Tageszusammenfassung - Dienstag 13-08-2013

End-of-Shift report

Timeframe: Montag 12-08-2013 18:00 − Dienstag 13-08-2013 18:00 Handler: Matthias Fraidl Co-Handler: n/a

Blaster - 3654 Days Later

Yesterday was Blasters 10th anniversary. Do you remember where you were on August 11, 2003? Numerous organizations, including several banks and airlines, suffered serious disruptions because of Blaster which caused affected computers to reboot continuously. Can you imagine the difficulties that would cause today?

http://www.f-secure.com/weblog/archives/00002587.html

Cybercrime-friendly underground traffic exchange helps facilitate fraudulent and malicious activity

By Dancho Danchev Throughout the last couple of years, the persistent demand for geolocated traffic coming from both legitimate traffic exchanges or purely malicious ones - think traffic acquisition through illegally embedded iFrames - has been contributing to the growing market segment where traffic is bought, sold and re-sold, ...

http://blog.webroot.com/2013/08/13/cybercrime-friendly-underground-traffic-exchange-helps-facilitate-fraudulent-and-malicious-activity

Attackers Toolbox Makes Malware Detection More Difficult

Sometimes the simplest techniques can foil the complex systems created by security firms and large enterprises to detect malicious programs and files. Putting malware to sleep, waiting for a user to click, or looking for the hallmarks of a virtual machine can set off warning bells and cause a malicious program to cease running, making analysis difficult at best.

http://www.darkreading.com/monitoring/attackers-toolbox-makes-malware-detectio/240159800

Researchers demonstrate how IPv6 can easily be used to perform MitM attacks

Many devices simply waiting for router advertisements, good or evil. When early last year I was doing research for an article on IPv6 and security, I was surprised to learn how easy it was to set up an IPv6 tunnel into an IPv4-only environment.

http://www.virusbtn.com/blog/2013/08_12.xml

Joomla Patches Zero Day Targeting EMEA Banks

Content management system Joomla patched a zero-day vulnerability that allowed attackers to upload malicious code that led victims to the Blackhole exploit kit.

http://threatpost.com/joomla-patches-zero-day-targeting-emea-banks/101976

WordPress All-in-One Event Calendar Plugin Script Insertion and SQL Injection Vulnerabilities

https://secunia.com/advisories/54038

HP StorageWorks P4000 Virtual SAN Appliance Login Buffer Overflow

http://cxsecurity.com/issue/WLB-2013080109

IBM HTTP Server mod_rewrite Arbitrary Command Execution Vulnerability

https://secunia.com/advisories/54497

Juniper Network and Security Manager Apache Axis2 Security Issue and Vulnerability

https://secunia.com/advisories/54454

Tageszusammenfassung - Dienstag 13-08-2013

End-of-Shift report

Blaster - 3654 Days Later

Cybercrime-friendly underground traffic exchange helps facilitate fraudulent and malicious activity

Attackers Toolbox Makes Malware Detection More Difficult

Researchers demonstrate how IPv6 can easily be used to perform MitM attacks

Joomla Patches Zero Day Targeting EMEA Banks

WordPress All-in-One Event Calendar Plugin Script Insertion and SQL Injection Vulnerabilities

HP StorageWorks P4000 Virtual SAN Appliance Login Buffer Overflow

IBM HTTP Server mod_rewrite Arbitrary Command Execution Vulnerability

Juniper Network and Security Manager Apache Axis2 Security Issue and Vulnerability

Dovecot POP3 "LIST" Command Handling Denial of Service Vulnerability

Debian Security Advisory DSA-2737 swift

IBM Advanced Management Module Cross-Site Scripting (XSS)

Ajax PHP Penny Auction 1.x 2.x multiple Vulnerabilities

Python SSL Module "subjectAltNames" NULL Byte Handling Security Issue