NOTABLE RECENT SECURITY ISSUES<\/p>\n
SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM<\/p>\n
Title: Recent Java exploits rapidly weaponizing in the wild<\/strong><\/p>\n Description: Exploit code for a group of Java vulnerabilities patched in Oracle’s June 2013 patch release has been made public over the last two weeks by the PacketStorm bug bounty program, and exploit kit authors and other malicious actors have been quick to weaponize the code and begin using it in the wild. Noted exploit kit researcher Kaffeine has already confirmed the presence of one or both exploits in half a dozen distinct kits, a particularly rapid uptake rate for an already-patched set of bugs. As always, administrators are urged to ensure that all systems under their control are properly patched.<\/p>\n Reference:<\/p>\n http:\/\/packetstormsecurity.com\/files\/122865\/<\/a><\/p>\n http:\/\/packetstormsecurity.com\/files\/122806\/<\/a><\/p>\n http:\/\/malware.dontneedcoffee.com\/2013\/08\/cve-2013-2465-integrating-exploit-kits.html<\/a><\/p>\n Snort SID: 27621, 27622, 27672 – 27677, 27691 – 27694<\/p>\n ClamAV: Java.Exploit.CVE_2013_2465, Java.Exploit.CVE_2013_2459<\/p>\n <\/p>\n Title: Denial of service in BIND in the wild<\/strong><\/p>\n Description: A recently announced vulnerability in the popular BIND DNS service is being exploited in the wild, according to notes in the ISC vulnerability announcement included with their official patches. The issue, which can be exploited with a single packet, impacts the entire version 9 code base, and will hit default configurations there.<\/p>\n Administrators should patch immediately, or upgrade to BIND 10 if possible, as several versions of the BIND 9 code base are past end-of-life and will not be patched against this issue.<\/p>\n Reference:<\/p>\n https:\/\/kb.isc.org\/article\/AA-01015<\/a><\/p>\n Snort SID: 27666<\/p>\n ClamAV: N\/A<\/p>\n <\/p>\n Title: New attacks against security of TLS announced<\/strong><\/p>\n Description: Researchers presenting at the 22nd annual USENIX security symposium last week announced a pair of partial plaintext recovery attacks against TLS. While the issues require rapidly repeated original plaintext in order to work, the researchers showed practical cases where necessary conditions would occur, though stopped short of providing any proof-of-concept code. Given this and related attacks discovered over the course of the last few years, such as the BEAST attack, developers of web applications secured by TLS should consider adding randomization to their plaintext messages as a proactive security measure against further attacks in this vein.<\/p>\n Reference:<\/p>\n https:\/\/www.usenix.org\/system\/files\/conference\/usenixsecurity13\/sec13-paper_alfardan.pdf<\/a><\/p>\n Snort SID: N\/A<\/p>\n ClamAV: N\/A<\/p>\n ============================================================<\/p>\n USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK<\/p>\n Alice in Warningland: A large-scale field study of browser security warning effectiveness:<\/p>\n http:\/\/static.googleusercontent.com\/external_content\/untrusted_dlcp\/research.google.com\/en\/us\/pubs\/archive\/41323.pdf<\/a><\/p>\n <\/p>\n A study in bots: Bitbot:<\/p>\n http:\/\/cylance.com\/techblog\/A-Study-in-Bots-Bitbot.shtml<\/a><\/p>\n <\/p>\n Vulnerabilities that just won’t die: compression bombs:<\/p>\n http:\/\/blog.cyberis.co.uk\/2013\/08\/vulnerabilities-that-just-wont-die.html<\/a><\/p>\n <\/p>\n Bypassing AirWatch root restriction:<\/p>\n https:\/\/www.netspi.com\/blog\/entryid\/192\/bypassing-airwatch-root-restriction<\/a><\/p>\n <\/p>\n A closer look: Perkle Android malware kit:<\/p>\n http:\/\/krebsonsecurity.com\/2013\/08\/a-closer-look-perkele-android-malware-kit\/<\/a><\/p>\n <\/p>\n Using patched QEMU and IDA pro to debug bootroms:<\/p>\n http:\/\/www.droid-developers.org\/wiki\/QEMU<\/a><\/p>\n <\/p>\n So you think your domain controller is secure?<\/p>\n http:\/\/scripthappens.azurewebsites.net\/?p=1<\/a><\/p>\n <\/p>\n UXSS: Internet Explorer EUC-JP parsing bug:<\/p>\n http:\/\/insert-script.blogspot.co.at\/2013\/08\/uxss-internet-explorer-euc-jp-parsing.html<\/a><\/p>\n <\/p>\n Hacker posts Facebook bug report on Zuckerberg’s wall:<\/p>\n http:\/\/rt.com\/news\/facebook-post-exploit-hacker-zuckerberg-621\/#.UhA62dulSpE.twitter<\/a><\/p>\n <\/p>\n Jekyll on iOS: when benign apps become evil:<\/p>\n https:\/\/www.usenix.org\/system\/files\/conference\/usenixsecurity13\/sec13-paper_wang_2.pdf<\/a><\/p>\n <\/p>\n ByeBye shell and the targeting of Pakistan:<\/p>\n https:\/\/community.rapid7.com\/community\/infosec\/blog\/2013\/08\/19\/byebye-and-the-targeting-of-pakistan<\/a><\/p>\n <\/p>\n ZFS forensics – recovering files from a destroyed Zpool:<\/p>\n http:\/\/www.joyent.com\/blog\/zfs-forensics-recovering-files-from-a-destroyed-zpool<\/a><\/p>\n <\/p>\n Mitigating the LdrHotPatchRoutine DEP\/ASLR bypass with MS13-063:<\/p>\n