[CERT-daily] Tageszusammenfassung - Dienstag 27-01-2015

[Daily end-of-shift report]

=======================
= End-of-Shift report =
=======================

Timeframe:   Montag 26-01-2015 18:00 − Dienstag 27-01-2015 18:00
Handler:     Robert Waldner
Co-Handler:  Alexander Riepl



*** Java is the biggest vulnerability for US computers ***
---------------------------------------------
Oracles Java poses the single biggest security risk to US desktops, according to a new report from Copenhagen-based security vendor Secunia ApS, because of its penetration rate, number of vulnerabilities, and patch status.According to the report, 48 percent of users arent running the ..
---------------------------------------------
http://www.csoonline.com/article/2875535/application-security/java-is-the-biggest-vulnerability-for-us-computers.html



*** Beyond "fake invoice" scams - crooks can get money out of real invoices, too! ***
---------------------------------------------
If I told you to change your record of a suppliers bank account so I got all the payments, would you do so? 1000s of companies did, and didnt spot the misdirected payments until an average of $100,000 had gone west...
---------------------------------------------
https://nakedsecurity.sophos.com/2015/01/26/beyond-fake-invoice-scams-crooks-can-get-money-out-of-real-invoices-too




*** ENISA draws the Cyber Threat Landscape 2014: 15 top cyber threats, cyber threat agents, cyber-attack methods and threat trends for emerging technology areas ***
---------------------------------------------
ENISA's Threat Landscape 2014 (ETL 2014) published today is the third yearly report in sequence, consolidating and analysing the top cyber threats and the evolution, encountered in 2014. ENISA Threat Landscape 2014, an activity contributing towards achieving the objectives formulated in the Cyber Security Strategy for the EU, stresses the importance of threat analysis and the identification of emerging trends in cyber security.
---------------------------------------------
http://www.enisa.europa.eu/media/press-releases/enisa-draws-the-cyber-threat-landscape-2014




*** Critical glibc update (CVE-2015-0235) in gethostbyname() calls ***
---------------------------------------------
A heap-based buffer overflow was found in glibc's __nss_hostname_digits_dots() function, which is used by the gethostbyname() and gethostbyname2() glibc function calls. A remote attacker able to make an application call either of these functions could use this flaw to execute arbitrary code with the permissions of the user running the application.
---------------------------------------------
http://ma.ttias.be/critical-glibc-update-cve-2015-0235-gethostbyname-calls/




*** Security updates available for Adobe Flash Player ***
---------------------------------------------
Adobe has released security updates for Adobe Flash Player for Windows, Macintosh and Linux. These updates address vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe is aware of reports that CVE-2015-0311 is actively being exploited in the wild via drive-by-download attacks against systems running Internet Explorer and Firefox on Windows 8.1 and below. Adobe recommends ..
---------------------------------------------
https://helpx.adobe.com/security/products/flash-player/apsb15-03.html