End-of-Day report
Timeframe: Donnerstag 25-10-2018 18:00 - Montag 29-10-2018 18:00
Handler: Dimitri Robl
Co-Handler: Stephan Richter
News
Windows 10 Bug Allowed UWP Apps Full Access to File System
A bug in Windows 10 allowed UWP apps (Universal Windows Platform) to have access to the entire file system in Windows without permission from the user. This could have allowed a malicious app to access any data stored on the computer without the knowledge or consent of the user.
https://www.bleepingcomputer.com/news/security/windows-10-bug-allowed-uwp-apps-full-access-to-file-system/
Linux und BSD: Sicherheitslücke in X.org ermöglicht Root-Rechte
Eine Sicherheitslücke im Displayserver X.org erlaubt unter bestimmten Umständen das Überschreiben von Dateien und das Ausweiten der Benutzerrechte. Der passende Exploit passt in einen Tweet. (Sicherheitslücke, OpenBSD)
https://www.golem.de/news/linux-und-bsd-sicherheitsluecke-in-x-org-ermoeglicht-root-rechte-1810-137347-rss.html
Sicherheitslücke: Steuerung von Bau-Kran lässt sich übernehmen
Eine Sicherheitslücke in der kabellosen Kransteuerung Telecrane F25 ermöglicht es, Signale mitzuschneiden und mit diesen anschließend den Kran fernzusteuern. Ein Sicherheitsupdate steht bereit. (Sicherheitslücke, Mobil)
https://www.golem.de/news/sicherheitsluecke-steuerung-von-bau-kran-laesst-sich-uebernehmen-1810-137374-rss.html
OWASP Top 10 Security Risks - Part II
It is National Cyber Security Awareness Month and in order to bring awareness to what threatens the integrity of websites, we have started a series of posts on the OWASP top 10 security risks.
https://blog.sucuri.net/2018/10/owasp-top-10-security-risks-part-ii.html
The D in Systemd stands for Dammmmit! A nasty DHCPv6 packet can pwn a vulnerable Linux box
Hole opens up remote-code execution to miscreants - or a crash, if youre lucky A security bug in Systemd can be exploited over the network to, at best, potentially crash a vulnerable Linux machine, or, at worst, execute malicious code on the box.
http://go.theregister.com/feed/www.theregister.co.uk/2018/10/26/systemd_dhcpv6_rce/
Google schreibt Android-Herstellern zwei Jahre Sicherheitspatches vor
In einem Vertrag schreibt Google Herstellern von Android-Smartphones regelmäßige Sicherheitsupdates vor. Diese Verpflichtung gilt bereits seit dem Sommer.
http://heise.de/-4203113
Ransomware and the enterprise: A new white paper
Ransomware remains a serious threat and this new white paper explains what enterprises need to know, and do, to reduce risk The post Ransomware and the enterprise: A new white paper appeared first on WeLiveSecurity
https://www.welivesecurity.com/2018/10/29/ransomware-enterprise-new-white-paper/
Vulnerabilities
GEOVAP Reliance 4 SCADA/HMI
This advisory includes mitigations for a cross-site scripting vulnerability in GEOVAPs Reliance 4 SCADA/HMI system.
https://ics-cert.us-cert.gov/advisories/ICSA-18-298-01
Advantech WebAccess
This advisory includes mitigations for stack-based buffer overflow, and improper access control vulnerabilities in Advantechs WebAccess.
https://ics-cert.us-cert.gov/advisories/ICSA-18-298-02
Cisco Advanced Malware Protection for Endpoints on Windows DLL Preloading Vulnerability
A vulnerability in the DLL loading component of Cisco Advanced Malware Protection (AMP) for Endpoints on Windows could allow an authenticated, local attacker to disable system scanning services or take other actions to prevent detection of unauthorized intrusions.
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181029-amp-dll
Security updates for Friday
Security updates have been issued by Arch Linux (firefox), CentOS (firefox), Debian (389-ds-base, openjdk-8, thunderbird, and xorg-server), Fedora (firefox), openSUSE (GraphicsMagick, jhead, mysql-community-server, ntp, postgresql96, python-cryptography, rust, tomcat, webkit2gtk3, and zziplib), Scientific Linux (firefox), and SUSE (clamav, firefox, ImageMagick, libgit2, net-snmp, smt, wpa_supplicant, and xorg-x11-server).
https://lwn.net/Articles/769613/
Security updates for Monday
Security updates have been issued by Arch Linux (xorg-server), Debian (graphicsmagick, libmspack, paramiko, ruby2.1, teeworlds, and tiff), Fedora (lldpad), Mageia (bitcoin, blueman, busybox, dhcp, exempi, firefox, kernel, kernel-linus, kernel-tmb, lilypond, ruby, and x11-server), openSUSE (audiofile, clamav, hostapd, ImageMagick, lcms2, libgit2, mercurial, net-snmp, and wpa_supplicant), SUSE (audiofile, binutils, kdelibs3, lcms2, mysql, openssh, and xen), and Ubuntu (mysql-5.5 and xorg-server, [...]
https://lwn.net/Articles/769891/
WebKitGTK+ 2.22.3 released!
This is a bug fix release in the stable 2.22 series. What-s new in the WebKitGTK+ 2.22.3 release? [...] Fix a memory leak during media playback when using playbin3. Fix portions of Web views not being rendered after resizing. Fix Resource Timing reporting for elements. Fix the build with the remote Web Inspector [...]
https://webkitgtk.org/2018/10/29/webkitgtk2.22.3-released.html
OpenSSL: Eine Schwachstelle ermöglicht das Ausspähen des privaten Schlüssels
https://adv-archiv.dfn-cert.de/adv/2018-2188/
IBM Security Bulletin: Vyatta 5600 vRouter Software Patches - Release 1801r
http://www.ibm.com/support/docview.wss?uid=ibm10737409
IBM Security Bulletin: Cross-site scripting vulnerability affects IBM® Rational® Team Concert
http://www.ibm.com/support/docview.wss?uid=ibm10737301
IBM Security Bulletin: Cross-site scripting vulnerability in CacheMonitor for WebSphere Application Server (CVE-2018-1767)
https://www-01.ibm.com/support/docview.wss?uid=ibm10729547
Microsoft Skype for Business Audio File Processing Flaw Lets Remote Users Execute Arbitrary Code
http://www.securitytracker.com/id/1041956
Apache Tomcat vulnerability CVE-2018-11784
https://support.f5.com/csp/article/K64921482
Mozilla NSS vulnerability CVE-2018-12384
https://support.f5.com/csp/article/K41738501
HPESBMU03895 rev.1 - HPE Real Time Management System (RTMS), Multiple Remote Security Issues
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbmu03895en_us
HPESBHF03869 rev.1 - HPE Windows Firmware Installer for certain HPE Gen9,Gen8, G7, and G6 Servers, Local Disclosure of Privileged Information
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03869en_us