[CERT-daily] Tageszusammenfassung - Montag 26-09-2016

Mon Sep 26 18:18:47 CEST 2016

=======================
= End-of-Shift report =
=======================

Timeframe:   Freitag 23-09-2016 18:00 − Montag 26-09-2016 18:00
Handler:     Robert Waldner
Co-Handler:  Stephan Richter


*** Kein Erste Bank-Sicherheitszertifikat installieren ***
---------------------------------------------
In einer gefälschten Erste Bank-Nachricht verlangen Kriminelle von Empfängern, dass diese ein Sicherheitszertifikat für ihr mobiles Endgerät installieren. Tun Adressaten das nicht, führt das angeblich zur Kontensperrung. Die Installation des Sicherheitszertifikats infiziert das Smartphone mit Schadsoftware. Mit dieser haben Kriminelle Zugriff auf das fremde Konto. Opfer verlieren Geld.
---------------------------------------------
https://www.watchlist-internet.at/schadsoftware/kein-erste-bank-sicherheitszertifikat-installieren/


*** Geschwächte iTunes-Backup-Verschlüsselung: Apple stellt Fix in Aussicht ***
---------------------------------------------
Eine Schwachstelle macht Brute-Force-Angriffe auf verschlüsselte iTunes-Backups von iOS-10-Geräten weniger zeitintensiv. Apple ist das Problem bekannt - und betont, dass iCloud-Backups davon nicht betroffen sind.
---------------------------------------------
http://heise.de/-3331346


*** VBA and P-code, (Mon, Sep 26th) ***
---------------------------------------------
I want to draw your attention to some great work Dr. Bontchev did. pcodedmp.py is a VBA P-code disassembler. Microsoft Office documents contain VBA macros in several forms. They contain the source code, but also compiled P-code. Dr. Bontchev created a proof-of-concept document that executes P-code and does not contain the corresponding source code. Here is the output from his pcodedmp.py tool for his PoC document:   python pcodedmp.py -d poc2b.docProcessing file:...
---------------------------------------------
https://isc.sans.edu/diary.html?storyid=21521&rss


*** Leaking Beeps: Here's A Reason to Kick Pagers out of Hospitals ***
---------------------------------------------
Today, Trend's FTR team released the paper Leaking Beeps: Unencrypted Pager Messages in the Healthcare Industry, on our research into pager technology. If are concerned about keeping your health information private, I would highly recommend you read through it. I, for one, was not expecting the findings we made. Pagers are secure, right? We've used them for decades, they are hard to monitor, and that's why some of our most trusted industries use them, including the healthcare...
---------------------------------------------
http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/o-H15bX77W8/


*** OpenSSL Fixes Critical Bug Introduced by Latest Update ***
---------------------------------------------
OpenSSL's most recent update introduced a critical vulnerability in the crypto library, forcing an emergency update today.
---------------------------------------------
http://threatpost.com/openssl-fixes-critical-bug-introduced-by-latest-update/120851/


*** OpenSSL Security Advisory [26 Sep 2016] ***
---------------------------------------------
This security update addresses issues that were caused by patches included in our previous security update, released on 22nd September 2016. Given the Critical severity of one of these flaws we have chosen to release this advisory immediately to prevent upgrades to the affected version, rather than delaying in order to provide our usual public pre-notification.
---------------------------------------------
https://www.openssl.org/news/secadv/20160926.txt


*** Security Advisory: NodeJS vulnerability CVE-2016-2086 ***
---------------------------------------------
https://support.f5.com:443/kb/en-us/solutions/public/k/15/sol15311661.html?ref=rss


*** Security Notice - Statement on Elevation of Privilege Vulnerability in Huawei HG8247H Product Disclosed on THEZEDT Website ***
---------------------------------------------
http://www.huawei.com/en/psirt/security-notices/2016/huawei-sn-20160924-01-hg8247h-en


*** Security Notice - Statement on Elevation of Privilege Vulnerability in Huawei HG8247H Product Disclosed on TheZedt Website ***
---------------------------------------------
http://www.huawei.com/en/psirt/security-notices/2016/huawei-sn-20160924-01-hg8247h-en


*** Security Advisory - Heap Overflow Vulnerability in the HIFI Driver of Huawei Smart Phone ***
---------------------------------------------
http://www.huawei.com/en/psirt/security-advisories/2015/hw-460347


*** Security Advisory - Privilege Escalation Vulnerability in Huawei Multiple Smart Phones ***
---------------------------------------------
http://www.huawei.com/en/psirt/security-advisories/2016/huawei-sa-20160926-01-smartphone-en


*** IBM Security Bulletins ***
---------------------------------------------
*** IBM Security Bulletin: Multiple Expat XML Parser vulnerabilities in Prospect ***
http://www-01.ibm.com/support/docview.wss?uid=swg21988817
---------------------------------------------
*** IBM Security Bulletin: IBM Security Access Manager for Web is affected by security vulnerabilities in libxml2 ***
http://www.ibm.com/support/docview.wss?uid=swg21990838
---------------------------------------------
*** IBM Security Bulletin: IBM Security Access Manager for Mobile is affected by security vulnerabilities in libxml2 ***
http://www.ibm.com/support/docview.wss?uid=swg21990837
---------------------------------------------
*** IBM Security Bulletin: Multiple libarchive vulnerabilities affect Watson Explorer ***
http://www-01.ibm.com/support/docview.wss?uid=swg21988311
---------------------------------------------
*** IBM Security Bulletin: A command injection vulnerability has been identified in IBM Security Access Manager for Web appliances (CVE-2016-3028) ***
http://www.ibm.com/support/docview.wss?uid=swg21990317
---------------------------------------------
*** IBM Security Bulletin: A vulnerability associated with the default account lockout settings in IBM Security Access Manager for Web has been identified (CVE-2016-3025) ***
http://www.ibm.com/support/docview.wss?uid=swg21990318
---------------------------------------------
*** IBM Security Bulletin: Multiple vulnerabilities in Apache Struts affect SAN Volume Controller and Storwize Family ***
http://www.ibm.com/support/docview.wss?uid=ssg1S1009282
---------------------------------------------
*** IBM Security Bulletin: Vulnerabilities in Apache Struts and Apache Commons FileUpload affects IBM WebSphere Service Registry and Repository (CVE-2016-1181, CVE-2016-1182, CVE-2016-3092) ***
http://www.ibm.com/support/docview.wss?uid=swg21988198
---------------------------------------------
*** IBM Security Bulletin: Multiple Vulnerabilities in Struts v2 affect IBM Opportunity Detect ***
http://www.ibm.com/support/docview.wss?uid=swg21987854
---------------------------------------------
*** IBM Security Bulletin: Vulnerabilities in OpenSSL affect SAN Volume Controller and Storwize Family (CVE-2016-2107 CVE-2016-2108) ***
http://www.ibm.com/support/docview.wss?uid=ssg1S1009281
---------------------------------------------