@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data
A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.
July 10, 2014=============================================================
@RISK: The Consensus Security Vulnerability Alert
Vol. 14, Num. 27
Providing a reliable, weekly summary of newly discovered attack vectors, vulnerabilities with active exploits, and explanations of how recent attacks worked.
=============================================================CONTENTS:
NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES 7/2/2014 - 7/8/2014
============================================================TOP VULNERABILITY THIS WEEK: Microsoft & Adobe Patch Tuesday; multiple critical vulnerabilities.
******************** Sponsored By Splunk *********************Looking for a simpler way to adopt the SANS 20? It's a daunting task for
security practitioners to monitor and correlate across the variety of
data sources needed to meet the requirements. Learn how Splunk can
provide insights to verify, execute and support requirements for the
SANS Top 20 Critical Security Controls. Read the e-book.
http://www.sans.org/info/163202
TRAINING UPDATE
- --SANS Capital City 2014Washington, DC July 7-12, 2014
7 courses. Bonus evening presentations include Weaponizing Digital
Currency; Incident Response and Forensics in the Cloud; and Who's
Watching the Watchers?
http://www.sans.org/event/capital-city-2014
- --SANS San Francisco 2014 San Francisco, CA July 14-19, 2014
7 courses. Bonus evening presentations include Aligning Your Defenses
with Today's Evolving Threats; and Malware Reloaded.
http://www.sans.org/event/san-francisco-2014
- --SANS Boston 2014 Boston, MAJuly 28-August 2, 2014
11 courses. Bonus evening presentations include APT: It is Time to Act;
Continuous Ownage: Why You Need Continuous Monitoring; and The Bot
Inside the Machine.
http://www.sans.org/event/boston-2014
- --SANS Virginia Beach 2014 Virginia Beach, VAAugust 18-29, 2014
10 courses. Bonus evening presentations include Closing the Door on Web
Shells and Gone in 60 Minutes: Have You patched Your System Today?
http://www.sans.org/event/virginia-beach-2014
- --SANS London Summer 2014 London, UKJuly 14-21, 2014
5 courses.
http://www.sans.org/event/london-summer-2014
- --Cyber Defense Summit | Nashville, TN | August 13-20, 2014
Join Dr. Eric Cole at this premier Cyber Defense-focused event and learn
how to implement best practices and proven techniques that will enable
you to stay on top of today's threats and ahead of tomorrow's.
Prevent --> Detect --> Respond... A Winning Formula for Cyber Defense! 7 courses.
http://www.sans.org/event/cyber-defense-summit
- --Security Awareness Summit | Dallas, TX | Sept 8-16, 2014
Come learn from your peers on how to build Next Generation Security
Awareness Programs. Hear from security awareness officers as they share
their lessons learned on how they took their awareness programs to the
next level and how they measured the impact. Plus 5 courses.
http://www.sans.org/event/security-awareness-summit-and-training-2014
- --Can't travel? SANS offers LIVE online instruction.
Day (www.sans.org/simulcast) and Evening courses (www.sans.org/vlive) available!
- -- Multi-week Live SANS training
http://www.sans.org/mentor/about
Contact mentor@sans.org
- -- Looking for training in your own community?
http://www.sans.org/community/
- --Save on On-Demand training (30 full courses) - See samples at
http://www.sans.org/ondemand/specials
Plus and Nashville, Bangkok, and Tallinn all in the next 90 days.
For a list of all upcoming events, on-line and live: www.sans.org
********************** Sponsored Links: ********************1) In case you missed it: Simple, Effective Patch Management: From
Dilemma to Done Deed - Wednesday, June 25 at 3:00 PM EDT (19:00:00
UTC)with Jason Tolu.
http://www.sans.org/info/163207
2) Webcast: Get Real-time Threat Detection Starting on Day 1 with
AlienVault USM. Webcast: Thursday, July 17 at 1:00 PM EDT (17:00:00
UTC) Tom D'Aquino.
http://www.sans.org/info/163047
3) Webcast: An Incident Response Playbook: From Monitoring to Operations
Wednesday, July 30 at 1:00 PM EDT (17:00:00 UTC) Dave Shackleford and
Joe Schrieber.
http://www.sans.org/info/163052
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM
Title: Microsoft Patch Tuesday for July 2014
Description: Microsoft releases patches for critical vulnerabilities
found in Microsoft Internet Explorer, and Windows Journal, important
vulnerabilities in the On-Screen Keyboard, Ancillary Function Driver and
DirectShow, and a denial of service vulnerability in the Microsoft
Service Bus (AMQP) system.
Reference: https://technet.microsoft.com/en-us/library/security/ms14-jul.aspx
Snort SID: 31380-31391
ClamAV: Html.Exploit.CVE_2014_1765, Html.Exploit.CVE_2014_2804,
Html.Exploit.CVE_2014_2787, Html.Exploit.CVE_2014_2801
Title: Adobe Patch Tuesday Jul 2014
Description: Adobe releases updates to Adobe Flash Player addressing
multiple security bypass vulnerabilities, and a JSONP callback API
vulnerability. Adobe Flash Player, and Adobe AIR are impacted.
Reference: http://helpx.adobe.com/security/products/flash-player/apsb14-17.html
Snort SID: 31392-31397
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
Java support over for Windows XP
www.zdnet.com/java-support-over-for-windows-xp-7000031226/
Threat Spotlight: A string of 'paerls'
Part 1 & 2: http://sfi.re/1qSDrfO http://sfi.re/paerls2
Analysis of Asterope
http://stopmalvertising.com/malware-reports/analysis-of-asterope.html
Connected cars - convenient and vulnerable
http://blog.kaspersky.com/connected-car-weak/
USG Aurora Data Dump
www.digitalbond.com/blog/2014/07/07/usg-aurora-data-dump/
Volatility at Black Hat USA & DFRWS 2014
http://volatility-labs.blogspot.com/2014/07/volatility-at-black-hat-usa-dfrws-2014.html
Kansa: Automating Analysis
http://trustedsignal.blogspot.com/2014/07/kansa-automating-analysis.html
RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM.
This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.
ID: CVE-2014-2969
Title: Netgear GS105PE Prosafe Plus Switch Contains Hard-Coded Login
Credentials
Vendor: Netgear
Description: NETGEAR GS108PE Prosafe Plus switches with firmware 1.2.0.5
have a hardcoded password of debugpassword for the ntgruser account,
which allows remote attackers to upload firmware or read or modify
memory contents, and consequently execute arbitrary code, via a request
to (1) produce_burn.cgi, (2) register_debug.cgi, or (3)
bootcode_update.cgi.
CVSS v2 Base Score: 8.3 (AV:A/AC:L/Au:N/C:C/I:C/A:C)
ID: CVE-2012-1876
Title: Microsoft Internet Explorer Col Element Memory Corruption
Vulnerability
Vendor: Microsoft
Description: Microsoft Internet Explorer 6 through 9, and 10 Consumer
Preview, does not properly handle objects in memory, which allows remote
attackers to execute arbitrary code by attempting to access a
nonexistent object, leading to a heap-based buffer overflow, aka "Col
Element Remote Code Execution Vulnerability," as demonstrated by VUPEN
during a Pwn2Own competition at CanSecWest 2012.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
ID: N/A
Title: Supermicro Server Motherboard Credential Disclosure Vulnerability
Vendor: Supermicro
Description: Supermicro motherboards store administrator passwords in
plain text, which is available to any attacker who can connect to TCP
port 49152.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/AU:N/C:C/I:C/A:C)
ID: CVE-2014-0515
Title: Adobe Flash Player Shader Buffer Overflow
Vendor: Adobe
Description: Buffer overflow in Adobe Flash Player before 11.7.700.279
and 11.8.x through 13.0.x before 13.0.0.206 on Windows and OS X, and
before 11.2.202.356 on Linux, allows remote attackers to execute
arbitrary code via unspecified vectors, as exploited in the wild in
April 2014.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/AU:N/C:C/I:C/A:C)
ID: CVE-2014-0094
Title: Apache Struts ClassLoader Manipulation Remote Code Execution
Vendor: Apache
Description: The ParametersInterceptor in Apache Struts before 2.3.16.1
allows remote attackers to "manipulate" the ClassLoader via the class
parameter, which is passed to the getClass method.
CVSS v2 Base Score: 5.0 (AV:N/AC:L/AU:N/C:N/I:P/A:N)
ID: CVE-2014-1776
Title: Microsoft Internet Explorer Use-after-Free Vulnerability
Vendor: Microsoft
Description: Use-after-free vulnerability in VGX.DLL in Microsoft
Internet Explorer 6 through 11 allows remote attackers to execute
arbitrary code or cause a denial of service (memory corruption) via
unspecified vectors, as exploited in the wild in April 2014.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/AU:N/C:C/I:C/A:C)
ID: CVE-2014-0160
Title: OpenSSL TLS Heartbeat Extension Buffer Oveflow Information
Disclosure Vulnerability (Heartbleed)
Vendor: OpenSSL Project
Description: The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1
before 1.0.1g do not properly handle Heartbeart Extension packets, which
allows remote attackers to obtain sensitive information from process
memory via crafted packets that trigger a buffer over-read, as
demonstrated by reading private keys, related to d1_both.c and t1_lib.c.
CVSS v2 Base Score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
MOST PREVALENT MALWARE FILES 7/2/2014 - 7/8/2014
COMPILED BY SOURCEFIRE
SHA 256: FA437EE13A4CC083D91B9DBD90F341CDA0051614998578AB51D0242742C04AB1
MD5: 7e271cf7bd83f1a0165f6beb3a3b49f9
VirusTotal:
https://www.virustotal.com/file/FA437EE13A4CC083D91B9DBD90F341CDA0051614998578AB51D0242742C04AB1/analysis/#additional-info
Typical Filename: cltmngui.exe
Claimed Product: ClientConnect Search Protect
Detection Name: W32.FA437EE13A-100.SBX.VIOC
SHA 256: 97667487392ACA1D94C0043FB725FE31855D5B65B1BDEBE58E0AC7E147D05BE4
MD5: 466af3fbfdd028b3d90238425c367b7e
VirusTotal:
https://www.virustotal.com/file/97667487392ACA1D94C0043FB725FE31855D5B65B1BDEBE58E0AC7E147D05BE4/analysis/#additional-info
Typical Filename: 8hsrchmn.exe
Claimed Product: Mindspark Toolbar Platform SearchScope Monitor
Detection Name: W32.MindsparkA.17hd.1201
SHA 256: 8679C8E6388FD3F927F7AC8ADCEB2CFECD0CEC3B95EA98F79D54119EFBD68034
MD5: 2b76e26f8314246c2a0f7968f73f00bb
VirusTotal:
https://www.virustotal.com/file/8679C8E6388FD3F927F7AC8ADCEB2CFECD0CEC3B95EA98F79D54119EFBD68034/analysis/#additional-info
Typical Filename: t8SrchMn.exe
Claimed Product: Mindspark Toolbar Platform SearchScope Monitor
Detection Name: W32.MindsparkA.17hd.1201
SHA 256: 1A84759D615916B53F8F41C9928C48FF005A970D6FA35893F9A7EC074DD77864
MD5: 738a57e0d8dd303b87220f209bd49024
VirusTotal:
https://www.virustotal.com/file/1A84759D615916B53F8F41C9928C48FF005A970D6FA35893F9A7EC074DD77864/analysis/#additional-info
Typical Filename: Updater.exe
Claimed Product: Updater_mpcb
Detection Name: W32.1A84759D61-78.SBX.VIOC
SHA 256: F8EA2EFA24813F1159ADCEF510EA33DCCEE50A5EF9F9C98EAE840AFAAB8DE8F8
MD5: 2c0a45683112082493b1fb3c09c60184
VirusTotal:
https://www.virustotal.com/file/F8EA2EFA24813F1159ADCEF510EA33DCCEE50A5EF9F9C98EAE840AFAAB8DE8F8/analysis/#additional-info
Typical Filename: 1cbrmon.exe
Claimed Product: Mindspark Toolbar Platform SearchScope Monitor
Detection Name: W32.MindsparkA.17hd.1201
(c) 2014. All rights reserved. The information contained in this newsletter, including any external links, is provided "AS IS," with no express or implied warranty, for informational purposes only.
Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit https://www.sans.org/account
