[CERT-daily] Tageszusammenfassung - Donnerstag 16-07-2015

Thu Jul 16 18:44:18 CEST 2015

=======================
= End-of-Shift report =
=======================

Timeframe:   Mittwoch 15-07-2015 18:00 − Donnerstag 16-07-2015 18:00
Handler:     Stephan Richter
Co-Handler:  n/a


*** RC4 crypto: Get RID of it already, say boffins ***
---------------------------------------------
This one simple attack busts WPA-TKIP in less than an hour ... As they explain here, the weakness of RC4 (inherited by systems using it) is based on biases in the RC4 keystream. The bias was already known, and is why vendors like Microsoft are working to deprecate it. Whats different in the new work is the acceleration of the cryptanalysis Vanhoef and Piessens carry out.
---------------------------------------------
http://www.theregister.co.uk/2015/07/16/rc4_get_rid_of_it_already_say_boffins/


*** RC4 in HTTPS & Verbreitung ***
---------------------------------------------
RC4 gehört nicht zu den stärksten Verschlüsselungsmethoden, und sollte eigentlich nach RFC7465 (aktuell noch ein Draft) gar nicht mehr verwendet werden. Neue Angriffe ermöglichen im Nachhinein das entschlüsseln von sensitiven Informationen wie zum Beispiel Session cookies innerhalb von wenigen Tagen. In den letzten Wochen haben wir ca. 2 Millionen TLS Konfigurationen weltweit mittels dem Tool...
---------------------------------------------
https://www.sba-research.org/2015/07/16/rc4-in-https-verbreitung/


*** Poodle-Nachspiel: Mace und weitere Lücken in TLS-Servern ***
---------------------------------------------
Cisco, F5, Juniper, Fortinet: Ein Sicherheitsforscher hat eine Reihe von TLS-Servern entdeckt, die den sogenannten Message Authentication Code (MAC) von Verbindungen nicht prüfen. Andere Serverimplementierungen prüfen eine Checksumme am Ende des Handshakes nicht.
---------------------------------------------
http://www.golem.de/news/poodle-nachspiel-mace-und-weitere-luecken-in-tls-servern-1507-115263-rss.html


*** Adobe's CVE-2015-5090 - Updating the Updater to become the bossman ***
---------------------------------------------
Amongst the many bugs Adobe patched in July 2015, CVE-2015-5090 stands out as being worth a closer look. Adobe lists this vulnerability as a privilege escalation from low to medium integrity, but this doesn’t tell the whole story. In actuality, this bug can used to execute code with SYSTEM privileges, which could allow an attacker to completely take over a target. Since this affects the Adobe updater service, the bug exists in both Adobe Reader and Acrobat Pro. Both of these programs install the ARMSvc service (Updater) and both keep AdobeARM.exe/AdobeARMHelper.exe in c:\progra~1\common~1\Adobe\ARM\1.0.
---------------------------------------------
http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Adobe-s-CVE-2015-5090-Updating-the-Updater-to-become-the-bossman/ba-p/6765412


*** Mozilla Winter of Security is back! ***
---------------------------------------------
The first edition of MWoS was a success, and a lot of fun for students and mentors, so we decided to run it again this year. For the 2015 edition, we are proposing six projects that directly contribute to our most impactful security tools. Students will be able to work on digital forensics with MIG, SSL/TLS configurations with Menagerie, certificate management with LetsEncrypt, security visualization with MozDef, and web security scanning with OWASP ZAP.
---------------------------------------------
https://blog.mozilla.org/security/2015/07/15/mozilla-winter-of-security-is-back/


*** Understanding PCI compliance fines: Who is in charge of enforcing PCI? ***
---------------------------------------------
If your business stores, processes, or transmits data from payment cards, then you are subject to the requirements of the PCI DSS. This set of security controls is designed to help merchants combat da...
---------------------------------------------
http://feedproxy.google.com/~r/HelpNetSecurity/~3/--jT_s5xAyE/article.php


*** Researchers prove HTML5 can be used to hide malware ***
---------------------------------------------
A group of Italian researchers have come up with new obfuscation techniques that can be used to dupe malware detection systems and allow malicious actors to execute successful drive-by download attack...
---------------------------------------------
http://feedproxy.google.com/~r/HelpNetSecurity/~3/9k3wj_RIqQ8/malware_news.php


*** Authentication Bypass Bug Hits Siemens Energy Automation Device ***
---------------------------------------------
An authentication bypass vulnerability in a Siemens device that's used in energy automation systems could allow an attacker to gain control of the device. The vulnerability is in the Siemens SICAM MIC, a small telecontrol system that performs a number of functions and includes an integrated Web server and several other features. The devices consist of...
---------------------------------------------
http://threatpost.com/authentication-bypass-bug-hits-siemens-energy-automation-device/113814


*** Are smart infrastructures experts in cyber security? ***
---------------------------------------------
[...] Prof. Helmbrecht said: “Currently there is no clear definition of cyber security for smart infrastructures at an EU level. It will be beneficial to increase information sharing and coordination for example on public transport. As new technologies and applications are developed, their security aspects also need to be developed from the design phase, allowing for improved services, user experience and safety in a connected online world”.
---------------------------------------------
http://www.enisa.europa.eu/media/news-items/are-smart-infrastructures-experts-in-cyber-security


*** Bugtraq: ESA-2015-122: EMC Documentum CenterStage Cross-site Scripting Vulnerability ***
---------------------------------------------
http://www.securityfocus.com/archive/1/536014


*** Bugtraq: ESA-2015-123: EMC Documentum WebTop Open Redirect Vulnerability ***
---------------------------------------------
http://www.securityfocus.com/archive/1/536015


*** IBM Security Bulletins ***
---------------------------------------------
https://www-304.ibm.com/connections/blogs/PSIRT/?lang=en_us


*** Cisco WebEx Meetings Server Remote Code Execution Vulnerability ***
---------------------------------------------
http://tools.cisco.com/security/center/viewAlert.x?alertId=39938


*** Cisco Unified Intelligence Center Cross-Site Request Forgery Vulnerability ***
---------------------------------------------
http://tools.cisco.com/security/center/viewAlert.x?alertId=39920


*** Cisco Email Security Appliance Malformed DMARC Policy Records File Modification Vulnerability ***
---------------------------------------------
http://tools.cisco.com/security/center/viewAlert.x?alertId=39940


*** Oracle Critical Patch Update Advisory - July 2015 ***
---------------------------------------------
http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html


*** Oracle Critical Patch Update - July 2015 ***
---------------------------------------------
http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html


*** Solaris Third Party Bulletin - July 2015 ***
---------------------------------------------
http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html