[CERT-daily] Tageszusammenfassung - 27.09.2018

Daily end-of-shift report team at cert.at
Thu Sep 27 18:10:00 CEST 2018 

=====================
= End-of-Day report =
=====================

Timeframe:   Mittwoch 26-09-2018 18:00 − Donnerstag 27-09-2018 18:00
Handler:     Robert Waldner
Co-Handler:  n/a

=====================
=       News        =
=====================

∗∗∗ Upcoming Security Updates for Adobe Acrobat and Reader (APSB18-30) ∗∗∗
---------------------------------------------
A prenotification security advisory (APSB18-30) has been posted regarding upcoming Adobe Acrobat and Reader updates scheduled for Tuesday, October 02, 2018.
---------------------------------------------
https://blogs.adobe.com/psirt/?p=1621


∗∗∗ Password Managers Can Be Tricked Into Believing That Malicious Android Apps Are Legitimate ∗∗∗
---------------------------------------------
A new academic study published today reveals that Android-based password managers have a hard time distinguishing between legitimate and fake applications, leading to easy phishing scenarios. From a report: The study looked at how password managers work on modern versions of the Android OS, and which of the OS features attackers can abuse to collect user credentials via phishing attacks carried out via fake, lookalike apps.
---------------------------------------------
https://it.slashdot.org/story/18/09/26/1534203/password-managers-can-be-tricked-into-believing-that-malicious-android-apps-are-legitimate


∗∗∗ LoJax: First UEFI rootkit found in the wild, courtesy of the Sednit group ∗∗∗
---------------------------------------------
Some UEFI rootkits have been presented as proofs of concept; some are known to be at the disposal of (at least some) governmental agencies. However, no UEFI rootkit has ever been detected in the wild – until we discovered a campaign by the Sednit APT group that successfully deployed a malicious UEFI module on a victim’s system.
---------------------------------------------
https://www.welivesecurity.com/2018/09/27/lojax-first-uefi-rootkit-found-wild-courtesy-sednit-group/


∗∗∗ Geldmacherei mit e-Visum für Ägypten ∗∗∗
---------------------------------------------
Konsument/innen, die nach Ägypten einreisen möchten, müssen ein e-Visum beantragen. Auf der offiziellen Regierungswebsite visa2egypt.gov.eg kostet es für eine einmalige Einreise als Tourist/in 25 US-Dollar. Das ist der günstigste Preis für das e-Visum. Andere Anbieter/innen verlangen dafür wesentlich höhere Kosten. Aus diesem Grund ist bei der Beantragung Vorsicht geboten.
---------------------------------------------
https://www.watchlist-internet.at/news/geldmacherei-mit-e-visum-fuer-aegypten/



=====================
=  Vulnerabilities  =
=====================

∗∗∗ Security updates for Thursday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (asterisk, otrs2, and strongswan), Fedora (kernel-headers, moodle, ntp, visualboyadvance-m, and yaml-cpp), Mageia (rsyslog), openSUSE (ant, libzypp, zypper, shadow, and tiff), Oracle (389-ds-base, flatpak, kernel, nss, and openssl), Red Hat (rh-perl524-mod_perl and rh-perl526-mod_perl), Scientific Linux (389-ds-base, flatpak, kernel, and nss), SUSE (firefox, gd, glibc, kernel, mgetty, php7, and wireshark), and Ubuntu (udisks2).
---------------------------------------------
https://lwn.net/Articles/766959/


∗∗∗ WebKitGTK+ and WPE WebKit Security Advisory WSA-2018-0007 ∗∗∗
---------------------------------------------
Several vulnerabilities were discovered in WebKitGTK+ and WPE WebKit.
...
We recommend updating to the latest stable versions of WebKitGTK+ and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. 
---------------------------------------------
https://webkitgtk.org/security/WSA-2018-0007.html


∗∗∗ Cisco Catalyst 6800 Series Switches ROM Monitor Software Secure Boot Bypass Vulnerability ∗∗∗
---------------------------------------------
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-catalyst6800


∗∗∗ Cisco IOS XE Software Web UI Denial of Service Vulnerability ∗∗∗
---------------------------------------------
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-webuidos


∗∗∗ Cisco IOS XE Software HTTP Denial of Service Vulnerability ∗∗∗
---------------------------------------------
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-webdos


∗∗∗ Cisco IOS and IOS XE Software VLAN Trunking Protocol Denial of Service Vulnerability ∗∗∗
---------------------------------------------
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-vtp


∗∗∗ Cisco IOS and IOS XE Software TACACS+ Client Denial of Service Vulnerability ∗∗∗
---------------------------------------------
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-tacplus


∗∗∗ Cisco IOS and IOS XE Software SM-1T3/E3 Service Module Denial of Service Vulnerability ∗∗∗
---------------------------------------------
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-sm1t3e3


∗∗∗ Cisco IOS XE Software NAT Session Initiation Protocol Application Layer Gateway Denial of Service Vulnerability ∗∗∗
---------------------------------------------
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-sip-alg


∗∗∗ Cisco IOS XE Software Shell Access Authentication Bypass Vulnerability ∗∗∗
---------------------------------------------
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-shell-access


∗∗∗ Cisco IOS Software Precision Time Protocol Denial of Service Vulnerability ∗∗∗
---------------------------------------------
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-ptp


∗∗∗ Cisco IOS XE Software Privileged EXEC Mode Root Shell Access Vulnerability ∗∗∗
---------------------------------------------
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-privesc


∗∗∗ Cisco IOS and IOS XE Software Plug and Play Agent Memory Leak Vulnerability ∗∗∗
---------------------------------------------
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-pnp-memleak


∗∗∗ Cisco IOS and IOS XE Software OSPFv3 Denial of Service Vulnerability ∗∗∗
---------------------------------------------
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-ospfv3-dos


∗∗∗ Cisco IOS XE Software MACsec MKA Using EAP-TLS Authentication Bypass Vulnerability ∗∗∗
---------------------------------------------
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-macsec


∗∗∗ Cisco IOS Software for Cisco 800 Series Industrial Integrated Services Routers Arbitrary Memory Write Vulnerabilities ∗∗∗
---------------------------------------------
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-ir800-memwrite


∗∗∗ Cisco IOS and IOS XE Software IPv6 Hop-by-Hop Options Denial of Service Vulnerability ∗∗∗
---------------------------------------------
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-ipv6hbh


∗∗∗ Cisco IOS XE Software and Cisco ASA 5500-X Series Adaptive Security Appliance IPsec Denial of Service Vulnerability ∗∗∗
---------------------------------------------
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-ipsec


∗∗∗ Cisco IOS XE Software Command Injection Vulnerabilities ∗∗∗
---------------------------------------------
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-iosxe-cmdinj


∗∗∗ Cisco IOS XE Software Errdisable Denial of Service Vulnerability ∗∗∗
---------------------------------------------
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-errdisable


∗∗∗ Cisco IOS XE Software Digital Signature Verification Bypass Vulnerability ∗∗∗
---------------------------------------------
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-digsig


∗∗∗ Cisco IOS and IOS XE Software Cluster Management Protocol Denial of Service Vulnerability ∗∗∗
---------------------------------------------
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-cmp


∗∗∗ Cisco IOS XE Software Cisco Discovery Protocol Memory Leak Vulnerability ∗∗∗
---------------------------------------------
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-cdp-memleak


∗∗∗ Cisco IOS and IOS XE Software Cisco Discovery Protocol Denial of Service Vulnerability ∗∗∗
---------------------------------------------
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-cdp-dos


∗∗∗ IBM Security Bulletin: A vulnerability in PostgreSQL affects PowerKVM ∗∗∗
---------------------------------------------
http://www.ibm.com/support/docview.wss?uid=ibm10730491


∗∗∗ IBM Security Bulletin: A vulnerability in gnupg2 affects PowerKVM ∗∗∗
---------------------------------------------
http://www.ibm.com/support/docview.wss?uid=ibm10720353


∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect Rational Performance Tester ∗∗∗
---------------------------------------------
https://www-01.ibm.com/support/docview.wss?uid=ibm10732455


∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect Rational Service Tester ∗∗∗
---------------------------------------------
https://www-01.ibm.com/support/docview.wss?uid=ibm10732457


∗∗∗ IBM Security Bulletin: Vulnerabilities in the Linux kernel affect PowerKVM ∗∗∗
---------------------------------------------
http://www.ibm.com/support/docview.wss?uid=ibm10716879


∗∗∗ IBM Security Bulletin: Multiple Security Vulnerabilities affect IBM® Cloud Private and IBM Cloud Private Cloud Foundry (CVE-2018-7167, CVE-2018-7164, CVE-2018-7162, CVE-2018-1000168, CVE-2018-7161) ∗∗∗
---------------------------------------------
https://www-01.ibm.com/support/docview.wss?uid=ibm10718901


∗∗∗ IBM Security Bulletin: Arbitrary URL Redirection (CVE-2018-1704) affects IBM Platform Symphony, IBM Spectrum Symphony ∗∗∗
---------------------------------------------
https://www-01.ibm.com/support/docview.wss?uid=ibm10719671


∗∗∗ IBM Security Bulletin: XML Entity Expansion vulnerability (CVE-2018-1702) affects IBM Platform Symphony, IBM Spectrum Symphony ∗∗∗
---------------------------------------------
https://www-01.ibm.com/support/docview.wss?uid=ibm10719659


∗∗∗ IBM Security Bulletin: A vulnerability in policycoreutils affects PowerKVM ∗∗∗
---------------------------------------------
http://www.ibm.com/support/docview.wss?uid=ibm10728473


∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Rational Developer for i and Rational Developer for AIX and Linux Security Bulletin ∗∗∗
---------------------------------------------
http://www.ibm.com/support/docview.wss?uid=ibm10730623


∗∗∗ HPESBST03884 rev.1 - HPE ConvergedSystem 700 Solutions Using HPE 3PAR Service Processor, Multiple Vulnerabilities ∗∗∗
---------------------------------------------
https://support.hpe.com/hpsc/doc/public/display?docLocale=en&docId=emr_na-hpesbst03884en_us


∗∗∗ HPESBHF03890 rev.1 - HPE Service Governance Framework (SGF) - Remote Unauthorized Disclosure of Information ∗∗∗
---------------------------------------------
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03890en_us


∗∗∗ HPESBHF03901 rev.1 - HPE intelligence Management Center (iMC) PLAT, Remote Code Execution ∗∗∗
---------------------------------------------
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03901en_us


∗∗∗ HPESBHF03902 rev.1 - HPE Intelligent Management Center (iMC) PLAT, Remote Code Execution ∗∗∗
---------------------------------------------
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us


∗∗∗ HPESBST03884 rev.2 - HPE ConvergedSystem 700 Solutions Using HPE 3PAR Service Processor, Multiple Vulnerabilities ∗∗∗
---------------------------------------------
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03884en_us

-- 
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

More information about the Daily mailing list