@RISK: The Consensus Security Vulnerability Alert
March 14, 2019 – Vol. 19, Num. 11
=========================================================
CONTENTS:
NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES March 7 – 14, 2019
=========================================================
TOP VULNERABILITY THIS WEEK: Microsoft discloses 64 vulnerabilities as part of Patch Tuesday
=========================================================
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP
Title: Patch Tuesday includes 17 critical Microsoft vulnerabilities
Description: Microsoft released its monthly security update today, disclosing a variety of vulnerabilities in several of its products. The latest Patch Tuesday covers 64 vulnerabilities, 17 of which are rated “critical,” 45 that are considered “important” and one “moderate” and “low” vulnerability each. This release also includes two critical advisories — one covering security updates to Adobe Flash Player and another concerning SHA-2.
Reference: https://blog.talosintelligence.com/2019/03/microsoft-patch-tuesday-march-2019.html
Snort SIDs: 45142, 45143, 46554, 46555, 48051, 48052, 49172, 49173, 49364 – 49369, 49371, 49372, 49378 – 49395, 49400 – 49403
Title: Multiple vulnerabilities in Pixar Renderman
Description: The MacOS version of Pixar Renderman contains three local vulnerabilities in its install helper tool. An attacker could exploit these bugs to escalate their privileges to root. Renderman is a rendering application used in animation and film production produced by Pixar, a well-known film studio. When installing the application, a helper tool is installed and launched as root. This service continues to listen even after installation is complete. These vulnerabilities lie in the `Dispatch` function of this helper tool.
Reference: https://blog.talosintelligence.com/2019/03/vuln-spotlight-pixar-renderman-local-2019.html
Snort SIDs: 48450 – 48453, 49088, 49089
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
Iranian hackers stole an estimated six terabytes of data off of Citrix networks, including e-mails and files stored on sharing services.
https://www.forbes.com/sites/kateoflahertyuk/2019/03/10/citrix-data-breach-heres-what-to-do-next/#49654a741476
Several popular car alarm systems can be bypassed and turned off remotely by attackers, according to new research.
https://www.bbc.com/news/technology-47485731
Google Chrome pushed users to upgrade to Windows 10 after the web browser disclosed a zero-day bug in Windows 7 and Chrome that could allow attackers to push malicious code to users.
https://www.theverge.com/2019/3/8/18256335/google-chrome-windows-against-zero-day-vulnerabilities-update
A new report from the U.S.’s Office of the Inspector General warns that NASA has serious cybersecurity holes that could open the space agency to an attack from a nation-state actor.
https://www.infosecurity-magazine.com/news/nasas-poor-cybersecurity-1-1-1/
Adobe patched critical vulnerabilities in Photoshop and Digital Editions as part of its monthly security update.
https://www.bleepingcomputer.com/news/security/adobe-releases-march-2019-security-fixes-for-photoshop-cc-and-digital-editions/
Social media hackers have stepped up their efforts over the past few months to reinforce pro-Brexit sentiment as the British government works on a deal to leave the European Union.
https://www.securityweek.com/pro-brexit-twitter-manipulation-continues
MOST PREVALENT MALWARE FILES March 7 – 14, 2019
COMPILED BY TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP
SHA 256: 9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f
MD5: 38de5b216c33833af710e88f7f64fc98
VirusTotal: scan analysis
Typical Filename: SECOH-QAD.exe
Claimed Product: N/A
Detection Name: W32.Hacktool.22ei.1201
SHA 256: 225bb8a1bdcd0132a3624fde62f109a4d59056bc7418a7838b6ac0997127259b
MD5: f953dd9537961aa72648f39379b7ff51
VirusTotal: scan analysis
Typical Filename: SOA.doc
Claimed Product: N/A
Detection Name: W32.225BB8A1BD-95.SBX.TG
SHA 256: 6d36f92ee3f1a7be56e00118cebf62fc4f3f127e307f5a4e7f008793ca549671
MD5: b23f736c46d9fa238b02c9eb0cea37cf
VirusTotal: scan analysis
Typical Filename: CONFIGURETGN.EXE
Claimed Product: N/A
Detection Name: Win.Malware.Generic::in03.talos
SHA 256: 18042540b39d543e9e648e5d0b059d2e8c74889bb9353674be59c94da265f393
MD5: 1a5a7532854ab45ac74b1c657fe47941
VirusTotal: scan analysis
Typical Filename: helperamc.zip
Claimed Product: Advanced Mac Cleaner
Detection Name: W32.18042540B3-95.SBX.TG
SHA 256: 60c5f5f3b78b151fe6a01d4957ad536496b646e9d8288703d10fb8a03afb3b64
MD5: efcaf7a94501ad0c9a37f459a91e493f
VirusTotal: scan analysis
Typical Filename: 1SOAJAN19_exe.bin
Claimed Product: MONARCHOMACHIC9
Detection Name: W32.60C5F5F3B7-100.SBX.T