Best Offers Of The Year Are Here with SANS OnDemand Cybersecurity Training - Learn More

Newsletters: @RISK

Subscribe to SANS Newsletters

Join the SANS Community to receive the latest curated cyber security news, vulnerabilities and mitigations, training opportunities, and our webcast schedule.

SANS NewsBites
@Risk: Security Alert
OUCH! Security Awareness
Case Leads DFIR Digest
Industrial Control Systems
Industrials & Infrastructure

@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data

A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.

December 12, 2013

@RISK: The Consensus Security Vulnerability Alert

Vol. 13, Num. 49

Providing a reliable, weekly summary of newly discovered attack vectors, vulnerabilities with active exploits, and explanations of how recent attacks worked.



MOST PREVALENT MALWARE FILES 12/1/2013 - 12/7/2013

TOP VULNERABILITY THIS WEEK: Microsoft Tuesday Updates

******************** Sponsored By Lancope ********************

Traditional security solutions are not enough to protect organizations from today's top threats. Learn why internal visibility is a necessity for network security today, and how it can be used to more effectively mitigate insider threats and APTs.



- --SANS Cyber Defense Initiative ® Washington, DC December 12-19, 2013
31 courses. Bonus evening presentations include Have No Fear - DFIR is Here!; New School Forensics: Latest Tools and Techniques in Memory Analysis; and a Special Event: NetWars Tournament of Champions.

- --SANS Security East 2014 New Orleans, LA January 20-25, 2014
10 courses. Bonus evening presentations include Legends: The Reality Behind the Security Fairytales We All Hear; and 10 Things Security Teams Need to Know About Cloud Security.

- --SANS Scottsdale 2014 Scottsdale, AZ February 17-22, 2014
6 courses. Bonus evening presentations include Offensive Digital Forensics; and Cloud IR and Forensics.

- --SANS Brussels 2014 Brussels, Belgium February 17-22, 2014
4 courses.

- --SANS Secure Singapore 2014 Singapore, Singapore March 10-26, 2014
7 courses. Bonus evening presentations includes Incident Response and Forensics in the Cloud.

- -- Multi-week Live SANS training

- -- Looking for training in your own community?

- --Save on On-Demand training (30 full courses) - See samples at

Plus Muscat, San Antonio, and Dubai all in the next 90 days.

For a list of all upcoming events, on-line and live:

********************** Sponsored Links: *********************

1) Discover how BlueCoat's Lifecycle Defense enables you to preserve your IT budget, protect and empower your business.

2) Take the SANS Survey on Endpoint Protection and win an iPad Air! SANS is conducting this survey to investigate the use of endpoint protections and improvements in managing/securing them and to identify additional areas that must be addressed to reduce risk and improve protection and compliance practices. Have your voice heard. Complete the survey:

3) Take the SANS Second survey on Application Security and enter to win an iPad!


Title: Microsoft Tuesday Updates
Description: 24 CVEs have been fixed in the latest rounds of Microsoft Tuesday Updates. 7 CVEs in Internet Explorer alone. For a full breakdown of the CVEs and the vulnerabilities see below:
Snort SID: 27823, 28464-28473, 28487-28488, 28525-28526, 28862-28863,
28865-28878, 28880-28882

Title: Adobe Flash and Shockwave Player Updates
Description: This vulnerability is of an extremely low priority being that you have to be logged in and the traffic is SSL encrypted, however, it is possible for users to retrieve sensitive information, to create additional accounts and to perform remote code execution.
Snort SID: Detection is forthcoming
ClamAV: Detection is forthcoming

Title: Dexter2/Stardust POS Malware
Description: A new version of POS Malware known as "Dexter2" or "Stardust" has been discovered and disclosed on the internet.
Snort SID: 28891-28892, 25553 ClamAV: N/A


When an Exploit Kit is VERY Simple

Look what I found, Moar Pony!

Malicious multi-hop iframe campaign affects thousands of Web sites, leads to a cocktail of client-side exploits - part two


This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.

D: CVE-2013-5331
Title: Adobe Flash Player Memory Corruption Code Execution
Vulnerability (APSB13-28)
Vendor: Adobe
Description: Remote exploitation of a memory corruption vulnerability in Adobe System Inc.'s Flash Player versions 11.9.900.152 and earlier versions for Windows and Macintosh and Adobe Flash Player and earlier versions for Linux. This could allow an attacker to execute arbitrary code. Adobe is aware of reports that an exploit designed to trick the user into opening a Microsoft Word document with malicious Flash (.swf).
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: CVE-2013-5065
Title: Microsoft Windows Kernel "NDProxy.sys Driver" Input Validation Code Execution Vulnerability
Vendor: Microsoft
Description: NDProxy.sys in the kernel in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in November 2013.
CVSS v2 Base Score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)

ID: CVE-2013-5486
Title: Cisco Prime Data Center Network Manager (DCNM) "fileUploadServlet" Command Execution Vulnerability
Vendor: Cisco
Description: DCNM-SAN Server in Cisco Prime Data Center Network Manager (DCNM) before 6.2(1) allows remote attackers to execute arbitrary commands via unspecified vectors, aka Bug IDs CSCue77035 and CSCue77036.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: CVE-2013-0074
Title: Microsoft Silverlight Double Dereference Vulnerability
Vendor: Microsoft
Description: Microsoft Silverlight 5, and 5 Developer Runtime, before 5.1.20125.0 does not properly validate pointers during HTML object rendering, which allows remote attackers to execute arbitrary code via a crafted Silverlight application, aka "Silverlight Double Dereference Vulnerability."
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: CVE-2013-3906
Title: Microsoft Graphics Component Could Allow Remote Code Execution
Vendor: Microsoft
Description: GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and Lync 2010, 2010 Attendee, 2013, and Basic 2013 allows remote attackers to execute arbitrary code via a crafted TIFF image, as demonstrated by an image in a Word document, and exploited in the wild in October and November 2013.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: CVE-2013-6026
Title: D-Link Authentication Security Bypass Vulnerability
Vendor: D-Link
Description: The web interface on D-Link DIR-100, DIR-120, DI-624S, DI-524UP, DI-604S, DI-604UP, DI-604+, and TM-G5240 routers; Planex BRL-04R, BRL-04UR, and BRL-04CW routers; and Alpha Networks routers allows remote attackers to bypass authentication and modify settings via an xmlset_roodkcableoj28840ybtide User-Agent HTTP header, as exploited in the wild in October 2013.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

MOST PREVALENT MALWARE FILES 12/1/2013 - 12/7/2013

SHA 256: DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C
MD5: 25aa9bb549ecc7bb6100f8d179452508
Typical Filename: Random
Claimed Product: Random
Detection Name: W32.DF83A0D694-100.SBX.VIOC

SHA 256: 180c6035ca44c270b8e1556a7b2e9faf442d1b4323ef6d8e93b7e759af169c96
MD5: 44e5b5dc6a27ea109b8a234e640bb5fd
Typical Filename: BitGuard
Claimed Product: BitGuard
Detection Name:

SHA 256: 5b8a898d66a1cb12ab682799cbb501699faf860b5f98a6a37068963ac1c844ac
MD5: 9b32cd6e776ee3abd010f44fecd7edfc
Typical Filename: hao123Inst.exe
Claimed Product: hao123Inst.exe
Detection Name: W32.Auto:5b8a89.TG.VRT

SHA 256: aa0bbaecb678868e1e7f57c7ca9d61b608b3d788be490790eb1d148beadf4615
MD5: 3291e1603715c47a23b60a8bf2ca73db
Typical Filename: 08.tmp
Claimed Product: None
Detection Name: Confiker


(c) 2013. All rights reserved. The information contained in this newsletter, including any external links, is provided "AS IS," with no express or implied warranty, for informational purposes only.

Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit