@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data
A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.
October 24, 2013=============================================================
@RISK: The Consensus Security Vulnerability Alert
Vol. 13, Num. 43
Providing a reliable, weekly summary of newly discovered attack vectors, vulnerabilities with active exploits, and explanations of how recent attacks worked.
=============================================================CONTENTS:
NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES 10/14/2013 - 10/18/2013
============================================================TOP VULNERABILITY THIS WEEK: Multiple Backdoors in Routers
******************** Sponsored By Bit9 *********************
Do you have maximum malware visibility across both your network and
endpoint? Forrester analysts agree the future of enterprise security is
a single, consolidated solution delivering maximum detection, response,
and protection across both the endpoint and network. Download this
report to understand the strategy behind a new generation of enterprise
security. Learn More
http://www.sans.org/info/141715
TRAINING UPDATE
- -- Securing the Internet of Things Summit (October 17-22, 2013) San Francisco, CA
The Internet of Things summit focuses on new solutions, demonstrates
security technology that already works and provides a force multiplier
to make the Internet of Things more secure.
http://www.sans.org/event/internet-of-things-summit
- -- Health Care Cyber Security Summit (October 17-24, 2013) San Francisco, CA
Meet leaders from the top health care organizations and see what really
works in securing and succeeding in the new health care environment -
balance security, compliance, and innovation.
http://www.sans.org/event/healthcare-summit
--SANS Chicago 2013 Chicago, ILOctober 28-November 2, 2013
7 courses. Bonus evening presentations include SANS 8 Mobile Device
Security Steps; and Privileged Domain Account Protection: How to Limit
Credentials Exposure.
http://www.sans.org/event/chicago-2013
--South Florida 2013 Ft. Lauderdale, IL November 4-9, 2013 5 courses. Bonus evening presentations include The Security Impact of IPv6; Evolving Threats; and Real-World Risk - What Incident Responders Can leverage from IT Operations. http://www.sans.org/event/south-florida-2013
- --October Singapore 2013 Singapore, Singapore October 21-November 2, 2013
5 courses. Bonus evening presentations include Pen Testing the Smart
Grid; and You Can Panic Now. Host Protection is (Mostly) Dead.
http://www.sans.org/event/singapore-sos-2013
- -- SANS Dubai 2013Dubai, UAEOctober 26th - November 7th 2013
SANS returns to Dubai with four essential courses at the Hilton Jumeirah Beach.
http://www.sans.org/event/dubai-2013
- -- SANS London 2013 London, UKNovember 16-25, 2013
17 courses. Bonus evening presentations include Real World Risk - What
Incident Responders Can Leverage From IT Operations; Information
Assurance Metrics: Practical Steps to Measurement; and APT: It Is Time
To Act.
http://www.sans.org/event/london-2013
- -- Multi-week Live SANS training
http://www.sans.org/mentor/about
Contact mentor@sans.org
- -- Looking for training in your own community?
http://www.sans.org/community/
- --Save on On-Demand training (30 full courses) - See samples at
http://www.sans.org/ondemand/specials
Plus Johannesburg, Abu Dhabi, Seoul, and Bangalore all in the next 90 days. For a list of all upcoming events, on-line and live: www.sans.org
********************** Sponsored Links: ********************1) Analyst Webcast: Not your Father's IPS: SANS Survey on Network Security Results, featuring Rob Vandenbrink, Tuesday October 29 at 1 PM EDT. http://www.sans.org/info/141720
2) Analyst Webcast: Finding Hidden Threats by Decrypting SSL Traffic
featuring J. Michael Butler Friday, Nov. 8 at 1 PM EDT.
http://www.sans.org/info/141725
3) Thank you for attending our webcast on Testing Next-Generation
Firewalls, featuring Dr. Eric Cole, Patrick Bedwell and Phil Trainor.
As promised, here is the link to the associated SANS whitepaper:
http://www.sans.org/info/141730
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM
Title: Tenda W302R wireless router w302r_mfg remote code execution
Description: By sending a UDP packet with a certain string in the
content, the user is able to make the router execute commands remotely.
This backdoor only works on the local lan. This backdoor was likely
first implemented in Tendas W302R router, although it also exists in the
Tenda W330R, as well as re-branded models, such as the Medialink
MWN-WAPR150N.
Reference:
http://www.devttys0.com/2013/10/from-china-with-love/
Snort SID: 28289-28290
ClamAV:N/A
Title: WHMCS 5.2.8 Vulnerability
Description: Through the manipulation of variables, files are able to
be written to a remote install of WHMCS.
Reference:
http://thehackernews.com/2013/10/web-hosting-software-whmcs-vulnerable.html
Snort SID: 28299
ClamAV: N/A
Title: Kore, Nuclear, and Magnitude Exploit Kits are on the rise
Description: Various Exploit Kits are scrambling to take the "King of
the Hill" title after the arrest of 'pauch' the author of the Blackhole
and Cool Exploit Kits.
Reference:
http://vrt-blog.snort.org/2013/10/sweet-orange-exploit-kit-was-new-king.html
Snort SID: Multiple
ClamAV: Multiple
Title: Apple Releases OSX Mavericks, iOS 7.0.3
Description: Apple has released the newest version of their OS for both
the iOS platform and the Desktop. Many security vulnerabilities are
fixed in these releases, and both releases are free.
Reference:
http://www.apple.com
Snort SID: N/A
ClamAV: N/A
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
Apache fixes Information Disclosure Vulnerability in Shindig
http://threatpost.com/apache-fixes-information-disclosure-vulnerability-in-shindig/102650
Court Rules Probable-Cause Warrant Required for GPS Trackers
http://www.wired.com/threatlevel/2013/10/warrant-required-gps-trackers/
Social Threats of Greatest Risk Concern for Executives
https://www.infosecisland.com/blogview/23434-Social-Threats-of-Greatest-Risk-Concern-for-Executives.html
Generation Y Users Say They Will Break Corporate BYOD Rules
http://www.darkreading.com/management/generation-y-users-say-they-will-break-c/240162955
RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM.
This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.
ID: CVE-2013-2333
Title: HP Data Protector Cell Request Service Buffer Overflow
Vendor: HP
Description: Unspecified vulnerability in HP Storage Data Protector
6.20, 6.21, 7.00, and 7.01 allows remote attackers to execute arbitrary
code via unknown vectors, aka ZDI-CAN-1680.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
ID: Not Available
Title: D-Link Authentication Security Bypass Vulnerability
Vendor: D-Link
Description: A remote exploitation of a design error vulnerability in
D-Link Systems Inc.'s routers could allow attackers to bypass
authentication security restrictions. The router allows any user with a
Web browser having the user agent string
"xmlset_roodkcableoj28840ybtide" to gain access to the Web interface of
the device without the requirement for any authentication credentials.
Affects D-Link Firmware v1.13 and other versions may also be affected.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
ID: CVE-2013-3897
Title: Microsoft Internet Explorer CDisplayPointer Use-After-Free (MS13-080)
Vendor: Microsoft
Description: Use-after-free vulnerability in the CDisplayPointer class
in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote
attackers to execute arbitrary code or cause a denial of service (memory
corruption) via crafted JavaScript code that uses the onpropertychange
event handler, as exploited in the wild in September and October 2013,
aka "Internet Explorer Memory Corruption Vulnerability."
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
ID: Not Available
Title: Joomla! Unauthorised Uploads
Vendor: Joomla!
Description: Inadequate filtering leads to the ability to bypass file
type upload restrictions.
Affects Joomla! version 2.5.13 and earlier 2.5.x versions; and version
3.1.4 and earlier 3.x versions
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
ID: CVE-2013-2251
Title: Apache Struts 2 DefaultActionMapper Prefixes OGNL Code Execution
Vendor: Apache
Description: Apache Struts 2.0.0 through 2.3.15 allows remote attackers
to execute arbitrary OGNL expressions via a parameter with a crafted (1)
action:, (2) redirect:, or (3) redirectAction: prefix.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
MOST PREVALENT MALWARE FILES 10/14/2013 - 10/18/2013
COMPILED BY SOURCEFIRE
SHA 256: CA66FE4F11D4CE764F9348BEA9EBDE18A57F9DA928FE381D434A9DE2882D1BB1
MD5: 8ed6e23731912c9a1da25223422487b3
VirusTotal:
https://www.virustotal.com/en/file/CA66FE4F11D4CE764F9348BEA9EBDE18A57F9DA928FE381D434A9DE2882D1BB1/analysis/
Typical Filename: Random
Claimed Product: None
Claimed Publisher: None
Detection Name: Sality
SHA 256: 6F2717BCC3428D7044C488976788695B60F1C3F9F29AA791DEAA31E21A3F049D
MD5: a2a4e91cdf63cfdd05592d355335bcaa
VirusTotal:
https://www.virustotal.com/en/file/6F2717BCC3428D7044C488976788695B60F1C3F9F29AA791DEAA31E21A3F049D/analysis/
Typical Filename: Random
Claimed Product: None
Claimed Publisher: None
Detection Name: Sality
SHA 256: 7BEB3EAED035809B9F9DC11ABBD8B33ADC534ED1F2AC80D096C57820330A6E80
MD5: 0b62417da5719b3ea1d343da3431c97f
VirusTotal:
https://www.virustotal.com/en/file/7BEB3EAED035809B9F9DC11ABBD8B33ADC534ED1F2AC80D096C57820330A6E80/analysis/
Typical Filename: FLVPlayerUpdate_downloader_by_FLVPlayerUpdate.exe
Claimed Product: Somoto
Claimed Publisher: BetterInstaller
Detection Name: Somoto
SHA 256: d14b66bd4c4c8f66a6edf2820fd4162d09b326beaf6a42014596571e81a1a503
MD5: 68b7f7a26b76805432e3d50009d2ab1f
VirusTotal:
https://www.virustotal.com/en/file/D14B66BD4C4C8F66A6EDF2820FD4162D09B326BEAF6A42014596571E81A1A503/analysis/
Typical Filename: W32.Agent:B.16lp.1201
Claimed Product: W32.Agent:B.16lp.1201
Claimed Publisher: W32.Agent:B.16lp.1201
Detection Name: W32.Agent:B.16lp.1201
SHA 256: D41F20AF6D1664BEDC12DF152849BC058D31D9563B9FA973B71BCCEEE17EDB80
MD5: 918007c1311c833b58f50b59b454266d
VirusTotal:
https://www.virustotal.com/en/file/D41F20AF6D1664BEDC12DF152849BC058D31D9563B9FA973B71BCCEEE17EDB80/analysis/
Typical Filename: WebCakeDesktop.exe
Claimed Product: WebCakeDesktop.exe
Claimed Publisher: WebCakeDesktop.exe
Detection Name: W32.WebCake:WebcakeAAdw.16lo.hw
(c) 2013. All rights reserved. The information contained in this newsletter, including any external links, is provided "AS IS," with no express or implied warranty, for informational purposes only.
Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit https://www.sans.org/account
