Learn InfoSec skills you can implement immediately! Six courses available in Houston - Oct. 28-Nov. 2.

Newsletters: @RISK

Subscribe to SANS Newsletters

Join the SANS Community to receive the latest curated cyber security news, vulnerabilities and mitigations, training opportunities, and our webcast schedule.





SANS NewsBites
@Risk: Security Alert
OUCH! Security Awareness
Case Leads DFIR Digest
Industrial Control Systems
Industrials & Infrastructure


@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data

A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.

July 11, 2019

=============================================================

     @RISK: The Consensus Security Vulnerability Alert

               July 11, 2019 - Vol. 19, Num. 28


Providing a reliable, weekly summary of newly discovered attack vectors,

vulnerabilities with active exploits, and explanations of how recent

attacks worked


Archived issues may be found at http://www.sans.org/newsletters/at-risk


=============================================================


CONTENTS:

NOTABLE RECENT SECURITY ISSUES

INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY

VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE

MOST PREVALENT MALWARE FILES July 4 - 11

============================================================


TOP VULNERABILITY THIS WEEK: Microsoft discloses 16 critical vulnerabilities as part of monthly security update


******************** Sponsored By Tenable *******************


Effective, data-driven vulnerability prioritization. Last year 16,500 new vulnerabilities were disclosed. CVSS categorized most as high or critical. With vulnerabilities on the rise, how do you know which ones to fix first? For answers, read the ebook, "3 Things You Need to Know About Prioritizing Vulnerabilities." http://www.sans.org/info/213595


============================================================


TRAINING UPDATE

 

-- SANS Network Security 2019 | Las Vegas, NV | September 9-16 | https://www.sans.org/event/network-security-2019


-- Pen Test Hackfest Europe 2019 | Berlin, DE | July 22-28 | https://www.sans.org/event/pentest-hackfest-eu-july-2019


-- DFIR Summit & Training 2019 | Austin, TX | July 25-August 1 | https://www.sans.org/event/digital-forensics-summit-2019


-- Supply Chain Cybersecurity Summit 2019 | Arlington, VA | August 12-19 | https://www.sans.org/event/supply-chain-cybersecurity-summit-2019


-- SANS Chicago 2019 | August 19-24 | https://www.sans.org/event/chicago-2019


-- SANS Virginia Beach 2019 | August 19-30 | https://www.sans.org/event/virginia-beach-2019


-- SANS London September 2019 | September 23-28 | https://www.sans.org/event/london-september-2019


-- SANS Tokyo Autumn 2019 | September 30-October 12 | https://www.sans.org/event/tokyo-autumn-2019


-- SANS October Singapore 2019 | October 7-26 | https://www.sans.org/event/october-singapore-2019


-- SANS OnDemand and vLive Training

Get an iPad Pro with Smart Keyboard, HP ProBook, or Take $350 Off through July 24 with OnDemand or vLive training.

https://www.sans.org/online-security-training/specials/


-- Can't travel? SANS offers online instruction for maximum flexibility

-- Live Daytime training with Simulcast - https://www.sans.org/simulcast

-- Evening training 2x per week for 6 weeks with vLive | https://www.sans.org/vlive

-- Anywhere, Anytime access for 4 months with OnDemand format | https://www.sans.org/ondemand/


-- Single Course Training

SANS Mentor |  https://www.sans.org/mentor/about

Community SANS | https://www.sans.org/community/

 

-- View the full SANS course catalog and Cyber Security Skills Roadmap

https://www.sans.org/courses

https://www.sans.org/cyber-security-skills-roadmap


********************** Sponsored Links: ********************


1) Join Unisys CISO Mathew Newfield for Webcast "Speaking the Language of the Board" on July 16 at 1 PM ET: http://www.sans.org/info/213600


2) ICYMI: Leveraging Your SIEM to Implement Security Best Practices. Register to see the archive: http://www.sans.org/info/213605


3) Webcast: See a demo of how Chronicle's security solutions can help your organization be better prepared for what comes onto your network: http://www.sans.org/info/213610


============================================================


NOTABLE RECENT SECURITY ISSUES

SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP


Title: Microsoft Patch Tuesday

Description: Microsoft released its monthly security update this week, disclosing a variety of vulnerabilities in several of its products. The latest Patch Tuesday covers 77 vulnerabilities, 16 of which are rated "critical," 60 that are considered "important" and one "moderate." This month's security update covers security issues in a variety of Microsoft's products, including the Chakra scripting engine, Internet Explorer and the Windows Server DHCP service.

Reference: https://blog.talosintelligence.com/2019/07/microsoft-patch-tuesday-july-2019.html

Snort SIDs: 45142, 45143, 46548, 46549, 49380, 49381, 50198, 50199, 50662 - 50683

 

Title: Cisco warns of three critical vulnerabilities in DNA Center

Description: Cisco released fixes for three critical bugs in its DNA Center last week. Two of the vulnerabilities -- which both have a CVSS score of 9.8 out of 10 -- involve Cisco Data Center Network manager. The flaws could allow an attacker to gain a valid session cookie or create arbitrary files on the victim machine's underlying Cisco Data Center Network Manager (DCNM).

Reference: https://www.networkworld.com/article/3405901/cisco-sounds-warning-on-3-critical-security-patches-for-dna-center.html

Snort SIDs: 50622, 50637, 50650 - 50653


============================================================


INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY


Microsoft researchers uncovered a new fileless malware campaign called "Astaroth" that runs system tools through a complex attack chain to evade detection.

https://www.microsoft.com/security/blog/2019/07/08/dismantling-a-fileless-campaign-microsoft-defender-atp-next-gen-protection-exposes-astaroth-attack/


A recent study found 28 percent of all companies in the U.K. were hit with ransomware in 2018, a slight dip from 2017, but still larger than the total in 2016.

https://www.infosecurity-magazine.com/news/ransomware-hits-over-a-quarter-of/


The European Union fined British Airways the equivalent of US $205 million for a security breach last year when 500,000 customers had their personal information stolen.

https://www.bbc.com/news/business-48905907


An outage on Facebook and Instagram revealed how the social media platforms' AI assigns tags to users' photos.

https://www.theverge.com/2019/7/3/20681231/facebook-outage-image-tags-captions-ai-machine-learning-revealed


The Maryland Department of Labor warned 78,000 customers that their personal information may have been accessed in a data breach earlier this year.

https://www.baltimoresun.com/business/bs-bz-department-of-labor-hacked-20190705-story.html


Apple patched a bug in iMessage that could allow an attacker to completely brick a device if they sent a specific string of characters in a message.

https://www.mic.com/p/imessage-bug-that-bricks-iphones-was-discovered-by-google-researchers-but-apple-has-a-fix-18174449


Immigration and Customs Enforcement officials and the FBI are mining driver's license databases using facial recognition technology without motorists' knowledge.

https://www.nytimes.com/2019/07/07/us/politics/ice-drivers-licenses-facial-recognition.html


=========================================================


RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE

COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM


This is a list of recent vulnerabilities for which exploits are

available. System administrators can use this list to help in

prioritization of their remediation activities. The Qualys Vulnerability

Research Team compiles this information based on various exploit

frameworks, exploit databases, exploit kits and monitoring of internet

activity.


ID:        CVE-2019-7226

Title:    ABB PB610 Multiple Security Vulnerabilities

Vendor:    ABB

Description: ABB PB610 Panel Builder 600 is exposed to an authentication bypass vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the affected application. The ABB IDAL HTTP server CGI interface contains a URL that allows an unauthenticated attacker to bypass authentication and gain access to privileged functions. Specifically, /cgi/loginDefaultUser creates a session in an authenticated state and returns the session ID along with what may be the username and cleartext password of the user. An attacker can then supply an IDALToken value in a cookie, which will allow them to perform privileged operations such as restarting the service with /cgi/restart. A GET request to /cgi/loginDefaultUser may result in "1 #S_OK IDALToken=532c8632b86694f0232a68a0897a145c admin admin" or a similar response.

CVSS v2 Base Score:    5.8 (AV:A/AC:L/Au:N/C:P/I:P/A:P)


ID:        CVE-2019-12817

Title:    Linux kernel Local Privilege Escalation Vulnerability

Vendor:    Linux

Description: Linux Kernel is exposed to a local privilege escalation vulnerability. A local attacker can exploit this issue to gain elevated privileges. arch/powerpc/mm/mmu_context_book3s64.c in the Linux kernel for powerpc has a bug where unrelated processes may be able to read/write to one another's virtual memory under certain conditions via an mmap above 512 TB.

CVSS v2 Base Score: 6.9 (AV:L/AC:M/Au:N/C:C/I:C/A:C)


ID:        CVE-2019-12974

Title:    ImageMagick Multiple Security Vulnerabilities

Vendor:    ImageMagick

Description: A NULL pointer dereference in the function ReadPANGOImage in coders/pango.c and the function ReadVIDImage in coders/vid.c in ImageMagick allows remote attackers to cause a denial of service via a crafted image. Successfully exploiting these issues may allow an attacker to gain access to sensitive information, bypass certain security restrictions and to perform unauthorized actions or cause a denial of service condition. This may aid in launching further attacks.

CVSS v2 Base Score:    4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)


ID:        CVE-2019-12972

Title:    GNU Binutils  Heap Based Buffer Overflow Vulnerability

Vendor:    GNU

Description: GNU Binutils is exposed to a heap based buffer overflow vulnerability. An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), where a heap based buffer over read in _bfd_doprnt in bfd.c because elf_object_p in elfcode.h mishandles an e_shstrndx section of type SHT_GROUP by omitting a trailing '' character. Attackers can exploit this issue to cause a denial of service condition, denying service to legitimate users.

CVSS v2 Base Score:    4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)


ID:        CVE-2019-3961

Title:    Nessus Cross Site Scripting Vulnerability

Vendor:    Nessus

Description: Nessus is exposed to a cross site scripting vulnerability because it fails to properly sanitize user supplied input. An unauthenticated, remote attacker could potentially exploit this vulnerability via a specially crafted request to execute arbitrary script code in a users browser session. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie based authentication credentials and launch other attacks.

CVSS v2 Base Score:    4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)


ID:        CVE-2019-12939

Title:    LiveZilla Server SQL Injection Vulnerability

Vendor:    LiveZilla

Description: LiveZilla Server is exposed to an SQL injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. An attacker may leverage this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

CVSS v2 Base Score:    7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)


ID:        CVE-2019-11707

Title:    Mozilla Firefox and Firefox ESR Denial of Service Vulnerability

Vendor:    Mozilla

Description: Mozilla Firefox and Firefox ESR are exposed to a denial of service vulnerability. Attackers can exploit these issues to crash the application, denying service to legitimate users. A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash.

CVSS v2 Base Score:    7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)


=========================================================


MOST PREVALENT MALWARE FILES July 4 - 11:

COMPILED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP


SHA 256: 3f6e3d8741da950451668c8333a4958330e96245be1d592fcaa485f4ee4eadb3

MD5: 47b97de62ae8b2b927542aa5d7f3c858

VirusTotal: https://www.virustotal.com/#/file/3f6e3d8741da950451668c8333a4958330e96245be1d592fcaa485f4ee4eadb3/details

Typical Filename: qmreportupload.exe

Claimed Product: qmreportupload

Detection Name: Win.Trojan.Generic::in10.talos


SHA 256: 64f3633e009650708c070751bd7c7c28cd127b7a65d4ab4907dbe8ddaa01ec8b

MD5: 42143a53581e0304b08f61c2ef8032d7

VirusTotal: https://www.virustotal.com/gui/file/64f3633e009650708c070751bd7c7c28cd127b7a65d4ab4907dbe8ddaa01ec8b/details

Typical Filename: N/A

Claimed Product: JPMorganChase Instructions SMG 82749206.pdf

Detection Name: Pdf.Phishing.Phishing::malicious.tht.talos


SHA 256: 46b241e3d33811f7364294ea99170b35462b4b5b85f71ac69d75daa487f7cf08

MD5: db69eaaea4d49703f161c81e6fdd036f

VirusTotal: https://www.virustotal.com/gui/file/46b241e3d33811f7364294ea99170b35462b4b5b85f71ac69d75daa487f7cf08/details

Typical Filename: xme32-2141-gcc.exe

Claimed Product: N/A

Detection Name: W32.46B241E3D3-95.SBX.TG


SHA 256: c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f

MD5: e2ea315d9a83e7577053f52c974f6a5a

VirusTotal: https://www.virustotal.com/gui/file/c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f/details

Typical Filename: c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f.bin

Claimed Product: N/A

Detection Name: W32.AgentWDCR:Gen.21gn.1201


SHA 256: 15716598f456637a3be3d6c5ac91266142266a9910f6f3f85cfd193ec1d6ed8b

MD5: 799b30f47060ca05d80ece53866e01cc

VirusTotal: https://www.virustotal.com/#/file/15716598f456637a3be3d6c5ac91266142266a9910f6f3f85cfd193ec1d6ed8b/details

Typical Filename: 15716598f456637a3be3d6c5ac91266142266a9910f6f3f85cfd193ec1d6ed8b.bin

Claimed Product: N/A

Detection Name: W32.Generic:Gen.22fz.1201


=============================================================


(c) 2019.  All rights reserved.  The information contained in this

newsletter, including any external links, is provided "AS IS," with no

express or implied warranty, for informational purposes only.


Please feel free to share this with interested parties via email, but

no posting is allowed on web sites. For a free subscription, (and for

free posters) or to update a current subscription, visit

https://www.sans.org/account


SANS Institute, 8120 Woodmont Ave., Suite 310, Bethesda, MD 20814-2743