@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data
A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.
July 19, 2012=============================================================
@RISK: The Consensus Security Vulnerability Alert
Vol. 12, Num. 29
Providing a reliable, weekly summary of newly discovered attack vectors, vulnerabilities with active exploits, and explanations of how recent attacks worked.
=============================================================CONTENTS:
NOTABLE RECENT SECURITY ISSUES
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST POPULAR MALWARE FILES 7/11/2012 - 7/17/2012
============================================================TOP VULNERABILITY THIS WEEK: With the assistance of a Sourcefire customer reporting back on live threats seen in their environment, the Sourcefire VRT this week discovered what appears to be a new malicious JavaScript kit that is redirecting to exploit kits and traffic direction systems. As always, users should be careful when clicking links in emails and visiting suspect web sites.
============================================================NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM
Title: Microsoft IIS File Disclosure / Denial-of-Service
Description: Independent security researcher Soroush Dalili recently
discovered a mechanism of using Windows' built in file name shortening
algorithm to determine whether particular files exist on a web server,
including files within protected directories. Using this same mechanism
with a particular set of wildcards, it is possible to cause a denial of
service, causing the filesystem to issue an abnormally large number of
requests. Publicly available scanning tools exist, and no patch is
currently available. The initial advisory, however, details remediation
steps, including applicable best practices from Microsoft.
Reference: http://soroush.secproject.com/downloadable/microsoft_iis_tilde_character_vulnerability_feature.pdf
http://support.microsoft.com/kb/121007
Snort SID: 23360 - 23362
ClamAV: N/A
Title: New In-The-Wild Malicious Redirection Kit
Description: The Sourcefire VRT has been made aware of a new kit used
to obfuscate malicious redirections. This kit, which was discovered and
reported by a Sourcefire customer, sends users to a TDS Sutra
redirection system, and from there on to either an exploit kit or an ad
fraud scheme. At the time of this release, antivirus detection was very
low (3 / 42 vendors per VirusTotal). As always, security analysts should
be suspicious of heavily obfuscated JavaScript and long redirection
chains.
Reference: http://vrt-blog.snort.org/2012/07/power-of-open-source-intelligence.html
Snort SID:23841, 23842
ClamAV: JS.Obfus-218
Title: CVE-2012-0663 Apple Quicktime TeXML Buffer Overflows
Description: Multiple stack-based buffer overflows are present in the
way that Apple QuickTime parses TeXML files. A patch was released in
mid-May, but public proof-of-concept and a Metasploit module were
recently released. Due to the simple nature of exploit development for
stack-based overflows in ASCII file formats, and the widespread
deployment of the target software, widespread exploitation in the wild
is likely already underway.
Reference: http://support.apple.com/kb/HT5261
http://0x1byte.blogspot.com/2012/06/cve-2012-0663-and-cve-2012-0664-samples.html
Snort SID: 23461 - 23465
ClamAV: BC.Exploit.CVE_2012_0663
Title: Multiple Antivirus Engine File Parsing Evasions
Description: University of Texas professors Suman Jana and Vitaly
Shmatikov recently released a paper detailing multiple file format
obfuscations that could be used to bypass antivirus detection across a
range of vendors. While impacted vendors have released updated engines
as necessary (ClamAV users should be running 0.97.5, released in July,
to ensure they are not impacted), millions of clients around the world
are likely still running engines vulnerable to this evasion. Targeted
attacks in the wild using these bypass techniques are likely.
Reference: http://www.cs.utexas.edu/~shmat/shmat_oak12av.pdf
Snort SID: 23309 - 23313, 23318, 23323 - 23329, 23351, 23357, 23358
ClamAV: N/A
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
Introduction to Reverse Engineering videos:
http://opensecuritytraining.info/ChangeBlog/Entries/2012/7/1_Videos_for_day_1_of_Introduction_to_Reverse_Engineering_Software_released!.html
A series of SQL injection challenges:
http://www.websec.ca/blog/view/sql-injection-challenges
Web exploit figures out what OS victim is running, customizes payload:
http://arstechnica.com/security/2012/07/cross-platform-web-exploit/
Instagram vulnerability can let strangers access your photos and more:
http://blog.eset.com/2012/07/11/instagram-vulnerability-can-allow-strangers-access-to-photos-and-more
Spamvertised American Airlines emails lead to Blackhole exploit kit:
http://blog.webroot.com/2012/07/13/spamvertised-american-airlines-themed-emails-lead-to-black-hole-exploit-kit/
RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM.
This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.
ID: CVE-2012-0663
Title: Apple QuickTime TeXML Buffer Overflow Vulnerability
Vendor: Apple
Description: Multiple stack-based buffer overflows in Apple QuickTime
before 7.7.2 on Windows allow remote attackers to execute arbitrary code
or cause a denial of service (application crash) via a crafted TeXML
file.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
ID: CVE-2012-0664
Title: Apple QuickTime Heap Based Buffer Overflow Vulnerability
Vendor: Apple
Description: Heap-based buffer overflow in Apple QuickTime before 7.7.2
on Windows allows remote attackers to execute arbitrary code or cause a
denial of service (application crash) via a crafted text track in a
movie file.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
ID: CVE-2012-1723
Title: Oracle Java SE Remote Code Execution Vulnerability / Blackhole Exploit Kit
Vendor: Oracle
Description: Unspecified vulnerability in the Java Runtime Environment
(JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32
and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows
remote attackers to affect confidentiality, integrity, and availability
via unknown vectors related to Hotspot.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
ID: CVE-2012-1889
Title: Vulnerability in Microsoft XML Core Services Could Allow Remote Code Execution (MS12-043)
Vendor: Microsoft
Description: Microsoft XML Core Services 3.0, 4.0, 5.0, and 6.0 accesses
uninitialized memory locations, which allows remote attackers to execute
arbitrary code or cause a denial of service (memory corruption) via a
crafted web site.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
ID: CVE-2012-1890
Title: Microsoft Windows Kernel-Mode Drivers Elevation of Privilege Vulnerability (MS12-047)
Vendor: Microsoft
Description: win32k.sys in the kernel-mode drivers in Microsoft Windows
XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows
Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not
properly handle keyboard-layout files, which allows local users to gain
privileges via a crafted application, aka "Keyboard Layout
Vulnerability."
CVSS v2 Base Score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)
MOST PREVALENT MALWARE FILES 7/11/2012 - 7/17/2012:
COMPILED BY SOURCEFIRE
SHA 256: 9A09BCC1402050E371E13056B606BBDE8DF15CD87732B28C8BDDB863B1C65302
MD5: 923c4d13bee966654f4fe4a8945af0ae
VirusTotal: https://www.virustotal.com/file/9A09BCC1402050E371E13056B606BBDE8DF15CD87732B28C8BDDB863B1C65302/analysis/
Malwr: http://malwr.com/analysis/923c4d13bee966654f4fe4a8945af0ae
Typical Filename:
Claimed Product: -
Claimed Publisher: -
SHA 256: DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C
MD5: 25aa9bb549ecc7bb6100f8d179452508
VirusTotal: https://www.virustotal.com/file/DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C/analysis/
Malwr: http://malwr.com/analysis/25aa9bb549ecc7bb6100f8d179452508
Typical Filename: -
Claimed Product: -
Claimed Publisher: -
SHA 256: E0B193D47609C9622AA018E81DA69C24B921F2BA682F3E18646A0D09EC63AC2B
MD5: bf31a8d79f704f488e3dbcb6eea3b3e3
VirusTotal: https://www.virustotal.com/file/E0B193D47609C9622AA018E81DA69C24B921F2BA682F3E18646A0D09EC63AC2B/analysis/
Malwr: http://malwr.com/analysis/bf31a8d79f704f488e3dbcb6eea3b3e3
Typical Filename: pspprn.sys
Claimed Product: -
Claimed Publisher: -
SHA 256: DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C
MD5: 25aa9bb549ecc7bb6100f8d179452508
VirusTotal: https://www.virustotal.com/file/DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C/analysis/
Malwr: http://malwr.com/analysis/25aa9bb549ecc7bb6100f8d179452508
Typical Filename: 25AA9BB549ECC7BB6100F8D179452508
Claimed Product: -
Claimed Publisher: -
SHA 256: 0585CDC0293EA6B8C86482608C08C583BF32E12CFA59D143F4A0411D2894C0F3
MD5: b3b9295385f4e74d023181e5a24f4d83
VirusTotal: https://www.virustotal.com/file/0585CDC0293EA6B8C86482608C08C583BF32E12CFA59D143F4A0411D2894C0F3/analysis/
Malwr: http://malwr.com/analysis/b3b9295385f4e74d023181e5a24f4d83
Typical Filename: keygen.exe
Claimed Product: -
Claimed Publisher: -
(c) 2012. All rights reserved. The information contained in this newsletter, including any external links, is provided "AS IS," with no express or implied warranty, for informational purposes only.
Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit https://www.sans.org/account
