@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data
A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.June 6, 2013
@RISK: The Consensus Security Vulnerability Alert
Vol. 13, Num. 23
Providing a reliable, weekly summary of newly discovered attack vectors, vulnerabilities with active exploits, and explanations of how recent attacks worked.=============================================================
TOP VULNERABILITY THIS WEEK: Google researcher Tavis Ormandy provided exploit code for an unpatched local kernel vulnerability in Windows this week, after having first published details on the Full-Disclosure mailing list in mid-May. The release coincides with Google's shift from giving vendors 60 days on actively exploited vulnerabilities to 7 days before Google will release details.
******************** Sponsored By SANS *********************
Strategies for Moving Beyond Antivirus:
Join us for an upcoming webcast to find out how you can move beyond
antivirus and adopt a proactive approach to endpoint protection. We will
cover best practices amidst a rapidly changing threat landscape and also
strategies for deploying unrivaled protection for both physical and
virtual systems. Register Now.
- -- Industrial Control System (ICS) Security Training
In-depth, hands-on technical courses taught by top SCADA experts. Gain the most current information regarding SCADA and Control System threats and learn how to best prepare to defend against them. Leave the event with solutions that you can immediately put to use in your organization.
--Houston, TX (June 10-June 15)
--Washington, DC (August 12-August 16)
- -- SANSFIRE 2013 Washington, DC June 14-22, 2013 43 courses. Bonus evening sessions include Avoiding Cyberterrorism Threats Inside Hydraulic Power Generation Plants; and Automated Analysis of Android Malware. http://www.sans.org/event/sansfire-2013
- -- Security Impact of IPv6 Summit Washington, DC June 14-16
Held in conjunction with SANSFIRE 2013, the Security Impact of IPv6 Summit offers discussions and panels with IPv6 security experts, ISPs, early adopters, and industry vendors. You will come away with best practices from those who have already implemented IPv6. A two-day, post-summit class follows:
- -- SANS Rocky Mountain 2013 Denver, CO July 14-20, 2013
10 courses. Bonus evening sessions include OODA - The Secret to Effective Security in Any Environment; and APT: It is Not Time to Pray, It is Time to Act.
- -- SANS San Francisco 2013 San Francisco, CA July 29-August 3, 2013
7 courses. Bonus evening sessions include Offensive Digital Forensics; and Base64 Can Get You Pwned!
- -- SANS Boston 2013 Boston, MA August 5-10, 2013
9 courses. Bonus evening sessions include Cloud R and Forensics; and You Can Panic Now. Host Protection is (Mostly) Dead.
- -- SANS Virginia Beach 2013 Virginia Beach, VA August 19-30, 2013
10 courses. Bonus evening presentations include Thanks for Recovering ... Now I Can Hack You!; Everything I Know is Wrong!; and APT: It is Time to Act.
- -- SANS Pen Test Berlin 2013 Berlin, Germany June 2-June 8, 2013
Europe's only specialist pen test training and networking event. Four dedicated pen test training courses led by five SANS world-class instructors.
- -- SANS London Summer 2013 London, UK July 9-July 16, 2013
5 courses. SANS has added a new London date to the security-training calendar, giving security professionals the opportunity to take one of four of SANS' most popular 6-day courses and the excellent 2 day Securing The Human course.
- -- Looking for training in your own community?
- --Save on On-Demand training (30 full courses) - See samples at
Plus Johannesburg, Abu Dhabi, Seoul, and Bangalore all in the next 90 days. For a list of all upcoming events, on-line and live: www.sans.org********************** Sponsored Links: ********************
1) Attend the SANS Industrial Controls Systems Security Briefing,
Monday, June 10, 2013 in Houston, TX at the Westin Houston Memorial
City. Featuring Mike Assante, Eric Cornelius, Lior Frenkel, Bart
Pestarino and Jonathan Knudsen. This event is free to Oil & Gas
constituents. For more information go to http://www.sans.org/info/131912
To register for this event via simulcast, visit http://www.sans.org/info/131917
2) Live from SANSFIRE, please attend our Simulcast - "Security Analytics: What Matters in Your Chatter?", featuring Westley McDuffie. Register at http://www.sans.org/info/132222============================================================
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM
Title: Google Shifts Policy, Will Release 0-days After A Week; Researcher Provides 0-day PoC
Description: In a major policy announcement made last week, Google stated that it will publicly disclose details of new vulnerabilities in other vendors' products 7 days after discovery, if those issues are being actively exploited in the wild. This is a major shift from its previous policy of giving vendors 60 days before disclosure. While acknowledging that this new policy may be too short of a time frame for vendors to develop a patch, Google stated that vendors should at least make users aware of the situation and offer any possible mitigations while a patch is being developed. Meanwhile, Google researcher Tavis Ormandy has released exploit code for a local kernel vulnerability in Windows ahead of a patch by Microsoft, after having released initial details in mid-May. Microsoft claims that no active exploitation was taking place prior to the release of the exploit code, although it is likely that will change in the face of publicly available PoC.
Snort SID: N/A
Title: RFI Botnet Compromising WordPress, Joomla Sites Worldwide
Description: Researchers at the Deep End Research group released an in-depth report this week on a major botnet that has been responsible for compromising hundreds of thousands of WordPress and Joomla web sites across the planet over the past year. The report, which is designed to raise awareness among administrators of these notoriously vulnerable web services, corresponds to attack techniques seen by Sourcefire since September of 2011. System administrators are urged to check their systems for signs of compromise by this botnet, and to ensure that their systems have all of the latest available security patches and recommended settings applied.
Snort SID: 26813
Title: Black Revolution DDoS Trojan In The Wild
Description: DDoS continues to be a favorite activity of attackers worldwide, with recent attacks on financial institutions in particular reaching 100+ Gbps levels. Researchers at Arbor Networks this week profiled a particularly advanced DDoS trojan by the name of "Black Revolution" they have been observing in the wild lately, with different variants of the malware showing its creators' progress at evading detection over time.
Snort SID: 26713-26715,26725-26750
Title: German Torrent Contains Source For 309 Bots
Description: The authors of the well-respected "Malware Must Die" blog this week published information on a huge dump of botnet source code they discovered on a German torrent, which has since been shut down. While most of the source is several years old, it provides valuable insight into multiple important families of malware, including Zeus, Skype-based bots, SDbot, and others. The source code is being shared with security researchers, and should provide useful information for network defenders worldwide.
Snort SID: Various
Shellcodecs - a huge collection of shellcode, loaders, etc.:
Ruby's $SAFE may go away:
Phishing as a service:
Cisco in the sky with diamonds:
How to search encrypted text in SQL server 2005/2008:
Trawling for Tor hidden services - detection, measurement, deanonymization:
Microsoft releases new mitigation guidance for Active Directory:
NSA official mitigations for DDoS:
RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM.
This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.
Title: IBM SPSS SamplePower C1Tab ActiveX Heap Overflow
Description: Buffer overflow in the c1sizer ActiveX control in C1sizer.ocx in IBM SPSS SamplePower 3.0 before FP1 allows remote attackers to execute arbitrary code via a long TabCaption string.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Title: Nginx HTTP Server 1.3.9-1.4.0 Chuncked Encoding Stack Buffer Overflow
Description: Remote exploitation of an integer overflow vulnerability in version 1.4.0 of nginx, as included in various vendors' operating system distributions, could allow attackers to execute arbitrary code on the targeted host.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
Title: Microsoft Internet Explorer 8 Use-After-Free Memory Corruption Vulnerability
Description: Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly allocated or (2) is deleted, as exploited in the wild in May 2013.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
Title: Adobe ColdFusion Information Disclosure Vulnerability (APSB13-13)
Description: Unspecified vulnerability in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to read arbitrary files via unknown vectors.
CVSS v2 Base Score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
Title: Java Applet Reflection Type Confusion Remote Code Execution
Description: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via unknown vectors related to HotSpot. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from the original researcher that this vulnerability allows remote attackers to bypass permission checks by the MethodHandles method and modify arbitrary public final fields using reflection and type confusion, as demonstrated using integer and double fields to disable the security manager.
CVSS v2 Base Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Title: Oracle Java SE JVM 2D Subcomponent Remote Code Execution
Vulnerability (Oracle Security Alert for CVE-2013-1493)
Description: The color management (CMM) functionality in the 2D component in Oracle Java SE 7 Update 15 and earlier, 6 Update 41 and earlier, and 5.0 Update 40 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (crash) via an image with crafted raster parameters, which triggers (1) an out-of-bounds read or (2) memory corruption in the JVM, as exploited in the wild in February 2013.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
SHA 256: 94A1A26F61B015C2CED2FD50BDBA4070B6C9AEC7D2938FBF7EB9E99960D3B7A9
Typical Filename: RemoveWAT.exe
Claimed Product: RemoveWAT.exe
Claimed Publisher: RemoveWAT.exe
SHA 256: AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615
Typical Filename: 01.tmp
Claimed Product: 01.tmp
Claimed Publisher: 01.tmp
SHA 256: 7BB7125EC5ECF99F975D7CB127009E615847D3FF05FA9F2F79F92CB480B28DC5
Typical Filename: pricepeep_130001_0101.exe
Claimed Product: pricepeep_130001_0101.exe
Claimed Publisher: pricepeep_130001_0101.exe
SHA 256: A6B140EC734C258C5EBF19C0BC0B414B5655ADC00108A038B5BE6A8F83D0BD03
Typical Filename: Virus.Win32.Sality.ab
Claimed Product: Virus.Win32.Sality.ab
Claimed Publisher: Virus.Win32.Sality.ab
SHA 256: DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C
Typical Filename: ygrqpx.exe
Claimed Product: ygrqpx.exe
Claimed Publisher: ygrqpx.exe
(c) 2013. All rights reserved. The information contained in this newsletter, including any external links, is provided "AS IS," with no express or implied warranty, for informational purposes only.
Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit https://www.sans.org/account