Newsletters: @RISK

Subscribe to SANS Newsletters

Join the SANS Community to receive the latest curated cyber security news, vulnerabilities and mitigations, training opportunities, and our webcast schedule.





SANS NewsBites
@Risk: Security Alert
OUCH! Security Awareness
Case Leads DFIR Digest
Industrial Control Systems
Industrials & Infrastructure


@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data

A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.

June 12, 2014
=============================================================

@RISK: The Consensus Security Vulnerability Alert

Vol. 14, Num. 23

Providing a reliable, weekly summary of newly discovered attack vectors, vulnerabilities with active exploits, and explanations of how recent attacks worked.

=============================================================

CONTENTS:

NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES 6/4/2014 - 6/10/2014
============================================================

TOP VULNERABILITY THIS WEEK: Microsoft Patch Tuesday for June 2014

******************** Sponsored By SANS *********************

Attend the SANS DHS Continuous Diagnostics & Mitigation Award Workshop - - PART II. August 1, 2014 in Washington, DC. This SANS CDM event provides government security managers the opportunity to get the latest status on the DHS Continuous Diagnostic and Mitigiation program and to learn how the early adopters in government are using CDM to increase security.
http://www.sans.org/info/159487

============================================================

TRAINING UPDATE

- -- SANS Rocky Mountain 2014 Denver, CO June 9-14, 2014
8 courses. Bonus evening presentations include Continuous Ownage; Why You Need Continuous Monitoring; and APT: It is Time to Act.
http://www.sans.org/event/rocky-mountain-2014

- --SANSFIRE 2014 Baltimore, ND June 21-30, 2014
42 courses. Bonus evening presentations include Avoiding Cyberterrosism Threats Inside Electrical Substations; Security Awareness Metrics: Measuring Human Behavior; and penetration Testing Corporate Mobile Applications and BYOD Environments.
http://www.sans.org/event/sansfire-2014

- --SANS Capital City 2014Washington, DC July 7-12, 2014
7 courses. Bonus evening presentations include Weaponizing Digital Currency; Incident Response and Forensics in the Cloud; and Who's Watching the Watchers?
http://www.sans.org/event/capital-city-2014

- --SANS Pen Test BerlinBerlin, GermanyJune 15-21, 2014
6 courses.
http://www.sans.org/event/pentest-berlin-2014

- --SANS London Summer 2014 London, UKJuly 14-21, 2014 5 courses.
http://www.sans.org/event/london-summer-2014

- --Can't travel? SANS offers LIVE online instruction.
Day (www.sans.org/simulcast) and Evening courses (www.sans.org/vlive) available!

- -- Multi-week Live SANS training
http://www.sans.org/mentor/about
Contact mentor@sans.org

- -- Looking for training in your own community?
http://www.sans.org/community/

- --Save on On-Demand training (30 full courses) - See samples at
http://www.sans.org/ondemand/specials

Plus and Nashville, Bangkok, and Tallinn all in the next 90 days.

For a list of all upcoming events, on-line and live: www.sans.org

********************** Sponsored Links: ********************

1) Kill Malware with Intelligent sensors, a review of SANS network security survey, featuring Rob Vandenbrink Thursday, June 19, Special Time of 3 PM EDT http://www.sans.org/info/161435

2) Dave Shackleford reviews McAfee's Next Gen Firewall in detecting advanced evasion tools and more Friday, June 20 at 1 PM EDT http://www.sans.org/info/161440

Provide input to the Critical Security Controls! Tell us your wins, misses and wish lists with the CSCs in this quick survey: http://bit.ly/2014CSCSurv. At the end of the survey, sign up for the paper and results webcast airing on September 9 webcast link:
http://www.sans.org/info/160675

============================================================
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM

Title: Microsoft Updates June 2014 - Almost 60 IE and GDI+/TrueType RCE
Description: Microsoft releases patches for 66 CVEs, many of them affecting Microsoft Internet Explorer, with critical severity.
Reference: https://technet.microsoft.com/library/security/ms14-jun
Snort SID: 31188-31194, 31196-31209, 31215-31217, 31219-31220

Title: Linux kernel futex local privilege escalation (CVE-2014-3153)
Description: A privilege escalation bug was discovered that allows a local user to gain ring 0 control via the futex syscall.
Reference: http://seclists.org/oss-sec/2014/q2/467

Title: Security updates available for Adobe Flash Player (APSB14-16)
Description: Adobe releases security updates for Flash Player affecting Windows, Mac, and Linux. Four of the eight vulnerabilities are critical.
Reference: http://helpx.adobe.com/security/products/flash-player/apsb14-16.html>
Snort SID: Coverage is pending.

============================================================
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY

Simplocker: First Confirmed File-Encrypting Ransomware for Android
http://www.symantec.com/connect/blogs/simplocker-first-confirmed-file-encrypting-ransomware-android

RIG Exploit Kit Strikes Oil
http://sfi.re/1llBLrg

Defeating UEFI's SecureBoot
http://www.net-security.org/article.php?id=2037

Black marketed Windows banking & POS Trojan Minerva turns in-the-wild
https://blog.avast.com/2014/06/04/black-marketed-windows-banking-pos-trojan-minerva-turns-in-the-wild/

============================================================
RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM.

This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.

ID: CVE-2014-3120
Title: Elasticsearch Remote Code Execution
Vendor: Elasticsearch
Description: Elasticsearch has a flaw in its default configuration which makes it possible for any webpage to execute arbitrary code on visitors with Elasticsearch installed.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/AU:N/C:C/I:C/A:C)

ID: CVE-2014-0515
Title: Adobe Flash Player Shader Buffer Overflow
Vendor: Adobe
Description: Buffer overflow in Adobe Flash Player before 11.7.700.279 and 11.8.x through 13.0.x before 13.0.0.206 on Windows and OS X, and before 11.2.202.356 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in April 2014.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/AU:N/C:C/I:C/A:C)

ID: CVE-2014-0094
Title: Apache Struts ClassLoader Manipulation Remote Code Execution
Vendor: Apache
Description: The ParametersInterceptor in Apache Struts before 2.3.16.1 allows remote attackers to "manipulate" the ClassLoader via the class parameter, which is passed to the getClass method.
CVSS v2 Base Score: 5.0 (AV:N/AC:L/AU:N/C:N/I:P/A:N)

ID: CVE-2014-0497
Title: Adobe Flash Player Integer Underflow Remote Code Execution
Vendor: Adobe
Description: Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/AU:N/C:C/I:C/A:C)

ID: CVE-2014-1776
Title: Microsoft Internet Explorer Use-after-Free Vulnerability
Vendor: Microsoft
Description: Use-after-free vulnerability in VGX.DLL in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, as exploited in the wild in April 2014.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/AU:N/C:C/I:C/A:C)

ID: CVE-2014-0160
Title: OpenSSL TLS Heartbeat Extension Buffer Oveflow Information Disclosure Vulnerability (Heartbleed)
Vendor: OpenSSL Project
Description: The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeart Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c.
CVSS v2 Base Score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)

=========================================================
MOST PREVALENT MALWARE FILES 6/4/2014 - 6/10/2014
COMPILED BY SOURCEFIRE

SHA 256: 37840A8EF03A5F4F9AED68C9E759D1B268E8335EE4D6C7C1774517BA9650B376
MD5: b13d123ceeaff81d2ba217cb74c7698e
VirusTotal:
https://www.virustotal.com/file/37840A8EF03A5F4F9AED68C9E759D1B268E8335EE4D6C7C1774517BA9650B376/analysis/#additional-info
Typical Filename: b13d123ceeaff81d2ba217cb74c7698e
Claimed Product: webget
Detection Name: Adware:MegaBrowse-tpd

SHA 256: D6585C5D5F85E8289C9EE8E6EECBAFD21B26B9DABA8561EDA12A91D5E484702C
MD5: cb963faf704f22473375856e3c2fcde3
VirusTotal:
https://www.virustotal.com/file/D6585C5D5F85E8289C9EE8E6EECBAFD21B26B9DABA8561EDA12A91D5E484702C/analysis/#additional-info
Typical Filename: CltMngSvc.exe
Claimed Product: ClientConnect
Detection Name: Win.Adware.SearchProtect.VRT

SHA 256: FA802EA3C3F8FBB3EF946A43B757E84A2D2AFD42BC9B035F71CC989A7E349081
MD5: 5454873bb620e77dcb10db8f23529877
VirusTotal:
https://www.virustotal.com/file/FA802EA3C3F8FBB3EF946A43B757E84A2D2AFD42BC9B035F71CC989A7E349081/analysis/#additional-info
Typical Filename: APISupport.dll
Claimed Product: ClientConnect
Detection Name: W32.FA802EA3C3-66.SBX.VIOC

SHA 256: D97C674896D54BF10EB4B26F39DF7E2AD3494C7B09C6634F17B8218CC6BDBF1A
MD5: 179b515a61e6d0c038dff57e0cec1a65
VirusTotal:
https://www.virustotal.com/file/D97C674896D54BF10EB4B26F39DF7E2AD3494C7B09C6634F17B8218CC6BDBF1A/analysis/#additional-info
Typical Filename: APISupport.dll
Claimed Product: Client Connect
Detection Name: W32.D97C674896-86.SBX.VIOC

SHA 256: DE79E5A4356CA0EFA56B69E6EDE21DD8E12FC16E2196B7B7366A0D76C65D3ED5
MD5:
VirusTotal:
https://www.virustotal.com/file/DE79E5A4356CA0EFA56B69E6EDE21DD8E12FC16E2196B7B7366A0D76C65D3ED5/analysis/#additional-info
Typical Filename: wajam_update.exe
Claimed Product: Wajam Updater
Detection Name: W32.AdwaregenAdw:Application.17g3.dk

=============================================================

(c) 2014. All rights reserved. The information contained in this newsletter, including any external links, is provided "AS IS," with no express or implied warranty, for informational purposes only.

Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit https://www.sans.org/account