnerability in the ControlTouch cloud subsystem. The cloud sub-system is updated to remove the vulnerability. An attacker who successfully exploited this vulnerability could modify the configuration of the ControlTouch of an authorized user. --------------------------------------------- https://search.abb.com/library/Download.aspx?DocumentID=9AKK107992A3688&Lan… ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (electron11, electron12, istio, jenkins, libtpms, mediawiki, mruby, opera, puppet, and python-fastapi), Debian (djvulibre and openexr), Fedora (dovecot, libtpms, nginx, and php-league-flysystem), Gentoo (corosync, freeimage, graphviz, and libqb), Mageia (busybox, file-roller, live, networkmanager, and php), openSUSE (clamav-database, lua53, and roundcubemail), Oracle (389-ds:1.4, kernel, libxml2, python38:3.8 and python38-devel:3.8, and ruby:2.5), and SUSE (crmsh, djvulibre, python-py, and python-rsa). --------------------------------------------- https://lwn.net/Articles/861906/ ∗∗∗ Ricon Industrial Cellular Router S9922XL Remote Command Execution ∗∗∗ --------------------------------------------- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5653.php ∗∗∗ GNU C Library (glibc) vlunerability CVE-2016-10228 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K52494142?utm_source=f5support&utm_mediu… ∗∗∗ Advisory: Denial of Service vulnerability in B&R Industrial Automation PROFINET IO Device ∗∗∗ --------------------------------------------- https://www.br-automation.com/downloads_br_productcatalogue/assets/16229864… ∗∗∗ Advisory: Stack crash in B&R Industrial Automation X20 EthernetIP Adpater ∗∗∗ --------------------------------------------- https://www.br-automation.com/downloads_br_productcatalogue/assets/16229864… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 02.07.2021
by Daily end-of-shift report 02 Jul '21

02 Jul '21

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 01-07-2021 18:00 − Freitag 02-07-2021 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Gelöschte Netz-Festplatten: Western Digital plant Hilfe bei Wiederherstellung ∗∗∗ --------------------------------------------- Die Daten angegriffener HDDs der WD-Baureihe My Book Live sollen sich wiederherstellen lassen. Western Digital will künftig entsprechende Dienste anbieten. --------------------------------------------- https://heise.de/-6127479 ∗∗∗ Scorecards 2.0: Sicherheitsrisiken in Open-Source-Software aufdecken ∗∗∗ --------------------------------------------- Das automatisierte Security-Tool Scorecards legt die Karten auf den Tisch - wie sicher ist Open-Source-Software? --------------------------------------------- https://heise.de/-6127588 ∗∗∗ Free Micropatches for PrintNightmare Vulnerability (CVE-2021-34527) ∗∗∗ --------------------------------------------- [Note: This blog post is expected to be updated as new micropatches are issued and new information becomes available.] June 2021 Windows Updates brought a fix for a vulnerability CVE-2021-1675 originally titled "Windows Print Spooler Local Code Execution Vulnerability". As usual, Microsofts advisory provided very little information about the vulnerability, and very few probably noticed that about two weeks later, the advisory was updated to [...] --------------------------------------------- https://blog.0patch.com/2021/07/free-micropatches-for-printnightmare.html ∗∗∗ Babuk ransomware is back, uses new version on corporate networks ∗∗∗ --------------------------------------------- After announcing their exit from the ransomware business in favor of data theft extortion, the Babuk gang appears to have slipped back into their old habit of encrypting corporate networks. --------------------------------------------- https://www.bleepingcomputer.com/news/security/babuk-ransomware-is-back-use… ∗∗∗ Mongolian Certificate Authority Hacked to Distribute Backdoored CA Software ∗∗∗ --------------------------------------------- In yet another instance of software supply chain attack, unidentified hackers breached the website of MonPass, one of Mongolias major certificate authorities, to backdoor its installer software with Cobalt Strike binaries. The trojanized client was available for download between February 8, 2021, and March 3, 2021, said Czech cybersecurity software company Avast in a report published Thursday. --------------------------------------------- https://thehackernews.com/2021/07/mongolian-certificate-authority-hacked.ht… ∗∗∗ New Mirai-Inspired Botnet Could Be Using Your KGUARD DVRs in Cyber Attacks ∗∗∗ --------------------------------------------- Cybersecurity researchers on Thursday revealed details about a new Mirai-inspired botnet called "mirai_ptea" that leverages an undisclosed vulnerability in digital video recorders (DVR) provided by KGUARD to propagate and carry out distributed denial-of-service (DDoS) attacks. Chinese security firm Netlab 360 pinned the first probe against the flaw on March 23, 2021, before it detected active [...] --------------------------------------------- https://thehackernews.com/2021/07/new-mirai-inspired-botnet-could-be.html ∗∗∗ 2020 Report: ICS Endpoints as Starting Points for Threats ∗∗∗ --------------------------------------------- The use of Industrial Control Systems (ICS) makes operations more efficient for various industries. These systems are powered by the interconnection between IT (information technology) and OT (operational technology), which help boost efficiency and speed. Unfortunately, this very interconnection also inadvertently makes ICS susceptible to cyberthreats. Securing these systems is vital, and one of its components that must be protected from threats are endpoints. --------------------------------------------- https://www.trendmicro.com/vinfo/us/security/news/internet-of-things/2020-r… ∗∗∗ STIR/SHAKEN: Nordamerika signiert Rufnummern im Kampf gegen Spam ∗∗∗ --------------------------------------------- Nordamerikas Netzbetreiber signieren und verifizieren jetzt Telefonnummern nach dem STIR/SHAKEN-System. Das erschwert Anrufe mit gefälschten Anruferkennungen. --------------------------------------------- https://heise.de/-6127147 ∗∗∗ TrickBot and Zeus ∗∗∗ --------------------------------------------- TrickBot is an established and widespread multi-purpose trojan. Active since 2016 and modular in nature, it can accomplish a variety of goals ranging from credential theft to lateral movement. Many of the malware’s capabilities come as self-contained modules, which the malware is instructed to download from the C2. Initially, TrickBot’s main focus was bank fraud, but this later shifted toward corporate targetted ransomware attacks, eventually resulting in the [...] --------------------------------------------- https://www.kryptoslogic.com/blog/2021/07/trickbot-and-zeus/ ∗∗∗ Top 5 Scam Techniques: What You Need to Know ∗∗∗ --------------------------------------------- Scammers are increasingly resourceful when coming up with scam techniques. But they often rely on long-standing persuasion techniques for the scam to work. So, you may hear about a new scam that uses a novel narrative, but there is a good chance that the scam relies on proven scam techniques once the narrative is stripped [...] --------------------------------------------- https://www.tripwire.com/state-of-security/security-data-protection/top-sca… ∗∗∗ Ransomware. In the air? ∗∗∗ --------------------------------------------- Introduction As an exercise, we were asked to look at the potential vectors for ransomware to affect flight despatch and operations. In most cases, flight systems simply weren’t significantly exposed, [...] --------------------------------------------- https://www.pentestpartners.com/security-blog/ransomware-in-the-air/ ∗∗∗ Mysterious Node.js malware puzzles security researchers ∗∗∗ --------------------------------------------- Almost four months after it was first spotted in the wild, the infosec community is still scratching its head in regards to the purpose of a new malware strain named Lu0bot. --------------------------------------------- https://therecord.media/mysterious-node-js-malware-puzzles-security-researc… ∗∗∗ TrickBot: New attacks see the botnet deploy new banking module, new ransomware ∗∗∗ --------------------------------------------- Over the course of the past few weeks, new activity has been observed from TrickBot, one of todays largest malware botnets, with reports that its operators have helped create a new ransomware strain called Diavol and that the TrickBot gang is returning to its roots as a banking trojan with a new and updated banking module.The post TrickBot: New attacks see the botnet deploy new banking module, new ransomware appeared first on The Record by Recorded Future. --------------------------------------------- https://therecord.media/trickbot-new-attacks-see-the-botnet-deploy-new-bank… ∗∗∗ The Brothers Grim ∗∗∗ --------------------------------------------- The reversing tale of GrimAgent malware used by Ryuk --------------------------------------------- https://blog.group-ib.com/grimagent ===================== = Vulnerabilities = ===================== ∗∗∗ WAGO: Multiple Vulnerabilities in I/O-Check Service ∗∗∗ --------------------------------------------- Multiple vulnerabilities in the WAGO I/O-Check Service were reported. By exploiting the described vulnerabilities, the attacker potentially is able to manipulate or disrupt the device. --------------------------------------------- https://cert.vde.com/de-de/advisories/vde-2020-036 ∗∗∗ Update PowerShell versions 7.0 and 7.1 to protect against a vulnerability ∗∗∗ --------------------------------------------- If you manage yoiur Azure resources from PowerShell version 7.0 or 7.1, we’ve released new versions of PowerShell to address a .NET Core remote code execution vulnerability in versions 7.0 and 7.1. We recommend that you install the updated versions as soon as possible. Windows PowerShell 5.1 isn’t affected by this issue. --------------------------------------------- https://azure.microsoft.com/en-us/updates/update-powershell-versions-70-and… ∗∗∗ Jetzt handeln! Angreifer nutzen Drucker-Lücke PrintNightmare in Windows aus ∗∗∗ --------------------------------------------- Alle Windows-Systeme sind von der PrintNightmare-Schwachstelle bedroht. Derzeit finden Attacken statt. So geht der Workaround zur Absicherung. --------------------------------------------- https://heise.de/-6127265 ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Fedora (ansible and seamonkey), openSUSE (go1.15 and opera), Oracle (kernel and microcode_ctl), and Red Hat (go-toolset-1.15 and go-toolset-1.15-golang). --------------------------------------------- https://lwn.net/Articles/861679/ ∗∗∗ Johnson Controls Facility Explorer ∗∗∗ --------------------------------------------- This advisory contains mitigations for an Improper Privilege Management vulnerability in Johnson Controls Facility Explorer industrial Ethernet controllers. --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-182-01 ∗∗∗ Sensormatic Electronics C-CURE 9000 ∗∗∗ --------------------------------------------- This advisory contains mitigations for an Improper Input Validation vulnerability in Sensormatic Electronics C-CURE 9000 industrial software. --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-182-02 ∗∗∗ Delta Electronics DOPSoft ∗∗∗ --------------------------------------------- This advisory contains mitigations for Out-of-bounds Read vulnerabilities in Delta Electronics DOPSoft software. --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-182-03 ∗∗∗ Mitsubishi Electric Air Conditioning System ∗∗∗ --------------------------------------------- This advisory contains mitigations for an Incorrect Implementation of Authentication Algorithm vulnerability in Mitsubishi Electric air conditioning systems. --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-182-04 ∗∗∗ Mitsubishi Electric Air Conditioning Systems ∗∗∗ --------------------------------------------- This advisory contains mitigations for an Improper Restriction of XML External Entity Reference vulnerability in Mitsubishi Electric Air Conditioning Systems. --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-182-05 ∗∗∗ All Bachmann M1 System Processor Modules ∗∗∗ --------------------------------------------- This updated advisory is a follow-up to the advisory titled ICSA-21-026-01P All Bachmann M1 System Processor Modules, posted to the HSIN ICS library on January 26, 2021. This advisory is now being released to the ICS webpage on us-cert.cisa.gov. This advisory contains mitigations for a Use of Password Hash with Insufficient Computational Effort vulnerability in Bachmann M1 system processor modules. --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-026-01-0 ∗∗∗ Apigee Edge - Moderately critical - Access bypass - SA-CONTRIB-2021-020 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2021-020 ∗∗∗ WEIDMUELLER: Multiple vulnerabilities in Industrial WLAN devices (UPDATE A) ∗∗∗ --------------------------------------------- https://cert.vde.com/de-de/advisories/vde-2021-026 ∗∗∗ Node.js: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K21-0714 ∗∗∗ Red Hat Developer Tools: Schwachstelle ermöglicht Denial of Service ∗∗∗ --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K21-0715 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 01.07.2021
by Daily end-of-shift report 01 Jul '21

01 Jul '21

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 30-06-2021 18:00 − Donnerstag 01-07-2021 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ "Drucker-Albtraum": Offene Sicherheitslücke erlaubt die Übernahme gesamter Windows-Netzwerke ∗∗∗ --------------------------------------------- Sicherheitsforscher veröffentlichen versehentlich passenden Schadcode, nun herrscht akuter Handlungsbedarf für Windows-Administratoren --------------------------------------------- https://www.derstandard.at/story/2000127868579/drucker-albtraum-offene-sich… ∗∗∗ Vorschussbetrug mit Krediten auf befinax.com ∗∗∗ --------------------------------------------- Auf der Suche nach Krediten, Hypotheken oder Versicherungen stoßen Sie womöglich auf befinax.com. Die Seite ist schön aufgebaut, verspricht schnelle Kreditvergaben und wirbt mit den Logos und Namen großer und bekannter Banken. Doch Vorsicht: Hier werden Sie betrogen! Vorab zu bezahlende Gebühren landen direkt in den Händen Krimineller und Kredit gibt es keinen. --------------------------------------------- https://www.watchlist-internet.at/news/vorschussbetrug-mit-krediten-auf-bef… ∗∗∗ The Most Prolific Ransomware Families: A Defenders Guide ∗∗∗ --------------------------------------------- In this article, DomainTools researchers provide a look at the three most prolific ransomware families and their toolsets. --------------------------------------------- https://www.domaintools.com/resources/blog/the-most-prolific-ransomware-fam… ∗∗∗ Linux: RPM prüft Signaturen nicht richtig ∗∗∗ --------------------------------------------- Eigentlich werden RPM-Pakte unter Linux signiert. Viele wichtige Teile der Signaturprüfung sind bisher aber gar nicht implementiert. --------------------------------------------- https://www.golem.de/news/linux-rpm-prueft-signaturen-nicht-richtig-2107-15… ∗∗∗ Another Exploit Hits WD My Book Live Owners ∗∗∗ --------------------------------------------- While it will come as no comfort to those who had their Western Digital My Book Live NAS drives wiped last week, it seems they were attacked by a combination of two exploits, and possibly caught in the fallout of a rivalry between two different teams of hackers. Toms Hardware reports: Initially, after the news broke on Friday, it was thought a known exploit from 2018 was to blame, allowing attackers to gain root access to the devices. However, it now seems that a previously unknown exploit was [...] --------------------------------------------- https://hardware.slashdot.org/story/21/06/30/2319243/another-exploit-hits-w… ∗∗∗ We Infiltrated a Counterfeit Check Ring! Now What? ∗∗∗ --------------------------------------------- Imagine waking up each morning knowing the identities of thousands of people who are about to be mugged for thousands of dollars each. You know exactly when and where each of those muggings will take place, and youve shared this information in advance with the authorities each day for a year with no outward indication that they are doing anything about it. How frustrated would you be? Such is the curse of the fraud fighter known online by the handles “Brianna Ware” and [...] --------------------------------------------- https://krebsonsecurity.com/2021/06/we-infiltrated-a-counterfeit-check-ring… ∗∗∗ Becoming Elon Musk - the Danger of Artificial Intelligence ∗∗∗ --------------------------------------------- A Tel Aviv, Israel-based artificial intelligence (AI) firm, with a mission to build trust in AI and protect AI from cyber threats, privacy issues, and safety incidents, has developed the opposite: an attack against facial recognition systems that can fool the algorithm into misinterpreting the image. --------------------------------------------- https://www.securityweek.com/becoming-elon-musk-%E2%80%93-danger-artificial… ∗∗∗ CISA’s CSET Tool Sets Sights on Ransomware Threat ∗∗∗ --------------------------------------------- CISA has released a new module in its Cyber Security Evaluation Tool (CSET): the Ransomware Readiness Assessment (RRA). CSET is a desktop software tool that guides network defenders through a step-by-step process to evaluate their cybersecurity practices on their networks. CSET—applicable to both information technology (IT) and industrial control system (ICS) networks—enables users to perform a comprehensive evaluation of their cybersecurity [...] --------------------------------------------- https://us-cert.cisa.gov/ncas/current-activity/2021/06/30/cisas-cset-tool-s… ∗∗∗ Two years later, the NSABuffMiner botnet is still alive and kicking ∗∗∗ --------------------------------------------- A crypto-mining botnet named NSABuffMiner (or Indexsinas) is still active and infecting Windows systems using three leaked NSA exploits, security firm Guardicore said today. --------------------------------------------- https://therecord.media/two-years-later-the-nsabuffminer-botnet-is-still-al… ===================== = Vulnerabilities = ===================== ∗∗∗ VU#383432: Microsoft Windows Print Spooler RpcAddPrinterDriverEx() function allows for RCE ∗∗∗ --------------------------------------------- The Microsoft Windows Print Spooler service fails to restrict access to the RpcAddPrinterDriverEx() function, which can allow a remote authenticated attacker to execute arbitrary code with SYSTEM privileges on a vulnerable system. --------------------------------------------- https://kb.cert.org/vuls/id/383432 ∗∗∗ Sicherheitsupdate: Microsoft entdeckt kritische Lücke in Netgear-Router ∗∗∗ --------------------------------------------- Es gibt ein wichtiges Sicherheitsupdate für den WLAN Router DGN2200v1 von Netgear. --------------------------------------------- https://heise.de/-6126662 ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (htmldoc, ipmitool, and node-bl), Fedora (libgcrypt and libtpms), Mageia (dhcp, glibc, p7zip, sqlite3, systemd, and thunar), openSUSE (arpwatch, go1.15, and kernel), SUSE (curl, dbus-1, go1.15, and qemu), and Ubuntu (xorg-server). --------------------------------------------- https://lwn.net/Articles/861521/ ∗∗∗ EC-CUBE fails to restrict access permissions ∗∗∗ --------------------------------------------- https://jvn.jp/en/jp/JVN57942445/ ∗∗∗ Block Content Revision UI - Moderately critical - Access bypass - SA-CONTRIB-2021-022 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2021-022 ∗∗∗ Linky Revision UI - Moderately critical - Access bypass - SA-CONTRIB-2021-021 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2021-021 ∗∗∗ Apigee Edge - Moderately critical - Access bypass - SA-CONTRIB-2021-020 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2021-020 ∗∗∗ Security Advisory - Path Traversal Vulnerability in Some Huawei Products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2021/huawei-sa-20210630-… ∗∗∗ Security Notice – Statement About the Media Report on the Use of GEA-1 Weak Algorithm in Certain Phones ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-notices/2021/huawei-sn-20210618-01-… ∗∗∗ Security Bulletin: Security Vulnerabilities in IBM® Java SDK April 2021 CPU plus affect multiple IBM Continuous Engineering products based on IBM Jazz Technology ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-security-vulnerabilities-… ∗∗∗ Security Bulletin: Using XSS attack, an attacker may inject Javascript code by modifying input fields in Datacap Navigator ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-using-xss-attack-an-attac… ∗∗∗ Security Bulletin: IBM MQ Appliance vulnerability in TLS (CVE-2020-4831) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-appliance-vulnerab… ∗∗∗ Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Go ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-watson-discovery-for-… ∗∗∗ Security Bulletin: IBM MQ Appliance is affected by an OpenSSL vulnerability (CVE-2021-3449) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-appliance-is-affec… ∗∗∗ Security Bulletin: SQL injection from various input fields may affect Datacap Navigator ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-sql-injection-from-variou… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 30.06.2021
by Daily end-of-shift report 30 Jun '21

30 Jun '21

===================== = End-of-Day report = ===================== Timeframe: Dienstag 29-06-2021 18:00 − Mittwoch 30-06-2021 18:00 Handler: Dimitri Robl Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ Lorenz ransomware decryptor recovers victims files for free ∗∗∗ --------------------------------------------- Dutch cybersecurity firm Tesorion has released a free decryptor for the Lorenz ransomware, allowing victims to recover some of their files for free without paying a ransom. --------------------------------------------- https://www.bleepingcomputer.com/news/security/lorenz-ransomware-decryptor-… ∗∗∗ An EPYC escape: Case-study of a KVM breakout ∗∗∗ --------------------------------------------- In this blog post I describe a vulnerability in KVM’s AMD-specific code and discuss how this bug can be turned into a full virtual machine escape. --------------------------------------------- https://googleprojectzero.blogspot.com/2021/06/an-epyc-escape-case-study-of… ∗∗∗ MITRE ATT&CK® mappings released for built-in Azure security controls ∗∗∗ --------------------------------------------- Microsoft is pleased to announce the publication of the Security Stack Mappings for Azure project in partnership with the Center for Threat-Informed Defense. --------------------------------------------- https://www.microsoft.com/security/blog/2021/06/29/mitre-attck-mappings-rel… ∗∗∗ June 2021 Forensic Contest: Answers and Analysis, (Wed, Jun 30th) ∗∗∗ --------------------------------------------- Thanks to everyone who participated in our June 2021 forensic contest originally posted two weeks ago. --------------------------------------------- https://isc.sans.edu/diary/rss/27582 ∗∗∗ Babuk ransomware builder leaked following muddled “retirement” ∗∗∗ --------------------------------------------- Heads are being scratched after the Babuk ransomware builder appears on VirusTotal, adding to the gangs reputation for confusion. --------------------------------------------- https://blog.malwarebytes.com/reports/2021/06/babuk-ransomware-builder-leak… ∗∗∗ Unseriöse Online-Shops verkaufen Mystery-Box mit Produkten aus unzustellbaren Amazon-Paketen ∗∗∗ --------------------------------------------- Einen Gaming Laptop oder eine PlayStation um 16 Euro? Zahlreiche Online-Shops verkaufen derzeit eine Mystery-Box, mit der das möglich sein soll. Die Box beinhaltet laut den HändlerInnen nicht zustellbare Amazon-Produkte wie Laptops, Computer, Kameras oder teure Kopfhörer. --------------------------------------------- https://www.watchlist-internet.at/news/unserioese-online-shops-verkaufen-my… ∗∗∗ FIRST Challenge 2021 Writeup ∗∗∗ --------------------------------------------- Due to the COVID-19 pandemic the FIRST conference 2021 moved online and so did the annual CTF organized by the FIRST Security Lounge SIG. Thomas Pribitzer, Dimitri Robl, and Sebastian Waldbauer from CERT.at participated as a team, scoring the 9. place out of 42 teams. --------------------------------------------- https://cert.at/en/blog/2021/6/first-challenge-2021-writeup ∗∗∗ Gozi malware gang member arrested in Colombia ∗∗∗ --------------------------------------------- Authorities in Colombia have arrested this week a Romanian national named Mihai Ionut Paunescu, one of the three suspects charged in 2013 for creating and operating the infamous Gozi banking trojan. --------------------------------------------- https://therecord.media/gozi-malware-gang-member-arrested-in-colombia/ ∗∗∗ REvil Twins ∗∗∗ --------------------------------------------- Deep Dive Into Prolific RaaS Affiliates’ TTPs --------------------------------------------- https://blog.group-ib.com/revil_raas ===================== = Vulnerabilities = ===================== ∗∗∗ DHCP Flood: Googles Cloud-VMs lassen sich per DHCP übernehmen ∗∗∗ --------------------------------------------- Angreifer könnten Root-Rechte in fremden VMs der Google-Cloud erhalten. Praktische Angriffe sind unwahrscheinlich, Updates gibt es nicht. --------------------------------------------- https://www.golem.de/news/dhcp-flood-googles-cloud-vms-lassen-sich-per-dhcp… ∗∗∗ CVE-2021-1675: Incomplete Patch and Leaked RCE Exploit, (Wed, Jun 30th) ∗∗∗ --------------------------------------------- On June 21st, Microsoft modified the description of the vulnerability upgrading it to a remote code execution vulnerability. Earlier this week, an RCE exploit was posted to GitHub. --------------------------------------------- https://isc.sans.edu/diary/rss/27588 ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (fluidsynth), Fedora (libgcrypt and tpm2-tools), Mageia (nettle, nginx, openvpn, and re2c), openSUSE (kernel, roundcubemail, and tor), Oracle (edk2, lz4, and rpm), Red Hat (389-ds:1.4, edk2, fwupd, kernel, kernel-rt, libxml2, lz4, python38:3.8 and python38-devel:3.8, rpm, ruby:2.5, ruby:2.6, and ruby:2.7), and SUSE (kernel and lua53). --------------------------------------------- https://lwn.net/Articles/861420/ ∗∗∗ Security Bulletin: Vulnerabilities in OpenSSL affect IBM Rational ClearQuest (CVE-2021-3449, CVE-2021-3450) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-openss… ∗∗∗ Security Bulletin: OpenSSL publicly disclosed vulnerability affects IBM MobileFirst Platform Foundation. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-openssl-publicly-disclose… ∗∗∗ Security Bulletin: IBM® Db2® could allow an authenticated user to overwrite arbitrary files due to improper group permissions. (CVE-2020-4945) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-db2-could-allow-an-au… ∗∗∗ Security Bulletin: IBM Cognos Analytics has addressed multiple vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cognos-analytics-has-… ∗∗∗ Security Bulletin: Vulnerabilities in OpenSSL affect IBM Rational ClearQuest ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-openss… ∗∗∗ Security Bulletin: Multiple vulnerabilities in the IBM Java Runtime affect IBM Rational ClearCase (CVE-2020-27221, CVE-2020-14782, CVE-2020-2773, CVE-2020-14781) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Vulnerability in OpenSSL affects IBM Rational ClearCase (CVE-2020-1971, CVE-2021-23839, CVE-2021-23840, CVE-2021-23841, CVE-2021-23839, CVE-2021-23840, CVE-2021-23841) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-openssl-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in the IBM Java Runtime affect IBM Rational ClearQuest ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Apache Commons Codec Vulnerability affects IBM Rational ClearQuest (177835) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-apache-commons-codec-vuln… ∗∗∗ Drupal 8 end-of-life on November 2, 2021 (four months from now) - PSA-2021-2021-06-29 ∗∗∗ --------------------------------------------- https://www.drupal.org/psa-2021-2021-06-29 ∗∗∗ Exacq Technologies exacqVision Web Service ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-180-01 ∗∗∗ Exacq Technologies exacqVision Enterprise Manager ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-180-02 ∗∗∗ Panasonic FPWIN Pro ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-180-03 ∗∗∗ JTEKT TOYOPUC PLC ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-180-04 ∗∗∗ AVEVA System Platform ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-180-05 ∗∗∗ Claroty Secure Remote Access Site ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-180-06 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 29.06.2021
by Daily end-of-shift report 29 Jun '21

29 Jun '21

===================== = End-of-Day report = ===================== Timeframe: Montag 28-06-2021 18:00 − Dienstag 29-06-2021 18:00 Handler: Dimitri Robl Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ Ransomware gangs now creating websites to recruit affiliates ∗∗∗ --------------------------------------------- Ever since two prominent Russian-speaking cybercrime forums banned ransomware-related topics, criminal operations have been forced to promote their service through alternative methods. --------------------------------------------- https://www.bleepingcomputer.com/news/security/ransomware-gangs-now-creatin… ∗∗∗ Microsoft successfully hit by dependency hijacking again ∗∗∗ --------------------------------------------- Microsoft has once again been successfully hit by a dependency hijacking attack. This month, another researcher found an npm internal dependency being used by an open-source project. --------------------------------------------- https://www.bleepingcomputer.com/news/security/microsoft-successfully-hit-b… ∗∗∗ Data for 700M LinkedIn Users Posted for Sale in Cyber-Underground ∗∗∗ --------------------------------------------- After 500 million LinkedIn enthusiasts were affected in a data-scraping incident in April, its happened again - with big security ramifications. --------------------------------------------- https://threatpost.com/data-700m-linkedin-users-cyber-underground/167362/ ∗∗∗ CFBF Files Strings Analysis, (Mon, Jun 28th) ∗∗∗ --------------------------------------------- The Office file format that predates the OOXML format, is a binary format based on the CFBF format. I informally call this the ole file format. --------------------------------------------- https://isc.sans.edu/diary/rss/27576 ∗∗∗ Diving into a Google Sweepstakes Phishing E-mail, (Tue, Jun 29th) ∗∗∗ --------------------------------------------- I was recently forwarded another phishing e-mail to examine. This time, it was an e-mail that claimed to be from Google. The e-mail included a pdf file, and instructed the recipient download the file for further information. --------------------------------------------- https://isc.sans.edu/diary/rss/27578 ∗∗∗ Verschlüsselungstrojaner REvil hat es nun auf virtuelle Maschinen abgesehen ∗∗∗ --------------------------------------------- Mehrere Sicherheitsforscher warnen vor einer neuen REvil-Version, die noch mehr Geräte bedroht. --------------------------------------------- https://heise.de/-6122156 ∗∗∗ Analyzing CVE-2021-1665 – Remote Code Execution Vulnerability in Windows GDI+ ∗∗∗ --------------------------------------------- Microsoft Windows Graphics Device Interface+, also known as GDI+, allows various applications to use different graphics functionality on video displays as well as printers. --------------------------------------------- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/analyzing-cve-2021-166… ∗∗∗ Instagram: Kooperationsanfragen von wegego.com sind Fake ∗∗∗ --------------------------------------------- Momentan werden Instagram-NutzerInnen vermehrt von einem Profil namens sara.wegego – einer angeblichen Brand Ambassador Managerin bei wegego.com – angeschrieben. Ihnen wird eine Kooperation mit dem Unternehmen angeboten. --------------------------------------------- https://www.watchlist-internet.at/news/instagram-kooperationsanfragen-von-w… ∗∗∗ CISA Begins Cataloging Bad Practices that Increase Cyber Risk ∗∗∗ --------------------------------------------- In a blog post by Executive Assistant Director (EAD) Eric Goldstein, CISA announced the creation of a catalog to document bad cybersecurity practices that are exceptionally risky for any organization and especially dangerous for those supporting designated Critical Infrastructure or National Critical Functions. --------------------------------------------- https://us-cert.cisa.gov/ncas/current-activity/2021/06/29/cisa-begins-catal… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (klibc and libjdom2-java), Mageia (bash, glibc, gnutls, java-openjdk, kernel, kernel-linus, leptonica, libgcrypt, openjpeg2, tor, and trousers), openSUSE (bouncycastle, chromium, go1.16, and kernel), Oracle (docker-engine docker-cli and qemu), Red Hat (kpatch-patch), and SUSE (arpwatch, go1.16, kernel, libsolv, microcode_ctl, and python-urllib3, python-requests). --------------------------------------------- https://lwn.net/Articles/861310/ ∗∗∗ PoC released for dangerous Windows PrintNightmare bug ∗∗∗ --------------------------------------------- Proof-of-concept exploit code has been published online today for a vulnerability in the Windows Print Spooler service (spoolsv.exe) that can allow a total compromise of Windows systems. --------------------------------------------- https://therecord.media/poc-released-for-dangerous-windows-printnightmare-b… ∗∗∗ Security Bulletin: Vulnerabilities in Python, Tornado, and Urllib3 affect IBM Spectrum Protect Plus Microsoft File Systems Backup and Restore ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-python… ∗∗∗ Security Bulletin: IBM DataQuant Fix for (All) Apache PDF Box (Publicly disclosed vulnerability) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-dataquant-fix-for-all… ∗∗∗ Security Bulletin: IBM Spectrum Protect Plus has Insecure File Permissions due to not setting the Sticky Bit (CVE-2021-20490) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-spectrum-protect-plus… ∗∗∗ Security Bulletin: IBM Integration Bus and IBM App Connect Enterprise v11 are affected by vulnerabilities in Node.js (CVE-2021-3450, CVE-2021-3449) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-integration-bus-and-i… ∗∗∗ Security Bulletin: Multiple vulnerabilities in open source libraries affects Tivoli Netcool/OMNIbus WebGUI ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Vulnerabilities in Redis, MinIO, Golang, and Urllib3 affect IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes and OpenShift ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-redis-… ∗∗∗ Security Bulletin: Vulnerabilities in MongoDB, Node.js, Docker, and XStream affect IBM Spectrum Protect Plus ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-mongod… ∗∗∗ Security Bulletin: Vulnerabilities in OpenSSL affect IBM Integration Bus and IBM App Connect Enterprise v11 (CVE-2021-3449 , CVE-2021-3450) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-openss… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM HTTP Server used by WebSphere Application Server ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Vulnerabilities in OpenSSL affect IBM Integration Bus and IBM App Connect Enterprise v11 (CVE-2021-23839, CVE-2021-23840) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-openss… ∗∗∗ Security Bulletin: IBM® Db2® could allow an authenticated user to overwrite arbirary files due to improper group permissions. (CVE-2020-4945) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-db2-could-allow-an-au… ∗∗∗ Security Bulletin: IBM® Db2® could allow a local user to access and change the configuration of DB2 due to a race condition via a symbolic link. (CVE-2020-4885) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-db2-could-allow-a-loc… ∗∗∗ Easily Exploitable Critical Vulnerabilities Patched in ProfilePress Plugin ∗∗∗ --------------------------------------------- https://www.wordfence.com/blog/2021/06/easily-exploitable-critical-vulnerab… ∗∗∗ Red Hat OpenShift: Mehrere Schwachstellen ermöglichen Codeausführung ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K21-0700 ∗∗∗ MISP: Schwachstelle ermöglicht nicht spezifizierten Angriff ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K21-0699 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily