@RISK: The Consensus Security Vulnerability Alert: Vol. 17, Num. 52

=============================================================
CONTENTS:

NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES 2017-12-19 – 2017-12-26
============================================================

TOP VULNERABILITY THIS WEEK: Arbitrary Command Injection Vulnerability in Net::FTP Ruby Library Identified and Patched

============================================================

TRAINING UPDATE

— SANS Security East 2018 | New Orleans, LA | January 8-13 | http://www.sans.org/u/xmN

— SANS Amsterdam January 2018 | January 15-20 | http://www.sans.org/u/wUT

— SANS Las Vegas 2018 | January 28-February 2 | http://www.sans.org/u/yjg

— Cyber Threat Intelligence Summit | Bethesda, MD | January 29-February 5 | http://www.sans.org/u/xTH

— SANS London February 2018 | February 5-10 | http://www.sans.org/u/yjq

— SANS Southern California-Anaheim 2018 | February 12-17 | http://www.sans.org/u/yJe

— Cloud Security Summit 2018 | San Diego, CA | February 19-26 | http://www.sans.org/u/yjl

— SANS Secure Japan 2018 | February 19-March 3 | http://www.sans.org/u/wUY

— SANS Secure Singapore 2018 | March 12-24 | http://www.sans.org/u/xTM

— SANS OnDemand and vLive Training | The SANS Training you want with the flexibility you need. Special Offer: Get a 10.5 iPad Pro or an HP ProBook 450 G4, or take $400 Off with OnDemand and vLive Training when you register by January 10. http://www.sans.org/u/z8I

— Can’t travel? SANS offers online instruction for maximum flexibility

— Live Daytime training with Simulcast – http://www.sans.org/u/WK

— Evening training 2x per week for 6 weeks with vLive – http://www.sans.org/u/WZ

— Anywhere, Anytime access for 4 months with OnDemand format – http://www.sans.org/u/rEw

— Multi-week Live SANS training

Mentor – http://www.sans.org/u/X9

Contact mentor@sans.org

— Looking for training in your own community?

Community – http://www.sans.org/u/Xo

— Plus Miami, Scottsdale, London, Brussels, and Bangalore all in the next 90 days.

— For a list of all upcoming events, on-line and live: http://www.sans.org/u/XN

============================================================

NOTABLE RECENT SECURITY ISSUES

SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

Title: Arbitrary Command Injection Vulnerability in Net::FTP Ruby Library Identified and Patched

Description: An arbitrary command injection vulnerability has been identified in the Net::FTP library in Ruby. This vulnerability, assigned CVE-2017-17405, manifests due to specific functions in the library using Kernel#open without properly sanitizing the value. This vulnerability has been patched and software updates have been released to address this issue.

Reference: https://hackerone.com/reports/294462

Title: VMWare VNC Vulnerabilities Identified and Patched

Description: A pair of remote code execution vulnerabilities have been identified in VMWare’s VNC implementation. These vulnerabilities can be leveraged by an attacker establishing a VNC connection to a host resulting in code execution. This vulnerability has been patched and software updates have been released to address the issue.

Reference:

– https://www.vmware.com/security/advisories/VMSA-2017-0021.html

– http://blog.talosintelligence.com/2017/12/vulnerability-spotlight-vmware-vnc.html

Snort SID: 43483-43486

============================================================

INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY

Zealot: New Apache Struts Campaign Uses EternalBlue and EternalSynergy To Mine Monero On Internal Networks

https://f5.com/labs/articles/threat-intelligence/cyber-security/zealot-new-apache-struts-campaign-uses-eternalblue-and-eternalsynergy-to-mine-monero-on-internal-networks

Reverse Engineering With Radare2â – âPart 2

https://medium.com/@jacob16682/reverse-engineering-with-radare2-part-2-83b71df7ffe4

Lithuania bans Kaspersky Lab software on sensitive computers

https://www.reuters.com/article/us-lithuania-russia/lithuania-bans-kaspersky-lab-software-on-sensitive-computers-idUSKBN1EF23M

=========================================================

RECENT

VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE

COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM

This is a list of recent vulnerabilities for which exploits are
available. System administrators can use this list to help in
prioritization of their remediation activities. The Qualys Vulnerability
Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.

ID: CVE-2017-17562
Title: EmbedThis GoAhead Remote Code Execution Vulnerability
Vendor: EmbedThis GoAhead

Description: Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. This is a result of initializing the environment of forked CGI scripts using untrusted HTTP request parameters in the cgiHandler function in cgi.c. When combined with the glibc dynamic linker, this behaviour can be abused for remote code execution using special parameter names such as LD_PRELOAD. An attacker can POST their shared object payload in the body of the request, and reference it using /proc/self/fd/0.