End-of-Day report
Timeframe: Montag 25-06-2018 18:00 - Dienstag 26-06-2018 18:00
Handler: Robert Waldner
Co-Handler: n/a
News
WPA3: Neuer WLAN-Verschlüsselungsstandard verabschiedet
Die Wi-Fi Alliance hat mit WPA3 einen neuen Verschlüsselungsstandard für drahtlose Netze vorgestellt. Darin werden einige Macken von früheren Standards ausgebessert, wie etwa Offline-Passwort-Angriffe unterbunden und Forward Secrecy eingeführt.
https://www.golem.de/news/wpa3-neuer-wlan-verschluesselungsstandard-verabschiedet-1806-135150-rss.html
Sicherheit von Industrieanlagen: BSI veröffentlicht Snort-Regeln für SIS-Netzwerke
Zum besseren Schutz vor Cyber-Angriffen mit Schadsoftware wie "Triton/Trisis/HatMan" hat das Bundesamt für Sicherheit in der Informationstechnik (BSI) sogenannte Snort-Regeln für das TriStation-Kommunikationsprotokoll der Firma Schneider Electric veröffentlicht.
https://www.bsi.bund.de/DE/Presse/Pressemitteilungen/Presse2018/RAPSN_SETS_26062018.html
Files Cannot Be Decrypted? Challenge Accepted. Talos Releases ThanatosDecryptor
This blog post was authored by Edmund Brumaghin, Earl Carter and Andrew Williams.Executive summaryCisco Talos has analyzed Thanatos, a ransomware variant that is being distributed via multiple malware campaigns that have been conducted over the past few months. As a result of our research, we have released a new, free decryption tool to help victims recover from this malware.
http://feedproxy.google.com/~r/feedburner/Talos/~3/_YSxzYWrMgs/ThanatosDecryptor.html
Vulnerabilities
[20180602] - Core - XSS vulnerability in language switcher module
Severity: Low
Versions: 1.6.0 through 3.8.8
Exploit type: XSS
Number: CVE-2018-12711
In some cases the link of the current language might contain unescaped HTML special characters. This may lead to reflective XSS via injection of arbitrary parameters and/or values on the current page url. Affected Installs Joomla! CMS versions 1.6.0 through 3.8.8
Solution: Upgrade to version 3.8.9
https://developer.joomla.org/security-centre/740-20180602-core-xss-vulnerability-in-language-switcher-module.html
[20180601] - Core - Local File Inclusion with PHP 5.3
Severity: Low
Versions: 2.5.0 through 3.8.8
Exploit type: LFI
CVE Number: CVE-2018-12712
Our autoload code checks classnames to be valid, using the "class_exists" function in PHP. In PHP 5.3 this function validates invalid names as valid, which can result in a Local File Inclusion.
Affected Installs: Joomla! CMS versions 2.5.0 through 3.8.8
Solution: Upgrade to version 3.8.9
https://developer.joomla.org/security-centre/741-20180601-core-local-file-inclusion-with-php-5-3.html
Bugtraq: KL-001-2018-008 : HPE VAN SDN Unauthenticated Remote Root Vulnerability
A hardcoded service token can be used to bypass authentication. Built-in functionality can be exploited to deploy and execute a malicious deb file containing a backdoor. A weak sudoers configuration can then be abused to escalate privileges to root.
http://www.securityfocus.com/archive/1/542101
SSA-159860 (Last Update: 2018-06-26): Access Control Vulnerability in IEC 61850 system configurator, DIGSI 5, DIGSI 4, SICAM PAS/PQS, SICAM PQ Analyzer, and SICAM SCC
IEC 61850 system configurator, DIGSI 5, DIGSI 4, SICAM PAS/PQS, SICAM PQ Analyzer, and SICAM SCC products are affected by a security vulnerability which could allow an attacker to either exfiltrate limited data from the system or to execute code with operating system user permissions.Siemens has released updates for several affected products, and recommends that customers update to the new version.
https://cert-portal.siemens.com/productcert/txt/ssa-159860.txt
Security updates for Tuesday
Security updates have been issued by Slackware (firefox), SUSE (gpg2 and zlib), and Ubuntu (openssl, openssl1.0).
https://lwn.net/Articles/758310/
Security Advisory - Side-Channel Vulnerability Variants 3a and 4
http://www.huawei.com/en/psirt/security-advisories/2018/huawei-sa-20180615-01-cpu-en
HPESBHF03843 rev.1 - HPE Moonshot Provisioning Manager, Remote Bypass of Security Restrictions, Local Arbitrary File Modification
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03843en_us