@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data
A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.
December 12, 2019=============================================================
@RISK: The Consensus Security Vulnerability Alert
December 12, 2019 - Vol. 19, Num. 50
Providing a reliable, weekly summary of newly discovered attack vectors,
vulnerabilities with active exploits, and explanations of how recent
attacks worked
Archived issues may be found at http://www.sans.org/newsletters/at-risk
=============================================================
CONTENTS:
NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES Dec. 5 - 12
============================================================
TOP VULNERABILITY THIS WEEK: Microsoft Patch Tuesday for December 2019
*************** Sponsored By AWS Marketplace ****************
SANS-AWS Education Series: Leveraging CASBs in AWS for Anywhere, Anytime Data Protection. In this webcast, AWS solutions architect David Aiken and SANS instructor Kyle Dickinson discuss deployment strategies for cloud access security brokers (CASBs) in AWS that protect data and support a distributed workforce utilizing a variety of endpoints. Dec. 12, 2 PM ET. http://www.sans.org/info/214990
============================================================
TRAINING UPDATE
-- SANS Security East 2020 | New Orleans, LA | February 1-8 | https://www.sans.org/event/security-east-2020
-- SANS Miami 2020 | January 13-18 | https://www.sans.org/event/miami-2020
-- SANS Threat Hunting & IR Summit & Training | London, UK | January 13-19, 2020 | https://www.sans.org/event/threat-hunting-europe-2020
-- SANS Tokyo January 2020 | January 20-25 | https://www.sans.org/event/tokyo-january-2020
-- SANS Amsterdam January 2020 | January 20-25 | https://www.sans.org/event/amsterdam-january-2020
-- Cyber Threat Intelligence Summit & Training | Arlington, VA | January 20-27 | https://www.sans.org/event/cyber-threat-intelligence-summit-2020
-- SANS Scottsdale 2020 | February 17-22 | https://www.sans.org/event/scottsdale-2020
-- Open-Source Intelligence Summit & Training 2020 | Alexandria, VA | February 18-24 | https://www.sans.org/event/osint-summit-2020
-- SANS Secure Singapore 2020 | 16-28 March | https://www.sans.org/event/secure-singapore-2020
-- SANS OnDemand and vLive Training
Get a Free GIAC Certification Attempt or Take $350 Off through December 25 with OnDemand or vLive training.
https://www.sans.org/online-security-training/specials/
-- Can't travel? SANS offers online instruction for maximum flexibility
-- Live Daytime training with Simulcast - https://www.sans.org/simulcast
-- Evening training 2x per week for 6 weeks with vLive | https://www.sans.org/vlive
-- Anywhere, Anytime access for 4 months with OnDemand format | https://www.sans.org/ondemand/
-- Single Course Training
SANS Mentor | https://www.sans.org/mentor/about
Community SANS | https://www.sans.org/community/
-- View the full SANS course catalog and Cyber Security Skills Roadmap
https://www.sans.org/cyber-security-skills-roadmap
********************** Sponsored Links: ********************
1) Webcast Today at 1PM ET: SANS David Szili to discuss using Mimecast Web Security to identify & block dangerous sites. http://www.sans.org/info/214995
2) Missed this webcast? 7 Myths of Security Automation: Be Clear on What It Can Achieve. http://www.sans.org/info/215000
3) Take SANS Training at RSA Conference 2020 | San Francisco, CA | Feb 23-24. http://www.sans.org/info/215005
============================================================
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP
Title: Microsoft discloses two critical bugs as part of monthly security update
Description: Microsoft released its monthly security update today, disclosing vulnerabilities across many of its products and releasing corresponding updates. This month's Patch Tuesday covers 25 vulnerabilities, two of which are considered critical. This month's security update covers security issues in a variety of Microsoft services and software, including Remote Desktop Protocol, Hyper-V and multiple Microsoft Office products.
Reference: https://blog.talosintelligence.com/2019/12/microsoft-patch-tuesday-dec-2019.html
Snort SIDs: 52402, 52403, 52410, 52411, 52419, 52420
Title: AMD ATI Radeon ATIDXX64.DLL shader functionality sincos denial-of-service vulnerability
Description: Cisco Talos recently discovered a denial-of-service vulnerability in a specific DLL inside of the AMD ATI Radeon line of video cards. This vulnerability can be triggered by supplying a malformed pixel shader inside a VMware guest operating system. Such an attack can be triggered from VMware guest usermode to cause an out-of-bounds memory read on vmware-vmx.exe process on host, or theoretically through WEBGL.
Reference: https://blog.talosintelligence.com/2019/12/vuln-spotlight-amd-radeon-550-DoS-VM-dec-2019.html
Snort SIDs: 51461, 51462 (By Tim Muniz)
============================================================
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
The city of Pensacola, Florida was hit with a ransomware attack over the weekend, taking many services offline, and officials aren't ruling out that the attack is connected to a shooting on a local military base from last week.
https://www.cnn.com/2019/12/09/us/pensacola-cyber-attack/index.html
A new ransomware called "Snatch" forces Windows machines to boot in safe mood, which allows the malware to avoid detection.
A new decryptor that the makers of the Ryuk ransomware say will recover victims' files after the ransom is paid will damage larger files, rendering them unusable.
https://blog.emsisoft.com/en/35023/bug-in-latest-ryuk-decryptor-may-cause-data-loss/
Several top cyber security officials from the White House announced their departure last week, a major blow to national election security as the 2020 presidential election just gets rolling.
A new report from the National Infrastructure Advisory Council states that a cyber attack on American infrastructure poses an "existential threat" to national security, and suggested President Donald Trumpt take "bold action" to secure ICS systems.
A new malware popping on Macs is staying fileless to avoid detection and may originate from hackers working with the North Korean government.
Reporters were able to bypass security protections on Ring smart doorbells, eventually uncovering more than 65,800 social media posts that were specifically related to video footage from the cameras in a randomly selected area of Washington, D.C.
https://gizmodo.com/ring-s-hidden-data-let-us-map-amazons-sprawling-home-su-1840312279
Adobe disclosed 14 critical vulnerabilities as part of its monthly security update, including bugs in Acrobat, Reader and Photoshop.
https://www.bleepingcomputer.com/news/security/adobe-releases-their-december-2019-security-updates/
=========================================================
RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM
This is a list of recent vulnerabilities for which exploits are
available. System administrators can use this list to help in
prioritization of their remediation activities. The Qualys Vulnerability
Research Team compiles this information based on various exploit
frameworks, exploit databases, exploit kits and monitoring of internet
activity.
ID: CVE-2019-15276
Title: Cisco Wireless LAN Controller Denial of Service Vulnerability
Vendor: Cisco
Description: A vulnerability in the web interface of Cisco Wireless LAN Controller Software could allow a low-privileged, authenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability exists due to a failure of the HTTP parsing engine to handle specially crafted URLs. An attacker could exploit this vulnerability by authenticating with low privileges to an affected controller and submitting the crafted URL to the web interface of the affected device.
CVSS v2 Base Score: 7.8 (AV:N/AC:L/Au:N/C:N/I:N/A:C)
ID: CVE-2019-19576
Title: Verot Remote Code Execution Vulnerability
Vendor: Verot
Description: Verot versions are exposed to remote code execution vulnerability. class.upload.php in verot.net class.upload, as used in the K2 extension for Joomla! and other products, omits .phar from the set of dangerous file extensions.
CVSS v2 Base Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
ID: CVE-2019-16702
Title: Integard Pro Remote Buffer Overflow Vulnerability
Vendor: Integard
Description: Integard Pro allows remote attackers to execute arbitrary code via a buffer overflow involving a long NoJs parameter to the /LoginAdmin URI. Integard fails to sanitize input to the "NoJs" parameter in an HTTP POST request# resulting in a stack buffer overflow that overwrites the instruction pointer, leading to remote code execution.
CVSS v2 Base Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
ID: CVE-2019-15627
Title: Trend Micro Deep Security Agent 11 Arbitrary File Overwrite Vulnerability
Vendor: Trend Micro
Description: Trend Micro Deep Security Agent are vulnerable to an arbitrary file delete attack, which may lead to availability impact. The attack requires access to local operating system. The vulnerability allows an unprivileged local attacker to delete any file on the filesystem, or overwrite it with abritrary data hosted elsewhere.
CVSS v2 Base Score: 6.6 (AV:L/AC:L/Au:N/C:N/I:C/A:C)
ID: CVE-2019-11708, CVE-2019-9810
Title: Mozilla Firfefox Multiple Vulnerabilities
Vendor: Mozilla
Description: This is a full browser compromise exploit chain targeting Mozilla Firefox on Windows 64-bit. It uses CVE-2019-9810 for getting code execution in both the content process as well as the parent process and CVE-2019-11708 to trick the parent process into browsing to an arbitrary URL. Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process. When combined with additional vulnerabilities this could result in executing arbitrary code on the user's computer. A remote attacker could entice a user to view a specially crafted web page, possibly resulting in the execution of arbitrary code with the privileges of the process or a Denial of Service condition.
Base Score: 10.0 HIGH Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C)
=========================================================
MOST PREVALENT MALWARE FILES Dec. 5 - 12:
COMPILED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP
SHA 256: 64f3633e009650708c070751bd7c7c28cd127b7a65d4ab4907dbe8ddaa01ec8b
MD5: 42143a53581e0304b08f61c2ef8032d7
VirusTotal: https://www.virustotal.com/gui/file/64f3633e009650708c070751bd7c7c28cd127b7a65d4ab4907dbe8ddaa01ec8b/details
Typical Filename: myfile.exe
Claimed Product: N/A
Detection Name: Pdf.Phishing.Phishing::malicious.tht.talos
SHA 256: f917be677daab5ee91dd3e9ec3f8fd027a58371524f46dd314a13aefc78b2ddc
MD5: c5608e40f6f47ad84e2985804957c342
VirusTotal: https://www.virustotal.com/gui/file/f917be677daab5ee91dd3e9ec3f8fd027a58371524f46dd314a13aefc78b2ddc/details
Typical Filename: FlashHelperServices.exe
Claimed Product: Flash Helper Service
Detection Name: PUA:2144FlashPlayer-tpd
SHA 256: 3f6e3d8741da950451668c8333a4958330e96245be1d592fcaa485f4ee4eadb3
MD5: 47b97de62ae8b2b927542aa5d7f3c858
VirusTotal: https://www.virustotal.com/gui/file/3f6e3d8741da950451668c8333a4958330e96245be1d592fcaa485f4ee4eadb3/details
Typical Filename: qmreportupload.exe
Claimed Product: qmreportupload
Detection Name: Win.Trojan.Generic::in10.talos
SHA 256: c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f
MD5: e2ea315d9a83e7577053f52c974f6a5a
VirusTotal: https://www.virustotal.com/gui/file/c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f/details
Typical Filename: c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f.bin
Claimed Product: N/A
Detection Name: W32.AgentWDCR:Gen.21gn.1201
SHA 256: 15716598f456637a3be3d6c5ac91266142266a9910f6f3f85cfd193ec1d6ed8b
MD5: 799b30f47060ca05d80ece53866e01cc
VirusTotal: https://www.virustotal.com/gui/file/15716598f456637a3be3d6c5ac91266142266a9910f6f3f85cfd193ec1d6ed8b/details
Typical Filename: mf2016341595.exe
Claimed Product: N/A
Detection Name: W32.Generic:Gen.22fz.1201
=============================================================
(c) 2019. All rights reserved. The information contained in this
newsletter, including any external links, is provided "AS IS," with no
express or implied warranty, for informational purposes only.
Please feel free to share this with interested parties via email, but
no posting is allowed on web sites. For a free subscription, (and for
free posters) or to update a current subscription, visit
SANS Institute, 8120 Woodmont Ave., Suite 310, Bethesda, MD 20814-2743
