@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data
A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.
July 12, 2012=============================================================
@RISK: The Consensus Security Vulnerability Alert
Vol. 12, Num. 28
Providing a reliable, weekly summary of newly discovered attack vectors, vulnerabilities with active exploits, and explanations of how recent attacks worked
=============================================================CONTENTS:
NOTABLE RECENT SECURITY ISSUES
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST POPULAR MALWARE FILES 7/4/2012 - 7/10/2012
============================================================| Platform | Number of Updates and Vulnerabilities |
| -------------------------- | ------------------------------------- |
| Cross Platform | 4 (#1,#3,#4,#5) |
| Microsoft Windows | 1 (#2) |
| Android | 1 (#6) |
| Web Application | 2 (#7,#8) |
| Cryptography | 1 (#9) |
TOP VULNERABILITY THIS WEEK: CVE-2012-1723, Java runtime vulnerability. Patched in June, this client-side vulnerability is being incorporated into the Blackhole exploit kit. Public exploits are available, and reports of in-the-wild exploitation are on the rise.
============================================================NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM
#1
Title: New Java Vulnerability in Blackhole
Description: A recently released Java vulnerability - CVE-2012-1723 -
has been incorporated into the Blackhole exploit kit, dramatically
raising the likelihood that even relatively current systems will fall
victim to its attacks. The bug, which is a complex object typing issue,
is reliably exploitable in the field, and has public proof-of-concept
available that gives full details on the nature of the vulnerability.
Reference:
http://www.oracle.com/technetwork/topics/security/javacpujun2012-1515912.html
http://schierlm.users.sourceforge.net/CVE-2012-1723.html
http://vrt-blog.snort.org/2012/07/cve-2012-1723-new-java-attack-added-to.html
Snort SID: 23273 - 23277
ClamAV: Exploit.CVE_2012_1723
#2
Title: New Variant On An Old Exploit
Description: CVE-2012-0158, which exploits a vulnerable Windows Common
Control ActiveX component, has been exploited actively in the field
since before the release of a patch in April of this year. While the
attacks have, to date, been very targeted in nature, they are becoming
more sophisticated with time. Often dropped in RTF, DOC, or XLS files,
new variants of the attack observed recently in the field have been much
more stripped down than the original exploits, bypassing a step
previously thought necessary to trigger the bug.
Reference: http://vrt-blog.snort.org/2012/07/its-not-dalai-lamas-birthday-oh-and-you.html
Snort SID: 21896 - 21093, 21905, 21937, 23305
ClamAV: Exploit.CVE_2012_0158
#3
Title: Kuluoz Trojan Spreading In-Field
Description: A trojan known as "Kuluoz" has been spreading rapidly in
the field, according to intelligence from the Sourcefire VRT's threat
monitoring network. Dropped by a variety of different means, the malware
contacts C&C servers in Russia and elsewhere upon installation, and is
part of a broader botnet.
Reference: http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Win32%2FKuluoz
Snort SID: 23244
ClamAV: Trojan-Kuluoz-4 through Trojan-Kuluoz-2311
#4
Title: CVE-2012-0677 iTunes M3U Playlist Buffer Overflow
Description: Classic buffer overflow attacks are generally rare these
days, but a new one was released that attacks M3U files - which form
Apple iTunes playlists - at the end of June. Public attacks exist, and
the vulnerability has been incorporated into Metasploit. Given the
cross-platform nature of the bug, and the ease with which it can be
exploited, in-the-wild attacks will likely be ongoing for some time.
Reference: http://zeroscience.mk/en/vulnerabilities/ZSL-2012-5093.php
Snort SID: 23271 23272
ClamAV: N/A
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
#5
Analysis of CVE-2011-3545:
http://axtaxt.wordpress.com/2012/07/08/analysis-of-cve-2011-3545/
#6
Find & Call: Leak & Spam:
https://www.securelist.com/en/blog/208193641/Find_and_Call_Leak_and_Spam
#7
How to monetize Facebook pages:
http://www.f-secure.com/weblog/archives/00002394.html
#8
RIPS - static source code analyzer for PHP applications:
http://sourceforge.net/projects/rips-scanner/
#9
MITM attacks with untrusted certificates against Tor in Jordan:
https://blog.torproject.org/blog/security-vulnerability-found-cyberoam-dpi-devices-cve-2012-3372
RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM.
This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.
ID: CVE-2012-1723
Title: Oracle Java SE Remote Code Execution Vulnerability / Blackhole Exploit Kit
Vendor: Oracle
Description: Unspecified vulnerability in the Java Runtime Environment
(JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32
and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows
remote attackers to affect confidentiality, integrity, and availability
via unknown vectors related to Hotspot.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
ID: CVE-2012-0469
Title: Mozilla Use-after-free vulnerability in the "IDBKeyRange"
Vendor: Mozilla
Description: Use-after-free vulnerability in the
mozilla::dom::indexedDB::IDBKeyRange::cycleCollection::Trace function
in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4,
Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and
SeaMonkey before 2.9 allows remote attackers to execute arbitrary code
via vectors related to crafted IndexedDB data.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
ID: CVE-2012-1889
Title: Vulnerability in Microsoft XML Core Services Could Allow Remote Code Execution (MS12-043)
Vendor: Microsoft
Description: Microsoft XML Core Services 3.0, 4.0, 5.0, and 6.0 accesses
uninitialized memory locations, which allows remote attackers to execute
arbitrary code or cause a denial of service (memory corruption) via a
crafted web site.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
ID: CVE-2012-0708
Title: IBM Rational ClearQuest CQOle Remote Code Execution
Vendor: IBM
Description: Heap-based buffer overflow in the Ole API in the CQOle
ActiveX control in cqole.dll in IBM Rational ClearQuest 7.1.1 before
7.1.1.9, 7.1.2 before 7.1.2.6, and 8.0.0 before 8.0.0.2 allows remote
attackers to execute arbitrary code via a crafted web page that
leverages a RegisterSchemaRepoFromFileByDbSet function-prototype
mismatch.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
ID: CVE-2012-2181
Title: IBM WebSphere Portal Dojo Module Directory Traversal
Vendor: IBM
Description: Directory traversal vulnerability in the Dojo module in IBM
WebSphere Portal 7.0.0.1 and 7.0.0.2 before CF14, and 8.0, allows remote
attackers to read arbitrary files via a crafted URL.
CVSS v2 Base Score: 7.8 (AV:N/AC:L/Au:N/C:C/I:N/A:N)
MOST POPULAR MALWARE FILES 7/4/2012 - 7/10/2012:
COMPILED BY SOURCEFIRE
SHA 256: 9A09BCC1402050E371E13056B606BBDE8DF15CD87732B28C8BDDB863B1C65302
MD5: 923c4d13bee966654f4fe4a8945af0ae
VirusTotal: https://www.virustotal.com/file/9A09BCC1402050E371E13056B606BBDE8DF15CD87732B28C8BDDB863B1C65302/analysis/
Malwr: http://malwr.com/analysis/923c4d13bee966654f4fe4a8945af0ae
Typical Filename:
Claimed Product: -
Claimed Publisher: -
SHA 256: CB85D393C4E0DB5A1514C21F9C51BA4C12D82B7FABD9724616758AE528A5B16B
MD5: 7961a56c11ba303f20f6a59a506693ff
VirusTotal: https://www.virustotal.com/file/CB85D393C4E0DB5A1514C21F9C51BA4C12D82B7FABD9724616758AE528A5B16B/analysis/
Malwr: http://malwr.com/analysis/7961a56c11ba303f20f6a59a506693ff
Typical Filename: m3SrchMn.exe
Claimed Product: My Web Search Bar
Claimed Publisher: MyWebSearch.com
SHA 256: DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C
MD5: 25aa9bb549ecc7bb6100f8d179452508
VirusTotal: https://www.virustotal.com/file/DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C/analysis/
Malwr: http://malwr.com/analysis/25aa9bb549ecc7bb6100f8d179452508
Typical Filename: 25AA9BB549ECC7BB6100F8D179452508
Claimed Product: -
Claimed Publisher: -
SHA 256: E0B193D47609C9622AA018E81DA69C24B921F2BA682F3E18646A0D09EC63AC2B
MD5: bf31a8d79f704f488e3dbcb6eea3b3e3
VirusTotal: https://www.virustotal.com/file/E0B193D47609C9622AA018E81DA69C24B921F2BA682F3E18646A0D09EC63AC2B/analysis/
Malwr: http://malwr.com/analysis/bf31a8d79f704f488e3dbcb6eea3b3e3
Typical Filename: pspprn.sys
Claimed Product: -
Claimed Publisher: -
SHA 256: 0585CDC0293EA6B8C86482608C08C583BF32E12CFA59D143F4A0411D2894C0F3
MD5: b3b9295385f4e74d023181e5a24f4d83
VirusTotal: https://www.virustotal.com/file/0585CDC0293EA6B8C86482608C08C583BF32E12CFA59D143F4A0411D2894C0F3/analysis/
Malwr: http://malwr.com/analysis/b3b9295385f4e74d023181e5a24f4d83
Typical Filename: keygen.exe
Claimed Product: -
Claimed Publisher: -
(c) 2012. All rights reserved. The information contained in this newsletter, including any external links, is provided "AS IS," with no express or implied warranty, for informational purposes only.
Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit https://www.sans.org/account
