SANS Live Training is Available In-Person OR Live Online! Explore Upcoming Events.

Newsletters: @RISK

Subscribe to SANS Newsletters

Join the SANS Community to receive the latest curated cyber security news, vulnerabilities and mitigations, training opportunities, and our webcast schedule.





SANS NewsBites
@Risk: Security Alert
OUCH! Security Awareness
Case Leads DFIR Digest
Industrial Control Systems
Industrials & Infrastructure


@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data

A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.

November 7, 2019

=============================================================

     @RISK: The Consensus Security Vulnerability Alert

              November 07, 2019 - Vol. 19, Num. 45


Providing a reliable, weekly summary of newly discovered attack vectors,

vulnerabilities with active exploits, and explanations of how recent

attacks worked


Archived issues may be found at http://www.sans.org/newsletters/at-risk


=============================================================


CONTENTS:

NOTABLE RECENT SECURITY ISSUES

INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY

VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE

MOST PREVALENT MALWARE FILES Oct. 31 - Nov. 7

============================================================


TOP VULNERABILITY THIS WEEK: Google Chrome contains critical remote execution vulnerability


*************** Sponsored By AWS Marketplace ***************


How to Build a Threat Hunting Program in AWS, webcast featuring Shaun McCullough, SANS instructor, SEC545 Cloud Security Architecture and Operations. Learn where to search for valuable data in logs and elsewhere, how to efficiently analyze that data using native AWS capabilities and how to enrich your findings through SIEM and SOAR solutions. November 21, 2 PM ET. http://www.sans.org/info/214685


============================================================

TRAINING UPDATE

 

-- SANS OnDemand and vLive Training

Get an 11" iPad Pro with Smart Keyboard, an HP ProBook, or Take $350 Off through November 13 with OnDemand or vLive training.

https://www.sans.org/online-security-training/specials/


-- SANS Cyber Defense Initiative(R) 2019 | Washington, DC | December 10-17 | https://www.sans.org/event/cyber-defense-initiative-2019


-- SANS Atlanta Fall 2019 | November 18-23 | https://www.sans.org/event/atlanta-fall-2019


-- Pen Test HackFest Summit 2019 | Washington, DC | November 18-25 | https://www.sans.org/event/pen-test-hackfest-2019


-- SANS Miami 2020 | January 13-18 | https://www.sans.org/event/miami-2020


-- SANS Threat Hunting & IR Summit & Training | London, UK | January 13-19, 2020 | https://www.sans.org/event/threat-hunting-europe-2020


-- SANS Tokyo January 2020 | January 20-25 | https://www.sans.org/event/tokyo-january-2020


-- SANS Amsterdam January 2020 | January 20-25 | https://www.sans.org/event/amsterdam-january-2020


-- Cyber Threat Intelligence Summit & Training | Arlington, VA | January 20-27 | https://www.sans.org/event/cyber-threat-intelligence-summit-2020


-- SANS Secure Singapore 2020 | 16-28 March | https://www.sans.org/event/secure-singapore-2020


-- Can't travel? SANS offers online instruction for maximum flexibility

-- Live Daytime training with Simulcast - https://www.sans.org/simulcast

-- Evening training 2x per week for 6 weeks with vLive | https://www.sans.org/vlive

-- Anywhere, Anytime access for 4 months with OnDemand format | https://www.sans.org/ondemand/


-- Single Course Training

SANS Mentor |  https://www.sans.org/mentor/about

Community SANS | https://www.sans.org/community/

 

-- View the full SANS course catalog and Cyber Security Skills Roadmap

https://www.sans.org/courses

https://www.sans.org/cyber-security-skills-roadmap



********************** Sponsored Links: ********************


1) Webcast November 7th at 3:30 PM ET: What dark secrets lurk in your Salesforce instance? Tune in for this webcast with Dave Shackleford: http://www.sans.org/info/214690


2) ICYMI Webcast: Network Traffic Analysis is emerging as an important new tool in the info security arsenal. Learn more: http://www.sans.org/info/214695


3) Register for the webcast SOARing Beyond Aggregation: How to Achieve Meaningful Correlation and Prioritization of Security Alerts and Actions: http://www.sans.org/info/214700


============================================================


NOTABLE RECENT SECURITY ISSUES

SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP


Title: Use-after-free bug in Chrome could allow complete system takeover

Description: Google Chrome is urging users to update their web browsers as soon as possible due to a critical use-after-free vulnerability. The company says it will be releasing updates this week to protect against exploitation of the bug. The vulnerability, identified as CVE-2019-13720, exists in Chrome's audio component, and could allow an attacker to execute arbitrary code or enable full remote code execution capabilities.

Reference: https://threatpost.com/google-discloses-chrome-flaw-exploited-in-the-wild/149784/

Snort SIDs: 52068, 52069

 

Title: Two remote code execution vulnerabilities in Investintech Able2Extract

Description: Cisco Talos recently discovered two remote code execution vulnerabilities in Investintech's Able2Extract Professional. This software is a cross-platform PDF tool for Windows, Mac and Linux that converts PDFs and allows users to create and edit them. Other features include PDF signing, redactions and annotations. An attacker could exploit these vulnerabilities to execute arbitrary code on the victim machine.

Reference: https://blog.talosintelligence.com/2019/11/vuln-spotlight-RCE-investintech-able2extract-nov-2019.html

Snort SIDs: 50864 - 50869


============================================================


INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY


The first public exploitation of the infamous vulnerability BlueKeep is here, but it's not nearly as bad as it could have been.

https://www.wired.com/story/bluekeep-hacking-cryptocurrency-mining/


Stolen login credentials from the NordVPN service were recently used in a credential-stuffing attack.

https://arstechnica.com/information-technology/2019/11/nordvpn-users-passwords-exposed-in-mass-credential-stuffing-attacks/


The U.S. and Taiwan are staging simulated cyber-war exercises this week, marketed as the first of their kind, to fight back against "North Korea and other actors."

https://www.bbc.com/news/technology-50289974


A ransomware attack hit a string of radio stations across Spain, as well as a number of other unidentified victims.

https://www.reuters.com/article/us-spain-cyber-ransomware/cyber-attack-hits-spanish-companies-including-radio-network-idUSKBN1XE1YJ


The head of Russia's State Security Service announced at a recent conference that Russia and the U.S. recently resumed cooperation on cyber security standards.

https://www.thedailybeast.com/putins-top-spy-russian-fsb-chief-alexander-bortnikov-were-teaming-up-with-dc-on-cybersecurity


The U.S. Department of Homeland Security issued a new warning on the "Hoplight" malware family from a North Korean-sponsored threat actor.

https://duo.com/decipher/dhs-warns-of-new-north-korean-government-malware-hoplight


A bug in the Robinhood app is allowing users to trade stocks in excess of their borrowed funds, calling it the "infinite money cheat code."

https://www.bloomberg.com/news/articles/2019-11-05/robinhood-has-a-glitch-that-gives-traders-infinite-leverage


Noted government document whistleblower recently called out Amazon, Google and Facebook, saying they "abuse" their access to users' data, while the government has yet to pass any laws preventing them from profiting off this information.

https://www.cnet.com/news/edward-snowden-says-facebook-amazon-and-google-engage-in-abuse


=========================================================


RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE

COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM


This is a list of recent vulnerabilities for which exploits are

available. System administrators can use this list to help in

prioritization of their remediation activities. The Qualys Vulnerability

Research Team compiles this information based on various exploit

frameworks, exploit databases, exploit kits and monitoring of internet

activity.


ID:        CVE-2019-13720

Title:    Google Chrome Use-After-Free Vulnerability

Vendor:    Google

Description: Google Chrome is exposed to a Use-After-Free vulnerability in audio. The exploit uses a race condition between two threads due to missing proprer synchronization between them. It gives an attacker a Use-After-Free condition that could lead to code execustion scenarios.

CVSS v2 Base Score:    10 (AV:N/AC:L/Au:N/C:C/I:C/A:C)


ID:        CVE-2019-2114

Title:    NFC Beaming Android Security Control Bypass Vulnerability

Vendor:    Google

Description: NFC beaming of applications between devices using Android OS bypasses some security controls (the "install unknown application" prompt). This could lead to local escalation of privilege by installing an application with no additional execution privileges needed. This means, that an Android phone that has NFC and Android Beam enabled, then touching a malicious phone or a malicious NFC payment terminal to the device may allow malware to be installed by bypassing the "install unknown apps" prompt.

CVSS v2 Base Score:    4.4 (AV:L/AC:M/Au:N/C:P/I:P/A:P)


ID:        CVE-2019-11932

Title:    Whatsapp Remote Code Execution Vulnerability

Vendor:    Whatsapp

Description: A double free vulnerability exists in the DDGifSlurp function in decoding.c in libpl_droidsonroids_gif as used in WhatsApp for Android before 2.19.244. Successful exploitation allows remote attackers to execute arbitrary code or cause a denial of service.

CVSS v2 Base Score:    7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)


ID:        CVE-2019-11043

Title:    PHP 7 Remote Code Execution Vulnerability

Vendor:    Multi-Vendor

Description: A vulenrabilty exists in PHP where insufficient validation in the path handling code of FPM module could result in the execution of arbitrary code and to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution. This vulnerability could be exploited to gain partial access to sensitive information. Malicious users could also use this vulnerability to change partial contents or configuration on the system.

CVSS v2 Base Score:    7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)


ID:        CVE-2019-16662

Title:    rConfig Remote Code Execution Vulnerability

Vendor:    Multi-Vendor

Description: An issue was discovered in rConfig where an attacker can directly execute system commands by sending a GET request to ajaxServerSettingsChk.php because the rootUname parameter is passed to the exec function without filtering, which can lead to command execution

CVSS v2 Base Score:    10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)


ID:        CVE-2019-1414

Title:    Visual Studio Code Elevation of Privilege Vulnerability

Vendor:    Microsoft

Description: An elevation of privilege vulnerability exists in Visual Studio Code when it exposes a debug listener to users of a local computer. A local attacker who successfully exploited the vulnerability could inject arbitrary code to run in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system.

CVSS v2 Base Score:    6.3 (AV:L/AC:M/Au:N/C:C/I:C/A:N)


ID:        CVE-2019-2888

Title:    Oracle WebLogic Server EJBTaglibDescriptor XXE Vulnerability

Vendor:    Oracle

Description: A vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle WebLogic Server accessible data.

CVSS v2 Base Score:    5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)


=========================================================


MOST PREVALENT MALWARE FILES Oct. 31 - Nov. 7:

COMPILED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP


SHA 256: 7acf71afa895df5358b0ede2d71128634bfbbc0e2d9deccff5c5eaa25e6f5510

MD5: 4a50780ddb3db16ebab57b0ca42da0fb

VirusTotal: https://www.virustotal.com/gui/file/7acf71afa895df5358b0ede2d71128634bfbbc0e2d9deccff5c5eaa25e6f5510/details

Typical Filename: xme64-2141.exe

Claimed Product: N/A

Detection Name: W32.7ACF71AFA8-95.SBX.TG


SHA 256: 3f6e3d8741da950451668c8333a4958330e96245be1d592fcaa485f4ee4eadb3

MD5: 47b97de62ae8b2b927542aa5d7f3c858

VirusTotal: https://www.virustotal.com/gui/file/3f6e3d8741da950451668c8333a4958330e96245be1d592fcaa485f4ee4eadb3/details

Typical Filename: qmreportupload

Claimed Product: qmreportupload

Detection Name: Win.Trojan.Generic::in10.talos


SHA 256: 6b01db091507022acfd121cc5d1f6ff0db8103f46a1940a6779dc36cca090854

MD5: 74f4e22e5be90d152521125eaf4da635

VirusTotal: https://www.virustotal.com/gui/file/6b01db091507022acfd121cc5d1f6ff0db8103f46a1940a6779dc36cca090854/details

Typical Filename: jsonMerge.exe

Claimed Product: ITSPlatform

Detection Name: W32.GenericKD:Attribute.22lk.1201


SHA 256: 46b241e3d33811f7364294ea99170b35462b4b5b85f71ac69d75daa487f7cf08

MD5: db69eaaea4d49703f161c81e6fdd036f

VirusTotal: https://www.virustotal.com/gui/file/46b241e3d33811f7364294ea99170b35462b4b5b85f71ac69d75daa487f7cf08/details

Typical Filename: xme32-2141-gcc.exe

Claimed Product: N/A

Detection Name: W32.46B241E3D3-95.SBX.TG


SHA 256: 85b936960fbe5100c170b777e1647ce9f0f01e3ab9742dfc23f37cb0825b30b5

MD5: 8c80dd97c37525927c1e549cb59bcbf3

VirusTotal: https://www.virustotal.com/gui/file/85b936960fbe5100c170b777e1647ce9f0f01e3ab9742dfc23f37cb0825b30b5/details

Typical Filename: Eternalblue-2.2.0.exe

Claimed Product: N/A

Detection Name: W32.WNCryLdrA:Trojan.22k2.1201


=============================================================


(c) 2019.  All rights reserved.  The information contained in this

newsletter, including any external links, is provided "AS IS," with no

express or implied warranty, for informational purposes only.


Please feel free to share this with interested parties via email, but

no posting is allowed on web sites. For a free subscription, (and for

free posters) or to update a current subscription, visit

https://www.sans.org/account


SANS Institute, 8120 Woodmont Ave., Suite 310, Bethesda, MD 20814-2743