Title: Microsoft Tuesday Updates
Description: 24 CVEs have been fixed in the latest rounds of Microsoft Tuesday Updates. 7 CVEs in Internet Explorer alone. For a full breakdown of the CVEs and the vulnerabilities see below:
Reference:
http://vrt-blog.snort.org/2013/12/microsoft-update-tuesday-december-2013.html
https://isc.sans.edu/diary/Microsoft+December+Patch+Tuesday/17198
Snort SID: 27823, 28464-28473, 28487-28488, 28525-28526, 28862-28863, 28865-28878, 28880-28882
Title: Adobe Flash and Shockwave Player Updates
Description: This vulnerability is of an extremely low priority being that you have to be logged in and the traffic is SSL encrypted, however, it is possible for users to retrieve sensitive information, to create additional accounts and to perform remote code execution.
Reference:
https://isc.sans.edu/diary/Adobe+Updates+today+as+well./17201
Snort SID: Detection is forthcoming
ClamAV: Detection is forthcoming
Title: Dexter2/Stardust POS Malware
Description: A new version of POS Malware known as “Dexter2” or “Stardust” has been discovered and disclosed on the internet.
Reference:
Snort SID: 28891-28892, 25553
ClamAV: N/A
============================================================
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
When an Exploit Kit is VERY Simple
http://vrt-blog.snort.org/2013/12/when-exploit-kit-is-very-simple.html
Look what I found, Moar Pony!
http://blog.spiderlabs.com/2013/12/look-what-i-found-moar-pony.html
Malicious multi-hop iframe campaign affects thousands of Web sites, leads to a cocktail of client-side exploits – part two http://www.webroot.com/blog/2013/12/09/malicious-multi-hop-iframe-campaign-affects-thousands-web-sites-leads-cocktail-client-side-exploits-part-two/
=========================================================
RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM
This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.
D: CVE-2013-5331
Title: Adobe Flash Player Memory Corruption Code Execution Vulnerability (APSB13-28)
Vendor: Adobe
Description: Remote exploitation of a memory corruption vulnerability in Adobe System Inc.’s Flash Player versions 11.9.900.152 and earlier versions for Windows and Macintosh and Adobe Flash Player 11.2.202.327 and earlier versions for Linux. This could allow an attacker to execute arbitrary code. Adobe is aware of reports that an exploit designed to trick the user into opening a Microsoft Word document with malicious Flash (.swf).
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
ID: CVE-2013-5065
Title: Microsoft Windows Kernel “NDProxy.sys Driver” Input Validation Code Execution Vulnerability
Vendor: Microsoft
Description: NDProxy.sys in the kernel in Microsoft Windows XP SP2 and
SP3 and Server 2003 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in November 2013.
CVSS v2 Base Score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)
ID: CVE-2013-5486
Title: Cisco Prime Data Center Network Manager (DCNM) “fileUploadServlet” Command Execution Vulnerability
Vendor: Cisco
Description: DCNM-SAN Server in Cisco Prime Data Center Network Manager
(DCNM) before 6.2(1) allows remote attackers to execute arbitrary commands via unspecified vectors, aka Bug IDs CSCue77035 and CSCue77036.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
ID: CVE-2013-0074
Title: Microsoft Silverlight Double Dereference Vulnerability
Vendor: Microsoft
Description: Microsoft Silverlight 5, and 5 Developer Runtime, before 5.1.20125.0 does not properly validate pointers during HTML object rendering, which allows remote attackers to execute arbitrary code via a crafted Silverlight application, aka “Silverlight Double Dereference Vulnerability.”
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
ID: CVE-2013-3906
Title: Microsoft Graphics Component Could Allow Remote Code Execution
Vendor: Microsoft
Description: GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and Lync 2010, 2010 Attendee, 2013, and Basic 2013 allows remote attackers to execute arbitrary code via a crafted TIFF image, as demonstrated by an image in a Word document, and exploited in the wild in October and November 2013.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
ID: CVE-2013-6026
Title: D-Link Authentication Security Bypass Vulnerability
Vendor: D-Link
Description: The web interface on D-Link DIR-100, DIR-120, DI-624S, DI-524UP, DI-604S, DI-604UP, DI-604+, and TM-G5240 routers; Planex BRL-04R, BRL-04UR, and BRL-04CW routers; and Alpha Networks routers allows remote attackers to bypass authentication and modify settings via an xmlset_roodkcableoj28840ybtide User-Agent HTTP header, as exploited in the wild in October 2013.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
=========================================================
MOST PREVALENT MALWARE FILES 12/1/2013 – 12/7/2013:
COMPILED BY SOURCEFIRE
SHA 256: DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C
MD5: 25aa9bb549ecc7bb6100f8d179452508
VirusTotal:
Typical Filename: Random
Claimed Product: Random
Detection Name: W32.DF83A0D694-100.SBX.VIOC
SHA 256: 180c6035ca44c270b8e1556a7b2e9faf442d1b4323ef6d8e93b7e759af169c96
MD5: 44e5b5dc6a27ea109b8a234e640bb5fd
VirusTotal:
Typical Filename: BitGuard
Claimed Product: BitGuard
Detection Name: W32.Agent:BProtector.16nb.dk
SHA 256: 5b8a898d66a1cb12ab682799cbb501699faf860b5f98a6a37068963ac1c844ac
MD5: 9b32cd6e776ee3abd010f44fecd7edfc
VirusTotal:
Typical Filename: hao123Inst.exe
Claimed Product: hao123Inst.exe
Detection Name: W32.Auto:5b8a89.TG.VRT
SHA 256: aa0bbaecb678868e1e7f57c7ca9d61b608b3d788be490790eb1d148beadf4615
MD5: 3291e1603715c47a23b60a8bf2ca73db
VirusTotal:
Typical Filename: 08.tmp
Claimed Product: None
Detection Name: Confiker
Deja un comentario