@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data
A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.June 20, 2013
@RISK: The Consensus Security Vulnerability Alert
Vol. 13, Num. 25
Providing a reliable, weekly summary of newly discovered attack vectors, vulnerabilities with active exploits, and explanations of how recent attacks worked.=============================================================
TOP VULNERABILITY THIS WEEK: Denial of service in Wordpress 3.5.1
******************** Sponsored By SANS *********************
Take the SANS survey on Security Intelligence and Analytics and enter to win an iPad!
- -- Industrial Control System (ICS) Security Training In-depth, hands-on technical courses taught by top SCADA experts. Gain the most current information regarding SCADA and Control System threats and learn how to best prepare to defend against them. Leave the event with solutions that you can immediately put to use in your organization.
--Washington, DC (August 12-August 16) http://www.sans.org/event/ics-security-training-washington-dc
- -- SANSFIRE 2013 Washington, DC June 14-22, 2013 42 courses. Bonus evening sessions include Avoiding Cyberterrorism Threats Inside Hydraulic Power Generation Plants; and Automated Analysis of Android Malware. http://www.sans.org/event/sansfire-2013
- -- Security Impact of IPv6 Summit Washington, DC June 14-16 Held in conjunction with SANSFIRE 2013, the Security Impact of IPv6 Summit offers discussions and panels with IPv6 security experts, ISPs, early adopters, and industry vendors. You will come away with best practices from those who have already implemented IPv6. A two-day, post-summit class follows: http://www.sans.org/event/ipv6-summit-2013/course/ipv6-essentialshttp://www.sans.org/event/ipv6-summit-2013
- -- SANS Rocky Mountain 2013 Denver, CO July 14-20, 2013 10 courses. Bonus evening sessions include OODA - The Secret to Effective Security in Any Environment; and APT: It is Not Time to Pray, It is Time to Act. http://www.sans.org/event/rocky-mountain-2013
- -- SANS San Francisco 2013 San Francisco, CA July 29-August 3, 2013 7 courses. Bonus evening sessions include Offensive Digital Forensics; and Base64 Can Get You Pwned! http://www.sans.org/event/san-francisco-2013
- -- SANS Boston 2013 Boston, MA August 5-10, 2013 9 courses. Bonus evening sessions include Cloud R and Forensics; and You Can Panic Now. Host Protection is (Mostly) Dead. http://www.sans.org/event/boston-2013
- -- SANS Virginia Beach 2013 Virginia Beach, VA August 19-30, 2013 10 courses. Bonus evening presentations include Thanks for Recovering ... Now I Can Hack You!; Everything I Know is Wrong!; and APT: It is Time to Act. http://www.sans.org/event/virginia-beach-2013
- -- SANS London Summer 2013 London, UK July 9-July 16, 2013 4 courses. SANS has added a new London date to the security-training calendar, giving security professionals the opportunity to take one of four of SANS' most popular 6-day courses and the excellent 2 day Securing The Human course. http://www.sans.org/event/london-summer-2013
- -- SANS Forensics Prague 2013Prague, Czech RepublicOctober 6-13 2013 SANS's European forensics summit and dedicated forensics training event. Four of SANS's most important forensics training courses and opportunities to network with leading digital forensics experts. http://www.sans.org/event/forensics-prague-2013
- -- SANS Dubai 2013Dubai, UAEOctober 26th - November 7th 2013 SANS returns to Dubai with four essential courses at the Hilton Jumeirah Beach. http://www.sans.org/event/dubai-2013
- -- Looking for training in your own community?
- --Save on On-Demand training (30 full courses) - See samples at
Plus Johannesburg, Abu Dhabi, Seoul, and Bangalore all in the next 90 days. For a list of all upcoming events, on-line and live: www.sans.org********************** Sponsored Links: ********************
1) Analyst Webcast: Getting Hitched: Converging Endpoint and Network Data Analysis for Improved Visibility and Control, Featuring Jerry Shenk, Wednesday, July 10, 2013 at 1:00 PM EDT. http://www.sans.org/info/133382
2) Analyst Webcast: Critical Security Controls Survey. Tuesday, June 25, 2013 at 1:00 PM EDT. http://www.sans.org/info/133387============================================================
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM
Title: JavaDoc frame injection vulnerability
Description: Javadoc is a tool that generates frames for online documentation webapps such as http://docs.oracle.com/javase/7/docs/api/. However there is a vulnerability in how javadoc interprets user supplied frames and by using the a variation, the frame will use the user supplied frame. This can be put into a webpage and the user will click it, thinking he is going to the docs.oracle site, but the frame will incorporate the malicious redirection. Oracle has just released its security update for June 2013 - a release that comprises of 40 security updates, with 37 of them addressing vulnerabilities that lead to malware execution. Among the updates is one that fixes the vulnerability found in Javadoc.
Snort SID: TBD
Title: Denial of service in Wordpress 3.5.1
Description: Version 3.5.1 (latest) of popular blogging engine WordPress suffers from remote denial of service vulnerability. The bug exists in encryption module (class-phpass.php). The exploitation of this vulnerability is possible only when at least one post is protected by a password.
Snort SID: 26981 ClamAV: N/A
Title: APSB13-15 Adobe Reader X XML Forms BMP handling
Description: Adobe Reader X is vulnerable to specially crafted compressed BMP images. When they are decompressed, an integer overflow allows an attacker to possibly gain arbitrary code execution.
ClamAV:PDF.Exploit.CVE_2013_2729, PDF.Exploit.CVE_2013_2729-1, PDF.Exploit.CVE_2013_2729-2
AntiTaintDroid (a.k.a. ScrubDroid) source code released
Statically Recompiling NES Games into Native Executables with LLVM and Go
pa_kt's half of the ASLR/timing attacks speech at SummerCon 2013
Dion Blazakis' half of the ASLR/timing attacks speech at SummerCon 2013
RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM.
This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.
Title: Microsoft Internet Explorer COALineDashStyleArray Integer Overflow (MS13-009)
Description: Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2013, aka "Internet Explorer Use After Free Vulnerability," a different vulnerability than CVE-2013-1308 and CVE-2013-1309.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
Title: Java Web Start Double Quote Injection Remote Code Execution
Description: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, and 6 Update 35 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
Title: Microsoft Internet Explorer textNode Use-After-Free
Description: Use-after-free vulnerability in Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer Use After Free Vulnerability."
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Title: Oracle WebCenter Content CheckOutAndOpen.dll ActiveX Remote Code Execution
Description: Unspecified vulnerability in the Oracle WebCenter Content component in Oracle Fusion Middleware 10.1.3.5.1 and 126.96.36.199.0 allows remote authenticated users to affect availability via unknown vectors related to Content Server.
CVSS v2 Base Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)
Title: Java Applet Reflection Type Confusion Remote Code Execution
Description: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via unknown vectors related to HotSpot. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from the original researcher that this vulnerability allows remote attackers to bypass permission checks by the MethodHandles method and modify arbitrary public final fields using reflection and type confusion, as demonstrated using integer and double fields to disable the security manager.
CVSS v2 Base Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Title: Oracle Java SE JVM 2D Subcomponent Remote Code Execution
Vulnerability (Oracle Security Alert for CVE-2013-1493)
Description: The color management (CMM) functionality in the 2D component in Oracle Java SE 7 Update 15 and earlier, 6 Update 41 and earlier, and 5.0 Update 40 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (crash) via an image with crafted raster parameters, which triggers (1) an out-of-bounds read or (2) memory corruption in the JVM, as exploited in the wild in February 2013.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
SHA 256: 94A1A26F61B015C2CED2FD50BDBA4070B6C9AEC7D2938FBF7EB9E99960D3B7A9
Typical Filename: RemoveWAT.exe
Claimed Product: RemoveWAT.exe
Claimed Publisher: RemoveWAT.exe
SHA 256: AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615
Typical Filename: 01.tmp
Claimed Product: 01.tmp
Claimed Publisher: 01.tmp
SHA 256: 7BB7125EC5ECF99F975D7CB127009E615847D3FF05FA9F2F79F92CB480B28DC5
Typical Filename: pricepeep_130001_0101.exe
Claimed Product: pricepeep_130001_0101.exe
Claimed Publisher: pricepeep_130001_0101.exe
SHA 256: A6B140EC734C258C5EBF19C0BC0B414B5655ADC00108A038B5BE6A8F83D0BD03
Typical Filename: Virus.Win32.Sality.ab
Claimed Product: Virus.Win32.Sality.ab
Claimed Publisher: Virus.Win32.Sality.ab
SHA 256: DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C
Typical Filename: ygrqpx.exe
Claimed Product: ygrqpx.exe
Claimed Publisher: ygrqpx.exe
(c) 2013. All rights reserved. The information contained in this newsletter, including any external links, is provided "AS IS," with no express or implied warranty, for informational purposes only.
Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit https://www.sans.org/account