Newsletters: @RISK

@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data

A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.

November 22, 2013
=============================================================

@RISK: The Consensus Security Vulnerability Alert

Vol. 13, Num. 47

Providing a reliable, weekly summary of newly discovered attack vectors, vulnerabilities with active exploits, and explanations of how recent attacks worked.

=============================================================

CONTENTS:

NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES 11/12/2013 - 11/19/2013
============================================================

TOP VULNERABILITY THIS WEEK: Microsoft Office TIFF Integer Overflow

******************** Sponsored By Bit9 *********************

When it comes to endpoint security, large organizations find themselves in a difficult situation. Most enterprises have host-based security software (i.e., antivirus software) installed on almost every PC and server, yet their IT assets are constantly attacked - and often compromised - by sophisticated malware and targeted attacks. Download this whitepaper for more information.
http://www.sans.org/info/144202

============================================================

TRAINING UPDATE

- --SANS Cyber Defense Initiative Washington, DC December 12-19, 2013
31 courses. Bonus evening presentations include Have No Fear - DFIR is Here!; New School Forensics: Latest Tools and Techniques in Memory Analysis; and a Special Event: NetWars Tournament of Champions.
http://www.sans.org/event/cyber-defense-initiative-2013

- --SANS Security East 2014 New Orleans, LA January 20-25, 2014
10 courses. Bonus evening presentations include Legends: The Reality Behind the Security Fairytales We All Hear; and 10 Things Security Teams Need to Know About Cloud Security.
http://www.sans.org/event/security-east-2014

- --SANS Scottsdale 2014 Scottsdale, AZ February 17-22, 2014
6 courses. Bonus evening presentations include Offensive Digital Forensics; and Cloud IR and Forensics.
http://www.sans.org/event/sans-scottsdale-2014

- --SANS Sydney 2013 Sydney, Australia November 11-23, 2013
6 courses. Bonus evening presentations include Advanced Exploit Writing: Use-After-Free Vulnerabilities.
http://www.sans.org/event/sydney-2013

- -- SANS London 2013 London, UKNovember 16-25, 2013
17 courses. Bonus evening presentations include Real World Risk - What Incident Responders Can Leverage From IT Operations; Information Assurance Metrics: Practical Steps to Measurement; and APT: It Is Time To Act.
http://www.sans.org/event/london-2013

- --Asia Pacific ICS Security Summit Singapore, Singapore December 2-8, 2013
3 courses. Bonus evening presentations include First Things First: The Top 4 Security Mitigation Strategies.
http://www.sans.org/event/asia-pacific-ics-security-summit-training

- -- Multi-week Live SANS training
http://www.sans.org/mentor/about
Contact mentor@sans.org

- -- Looking for training in your own community?
http://www.sans.org/community/

- --Save on On-Demand training (30 full courses) - See samples at
http://www.sans.org/ondemand/specials

Plus Johannesburg, Abu Dhabi, Seoul, and Bangalore all in the next 90 days.

For a list of all upcoming events, on-line and live: www.sans.org

********************** Sponsored Links: ********************

1) Ask the Expert Webcast = Mobile Forensics: Recovering Data You May Be Missing - Friday, November 22 at 1:00 PM EST. Join Paul Henry from SANS who will be discussing mobile forensics trends and challenges followed by a live demo of Internet Evidence Finder (IEF) Advanced from Jad Saliba and Lance Mueller of Magnet Forensics.
http://www.sans.org/info/144207

2) App Developers and Managers! Share Your Expertise by Taking SANS' 2nd AppSec Survey and Enter to Win an iPad!
http://www.sans.org/info/144212

3) Webcast: Prowling Peer-to-Peer Botnets Monday, December 02 at 1:00 PM EST George Kurtz and Tillmann Werner, co-founders, Crowdstrike. In this live webcast, attendees will learn how to use prowler to reconnoiter and track peer-to-peer botnets.
http://www.sans.org/info/144217

============================================================
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM

Title: Microsoft Office TIFF Integer Overflow 0-day
Description: Still unpatched. An integer overflow exists in a graphic rendering library used by Office products or by some versions of Windows.
Reference:
http://technet.microsoft.com/en-us/security/advisory/2896666
http://blogs.technet.com/b/srd/archive/2013/11/05/cve-2013-3906-a-graphics-vulnerability-exploited-through-word-documents.aspx
http://blog.snort.org/2013/11/sourcefire-vrt-certified-snort-rules.html
Snort SID: 28464-28471
ClamAV: Win.Exploit.CVE_2013_3906-1
Win.Exploit.CVE_2013_3906
Win.Exploit.CVE_2013_3906-2

Title: Security updates for Adobe Flash Player, Reader, Acrobat and Shockwave Player
Description: Additional information has been recently released about several vulnerabilities affecting Adobe Flash Player, Reader, Acrobat and Shockwave Player. Although these vulnerabilities were patched in September 2013, we believe the disclosure of additional information will invite malicious actors to launch attacks against unpatched clients.
Reference:
http://www.adobe.com/support/security/bulletins/apsb13-21.html
http://www.adobe.com/support/security/bulletins/apsb13-22.html
http://www.adobe.com/support/security/bulletins/apsb13-23.html
Snort SID: Multiple
ClamAV: Multiple

Title: CryptoLocker Ransomware Gets a Decryption Service
Description: Still a major problem, given its prevalence. As CryptoLocker Ransomware makes its rounds, criminals have launched a "CryptoLocker Decryption Service".
Reference:
http://thehackernews.com/2013/11/CryptoLocker-Ransomware-Decryption-service-malware-keys.html
Snort SID: 28044, 28416
ClamAV: Multiple

============================================================
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY

EMET (Enhanced Mitigation Experience Toolkit) uncovered
http://0xdabbad00.com/wp-content/uploads/2013/11/emet_4_1_uncovered.pdf

Catching and understanding GSM signals
http://www.ru.nl/publish/pages/578936/fvdbroekscriptie.pdf%E2%80%8E

MagicTraffic : a look inside a Zaccess/Sirefef affiliate

http://malware.dontneedcoffee.com/2013/11/magictraffic-look-inside-zaccesssirefef.html

Reverse Engineering InternalCall Methods in .NET
http://www.exploit-monday.com/2013/11/ReverseEngineeringInternalCallMethods.html

============================================================
RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM.

This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.

ID: N/A
Title: Jelsoft vBulletin Unspecified Security Bypass Vulnerability
Vendor: Jelsoft Enterprises Ltd
Description: A remote exploitation of an unspecified vulnerability in Jelsoft Enterprises Ltd.'s vBulletin could allow attackers to bypass security restrictions. vBulletin versions 4.x.x and 5..x are reported to be vulnerable.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: CVE-2013-3918
Title: Microsoft ActiveX Controls "InformationCardSigninHelper Class" Out-of-Bounds Memory Access Vulnerability
Vendor: Microsoft
Description: A remote code execution vulnerability exists in the InformationCardSigninHelper Class ActiveX control. Specifically the issue occurs in the way "InformationCardSigninHelper Class" ActiveX control (icardie.dll) is loaded into Internet Explorer and causes system state corruption.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: CVE-2013-3906
Title: Microsoft Graphics Component Could Allow Remote Code Execution
Vendor: Microsoft
Description: Remote exploitation of a memory corruption vulnerability in multiple Microsoft products could allow attackers to execute arbitrary code on the targeted host. The issue occurs with how the TIFF codec in Microsoft's graphics component handles crafted TIFF files. Processing crafted TIFF files can corrupt system memory and create an exploitable condition.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: CVE-2012-1823
Title: PHP Group PHP CGI Query String Parameter Processing Remote Code Execution
Vendor: PHP
Description: sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.
CVSS v2 Base Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

ID: Not Available
Title: D-Link Authentication Security Bypass Vulnerability
Vendor: D-Link
Description: A remote exploitation of a design error vulnerability in D-Link Systems Inc.'s routers could allow attackers to bypass authentication security restrictions. The router allows any user with a Web browser having the user agent string "xmlset_roodkcableoj28840ybtide" to gain access to the Web interface of the device without the requirement for any authentication credentials. Affects D-Link Firmware v1.13 and other versions may also be affected.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: CVE-2013-2251
Title: Apache Struts 2 DefaultActionMapper Prefixes OGNL Code Execution
Vendor: Apache
Description: Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

=========================================================
MOST PREVALENT MALWARE FILES 11/12/2013 - 11/19/2013
COMPILED BY SOURCEFIRE

SHA 256: 00B7ACFCACD70642EB75871708D59F8D1A7DBCF813F235B7C2B37AC2DF7F87B7
MD5: E66E725E10B9CB8A6F5C74D7CA9E98A9
VirusTotal:
https://www.virustotal.com/en/file/00B7ACFCACD70642EB75871708D59F8D1A7DBCF813F235B7C2B37AC2DF7F87B7/analysis/
Typical Filename: BitGuard.exe
Claimed Product: Protector
Claimed Publisher: MediaTechSoft Inc.

SHA 256: AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615
MD5: 3291E1603715C47A23B60A8BF2CA73DB
VirusTotal:
https://www.virustotal.com/en/file/AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615/analysis/
Typical Filename: 01.tmp
Claimed Product: -
Claimed Publisher: -

SHA 256: DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C
MD5: 25AA9BB549ECC7BB6100F8D179452508
VirusTotal:
https://www.virustotal.com/en/file/DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C/analysis/
Typical Filename: ygrqpx.exe
Claimed Product: -
Claimed Publisher: -

SHA 256: CA66FE4F11D4CE764F9348BEA9EBDE18A57F9DA928FE381D434A9DE2882D1BB1
MD5: 8ED6E23731912C9A1DA25223422487B3
VirusTotal:
https://www.virustotal.com/en/file/CA66FE4F11D4CE764F9348BEA9EBDE18A57F9DA928FE381D434A9DE2882D1BB1/analysis/
Typical Filename: -
Claimed Product: -
Claimed Publisher: -

SHA 256: FBEAE1C479D485BC4E9244DCAF4E36468C866D7C064E4BAD4206CC6A6C2FE10C
MD5: E10816690103C99A2A40F7D1167DF01A
VirusTotal:
https://www.virustotal.com/en/file/FBEAE1C479D485BC4E9244DCAF4E36468C866D7C064E4BAD4206CC6A6C2FE10C/analysis/
Typical Filename: -
Claimed Product: -
Claimed Publisher: -

=============================================================

(c) 2013. All rights reserved. The information contained in this newsletter, including any external links, is provided "AS IS," with no express or implied warranty, for informational purposes only.

Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit https://www.sans.org/account