@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data
A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.
April 18, 2013=============================================================
@RISK: The Consensus Security Vulnerability Alert
Vol. 13, Num. 16
Providing a reliable, weekly summary of newly discovered attack vectors, vulnerabilities with active exploits, and explanations of how recent attacks worked.
=============================================================CONTENTS:
NOTABLE RECENT SECURITY ISSUES
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST POPULAR MALWARE FILES 4/9/2013 - 4/16/2013
============================================================TOP VULNERABILITY THIS WEEK: Microsoft is warning users not to install MS13-036, as certain users' systems are failing to boot after applying the patch. The issue is, as of the time of writing, still being diagnosed by Microsoft, who will presumably issue an updated patch as soon as QA is complete.
***************** Sponsored By SANS ****************
Attend the SANS 20 Critical Security Control Briefing, Thursday, April 18, 2013 in Washington, DC at the JW Marriott. Tony Sager and John Pescatore will provide an overview of the 20CC, showcase the 20CC In Action, and also moderate a Vendor Panel. Event is free to Government attendees. For more information go to http://www.sans.org/info/128292
To register for this event via simulcast, visit http://www.sans.org/info/128297
============================================================TRAINING UPDATE
- -- SANS Security West 2013 San Diego, CA May 7-May 16, 2013
32 courses. Bonus evening sessions include Gone in 60 Minutes; The
Ancient Art of Falconry; and You Can Panic Now. Host Protection is
(Mostly) Dead.
http://www.sans.org/event/security-west-2013
- -- SANSFIRE 2013 Washington, DC June 14-22, 2013
41 courses. Bonus evening sessions include Avoiding Cyberterrorism
Threats Inside Hydraulic Power Generation Plants; and Automated Analysis
of Android Malware.
http://www.sans.org/event/sansfire-2013
- -- SANS Rocky Mountain 2013 Denver, CO July 14-20, 2013
10 courses. Bonus evening sessions include OODA - The Secret to
Effective Security in Any Environment; and APT: It is Not Time to Pray,
It is Time to Act.
http://www.sans.org/event/rocky-mountain-2013
- -- SANS Secure Europe 2013 Amsterdam, Netherlands April 15-April 27, 2013
10 courses.
http://www.sans.org/event/secure-europe-2013
- -- Critical Security Controls International Summit London, UK April 26-May 2 2013
Including SEC566: Implementing and Auditing the 20 Critical Security
Controls led by Dr. Eric Cole.
http://www.sans.org/event/critical-security-controls-international-summit
- -- SANS Pen Test Berlin 2013 Berlin, Germany June 2-June 8, 2013
Europe's only specialist pen test training and networking event. Five
dedicated pen test training courses led by five SANS world-class
instructors.
http://www.sans.org/event/pentest-berlin-2013
- -- Looking for training in your own community?
http://www.sans.org/community/
- -- Save on On-Demand training (30 full courses) - See samples at
http://www.sans.org/ondemand/specials
Plus Bangalore, Johannesburg, Malaysia, and Canberra all in the next 90 days.
For a list of all upcoming events, on-line and live: www.sans.org
********************* Sponsored Links: *********************
1) Attend the Mobile Device Security Summit where experts and
practitioners will detail proven approaches to securing BYOD.
http://www.sans.org/info/129290
2) "Data Center Virtualization from a Security Perspective," featuring
Dave Shackleford and Deepak Thakkar, Wednesday, May 1, at 1 PM EDT
http://www.sans.org/info/129295
3) There's not much time left to take the SANS survey on the Critical
Security Controls and enter to win a new iPad!
http://www.sans.org/info/129300
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM
Title: Microsoft patch causing systems to die after application
Description: Certain users are reporting that applying MS13-036 to their
Windows systems is causing those machines to fail to boot afterwards,
and Microsoft has officially warned users not to apply the patch until
a fix can be identified. The patch addresses locally exploitable bugs,
so the risk of breakage from the patch is most likely higher than the
risk of leaving the vulnerability open for the time being.
Reference:
http://support.microsoft.com/kb/2823324
Snort SID: N/A
ClamAV: N/A
Title: HP Intelligent Management Center arbitrary code execution exploit released
Description: A public exploit was released this week for an arbitrary
code execution identified in March for the HP Intelligent Management
Center product, an enterprise network management solution.
Administrators who have not previously patched should do so as soon as
possible.
Reference:
http://seclists.org/bugtraq/2013/Mar/45
Snort SID: 26416, 26417
ClamAV: N/A
Title: Asterisk SIP SDP header buffer overflow
Description: A pair of trivially exploitable buffer overflows were
patched in the Asterisk SIP SDP header parsing code recently, with
values as small as 17 bytes in certain fields sufficient to trigger
memory corruption. Administrators are urged to patch immediately, as
working exploits can be trivially crafted using existing shellcode
libraries for the target platforms.
http://osvdb.org/show/osvdb/91753
Snort SID: 26425, 26426
ClamAV: N/A
Title: Squid proxy server denial of service
Description: A surprisingly simple denial of service was patched earlier
this month in the popular Squid proxy server software package.
Specifically, if the "Accept-Language" header of an HTTP request begins
with a comma, an infinite loop in the product's error routine will
ensue, rapidly leading to a service (and possibly operating system)
crash. Administrators should patch promptly, as this issue could be
exploited by the simplest of tools.
Reference:
http://osvdb.org/show/osvdb/90910
Snort SID: 26379
ClamAV: N/A
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
Java applet attack wipes out Bitcoin accounts on MtGox:
http://techcrunch.com/2013/04/11/mt-gox-cross-site-scripting-attack-wipes-out-bitcoin-accounts/
90% of game hacks infected with malware:
http://blogs.avg.com/news-threats/avg-insight-90-game-hacks-infected-malware/
Gaming company certificates stolen and used to attack activists:
http://www.wired.com/threatlevel/2013/04/gaming-company-certs-stolen/
How mobile spammers verify the validity of harvested phone numbers:
http://blog.webroot.com/2013/04/16/how-mobile-spammers-verify-the-validity-of-harvested-phone-numbers-part-two/
SET (Social Engineering Toolkit) 5.0 released:
https://www.trustedsec.com/april-2013/the-social-engineer-toolkit-set-version-5-0-the-wild-west/
The bug that caught PayPal with its pants down:
http://www.theregister.co.uk/2013/04/15/paypal_sql_injection/
RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM.
This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.
ID: CVE-2013-0632
Title: Adobe ColdFusion APSB13-03 Remote Exploit
Vendor: Adobe
Description: Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote
attackers to bypass authentication and possibly execute arbitrary code
via unspecified vectors, as exploited in the wild in January 2013.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
ID: CVE-2013-1080
Title: Novell ZENworks Configuration Management Remote Execution
Vendor: Novell
Description: The web server in Novell ZENworks Configuration Management
(ZCM) 10.3 and 11.2 does not properly perform authentication for
zenworks/jsp/index.jsp, which allows remote attackers to conduct
directory traversal attacks, and consequently upload and execute
arbitrary programs, via a request to TCP port 443.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
ID: CVE-2013-1892
Title: MongoDB nativeHelper.apply Remote Code Execution
Vendor: MongoDB.org
Description: Remote exploitation of an input validation error
vulnerability in versions 2.2.3 of mongoDB, as included in various
vendors' operating system distributions, could allow attackers to
execute arbitrary code on the targeted host. An input validation error
vulnerability exists in monogoDB. Specifically, the vulnerable
server-side process fails to sanitize user input passed through the
"nativeHelper.apply()" function.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
ID: CVE-2012-5879
Title: McAfee Virtual Technician ActiveX Control Insecure Method
Vendor: McAfee
Description: An ActiveX control in McHealthCheck.dll in McAfee Virtual
Technician (MVT) and ePO-MVT 6.5.0.2101 and earlier allows remote
attackers to modify or create arbitrary files via a full pathname
argument to the Save method.
CVSS v2 Base Score: 8.2 (AV:N/AC:M/Au:S/C:C/I:C/A:P)
ID: CVE-2013-1493
Title: Oracle Java SE JVM 2D Subcomponent Remote Code Execution Vulnerability (Oracle Security Alert for CVE-2013-1493)
Vendor: Oracle
Description: The color management (CMM) functionality in the 2D
component in Oracle Java SE 7 Update 15 and earlier, 6 Update 41 and
earlier, and 5.0 Update 40 and earlier allows remote attackers to
execute arbitrary code or cause a denial of service (crash) via an image
with crafted raster parameters, which triggers (1) an out-of-bounds read
or (2) memory corruption in the JVM, as exploited in the wild in
February 2013.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
MOST POPULAR MALWARE FILES 4/9/2013 - 4/16/2013:
COMPILED BY SOURCEFIRE
SHA 256: D14B66BD4C4C8F66A6EDF2820FD4162D09B326BEAF6A42014596571E81A1A503
MD5: 68b7f7a26b76805432e3d50009d2ab1f
VirusTotal: https://www.virustotal.com/file/D14B66BD4C4C8F66A6EDF2820FD4162D09B326BEAF6A42014596571E81A1A503/analysis/
Typical Filename: winijskuo.exe
Claimed Product: winijskuo.exe
Claimed Publisher: winijskuo.exe
SHA 256: 5A9AFC24B0B0C8E565094EA386A7E9369BAB7BCBA9B1D5A992EE3A7FD69D9F81
MD5: 59f9f5ce65a6b2e3ec401b585ab90ba1
VirusTotal: https://www.virustotal.com/file/5A9AFC24B0B0C8E565094EA386A7E9369BAB7BCBA9B1D5A992EE3A7FD69D9F81/analysis/
Typical Filename: b4182854f7531e4f363e641ebdba33e3d9dfa691
Claimed Product: b4182854f7531e4f363e641ebdba33e3d9dfa691
Claimed Publisher: b4182854f7531e4f363e641ebdba33e3d9dfa691
SHA 256: E0B193D47609C9622AA018E81DA69C24B921F2BA682F3E18646A0D09EC63AC2B
MD5: bf31a8d79f704f488e3dbcb6eea3b3e3
VirusTotal: https://www.virustotal.com/file/E0B193D47609C9622AA018E81DA69C24B921F2BA682F3E18646A0D09EC63AC2B/analysis/
Typical Filename: klplmq.sys
Claimed Product: klplmq.sys
Claimed Publisher: klplmq.sys
SHA 256: F09AFC177AFBC8E2D36A57D105D3F79A70EC2E36701C9759E19D54A009279F11
MD5: 3b7a992ae53ebb41dd1e566e4172e9c0
VirusTotal: https://www.virustotal.com/file/F09AFC177AFBC8E2D36A57D105D3F79A70EC2E36701C9759E19D54A009279F11/analysis/
Typical Filename: winxeyfe.exe
Claimed Product: winxeyfe.exe
Claimed Publisher: winxeyfe.exe
SHA 256: 1A5997406EF0960F86D31E404B95A40CC03DE4DB6279B16030ACCFC62F97CF3E
MD5:
VirusTotal: https://www.virustotal.com/file/1A5997406EF0960F86D31E404B95A40CC03DE4DB6279B16030ACCFC62F97CF3E/analysis/
Typical Filename:
Claimed Product:
Claimed Publisher:
(c) 2013. All rights reserved. The information contained in this newsletter, including any external links, is provided "AS IS," with no express or implied warranty, for informational purposes only.
Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit https://www.sans.org/account
