@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data
A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.
June 5, 2014=============================================================
@RISK: The Consensus Security Vulnerability Alert
Vol. 14, Num. 22
Providing a reliable, weekly summary of newly discovered attack vectors, vulnerabilities with active exploits, and explanations of how recent attacks worked.
=============================================================CONTENTS:
NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES 5/27/2014 - 6/3/2014
============================================================TOP VULNERABILITY THIS WEEK: Adobe Flash Player Shader Buffer Overflow (CVE-2014-0515)
******************** Sponsored By SANS *********************Attend the SANS DHS Continuous Diagnostics & Mitigation Award Workshop
- - PART II. August 1, 2014 in Washington, DC. This SANS CDM event
provides government security managers the opportunity to get the latest
status on the DHS Continuous Diagnostic and Mitigiation program and to
learn how the early adopters in government are using CDM to increase
security.
http://www.sans.org/info/159487
TRAINING UPDATE
- --Digital Forensics Incident Response Summit Austin, TX June 3-10, 2014
8 courses. Bonus evening presentations include Extracting User
Credentials Using Memory Forensics, and Dealing with Persistent
Smartphone Forensic Challenges.
http://www.sans.org/event/dfir-summit-2014
- -- SANS Rocky Mountain 2014 Denver, CO June 9-14, 2014
8 courses. Bonus evening presentations include Continuous Ownage; Why
You Need Continuous Monitoring; and APT: It is Time to Act.
http://www.sans.org/event/rocky-mountain-2014
- --SANSFIRE 2014 Baltimore, ND June 21-30, 2014
42 courses. Bonus evening presentations include Avoiding Cyberterrosism
Threats Inside Electrical Substations; Security Awareness Metrics:
Measuring Human Behavior; and penetration Testing Corporate Mobile
Applications and BYOD Environments.
http://www.sans.org/event/sansfire-2014
- --SANS Capital City 2014Washington, DC July 7-12, 2014
7 courses. Bonus evening presentations include Weaponizing Digital
Currency; Incident Response and Forensics in the Cloud; and Who's
Watching the Watchers?
http://www.sans.org/event/capital-city-2014
- --SANS Pen Test BerlinBerlin, GermanyJune 15-21, 2014
6 courses.
http://www.sans.org/event/pentest-berlin-2014
- --SANS London Summer 2014 London, UKJuly 14-21, 2014
5 courses.
http://www.sans.org/event/london-summer-2014
- --Can't travel? SANS offers LIVE online instruction.
Day (www.sans.org/simulcast) and Evening courses (www.sans.org/vlive) available!
- -- Multi-week Live SANS training
http://www.sans.org/mentor/about
Contact mentor@sans.org
- -- Looking for training in your own community?
http://www.sans.org/community/
- --Save on On-Demand training (30 full courses) - See samples at
http://www.sans.org/ondemand/specials
Plus and Nashville, Bangkok, and Tallinn all in the next 90 days.
For a list of all upcoming events, on-line and live: www.sans.org
********************** Sponsored Links: ********************1) Provide input to the Critical Security Controls! Tell us your wins,
misses and wish lists with the CSCs in this quick survey:
http://bit.ly/2014CSCSurv. At the end of the survey, sign up for the
paper and results webcast airing on September 9 webcast link:
http://www.sans.org/info/160675
2) Kill Malware with Intelligent sensors, a review of SANS network security survey, featuring Rob Vandenbrink Thursday, June 19, Special Time of 3 PM EDT http://www.sans.org/info/160770
3) Webcast: Fighting the Insider Threat: Privilege Management and Abuse Prevention Strategies. Tuesday, June 10 at 1:00 PM EDT (17:00:00 UTC) John Pescatore, Michael Crouse. http://www.sans.org/info/160775
============================================================NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM
Title: Heartbleed, Cupid and Wireless
Description: A security researcher has implemented the OpenSSL
Heartbleed attack for against the TLS/EAP key exchange for 802.11
wireless networks.
Reference: http://www.sysvalue.com/en/heartbleed-cupid-wireless/
Snort SID: 30514-30517, 30549, 30719-30726, 30735-30742, 30777-30788
Title: Recent Exploit for Adobe Flash Vulnerability Targeting Users in
Japan for Financial Information (CVE-2014-0515)
Description: Security researchers discovered strategic web compromises
focusing on Japanese consumers, leading to banking malware.
Reference:
http://www.symantec.com/connect/blogs/recent-exploit-adobe-flash-vulnerability-targeting-users-japan-financial-information
Snort SID: 30876, 30877
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
NEWSCASTER - An Iranian Threat Inside Social Media
http://www.isightpartners.com/2014/05/newscaster-iranian-threat-inside-social-media/
GameOver Zeus P2P Malware
http://www.us-cert.gov/ncas/alerts/TA14-150A
"Nemanja" Botnet Identified
http://intelcrawler.com/news-18
An Introduction to Recognizing and Decoding RC4 Encryption in Malware
http://sfi.re/1h5wc0C
Attack Analysis with a Fast Graph
http://sfi.re/1otR3tp
RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM.
This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.
ID: CVE-2014-3120
Title: Elasticsearch Remote Code Execution
Vendor: Elasticsearch
Description: Elasticsearch has a flaw in its default configuration which
makes it possible for any webpage to execute arbitrary code on visitors
with Elasticsearch installed.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/AU:N/C:C/I:C/A:C)
ID: CVE-2014-0515
Title: Adobe Flash Player Shader Buffer Overflow
Vendor: Adobe
Description: Buffer overflow in Adobe Flash Player before 11.7.700.279
and 11.8.x through 13.0.x before 13.0.0.206 on Windows and OS X, and
before 11.2.202.356 on Linux, allows remote attackers to execute
arbitrary code via unspecified vectors, as exploited in the wild in
April 2014.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/AU:N/C:C/I:C/A:C)
ID: CVE-2014-0094
Title: Apache Struts ClassLoader Manipulation Remote Code Execution
Vendor: Apache
Description: The ParametersInterceptor in Apache Struts before 2.3.16.1
allows remote attackers to "manipulate" the ClassLoader via the class
parameter, which is passed to the getClass method.
CVSS v2 Base Score: 5.0 (AV:N/AC:L/AU:N/C:N/I:P/A:N)
ID: CVE-2014-0497
Title: Adobe Flash Player Integer Underflow Remote Code Execution
Vendor: Adobe
Description: Integer underflow in Adobe Flash Player before 11.7.700.261
and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and
before 11.2.202.336 on Linux, allows remote attackers to execute
arbitrary code via unspecified vectors.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/AU:N/C:C/I:C/A:C)
ID: CVE-2014-1776
Title: Microsoft Internet Explorer Use-after-Free Vulnerability
Vendor: Microsoft
Description: Use-after-free vulnerability in VGX.DLL in Microsoft
Internet Explorer 6 through 11 allows remote attackers to execute
arbitrary code or cause a denial of service (memory corruption) via
unspecified vectors, as exploited in the wild in April 2014.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/AU:N/C:C/I:C/A:C)
ID: CVE-2014-0160
Title: OpenSSL TLS Heartbeat Extension Buffer Oveflow Information
Disclosure Vulnerability (Heartbleed)
Vendor: OpenSSL Project
Description: The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1
before 1.0.1g do not properly handle Heartbeart Extension packets, which
allows remote attackers to obtain sensitive information from process
memory via crafted packets that trigger a buffer over-read, as
demonstrated by reading private keys, related to d1_both.c and t1_lib.c.
CVSS v2 Base Score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
MOST PREVALENT MALWARE FILES 5/27/2014 - 6/3/2014
COMPILED BY SOURCEFIRE
SHA 256: F095974F28C10F44F18088D8F174C07714967E80CCD2607A4FBDE9E9AE538806
MD5: 59f0fab281ee4cc5a7aeebbeaf8d0cd8
VirusTotal:
https://www.virustotal.com/file/F095974F28C10F44F18088D8F174C07714967E80CCD2607A4FBDE9E9AE538806/analysis/#additional-info
Typical Filename: cltmng.exe
Claimed Product: Conduit SearchProtect
Detection Name: W32.F095974F28-100.SBX.VIOC
SHA 256: C7E2762651F4DD99326BAA1499761D1E1FCD48F6ADB8CA9096590E6CAB8E1AE5
MD5: e08bdcb2af67b0117fb34cf030f1e0ab
VirusTotal:
https://www.virustotal.com/file/C7E2762651F4DD99326BAA1499761D1E1FCD48F6ADB8CA9096590E6CAB8E1AE5/analysis/#additional-info
Typical Filename: cltmngui.exe
Claimed Product: Conduit SearchProtect
Detection Name: W32.C7E2762651-100.SBX.VIOC
SHA 256: 6AE1FD42D591136387A2169BAEDCA2529CE178F22EEAB244A227F08ED90C0692
MD5: 6b5b9dce3f762732273c76c3b99cb3ed
VirusTotal:
https://www.virustotal.com/file/6AE1FD42D591136387A2169BAEDCA2529CE178F22EEAB244A227F08ED90C0692/analysis/#additional-info
Typical Filename: Au_.exe
Claimed Product: Conduit SearchProtect
Detection Name: W32.6AE1FD42D5-100.SBX.VIOC
SHA 256: 59D6E69D8091D73643813706C144249492EA0461A9F5935011C67C02EAD0EF4D
MD5: 7c1b2daee1d399955b979c0559fcea0b
VirusTotal:
https://www.virustotal.com/file/59D6E69D8091D73643813706C144249492EA0461A9F5935011C67C02EAD0EF4D/analysis/#additional-info
Typical Filename: SPTool.dll
Claimed Product: Conduit SearchProtect
Detection Name: W32.59D6E69D80-100.SBX.VIOC
SHA 256: 87B690E4778E41B336B113E06767308DEFF4E217B0F12FB2B294849DC6D219C9
MD5: 9d34c62ac86d6f9e110dc94dd93cd072
VirusTotal:
https://www.virustotal.com/file/87B690E4778E41B336B113E06767308DEFF4E217B0F12FB2B294849DC6D219C9/analysis/#additional-info
Typical Filename: SPVC64Loader.dll
Claimed Product: Conduit SearchProtect
Detection Name: W32.87B690E477-100.SBX.VIOC
(c) 2014. All rights reserved. The information contained in this newsletter, including any external links, is provided "AS IS," with no express or implied warranty, for informational purposes only.
Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit https://www.sans.org/account
