======================= = End-of-Shift report = =======================
Timeframe: Donnerstag 24-03-2016 18:00 − Freitag 25-03-2016 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl
*** DFN-CERT-2016-0510/">Xen, QEMU: Mehrere Schwachstellen ermöglichen u.a. das Ausführen beliebigen Programmcodes mit den Rechten des Dienstes *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2016-0510/
*** USB Trojan Hides In Portable Applications, Targets Air-Gapped Systems *** --------------------------------------------- A Trojan program, dubbed USB Thief by researchers at security firm ESET, infects USB drives that contain portable installations of popular applications such as Firefox, NotePad++, or TrueCrypt, and it also seems to be designed to steal information from so-called air-gapped computers. "In the case we .. --------------------------------------------- https://it.slashdot.org/story/16/03/24/184255/usb-trojan-hides-in-portable-a...
*** F5: sol93122894: OpenSSL vulnerability CVE-2016-0705 *** --------------------------------------------- OpenSSL handling of malformed DSA private keys may cause memory corruption and possibly stop the handling process. --------------------------------------------- https://support.f5.com/kb/en-us/solutions/public/k/93/sol93122894.html
*** Tenable: [R1] Log Correlation Engine (LCE) 4.8.0 Updates Libxml2 *** --------------------------------------------- The Log Correlation Engine (LCE) uses the third-party Libxml2 library for some XML parsing routines. A vulnerability was found and patched in Libxml2 recently. Tenable has not evaluated this vulnerability beyond acknowledging that user-supplied XML .. --------------------------------------------- http://www.tenable.com/security/tns-2016-06
*** Cogent DataHub Elevation of Privilege Vulnerability *** --------------------------------------------- This advisory contains mitigation details for a privilege elevation vulnerability in the Cogent DataHub application. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-16-084-01
*** SQL Injection Cheat Sheet *** --------------------------------------------- What is an SQL Injection Cheat Sheet? An SQL injection cheat sheet is a resource in which you can find detailed technical information about the many different variants of the SQL Injection vulnerability. This cheat sheet is of good .. --------------------------------------------- https://www.netsparker.com/blog/web-security/sql-injection-cheat-sheet/
*** Erpressungstrojaner: "Petya" befällt deutschsprachiges Gebiet *** --------------------------------------------- Die Ransomware verbreitet sich über Dropbox und zwingt Windows-User, Geld für die Entsperrung ihres Computers zu zahlen. --------------------------------------------- http://derstandard.at/2000033657066