End-of-Day report
Timeframe: Montag 19-03-2018 18:00 − Dienstag 20-03-2018 18:00
Handler: Robert Waldner
Co-Handler: n/a
News
∗∗∗ Administrators Password Bad Practice, (Tue, Mar 20th) ∗∗∗
Just a quick reminder about some bad practices while handling Windows Administrator credentials.
https://isc.sans.edu/diary/rss/23465
∗∗∗ This Android malware redirects calls you make to your bank to go to scammers instead ∗∗∗
Once installed the malware will intercept mobile calls you attempt to make to your bank, and instead direct them to a scammer impersonating an agent working for the bank. Furthermore, the malware will intercept calls from the *scammers*, and display a fake caller ID to make it appear as though the call is really from the legitimate bank. Very sneaky.
https://www.grahamcluley.com/this-android-malware-redirects-calls-you-make-to-your-bank-to-go-to-scammers-instead/
Vulnerabilities
∗∗∗ Bugtraq: ES2018-05 Kamailio heap overflow ∗∗∗
A specially crafted REGISTER message with a malformed `branch` or `From tag` triggers an off-by-one heap overflow.
Abuse of this vulnerability leads to denial of service in Kamailio. Further research may show that exploitation leads to remote code execution.
http://www.securityfocus.com/archive/1/541874
∗∗∗ Bugtraq: CSNC-2017-026 Microsoft Intune - Preserved Keychain Entries ∗∗∗
Compass Security discovered a design weakness in Microsoft Intune's iOS Keychain management. This allows users to access company data even after the device has been unenrolled.
http://www.securityfocus.com/archive/1/541875
∗∗∗ DFN-CERT-2018-0526/">Apache Commons Compress: Eine Schwachstelle ermöglicht einen Denial-of-Service-Angriff ∗∗∗
Ein entfernter, nicht authentisierter Angreifer kann mit Hilfe einer speziell präparierten ZIP-Archivdatei einen Denial-of-Service-Angriff auf Apache Commons Compress und auf Software, die dessen ZIP-Paket verwendet, durchführen.
Der Hersteller veröffentlicht zur Behebung der Schwachstelle die Version Commons Compress 1.16.
https://portal.cert.dfn.de/adv/DFN-CERT-2018-0526/
∗∗∗ DFN-CERT-2018-0532/">SDL2, SDL2_image: Mehrere Schwachstellen ermöglichen u.a. die Ausführung beliebigen Programmcodes ∗∗∗
Eine Vielzahl von Schwachstellen in verschiedenen Komponenten von SDL2_image ermöglicht einem entfernten, nicht authentisierten Angreifer mit Hilfe manipulierter Bilddateien, welche ein Benutzer anzeigen muss, die Ausführung beliebigen Programmcodes sowie die Durchführung verschiedener Denial-of-Service (DoS)-Angriffe.
https://portal.cert.dfn.de/adv/DFN-CERT-2018-0532/
∗∗∗ Security updates for Tuesday ∗∗∗
Security updates have been issued by Arch Linux (clamav, curl, lib32-curl, lib32-libcurl-compat, lib32-libcurl-gnutls, libcurl-compat, and libcurl-gnutls), openSUSE (various KMPs), Oracle (firefox), Scientific Linux (firefox), SUSE (java-1_7_1-ibm), and Ubuntu (memcached).
https://lwn.net/Articles/749757/
∗∗∗ [R1] Nessus 7.0.3 Fixes One Vulnerability ∗∗∗
When installing Nessus to a directory outside of the default location, Nessus did not enforce secure permissions for sub-directories. This could allow for local privilege escalation if users had not secured the directories in the installation location.
http://www.tenable.com/security/tns-2018-01
∗∗∗ Geutebruck IP Cameras ∗∗∗
This advisory includes mitigations for several vulnerabilities in the Geutebrück IP Cameras.
https://ics-cert.us-cert.gov/advisories/ICSA-18-079-01
∗∗∗ Siemens SIMATIC, SINUMERIK, and PROFINET IO ∗∗∗
This advisory includes mitigations for an improper input validation vulnerability in the Siemens SIMATIC, SINUMERIK, and PROFINET IO products.
https://ics-cert.us-cert.gov/advisories/ICSA-18-079-02
∗∗∗ IBM Security Bulletin: Denial of Service attack affects IBM Integrated Management Module II (IMM2) for System x, Flex and BladeCenter Systems (CVE-2017-3768) ∗∗∗
https://www.ibm.com/support/home/docdisplay?lndocid=migr-5099791
∗∗∗ IBM Security Bulletin: Vulnerabilities in Ncurses affect IBM Integrated Management Module II (IMM2) for System x, Flex and BladeCenter Systems ∗∗∗
https://www.ibm.com/support/home/docdisplay?lndocid=migr-5099790
∗∗∗ IBM Security Bulletin: Vulnerability in cURL affects IBM BladeCenter Advanced Management Module (AMM) ∗∗∗
https://www.ibm.com/support/home/docdisplay?lndocid=migr-5099766
∗∗∗ IBM Security Bulletin: Vulnerability in Linux Kernel affects IBM BladeCenter Advanced Management Module (AMM) ∗∗∗
https://www.ibm.com/support/home/docdisplay?lndocid=migr-5099767
∗∗∗ IBM Security Bulletin: Vulnerabilities in HTTPD affect IBM BladeCenter Advanced Management Module (AMM) ∗∗∗
https://www.ibm.com/support/home/docdisplay?lndocid=migr-5099759
∗∗∗ IBM Security Bulletin: Vulnerabilities in OpenSSH affect IBM BladeCenter Advanced Management Module (AMM) ∗∗∗
https://www.ibm.com/support/home/docdisplay?lndocid=migr-5099758
∗∗∗ IBM Security Bulletin: Vulnerability in strongSwan affects IBM Chassis Management Module (CVE-2017-11185) ∗∗∗
https://www.ibm.com/support/home/docdisplay?lndocid=MIGR-5099779
∗∗∗ IBM Security Bulletin: Vulnerabilities in expat affects IBM BladeCenter Advanced Management Module (AMM) ∗∗∗
https://www.ibm.com/support/home/docdisplay?lndocid=MIGR-5099765
∗∗∗ IBM Security Bulletin: Vulnerability in cURL affects IBM Chassis Management Module (CVE-2017-1000100) ∗∗∗
https://www.ibm.com/support/home/docdisplay?lndocid=MIGR-5099776
∗∗∗ IBM Security Bulletin: Vulnerability in libxml2 affects IBM Chassis Management Module (CVE-2017-8872) ∗∗∗
https://www.ibm.com/support/home/docdisplay?lndocid=MIGR-5099775