@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data
A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.
January 10, 2013=============================================================
@RISK: The Consensus Security Vulnerability Alert
Vol. 13, Num. 01
Providing a reliable, weekly summary of newly discovered attack vectors, vulnerabilities with active exploits, and explanations of how recent attacks worked.
=============================================================CONTENTS:
NOTABLE RECENT SECURITY ISSUES
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST POPULAR MALWARE FILES 1/3/2013 - 1/9/2013
============================================================TOP VULNERABILITY THIS WEEK: Attacks are occurring in the wild against the Adobe ColdFusion administrative API, allowing remote users to execute commands through some simple web queries. After being discovered by impacted administrators, Adobe issued a patch last Friday, which administrators are urged to apply as soon as possible.
============================================================TRAINING UPDATE
- --SANS Security East 2013 New Orleans, LA January 16-23, 2013
11 courses. Bonus evening presentations include The Next Wave - Data
Center Consolidation; Top Threats to Cloud for 2013; and Hacking Your
Friends and Neighbors for Fun. Special Event: NetWars Tournament of
Champions.
http://www.sans.org/event/security-east-2013
- --North American Industrial Controls Systems and SCADA Summit 2013
Lake Buena Vista, FL February 6-13, 2013
The only technical security and training program in ICS security - for
program managers, control systems engineers, IT security professionals
and critical infrastructure protection specialists from asset owning and
operating organizations along with control systems and security vendors
who have innovative solutions for improving security. Every attendee
leaves with new tools and techniques they can put to work immediately.
8 courses. Bonus evening presentation: The SANS SCADA Dinner Theater
Players Present: From Exposure to Closure - Act III.
http://www.sans.org/event/north-american-scada-2013
- --SANS Secure Singapore 2013 February 25-March 2, 2013
6 courses. Bonus evening presentation: Security of National eID
(smartcard-based) Web Applications.
http://www.sans.org/event/singapore-2013
- --SANS 2013 Orlando, FL March 8-March 15, 2013
46 courses. Bonus evening presentations include Why Our Defenses Are
Failing Us: One Click Is All It Takes ...; Human Nature and Information
Security: Irrational and Extraneous Factors That Matter; and
Over-Zealous Social Media Investigations: Beware the Privacy Monster.
http://www.sans.org/event/sans-2013
- --SANS Monterey 2013 Monterey, CA March 22-March 27, 2013
7 courses. Bonus evening presentations include Base64 Can Get You
Pwned!; and The 13 Absolute Truths of Security.
http://www.sans.org/event/monterey-2013
- --Looking for training in your own community?
http://www.sans.org/community/
- --Save on On-Demand training (30 full courses) - See samples at
http://www.sans.org/ondemand/discounts.php#current
Plus Cairo, New Delhi, Scottsdale, Brussels, Johannesburg, and Canberra all in the next 90 days.
For a list of all upcoming events, on-line and live: www.sans.org
============================================================NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM
Title: ColdFusion Zero-Day Attack Allows Full Administrative Control
Description: A major vulnerability in Adobe's ColdFusion product was
patched this week, after being discovered on Christmas day by system
administrators noting intrusions in their logs. While details of the
precise mechanism used by the exploit have been kept largely quiet, to
help slow the spread of these attacks, the issue revolves around
unauthenticated access to administrative APIs, which allows attackers
to create scheduled jobs on the vulnerable system as a path to further
code execution. Administrators should apply patches immediately, and
also ensure that all remote access to administrative APIs are
appropriately locked down.
Reference:
http://www.adobe.com/support/security/advisories/apsa13-01.html
http://www.carehart.org/blog/client/index.cfm/2013/1/2/Part2_serious_security_threat
http://forums.adobe.com/message/4962104
Snort SID: 25266, 25267
ClamAV: N/A
Title: Turktrust Certificate Authority Mishap Leads To Fraudulent Certificates for Google
Description: After discovering a fraudulent SSL certificate for
"*.google.com" on Christmas Eve, the Google security team traced the
issue to Turktrust, a Turkish certificate authority. Instead of issuing
simple SSL certificates to a pair of entities, Turktrust had issued
information sufficient to allow these parties to become intermediate
authorities, which carry the full weight of trust of the parent
authority. Those certificates and others based off of them were revoked
promptly by Chrome, other major browser vendors have followed suit
within the last week. The issue highlights the continuing difficulty of
establishing proper trust relationships with SSL, as it is part of a
string of fraudulent certificate issues discovered over the last year.
Reference:
http://support.microsoft.com/kb/2798897
http://googleonlinesecurity.blogspot.com/2013/01/enhancing-digital-certificate-security.html
http://www.securelist.com/en/blog/208194063/TURKTRUST_CA_Problems
Snort SID: 25263 25264 25265
ClamAV: N/A
Title: Asterisk vulnerability moves from denial-of-service to remote code execution
Description: An Asterisk security advisory released last week covering
crashes due to large chunks of data received via SIP or HTTP, initially
described as a denial-of-service only, has been upgraded to a remote
code execution bug after a detailed writeup by researchers at Exodus
Intelligence on Monday provided a straightforward, reliable method of
manipulating memory in the necessary manner for code execution. While
the researchers did not supply proof-of-concept exploit code, any
attacker with memory manipulation skills will be able to craft their own
exploit based on this new information, and attacks are presumed to be
taking place in the wild at this point. Administrators should apply the
available patch as soon as possible.
Reference:
http://blog.exodusintel.com/2013/01/07/who-was-phone/
http://downloads.asterisk.org/pub/security/AST-2012-014.html
Snort SID: 25276
ClamAV: N/A
Title: US Patent and Trademark Office seeks public comments on enhancing
software patents
Description: While not strictly vulnerability-related themselves,
software patents have a major impact on the security software industry
as a whole, both through their traditional role in spurring innovation
and in the more modern context of potentially keeping useful detection
algorithms or techniques out of the hands of the public until well past
the time that the malware-creation industry has moved to the next
tactic. As this is a rare opportunity for members of the information
security community to make their voices heard in a meaningful way,
anyone with expertise and a relevant opinion is encouraged to
participate in the process.
Reference:
https://www.federalregister.gov/articles/2013/01/03/2012-31594/request-for-comments-and-notice-of-roundtable-events-for-partnership-for-enhancement-of-quality-of
Snort SID: N/A
ClamAV: N/A
Title: Official Debian Wiki, Others Compromised Via MoinMoin Exploit
Description: A trivially exploitable file inclusion vulnerability in
MoinMoin, a popular piece of Wiki software used by Debian and other
major sites, was discovered in late December, and an announcement on the
Debian-Devel mailing list last Friday noted that wiki.debian.org had
been compromised via this vector. While the damage so far appears to be
limited, and no source code appears to have been tainted, such a
high-profile target falling victim to an attack like this is a reminder
that no one is safe without proper patching and vigilance.
Administrators running this service are urged to patch as soon as
possible.
Reference:
http://moinmo.in/SecurityFixes
http://www.openwall.com/lists/oss-security/2012/12/29/6
http://lists.debian.org/debian-devel-announce/2013/01/msg00000.html
Snort SID: 25286
ClamAV: N/A
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
Crimeware author funds exploit buying spree:
http://krebsonsecurity.com/2013/01/crimeware-author-funds-exploit-buying-spree/
RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM.
This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.
ID: : CVE-2012-4792
Title: Microsoft Internet Explorer CDwnBindInfo Object Use-After-Free Vulnerability
Vendor: Microsoft
Description: Use-after-free vulnerability in Microsoft Internet Explorer
6 through 8 allows remote attackers to execute arbitrary code via a
crafted web site that triggers access to an object that (1) was not
properly allocated or (2) is deleted, as demonstrated by a CDwnBindInfo
object, and exploited in the wild in December 2012.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
ID: : CVE-2012-2176
Title: IBM Lotus Quickr 8.2 qp2.cab ActiveX Control Buffer Overflow Vulnerability
Vendor: IBM
Description: Multiple stack-based buffer overflows in a certain ActiveX
control in qp2.cab in IBM Lotus Quickr 8.2 before 8.2.0.27-002a for
Domino allow remote attackers to execute arbitrary code via a long
argument to the (1) Attachment_Times or (2) Import_Times method.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
ID: : CVE-2012-2175
Title: IBM Lotus iNotes "Attachment_Times" ActiveX Buffer Overflow Vulnerability
Vendor: IBM
Description: Buffer overflow in the Attachment_Times method in a certain
ActiveX control in dwa85W.dll in IBM Lotus iNotes 8.5.x before 8.5.3 FP2
allows remote attackers to execute arbitrary code via a long argument.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
ID: : CVE-2012-0202
Title: IBM Cognos TM1 Buffer Overflow Vulnerability
Vendor: IBM
Description: Multiple stack-based buffer overflows in tm1admsd.exe in
the Admin Server in IBM Cognos TM1 9.4.x and 9.5.x before 9.5.2 FP2
allow remote attackers to cause a denial of service (daemon crash) or
possibly execute arbitrary code via crafted data.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
ID: : CVE-2011-5227
Title: Enterasys NetSight nssyslogd.exe Buffer Overflow
Vendor: Enterasys
Description: Stack-based buffer overflow in the Syslog service
(nssyslogd.exe) in Enterasys Network Management Suite (NMS) before
4.1.0.80 allows remote attackers to execute arbitrary code via a long
PRIO field in a message to UDP port 514.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
MOST POPULAR MALWARE FILES 1/3/2013 - 1/9/2013:
COMPILED BY SOURCEFIRE
SHA 256: 9267AAD92DEA47A6A8B2F734037239AB3376E47F969F8B97B64192A820B2A86F
MD5: 3ff52cee72b936c56b4fbb9f970ece74
VirusTotal: https://www.virustotal.com/file/9267AAD92DEA47A6A8B2F734037239AB3376E47F969F8B97B64192A820B2A86F/analysis/
Typical Filename: wintdiyx.exe
Claimed Product: wintdiyx.exe
Claimed Publisher: wintdiyx.exe
SHA 256: DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C
MD5: 25aa9bb549ecc7bb6100f8d179452508
VirusTotal: https://www.virustotal.com/file/DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C/analysis/
Typical Filename: File_0_2.ok
Claimed Product: File_0_2.ok
Claimed Publisher: File_0_2.ok
SHA 256: 0585CDC0293EA6B8C86482608C08C583BF32E12CFA59D143F4A0411D2894C0F3
MD5: b3b9295385f4e74d023181e5a24f4d83
VirusTotal: https://www.virustotal.com/file/0585CDC0293EA6B8C86482608C08C583BF32E12CFA59D143F4A0411D2894C0F3/analysis/
Typical Filename: Keygen.exe
Claimed Product: Keygen.exe
Claimed Publisher: Keygen.exe
SHA 256: E0B193D47609C9622AA018E81DA69C24B921F2BA682F3E18646A0D09EC63AC2B
MD5: bf31a8d79f704f488e3dbcb6eea3b3e3
VirusTotal: https://www.virustotal.com/file/E0B193D47609C9622AA018E81DA69C24B921F2BA682F3E18646A0D09EC63AC2B/analysis/
Typical Filename: lmlkl.sys
Claimed Product: lmlkl.sys
Claimed Publisher: lmlkl.sys
SHA 256: B7B28E855B8C6225C605330760FF4DC407EFC83F72F1A04E974A72189D0F1D96
MD5: 573b6cc513e1b7cd9e35b491eacc38f3
VirusTotal: https://www.virustotal.com/file/B7B28E855B8C6225C605330760FF4DC407EFC83F72F1A04E974A72189D0F1D96/analysis/
Typical Filename: 573b6cc513e1b7cd9e35b491eacc38f3
Claimed Product: 573b6cc513e1b7cd9e35b491eacc38f3
Claimed Publisher: 573b6cc513e1b7cd9e35b491eacc38f3
(c) 2013. All rights reserved. The information contained in this newsletter, including any external links, is provided "AS IS," with no express or implied warranty, for informational purposes only.
Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit https://www.sans.org/account
