Register now for SANS Cyber Defense Initiative 2016 and save $400.

Newsletters: @RISK

@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data

A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.

November 7, 2013
=============================================================

@RISK: The Consensus Security Vulnerability Alert

Vol. 13, Num. 45

Providing a reliable, weekly summary of newly discovered attack vectors, vulnerabilities with active exploits, and explanations of how recent attacks worked.

=============================================================

CONTENTS:

NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES 10/28/2013 - 11/1/2013
============================================================

TOP VULNERABILITY THIS WEEK: Microsoft Office TIFF Integer Overflow

******************** Sponsored By Symantec *********************

This report provides the latest analysis of cyber security threats, trends, and insights from the Symantec Intelligence team concerning malware, spam, and other potentially harmful business risks. Learn more
http://www.sans.org/info/142867

============================================================

TRAINING UPDATE

--South Florida 2013 Ft. Lauderdale, IL November 4-9, 2013 5 courses. Bonus evening presentations include The Security Impact of IPv6; Evolving Threats; and Real-World Risk - What Incident Responders Can leverage from IT Operations. http://www.sans.org/event/south-florida-2013

- --SANS Cyber Defense Initiative Washington, DC December 12-19, 2013
31 courses. Bonus evening presentations include Have No Fear - DFIR is Here!; New School Forensics: Latest Tools and Techniques in Memory Analysis; and a Special Event: NetWars Tournament of Champions.
http://www.sans.org/event/cyber-defense-initiative-2013

- -- SANS Dubai 2013Dubai, UAEOctober 26th - November 7th 2013
SANS returns to Dubai with four essential courses at the Hilton Jumeirah Beach.
http://www.sans.org/event/dubai-2013

- -- SANS London 2013 London, UKNovember 16-25, 2013
17 courses. Bonus evening presentations include Real World Risk - What Incident Responders Can Leverage From IT Operations; Information Assurance Metrics: Practical Steps to Measurement; and APT: It Is Time To Act.
http://www.sans.org/event/london-2013

- -- Multi-week Live SANS training
http://www.sans.org/mentor/about
Contact mentor@sans.org

- -- Looking for training in your own community?
http://www.sans.org/community/

- --Save on On-Demand training (30 full courses) - See samples at
http://www.sans.org/ondemand/specials

Plus Johannesburg, Abu Dhabi, Seoul, and Bangalore all in the next 90 days.

For a list of all upcoming events, on-line and live: www.sans.org

********************** Sponsored Links: ********************

1) Special Webcast: Finding Hidden Threats by Decrypting SSL/TLS. Friday, November 08 at 1:00 PM EST. J. Michael Butler, SANS Analyst, and Timothy Chiu, Blue Coat Systems. http://www.sans.org/info/142872

2) Analylst Webcast: Automation and Critical Security Controls 1-7: EIQ SecureVue Tuesday, November 12 at 1:00 PM EST Featuring Jerry Shenk and Brian Mehlman. http://www.sans.org/info/142882

3) Smart Buildings, Cars and Medical Devices! The Internet of Things Survey is Calling You To Take It - and enter to win an iPad. http://www.sans.org/info/142887

============================================================
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM

Title: Microsoft Office TIFF Integer Overflow
Description: An integer overflow exists in a graphic rendering library used by Office products or by some versions of Windows.
Reference:
http://blogs.technet.com/b/srd/archive/2013/11/05/cve-2013-3906-a-graphics-vulnerability-exploited-through-word-documents.aspx
http://blog.snort.org/2013/11/sourcefire-vrt-certified-snort-rules.html
Snort SID: 28464-28471
ClamAV: Win.Exploit.CVE_2013_3906-1
Win.Exploit.CVE_2013_3906
Win.Exploit.CVE_2013_3906-2

Title: HP Intelligent Management Center BIMS UploadServlet Arbitrary File Upload
Description: A lack of authentication and sanitization of PUT requests leads to an arbitrary file upload vulnerability
Reference: http://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03943425/
Snort SID: 28407
ClamAV:N/A

Title: HP Intelligent Management Center BIMS bimsDownload Information Disclosure
Description: A lack of authentication and insufficient input validation of path and filename parameters reveals an information disclosure vulnerability
Reference: h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03943425
Snort SID: 28448
ClamAV: N/A

Title: CryptoLocker Ransomware Gets a Decryption Service
Description: As CryptoLocker Ransomware makes its rounds, criminals have launched a "CryptoLocker Decryption Service".
Reference: http://thehackernews.com/2013/11/CryptoLocker-Ransomware-Decryption-service-malware-keys.html
Snort SID: 28044, 28416 ClamAV: Multiple

============================================================
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY

Using Nessus to Detect Suspicious Windows Processes
http://www.tenable.com/blog/using-nessus-to-detect-suspicious-windows-processes

26th Annual FIRST Conference Call for Papers
https://cfp.first.org/conferenceDisplay.py?confId=2

How a grad student trying to build the first botnet brought the Internet to its knees
http://www.washingtonpost.com/blogs/the-switch/wp/2013/11/01/how-a-grad-student-trying-to-build-the-first-botnet-brought-the-internet-to-its-knees/

Cloud-Based Sandboxing: An Elevated Approach to Network Security
http://www.securityweek.com/cloud-based-sandboxing-elevated-approach-network-security

============================================================
RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM.

This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.

ID: CVE-2013-3906
Title: Microsoft Graphics Component Could Allow Remote Code Execution
Vendor: Microsoft
Description: Remote exploitation of a memory corruption vulnerability in multiple Microsoft products could allow attackers to execute arbitrary code on the targeted host. The issue occurs with how the TIFF codec in Microsoft's graphics component handles crafted TIFF files. Processing crafted TIFF files can corrupt system memory and create an exploitable condition.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: CVE-2012-1823
Title: PHP Group PHP CGI Query String Parameter Processing Remote Code Execution
Vendor: PHP
Description: sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.
CVSS v2 Base Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

ID: CVE-2013-4822
Title: HP Intelligent Management Center BIMS UploadServlet Directory Traversal
Vendor: HP
Description: Unspecified vulnerability in HP Intelligent Management Center (iMC) and HP IMC Branch Intelligent Management System Software Module (aka BIMS) allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1606.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: Not Available
Title: D-Link Authentication Security Bypass Vulnerability
Vendor: D-Link
Description: A remote exploitation of a design error vulnerability in D-Link Systems Inc.'s routers could allow attackers to bypass authentication security restrictions. The router allows any user with a Web browser having the user agent string "xmlset_roodkcableoj28840ybtide" to gain access to the Web interface of the device without the requirement for any authentication credentials. Affects D-Link Firmware v1.13 and other versions may also be affected.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: CVE-2013-3897
Title: Microsoft Internet Explorer CDisplayPointer Use-After-Free (MS13-080)
Vendor: Microsoft
Description: Use-after-free vulnerability in the CDisplayPointer class in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted JavaScript code that uses the onpropertychange event handler, as exploited in the wild in September and October 2013, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: CVE-2013-2251
Title: Apache Struts 2 DefaultActionMapper Prefixes OGNL Code Execution
Vendor: Apache
Description: Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

=========================================================
MOST PREVALENT MALWARE FILES 10/28/2013 - 11/1/2013
COMPILED BY SOURCEFIRE

SHA 256: 00B7ACFCACD70642EB75871708D59F8D1A7DBCF813F235B7C2B37AC2DF7F87B7
MD5: e66e725e10b9cb8a6f5c74d7ca9e98a9
VirusTotal:
https://www.virustotal.com/en/file/00B7ACFCACD70642EB75871708D59F8D1A7DBCF813F235B7C2B37AC2DF7F87B7/analysis/

Typical Filename: BitGuard.exe
Claimed Product: Protector
Claimed Publisher: MediaTechSoft Inc.

SHA 256: a1f8f37d2d5646e06201ae961e6246337ee73569c8e157d21b9211a75fc26630
MD5: dad6f82c589cd0d558374a8b5fa293b2
VirusTotal:
https://www.virustotal.com/en/file/A1F8F37D2D5646E06201AE961E6246337EE73569C8E157D21B9211A75FC26630/analysis/

Typical Filename: smodsulog.exe
Claimed Product: Worm.Palevo
Claimed Publisher: None

SHA 256: ca24a8f7c04fe15a758f3360c8e5619205c53807bfc65f82c028cdf808bf2189
MD5: ec63f649f7090f885ebd4770ffb92fcb
VirusTotal:
https://www.virustotal.com/en/file/CA24A8F7C04FE15A758F3360C8E5619205C53807BFC65F82C028CDF808BF2189/analysis/

Typical Filename: UpdateTask.exe
Claimed Product: W32.Trojan.16l1
Claimed Publisher: None.

SHA 256: b2cad8322db85f67db6ea074d00c2ed56ce1fa92952d07b70baac249fa18236d
MD5: 249a44dcfa2500eb1c020e33a3e9f25b
VirusTotal:
https://www.virustotal.com/en/file/B2CAD8322DB85F67DB6EA074D00C2ED56CE1FA92952D07B70BAAC249FA18236D/analysis/

Typical Filename: FlashPlayerUpdateService.exe
Claimed Product: W32.Downloader:AgentASEBTrj.16mc.1201
Claimed Publisher: None

SHA 256: df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c
MD5: 25aa9bb549ecc7bb6100f8d179452508
VirusTotal:
https://www.virustotal.com/en/file/DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C/analysis/

Typical Filename: ygrqpx.exe
Claimed Product: W32.Sality
Claimed Publisher: None

=============================================================

(c) 2013. All rights reserved. The information contained in this newsletter, including any external links, is provided "AS IS," with no express or implied warranty, for informational purposes only.

Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit https://www.sans.org/account