One Week Left to Get an 11" iPad Pro, a Surface Go 2, or $300 Off with OnDemand Training

Newsletters: @RISK

Subscribe to SANS Newsletters

Join the SANS Community to receive the latest curated cyber security news, vulnerabilities and mitigations, training opportunities, and our webcast schedule.





SANS NewsBites
@Risk: Security Alert
OUCH! Security Awareness
Case Leads DFIR Digest
Industrial Control Systems
Industrials & Infrastructure


@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data

A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.

December 12, 2019

=============================================================

     @RISK: The Consensus Security Vulnerability Alert

              December 12, 2019 - Vol. 19, Num. 50


Providing a reliable, weekly summary of newly discovered attack vectors,

vulnerabilities with active exploits, and explanations of how recent

attacks worked


Archived issues may be found at http://www.sans.org/newsletters/at-risk


=============================================================


CONTENTS:

NOTABLE RECENT SECURITY ISSUES

INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY

VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE

MOST PREVALENT MALWARE FILES Dec. 5 - 12

============================================================


TOP VULNERABILITY THIS WEEK: Microsoft Patch Tuesday for December 2019


*************** Sponsored By AWS Marketplace ****************


SANS-AWS Education Series: Leveraging CASBs in AWS for Anywhere, Anytime Data Protection. In this webcast, AWS solutions architect David Aiken and SANS instructor Kyle Dickinson discuss deployment strategies for cloud access security brokers (CASBs) in AWS that protect data and support a distributed workforce utilizing a variety of endpoints. Dec. 12, 2 PM ET. http://www.sans.org/info/214990


============================================================

TRAINING UPDATE

 

-- SANS Security East 2020 | New Orleans, LA | February 1-8 | https://www.sans.org/event/security-east-2020


-- SANS Miami 2020 | January 13-18 | https://www.sans.org/event/miami-2020


-- SANS Threat Hunting & IR Summit & Training | London, UK | January 13-19, 2020 | https://www.sans.org/event/threat-hunting-europe-2020


-- SANS Tokyo January 2020 | January 20-25 | https://www.sans.org/event/tokyo-january-2020


-- SANS Amsterdam January 2020 | January 20-25 | https://www.sans.org/event/amsterdam-january-2020

    

-- Cyber Threat Intelligence Summit & Training | Arlington, VA | January 20-27 | https://www.sans.org/event/cyber-threat-intelligence-summit-2020


-- SANS Scottsdale 2020 | February 17-22 | https://www.sans.org/event/scottsdale-2020


-- Open-Source Intelligence Summit & Training 2020 | Alexandria, VA | February 18-24 | https://www.sans.org/event/osint-summit-2020


-- SANS Secure Singapore 2020 | 16-28 March | https://www.sans.org/event/secure-singapore-2020


-- SANS OnDemand and vLive Training

Get a Free GIAC Certification Attempt or Take $350 Off through December 25 with OnDemand or vLive training.

https://www.sans.org/online-security-training/specials/


-- Can't travel? SANS offers online instruction for maximum flexibility

-- Live Daytime training with Simulcast - https://www.sans.org/simulcast

-- Evening training 2x per week for 6 weeks with vLive | https://www.sans.org/vlive

-- Anywhere, Anytime access for 4 months with OnDemand format | https://www.sans.org/ondemand/


-- Single Course Training

SANS Mentor |  https://www.sans.org/mentor/about

Community SANS | https://www.sans.org/community/

 

-- View the full SANS course catalog and Cyber Security Skills Roadmap

https://www.sans.org/courses

https://www.sans.org/cyber-security-skills-roadmap


********************** Sponsored Links: ********************


1) Webcast Today at 1PM ET: SANS David Szili to discuss using Mimecast Web Security to identify & block dangerous sites. http://www.sans.org/info/214995


2) Missed this webcast? 7 Myths of Security Automation: Be Clear on What It Can Achieve. http://www.sans.org/info/215000


3) Take SANS Training at RSA Conference 2020 | San Francisco, CA | Feb 23-24. http://www.sans.org/info/215005


============================================================


NOTABLE RECENT SECURITY ISSUES

SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP


Title: Microsoft discloses two critical bugs as part of monthly security update

Description: Microsoft released its monthly security update today, disclosing vulnerabilities across many of its products and releasing corresponding updates. This month's Patch Tuesday covers 25 vulnerabilities, two of which are considered critical. This month's security update covers security issues in a variety of Microsoft services and software, including Remote Desktop Protocol, Hyper-V and multiple Microsoft Office products.

Reference: https://blog.talosintelligence.com/2019/12/microsoft-patch-tuesday-dec-2019.html

Snort SIDs: 52402, 52403, 52410, 52411, 52419, 52420

 

Title: AMD ATI Radeon ATIDXX64.DLL shader functionality sincos denial-of-service vulnerability

Description: Cisco Talos recently discovered a denial-of-service vulnerability in a specific DLL inside of the AMD ATI Radeon line of video cards. This vulnerability can be triggered by supplying a malformed pixel shader inside a VMware guest operating system. Such an attack can be triggered from VMware guest usermode to cause an out-of-bounds memory read on vmware-vmx.exe process on host, or theoretically through WEBGL.

Reference: https://blog.talosintelligence.com/2019/12/vuln-spotlight-amd-radeon-550-DoS-VM-dec-2019.html

Snort SIDs: 51461, 51462 (By Tim Muniz)


============================================================


INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY


The city of Pensacola, Florida was hit with a ransomware attack over the weekend, taking many services offline, and officials aren't ruling out that the attack is connected to a shooting on a local military base from last week.

https://www.cnn.com/2019/12/09/us/pensacola-cyber-attack/index.html


A new ransomware called "Snatch" forces Windows machines to boot in safe mood, which allows the malware to avoid detection.

https://news.sophos.com/en-us/2019/12/09/snatch-ransomware-reboots-pcs-into-safe-mode-to-bypass-protection/


A new decryptor that the makers of the Ryuk ransomware say will recover victims' files after the ransom is paid will damage larger files, rendering them unusable.

https://blog.emsisoft.com/en/35023/bug-in-latest-ryuk-decryptor-may-cause-data-loss/


Several top cyber security officials from the White House announced their departure last week, a major blow to national election security as the 2020 presidential election just gets rolling.

https://www.wsj.com/articles/top-u-s-cybersecurity-officials-to-depart-as-election-season-enters-full-swing-11575658194


A new report from the National Infrastructure Advisory Council states that a cyber attack on American infrastructure poses an "existential threat" to national security, and suggested President Donald Trumpt take "bold action" to secure ICS systems.

https://thehill.com/policy/cybersecurity/473682-federal-council-to-trump-cyber-threats-pose-existential-threat-to-the


A new malware popping on Macs is staying fileless to avoid detection and may originate from hackers working with the North Korean government.

https://arstechnica.com/information-technology/2019/12/north-koreas-lazarus-hackers-up-their-game-with-fileless-mac-malware/


Reporters were able to bypass security protections on Ring smart doorbells, eventually uncovering more than 65,800 social media posts that were specifically related to video footage from the cameras in a randomly selected area of Washington, D.C.

https://gizmodo.com/ring-s-hidden-data-let-us-map-amazons-sprawling-home-su-1840312279


Adobe disclosed 14 critical vulnerabilities as part of its monthly security update, including bugs in Acrobat, Reader and Photoshop.

https://www.bleepingcomputer.com/news/security/adobe-releases-their-december-2019-security-updates/


=========================================================


RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE

COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM


This is a list of recent vulnerabilities for which exploits are

available. System administrators can use this list to help in

prioritization of their remediation activities. The Qualys Vulnerability

Research Team compiles this information based on various exploit

frameworks, exploit databases, exploit kits and monitoring of internet

activity.


ID:        CVE-2019-15276

Title:    Cisco Wireless LAN Controller Denial of Service Vulnerability

Vendor:    Cisco

Description: A vulnerability in the web interface of Cisco Wireless LAN Controller Software could allow a low-privileged, authenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability exists due to a failure of the HTTP parsing engine to handle specially crafted URLs. An attacker could exploit this vulnerability by authenticating with low privileges to an affected controller and submitting the crafted URL to the web interface of the affected device.

CVSS v2 Base Score: 7.8 (AV:N/AC:L/Au:N/C:N/I:N/A:C)


ID:        CVE-2019-19576

Title:    Verot Remote Code Execution Vulnerability

Vendor:    Verot

Description: Verot versions are exposed to remote code execution vulnerability. class.upload.php in verot.net class.upload, as used in the K2 extension for Joomla! and other products, omits .phar from the set of dangerous file extensions.

CVSS v2 Base Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)


ID:        CVE-2019-16702

Title:    Integard Pro Remote Buffer Overflow Vulnerability

Vendor:    Integard

Description: Integard Pro allows remote attackers to execute arbitrary code via a buffer overflow involving a long NoJs parameter to the /LoginAdmin URI. Integard fails to sanitize input to the "NoJs" parameter in an HTTP POST request# resulting in a stack buffer overflow that overwrites the instruction pointer, leading to remote code execution.  

CVSS v2 Base Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)


ID:        CVE-2019-15627

Title:    Trend Micro Deep Security Agent 11 Arbitrary File Overwrite Vulnerability

Vendor:    Trend Micro

Description: Trend Micro Deep Security Agent are vulnerable to an arbitrary file delete attack, which may lead to availability impact. The attack requires access to local operating system. The vulnerability allows an unprivileged local attacker to delete any file on the filesystem, or overwrite it with abritrary data hosted elsewhere.

CVSS v2 Base Score: 6.6 (AV:L/AC:L/Au:N/C:N/I:C/A:C)


ID:        CVE-2019-11708, CVE-2019-9810

Title:    Mozilla Firfefox Multiple Vulnerabilities

Vendor:    Mozilla

Description: This is a full browser compromise exploit chain targeting Mozilla Firefox on Windows 64-bit. It uses CVE-2019-9810 for getting code execution in both the content process as well as the parent process and CVE-2019-11708 to trick the parent process into browsing to an arbitrary URL. Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process. When combined with additional vulnerabilities this could result in executing arbitrary code on the user's computer. A remote attacker could entice a user to view a specially crafted web page, possibly resulting in the execution of arbitrary code with the privileges of the process or a Denial of Service condition.

Base Score: 10.0 HIGH Vector:  (AV:N/AC:L/Au:N/C:C/I:C/A:C)


=========================================================


MOST PREVALENT MALWARE FILES Dec. 5 - 12:

COMPILED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP


SHA 256: 64f3633e009650708c070751bd7c7c28cd127b7a65d4ab4907dbe8ddaa01ec8b

MD5: 42143a53581e0304b08f61c2ef8032d7

VirusTotal: https://www.virustotal.com/gui/file/64f3633e009650708c070751bd7c7c28cd127b7a65d4ab4907dbe8ddaa01ec8b/details

Typical Filename: myfile.exe

Claimed Product: N/A

Detection Name: Pdf.Phishing.Phishing::malicious.tht.talos


SHA 256: f917be677daab5ee91dd3e9ec3f8fd027a58371524f46dd314a13aefc78b2ddc

MD5: c5608e40f6f47ad84e2985804957c342

VirusTotal: https://www.virustotal.com/gui/file/f917be677daab5ee91dd3e9ec3f8fd027a58371524f46dd314a13aefc78b2ddc/details

Typical Filename: FlashHelperServices.exe

Claimed Product: Flash Helper Service

Detection Name: PUA:2144FlashPlayer-tpd


SHA 256: 3f6e3d8741da950451668c8333a4958330e96245be1d592fcaa485f4ee4eadb3

MD5: 47b97de62ae8b2b927542aa5d7f3c858

VirusTotal: https://www.virustotal.com/gui/file/3f6e3d8741da950451668c8333a4958330e96245be1d592fcaa485f4ee4eadb3/details

Typical Filename: qmreportupload.exe

Claimed Product: qmreportupload

Detection Name: Win.Trojan.Generic::in10.talos


SHA 256: c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f

MD5: e2ea315d9a83e7577053f52c974f6a5a

VirusTotal: https://www.virustotal.com/gui/file/c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f/details

Typical Filename: c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f.bin

Claimed Product: N/A

Detection Name: W32.AgentWDCR:Gen.21gn.1201


SHA 256: 15716598f456637a3be3d6c5ac91266142266a9910f6f3f85cfd193ec1d6ed8b

MD5: 799b30f47060ca05d80ece53866e01cc

VirusTotal: https://www.virustotal.com/gui/file/15716598f456637a3be3d6c5ac91266142266a9910f6f3f85cfd193ec1d6ed8b/details

Typical Filename: mf2016341595.exe

Claimed Product: N/A

Detection Name: W32.Generic:Gen.22fz.1201


=============================================================


(c) 2019.  All rights reserved.  The information contained in this

newsletter, including any external links, is provided "AS IS," with no

express or implied warranty, for informational purposes only.


Please feel free to share this with interested parties via email, but

no posting is allowed on web sites. For a free subscription, (and for

free posters) or to update a current subscription, visit

https://www.sans.org/account


SANS Institute, 8120 Woodmont Ave., Suite 310, Bethesda, MD 20814-2743