@RISK: The Consensus Security Vulnerability Alert: Vol. 18, Num. 1

=========================================================
CONTENTS:

NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITYVULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLEMOST PREVALENT MALWARE FILES 2017-12-26 – 2018-01-02

========================================================

TOP VULNERABILITY THIS WEEK: Researcher Discloses New Local Privilege Escalation 0-Day Vulnerability In Apple macOS

========================================================

TRAINING UPDATE

— SANS 2018 | Orlando, FL | April 3-10 | http://www.sans.org/u/zbH

— SANS Amsterdam January 2018 | January 15-20 | http://www.sans.org/u/wUT

— SANS Las Vegas 2018 | January 28-February 2 | http://www.sans.org/u/yjg

— Cyber Threat Intelligence Summit | Bethesda, MD | January 29-February 5 | http://www.sans.org/u/xTH

— SANS London February 2018 | February 5-10 | http://www.sans.org/u/yjq

— SANS Southern California-Anaheim 2018 | February 12-17 | http://www.sans.org/u/yJe

— Cloud Security Summit 2018 | San Diego, CA | February 19-26 | http://www.sans.org/u/yjl

— SANS Secure Japan 2018 | February 19-March 3 | http://www.sans.org/u/wUY

— SANS Secure Singapore 2018 | March 12-24 | http://www.sans.org/u/xTM

— SANS OnDemand and vLive Training | The SANS Training you want with the flexibility you need. Special Offer: Get a 10.5″ iPad Pro or an HP ProBook 450 G4, or take $400 Off with OnDemand and vLive Training when you register by January 10. http://www.sans.org/u/z8I

— Can’t travel? SANS offers online instruction for maximum flexibility

— Live Daytime training with Simulcast – http://www.sans.org/u/WK

— Evening training 2x per week for 6 weeks with vLive – http://www.sans.org/u/WZ

— Anywhere, Anytime access for 4 months with OnDemand format – http://www.sans.org/u/rEw

— Multi-week Live SANS training

Mentor – http://www.sans.org/u/X9

Contact mentor@sans.org

— Looking for training in your own community?

Community – http://www.sans.org/u/Xo

— Plus Miami, Scottsdale, London, Brussels, and Bangalore all in the next 90 days.

For a list of all upcoming events, on-line and live: http://www.sans.org/u/XN

========================================================

NOTABLE RECENT SECURITY ISSUES

SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

Title: Researcher Discloses New Local Privilege Escalation 0-Day Vulnerability In Apple macOS

Description: A researcher has disclosed a new 0-day vulnerability in Apple macOS that could allow an attacker to conduct a privilege escalation attack. This vulnerability manifests in the IOHIDFamily macOS kernel driver, which handles various types of user interaction, and can could be used to gain root access. As this vulnerability is a local privilege escalation flaw, it can only be exploited if an attacker has physical access to the host or if the attacker already has compromised the device. Updates that address this flaw are expected to be released in the next Security Update for macOS

Reference:

– https://www.bleepingcomputer.com/news/apple/macos-exploit-published-on-the-last-day-of-2017/
– https://siguza.github.io/IOHIDeous/

Title: VMware Releases Security Advisory for Three Critical Vulnerabilities in vSphere Data Protection (VDP)

Description: VMware has released a security advisory for vSphere Data Protection (VDP) to address three critical vulnerabilities. These flaws are identified as CVE-2017-15548, an authentication bypass vulnerability; CVE-2017-15549, an arbitrary file upload vulnerability; and CVE-2017-15550, a path traversal vulnerability. VMware has released a software update that addresses these vulnerabilities.

Reference: https://www.vmware.com/security/advisories/VMSA-2018-0001.html

Snort SID: Detection pending release of vulnerability information

========================================================

INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY

34C3 (34th Chaos Communications Congress) Talks
https://media.ccc.de/c/34c3

Black Hat Europe 2017 Videos
https://www.youtube.com/playlist?list=PLH15HpR5qRsXtpLirwYHPWyqcEFPbr-uB

Why TLS 1.3 isn’t in browsers yet
https://blog.cloudflare.com/why-tls-1-3-isnt-in-browsers-yet/

Kansas Man Killed In ‘SWATting’ Attack
https://krebsonsecurity.com/2017/12/kansas-man-killed-in-swatting-attack

========================================================

RECENT

VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE

COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM

This is a list of recent vulnerabilities for which exploits are
available. System administrators can use this list to help inprioritization of their remediation activities. The Qualys Vulnerability
Research Team compiles this information based on various exploit
frameworks, exploit databases, exploit kits and monitoring of internet
activity.

ID: CVE-2017-17562
Title: EmbedThis GoAhead Remote Code Execution Vulnerability
Vendor: EmbedThis GoAhead

Description: Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. This is a result of initializing the environment of forked CGI scripts using untrusted HTTP request parameters in the cgiHandler function in cgi.c. When combined with the glibc dynamic linker, this behaviour can be abused for remote code execution using special parameter names such as LD_PRELOAD. An attacker can POST their shared object payload in the body of the request, and reference it using /proc/self/fd/0.