[CERT-daily] Tageszusammenfassung - Freitag 7-03-2014

Fri Mar 7 18:06:13 CET 2014

=======================
= End-of-Shift report =
=======================

Timeframe:   Donnerstag 06-03-2014 18:00 − Freitag 07-03-2014 18:00
Handler:     Robert Waldner
Co-Handler:  n/a


*** The Snake Campaign ***
---------------------------------------------
This new report from BAE Systems Applied Intelligence today provides further details on how the recently disclosed ‘Snake’ cyber espionage toolkit operates. Timelines of the malware development show this to be much bigger campaign than previously known. Specifically it reveals that the malware has actually been in development since at least 2005. From the complexity of the malware, and the range of variants and techniques used to support its operation, the research also suggests that
---------------------------------------------
http://www.baesystems.com/what-we-do-rai/the-snake-campaign


*** Diffie-Hellman: Unsinnige Krypto-Parameter ***
---------------------------------------------
Ein kurzer Schlüsselaustausch bringt Chrome zum Absturz, andere Browser akzeptieren völlig unsinnige Parameter für einen Diffie-Hellman-Schlüsselaustausch. Im Zusammenhang mit den jüngst gefundenen TLS-Problemen könnte das ein Sicherheitsrisiko sein. (Opera, Firefox)
---------------------------------------------
http://www.golem.de/news/diffie-hellman-unsinnige-krypto-parameter-1403-104970-rss.html


*** Shedding New Light on Tor-Based Malware ***
---------------------------------------------
Researchers at Kaspersky Lab and Microsoft have shared new insight into how malware campaigns operate over the Tor anonymity network, as well as other darknets.
---------------------------------------------
http://threatpost.com/shedding-new-light-on-tor-based-malware/104651


*** EMC Documentum TaskSpace privilege escalation ***
---------------------------------------------
EMC Documentum TaskSpace could allow a remote attacker to gain elevated privileges on the system, caused by an error related to the way dm_world group users were added to the dm_superusers_dynamic group. An attacker could exploit this vulnerability to gain elevated privileges on the system.
---------------------------------------------
http://xforce.iss.net/xforce/xfdb/91600


*** Multiple Cisco Wireless LAN Controllers WebAuth denial of service ***
---------------------------------------------
Multiple Cisco Wireless LAN Controllers are vulnerable to a denial of service, caused by the failure to deallocate memory used during the processing of a WebAuth login. By creating an overly large number of WebAuth requests, an attacker could exploit this vulnerability to cause the device to reboot.
---------------------------------------------
http://xforce.iss.net/xforce/xfdb/91602


*** New Tool Makes Android Malware Easier To Create ***
---------------------------------------------
itwbennett writes "A new commercial tool designed to allow cybercriminals to easily transform legitimate Android applications into malicious software has hit the underground market, paving the way for cheap and easy development of sophisticated Android malware. Security researchers from Symantec said Wednesday in a blog post that the tool, called Dendroid, is marketed by its creators as an Android remote administration tool (RAT) and is being sold for $300."    Read more of this story
---------------------------------------------
http://rss.slashdot.org/~r/Slashdot/slashdot/~3/lUI1_mGPycM/story01.htm


*** The Siesta Campaign: A New Targeted Attack Awakens ***
---------------------------------------------
In the past few weeks, we have received several reports of targeted attacks that exploited various application vulnerabilities to infiltrate various organizations. Similar to the Safe Campaign, the campaigns we noted went seemingly unnoticed and under the radar. The attackers orchestrating the campaign we call the Siesta Campaign used multicomponent malware to target certain institutions that […]Post from: Trendlabs Security Intelligence Blog - by Trend MicroThe Siesta Campaign: A New
---------------------------------------------
http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/-rYSWuRUzdQ/


*** Gameover trojan uses rootkit to remain stealthy, tougher to remove ***
---------------------------------------------
Researchers have discovered a Gameover variant of the Zeus trojan that has been modified to include the Necurs rootkit, which makes the malware tougher to detect and remove by protecting files on the disk and memory.
---------------------------------------------
http://feedproxy.google.com/~r/SCMagazineHome/~3/F6bJXyUofvI/


*** Apache Struts Bugs Let Remote Users Deny Service and Manipulate the ClassLoader ***
---------------------------------------------
A remote user can supply specially crafted 'class' parameter values to the ParametersInterceptor class to manipulate the ClassLoader [CVE-2014-0094].
A remote user can send a multipart request with a specially crafted Content-Type header to to trigger a flaw in the Apache Commons FileUpload component and cause denial of service conditions [CVE-2014-0050].
---------------------------------------------
http://www.securitytracker.com/id/1029876


*** Linux Memory Dump with Rekall, (Fri, Mar 7th) ***
---------------------------------------------
Memory dumping for incident response is nothing new, but ever since they locked down access to direct memory (/dev/mem) on Linux, I’ve had bad experiences dumping memory. I usually end up crashing the server about 60 percent of the time while collecting data with Fmem.     A new version of Linux memory dumping utility rekall (previous called Winpmem) has recently came out. I’ve been testing it on the latest versions of Ubuntu and Redhat EL 5 and have not run into any issues with
---------------------------------------------
http://isc.sans.edu/diary.html?storyid=17775&rss


*** Citrix NetScaler Application Delivery Controller Multiple Flaws Let Users Gain Elevated Privileges and Deny Service ***
---------------------------------------------
Several vulnerabilities were reported in Citrix NetScaler Application Delivery Controller. A local user can obtain passwords. A user can gain elevated privileges. A remote user can conduct cross-site scripting and cross-site request forgery attacks. A user can cause denial of service conditions.
---------------------------------------------
http://www.securitytracker.com/id/1029880


*** February 2014 virus activity review from Doctor Web ***
---------------------------------------------
February 28, 2014 Although it’s the years shortest month, February proved to be quite eventful in terms of information security. In particular, Doctor Webs security researchers discovered several Trojans that replace browser window banners and steal confidential information. Also identified were new malignant programs targeting Android. Viruses According to statistics collected in February 2014 by Dr.Web CureIt!, Trojan.Packed.24524, which spreads in the guise of legitimate software, was
---------------------------------------------
http://news.drweb.com/show/?i=4262&lng=en&c=9


*** ownCloud 4.0.x / 4.5.x Remote Code Execution ***
---------------------------------------------
Topic: ownCloud 4.0.x / 4.5.x Remote Code Execution Risk: High Text:Vulnerability title: Remote Code Execution in ownCloud CVE: CVE-2014-2044 Vendor: ownCloud Product: ownCloud Affected versi...
---------------------------------------------
http://cxsecurity.com/issue/WLB-2014030055


*** WordPress Premium Gallery Manager Shell Upload ***
---------------------------------------------
Topic: WordPress Premium Gallery Manager Shell Upload Risk: High Text: Wordpress Plugins Premium Gallery Manager Arbitrary File Upload ...
---------------------------------------------
http://cxsecurity.com/issue/WLB-2014030053


*** [2014-03-07] Unauthenticated access & manipulation of settings in Huawei E5331 MiFi mobile hotspot ***
---------------------------------------------
Unauhenticated attackers are able to gain access to sensitive configuration (e.g. WLAN passwords in clear text or IMEI information of the SIM card) and even manipulate all settings in the web administration interface! This can even be exploited remotely via Internet depending on the mobile operator setup or via CSRF attacks.
---------------------------------------------
https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140307-0_Huawei_E5331_MiFi_Unauthenticated_access_and_settings_modifications_v10.txt


*** HP-UX m4(1) Command Flaw Lets Local Users Gain Elevated Privileges ***
---------------------------------------------
A vulnerability was reported in HP-UX. A local user can obtain elevated privileges on the target system.
A local user can exploit an unspecified flaw in the HP-UX m4(1) command to gain elevated privileges.
---------------------------------------------
http://www.securitytracker.com/id/1029881


*** Hack gegen AVM-Router: Fritzbox-Lücke offengelegt, Millionen Router in Gefahr ***
---------------------------------------------
Die Schonfrist ist abgelaufen: Im Netz kursieren Details, wie man die kritische Schwachstelle in den Fritzboxen ausnutzt. Das bedeutet akute Gefahr, da nach Erkenntnissen von heise Security noch immer sehr viele AVM-Router verwundbar sind.
---------------------------------------------
http://www.heise.de/security/meldung/Hack-gegen-AVM-Router-Fritzbox-Luecke-offengelegt-Millionen-Router-in-Gefahr-2136784.html


*** ComiXology gehackt: User müssen Passwort ändern ***
---------------------------------------------
Die größte digitale Comics-Plattform ComiXology wurde Opfer eines unerlaubten Zugriffs auf Datenbanken mit Usernamen, E-Mailinfos und verschlüsselten Passwörtern.
---------------------------------------------
http://futurezone.at/digital-life/comixology-gehackt-user-muessen-passwort-aendern/54.852.404


*** Via Drucker ins Netz: PDF-Trojaner verwandelt IP-Telefone in Wanzen ***
---------------------------------------------
Ausschließlich durch Missbrauch von Lücken in Geräten wie Netzwerkdruckern oder VoIP-Telefonen können Angreifer ein Netzwerk attackieren. Demonstriert wurde, wie sich die Telefone in Wanzen verwandeln lassen.
---------------------------------------------
http://www.heise.de/newsticker/meldung/Via-Drucker-ins-Netz-PDF-Trojaner-verwandelt-IP-Telefone-in-Wanzen-2136578.html/from/rss09?wt_mc=rss.ho.beitrag.rdf


*** Microsoft Security Bulletin Advance Notification for March 2014 ***
---------------------------------------------
* Remote Code Execution Microsoft Windows,Internet Explorer * Remote Code Execution Microsoft Windows * Elevation of Privilege Microsoft Windows * Security Feature Bypass Microsoft Windows * Security Feature Bypass Microsoft Silverlight
---------------------------------------------
http://technet.microsoft.com/en-us/security/bulletin/ms14-mar


*** PHP 5.4.26 and 5.5.10 available. Several Security Fixes @ : http://www.php.net/downloads.php, (Fri, Mar 7th) ***
---------------------------------------------
PHP 5.4.26 and 5.5.10 available. Several Security Fixes @ : http://www.php.net/downloads.php    --  Tom Webb (c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
---------------------------------------------
http://isc.sans.edu/diary.html?storyid=17777&rss


*** Windows XP: Bundesregierung sorgt sich um Sicherheit von Geldautomaten ***
---------------------------------------------
Zum 8. April läuft Microsofts Support für Windows XP aus. Darum hält es das BSI laut Innenministerium für geboten, aktuelle Betriebssysteme einzusetzen, die mit Sicherheitsupdates versorgt werden.
---------------------------------------------
http://www.heise.de/newsticker/meldung/Windows-XP-Bundesregierung-sorgt-sich-um-Sicherheit-von-Geldautomaten-2137531.html/from/rss09?wt_mc=rss.ho.beitrag.rdf


*** New Attacks on HTTPS Traffic Reveal Plenty About Your Web Surfing ***
---------------------------------------------
Researchers at UC Berkeley have developed new attacks that analyze HTTPS traffic and can accurately determine what pages youve visited during an encrypted session.
---------------------------------------------
http://threatpost.com/new-attacks-on-https-traffic-reveal-plenty-about-your-web-surfing/104667


*** Open-Source-CMS: Sicherheitsupdate für Joomla ***
---------------------------------------------
Das Joomla-Entwicklerteam hat ein Sicherheitsupdate für die beiden aktuell unterstützten Versionszweige des Open-Source-CMS veröffentlicht. Joomla 2.5.19 und Joomla 3.2.3 sollen kürzlich entdeckte Schwachstellen des Content Management Systems stopfen.
---------------------------------------------
http://www.heise.de/newsticker/meldung/Open-Source-CMS-Sicherheitsupdate-fuer-Joomla-2138003.html/from/rss09?wt_mc=rss.ho.beitrag.rdf


*** FFmpeg Multiple Vulnerabilities ***
---------------------------------------------
Multiple vulnerabilities have been reported in FFmpeg, which can be exploited by malicious people to cause a DoS (Denial of Service) in an application using the library.
---------------------------------------------
https://secunia.com/advisories/57282


*** Security Bulletin: Multiple vulnerabilities in IBM QRadar SIEM (CVE-2014-0838, CVE-2014-0835, CVE-2014-0836, CVE-2014-0837) ***
---------------------------------------------
Multiple vulnerabilities exist in the AutoUpdate settings page and the AutoUpdate process within the IBM QRadar SIEM that when used together could result in remote code execution. CVE(s):  CVE-2014-0835, CVE-2014-0836, CVE-2014-0837, and CVE-2014-0838  Affected product(s) and affected version(s): IBM QRadar Security Information and Event Manager (SIEM) 7.2 MR1 and earlier  Refer to the following reference URLs for remediation and additional vulnerability details: Source Bulletin:
---------------------------------------------
https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_multiple_vulnerabilities_in_ibm_qradar_siem_cve_2014_0838_cve_2014_0835_cve_2014_0836_cve_2014_08371?lang=en_us


*** Security Bulletin: Information regarding security vulnerability in IBM SDK Java™ Technology Edition that is shipped with IBM WebSphere Application Server and addressed by Oracle CPU January 2014 ***
---------------------------------------------
Multiple security vulnerabilities exist in the IBM SDK Java Technology Edition that is shipped with IBM WebSphere Application Server and included in the products that are listed in this document.  CVE(s):  CVE-2014-0411  Affected product(s) and affected version(s): WebSphere Process Server V6.1.2, 6.2.x, 7.0.x WebSphere Process Server on z/OS V6.2.x, 7.0.x WebSphere Process Server Hypervisor Edition for Red Hat Enterprise Linux Server for x86 (32-bit) V7.0.0 WebSphere Process Server Hypervisor
---------------------------------------------
https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_information_regarding_security_vulnerability_in_ibm_sdk_java_technology_edition_that_is_shipped_with_ibm_websphere_application_server_and_addressed_by_oracle_cpu_january_2014?lan