@RISK: The Consensus Security Vulnerability Alert
Week 40 2012
This is a weekly newsletter that provides in-depth analysis of
the latest vulnerabilities with straightforward remediation advice. Qualys
supplies a large part of the newly-discovered vulnerability content used in
this newsletter.
@RISK: The Consensus Security Vulnerability Alert
Week 40 2012
CONTENTS
NOTABLE RECENT SECURITY ISSUES
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES 9/25/2012 - 10/04/12
TOP VULNERABILITY THIS WEEK: Adobe code signing infrastructure was
compromised and malware was found in the wild that appeared to be signed
using a valid Adobe certificate. There could potentially be thousands
of malicious files out there that users could be tricked into running
thinking that they are from a trusted source.
NOTABLE RECENT SECURITY ISSUES SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM
Title Adobe code signing certificate stolen
Description Not a typical vulnerability, but a vulnerability
nonetheless. Adobe code signing infrastructure was compromised and
malware was found in the wild that appeared to be signed using a valid
Adobe certificate. There could potentially be thousands of malware
samples that users could be tricked into running thinking that they are
from a trusted source.
Adobe plans to revoke all code signed after July 10, 2012 on October 4,
2012 and will have little to no impact on genuine Adobe software. More
information about the impact of the revocation can be found here.
Reference
http://blogs.adobe.com/asset/2012/09/inappropriate-use-of-adobe-code-signing-certificate.html
http://helpx.adobe.com/x-productkb/global/certificate-updates.html
Snort SID 64700, 64702, 64704
ClamAV WIN.Trojan.Geeksmail, WIN.Trojan.Lanman2
Title DDoS attacks against US banks
Description Over the last two weeks, cyberattacks have disrupted the
websites of U.S. banks, including Wells Fargo, U.S. Bank, PNC Bank, Bank
of America and JPMorgan Chase. While a group called "Cyber fighters of
Izz ad-din Al qassam" has claimed credit, citing outrageover the same
controversial film that has caused riots throughout the Arab world, US
officials including Senator Joe Lieberman have insinuated that Iran is
actually sponsoring the attacks, questioning the ability of a group of
activists to take down major corporations. The Sourcefire VRT has
intelligence indicating that the attacks, wherever their origin, are
using a script dubbed "itsoknoproblembro" (so called because of a status
message it displays), which originally surfaced on PasteBin in January
of this year.
Reference
http://betabeat.com/2012/09/iran-possibly-behind-operation-ababil-cyber-attacks-against-financial-institutions/
http://pastebin.com/yftgau9w
http://pastebin.com/5qHMEX5y
Snort SID Rate-based preprocessor
ClamAV N/A
Title Android dialer USSD code execution
Description A vulnerability can allow an attacker to execute USSD codes
automatically without user permission. Phone running Android 2.3.x ,3.x,
4.0.x and 4.1.x are vulnerable to the USSD attack.
A user could use their phone visit a webpage that contains malicious
code to permanently kill the SIM card or remotely wipe the device. Note
that the remote wipe seems to only affect Samsung devices. Both Google
and Samsung already have patches and are working with vendors and
network operators to push them out to users.
Reference
http://www.isk.kth.se/~rbbo/ussdvul.html
Snort SID 24250
ClamAV -
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
The tale of one thousand and one DSL modems
http://threatpost.com/en_us/blogs/tale-one-thousand-and-one-dsl-modems-100212
How to write a Metasploit post-exploitation module
http://averagesecurityguy.info/post-exploitation/
Proof of concept Android malware creates 3D maps of your home
http://nakedsecurity.sophos.com/2012/10/02/proof-of-concept-android-malware-creates-3d-maps-of-your-home/
My PC has 32,539 errors: how telephone support scams really work:
http://www.eset.com/fileadmin/Images/US/Docs/conference_papers/Harley-etal-VB2012.pdf
Dissecting "Operation Ababil"
http://ddanchev.blogspot.com/2012/09/dissecting-operation-ababil-osint.html
RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM
This is a list of recent vulnerabilities for which exploits are
available. System administrators can use this list to help in
prioritization of their remediation activities. The Qualys Vulnerability
Research Team compiles this information based on various exploit
frameworks, exploit databases, exploit kits and monitoring of internet
activity.
ID : CVE-2012-0507
Title Oracle Java SE Remote Java Runtime Environment Code Execution Vulnerability
Vendor Oracle
Description Unspecified vulnerability in the Java Runtime Environment
(JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30
and earlier, and 5.0 Update 33 and earlier allows remote attackers to
affect confidentiality, integrity, and availability via unknown vectors
related to Concurrency.
CVSS v2 Base Score 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
ID : CVE-2012-4969
Title Microsoft Internet Explorer 7/8/9 contain a use-after-free vulnerability
Vendor Microsoft
Description Microsoft Internet Explorer versions 7, 8, and 9 are
susceptible to a use-after-free vulnerability that may result in remote
code execution.
CVSS v2 Base Score 9.7 (AV:N/AC:L/Au:N/C:C/I:C/A:P)
ID : CVE-2012-4681
Title Java 7 Applet Remote Code Execution
Vendor Oracle
Description Oracle Java 7 Update 6, and possibly other versions, allows
remote attackers to execute arbitrary code via a crafted applet, as
exploited in the wild in August 2012 using Gondzz.class and
Gondvv.class.
CVSS v2 Base Score 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
ID : CVE-2012-1535
Title Adobe Flash Player 11.3 Font Parsing Code Execution
Vendor Adobe
Description Unspecified vulnerability in Adobe Flash Player before
11.3.300.271 on Windows and Mac OS X and before 11.2.202.238 on Linux
allows remote attackers to execute arbitrary code or cause a denial of
service (application crash) via crafted SWF content, as exploited in the
wild in August 2012 with SWF content in a Word document.
CVSS v2 Base Score 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
ID : CVE-2012-3579
Title Symantec Messaging Gateway SSH Default Password Security Bypass Vulnerability
Vendor Symantec
Description Symantec Messaging Gateway before 10.0 has a default
password for an unspecified account, which makes it easier for remote
attackers to obtain privileged access via an SSH session.
CVSS v2 Base Score 7.9 (AV:A/AC:M/Au:N/C:C/I:C/A:C)
MOST PREVALENT MALWARE FILES 9/25/2012 - 10/04/12: COMPILED BY SOURCEFIRE
SHA 256 9A09BCC1402050E371E13056B606BBDE8DF15CD87732B28C8BDDB863B1C65302
MD5 923c4d13bee966654f4fe4a8945af0ae
VirusTotal https://www.virustotal.com/file/ 9A09BCC1402050E371E13056B606BBDE8DF15CD87732B28C8BDDB863B1C65302/analysis/
Typical Filename winhsebb.exe
Claimed Product winhsebb.exe
Claimed Publisher winhsebb.exe
SHA 256 0585CDC0293EA6B8C86482608C08C583BF32E12CFA59D143F4A0411D2894C0F3
MD5 b3b9295385f4e74d023181e5a24f4d83
VirusTotal https://www.virustotal.com/file/ 0585CDC0293EA6B8C86482608C08C583BF32E12CFA59D143F4A0411D2894C0F3/analysis/
Typical Filename activator.exe.xxx
Claimed Product activator.exe.xxx
Claimed Publisher activator.exe.xxx
SHA 256 DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C
MD5 25aa9bb549ecc7bb6100f8d179452508
VirusTotal https://www.virustotal.com/file/ DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C/analysis/
Typical Filename smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin
Claimed Product smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin
Claimed Publisher smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin
SHA 256 AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615
MD5 3291e1603715c47a23b60a8bf2ca73db
VirusTotal https://www.virustotal.com/file/ AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615/analysis/
Typical Filename 123
Claimed Product 123
Claimed Publisher 123
