@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data
A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.
June 28, 2012=============================================================
@RISK: The Consensus Security Vulnerability Alert
Vol. 12, Num. 26
Providing a reliable, weekly summary of newly discovered attack vectors, vulnerabilities with active exploits, and explanations of how recent attacks worked.
=============================================================CONTENTS:
NOTABLE RECENT SECURITY ISSUES
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST POPULAR MALWARE FILES 6/19/2012 - 6/26/2012
Top Vulnerability this week: CVE-2012-0469 in Mozilla Firefox, Thunderbird and SeaMonkey: patched as of April 2012, however recent information has been released on how to take advantage the vulnerability and bypass DEP/ASLR. It is likely that we will see several attacks in the wild in the near future."
================================================================TRAINING UPDATE
- --SANS Canberra 2012, Canberra, Australia July 2-10, 2012
5 courses. Bonus evening presentations include Penetrating Modern Defenses; and Tales From the Crypt: TrueCrypt Analysis.
http://www.sans.org/canberra-2012/
- --Security Impact of IPv6 Summit, Washington, DC July 6, 2012
Walk away with best practices from some who have already implemented IPv6, in large networks, for a few years.
http://www.sans.org/ipv6-summit-2012/
- --SANSFIRE 2012, Washington, DC July 6-15, 2012
44 courses. Bonus evening presentations include Critical Infrastructure Control Systems Cybersecurity; and Why Don't We Consider Our Cars Critical Infrastructure?, Authentication Issues Between Entities During Protocol Message Exchange in SCADA Systems, many more.
http://www.sans.org/sansfire-2012/
- --SANS San Francisco 2012, San Francisco, CA July 30-August 6, 2012
9 courses. Bonus evening presentations include All Your Hash Are Belong to Us: Targeting Windows Password Hashes for Penetration; Spear Phishing and Targeted Attacks; and Assessing Deception.
http://www.sans.org/san-francisco-2012/
- --SANS Boston 2012, Boston, MA August 6-11, 2012
9 courses. Bonus evening presentations include SIFT Workstation: The Art of Incident Response; and Everything I Know is Wrong! How to Lead a Security Team in a Time of Unprecedented Change and Challenge.
http://www.sans.org/boston-2012/
- --Looking for training in your own community?
http://www.sans.org/community/
- --Save on On-Demand training (30 full courses) - See samples at
http://www.sans.org/ondemand/discounts.php#current
Plus Bangkok, San Antonio, Melbourne, and Arlington, VA all in the next 90 days.
For a list of all upcoming events, on-line and live: www.sans.org
================================================================NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM
Title: CVE-2012-0469 Use-after-free vulnerability in the "IDBKeyRange" interface affecting Mozilla Firefox, Thunderbird and SeaMonkey
Description: This vulnerability was patched in April 2012, however,
newly released information by security firm VUPEN highlights how the
vulnerability can be leveraged in order to bypass DEP and ASLR. We
believe it will only be matter of time before unpatched versions of
Firefox, Thunderbird and SeaMonkey are targeted.
Reference:
http://www.mozilla.org/security/announce/2012/mfsa2012-22.html
http://www.vupen.com/blog/20120625.Advanced_Exploitation_of_Mozilla_Firefox_UaF_CVE-2012-0469.php
Snort SID: 23212
ClamAV: N/A
Title: CVE-2010-0188 Adobe Reader malformed TIFF remote code execution
Description: Several malicious PDF documents found in the wild are
leveraging this vulnerability in order to drop malware on Windows and
Macintosh systems. These PDFs are being used by the Blackhole exploit
kit in "drive by" exploits. You may have seen examples of this in your
environment's email in the form of USAirways reservations, Amazon.com
orders, and other false emails. The vulnerability is a boundary check
error in the 'Libtiff' library when parsing specially crafted PDF
documents. Successful exploitation would cause a stack-based buffer
overflow that may lead to arbitrary code execution in the security
context of the logged in user, or terminate the application abnormally.
Reference: www.adobe.com/support/security/bulletins/apsb10-07.html
Snort SID: 23089
ClamAV: Exploit.PDF-13527, Exploit.PDF.Dropped-17
Title: Worm targeting AutoCAD
Description: A worm specially crafted to steal AutoCAD files has been
found in the wild. While the origin of this worm is unknown, AutoCAD
files are then sent to email accounts provided by 163.com and qq.com,
both Chinese companies. The malware is written in AutoLISP, a scripting
language for AutoCAD.
Reference: http://securityaffairs.co/wordpress/6677/cyber-crime/a-virus-specialized-for-autocad-a-perfect-cyber-espionage-tool.html
Snort SID: (In testing)
ClamAV: Worm.ACAD, Worm.ACAD-1
Title: CVE-2010-2729 and Stuxnet
Description: June 24, 2012 is when Stuxnet's replication mechanism
leveraging CVE-2010-2729 is programmed to be deactivated. This means
that that Stuxnet will no longer spread to USB keys using that
vulnerability. This is a welcome relief in the fight against the spread
of the worm, even two years after the initial outbreak. Users need to
be aware that Stuxnet has not always taken advantage of the Windows
Print Spooler Service vulnerability. Prior to March 2010, Stuxnet used
a trick in Autorun in order to spread and this technique may still be
used.
Reference:
http://technet.microsoft.com/en-us/security/bulletin/MS10-061
http://www.symantec.com/connect/blogs/stuxnet-lnk-file-vulnerability
https://www.securelist.com/en/blog/208193609/The_Day_The_Stuxnet_Died
Snort SID: 17044, 20523, 20524
ClamAV: Worm.Stuxnet -> Worm.Stuxnet-9
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
Advanced Exploitation of Mozilla Use-after-free vulnerability
http://www.vupen.com/blog/20120625.Advanced_Exploitation_of_Mozilla_Firefox_UaF_CVE-2012-0469.php
Why do Nigerian Scammers Say They are from Nigeria?
http://research.microsoft.com/pubs/167719/WhyFromNigeria.pdf
RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM.
This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.
ID: CVE-2012-1493
Title: F5 BIG-IP SSH Private Key Exposure
Vendor: F5 Networks Inc
Description: Remote exploitation of a configuration error vulnerability
in multiple F5 Networks Inc. products could allow an attacker to gain
escalated "root" privileges.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
ID: CVE-2011-2110
Title: Adobe Flash Player AVM Verification Logic Array Indexing Code Execution
Vendor: Adobe
Description: Adobe Flash Player before 10.3.181.26 on Windows, Mac OS
X, Linux, and Solaris, and 10.3.185.23 and earlier on Android, allows
remote attackers to execute arbitrary code or cause a denial of service
(memory corruption) via unspecified vectors, as exploited in the wild
in June 2011.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
ID: CVE-2012-0779
Title: Adobe Flash Player Object Type Confusion
Vendor: Adobe
Description: Adobe Flash Player before 10.3.183.19 and 11.x before
11.2.202.235 on Windows, Mac OS X, and Linux; before 11.1.111.9 on
Android 2.x and 3.x; and before 11.1.115.8 on Android 4.x allows remote
attackers to execute arbitrary code via a crafted file, related to an
"object confusion vulnerability," as exploited in the wild in May 2012.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
ID: CVE-2012-2171
Title: IBM System Storage Manager Profiler SQL Injection and Cross Site Scripting Vulnerabilities
Vendor: IBM
Description: SQL injection vulnerability in ModuleServlet.do in the
Storage Manager Profiler in IBM System Storage DS Storage Manager before
10.83.xx.18 on DS Series devices allows remote authenticated users to
execute arbitrary SQL commands via the selectedModuleOnly parameter in
a state_viewmodulelog action to the ModuleServlet URI.
CVSS v2 Base Score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
ID: CVE-2012-2329
Title: PHP apache_request_headers Function Buffer Overflow
Vendor: The PHP Group
Description: Buffer overflow in the apache_request_headers function in
sapi/cgi/cgi_main.c in PHP 5.4.x before 5.4.3 allows remote attackers
to cause a denial of service (application crash) via a long string in
the header of an HTTP request.
CVSS v2 Base Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
MOST POPULAR MALWARE FILES 6/19/2012 - 6/26/2012:
COMPILED BY SOURCEFIRE
SHA 256: 1481ACE90584C46406259C653D2BD3457A2E5F44781E907731C9A618F96C7442
MD5: bb74024a1d4e4808562c090980151653
VirusTotal: https://www.virustotal.com/file/1481ACE90584C46406259C653D2BD3457A2E5F44781E907731C9A618F96C7442/analysis/
Malwr: http://malwr.com/analysis/bb74024a1d4e4808562c090980151653
Typical Filename: mwssvc.exe
Claimed Product: My Web Search Bar
Claimed Publisher: MyWebSearch.com
SHA 256: CB85D393C4E0DB5A1514C21F9C51BA4C12D82B7FABD9724616758AE528A5B16B
MD5: 7961a56c11ba303f20f6a59a506693ff
VirusTotal: https://www.virustotal.com/file/CB85D393C4E0DB5A1514C21F9C51BA4C12D82B7FABD9724616758AE528A5B16B/analysis/
Malwr: http://malwr.com/analysis/7961a56c11ba303f20f6a59a506693ff
Typical Filename: m3SrchMn.exe
Claimed Product: My Web Search Bar
Claimed Publisher: MyWebSearch.com
SHA 256: A6B140EC734C258C5EBF19C0BC0B414B5655ADC00108A038B5BE6A8F83D0BD03
MD5: 8ac1e580cf274b3ca98124580e790706
VirusTotal: https://www.virustotal.com/file/A6B140EC734C258C5EBF19C0BC0B414B5655ADC00108A038B5BE6A8F83D0BD03/analysis/
Malwr: http://malwr.com/analysis/8ac1e580cf274b3ca98124580e790706
Typical Filename: lpkjnn.sys
Claimed Product: -
Claimed Publisher: -
SHA 256: E2C3896C24FD45DD8092AF10DE84B1A4FAF4FC37A1E9772C56148FE982B44181
MD5: cce8aeb6b86e89280e703608eb252e62
VirusTotal: https://www.virustotal.com/file/E2C3896C24FD45DD8092AF10DE84B1A4FAF4FC37A1E9772C56148FE982B44181/analysis/
Malwr: http://malwr.com/analysis/cce8aeb6b86e89280e703608eb252e62
Typical Filename: M3SKPLAY.EXE
Claimed Product: My Web Search Skin Tools
Claimed Publisher: MyWebSearch.com
SHA 256: E0B193D47609C9622AA018E81DA69C24B921F2BA682F3E18646A0D09EC63AC2B
MD5: bf31a8d79f704f488e3dbcb6eea3b3e3
VirusTotal: https://www.virustotal.com/file/E0B193D47609C9622AA018E81DA69C24B921F2BA682F3E18646A0D09EC63AC2B/analysis/
Malwr: http://malwr.com/analysis/bf31a8d79f704f488e3dbcb6eea3b3e3
Typical Filename: pspprn.sys
Claimed Product: -
Claimed Publisher: -
(c) 2012. All rights reserved. The information contained in this newsletter, including any external links, is provided "AS IS," with no express or implied warranty, for informational purposes only.
Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit https://www.sans.org/account
