Security Vulnerability Alert Archives - Page 8 of 33

January 9, 2020March 6, 2020

@RISK: The Consensus Security Vulnerability Alert: Vol. 20, Num. 02

@RISK: The Consensus Security Vulnerability Alert
January 9, 2020 – Vol. 20, Num. 02

CONTENTS:
=========================================================
NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES January 2 – 9, 2020
=========================================================
TOP VULNERABILITY THIS WEEK: Cisco Data Center Network Manager patches SQL injection, code execution vulnerabilities
=========================================================
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

Title: Cisco patches dozen vulnerabilities in Data Center Network Manager
Description: Cisco released multiple security advisories last week announcing patches for 12 vulnerabilities in the Data Center Network Manager software. The software allows users to manage their Cisco switches and fabric extenders. Three of the vulnerabilities disclosed (CVE-2019-15975, CVE-2019-15976 and CVE-2019-15977) could allow an unauthenticated, remote attacker to bypass authentication and carry out a variety of malicious tasks with administrative privileges on an affected device.
Reference: https://www.helpnetsecurity.com/2020/01/06/cisco-data-center-network-manager-flaws-fixed/
Snort SIDs: 52530 – 52547

Title: Buffer overflow vulnerabilities in OpenCV
Description: Cisco Talos recently discovered two buffer overflow vulnerabilities in the OpenCV libraries. An attacker could potentially exploit these bugs to cause heap corruptions and potentially code execution. Intel Research originally developed OpenCV in 1999, but it is currently maintained by the non-profit organization OpenCV.org. OpenCV is used for numerous applications, including facial recognition technology, robotics, motion tracking and various machine learning programs.
Reference: https://blog.talosintelligence.com/2020/01/opencv-buffer-overflow-jan-2020.html
Snort SIDs: 50774, 50775 (By Dave McDaniel)

INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY

Companies, organizations and government agencies in the U.S. are anxiously bracing for a retaliatory cyber attack from Iran after an American drone attack on a top Iranian general.
https://www.newyorker.com/tech/annals-of-technology/should-the-us-expect-an-iranian-cyberattack

The U.S. Department of Homeland Security even went so far as to release a warning telling companies to “consider and assess” the possible damage a state-sponsored attack from Iran could have on their operations.
https://techcrunch.com/2020/01/06/homeland-security-iran-cyberattacks/

Homeland Security is expected to push for legislation in 2020 that would allow them to subpoena internet companies to protect infrastructure from cyber attacks.
https://news.bloomberglaw.com/tech-and-telecom-law/cybersecurity-infrastructure-top-homeland-security-hill-agenda

Currency exchange marketplace Travelex’s website was still down as of Tuesday morning after an attack on New Year’s Eve. The company referred to the attack as a “software virus.”
https://www.infosecurity-magazine.com/news/travelex-site-down-new-years-eve/

England is looking into whether malware caused an outage at the London stock exchange in August, though the trading outage was initially blamed on a software glitch. (Please note that this story is behind a paywall.)
https://www.wsj.com/articles/u-k-examines-if-cyberattack-triggered-london-stock-exchange-outage-11578232800

Wyze smart camera users are urged to reset their passwords and reconnect third-party apps after researchers discovered an exposed database containing users’ personal information.
https://www.cnet.com/how-to/wyze-camera-data-leak-how-to-secure-your-account-right-now/

A Japanese intelligence agency released a warning that it is expecting state-sponsored cyber attacks on the 2020 Olympic Games slated to take place later this year after it discovered a series of targeted phishing emails.
https://www.cpomagazine.com/cyber-security/state-backed-cyber-attacks-expected-at-tokyo-2020-games/

Attackers are still exploiting a vulnerability in the Pulse Secure VPN service to deliver malware that deletes the victim’s backup files and disables endpoint security controls.
https://doublepulsar.com/big-game-ransomware-being-delivered-to-organisations-via-pulse-secure-vpn-bd01b791aad9

MOST PREVALENT MALWARE FILES January 2 – 9, 2020
COMPILED BY TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

SHA 256: d73ea76f6f07f96b337335213418b58e3fbc7e4b519fec0ef3fbd19c1d335d81
MD5: 5142c721e7182065b299951a54d4fe80
VirusTotal: scan analysis
Typical Filename: FlashHelperServices.exe
Claimed Product: Flash Helper Service
Detection Name: PUA.Win.Adware.Flashserv::1201

SHA 256: 5fc600351bade74c2791fc526bca6bb606355cc65e5253f7f791254db58ee7fa
MD5: 121e1634bf18768802427f0a13f039a9
VirusTotal: scan analysis
Typical Filename: AA_v3.exe
Claimed Product: Ammyy Admin
Detection Name: W32.SPR:Variant.22fn.1201

SHA 256: 1c3ed460a7f78a43bab0ae575056d00c629f35cf7e72443b4e874ede0f305871
MD5: c2406fc0fce67ae79e625013325e2a68
VirusTotal: scan analysis
Typical Filename: SegurazoIC.exe
Claimed Product: Digital Communications Inc.
Detection Name: PUA.Win.Adware.Ursu::95.sbx.tg

SHA 256: d8b594956ed54836817e38b365dafdc69aa7e07776f83dd0f706278def8ad2d1
MD5: 56f11ce9119632ba360e5b3dd0a89acd
VirusTotal: scan analysis
Typical Filename: xme64-540.exe
Claimed Product: N/A
Detection Name: PUA.Win.Tool.Coinminer::100.sbx.tg

SHA 256: c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f
MD5: e2ea315d9a83e7577053f52c974f6a5a
VirusTotal: scan analysis
Typical Filename: c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f.bin
Claimed Product: N/A
Detection Name: W32.AgentWDCR:Gen.21gn.1201

January 2, 2020March 6, 2020

@RISK: The Consensus Security Vulnerability Alert: Vol. 20, Num. 01

@RISK: The Consensus Security Vulnerability Alert
January 2, 2020 – Vol. 20, Num. 01

CONTENTS:
=========================================================
NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
MOST PREVALENT MALWARE FILES December 26, 2019 – January 2, 2020
=========================================================
TOP VULNERABILITY THIS WEEK: Bug in Citrix leaves corporate local networks open to attack
=========================================================
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

Title: Arbitrary code execution vulnerability in Citrix
Description: The Citrix Application Delivery Controller (ADC) and Citrix Gateway contain remote code execution vulnerability that could allow an attacker to infiltrate a large-scale LAN. The digital workspace and enterprise network vendor said the bug does not require the use of any credentials, so therefore could be carried out by anyone. Citrix released a set of measures to mitigate the vulnerability, including software updates. These products are installed in more than 150,000 companies’ networks across the globe.
Reference: https://threatpost.com/critical-citrix-bug-80000-corporate-lans-at-risk/151444/
Snort SIDs: 52512, 51513

INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY

Russia’s meddling in the 2016 American presidential election may trace back to a breach at a Florida tech company, according to a new report.
https://www.politico.com/news/magazine/2019/12/26/did-russia-really-hack-2016-election-088171

U.S. Congress passed a law aimed at cracking down on the companies and individuals behind robocalls, but the legislation is unlikely to actually help most users.
https://www.wsj.com/articles/washingtons-new-anti-robocall-law-wont-stop-the-calls-heres-why-11577367931

The British government apologized to the high-profile individuals whose information was leaked online, all of whom had received a prestigious award in the past, including Sir Elton John.
https://www.bbc.com/news/uk-50929543

New Orleans says it is raising its cyber insurance coverage in 2020 after a crippling ransomware attack in mid-December.
https://www.msspalert.com/cybersecurity-breaches-and-attacks/ransomware/new-orleans-cyber-insurance-plan/

Home security company Wyze says it mistakenly left 2.4 million users’ information exposed over the course of three weeks, including email addresses, SSIDs and API tokens.
https://www.theverge.com/2019/12/30/21042974/wyze-server-breach-cybersecurity-smart-home-security-camera

A government agency in South Korea is launching an investigation into the TikTok social media app after an official raised concerns about how the Chinese company behind the app handles personal data.
https://news.softpedia.com/news/security-risks-trigger-tiktok-investigation-in-south-korea-528726.shtml

Several individuals and groups have already filed lawsuits against Wawa after they say their credit card information was stolen and used in the data breach the gas station chain disclosed in December.
https://www.inquirer.com/business/wawa-data-breach-class-action-lawsuit-20191226.html

A deadline in Russia is quickly approaching that would require smart device manufacturers to install Russian-made software on their devices before they can hit store shelves, including a web browser that would restrict access to some social media apps.
https://www.hollywoodreporter.com/news/new-russian-legislation-targets-apple-facebook-twitter-netflix-1264747

MOST PREVALENT MALWARE FILES December 26, 2019 – January 2, 2020
COMPILED BY TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

SHA 256: 3f6e3d8741da950451668c8333a4958330e96245be1d592fcaa485f4ee4eadb3
MD5: 47b97de62ae8b2b927542aa5d7f3c858
VirusTotal: scan analysis
Typical Filename: qmreportupload.exe
Claimed Product: qmreportupload
Detection Name: Win.Trojan.Generic::in10.talos

SHA 256: 252555d28366ea4d2d2066ea1f66b1250b7cc297a2b0066a595f5a2b240a0637
MD5: 3e1e9579a3b11547adc012d9b1caf273
VirusTotal: scan analysis
Typical Filename: cloudnet.exe
Claimed Product: EpicNet Cloud Office
Detection Name: W32.252555D283-100.SBX.TG

December 26, 2019March 6, 2020

@RISK: The Consensus Security Vulnerability Alert: Vol. 19, Num. 52

@RISK: The Consensus Security Vulnerability Alert
December 26, 2019 – Vol. 19, Num. 52

CONTENTS:
=========================================================
NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
MOST PREVALENT MALWARE FILES December 19 – 26, 2019
=========================================================
TOP VULNERABILITY THIS WEEK: Attackers utilize Cisco ASA bug to carry out DoS attacks
=========================================================
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

Title: Old vulnerability in Cisco Adaptive Security Appliances exploited in DoS attacks
Description: Attackers are exploiting a patched vulnerability in Cisco ASA to carry out denial-of-service attacks and steal critical information. The vulnerability, CVE-2018-0296, is directory traversal bug found in the web framework of Adaptive Security Appliance and Firepower Appliance. The attacker can use a specially crafted URL to cause the ASA appliance to reboot or disclose unauthenticated information. This vulnerability was first discovered and patched in June 2018, but vulnerable devices are still being targeted.
Reference: https://www.bleepingcomputer.com/news/security/cisco-security-appliances-targeted-for-dos-attacks-via-old-bug/
Snort SIDs: 46897

Title: Multiple vulnerabilities in some WAGO devices
Description: The WAGO PFC200 and PFC100 controllers contain multiple exploitable vulnerabilities. The PFC200 is one of WAGO’s programmable automation controllers that are used in many industries including automotive, rail, power engineering, manufacturing and building management. The vulnerabilities disclosed here all have their root cause within the protocol handling code of the I/O Check (iocheckd) configuration service used by the controllers. The vulnerabilities discussed here could allow an attacker to remotely execute code, deny service to the device or weaken device login credentials.
Reference: https://blog.talosintelligence.com/2019/12/vulnerability-spotlight-multiple.html
Snort SIDs: 50786 – 50789, 50790 – 50793, 50797

INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY

Reporters and researchers at the New York Times were able to use leaked location data to track cell phone users across the U.S., even President Donald Trump, the sign of a major national security risk.
https://www.nytimes.com/interactive/2019/12/19/opinion/location-tracking-cell-phone.html

The login credentials for more than 3,000 Ring camera users were leaked last week, the latest blow to the Amazon-owned security company.
https://www.buzzfeednews.com/article/carolinehaskins1/data-leak-exposes-personal-data-over-3000-ring-camera-users

Gas station chain Wawa says it was the victim of a credit card-stealing attack since March, potentially affecting every customer at each of its locations. The company is offering victims free fraud protection for a year.
https://slate.com/technology/2019/12/how-bad-is-the-wawa-data-breach.html

A U.S. government-sponsored study found there is a high rate of error in facial recognition technology, especially among non-whites, often assigning individuals the wrong genger or identifying them as the incorrect race.
https://news.yahoo.com/massive-errors-found-facial-recognition-tech-us-study-215334634.html

An airline in Alaska had to cancel several flights after what the company called a “malicious cyber attack.”
https://www.usatoday.com/story/travel/news/2019/12/22/alaska-airline-cancels-flights-after-malicious-cyber-attack/2727709001/

U.S. military members are now banned from using the popular social media app TikTok on government-issued devices, citing security concerns based on the app developer’s potential connections to China.
https://www.pcmag.com/news/372673/us-navy-bans-tiktok-citing-cybersecurity-threat

Content management system Drupal released a series of security updates, fixing a critical vulnerability that could allow an attacker to directly upload some malicious files to a website.
https://thehackernews.com/2019/12/drupal-website-hacking.html

An exposed Elasticsearch database exposed the personal information of more than 26,000 Honda car owners, including names, addresses, VINs and email addresses.
https://www.scmagazine.com/home/security-news/database-security/open-database-exposes-26000-honda-motors-customers/

MOST PREVALENT MALWARE FILES December 19 – 26, 2019
COMPILED BY TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

SHA 256: 15716598f456637a3be3d6c5ac91266142266a9910f6f3f85cfd193ec1d6ed8b
MD5: 799b30f47060ca05d80ece53866e01cc
VirusTotal: scan analysis
Typical Filename: mf2016341595.exe
Claimed Product: N/A
Detection Name: W32.Generic:Gen.22fz.1201

SHA 256: b32093d726609c88a06f71b8fe74e9e5a04c2dfe81fc39743bdd970bf4dea017
MD5: baadce7c152b24bd48cc1f2f4a0b088d
VirusTotal: scan analysis
Typical Filename: xme64-530.exe
Claimed Product: N/A
Detection Name: W32.B32093D726-100.SBX.TG