Learn InfoSec skills you can implement immediately! Six courses available in Houston - Oct. 28-Nov. 2.

Newsletters: @RISK

Subscribe to SANS Newsletters

Join the SANS Community to receive the latest curated cyber security news, vulnerabilities and mitigations, training opportunities, and our webcast schedule.





SANS NewsBites
@Risk: Security Alert
OUCH! Security Awareness
Case Leads DFIR Digest
Industrial Control Systems
Industrials & Infrastructure


@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data

A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.

August 8, 2019

=============================================================

     @RISK: The Consensus Security Vulnerability Alert

            August 08, 2019 - Vol. 19, Num. 32


Providing a reliable, weekly summary of newly discovered attack vectors,

vulnerabilities with active exploits, and explanations of how recent

attacks worked


Archived issues may be found at http://www.sans.org/newsletters/at-risk


=============================================================


CONTENTS:

NOTABLE RECENT SECURITY ISSUES

INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY

VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE

MOST PREVALENT MALWARE FILES Aug. 1 - 8

============================================================


TOP VULNERABILITY THIS WEEK: Remote code execution bug in popular VPN service


*************** Sponsored By AWS Marketplace ***************


Make informed decisions about acquiring and integrating SIEM and SOAR in AWS. SANS, Optiv and AWS experts explain criteria for selecting and connecting SIEM and SOAR platforms in AWS. Learn key considerations for logging network and endpoint activities for more automated and integrated protection, forensics and reporting. August 14, 2 PM ET. http://www.sans.org/info/213860


============================================================

TRAINING UPDATE

 

-- SANS Network Security 2019 | Las Vegas, NV | September 9-16 | https://www.sans.org/event/network-security-2019


-- SANS Chicago 2019 | August 19-24 | https://www.sans.org/event/chicago-2019


-- SANS Virginia Beach 2019 | August 19-30 | https://www.sans.org/event/virginia-beach-2019


-- SANS London September 2019 | September 23-28 | https://www.sans.org/event/london-september-2019


-- SANS DFIR Europe Summit and Training 2019 | Prague, CZ | September 30-October 6 | https://www.sans.org/event/dfir-prague-2019


-- Threat Hunting & Incident Response Summit 2019 | New Orleans, LA | September 30-October 7 | https://www.sans.org/event/threat-hunting-and-incident-response-summit-2019


-- SANS Tokyo Autumn 2019 | September 30-October 12 | https://www.sans.org/event/tokyo-autumn-2019


-- SIEM Summit & Training 2019 | Chicago, IL | October 7-14 | https://www.sans.org/event/siem-summit-2019


-- SANS October Singapore 2019 | October 7-26 | https://www.sans.org/event/october-singapore-2019


-- SANS OnDemand and vLive Training

Get a 10.5" iPad Air with Smart Keyboard, a Surface Go, or Take $300 off through August 21 with OnDemand or vLive training.

https://www.sans.org/online-security-training/specials/


-- Can't travel? SANS offers online instruction for maximum flexibility

-- Live Daytime training with Simulcast - https://www.sans.org/simulcast

-- Evening training 2x per week for 6 weeks with vLive | https://www.sans.org/vlive

-- Anywhere, Anytime access for 4 months with OnDemand format | https://www.sans.org/ondemand/


-- Single Course Training

SANS Mentor |  https://www.sans.org/mentor/about

Community SANS | https://www.sans.org/community/

 

-- View the full SANS course catalog and Cyber Security Skills Roadmap

https://www.sans.org/courses

https://www.sans.org/cyber-security-skills-roadmap


********************** Sponsored Links: ********************


1) ICYMI: Security Inside the Perimeter with VMware. View webcast: http://www.sans.org/info/213870


2) What challenges do you face with implementing endpoint security in your organization? Take this SANS survey: http://www.sans.org/info/213875


3) August 13, 1 PM ET: Visibility for Incident Response: A Review of Forescout 8.1. Register for this webcast: http://www.sans.org/info/213865


============================================================


NOTABLE RECENT SECURITY ISSUES

SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP


Title: Palo Alto Network's GlobalProtect Secure Socket Layer (SSL) virtual private network contains remote code execution bug

Description: CVE-2019-1579 is a remote code execution vulnerability in Palo Alto Network's GlobalProtect Secure Socket Layer (SSL) virtual private network (VPN). At the time of discovery, some systems belonging to ride-sharing service Uber were still at risk, though they have since patched the issue. An attacker could exploit this bug to carry out a buffer overflow, and then gain the ability to remotely execute code on the victim machine.

Reference: https://www.scmagazine.com/home/security-news/vulnerabilities/remote-code-execution-vulnerability-disclosed-in-palo-alto-networks-globalprotect-ssl-vpn/

Snort SIDs: 50859, 50860 (Written by Joanne Kim)

 

Title: VMware vulnerability leads to other flaws in NVIDIA Windows GPU display driver

Description: VMware ESXi, Workstation and Fusion are affected by an out-of-bounds read vulnerability that can be triggered using a specially crafted shader file. This vulnerability can be triggered from a VMware guest, affecting the VMware host, leading to a crash (denial-of-service) of the vmware-vmx.exe process on the host. However, when the host/guest systems are using an NVIDIA graphics card, the VMware denial-of-service can be turned into a code execution vulnerability (leading to a VM escape), because of an additional security issue present in NVIDIA's Windows GPU Display Driver.

Reference: https://blog.talosintelligence.com/2019/08/nvidia-vmware-gpu-rce-vulnerabilities.html

Snort SIDs: 48852, 48853, 49894, 49895 - 49897, 49205, 49206


============================================================


INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY


State-sponsored actors may be behind three spear-phishing attacks on U.S. utility companies last month, according to a new report.

https://www.cyberscoop.com/apt-10-utilities-phishing-proofpoint/


Clothing resale app Poshmark said an "unauthorized third party" stole some users' information, including usernames, first and last names, gender, email address and hashed password.

https://www.vice.com/en_us/article/8xw4n4/poshmark-hacked


Apple suspended the practice of humans reviewing Siri recordings as the company reviews the process and releases an update that will allow users to opt into the program that it uses to ensure Siri is working correctly.

https://techcrunch.com/2019/08/01/apple-suspends-siri-response-grading-in-response-to-privacy-concerns/


There are 14 states in the U.S. that use all-paperless voting systems, but they have been slow to replace or patch those machines ahead of the 2020 election.

https://www.politico.com/interactives/2019/election-security-americas-voting-machines/


Scammers tricked employees for the city of Naples, Florida into sending them $700,000 via a spear-phishing email.

https://www.naplesnews.com/story/news/local/2019/08/02/scammers-trick-naples-out-700-000-spear-phishing-cyber-attack/1902321001/


Some of the most popular websites in the world have recently unknowingly hosted malicious ads, the latest development in the exploding popularity of adware.

https://blog.talosintelligence.com/2019/07/malvertising-deepdive.html


Facebook said it deactivated two major accounts linked to spreading fake news in the Middle East, both of which may be connected to the Saudi Arabian government.

https://www.bbc.com/news/world-middle-east-49197576


=========================================================


RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE

COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM


This is a list of recent vulnerabilities for which exploits are

available. System administrators can use this list to help in

prioritization of their remediation activities. The Qualys Vulnerability

Research Team compiles this information based on various exploit

frameworks, exploit databases, exploit kits and monitoring of internet

activity.


ID:        CVE-2019-1125

Title:    Microsoft Windows Kernel Information Disclosure Vulnerability

Vendor: Microsoft

Description: An information disclosure vulnerability exists when certain central processing units speculatively access memory. An attacker who successfully exploited the vulnerability could read privileged data across trust boundaries. To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted application. The vulnerability would not allow an attacker to elevate user rights directly, but it could be used to obtain information that could be used to try to compromise the affected system further.

CVSS v2 Base Score:    4.0 (AV:L/AC:H/Au:N/C:C/I:N/A:N)


ID:        CVE-2019-11247

Title:    Kubernetes Incomplete Fix Arbitrary File Overwrite Vulnerability

Vendor:    Kubernetes

Description: A vulnerability exists in the K8s API that could allow users to read, modify or delete cluster-wide custom resources, even if they only have RBAC permissions for namespaced resources. This vulnerability allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced. Athorizations for the resource accessed in this manner are enforced using roles and role bindings within the namespace, meaning that a user with access only to a resource in one namespace could create, view update or delete the cluster-scoped resource (according to their namespace role privileges).

CVSS v2 Base Score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P)


ID:        CVE-2019-13377

Title:    WPA3 Timing Based Side Channel Vulnerability

Vendor:    WPA3

Description: New Side-Channel Attack against WPA3 exists when using brainpool curves. The first vulnerability is a timing-based side-channel attack against WPA3's Dragonfly handshake when using Brainpool curves, which the WiFi Alliance recommended vendors to use as one of the security recommendations to add another layer of security. The new side-channel leak is located in the password encoding algorithm of Dragonfly.

CVSS v2 Base Score: 5.4 (AV:N/AC:H/Au:N/C:C/I:N/A:N)


ID:        CVE-2019-14234

Title:    Django JSONField SQL injection Vulnerability

Vendor:    Django

Description: Key and index lookups for django.contrib.postgres.fields.JSONField and key lookups for django.contrib.postgres.fields.HStoreField were subject to SQL injection, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet.filter().

CVSS v2 Base Score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)


ID:        CVE-2019-13143

Title:    FB50 Smart Lock Information Disclosure Vulnerability

Vendor:    Shenzhen Dragon Brother Technology

Description: An HTTP parameter pollution issue was discovered on Shenzhen Dragon Brothers Fingerprint Bluetooth Round Padlock FB50 2.3. With the user ID, user name, and the lock's MAC address, anyone can unbind the existing owner of the lock, and bind themselves instead. This leads to complete takeover of the lock. The user ID, name, and MAC address are trivially obtained from APIs found within the Android or iOS application. With only the MAC address of the lock, any attacker can transfer ownership of the lock from the current user, over to the attacker's account. Thus rendering the lock completely inaccessible to the current user.

CVSS v2 Base Score: 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N)


ID:        CVE-2019-14697

Title:    musl libc x87 Stack Overflow Vulnerability

Vendor:    musl libc

Description: musl libc has an x87 floating-point stack adjustment imbalance, related to the math/i386/ directory. In some cases, use of this library could introduce out-of-bounds writes that are not present in an application's source code.    This can lead to x87 stack overflow in the execution of subsequent math code, causing it to incorrectly produce a NAN in place of the actual result.

CVSS v2 Base Score: 3.6 (AV:L/AC:L/Au:N/C:N/I:P/A:P)


ID:        CVE-2019-14286

Title:    Misp Cross Site Scripting Vulnerability

Vendor:    Misp

Description: In app/webroot/js/event-graph.js in MISP, a stored XSS vulnerability exists in the event-graph view when a user toggles the event graph view. A malicious MISP event must be crafted in order to trigger the vulnerability.

CVSS v2 Base Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)


ID:        CVE-2019-14654

Title:    Joomla Remote code Execution Vulnerability

Vendor:    Joomla

Description: In Joomla!, inadequate filtering allows users authorised to create custom fields to manipulate the filtering options and inject an unvalidated option.In other words, the filter attribute in subform fields allows remote code execution.

CVSS v2 Base Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)


=========================================================


MOST PREVALENT MALWARE FILES Aug. 1 - 8:

COMPILED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP


SHA 256: 3f6e3d8741da950451668c8333a4958330e96245be1d592fcaa485f4ee4eadb3

MD5: 47b97de62ae8b2b927542aa5d7f3c858

VirusTotal: https://www.virustotal.com/gui/file/3f6e3d8741da950451668c8333a4958330e96245be1d592fcaa485f4ee4eadb3/details

Typical Filename: qmreportupload.exe

Claimed Product: qmreportupload

Detection Name: Win.Trojan.Generic::in10.talos


SHA 256: b22eaa5c51f0128d5e63a67ddf44285010c05717e421142a3e59bba82ba1325a

MD5: 125ef5dc3115bda09d2cef1c50869205

VirusTotal: https://www.virustotal.com/gui/file/b22eaa5c51f0128d5e63a67ddf44285010c05717e421142a3e59bba82ba1325a/details

Typical Filename: helpermcp

Claimed Product: N/A

Detection Name: PUA.Osx.Trojan.Amcleaner::sbmt.talos


SHA 256: c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f

MD5: e2ea315d9a83e7577053f52c974f6a5a

VirusTotal: https://www.virustotal.com/gui/file/c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f/details

Typical Filename: Tempmf582901854.exe

Claimed Product: N/A

Detection Name: W32.AgentWDCR:Gen.21gn.1201


SHA 256: 15716598f456637a3be3d6c5ac91266142266a9910f6f3f85cfd193ec1d6ed8b

MD5: 799b30f47060ca05d80ece53866e01cc

VirusTotal: https://www.virustotal.com/gui/file/15716598f456637a3be3d6c5ac91266142266a9910f6f3f85cfd193ec1d6ed8b/details

Typical Filename: mf2016341595.exe

Claimed Product: N/A

Detection Name: W32.Generic:Gen.22fz.1201


SHA 256: 7acf71afa895df5358b0ede2d71128634bfbbc0e2d9deccff5c5eaa25e6f5510

MD5: 4a50780ddb3db16ebab57b0ca42da0fb

VirusTotal: https://www.virustotal.com/gui/file/7acf71afa895df5358b0ede2d71128634bfbbc0e2d9deccff5c5eaa25e6f5510/details

Typical Filename: xme64-2141.exe

Claimed Product: N/A

Detection Name: W32.7ACF71AFA8-95.SBX.TG


=============================================================


(c) 2019.  All rights reserved.  The information contained in this

newsletter, including any external links, is provided "AS IS," with no

express or implied warranty, for informational purposes only.


Please feel free to share this with interested parties via email, but

no posting is allowed on web sites. For a free subscription, (and for

free posters) or to update a current subscription, visit

https://www.sans.org/account


SANS Institute, 8120 Woodmont Ave., Suite 310, Bethesda, MD 20814-2743