End-of-Day report
Timeframe: Mittwoch 26-09-2018 18:00 - Donnerstag 27-09-2018 18:00
Handler: Robert Waldner
Co-Handler: n/a
News
Upcoming Security Updates for Adobe Acrobat and Reader (APSB18-30)
A prenotification security advisory (APSB18-30) has been posted regarding upcoming Adobe Acrobat and Reader updates scheduled for Tuesday, October 02, 2018.
https://blogs.adobe.com/psirt/?p=1621
Password Managers Can Be Tricked Into Believing That Malicious Android Apps Are Legitimate
A new academic study published today reveals that Android-based password managers have a hard time distinguishing between legitimate and fake applications, leading to easy phishing scenarios. From a report: The study looked at how password managers work on modern versions of the Android OS, and which of the OS features attackers can abuse to collect user credentials via phishing attacks carried out via fake, lookalike apps.
https://it.slashdot.org/story/18/09/26/1534203/password-managers-can-be-tricked-into-believing-that-malicious-android-apps-are-legitimate
LoJax: First UEFI rootkit found in the wild, courtesy of the Sednit group
Some UEFI rootkits have been presented as proofs of concept; some are known to be at the disposal of (at least some) governmental agencies. However, no UEFI rootkit has ever been detected in the wild - until we discovered a campaign by the Sednit APT group that successfully deployed a malicious UEFI module on a victim-s system.
https://www.welivesecurity.com/2018/09/27/lojax-first-uefi-rootkit-found-wild-courtesy-sednit-group/
Geldmacherei mit e-Visum für Ägypten
Konsument/innen, die nach Ägypten einreisen möchten, müssen ein e-Visum beantragen. Auf der offiziellen Regierungswebsite visa2egypt.gov.eg kostet es für eine einmalige Einreise als Tourist/in 25 US-Dollar. Das ist der günstigste Preis für das e-Visum. Andere Anbieter/innen verlangen dafür wesentlich höhere Kosten. Aus diesem Grund ist bei der Beantragung Vorsicht geboten.
https://www.watchlist-internet.at/news/geldmacherei-mit-e-visum-fuer-aegypten/
Vulnerabilities
Security updates for Thursday
Security updates have been issued by Debian (asterisk, otrs2, and strongswan), Fedora (kernel-headers, moodle, ntp, visualboyadvance-m, and yaml-cpp), Mageia (rsyslog), openSUSE (ant, libzypp, zypper, shadow, and tiff), Oracle (389-ds-base, flatpak, kernel, nss, and openssl), Red Hat (rh-perl524-mod_perl and rh-perl526-mod_perl), Scientific Linux (389-ds-base, flatpak, kernel, and nss), SUSE (firefox, gd, glibc, kernel, mgetty, php7, and wireshark), and Ubuntu (udisks2).
https://lwn.net/Articles/766959/
WebKitGTK+ and WPE WebKit Security Advisory WSA-2018-0007
Several vulnerabilities were discovered in WebKitGTK+ and WPE WebKit.
...
We recommend updating to the latest stable versions of WebKitGTK+ and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit.
https://webkitgtk.org/security/WSA-2018-0007.html
Cisco Catalyst 6800 Series Switches ROM Monitor Software Secure Boot Bypass Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-catalyst6800
Cisco IOS XE Software Web UI Denial of Service Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-webuidos
Cisco IOS XE Software HTTP Denial of Service Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-webdos
Cisco IOS and IOS XE Software VLAN Trunking Protocol Denial of Service Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-vtp
Cisco IOS and IOS XE Software TACACS+ Client Denial of Service Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-tacplus
Cisco IOS and IOS XE Software SM-1T3/E3 Service Module Denial of Service Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-sm1t3e3
Cisco IOS XE Software NAT Session Initiation Protocol Application Layer Gateway Denial of Service Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-sip-alg
Cisco IOS XE Software Shell Access Authentication Bypass Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-shell-access
Cisco IOS Software Precision Time Protocol Denial of Service Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-ptp
Cisco IOS XE Software Privileged EXEC Mode Root Shell Access Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-privesc
Cisco IOS and IOS XE Software Plug and Play Agent Memory Leak Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-pnp-memleak
Cisco IOS and IOS XE Software OSPFv3 Denial of Service Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-ospfv3-dos
Cisco IOS XE Software MACsec MKA Using EAP-TLS Authentication Bypass Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-macsec
Cisco IOS Software for Cisco 800 Series Industrial Integrated Services Routers Arbitrary Memory Write Vulnerabilities
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-ir800-memwrite
Cisco IOS and IOS XE Software IPv6 Hop-by-Hop Options Denial of Service Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-ipv6hbh
Cisco IOS XE Software and Cisco ASA 5500-X Series Adaptive Security Appliance IPsec Denial of Service Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-ipsec
Cisco IOS XE Software Command Injection Vulnerabilities
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-iosxe-cmdinj
Cisco IOS XE Software Errdisable Denial of Service Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-errdisable
Cisco IOS XE Software Digital Signature Verification Bypass Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-digsig
Cisco IOS and IOS XE Software Cluster Management Protocol Denial of Service Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-cmp
Cisco IOS XE Software Cisco Discovery Protocol Memory Leak Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-cdp-memleak
Cisco IOS and IOS XE Software Cisco Discovery Protocol Denial of Service Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-cdp-dos
IBM Security Bulletin: A vulnerability in PostgreSQL affects PowerKVM
http://www.ibm.com/support/docview.wss?uid=ibm10730491
IBM Security Bulletin: A vulnerability in gnupg2 affects PowerKVM
http://www.ibm.com/support/docview.wss?uid=ibm10720353
IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect Rational Performance Tester
https://www-01.ibm.com/support/docview.wss?uid=ibm10732455
IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect Rational Service Tester
https://www-01.ibm.com/support/docview.wss?uid=ibm10732457
IBM Security Bulletin: Vulnerabilities in the Linux kernel affect PowerKVM
http://www.ibm.com/support/docview.wss?uid=ibm10716879
IBM Security Bulletin: Multiple Security Vulnerabilities affect IBM® Cloud Private and IBM Cloud Private Cloud Foundry (CVE-2018-7167, CVE-2018-7164, CVE-2018-7162, CVE-2018-1000168, CVE-2018-7161)
https://www-01.ibm.com/support/docview.wss?uid=ibm10718901
IBM Security Bulletin: Arbitrary URL Redirection (CVE-2018-1704) affects IBM Platform Symphony, IBM Spectrum Symphony
https://www-01.ibm.com/support/docview.wss?uid=ibm10719671
IBM Security Bulletin: XML Entity Expansion vulnerability (CVE-2018-1702) affects IBM Platform Symphony, IBM Spectrum Symphony
https://www-01.ibm.com/support/docview.wss?uid=ibm10719659
IBM Security Bulletin: A vulnerability in policycoreutils affects PowerKVM
http://www.ibm.com/support/docview.wss?uid=ibm10728473
IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Rational Developer for i and Rational Developer for AIX and Linux Security Bulletin
http://www.ibm.com/support/docview.wss?uid=ibm10730623
HPESBST03884 rev.1 - HPE ConvergedSystem 700 Solutions Using HPE 3PAR Service Processor, Multiple Vulnerabilities
https://support.hpe.com/hpsc/doc/public/display?docLocale=en&docId=emr_na-hpesbst03884en_us
HPESBHF03890 rev.1 - HPE Service Governance Framework (SGF) - Remote Unauthorized Disclosure of Information
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03890en_us
HPESBHF03901 rev.1 - HPE intelligence Management Center (iMC) PLAT, Remote Code Execution
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03901en_us
HPESBHF03902 rev.1 - HPE Intelligent Management Center (iMC) PLAT, Remote Code Execution
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us
HPESBST03884 rev.2 - HPE ConvergedSystem 700 Solutions Using HPE 3PAR Service Processor, Multiple Vulnerabilities
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03884en_us