@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data
A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.
December 12, 2013=============================================================
@RISK: The Consensus Security Vulnerability Alert
Vol. 13, Num. 49
Providing a reliable, weekly summary of newly discovered attack vectors, vulnerabilities with active exploits, and explanations of how recent attacks worked.
=============================================================CONTENTS:
NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES 12/1/2013 - 12/7/2013
============================================================TOP VULNERABILITY THIS WEEK: Microsoft Tuesday Updates
******************** Sponsored By Lancope ********************Traditional security solutions are not enough to protect organizations
from today's top threats. Learn why internal visibility is a necessity
for network security today, and how it can be used to more effectively
mitigate insider threats and APTs.
http://www.sans.org/info/146160
TRAINING UPDATE
- --SANS Cyber Defense Initiative ® Washington, DC December 12-19, 2013
31 courses. Bonus evening presentations include Have No Fear - DFIR is
Here!; New School Forensics: Latest Tools and Techniques in Memory
Analysis; and a Special Event: NetWars Tournament of Champions.
http://www.sans.org/event/cyber-defense-initiative-2013
- --SANS Security East 2014 New Orleans, LA January 20-25, 2014
10 courses. Bonus evening presentations include Legends: The Reality
Behind the Security Fairytales We All Hear; and 10 Things Security Teams
Need to Know About Cloud Security.
http://www.sans.org/event/security-east-2014
6 courses. Bonus evening presentations include Offensive Digital Forensics; and Cloud IR and Forensics.
http://www.sans.org/event/sans-scottsdale-2014
- --SANS Brussels 2014 Brussels, Belgium February 17-22, 2014
4 courses.
http://www.sans.org/event/belgium-2014
- --SANS Secure Singapore 2014 Singapore, Singapore March 10-26, 2014
7 courses. Bonus evening presentations includes Incident Response and
Forensics in the Cloud.
http://www.sans.org/event/singapore-2014
- -- Multi-week Live SANS training
http://www.sans.org/mentor/about
Contact mentor@sans.org
- -- Looking for training in your own community?
http://www.sans.org/community/
- --Save on On-Demand training (30 full courses) - See samples at
http://www.sans.org/ondemand/specials
Plus Muscat, San Antonio, and Dubai all in the next 90 days.
For a list of all upcoming events, on-line and live: www.sans.org
********************** Sponsored Links: *********************1) Discover how BlueCoat's Lifecycle Defense enables you to preserve
your IT budget, protect and empower your business.
http://www.sans.org/info/146165
2) Take the SANS Survey on Endpoint Protection and win an iPad Air! SANS is conducting this survey to investigate the use of endpoint protections and improvements in managing/securing them and to identify additional areas that must be addressed to reduce risk and improve protection and compliance practices. Have your voice heard. Complete the survey: http://www.sans.org/info/145610
3) Take the SANS Second survey on Application Security and enter to win an iPad! http://www.sans.org/info/146170
============================================================NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM
Title: Microsoft Tuesday Updates
Description: 24 CVEs have been fixed in the latest rounds of Microsoft
Tuesday Updates. 7 CVEs in Internet Explorer alone. For a full breakdown
of the CVEs and the vulnerabilities see below:
Reference:
http://vrt-blog.snort.org/2013/12/microsoft-update-tuesday-december-2013.html
https://isc.sans.edu/diary/Microsoft+December+Patch+Tuesday/17198
Snort SID: 27823, 28464-28473, 28487-28488, 28525-28526, 28862-28863,
28865-28878, 28880-28882
Title: Adobe Flash and Shockwave Player Updates
Description: This vulnerability is of an extremely low priority being
that you have to be logged in and the traffic is SSL encrypted, however,
it is possible for users to retrieve sensitive information, to create
additional accounts and to perform remote code execution.
Reference:
https://isc.sans.edu/diary/Adobe+Updates+today+as+well./17201
Snort SID: Detection is forthcoming
ClamAV: Detection is forthcoming
Title: Dexter2/Stardust POS Malware
Description: A new version of POS Malware known as "Dexter2" or
"Stardust" has been discovered and disclosed on the internet.
Reference:
http://www.arbornetworks.com/asert/2013/12/happy-holidays-point-of-sale-malware-campaigns-targeting-credit-and-debit-cards/
Snort SID: 28891-28892, 25553
ClamAV: N/A
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
When an Exploit Kit is VERY Simple
http://vrt-blog.snort.org/2013/12/when-exploit-kit-is-very-simple.html
Look what I found, Moar Pony!
http://blog.spiderlabs.com/2013/12/look-what-i-found-moar-pony.html
Malicious multi-hop iframe campaign affects thousands of Web sites,
leads to a cocktail of client-side exploits - part two
http://www.webroot.com/blog/2013/12/09/malicious-multi-hop-iframe-campaign-affects-thousands-web-sites-leads-cocktail-client-side-exploits-part-two/
RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM.
This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.
D: CVE-2013-5331
Title: Adobe Flash Player Memory Corruption Code Execution
Vulnerability (APSB13-28)
Vendor: Adobe
Description: Remote exploitation of a memory corruption vulnerability
in Adobe System Inc.'s Flash Player versions 11.9.900.152 and earlier
versions for Windows and Macintosh and Adobe Flash Player 11.2.202.327
and earlier versions for Linux. This could allow an attacker to execute
arbitrary code. Adobe is aware of reports that an exploit designed to
trick the user into opening a Microsoft Word document with malicious
Flash (.swf).
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
ID: CVE-2013-5065
Title: Microsoft Windows Kernel "NDProxy.sys Driver" Input Validation
Code Execution Vulnerability
Vendor: Microsoft
Description: NDProxy.sys in the kernel in Microsoft Windows XP SP2 and
SP3 and Server 2003 SP2 allows local users to gain privileges via a
crafted application, as exploited in the wild in November 2013.
CVSS v2 Base Score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)
ID: CVE-2013-5486
Title: Cisco Prime Data Center Network Manager (DCNM)
"fileUploadServlet" Command Execution Vulnerability
Vendor: Cisco
Description: DCNM-SAN Server in Cisco Prime Data Center Network Manager
(DCNM) before 6.2(1) allows remote attackers to execute arbitrary
commands via unspecified vectors, aka Bug IDs CSCue77035 and CSCue77036.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
ID: CVE-2013-0074
Title: Microsoft Silverlight Double Dereference Vulnerability
Vendor: Microsoft
Description: Microsoft Silverlight 5, and 5 Developer Runtime, before
5.1.20125.0 does not properly validate pointers during HTML object
rendering, which allows remote attackers to execute arbitrary code via
a crafted Silverlight application, aka "Silverlight Double Dereference
Vulnerability."
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
ID: CVE-2013-3906
Title: Microsoft Graphics Component Could Allow Remote Code Execution
Vendor: Microsoft
Description: GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2;
Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility
Pack SP3; and Lync 2010, 2010 Attendee, 2013, and Basic 2013 allows
remote attackers to execute arbitrary code via a crafted TIFF image, as
demonstrated by an image in a Word document, and exploited in the wild
in October and November 2013.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
ID: CVE-2013-6026
Title: D-Link Authentication Security Bypass Vulnerability
Vendor: D-Link
Description: The web interface on D-Link DIR-100, DIR-120, DI-624S,
DI-524UP, DI-604S, DI-604UP, DI-604+, and TM-G5240 routers; Planex
BRL-04R, BRL-04UR, and BRL-04CW routers; and Alpha Networks routers
allows remote attackers to bypass authentication and modify settings via
an xmlset_roodkcableoj28840ybtide User-Agent HTTP header, as exploited
in the wild in October 2013.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
MOST PREVALENT MALWARE FILES 12/1/2013 - 12/7/2013
COMPILED BY SOURCEFIRE
SHA 256: DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C
MD5: 25aa9bb549ecc7bb6100f8d179452508
VirusTotal:
https://www.virustotal.com/en/file/DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C/analysis/
Typical Filename: Random
Claimed Product: Random
Detection Name: W32.DF83A0D694-100.SBX.VIOC
SHA 256: 180c6035ca44c270b8e1556a7b2e9faf442d1b4323ef6d8e93b7e759af169c96
MD5: 44e5b5dc6a27ea109b8a234e640bb5fd
VirusTotal:
https://www.virustotal.com/en/file/180C6035CA44C270B8E1556A7B2E9FAF442D1B4323EF6D8E93B7E759AF169C96/analysis/
Typical Filename: BitGuard
Claimed Product: BitGuard
Detection Name: W32.Agent:BProtector.16nb.dk
SHA 256: 5b8a898d66a1cb12ab682799cbb501699faf860b5f98a6a37068963ac1c844ac
MD5: 9b32cd6e776ee3abd010f44fecd7edfc
VirusTotal:
https://www.virustotal.com/en/file/5B8A898D66A1CB12AB682799CBB501699FAF860B5F98A6A37068963AC1C844AC/analysis/
Typical Filename: hao123Inst.exe
Claimed Product: hao123Inst.exe
Detection Name: W32.Auto:5b8a89.TG.VRT
SHA 256: aa0bbaecb678868e1e7f57c7ca9d61b608b3d788be490790eb1d148beadf4615
MD5: 3291e1603715c47a23b60a8bf2ca73db
VirusTotal:
https://www.virustotal.com/en/file/AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615/analysis/
Typical Filename: 08.tmp
Claimed Product: None
Detection Name: Confiker
(c) 2013. All rights reserved. The information contained in this newsletter, including any external links, is provided "AS IS," with no express or implied warranty, for informational purposes only.
Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit https://www.sans.org/account
