[Owasp-cuiaba] Fwd: @RISK: The Consensus Security Vulnerability Alert: Vol. 12, Num. 28

Kembolle Amilkar haxorcoding em gmail.com
Sábado Julho 14 00:02:32 UTC 2012


*Att. Kembolle Amilkar *
#/[ kembolle.com.br <http://www.kembolle.com.br> ] - Consultoria Segurança
da Informação.
#/ [ samurayconsultoria.com.br ] - Chief Security Officer - Samuray
Consultoria.
#/ Systems Analyst | Esp. Information Security | Computer Forensic Expert |
#/ Owasp Chapter Lider Cuiabá - https://www.owasp.org/index.php/Cuiaba
#/ Mobile: [65] 9979-2925  && contato[at]kembolle.com.br.
**






**



In partnership with SANS and Sourcefire, Qualys is pleased to provide you
with the @RISK Newsletter. This is a weekly newsletter that provides
in-depth analysis of the latest vulnerabilities with straight forward
remediation advice. Qualys supplies a large part of the newly-discovered
vulnerability content used in this newsletter.

______________________________________________________________________

@RISK: The Consensus Security Vulnerability Alert
Vol. 12, Num. 28

Providing a reliable, weekly summary of newly discovered attack vectors,
vulnerabilities with active exploits, and explanations of how recent
attacks worked.

=============================================================

CONTENTS:
NOTABLE RECENT SECURITY ISSUES
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES 7/4/2012 - 7/10/2012
============================================================

Platform                                   Number of Updates and
Vulnerabilities
- -------------------------
 -------------------------------------

Cross Platform                                    4 (#1,#3,#4,#5)
Microsoft Windows                                 1 (#2)
Android                                           1 (#6)
Web Application                                   2 (#7,#8)
Cryptography                                      1 (#9)

============================================================

TOP VULNERABILITY THIS WEEK: CVE-2012-1723, Java runtime vulnerability.
Patched in June, this client-side vulnerability is being incorporated
into the Blackhole exploit kit. Public exploits are available, and
reports of in-the-wild exploitation are on the rise.

============================================================

NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM

#1
Title: New Java Vulnerability in Blackhole
Description: A recently released Java vulnerability - CVE-2012-1723 -
has been incorporated into the Blackhole exploit kit, dramatically
raising the likelihood that even relatively current systems will fall
victim to its attacks. The bug, which is a complex object typing issue,
is reliably exploitable in the field, and has public proof-of-concept
available that gives full details on the nature of the vulnerability.
Reference:
http://www.oracle.com/technetwork/topics/security/javacpujun2012-1515912.html<http://www.oracle.com/technetwork/topics/security/javacpujun2012-1515912.html?elq=81751dcbeb8840caa9338cc46c6f290b&elqCampaignId=301>
http://schierlm.users.sourceforge.net/CVE-2012-1723.html<http://schierlm.users.sourceforge.net/CVE-2012-1723.html?elq=81751dcbeb8840caa9338cc46c6f290b&elqCampaignId=301>
http://vrt-blog.snort.org/2012/07/cve-2012-1723-new-java-attack-added-to.html<http://vrt-blog.snort.org/2012/07/cve-2012-1723-new-java-attack-added-to.html?elq=81751dcbeb8840caa9338cc46c6f290b&elqCampaignId=301>
Snort SID: 23273 - 23277
ClamAV: Exploit.CVE_2012_1723

#2
Title: New Variant On An Old Exploit
Description: CVE-2012-0158, which exploits a vulnerable Windows Common
Control ActiveX component, has been exploited actively in the field
since before the release of a patch in April of this year. While the
attacks have, to date, been very targeted in nature, they are becoming
more sophisticated with time. Often dropped in RTF, DOC, or XLS files,
new variants of the attack observed recently in the field have been much
more stripped down than the original exploits, bypassing a step
previously thought necessary to trigger the bug.
Reference:
http://vrt-blog.snort.org/2012/07/its-not-dalai-lamas-birthday-oh-and-you.html<http://vrt-blog.snort.org/2012/07/its-not-dalai-lamas-birthday-oh-and-you.html?elq=81751dcbeb8840caa9338cc46c6f290b&elqCampaignId=301>
Snort SID: 21896 -
21093<21896%20-%2021093?elq=81751dcbeb8840caa9338cc46c6f290b&elqCampaignId=301>,
21905, 21937, 23305
ClamAV: Exploit.CVE_2012_0158

#3
Title: Kuluoz Trojan Spreading In-Field
Description: A trojan known as "Kuluoz" has been spreading rapidly in
the field, according to intelligence from the Sourcefire VRT's threat
monitoring network. Dropped by a variety of different means, the malware
contacts C&C servers in Russia and elsewhere upon installation, and is
part of a broader botnet.
Reference:
http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Win32%2FKuluoz<http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Win32/Kuluoz&elq=81751dcbeb8840caa9338cc46c6f290b&elqCampaignId=301>
Snort SID: 23244
ClamAV: Trojan-Kuluoz-4 through Trojan-Kuluoz-2311

#4
Title: CVE-2012-0677 iTunes M3U Playlist Buffer Overflow
Description: Classic buffer overflow attacks are generally rare these
days, but a new one was released that attacks M3U files - which form
Apple iTunes playlists - at the end of June. Public attacks exist, and
the vulnerability has been incorporated into Metasploit. Given the
cross-platform nature of the bug, and the ease with which it can be
exploited, in-the-wild attacks will likely be ongoing for some time.
Reference:
http://zeroscience.mk/en/vulnerabilities/ZSL-2012-5093.php<http://zeroscience.mk/en/vulnerabilities/ZSL-2012-5093.php?elq=81751dcbeb8840caa9338cc46c6f290b&elqCampaignId=301>
Snort SID: 23271 23272
ClamAV: N/A

============================================================

USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK

#5
Analysis of CVE-2011-3545:
http://axtaxt.wordpress.com/2012/07/08/analysis-of-cve-2011-3545/<http://axtaxt.wordpress.com/2012/07/08/analysis-of-cve-2011-3545/?elq=81751dcbeb8840caa9338cc46c6f290b&elqCampaignId=301>

#6
Find & Call: Leak & Spam:
https://www.securelist.com/en/blog/208193641/Find_and_Call_Leak_and_Spam<https://www.securelist.com/en/blog/208193641/Find_and_Call_Leak_and_Spam?elq=81751dcbeb8840caa9338cc46c6f290b&elqCampaignId=301>

#7
How to monetize Facebook pages:
http://www.f-secure.com/weblog/archives/00002394.html<http://www.f-secure.com/weblog/archives/00002394.html?elq=81751dcbeb8840caa9338cc46c6f290b&elqCampaignId=301>

#8
RIPS - static source code analyzer for PHP applications:
http://sourceforge.net/projects/rips-scanner/<http://sourceforge.net/projects/rips-scanner/?elq=81751dcbeb8840caa9338cc46c6f290b&elqCampaignId=301>

#9
MITM attacks with untrusted certificates against Tor in Jordan:
https://blog.torproject.org/blog/security-vulnerability-found-cyberoam-dpi-devices-cve-2012-3372<https://blog.torproject.org/blog/security-vulnerability-found-cyberoam-dpi-devices-cve-2012-3372?elq=81751dcbeb8840caa9338cc46c6f290b&elqCampaignId=301>

=========================================================

RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM

This is a list of recent vulnerabilities for which exploits are
available. System administrators can use this list to help in
prioritization of their remediation activities. The Qualys Vulnerability
Research Team compiles this information based on various exploit
frameworks, exploit databases, exploit kits and monitoring of internet
activity.

ID: CVE-2012-1723
Title: Oracle Java SE Remote Code Execution Vulnerability / Blackhole
Exploit Kit
Vendor: Oracle
Description: Unspecified vulnerability in the Java Runtime Environment
(JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32
and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows
remote attackers to affect confidentiality, integrity, and availability
via unknown vectors related to Hotspot.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: CVE-2012-0469
Title: Mozilla Use-after-free vulnerability in the "IDBKeyRange"
Vendor: Mozilla
Description: Use-after-free vulnerability in the
mozilla::dom::indexedDB::IDBKeyRange::cycleCollection::Trace function
in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4,
Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and
SeaMonkey before 2.9 allows remote attackers to execute arbitrary code
via vectors related to crafted IndexedDB data.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: CVE-2012-1889
Title:  Vulnerability in Microsoft XML Core Services Could Allow Remote
Code Execution (MS12-043)
Vendor: Microsoft
Description: Microsoft XML Core Services 3.0, 4.0, 5.0, and 6.0 accesses
uninitialized memory locations, which allows remote attackers to execute
arbitrary code or cause a denial of service (memory corruption) via a
crafted web site.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: CVE-2012-0708
Title: IBM Rational ClearQuest CQOle Remote Code Execution
Vendor: IBM
Description: Heap-based buffer overflow in the Ole API in the CQOle
ActiveX control in cqole.dll in IBM Rational ClearQuest 7.1.1 before
7.1.1.9, 7.1.2 before 7.1.2.6, and 8.0.0 before 8.0.0.2 allows remote
attackers to execute arbitrary code via a crafted web page that
leverages a RegisterSchemaRepoFromFileByDbSet function-prototype
mismatch.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: CVE-2012-2181
Title: IBM WebSphere Portal Dojo Module Directory Traversal
Vendor: IBM
Description: Directory traversal vulnerability in the Dojo module in IBM
WebSphere Portal 7.0.0.1 and 7.0.0.2 before CF14, and 8.0, allows remote
attackers to read arbitrary files via a crafted URL.
CVSS v2 Base Score: 7.8 (AV:N/AC:L/Au:N/C:C/I:N/A:N)

=========================================================

MOST PREVALENT MALWARE FILES 7/4/2012 - 7/10/2012:
COMPILED BY SOURCEFIRE

SHA 256: 9A09BCC1402050E371E13056B606BBDE8DF15CD87732B28C8BDDB863B1C65302
MD5: 923c4d13bee966654f4fe4a8945af0ae
VirusTotal:
https://www.virustotal.com/file/9A09BCC1402050E371E13056B606BBDE8DF15CD87732B28C8BDDB863B1C65302/analysis/<https://www.virustotal.com/file/9A09BCC1402050E371E13056B606BBDE8DF15CD87732B28C8BDDB863B1C65302/analysis/?elq=81751dcbeb8840caa9338cc46c6f290b&elqCampaignId=301>
Malwr: http://malwr.com/analysis/923c4d13bee966654f4fe4a8945af0ae<http://malwr.com/analysis/923c4d13bee966654f4fe4a8945af0ae?elq=81751dcbeb8840caa9338cc46c6f290b&elqCampaignId=301>

Typical Filename:
Claimed Product: -
Claimed Publisher: -


SHA 256: CB85D393C4E0DB5A1514C21F9C51BA4C12D82B7FABD9724616758AE528A5B16B
MD5: 7961a56c11ba303f20f6a59a506693ff
VirusTotal:
https://www.virustotal.com/file/CB85D393C4E0DB5A1514C21F9C51BA4C12D82B7FABD9724616758AE528A5B16B/analysis/<https://www.virustotal.com/file/CB85D393C4E0DB5A1514C21F9C51BA4C12D82B7FABD9724616758AE528A5B16B/analysis/?elq=81751dcbeb8840caa9338cc46c6f290b&elqCampaignId=301>
Malwr: http://malwr.com/analysis/7961a56c11ba303f20f6a59a506693ff<http://malwr.com/analysis/7961a56c11ba303f20f6a59a506693ff?elq=81751dcbeb8840caa9338cc46c6f290b&elqCampaignId=301>

Typical Filename: m3SrchMn.exe
Claimed Product: My Web Search Bar
Claimed Publisher: MyWebSearch.com


SHA 256: DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C
MD5: 25aa9bb549ecc7bb6100f8d179452508
VirusTotal:
https://www.virustotal.com/file/DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C/analysis/<https://www.virustotal.com/file/DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C/analysis/?elq=81751dcbeb8840caa9338cc46c6f290b&elqCampaignId=301>
Malwr: http://malwr.com/analysis/25aa9bb549ecc7bb6100f8d179452508<http://malwr.com/analysis/25aa9bb549ecc7bb6100f8d179452508?elq=81751dcbeb8840caa9338cc46c6f290b&elqCampaignId=301>

Typical Filename: 25AA9BB549ECC7BB6100F8D179452508
Claimed Product: -
Claimed Publisher: -


SHA 256: E0B193D47609C9622AA018E81DA69C24B921F2BA682F3E18646A0D09EC63AC2B
MD5: bf31a8d79f704f488e3dbcb6eea3b3e3
VirusTotal:
https://www.virustotal.com/file/E0B193D47609C9622AA018E81DA69C24B921F2BA682F3E18646A0D09EC63AC2B/analysis/<https://www.virustotal.com/file/E0B193D47609C9622AA018E81DA69C24B921F2BA682F3E18646A0D09EC63AC2B/analysis/?elq=81751dcbeb8840caa9338cc46c6f290b&elqCampaignId=301>
Malwr: http://malwr.com/analysis/bf31a8d79f704f488e3dbcb6eea3b3e3<http://malwr.com/analysis/bf31a8d79f704f488e3dbcb6eea3b3e3?elq=81751dcbeb8840caa9338cc46c6f290b&elqCampaignId=301>

Typical Filename: pspprn.sys
Claimed Product: -
Claimed Publisher: -


SHA 256: 0585CDC0293EA6B8C86482608C08C583BF32E12CFA59D143F4A0411D2894C0F3
MD5: b3b9295385f4e74d023181e5a24f4d83
VirusTotal:
https://www.virustotal.com/file/0585CDC0293EA6B8C86482608C08C583BF32E12CFA59D143F4A0411D2894C0F3/analysis/<https://www.virustotal.com/file/0585CDC0293EA6B8C86482608C08C583BF32E12CFA59D143F4A0411D2894C0F3/analysis/?elq=81751dcbeb8840caa9338cc46c6f290b&elqCampaignId=301>
Malwr: http://malwr.com/analysis/b3b9295385f4e74d023181e5a24f4d83<http://malwr.com/analysis/b3b9295385f4e74d023181e5a24f4d83?elq=81751dcbeb8840caa9338cc46c6f290b&elqCampaignId=301>

Typical Filename: keygen.exe
Claimed Product: -
Claimed Publisher: -

_________________________________________________________** __________

(c) 2012. All rights reserved. The information contained in this
newsletter, including any external links, is provided "AS IS," with no
express or implied warranty, for informational purposes only. In some
cases, copyright for material in this newsletter may be held by a
party other than Qualys (as indicated herein) and permission to use
such material must be requested from the copyright owner.

--END--

You are receiving this email because you indicated that you wanted to
receive information from
Qualys about industry news, product updates, security alerts and other
information that may be of
interest to you.

To manage your subscriptions, visit our communication preferences
page<http://www.qualys.com/company/compref/[email protected]>
.
-------------- Próxima Parte ----------
Um anexo em HTML foi limpo...
URL: <http://lists.owasp.org/pipermail/owasp-cuiaba/attachments/20120713/32ffc416/attachment-0001.html>


More information about the Owasp-cuiaba mailing list