@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data
A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.
June 26, 2014=============================================================
@RISK: The Consensus Security Vulnerability Alert
Vol. 14, Num. 25
Providing a reliable, weekly summary of newly discovered attack vectors, vulnerabilities with active exploits, and explanations of how recent attacks worked.
=============================================================CONTENTS:
NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES 6/11/2014 - 6/17/2014
============================================================TOP VULNERABILITY THIS WEEK: Supermicro Onboard IPMI Port 49152 Sensitive File Exposure
******************** Sponsored By Splunk *********************TLooking for a simpler way to adopt the SANS 20? It's a daunting task for security practitioners to monitor and correlate across the variety of data sources needed to meet the requirements. Learn how Splunk can provide insights to verify, execute and support requirements for the SANS Top 20 Critical Security Controls. Read the e-book. - http://www.sans.org/info/162507
============================================================TRAINING UPDATE
- --SANSFIRE 2014 Baltimore, ND June 21-30, 2014
42 courses. Bonus evening presentations include Avoiding Cyberterrosism
Threats Inside Electrical Substations; Security Awareness Metrics:
Measuring Human Behavior; and penetration Testing Corporate Mobile
Applications and BYOD Environments.
http://www.sans.org/event/sansfire-2014
- --SANS Capital City 2014Washington, DC July 7-12, 2014
7 courses. Bonus evening presentations include Weaponizing Digital
Currency; Incident Response and Forensics in the Cloud; and Who's
Watching the Watchers?
http://www.sans.org/event/capital-city-2014
- --SANS Boston 2014 Boston, MAJuly 28-August 2, 2014
11 courses. Bonus evening presentations include APT: It is Time to Act;
Continuous Ownage: Why You Need Continuous Monitoring; and The Bot
Inside the Machine.
http://www.sans.org/event/boston-2014
- --SANS Pen Test BerlinBerlin, GermanyJune 15-21, 2014
6 courses.
http://www.sans.org/event/pentest-berlin-2014
- --SANS London Summer 2014 London, UKJuly 14-21, 2014
5 courses.
http://www.sans.org/event/london-summer-2014
- --Can't travel? SANS offers LIVE online instruction.
Day (www.sans.org/simulcast) and Evening courses (www.sans.org/vlive) available!
- -- Multi-week Live SANS training
http://www.sans.org/mentor/about
Contact mentor@sans.org
- -- Looking for training in your own community?
http://www.sans.org/community/
- --Save on On-Demand training (30 full courses) - See samples at
http://www.sans.org/ondemand/specials
Plus and Nashville, Bangkok, and Tallinn all in the next 90 days.
For a list of all upcoming events, on-line and live: www.sans.org
********************** Sponsored Links: ********************1) Provide input to the Critical Security Controls Survey and enter to
win iPad! Tell us your wins, misses and wish lists with the CSCs here:
http://bit.ly/2014CSCSurv. At the end of the survey, sign up for the
paper and results webcast airing on September 9:
http://www.sans.org/info/162000
2) Attend the SANS DHS Continuous Diagnostics & Mitigation Award
Workshop - PART II. August 1, 2014 in Washington, DC.
http://www.sans.org/info/159487
3) In case you missed it: More web traffic, more problems. How CARFAX
consolidated security concerns, saved money and grew their business
Thursday, June 26 at 1:00 PM EDT (17:00:00 UTC)
John Pescatore, Chris Thomas and Preston Hogue. http://www.sans.org/info/162512
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM
Title: CARISIRT: Yet Another BMC Vulnerability (And some added extras)
Description: Supermicro motherboards with IPMI store sensitive data on
a publicly accessible webserver on port 49152.
Reference:
http://blog.cari.net/carisirt-yet-another-bmc-vulnerability-and-some-added-extras/
https://community.rapid7.com/community/metasploit/blog/2013/11/06/supermicro-ipmi-firmware-vulnerabilities
Snort SID: 31339-31342
Title: Towelroot gives root access to Samsung Galaxy S5 and other
popular Android devices (CVE-2014-3153)
Description: Towelroot is an application for Android devices that
leverages a bug in the Linux kernel futex system to gain root access.
This affects all Android devices lower than Android 4.4.4.
Reference:
http://www.lacoon.com/blog/2014/06/towelroot-gives-root-access-samsung-galaxy-s5-popular-android-devices/
Title: Docker VMM escape proof-of-concept
Description: The Linux LXC (linux containers) based Docker application
for deploying applications in a restricted sandbox resolved a
vulnerability in the 1.0 release that permitted a sandbox escape,
allowing access to the host from within the sandbox.
Reference: http://seclists.org/oss-sec/2014/q2/565
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
The Citadel and Gameover Campaigns of 5CB682C10440B2EBAF9F28C1FE438468
http://www.arbornetworks.com/asert/2014/06/the-citadel-and-gameover-campaigns-of-5cb682c10440b2ebaf9f28c1fe438468/
A peek inside a commercially available Android-based botnet for hire
http://ww.webroot.com/blog/2014/06/23/peek-inside-commercially-available-android-based-botnet-hire/
A preview of McSema - a framework for translating x86 binaries into LLVM
bytecode (for analysis of x86 applications)
http://blog.trailofbits.com/2014/06/23/a-preview-of-mcsema/
Havex Hunts for ICS/SCADA Systems
http://www.f-secure.com/weblog/archives/00002718.html
RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM.
This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.
ID: N/A
Title: Supermicro Server Motherboard Credential Disclosure Vulnerability
Vendor: Supermicro
Description: Supermicro motherboards store administrator passwords in
plain text, which is available to any attacker who can connect to TCP
port 49152.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/AU:N/C:C/I:C/A:C)
ID: CVE-2014-3913
Title: Ericom AccessNow Server Stack Buffer Overflow Vulnerability
Vendor: Ericom
Description: Stack-based buffer overflow in AccessServer32.exe in Ericom
AccessNow Server allows remote attackers to execute arbitrary code via
a request for a non-existent file.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/AU:N/C:C/I:C/A:C)
ID: CVE-2014-3120
Title: Elasticsearch Remote Code Execution
Vendor: Elasticsearch
Description: Elasticsearch has a flaw in its default configuration which
makes it possible for any webpage to execute arbitrary code on visitors
with Elasticsearch installed.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/AU:N/C:C/I:C/A:C)
ID: CVE-2014-0515
Title: Adobe Flash Player Shader Buffer Overflow
Vendor: Adobe
Description: Buffer overflow in Adobe Flash Player before 11.7.700.279
and 11.8.x through 13.0.x before 13.0.0.206 on Windows and OS X, and
before 11.2.202.356 on Linux, allows remote attackers to execute
arbitrary code via unspecified vectors, as exploited in the wild in
April 2014.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/AU:N/C:C/I:C/A:C)
ID: CVE-2014-0094
Title: Apache Struts ClassLoader Manipulation Remote Code Execution
Vendor: Apache
Description: The ParametersInterceptor in Apache Struts before 2.3.16.1
allows remote attackers to "manipulate" the ClassLoader via the class
parameter, which is passed to the getClass method.
CVSS v2 Base Score: 5.0 (AV:N/AC:L/AU:N/C:N/I:P/A:N)
ID: CVE-2014-1776
Title: Microsoft Internet Explorer Use-after-Free Vulnerability
Vendor: Microsoft
Description: Use-after-free vulnerability in VGX.DLL in Microsoft
Internet Explorer 6 through 11 allows remote attackers to execute
arbitrary code or cause a denial of service (memory corruption) via
unspecified vectors, as exploited in the wild in April 2014.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/AU:N/C:C/I:C/A:C)
ID: CVE-2014-0160
Title: OpenSSL TLS Heartbeat Extension Buffer Oveflow Information
Disclosure Vulnerability (Heartbleed)
Vendor: OpenSSL Project
Description: The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1
before 1.0.1g do not properly handle Heartbeart Extension packets, which
allows remote attackers to obtain sensitive information from process
memory via crafted packets that trigger a buffer over-read, as
demonstrated by reading private keys, related to d1_both.c and t1_lib.c.
CVSS v2 Base Score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
MOST PREVALENT MALWARE FILES 6/18/2014 - 6/24/2014
COMPILED BY SOURCEFIRE
SHA 256: C7E2762651F4DD99326BAA1499761D1E1FCD48F6ADB8CA9096590E6CAB8E1AE5
MD5: e08bdcb2af67b0117fb34cf030f1e0ab
VirusTotal:
https://www.virustotal.com/file/C7E2762651F4DD99326BAA1499761D1E1FCD48F6ADB8CA9096590E6CAB8E1AE5/analysis/#additional-info
Typical Filename: cltmngui.exe
Claimed Product: Search Protect
Detection Name: W32.C7E2762651-100.SBX.VIOC
SHA 256: F095974F28C10F44F18088D8F174C07714967E80CCD2607A4FBDE9E9AE538806
MD5: 59f0fab281ee4cc5a7aeebbeaf8d0cd8
VirusTotal:
https://www.virustotal.com/file/F095974F28C10F44F18088D8F174C07714967E80CCD2607A4FBDE9E9AE538806/analysis/#additional-info
Typical Filename: cltmng.exe
Claimed Product: Search Protect
Detection Name: W32.F095974F28-100.SBX.VIOC
SHA 256: 8679C8E6388FD3F927F7AC8ADCEB2CFECD0CEC3B95EA98F79D54119EFBD68034
MD5: 2b76e26f8314246c2a0f7968f73f00bb
VirusTotal:
https://www.virustotal.com/file/8679C8E6388FD3F927F7AC8ADCEB2CFECD0CEC3B95EA98F79D54119EFBD68034/analysis/#additional-info
Typical Filename: 39SrchMn.exe
Claimed Product: Mindspark Toolbar Platform SearchScope Monitor
Detection Name: W32.MindsparkA.17hd.1201
SHA 256: 97667487392ACA1D94C0043FB725FE31855D5B65B1BDEBE58E0AC7E147D05BE4
MD5: 466af3fbfdd028b3d90238425c367b7e
VirusTotal:
https://www.virustotal.com/file/97667487392ACA1D94C0043FB725FE31855D5B65B1BDEBE58E0AC7E147D05BE4/analysis/#additional-info
Typical Filename: 14SrchMn.exe
Claimed Product: Mindspark Toolbar Platform SearchScope Monitor
Detection Name: W32.MindsparkA.17hd.1201
SHA 256: AC4F967E68098093E09B39192B1FCE7B36D28F74A616C9ED6B8448B9E39C58AA
MD5:
VirusTotal:
https://www.virustotal.com/file/AC4F967E68098093E09B39192B1FCE7B36D28F74A616C9ED6B8448B9E39C58AA/analysis/#additional-info
Typical Filename:
Claimed Product:
Detection Name: W32.MindsparkA.17hd.1201
(c) 2014. All rights reserved. The information contained in this newsletter, including any external links, is provided "AS IS," with no express or implied warranty, for informational purposes only.
Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit https://www.sans.org/account
