[CERT-daily] Tageszusammenfassung - 11.07.2017

Daily end-of-shift report team at cert.at
Tue Jul 11 18:05:41 CEST 2017 

=====================
= End-of-Day report =
=====================

Timeframe:   Montag 10-07-2017 18:00 − Dienstag 11-07-2017 18:00
Handler:     Stephan Richter
Co-Handler:  

=====================
=        News       =
=====================

∗∗∗ Security Bulletins posted for Adobe Flash Player and Adobe Connect ∗∗∗
---------------------------------------------
Adobe has published security bulletins for Adobe Flash Player (APSB17-21) and Adobe Connect (APSB17-22). Adobe recommends users update their product installations to the latest versions using the instructions referenced in the relevant bulletin. This posting is provided “AS IS” with no [...]
---------------------------------------------
https://blogs.adobe.com/psirt/?p=1474

∗∗∗ Exploiting Windows Authentication Protocols: Introduction ∗∗∗
---------------------------------------------
SMB relay attack Exploiting the weak Windows authentication protocols is on the top of the list for any adversary, because it mostly relies on a design flaw in the protocol itself, moreover, it is easy and could allow the adversary to get access to remote systems with almost no alert from most systems such as [...]
---------------------------------------------
http://resources.infosecinstitute.com/exploiting-windows-authentication-protocols-part-01/

∗∗∗ A Computational Complexity Attack against Racoon and ISAKMP Fragmentation ∗∗∗
---------------------------------------------
Trustwave recently reported a remotely exploitable computational complexity vulnerability in the racoon isakmp daemon that is part of the ipsec-tools open-source project (http://ipsec-tools.sourceforge.net/). The vulnerability is present in the handling of fragmented packets. A computational complexity attack seeks to cause [...]
---------------------------------------------
http://trustwave.com/Resources/SpiderLabs-Blog/A-Computational-Complexity-Attack-against-Racoon-and-ISAKMP-Fragmentation/

∗∗∗ Verschlüsselung knackbar: Hoffnung für (manche) NotPetya-Opfer ∗∗∗
---------------------------------------------
Die Entwickler des Verschlüsselungstrojaners NotPetya haben entscheidende Fehler bei der Umsetzung ihrer Verschlüsselung gemacht. Unter bestimmten Umständen lässt sich diese knacken. Automatische Tools wird es aber wohl erst einmal nicht geben.
---------------------------------------------
https://heise.de/-3768889

∗∗∗ SambaCry bedroht HPE-NonStop-Server ∗∗∗
---------------------------------------------
Das NonStopOS von Hewlett Packards NonStop-Serversystemen ist anfällig für Angriffe über die SambaCry-Lücke. Die Firma empfiehlt, entsprechende Workarounds umzusetzen, bis Patches bereit stehen.
---------------------------------------------
https://heise.de/-3769117

∗∗∗ Learning PowerShell: The basics ∗∗∗
---------------------------------------------
Get acquainted with some of the basic principles of Powershell and get prepared for some basic usage of this versatile tool that is available on all modern Windows systems.
---------------------------------------------
https://blog.malwarebytes.com/101/how-tos/2017/07/learning-powershell-the-basics/

∗∗∗ SAP Security Patch Day – July 2017 ∗∗∗
---------------------------------------------
This post by SAP Product Security Response Team shares information on Patch Day Security Notes* that are released on second Tuesday of every month and fix vulnerabilities discovered in SAP products. SAP strongly recommends that [...]
---------------------------------------------
https://blogs.sap.com/2017/07/11/sap-security-patch-day-july-2017/


=====================
=    Advisories     =
=====================

∗∗∗ Schneider Electric Pelco Sarix/Spectra Cameras Root Remote Code Execution ∗∗∗
---------------------------------------------
https://cxsecurity.com/issue/WLB-2017070080

∗∗∗ Schneider Electric Pelco Sarix/Spectra Cameras CSRF Enable SSH Root Access ∗∗∗
---------------------------------------------
https://cxsecurity.com/issue/WLB-2017070076

∗∗∗ DFN-CERT-2017-1193: Sophos UTM: Mehrere Schwachstellen ermöglichen u.a. Denial-of-Service-Angriffe ∗∗∗
---------------------------------------------
https://portal.cert.dfn.de/adv/DFN-CERT-2017-1193/

∗∗∗ HPESBNS03755 rev.1 - HPE NonStop Server using Samba, Multiple Remote Vulnerabilities ∗∗∗
---------------------------------------------
https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbns03755en_us

∗∗∗ IBM Security Bulletin: IBM InfoSphere Information Server is vulnerable to Cross-Site Scripting (XSS) ∗∗∗
---------------------------------------------
http://www-01.ibm.com/support/docview.wss?uid=swg22004729

∗∗∗ IBM Security Bulletin: IBM MQ and IBM MQ Appliance invalid requests cause denial of service to SDR and CLUSSDR channels (CVE-2017-1285) ∗∗∗
---------------------------------------------
https://www-01.ibm.com/support/docview.wss?uid=swg22003856

∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affects WebSphere Cast Iron ∗∗∗
---------------------------------------------
http://www.ibm.com/support/docview.wss?uid=swg22005610

∗∗∗ IBM Security Bulletin: Multiple vulnerabilities affect IBM Emptoris Spend Analysis product (CVE-2017-1445, CVE-2017-1446) ∗∗∗
---------------------------------------------
http://www-01.ibm.com/support/docview.wss?uid=swg22005787

∗∗∗ IBM Security Bulletin:Multiple vulnerabilities in the IBM Emptoris Services Procurement product ∗∗∗
---------------------------------------------
http://www.ibm.com/support/docview.wss?uid=swg22005550

∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in the IBM Emptoris Sourcing product ∗∗∗
---------------------------------------------
http://www.ibm.com/support/docview.wss?uid=swg22005549

∗∗∗ IBM Security Bulletin: Apache PDFBox affects IBM Emptoris Contract Management (CVE-2016-2175) ∗∗∗
---------------------------------------------
http://www.ibm.com/support/docview.wss?uid=swg22005591

∗∗∗ SQL Injection in extension "Content Rating Extbase" (content_rating_extbase) ∗∗∗
---------------------------------------------
https://typo3.org/news/article/sql-injection-in-extension-content-rating-extbase-content-rating-extbase/

∗∗∗ Remote Code Execution in extension "PHPMailer" (bb_phpmailer) ∗∗∗
---------------------------------------------
https://typo3.org/news/article/remote-code-execution-in-extension-phpmailer-bb-phpmailer/

∗∗∗ Remote Code Execution in extension "AH Sendmail" (ah_sendmail) ∗∗∗
---------------------------------------------
https://typo3.org/news/article/remote-code-execution-in-extension-ah-sendmail-ah-sendmail/

∗∗∗ Remote Code Execution in extension "Maag Sendmail" (maag_sendmail) ∗∗∗
---------------------------------------------
https://typo3.org/news/article/remote-code-execution-in-extension-maag-sendmail-maag-sendmail/

∗∗∗ SQL Injection in extension "Faceted Search" (ke_search) ∗∗∗
---------------------------------------------
https://typo3.org/news/article/sql-injection-in-extension-faceted-search-ke-search/

∗∗∗ Linux kernel vulnerability CVE-2017-1000364 ∗∗∗
---------------------------------------------
https://support.f5.com/csp/article/K51931024

∗∗∗ Linux kernel vulnerability CVE-2017-1000366 ∗∗∗
---------------------------------------------
https://support.f5.com/csp/article/K20486351

-- 
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

More information about the Daily mailing list