The Consensus Security Vulnerability Alert

ISC provides a free analysis and warning service to thousands of Internet users and organizations, and is actively working with Internet Service Providers to fight back against the most malicious attackers. https://isc.sans.edu/about.html

Potential Weaponizing of Honeypot Logs [Guest Diary]

Published: 2023-08-31

Last Updated: 2023-09-01 00:16:46 UTC

by Guy Bruneau (Version: 1)

[This is a Guest Diary by James Turner, an ISC intern as part of the SANS.edu BACS program]

Introduction

In today's rapidly evolving cybersecurity landscape, vigilance is the key. But what if the very tools designed to detect and analyze threats could be turned against us? In this exploration, we dive into the world of honeypots, their valuable logs, and the potential vulnerabilities that lie within. Understanding the use and application of honeypots and their associated dangers isn't just a theoretical exercise; it's a necessity. Cybersecurity professionals, threat analysts, and IT administrators stand at the forefront of this battlefield and should know the dangers that lurk in the logs.

Why do we run honeypots?

A honeypot is a system which is deliberately vulnerable. These honeypots are run by analysts all over the world and help to provide useful information.

The Internet Storm Center (ISC) at SANS utilizes honeypots for several reasons:

Threat intelligence for insights into techniques, tactics, and procedures.

Early warning of emerging attacks which would affect the broader information systems community.

Study and research of malware to develop better defense mechanisms.

Training and education which provides students with real-world attack scenarios.

Better training of students to prepare as cybersecurity professionals.

Read the full entry:

https://isc.sans.edu/diary/Potential+Weaponizing+of+Honeypot+Logs+Guest+Diary/30178/

Security Relevant DNS Records

Published: 2023-09-06

Last Updated: 2023-09-06 20:24:03 UTC

by Johannes Ullrich (Version: 1)

DNS has a big security impact. DNS is partly responsible for your traffic reaching the correct host on the internet. But there is more to DNS than name resolution. I am going to mention a few security-relevant record types here, in no particular order:

I did add some records mentioned by@hquest on Twitter.

DNSSEC (DNSKEY, RRSIG, DS, NSEC3, and others...)

That is probably the most obvious security-related feature. DNSSEC is used to digitally sign DNS records. It protects the integrity of DNS responses. Note that DNSSEC does nothing to protect the confidentiality of the data. DNS requests are not affected by DNSSEC either. There are a few different records related to DNSSEC:

DNSKEY: DNS records used to retrieve the public key used to verify the DNS signatures.

RRSIG: Signature for a particular DNS records

DS: Hash of a key used to verify the key integrity.

Read the full entry:

https://isc.sans.edu/diary/Security+Relevant+DNS+Records/30194/

Analysis of a Defective Phishing PDF

Published: 2023-09-03

Last Updated: 2023-09-03 13:24:59 UTC

by Didier Stevens (Version: 1)

A reader submitted a suspicious PDF file. TLDR: it's a defective phishing PDF.

Taking a look with pdfid.py, I see nothing special, but it contains stream objects...

With the recent PDF/ActiveMime polyglots in mind, I also use option -e to get some extra information...

Read the full entry:

https://isc.sans.edu/diary/Analysis+of+a+Defective+Phishing+PDF/30184/

Common usernames submitted to honeypots (2023.090.05)

https://isc.sans.edu/diary/Common+usernames+submitted+to+honeypots/30188/

Creating a YARA Rule to Detect Obfuscated Strings (2023.09.04)

https://isc.sans.edu/diary/Creating+a+YARA+Rule+to+Detect+Obfuscated+Strings/30186/

What is the origin of passwords submitted to honeypots? (2023.09.02)

https://isc.sans.edu/diary/What+is+the+origin+of+passwords+submitted+to+honeypots/30182/

The low, low cost of (committing) cybercrime (2023.08.31)

https://isc.sans.edu/diary/The+low+low+cost+of+committing+cybercrime/30176/

Product: Waqaskanju Chitor-CMSCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-31714NVD References: - https://github.com/msd0pe-1/chitor-sqli- https://github.com/waqaskanju/Chitor-CMS/commit/69d34420ad382c91b0c285432418c1b0810128c1- https://github.com/waqaskanju/Chitor-CMS/releases/tag/Chitor-cms- https://www.exploit-db.com/exploits/51383CVE-2023-31424 - Brocade SANnav Web interface before Brocade SANnav v2.3.0 and v2.2.2a allows remote unauthenticated users to bypass web authentication and authorization.Product: Broadcom Brocade SANnavCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-31424NVD References: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/22507CVE-2023-3162 - The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to authentication bypass, allowing unauthenticated attackers to log in as users with orders.Product: Webtoffee Stripe Payment Plugin For WooCommerceCVSS Score: 9.8 AtRiskScore 30NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-3162NVD References: - https://plugins.trac.wordpress.org/browser/payment-gateway-stripe-and-woocommerce-integration/tags/3.7.7/includes/class-stripe-checkout.php#L640- https://plugins.trac.wordpress.org/changeset/2925361/payment-gateway-stripe-and-woocommerce-integration- https://www.wordfence.com/threat-intel/vulnerabilities/id/4d052f3e-8554-43f0-a5ae-1de09c198d7b?source=cveCVE-2023-28801 - Zscaler Admin UI improper verification of cryptographic signature in SAML authentication allows privilege escalation.Product: Zscaler Admin UICVSS Score: 9.6NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-28801NVD References: https://help.zscaler.com/zia/release-upgrade-summary-2023CVE-2023-41636 - GruppoSCAI RealGimm v1.1.37p38 is vulnerable to SQL injection, enabling attackers to execute arbitrary commands and access the database via a crafted SQL query.Product: GruppoSCAI RealGimmCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-41636NVD References: https://github.com/CapgeminiCisRedTeam/Disclosure/blob/main/CVE%20PoC/CVE-ID%20%7C%20RealGimm%20-%20SQL%20Injection(1).mdCVE-2023-41637 - GruppoSCAI RealGimm 1.1.37p38 allows attackers to execute arbitrary code by uploading a crafted HTML file through its Carica immagine function.Product: GruppoSCAI RealGimmCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-41637NVD References: https://github.com/CapgeminiCisRedTeam/Disclosure/blob/main/CVE%20PoC/CVE-ID%20%7C%20RealGimm%20-%20Stored%20Cross-site%20Scripting.mdCVE-2023-31175 -  The SEL-5037 SEL Grid Configurator before 4.5.0.20 allows an attacker to execute system commands with the highest level privilege.Product: SELinc SEL-5037 SEL Grid ConfiguratorCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-31175NVD References: - https://selinc.com/support/security-notifications/external-reports/- https://www.nozominetworks.com/blog/CVE-2023-4299 - Digi RealPort Protocol allows authentication bypass through a replay attack, granting unauthorized access to connected equipment.Product: Digi RealPort ProtocolCVSS Score: 9.0NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-4299NVD References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-04- https://www.digi.com/getattachment/resources/security/alerts/realport-cves/Dragos-Disclosure-Statement.pdfCVE-2023-4696 - Improper Access Control in GitHub repository usememos/memos prior to 0.13.2.Product: Usememos MemosCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-4696NVD References: - https://github.com/usememos/memos/commit/c9aa2eeb9852047e4f41915eb30726bd25f07ecd- https://huntr.dev/bounties/4747a485-77c3-4bb5-aab0-21253ef303caCVE-2023-36326 - RELIC before commit 34580d840469361ba9b5f001361cad659687b9ab allows attackers to execute arbitrary code, cause a denial of service, and escalate privileges due to an Integer Overflow vulnerability in the bn_grow function's realloc call.Product: Relic Project CVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-36326NVD References: - https://github.com/relic-toolkit/relic/commit/34580d840469361ba9b5f001361cad659687b9ab- https://groups.google.com/g/relic-discuss/c/A_J2-ArVIAo/m/qgFiXsUJBQAJ?utm_medium=email&utm_source=footerCVE-2023-36327 - RELIC before commit 421f2e91cf2ba42473d4d54daf24e295679e290e allows arbitrary code execution and denial of service via an Integer Overflow vulnerability in the pos argument of the bn_get_prime function.Product: Relic Project CVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-36327NVD References: - https://github.com/relic-toolkit/relic/commit/421f2e91cf2ba42473d4d54daf24e295679e290e- https://groups.google.com/g/relic-discuss/c/A_J2-ArVIAo/m/qgFiXsUJBQAJ?utm_medium=email&utm_source=footerCVE-2023-36328 - Libtom libtommath before commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9 allows arbitrary code execution and DoS attacks due to an Integer Overflow vulnerability in mp_grow.Product: Libtommath…

Product: TIOCLINUX snapCVSS Score: 10.0NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-1523NVD References: - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1523- https://github.com/snapcore/snapd/pull/12849- https://marc.info/?l=oss-security&m=167879021709955&w=2- https://ubuntu.com/security/notices/USN-6125-1CVE-2023-39979 - MXsecurity versions prior to 1.0.1 allow remote attackers to bypass authentication by exploiting insufficient random values in the web service authenticator.Product: MXsecurityCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-39979NVD References: https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230403-mxsecurity-series-multiple-vulnerabilitiesCVE-2023-3703 - Proscend Advice ICR Series routers FW version 1.76 - CWE-1392: Use of Default CredentialsProduct: Proscend Advice ICR Series routersCVSS Score: 10.0NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-3703NVD References: https://www.gov.il/en/Departments/faq/cve_advisoriesCVE-2023-4613 - LG LED Assistant allows remote attackers to execute arbitrary code by exploiting a lack of authentication in the /api/settings/upload endpoint, enabling code execution in the context of the current user.Product: LG LED AssistantCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-4613NVD References: - https://lgsecurity.lge.com/bulletins/idproducts#updateDetails- https://www.zerodayinitiative.com/advisories/ZDI-23-1221/CVE-2023-4614 - LG LED Assistant allows remote attackers to execute arbitrary code without authentication by exploiting a lack of validation in the /api/installation/setThumbnailRc endpoint, enabling code execution with current user privileges.Product: LG LED Assistant CVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-4614NVD References: - https://lgsecurity.lge.com/bulletins/idproducts#updateDetails- https://www.zerodayinitiative.com/advisories/ZDI-23-1222/CVE-2023-28562 - Memory corruption while handling payloads from remote ESL.Product: No vendor and product name are given in the vulnerability description provided. CVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-28562NVD References: https://www.qualcomm.com/company/product-security/bulletins/september-2023-bulletinCVE-2023-28581 - Memory corruption in WLAN Firmware while parsing receieved GTK Keys in GTK KDE.Product: WLAN Firmware  GTK KDECVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-28581NVD References: https://www.qualcomm.com/company/product-security/bulletins/september-2023-bulletinCVE-2023-3374 - Incomplete List of Disallowed Inputs vulnerability in Bookreen allows Privilege Escalation.This issue affects Bookreen: before 3.0.0.Product: Bookreen CVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-3374NVD References: https://www.usom.gov.tr/bildirim/tr-23-0489CVE-2023-3375 - Unrestricted Upload of File with Dangerous Type vulnerability in Bookreen allows OS Command Injection.This issue affects Bookreen: before 3.0.0.Product: Bookreen CVSS Score: 9.1NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-3375NVD References: https://www.usom.gov.tr/bildirim/tr-23-0489CVE-2017-9453 - BMC Server Automation before 8.9.01 patch 1 allows Process Spawner command execution because of authentication bypass.Product: BMC Server AutomationCVSS Score: 9.0NVD: https://nvd.nist.gov/vuln/detail/CVE-2017-9453NVD References: https://docs.bmc.com/docs/serverautomation/2002/notification-of-critical-security-issue-in-bmc-server-automation-cve-2017-9453-1020706453.htmlCVE-2023-35065 - Osoft Paint Production Management before 2.1 is vulnerable to SQL Injection.Product: Osoft Paint Production ManagementCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-35065NVD References: https://www.usom.gov.tr/bildirim/tr-23-0490CVE-2023-35068 - BMA Personnel Tracking System before 20230904 is vulnerable to SQL Injection.Product: BMA Personnel Tracking SystemCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-35068NVD References: https://www.usom.gov.tr/bildirim/tr-23-0491CVE-2023-35072 - Coyav Travel Proagent before 20230904 allows SQL Injection.Product: Coyav ProagentCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-35072NVD References: https://www.usom.gov.tr/bildirim/tr-23-0492CVE-2023-3616 - Mava Software Hotel Management System before 2.0 allows SQL Injection.Product: Mava Software Hotel Management SystemCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-3616NVD References: https://www.usom.gov.tr/bildirim/tr-23-0493CVE-2023-4034 - Smartrise Document Management System before Hvl-2.0 allows SQL Injection.Product: Digita Information Technology Smartrise Document Management SystemCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-4034NVD References: https://www.usom.gov.tr/bildirim/tr-23-0494CVE-2023-4531 - Mestav Software E-commerce Software before 20230901 is vulnerable to SQL Injection.Product: Mestav Software E-commerce SoftwareCVSS Score: 9.8NVD: https://nvd.nist.gov/…