Daily

daily@lists.cert.at

1 participants
3288 discussions

Tageszusammenfassung - Donnerstag 20-06-2013
by Daily end-of-shift report 20 Jun '13

20 Jun '13

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 19-06-2013 18:00 − Donnerstag 20-06-2013 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Multiple Vulnerabilities in Cisco TelePresence TC and TE Software *** --------------------------------------------- Cisco TelePresence TC and TE Software contain two vulnerabilities in the implementation of the Session Initiation Protocol (SIP) that could allow an unauthenticated remote attacker to cause a denial of service (DoS) condition. Additionally, Cisco TelePresence TC Software contain an adjacent root access vulnerability that could allow an attacker on the same physical or logical Layer-2 network as the affected system to gain an unauthenticated root shell. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Vuln: OTRS CVE-2013-4088 Remote Security Bypass Vulnerability *** --------------------------------------------- OTRS is prone to a remote security-bypass vulnerability. Attackers can exploit this issue to bypass security restrictions and obtain sensitive information; other attacks may also be possible. --------------------------------------------- http://www.securityfocus.com/bid/60688 *** Anonymous' #OpPetrol: What is it, What to Expect, Why Care? *** --------------------------------------------- Last month, the hacker collective Anonymous announced their intention to launch cyber attacks against the petroleum industry (under the code name #OpPetrol) that is expected to last up to June 20. Their claimed reason for this attack is primarily due to petroleum being sold with the US dollar instead of currency of the country where... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/wIkmxr0Tz_A/ *** LinkedIn auf indische Webseite umgeleitet *** --------------------------------------------- Das Karriereportal LinkedIn war in den letzten Stunden nur hin und wieder zu erreichen. Das Karriereportal wurde auf fremde Seiten umgeleitet. Die Einen sprechen von "menschlichen Fehlern", die anderen von einem Angriff. --------------------------------------------- http://www.heise.de/security/meldung/LinkedIn-auf-indische-Webseite-umgelei… *** VLC Media Player Unspecified Vulnerabilities *** --------------------------------------------- Some vulnerabilities with an unknown impact have been reported in VLC Media Player. The vulnerabilities are caused due to unspecified errors. No further information is currently available. --------------------------------------------- https://secunia.com/advisories/53656 *** Blog: Apple of discord *** --------------------------------------------- As Apple's popularity grows, so does the desire among fraudsters to make money from the people who own the company's devices. The cybercriminals are aiming to steal Apple ID data which provides access to users' personal information stored in iCloud (e.g., photographs, contacts, documents, email, etc.) as well as to the purchases made in the company's iTunes Store. Many malicious users go further and try to the steal bank card details used to pay for those purchases. --------------------------------------------- http://www.securelist.com/en/blog/8108/Apple_of_discord

1 0

Tageszusammenfassung - Mittwoch 19-06-2013
by Daily end-of-shift report 19 Jun '13

19 Jun '13

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 18-06-2013 18:00 − Mittwoch 19-06-2013 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Sybase EAServer Multiple Vulnerabilities *** --------------------------------------------- Multiple vulnerabilities have been reported in Sybase EAServer, which can be exploited by malicious people to bypass certain security restrictions, disclose certain sensitive information, and compromise a vulnerable system. --------------------------------------------- https://secunia.com/advisories/53733 *** Java SE Critical Patch Update - June 2013 *** --------------------------------------------- Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply CPU fixes as soon as possible. This Critical Patch Update contains 40 new security fixes across Java SE products of which 4 are applicable to server deployments of Java. --------------------------------------------- http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.ht… *** Java 7 update 25 released (Tue, Jun 18th) *** --------------------------------------------- http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.ht… (c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. --------------------------------------------- http://isc.sans.edu/diary.html?storyid=16025 *** Critical Update Plugs 40 Security Holes in Java *** --------------------------------------------- Oracle today released a critical patch update for its Java software that fixes at least 40 security vulnerabilities in this widely deployed program and browser plugin. Updates are available for Java 7 on both Mac and Windows. --------------------------------------------- https://krebsonsecurity.com/2013/06/critical-update-plugs-40-security-holes… *** Siemens WinCC 7.2 Multiple Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for vulnerabilities that impact the Siemens WinCC Web Navigator 7.2. --------------------------------------------- http://ics-cert.us-cert.gov/advisories/ICSA-13-169-02 *** Remote code execution vuln appears in Puppet *** --------------------------------------------- Big trouble in automated clouds - Puppet Labs has blasted out a security advisory about a vulnerability in the popular infrastructure management tool Puppet. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2013/06/18/puppet_secu… *** Solaris 10 patch cluster File clobbering vulnerability *** --------------------------------------------- Topic: Solaris 10 patch cluster File clobbering vulnerability Risk: Medium Text:File clobbering vulnerability in Solaris 10 patch cluster 3/27/2013 Larry W. Cashdollar @_larry0 Hello, The 147147-2... --------------------------------------------- http://cxsecurity.com/issue/WLB-2013060154 *** Joomla 1.5.26, 2.5.11, 3.1.1 crypto vulnerability *** --------------------------------------------- Topic: Joomla 1.5.26, 2.5.11, 3.1.1 crypto vulnerability Risk: Medium Text:# Vulnerable Application All current and past versions of Joomla (http://www.joomla.org) up to 1.5.26, 2.5.11, 3.1.1. Also th... --------------------------------------------- http://cxsecurity.com/issue/WLB-2013060146 *** Symantec Endpoint Protection Manager Buffer Overflow Vulnerability *** --------------------------------------------- A vulnerability has been reported in Symantec Endpoint Protection Manager, which can be exploited by malicious people to compromise a vulnerable system. --------------------------------------------- https://secunia.com/advisories/53864 *** Angestellte wollen Hilfe bei IT-Sicherheit *** --------------------------------------------- Der Umgang mit Informationstechnik gehört auch für Angestellte in kleinen und mittelständischen Unternehmen zum täglichen Alltag. Einer Studie zufolge fühlten sie sich bei dieser Aufgabe jedoch vielfach alleingelassen. --------------------------------------------- http://futurezone.at/b2b/16584-angestellte-wollen-hilfe-bei-it-sicherheit.p…

1 0

Tageszusammenfassung - Dienstag 18-06-2013
by Daily end-of-shift report 18 Jun '13

18 Jun '13

======================= = End-of-Shift report = ======================= Timeframe: Montag 17-06-2013 18:00 − Dienstag 18-06-2013 18:00 Handler: Robert Waldner Co-Handler: n/a *** Siemens SIMATIC WinCC Web Navigator Bugs Let Remote Users Inject SQL Commands and Login to the System *** --------------------------------------------- Siemens SIMATIC WinCC Web Navigator Bugs Let Remote Users Inject SQL Commands and Login to the System --------------------------------------------- http://www.securitytracker.com/id/1028672 *** New Regulation for EU cybersecurity agency ENISA, with new duties *** --------------------------------------------- European Union (EU) cybersecurity agency, ENISA has today (18th June) received a new Regulation, granting it a seven year mandate with an expanded set of duties. --------------------------------------------- http://www.enisa.europa.eu/media/press-releases/new-regulation-for-eu-cyber… *** Tools - ProcDOT 1.0 released *** --------------------------------------------- I am happy to announce that the first release (1.0) of my visual malware analysis tool ProcDOT (I already mentioned the beta in a recent blog post) is now available. This tool processes Sysinternals Process Monitor (Procmon) logfiles and PCAP-logs (Windump, Tcpdump) to generate a graph via the GraphViz suite. This graph visualizes any relevant activities (customizable) and can be interactively analyzed. --------------------------------------------- https://www.cert.at/services/blog/20130618112047-852_en.html *** Wall Street sets example for testing security defenses *** --------------------------------------------- Quantum Dawn 2 will test institutions playbooks while also finding more efficient ways to share real-time information --------------------------------------------- http://www.csoonline.com/article/735068/wall-street-sets-example-for-testin… *** iOS: Sicherheitsmängel im "Persönlichen Hotspot" *** --------------------------------------------- iOS wählt die Passwörter für mobiles Tethering nicht wirklich zufällig. Mobile Hotspots können in wenigen Sekunden geknackt werden. --------------------------------------------- http://www.heise.de/security/meldung/iOS-Sicherheitsmaengel-im-Persoenliche… *** Windows-Härter überführt SSL-Spione *** --------------------------------------------- Microsofts Gratis-Schutzprogramm EMET soll in Version 4.0 nicht nur besser vor Cyber-Angriffen schützen, es ist auch deutlich benutzerfreundlicher geworden. Die empfohlenen Schutzeinstellungen aktiviert man mit wenigen Klicks. --------------------------------------------- http://www.heise.de/newsticker/meldung/Windows-Haerter-ueberfuehrt-SSL-Spio… *** Apache XML Security Multiple Vulnerabilities *** --------------------------------------------- Apache XML Security Multiple Vulnerabilities --------------------------------------------- https://secunia.com/advisories/53590 *** Graphical Tools Help Security Experts Track Cyber-Attacks in Real Time *** --------------------------------------------- "... it looks like a fantastic image from something in the world of science fiction. Streams of data flow from the globe representing the Internet. Attack vectors are highlighted in red. You can watch the changes as the attacks progress." --------------------------------------------- http://www.eweek.com/security/graphical-tools-help-security-experts-track-c… *** Security Vulnerability in Siemens COMOS 9.2/10.0 *** --------------------------------------------- Siemens has discovered a vulnerability in the client library of the database system COMOS which might allow attackers to escalate their privileges for database access. The attacker would need local access as authenticated user to exploit the vulnerability. --------------------------------------------- http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemen…

1 0

Tageszusammenfassung - Montag 17-06-2013
by Daily end-of-shift report 17 Jun '13

17 Jun '13

======================= = End-of-Shift report = ======================= Timeframe: Freitag 14-06-2013 18:00 − Montag 17-06-2013 18:00 Handler: Robert Waldner Co-Handler: n/a *** [webapps] - LibrettoCMS 2.2.2 - Arbitrary File Upload *** --------------------------------------------- LibrettoCMS is provided a file upload function to unauthenticated users. Allows for write/read/edit/delete download arbitrary file uploaded , which results attacker might arbitrary write/read/edit/delete files and folders. --------------------------------------------- http://www.exploit-db.com/exploits/26213 *** Adobe Flash exploit grabs video and audio, long after “fix” *** --------------------------------------------- Demonstration code shows a new trick defeats Flash privacy fix. --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/72PWd3AAReE/ *** Microsoft Sharepoint (Cloud) Persistent Script Insertion *** --------------------------------------------- Topic: Microsoft Sharepoint (Cloud) Persistent Script Insertion Risk: Low Text:Title: Microsoft SharePoint (Cloud) - Persistent Exception-Handling Web Vulnerability Date: == 2013-06-14 Re... --------------------------------------------- http://cxsecurity.com/issue/WLB-2013060124 *** Avira AntiVir Engine Denial Of Service / Filter Evasion *** --------------------------------------------- Topic: Avira AntiVir Engine Denial Of Service / Filter Evasion Risk: Medium Text: LSE Leading Security Experts GmbH - Security Advisory 2013-06-13 Avira AntiVir Engine -- Denial of Service / Filtering E... --------------------------------------------- http://cxsecurity.com/issue/WLB-2013060123 *** Siemens OpenScape Branch / Session Border Controller XSS / Disclosure / Injection *** --------------------------------------------- Topic: Siemens OpenScape Branch / Session Border Controller XSS / Disclosure / Injection Risk: Medium Text:SEC Consult Vulnerability Lab Security Advisory == title: Multiple vulner... --------------------------------------------- http://cxsecurity.com/issue/WLB-2013060121 *** Firefox und Twitter schützen vor eingeschleusten Skripten *** --------------------------------------------- "Du kommst hier nicht rein" heißt es für Schadcode, wenn man als Webseiten-Betreiber den HTTP-Header "Content Security Policy" benutzt. Google, Mozilla und Twitter gehen mit gutem Beispiel voran. --------------------------------------------- http://www.heise.de/newsticker/meldung/Firefox-und-Twitter-schuetzen-vor-ei… *** Security Bulletin: WebSphere Commerce vulnerability could allow disclosure of user personal data (CVE-2013-0523) *** --------------------------------------------- Some WebSphere Commerce data may be encrypted using an encryption algorithm that is susceptible to a padding oracle attack which may allow for the disclosure of user personal data. CVE(s): ... --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_web… *** Joomla com_extplorer Components shell upload Vulnerability *** --------------------------------------------- Topic: Joomla com_extplorer Components shell upload Vulnerability Risk: Medium Text: # ISlamic Republic Of Iran Security Team # Www.IrIsT.Ir ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2013060127 *** Microsoft Outlook Vulnerability S/MIME Loss of Integrity *** --------------------------------------------- Topic: Microsoft Outlook Vulnerability S/MIME Loss of Integrity Risk: Medium Text:** Attention script bunnies: This is not an RCE, XSS, etc. Please move along :) ** Microsoft Outlook (all versions) suffers ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2013060129 *** Mozilla Firefox and Microsoft Internet Explorer DoS vulnerability *** --------------------------------------------- Topic: Mozilla Firefox and Microsoft Internet Explorer DoS vulnerability Risk: Medium Text:I want to warn you about Denial of Service vulnerability in Mozilla Firefox and Microsoft Internet Explorer. Earlier Jean ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2013060128 *** Vulnerability Disclosure – Open or Private? *** --------------------------------------------- At the end of May, two Google security engineers announced Mountain View’s new policy regarding zero-day bugs and disclosure. They strongly suggested that information about zero-day exploits currently in the wild should be released no more than seven days after the vendor has been notified. Ideally, the notification or patch should come from the vendor, [...]Post from: Trendlabs Security Intelligence Blog - by Trend MicroVulnerability Disclosure – Open or Private? --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/1qT_zYH1FxU/ *** Oracle Java pre-announcement: Upcoming JRE patch will plug 37 remotely exploitable holes. --------------------------------------------- See http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.ht…, (Mon, Jun 17th) --------------------------------------------- http://isc.sans.edu/diary.html?storyid=16013&rss *** Fortinet FortiOS (FortiGate) Guest User Permission Security Bypass Security Issue *** --------------------------------------------- Fortinet FortiOS (FortiGate) Guest User Permission Security Bypass Security Issue --------------------------------------------- https://secunia.com/advisories/53875 *** Debian Security Advisory for fail2ban *** --------------------------------------------- When using Fail2ban to monitor Apache logs, improper input validation in log parsing could enable a remote attacker to trigger an IP ban on arbitrary addresses, thus causing a denial of service. --------------------------------------------- http://www.debian.org/security/2013/dsa-2708

1 0

Tageszusammenfassung - Freitag 14-06-2013
by Daily end-of-shift report 14 Jun '13

14 Jun '13

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 13-06-2013 18:00 − Freitag 14-06-2013 18:00 Handler: Matthias Fraidl Co-Handler: Stephan Richter *** Java SE Critical Patch Update - June 2013 - Pre-Release Announcement *** --------------------------------------------- This Critical Patch Update Pre-Release Announcement provides advance information about the Oracle Java SE Critical Patch Update for June 2013, which will be released on Tuesday, June 18, 2013. While this Pre-Release Announcement is as accurate as possible at the time of publication, the information it contains may change before publication of the Critical Patch Update Advisory. --------------------------------------------- http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.ht… *** MtGox Phishing Campaign Hits Bing, Yahoo! *** --------------------------------------------- An active phishing campaign targeting account holders at popular Bitcoin exchange MtGox.com has hijacked the top search results at Bing and Yahoo.com, redirecting unwary clickers to mtpox.com, a look-alike domain and Web site that was registered on June 12, 2013, less than 24 hours ago. --------------------------------------------- https://krebsonsecurity.com/2013/06/mtgox-phishing-campaign-hits-bing-yahoo *** How cybercriminals apply Quality Assurance (QA) to their malware campaigns before launching them *** --------------------------------------------- By Dancho Danchev In 2013, the use of basic Quality Assurance (QA) practices has become standard practice for cybercrininals when launching a new campaign. In an attempt to increase the probability of a successful outcome for their campaigns � think malware infection, increased visitor-to-malware infected conversion, improved conversion of blackhat SEO acquired traffic leading to the purchase of counterfeit pharmaceutical items etc. --------------------------------------------- http://blog.webroot.com/2013/06/14/how-cybercriminals-apply-quality-assuran… *** Critical vulnerabilities in Siemens OpenScape Branch & SBC *** --------------------------------------------- Siemens OpenScape Branch & SBC are vulnerable to critical vulnerabilities such as unauthenticated execution of OS commands or file disclosure. Attackers are able to take over the operating system and potentially intercept VoIP traffic or phone calls. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2013… *** AirLive IP cameras plain text information disclosure *** --------------------------------------------- AirLive IP cameras could allow a remote attacker to obtain sensitive information, caused by retrieving users details and passwords stored as plain text in a backup file. An attacker could exploit this vulnerability to obtain sensitive information. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/84933 *** OWASP Top 10 2013 released *** --------------------------------------------- The Open Web Application Security Project's top 10 most critical web application security risks, has been updated and a new list has been published. Last updated back in 2010, the organization has published the new list wherein the importance of cross-site scripting (XSS) and cross-site request forgery (CRSF) has been diluted a little while risks related to broken session management and authentication has moved up a notch. --------------------------------------------- https://www.owasp.org/index.php/Top10 *** Linux-Kernel-Exploit wurde auf Android portiert *** --------------------------------------------- Eine gefährliche Sicherheitslücke, die unter Linux längst gepatcht wurde, wird nun unter Android ausgenutzt. Laut Symantec ist es Entwicklern von Schadsoftware gelungen, den Exploit zu portieren. Abhilfe durch eine neue Android-Version gibt es zunächst nicht. --------------------------------------------- http://www.golem.de/news/privilege-escalation-linux-kernel-exploit-wurde-au… *** Big browser builders scramble to fix cross-platform zero-day flaw *** --------------------------------------------- Browser manufacturers will release an update in the next few weeks to block a new type of malware that exploits a cross-platform flaw that allows attackers access to Mac, PC, mobile, and even games console internet users. --------------------------------------------- http://www.theregister.co.uk/2013/06/13/cross_platform_browser_flaw_in_wild/ *** Hintergrund: XSS-Bremse Content Security Policy *** --------------------------------------------- Cross-Site-Scripting (XSS) ist eine der größten Plagen, mit denen Webmaster zu kämpfen haben. Selbst Banken und Bezahldienstleistern wie PayPal gelingt es nicht, das gefährliche Einschleusen von Fremdcode zu verhindern. Der neue Standard "Content Security Policy" soll endlich Abhilfe schaffen. --------------------------------------------- http://www.heise.de/security/artikel/XSS-Bremse-Content-Security-Policy-188…

1 0

Tageszusammenfassung - Donnerstag 13-06-2013
by Daily end-of-shift report 13 Jun '13

13 Jun '13

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 12-06-2013 18:00 − Donnerstag 13-06-2013 18:00 Handler: Matthias Fraidl Co-Handler: Robert Waldner *** BlackBerry Issues Z10, PlayBook Security Advisories *** --------------------------------------------- BlackBerry has issued security advisories warning of vulnerabilities in the Z10 smartphone and PlayBook tablet. --------------------------------------------- http://threatpost.com/blackberry-issues-z10-playbook-security-advisories/ *** NanoBB 0.7 - Multiple Vulnerabilities *** --------------------------------------------- An attacker might execute arbitrary SQL commands on the database server with this vulnerability. User tainted data is used when creating the database query that will be executed on the database management system (DBMS). --------------------------------------------- http://www.exploit-db.com/exploits/26126 *** Vuln: WordPress crypt_private() Method Remote Denial of Service Vulnerability *** --------------------------------------------- WordPress is prone to a remote denial-of-service vulnerability. Attackers can exploit this issue to consume CPU and memory resources, denying service to legitimate users. WordPress 3.5.1 is vulnerable; other versions may also be affected. --------------------------------------------- http://www.securityfocus.com/bid/60477 *** Rogue ads lead to SafeMonitorApp Potentially Unwanted Application (PUA) *** --------------------------------------------- By Dancho Danchev Our sensors just picked up yet another rogue ad enticing users into installing the SafeMonitorApp, a potentially unwanted application (PUA) that socially engineers users into giving away their privacy through deceptive advertising of the rogue application's 'features'. --------------------------------------------- http://blog.webroot.com/2013/06/13/rogue-ads-lead-to-safemonitorapp-potenti… *** Swedens data protection Authority bans Google cloud services over privacy concerns *** --------------------------------------------- In a landmark ruling, Swedens data protection authority (the Swedish Data Inspection Board) this week issued a decision that prohibits the nations public sector bodies from using the cloud service Google Apps...... --------------------------------------------- http://www.privacysurgeon.org/blog/incision/swedens-data-protection-authori… *** Enterprises spend too much time on attack prevention, not enough on mitigating a breach *** --------------------------------------------- The biggest security mistake enterprises make is focusing too much time and too many resources on preventing cyberattacks and not enough time and money on mitigation once a breach occurs, said Dave Monnier, security evangelist and fellow at non-profit Internet security research firm Team Cymru." --------------------------------------------- http://www.fierceenterprisecommunications.com/story/enterprises-spend-too-m… *** Blog: AutoRun. Reloaded *** --------------------------------------------- Recent months have produced little of interest among worms written in Java and script languages such as JavaScript and VBScript. The main reason behind this was the limited proficiency of the virus writers, whose creations were anything but remarkable. However, a couple of malware samples grabbed our attention; their complexity is testimony to the fact that professionals sometimes get involved as well. --------------------------------------------- http://www.securelist.com/en/blog/8107/AutoRun_Reloaded *** Microsoft botnet smackdown caused collateral damage, failed to kill target *** --------------------------------------------- Zombies just wont stay underground Microsoft is attracting fresh criticism for its handling of the Citadel botnet takedown, with some security researchers pointing to signs that the zombie network is already rising from the grave again. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2013/06/13/ms_citadel_… *** Medical Devices Hard-Coded Passwords *** --------------------------------------------- ALERTSUMMARYResearchers Billy Rios and Terry McCorkle of Cylance have reported a hard-coded password vulnerability affecting a wide variety of medical devices. According to the report, the vulnerability could be exploited to potentially change critical settings and/or modify device firmware. ICS-CERT has been working closely with the Food and Drug Administration (FDA) on these issues. ICS-CERT and the FDA have notified the affected vendors of the report and have asked the vendors to confirm the --------------------------------------------- http://ics-cert.us-cert.gov/alerts/ICS-ALERT-13-164-01 *** Researchers Claim Wi-Fi Threat Is A Serious Danger To iPhone Users *** --------------------------------------------- The way certain iOS devices, like iPhones or iPads, automatically connect to Wi-Fi networks could place users at serious risk. Security firm SkyCure said it had discovered a feature in iPhone devices running on certain networks, including Vodafone, that would connect automatically to a Wi-Fi network with a specified SSID, such as 'BTWiFi'. --------------------------------------------- http://www.techweekeurope.co.uk/news/researchers-claim-wi-fi-threat-is-a-se…

1 0

Tageszusammenfassung - Mittwoch 12-06-2013
by Daily end-of-shift report 12 Jun '13

12 Jun '13

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 11-06-2013 18:00 − Mittwoch 12-06-2013 18:00 Handler: Matthias Fraidl Co-Handler: Robert Waldner *** Microsoft Security Bulletin Summary for June 2013 --------------------------------------------- - Cumulative Security Update for Internet Explorer - Vulnerability in Windows Kernel Could Allow Information Disclosure - Vulnerability in Kernel-Mode Driver Could Allow Denial of Service - Vulnerability in Windows Print Spooler Components Could Allow Elevation of Privilege - Vulnerability in Microsoft Office Could Allow Remote Code Execution --------------------------------------------- http://technet.microsoft.com/en-us/security/bulletin/ms13-jun *** Microsoft schließt sie nicht alle *** --------------------------------------------- Am Juni-Patchday hat Microsoft zahlreihe Lücken in Windows, Internet Explorer und Office geschlossen. Eine Rechteausweitungslücke, für die bereits ein Exploit im Netz kursiert, hat die Redmonder Softwareschmiede dabei jedoch offenbar ausgelassen. --------------------------------------------- http://www.heise.de/security/meldung/Microsoft-schliesst-sie-nicht-alle-188… *** Juni-Updates für Flash-Player und Co. *** --------------------------------------------- Eine Lücke, viele Updates: Adobe hat ein kritisches Sicherheitsloch gestopft und neue Flash- und Air-Versionen für sämtliche Plattformen veröffentlicht. --------------------------------------------- http://www.heise.de/security/meldung/Juni-Updates-fuer-Flash-Player-und-Co-… *** HP integrated Lights Out (iLO) Unspecified Bug Lets Remote Users Gain Access *** --------------------------------------------- HP integrated Lights Out (iLO) Unspecified Bug Lets Remote Users Gain Access --------------------------------------------- http://www.securitytracker.com/id/1028661 *** glibc 2.17+ XDM crypto() NULL pointer deref *** --------------------------------------------- Topic: glibc 2.17+ XDM crypto() NULL pointer deref Risk: Medium Text:Its been suggested we get a CVE id assigned for this recent fix to the xdm display/login manager from X.Org: http://cgit.f... --------------------------------------------- http://cxsecurity.com/issue/WLB-2013060101 *** Weitere XSS-Lücke bei ClickandBuy geschlossen *** --------------------------------------------- Nachdem heise Security über eine XSS-Lücke beim Zahlungsabwickler berichtete, erreichte uns vor kurzem schon der nächste Hinweis auf eine weitere Lücke. --------------------------------------------- http://www.heise.de/security/meldung/Weitere-XSS-Luecke-bei-ClickandBuy-ges… *** Vuln: HP Data Protector CVE-2013-2333 Remote Code Execution Vulnerability *** --------------------------------------------- HP Data Protector CVE-2013-2333 Remote Code Execution Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/60309 *** WordPress Mail Subscribe List Plugin Script Insertion Vulnerability *** --------------------------------------------- WordPress Mail Subscribe List Plugin Script Insertion Vulnerability --------------------------------------------- https://secunia.com/advisories/53732 *** Hewlett Packards Weboberfläche "System Management Homepage" angreifbar *** --------------------------------------------- Die Weboberfläche zur Verwaltung von ProLiant- und Integrity-Servern enthält eine kritische Sicherheitslücke. --------------------------------------------- http://www.heise.de/security/meldung/Hewlett-Packards-Weboberflaeche-System…

1 0

Tageszusammenfassung - Dienstag 11-06-2013
by Daily end-of-shift report 11 Jun '13

11 Jun '13

======================= = End-of-Shift report = ======================= Timeframe: Montag 10-06-2013 18:00 − Dienstag 11-06-2013 18:00 Handler: Matthias Fraidl Co-Handler: Stephan Richter *** CERT Warns of Vulnerabilities in HP Insight Diagnostics *** --------------------------------------------- CERT warns of an unpatched vulnerability in HPs Insight Diagnostics server management software that could lead to remote code execution attacks. --------------------------------------------- http://threatpost.com/cert-warns-of-vulnerabilities-in-hp-insight-diagnosti… *** Apple iOS and Mac OS X security bypass *** --------------------------------------------- Apple iOS and Mac OS X security bypass --------------------------------------------- http://xforce.iss.net/xforce/xfdb/84809 *** The Value of a Hacked Email Account *** --------------------------------------------- One of the most-viewed stories on this site is a blog post+graphic that I put together last year to illustrate the ways that bad guys can monetize hacked computers. But just as folks who dont bank online or store sensitive data on their PCs often have trouble understanding why someone would want to hack into their systems, many people do not fully realize how much they have invested in their email accounts until those accounts are in the hands of cyber thieves. --------------------------------------------- https://krebsonsecurity.com/2013/06/the-value-of-a-hacked-email-account *** NSA Whistleblower Article Redirects to Malware *** --------------------------------------------- The Washington Free Beacons website has been attacked and malware is redirecting visitors to a site hosting the ZeroAccess rootkit and scareware. --------------------------------------------- http://threatpost.com/nsa-whistleblower-article-redirects-to-malware/ *** Debian Security Advisory DSA-2706 chromium-browser *** --------------------------------------------- Several vulnerabilities have been discovered in the Chromium web browser. --------------------------------------------- http://www.debian.org/security/2013/dsa-2706 *** Cisco ASA Ethernet Information Leak *** --------------------------------------------- Exploit for hosts which use a network device driver that pads ethernet frames with data which vary from one packet to another, likely taken from kernel memory, system memory allocated to the device driver, or a hardware buffer on its network interface card. --------------------------------------------- http://cxsecurity.com/issue/WLB-2013060088 *** MobileIron Virtual Smartphone Platform Privilege Escalation Exploit 0day *** --------------------------------------------- The MobileIron VSP appliance provides a restricted "clish" java application that can be used for performing a minimal amount of configuration and requires an "enable" password for elevated privileges. --------------------------------------------- http://cxsecurity.com/issue/WLB-2013060085 *** Going Solo: Self-Propagating ZBOT Malware Spotted *** --------------------------------------------- Who says you can't teach old malware new tricks? Recently, we reported on how ZBOT had made a comeback of sorts in 2013; this was followed by media reports that it was now spreading via Facebook. Now, we have spotted a new ZBOT variant that can spread on its own. --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/9Agp1TYzr9c/ *** Microsoft FixIt Tool Blocks Java Attacks in IE *** --------------------------------------------- Java is a security headache, not just for users and Oracle, its provider, but also for other software companies that have to deal with it, as well. Microsoft has taken steps to address this problem by releasing a FixIt tool that is designed to block all of the Web-based Java attack vectors in Internet Explorer, ... --------------------------------------------- http://threatpost.com/microsoft-fixit-tool-blocks-java-attacks-in-ie/ *** Store passwords the right way in your application *** --------------------------------------------- I suspect most of our readers know this, but it cant hurt to repeat this every so often as there is a lot of confusion on the issue. One thing that gets to me is seeing reports of website compromises that claim "the passwords were hashed with SHA-256". Well at face value that means 90% of the passwords were decoded before the news hit. --------------------------------------------- http://isc.sans.edu/diary.html?storyid=15974 *** [remote] - Java Web Start Double Quote Injection Remote Code Execution *** --------------------------------------------- Java Web Start Double Quote Injection Remote Code Execution --------------------------------------------- http://www.exploit-db.com/exploits/26123 *** WordPress 3.5.1 Denial of Service *** --------------------------------------------- Version 3.5.1 (latest) of popular blogging engine WordPress suffers from remote denial of service vulnerability. The bug exists in encryption module (class-phpass.php). --------------------------------------------- http://cxsecurity.com/issue/WLB-2013060091

1 0

Tageszusammenfassung - Montag 10-06-2013
by Daily end-of-shift report 10 Jun '13

10 Jun '13

======================= = End-of-Shift report = ======================= Timeframe: Freitag 07-06-2013 18:00 − Montag 10-06-2013 18:00 Handler: Matthias Fraidl Co-Handler: Stephan Richter *** Zpanel 10.0.0.2 Remote Execution Exploit *** --------------------------------------------- Topic: Zpanel 10.0.0.2 Remote Execution Exploit Risk: High Text:One of our expert team members (shachibista () gmail com) who is assigned to do the security audit of ZPanel code has found th... --------------------------------------------- http://cxsecurity.com/issue/WLB-2013060057 *** Asus RT56U 3.0.0.4.360 Remote Command Injection *** --------------------------------------------- Topic: Asus RT56U 3.0.0.4.360 Remote Command Injection Risk: High Text:Insufficient (or rather, a complete lack thereof) input sanitization leads to the injection of shell commands. Its possible t... --------------------------------------------- http://cxsecurity.com/issue/WLB-2013060058 *** Sneaky new Android Trojan is WORST yet discovered *** --------------------------------------------- Sophisticated code stays hidden but can wreak havoc Security researchers at Kaspersky Lab report that a recently discovered Android Trojan is the most sophisticated such mobile malware yet to be identified. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2013/06/07/android_oba… *** Abhilfe für Zero-Day-Lücke in Plesk *** --------------------------------------------- Parallels bezieht Stellung zu einem angeblichen Exploit in seiner Server-Verwaltungssoftware und stellt einen Workaround für nicht mehr offiziell unterstützte Versionen bereit. --------------------------------------------- http://www.heise.de/security/meldung/Abhilfe-fuer-Zero-Day-Luecke-in-Plesk-… *** May 2013 virus activity review from Doctor Web *** --------------------------------------------- June 3, 2013 In early May, a dangerous Trojan was discovered that can replace pages loaded in the browser. Another malicious program, also added to the virus database in May, attacked users on Facebook, Google Plus and Twitter. At the end of the month, Doctor Web analysts hijacked another command-and-control (C&C) server of the botnet Rmnet and discovered that two mew malicious components of the file infector were being distributed in the zombie network. Also found were new malicious... --------------------------------------------- http://news.drweb.com/show/?i=3576&lng=en&c=9 *** Qnap patcht häppchenweise *** --------------------------------------------- Mittlerweile stehen Updates des Herstellers für die verwundbaren NAS- und Videoüberwachungssysteme bereit. --------------------------------------------- http://www.heise.de/security/meldung/Qnap-patcht-haeppchenweise-1885664.html *** Twitter Spammers abuses Google search *** --------------------------------------------- We reported few days ago about a new spam campaign that abuses open-redirect vulnerability in popular websites including CNN, Yahoo and Ask.com. Today, Security researcher Janne Ahlberg discovered another spam campaign that abuses the google search to spread the scam websites. --------------------------------------------- http://www.ehackingnews.com/2013/06/twitter-spammers-abuses-google-search.h… *** Microsoft announces five Bulletins for Patch Tuesday, including Office for Mac *** --------------------------------------------- Midsummer Patch Tuesday (or midwinter, depending on your latitude) takes place on Tuesday 11 June 2013. As you probably already know, Microsoft publishes an official Advance Notification each month to give you early warning of whats coming. --------------------------------------------- http://nakedsecurity.sophos.com/2013/06/09/microsoft-announces-five-bulleti… *** ZeuS-P2P internals - understanding the mechanics: a technical report *** --------------------------------------------- At the beginning of 2012, we wrote about the emergence of a new version of ZeuS called ZeuS-P2P or Gameover. It utilizes a P2P (Peer-to-Peer) network topology to communicate with a hidden C&C center. This malware is still active and it has been monitored and investigated by CERT Polska for more than a year. --------------------------------------------- https://www.cert.pl/news/7386/langswitch_lang/en *** Comparing Antivirus Threat Detection to Online Sandboxes *** --------------------------------------------- Metascan uses multiple virus and malware detection engines and aggregates their findings to identify potential threats. There are other ways to detect potential threats, and one approach is to create a virtual environment, or 'sandbox', for the file where it can be observed to see if it exhibits any threatening behavior. --------------------------------------------- http://www.opswat.com/blog/comparing-antivirus-threat-detection-online-sand… *** Microsoft borks botnet takedown in Citadel snafu *** --------------------------------------------- Stupid Redmond kicked over our honeypots, wail white hats Security researchers are complaining about collateral damage from the latest botnet take-down efforts by Microsoft and its partners. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2013/06/10/citadel_bot… *** Apple Store Vulnerable to XSS *** --------------------------------------------- There is a cross-site scripting vulnerability in the Apple Store Web site that is exposing visitors to potential attack. The vulnerability was discovered by a German security researcher who says he informed Apple about the problem in mid-May, but the vulnerability still exists. --------------------------------------------- http://threatpost.com/apple-store-vulnerable-to-xss/ *** RSA Authentication Manager Writes Operating System, SNMP, and HTTP Plug-in Proxy Passwords in Clear Text to Log Files *** --------------------------------------------- RSA Authentication Manager Writes Operating System, SNMP, and HTTP Plug-in Proxy Passwords in Clear Text to Log Files --------------------------------------------- http://www.securitytracker.com/id/1028638 *** Cisco IOS XR SNMP Memory Leak Lets Remote Users Deny Service *** --------------------------------------------- Cisco IOS XR SNMP Memory Leak Lets Remote Users Deny Service --------------------------------------------- http://www.securitytracker.com/id/1028636 *** DSA-2703 subversion *** --------------------------------------------- several vulnerabilities --------------------------------------------- http://www.debian.org/security/2013/dsa-2703

1 0

Tageszusammenfassung - Freitag 7-06-2013
by Daily end-of-shift report 07 Jun '13

07 Jun '13

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 06-06-2013 18:00 − Freitag 07-06-2013 18:00 Handler: Stephan Richter Co-Handler: n/a *** Advanced Notification Service for the June 2013 Security Bulletin Release *** --------------------------------------------- Today we're providing Advance Notification of five bulletins for release on Tuesday, June 11, 2013. This release brings one Critical- and four Important-class bulletins. The Critical-rated bulletin addresses issues in Internet Explorer, and the Important-rated bulletins address issues in Microsoft Windows and Office. We will publish the bulletins on the second Tuesday of the month, at approximately 10 a.m. PT. Please revisit this blog at that time for our official risk and impact... --------------------------------------------- http://blogs.technet.com/b/msrc/archive/2013/06/06/advanced-notification-se… *** Plesk 0-day: Real or not?, (Fri, Jun 7th) *** --------------------------------------------- Yesterday, a poster to the full disclosure mailing list described a possible new 0-day vulnerability against Plesk. Contributing to the vulnerability is a very odd configuration choice to expose "/usr/bin" via a ScriptAlias, making executables inside the directory reachable via URLs. The big question that hasnt been answered so far is how common this configuration choice is. Appaerently, some versions of Plesk on CentOS 5 are configured this way, but not necessarily exploitable. The... --------------------------------------------- http://isc.sans.edu/diary.html?storyid=15950&rss *** 100% Compliant (for 65% of the systems), (Fri, Jun 7th) *** --------------------------------------------- At a community college where Im helping out whenever they panic on security issues, I recently was confronted with the odd reality of a lingering malware infection on their network, even though they had deployed a custom anti-virus (AV) pattern ("extra.dat") to eradicate the problem. Of course, these days, reliance on anti-virus is somewhat moot to begin with, our recent tally of fresh samples submitted to VirusTotal had AV lagging behind about 8 days or so. If you caught a keylogger... --------------------------------------------- http://isc.sans.edu/diary.html?storyid=15959&rss *** PHP "php_quot_print_encode()" Buffer Overflow Vulnerability *** --------------------------------------------- A vulnerability has been reported in PHP, which can be exploited by malicious people to compromise a vulnerable system. --------------------------------------------- https://secunia.com/advisories/53736 *** Vuln: Drupal Services Module Cross Site Request Forgery Vulnerability *** --------------------------------------------- The Services module for Drupal is prone to a cross-site request-forgery vulnerability. --------------------------------------------- http://www.securityfocus.com/bid/60356

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily