Get an 11" iPad Pro, Surface Go 2, or $300 Off with OnDemand Training

Newsletters: @RISK

Subscribe to SANS Newsletters

Join the SANS Community to receive the latest curated cyber security news, vulnerabilities and mitigations, training opportunities, and our webcast schedule.

SANS NewsBites
@Risk: Security Alert
OUCH! Security Awareness
Case Leads DFIR Digest
Industrial Control Systems
Industrials & Infrastructure

@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data

A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.

October 24, 2013

@RISK: The Consensus Security Vulnerability Alert

Vol. 13, Num. 43

Providing a reliable, weekly summary of newly discovered attack vectors, vulnerabilities with active exploits, and explanations of how recent attacks worked.



MOST PREVALENT MALWARE FILES 10/14/2013 - 10/18/2013

TOP VULNERABILITY THIS WEEK: Multiple Backdoors in Routers

******************** Sponsored By Bit9 *********************

Do you have maximum malware visibility across both your network and endpoint? Forrester analysts agree the future of enterprise security is a single, consolidated solution delivering maximum detection, response, and protection across both the endpoint and network. Download this report to understand the strategy behind a new generation of enterprise security. Learn More



- -- Securing the Internet of Things Summit (October 17-22, 2013) San Francisco, CA
The Internet of Things summit focuses on new solutions, demonstrates security technology that already works and provides a force multiplier to make the Internet of Things more secure.

- -- Health Care Cyber Security Summit (October 17-24, 2013) San Francisco, CA Meet leaders from the top health care organizations and see what really works in securing and succeeding in the new health care environment - balance security, compliance, and innovation.

--SANS Chicago 2013 Chicago, ILOctober 28-November 2, 2013
7 courses. Bonus evening presentations include SANS 8 Mobile Device Security Steps; and Privileged Domain Account Protection: How to Limit Credentials Exposure.

--South Florida 2013 Ft. Lauderdale, IL November 4-9, 2013 5 courses. Bonus evening presentations include The Security Impact of IPv6; Evolving Threats; and Real-World Risk - What Incident Responders Can leverage from IT Operations.

- --October Singapore 2013 Singapore, Singapore October 21-November 2, 2013
5 courses. Bonus evening presentations include Pen Testing the Smart Grid; and You Can Panic Now. Host Protection is (Mostly) Dead.

- -- SANS Dubai 2013Dubai, UAEOctober 26th - November 7th 2013
SANS returns to Dubai with four essential courses at the Hilton Jumeirah Beach.

- -- SANS London 2013 London, UKNovember 16-25, 2013
17 courses. Bonus evening presentations include Real World Risk - What Incident Responders Can Leverage From IT Operations; Information Assurance Metrics: Practical Steps to Measurement; and APT: It Is Time To Act.

- -- Multi-week Live SANS training

- -- Looking for training in your own community?

- --Save on On-Demand training (30 full courses) - See samples at

Plus Johannesburg, Abu Dhabi, Seoul, and Bangalore all in the next 90 days. For a list of all upcoming events, on-line and live:

********************** Sponsored Links: ********************

1) Analyst Webcast: Not your Father's IPS: SANS Survey on Network Security Results, featuring Rob Vandenbrink, Tuesday October 29 at 1 PM EDT.

2) Analyst Webcast: Finding Hidden Threats by Decrypting SSL Traffic featuring J. Michael Butler Friday, Nov. 8 at 1 PM EDT.

3) Thank you for attending our webcast on Testing Next-Generation Firewalls, featuring Dr. Eric Cole, Patrick Bedwell and Phil Trainor. As promised, here is the link to the associated SANS whitepaper:


Title: Tenda W302R wireless router w302r_mfg remote code execution
Description: By sending a UDP packet with a certain string in the content, the user is able to make the router execute commands remotely. This backdoor only works on the local lan. This backdoor was likely first implemented in Tendas W302R router, although it also exists in the Tenda W330R, as well as re-branded models, such as the Medialink MWN-WAPR150N.
Snort SID: 28289-28290

Title: WHMCS 5.2.8 Vulnerability
Description: Through the manipulation of variables, files are able to be written to a remote install of WHMCS.
Snort SID: 28299
ClamAV: N/A

Title: Kore, Nuclear, and Magnitude Exploit Kits are on the rise
Description: Various Exploit Kits are scrambling to take the "King of the Hill" title after the arrest of 'pauch' the author of the Blackhole and Cool Exploit Kits.
Snort SID: Multiple
ClamAV: Multiple

Title: Apple Releases OSX Mavericks, iOS 7.0.3
Description: Apple has released the newest version of their OS for both the iOS platform and the Desktop. Many security vulnerabilities are fixed in these releases, and both releases are free.
Snort SID: N/A
ClamAV: N/A


Apache fixes Information Disclosure Vulnerability in Shindig

Court Rules Probable-Cause Warrant Required for GPS Trackers

Social Threats of Greatest Risk Concern for Executives

Generation Y Users Say They Will Break Corporate BYOD Rules


This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.

ID: CVE-2013-2333
Title: HP Data Protector Cell Request Service Buffer Overflow
Vendor: HP
Description: Unspecified vulnerability in HP Storage Data Protector 6.20, 6.21, 7.00, and 7.01 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1680.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: Not Available
Title: D-Link Authentication Security Bypass Vulnerability
Vendor: D-Link
Description: A remote exploitation of a design error vulnerability in D-Link Systems Inc.'s routers could allow attackers to bypass authentication security restrictions. The router allows any user with a Web browser having the user agent string "xmlset_roodkcableoj28840ybtide" to gain access to the Web interface of the device without the requirement for any authentication credentials. Affects D-Link Firmware v1.13 and other versions may also be affected.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: CVE-2013-3897
Title: Microsoft Internet Explorer CDisplayPointer Use-After-Free (MS13-080)
Vendor: Microsoft
Description: Use-after-free vulnerability in the CDisplayPointer class in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted JavaScript code that uses the onpropertychange event handler, as exploited in the wild in September and October 2013, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: Not Available
Title: Joomla! Unauthorised Uploads
Vendor: Joomla!
Description: Inadequate filtering leads to the ability to bypass file type upload restrictions.
Affects Joomla! version 2.5.13 and earlier 2.5.x versions; and version 3.1.4 and earlier 3.x versions
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: CVE-2013-2251
Title: Apache Struts 2 DefaultActionMapper Prefixes OGNL Code Execution
Vendor: Apache
Description: Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

MOST PREVALENT MALWARE FILES 10/14/2013 - 10/18/2013

SHA 256: CA66FE4F11D4CE764F9348BEA9EBDE18A57F9DA928FE381D434A9DE2882D1BB1
MD5: 8ed6e23731912c9a1da25223422487b3
Typical Filename: Random
Claimed Product: None
Claimed Publisher: None
Detection Name: Sality

SHA 256: 6F2717BCC3428D7044C488976788695B60F1C3F9F29AA791DEAA31E21A3F049D
MD5: a2a4e91cdf63cfdd05592d355335bcaa
Typical Filename: Random
Claimed Product: None
Claimed Publisher: None
Detection Name: Sality

SHA 256: 7BEB3EAED035809B9F9DC11ABBD8B33ADC534ED1F2AC80D096C57820330A6E80
MD5: 0b62417da5719b3ea1d343da3431c97f
Typical Filename: FLVPlayerUpdate_downloader_by_FLVPlayerUpdate.exe
Claimed Product: Somoto
Claimed Publisher: BetterInstaller
Detection Name: Somoto

SHA 256: d14b66bd4c4c8f66a6edf2820fd4162d09b326beaf6a42014596571e81a1a503
MD5: 68b7f7a26b76805432e3d50009d2ab1f
Typical Filename: W32.Agent:B.16lp.1201
Claimed Product: W32.Agent:B.16lp.1201
Claimed Publisher: W32.Agent:B.16lp.1201
Detection Name: W32.Agent:B.16lp.1201

SHA 256: D41F20AF6D1664BEDC12DF152849BC058D31D9563B9FA973B71BCCEEE17EDB80
MD5: 918007c1311c833b58f50b59b454266d
Typical Filename: WebCakeDesktop.exe
Claimed Product: WebCakeDesktop.exe
Claimed Publisher: WebCakeDesktop.exe
Detection Name: W32.WebCake:WebcakeAAdw.16lo.hw


(c) 2013. All rights reserved. The information contained in this newsletter, including any external links, is provided "AS IS," with no express or implied warranty, for informational purposes only.

Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit