End-of-Day report
Timeframe: Dienstag 05-07-2022 18:00 - Mittwoch 06-07-2022 18:00
Handler: Robert Waldner
Co-Handler: Michael Schlagenhaufer
News
Microsoft quietly fixes ShadowCoerce Windows NTLM Relay bug
Microsoft has confirmed it fixed a previously disclosed ShadowCoerce vulnerability as part of the June 2022 updates that enabled attackers to target Windows servers in NTLM relay attacks.
https://www.bleepingcomputer.com/news/microsoft/microsoft-quietly-fixes-shadowcoerce-windows-ntlm-relay-bug/
NPM supply-chain attack impacts hundreds of websites and apps
An NPM supply-chain attack dating back to December 2021 used dozens of malicious NPM modules containing obfuscated Javascript code to compromise hundreds of downstream desktop apps and websites.
https://www.bleepingcomputer.com/news/security/npm-supply-chain-attack-impacts-hundreds-of-websites-and-apps/
Kryptographie: NIST gibt Post-Quanten-Algorithmen bekannt
Nach einem Wettbewerb kürt die US-Behörde Verschlüsselungs- und Signaturalgorithmen, die vor Quantencomputern sicher sein sollen.
https://www.golem.de/news/kryptographie-nist-gibt-post-quanten-algorithmen-bekannt-2207-166648-rss.html
Top 5 Most Common WordPress Malware Infections: An Anatomy Lesson
WordPress security is serious business - and an essential consideration for anyone using the world-s most popular CMS (Content Management System). While the WordPress team quickly addresses known security issues in WordPress- core to protect the millions of website owners who rely and depend on the software, the reality is that the same cannot be said for all plugin and theme developers.
https://blog.sucuri.net/2022/07/top-5-most-common-wordpress-malware-infections-an-anatomy-lesson.html
Fake-Shop-Alarm: Vorsicht beim Online-Kauf von Brennholz!
Die aktuelle Energiekrise lässt die Preise für Brennholz steigen. Der befürchtete Gasmangel führt dazu, dass Holz gehamstert und dementsprechend knapper wird. Eine perfekte Ausgangslage für Kriminelle: Sie nutzen die Situation aus und erstellen Fake-Shops, auf denen sie günstiges Brennholz anbieten.
https://www.watchlist-internet.at/news/fake-shop-alarm-vorsicht-beim-online-kauf-von-brennholz/
Electric Vehicle Charging: a Survey on the Security Issues and Challenges of the Open Charge Point Protocol (OCPP)
The increased use of smart Electric Vehicles (EVs) and Plug-in ElectricVehicles (PEV) opened a new area of research and development. The number of EVcharging sites has considerably increased in residential as well as in publicareas. Within these EV charging sites, various entities need to communicate in a secure and efficient way.
http://arxiv.org/abs/2207.01950
OrBit: New Undetected Linux Threat Uses Unique Hijack of Execution Flow
Linux is a popular operating system for servers and cloud infrastructures, and as such it-s not a surprise that it attracts threat actors- interest and we see a continued growth and innovation of malware that targets Linux, such as the recent Symbiote malware that was discovered by our research team.
https://www.intezer.com/blog/incident-response/orbit-new-undetected-linux-threat/
Vulnerabilities
Security updates for Wednesday
Security updates have been issued by Debian (ldap-account-manager), Fedora (openssl1.1, thunderbird, and yubihsm-connector), Mageia (curl, cyrus-imapd, firefox, ruby-git, ruby-rack, squid, and thunderbird), Oracle (firefox, kernel, and thunderbird), Slackware (openssl), SUSE (dpdk, haproxy, and php7), and Ubuntu (gnupg2 and openssl).
https://lwn.net/Articles/900172/
Security Bulletin: IBM Maximo Asset Management and the IBM Maximo Manage application in IBM Maximo Application Suite are vulnerable to cross-site scripting (CVE-2022-22436)
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-maximo-asset-management-and-the-ibm-maximo-manage-application-in-ibm-maximo-application-suite-are-vulnerable-to-cross-site-scripting-cve-2022-22436-2/
Security Bulletin: IBM Maximo Asset Management and the IBM Maximo Manage application in IBM Maximo Application Suite are vulnerable to cross-site scripting (CVE-2022-22435)
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-maximo-asset-management-and-the-ibm-maximo-manage-application-in-ibm-maximo-application-suite-are-vulnerable-to-cross-site-scripting-cve-2022-22435-2/
Security Bulletin: IBM Rational Build Forge is affected by Apache Tomcat version used in it. (CVE-2021-42340)
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-rational-build-forge-is-affected-by-apache-tomcat-version-used-in-it-cve-2021-42340/
Security Bulletin: IBM Tivoli Netcool Impact is affected but not classified as vulnerable by a remote code execution in Spring Framework (CVE-2022-22965)
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-tivoli-netcool-impact-is-affected-but-not-classified-as-vulnerable-by-a-remote-code-execution-in-spring-framework-cve-2022-22965/
Security Bulletin: IBM Event Streams is vulnerable to arbitrary code execution due to the Fabric8 Kubernetes client (CVE-2021-4178)
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-event-streams-is-vulnerable-to-arbitrary-code-execution-due-to-the-fabric8-kubernetes-client-cve-2021-4178/
Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands may be vulnerable to loss of confidentiality due to CVE-2022-32210
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-app-connect-enterprise-certified-container-designerauthoring-operands-may-be-vulnerable-to-loss-of-confidentiality-due-to-cve-2022-32210/
Security Bulletin: IBM QRadar Network Packet Capture includes multiple vulnerable components.
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-qradar-network-packet-capture-includes-multiple-vulnerable-components/
K58003591: Apache HTTP server vulnerability CVE-2022-28614
https://support.f5.com/csp/article/K58003591
vim: Schwachstelle ermöglicht Manipulation von Speicher
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0583
tribe29 checkmk: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0581