[CERT-daily] Tageszusammenfassung - Montag 22-04-2013

Mon Apr 22 18:18:36 CEST 2013

=======================
= End-of-Shift report =
=======================

Timeframe:   Freitag 19-04-2013 18:00 − Montag 22-04-2013 18:00
Handler:     Stephan Richter
Co-Handler:  Otmar Lendl


*** OpenStack keystone.conf insecure file permissions ***
---------------------------------------------
Topic: OpenStack keystone.conf insecure file permissions Risk: Medium Text:As reported: https://bugs.launchpad.net/keystone/+bug/1168252 The password configuration of LDAP and admin_token in keystone...
---------------------------------------------
http://feedproxy.google.com/~r/securityalert_database/~3/Y9fS7PiNeIM/WLB-2013040141


*** nginx Arbitrary Code Execution NullByte Injection ***
---------------------------------------------
Topic: nginx Arbitrary Code Execution NullByte Injection Risk: Low Text:# Exploit Title: nginx Arbitrary Code Execution NullByte Injection # Date: 24/08/2011 # Exploit Author: Neal Poole # Vendor ...
---------------------------------------------
http://cxsecurity.com/wlb/WLB-2013040142


*** Vuln: Opera Web Browser Information Disclosure and Unspecified Vulnerabilities ***
---------------------------------------------
Opera Web Browser Information Disclosure and Unspecified Vulnerabilities
---------------------------------------------
http://www.securityfocus.com/bid/58864


*** libxml2 Multiple Use-After-Free Vulnerabilities ***
---------------------------------------------
Topic: libxml2 Multiple Use-After-Free Vulnerabilities Risk: Medium Text:1) An use-after-free error in "htmlParseChunk()" can be exploited to dereference already freed memory. 2) Two use-after-free...
---------------------------------------------
http://feedproxy.google.com/~r/securityalert_database/~3/yn55M8Cmawk/WLB-2013040150


*** Family of “BadNews” malware in Google Play downloaded up to 9 million times ***
---------------------------------------------
Apps steal sensitive data, push SMS app that racks up charges to pricey service.
---------------------------------------------
http://feeds.arstechnica.com/~r/arstechnica/security/~3/hS0_oWvBHPU/


*** A Chargen-based DDoS? Chargen is still a thing?, (Sun, Apr 21st) ***
---------------------------------------------
In the recent few days there was another denial of service attack launched at financial organizations. (Yeah, I know, DDoS on a bank, thats *totally* never happens). What is newsworthy isnt that it happened, it was the means used to execute the attack. Specifically, the organizations were flooded with UDP port 19 traffic which is the chargen protocol. I am not sure Ive ever seen a legitimate use of this protocol or encountered a machine that had it on intentionally before.  For review, chargen...
---------------------------------------------
http://isc.sans.edu/diary.html?storyid=15647&rss


*** ownCloud Server 5.0.x/4.5.x XSS and Privilege escalation ***
---------------------------------------------
Topic: ownCloud Server 5.0.x/4.5.x XSS and Privilege escalation Risk: Medium Text:This vulnerabilities only affect ownCloud Server 5.0.x and 4.5.x, the 4.0.x branch is not affected and still supported with se...
---------------------------------------------
http://cxsecurity.com/wlb/WLB-2013040156


*** Und täglich grüßt die Router-Lücke ***
---------------------------------------------
Belkin, D-Link, Linksys, Netgear, Sitecom, TP-Link – es gibt kaum Hersteller, die bei der Firmware-Entwicklung nicht patzen. Es ist nach wie vor schockierend, was für mitunter haarsträubende Schwachstellen in verbreiteten Router-Modellen schlummern.
---------------------------------------------
http://www.heise.de/security/meldung/Und-taeglich-gruesst-die-Router-Luecke-1846882.html


*** Avaya Communication Manager OpenSSL and glibc Vulnerabilities ***
---------------------------------------------
Avaya Communication Manager OpenSSL and glibc Vulnerabilities
---------------------------------------------
https://secunia.com/advisories/53166


*** 8 tips for a security incident handling plan ***
---------------------------------------------
Most of us know that there is no such thing as 100% security, and that - unfortunately - its only a matter of time until a security incident occurs. Despite this, its rare to see a good incident response process and plan in place.
---------------------------------------------
http://nakedsecurity.sophos.com/2013/04/20/tips-incident-handling-plan/


*** McAfee Security Bulletin - ePO update fixes two vulnerabilities ***
---------------------------------------------
Five separate CVE reports of potential ePO vulnerabilities were reported: CVE-2013-0169, CVE-2013-1484, CVE-2013-1485, CVE-2013-1486, CVE-2013-1487. Collectively, these vulnerabilities could allow unauthorized disclosure of information, unauthorized modification, or disruption of service. ePO is not vulnerable to any of these CVE vulnerabilities.
---------------------------------------------
https://kc.mcafee.com/corporate/index?page=content&id=SB10041


*** Cisco Unified Contact Center Express Editor Information Disclosure Vulnerability ***
---------------------------------------------
A vulnerability in the scripts editor software of the Cisco Unified Contact Center Express (Cisco Unified CCX) could allow an unauthenticated, remote attacker to have read access to scripts that are stored in the Cisco Unified CCX scripts repository.
---------------------------------------------
http://tools.cisco.com/security/center/viewAlert.x?alertId=29050


*** Firefox FirePHP Extension Arbitrary Command Execution Weakness ***
---------------------------------------------
Firefox FirePHP Extension Arbitrary Command Execution Weakness
---------------------------------------------
https://secunia.com/advisories/53163


*** Global Mapper Insecure Library Loading Vulnerability ***
---------------------------------------------
Global Mapper Insecure Library Loading Vulnerability
---------------------------------------------
https://secunia.com/advisories/51510


*** DDoS Strikes Take EU Banks Offline ***
---------------------------------------------
Experts Say Outages Not Linked to U.S. Attacks Distributed-denial-of-service attacks against banking institutions are becoming a global concern, and experts say many organizations outside the U.S. financial-services sector are ill-equipped to defend themselves. DDoS strikes have taken down online-banking sites in Northern Europe in recent days and weeks, several security experts say. Scott Hammack, CEO of DDoS-mitigation provider Prolexic, says...
---------------------------------------------
http://www.bankinfosecurity.com/ddos-strikes-take-eu-banks-offline-a-5701/op-1


*** Bugtraq: [SE-2012-01] Yet another Reflection API flaw affecting Oracles Java SE ***
---------------------------------------------
[SE-2012-01] Yet another Reflection API flaw affecting Oracles Java SE
---------------------------------------------
http://www.securityfocus.com/archive/1/526415


*** Security Bulletin: IBM InfoSphere Data Replication Dashboard Username Enumeration (CVE-2013-0584) ***
---------------------------------------------
A remote, unauthenticated user can enumerate a list of InfoSphere Data Replication Dashboard user accounts including which accounts do not require a password.
---------------------------------------------
http://www-01.ibm.com/support/docview.wss?uid=swg21634798


*** A Primer on IPv4, IPv6 and Transition ***
---------------------------------------------
There is something badly broken in todays Internet. At first blush that may sound like a contradiction in terms, or perhaps a wild conjecture intended only to grab your attention to get you to read on. After all, the Internet is a modern day technical marvel. In just a couple of decades the Internet has not only...
---------------------------------------------
http://www.circleid.com/posts/20130421_a_primer_on_ipv4_ipv6_and_transition/


*** Security Advisory-The AR Abnormally Resets When Receiving Special DHCP Packets ***
---------------------------------------------
Apr 20, 2013 14:38
---------------------------------------------
http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-258476.htm


*** WordPress - Vulnerabilities in multiple Plugins ***
---------------------------------------------
WordPress All in One Webmaster Plugin Cross-Site Request Forgery Vulnerability
---------------------------------------------
https://secunia.com/advisories/52877

WordPress FourSquare Checkins Plugin Cross-Site Request Forgery Vulnerability
---------------------------------------------
https://secunia.com/advisories/53151

WordPress Facebook Members Plugin Cross-Site Request Forgery Vulnerability
---------------------------------------------
https://secunia.com/advisories/52962

WordPress W3 Total Cache Arbitrary Code Execution Vulnerability
---------------------------------------------
https://secunia.com/advisories/53052