Vol. 12, Num. 42
This is a weekly newsletter that provides in-depth analysis of the latest vulnerabilities with straightforward remediation advice. Qualys supplies a large part of the newly-discovered vulnerability content used in this newsletter.
Archived issues may be found at the SANS @RISK Newletter Archive.
NOTABLE RECENT SECURITY ISSUES
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES 10/11/2012 - 10/18/12
The bank DDoS attacks being generated by the “itsoknoproblembro”
script have continued apace over the last week, with rumors that
defense contractors and others outside the banking industry are to
be targeted soon.
Title: miniFlame cyberespionage malware
Description: A new piece of malware likely used for cyberespionage
has been discovered during an analysis of the Flame command and
control servers. It is called “miniFlame” due the fact that
it exhibits strong similarities to Flame, another piece of spying
malware discovered earlier in 2012. Flame, along with another piece
of malware called Gauss, have already infected over 10,000 computers
worldwide. While minFlame was found on machines that were already
infected with Flame and Gauss, it has been detected on only a dozen
computers, primarily in the Middle East. This leads us to believe that
miniFlame is part of a targeted attack rather than a broad campaign.
Snort SID: 23019 through 23038, 23824
ClamAV: Worm.Flame.* , W32.Trojan.Gauss., WIN.Trojan.MiniFlame.
Title: “itsoknoproblembro” and Recent DDoS Attacks
Description: The bank DDoS attacks being generated by the
“itsoknoproblembro” script have continued apace over the last
week, with rumors that defense contractors and others outside the
banking industry are to be targeted soon. As the attacks have worn on,
additional details have come to light about the mechanisms being used,
which are allowing potential targets to better protect themselves.
Specifically, the script in question has been observed in the wild
on compromised web servers with high-bandwidth links, and some of
the patterns being used in the DDoS attacks have come to light as well.
Snort SID: 24388 - 24396
Title: Multiple Remote Attacks in Steam Browser URIs
Description: A report was released on Monday by a pair of respected
researchers detailing multiple vulnerabilities in the Steam game URI
handler, including potential remote code execution, the ability to
write files to the victim host directly, etc. The researchers strongly
suggest disabling this URI handler until a patch has been issued by
Steam. While attacks have yet to be directly observed in the wild,
the trivial nature of certain types of exploitation all but ensures
that it will be abused soon. Network administrators should consider
Snort SID 24397, which simply blocks all Steam URIs on a given network.
Snort SID: 24397
mDNS - Telling the world about you (and your device):
iOS 6 kernel security: a hacker’s guide:
Spear phishing in action:
By fixing a security vulnerability, Facebook created a new one:
This is a list of recent vulnerabilities for which exploits are available.
System administrators can use this list to help in prioritization of their
remediation activities. The Qualys Vulnerability Research Team compiles this
information based on various exploit frameworks, exploit databases, exploit
kits and monitoring of internet activity.
ID: : CVE-2012-0507
Title: Oracle Java SE Remote Java Runtime Environment Code Execution
Description: Unspecified vulnerability in the Java Runtime Environment
(JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30
and earlier, and 5.0 Update 33 and earlier allows remote attackers
to affect confidentiality, integrity, and availability via unknown
vectors related to Concurrency.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
ID: : CVE-2012-4969
Title: Microsoft Internet Explorer 7/8/9 contain a use-after-free
Description: Microsoft Internet Explorer versions 7, 8, and 9 are
susceptible to a use-after-free vulnerability that may result in
remote code execution.
CVSS v2 Base Score: 9.7 (AV:N/AC:L/Au:N/C:C/I:C/A:P)
ID: : CVE-2012-4681
Title: Java 7 Applet Remote Code Execution
Description: Oracle Java 7 Update 6, and possibly other versions,
allows remote attackers to execute arbitrary code via a crafted
applet, as exploited in the wild in August 2012 using Gondzz.class
CVSS v2 Base Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
ID: : CVE-2012-1535
Title: Adobe Flash Player 11.3 Font Parsing Code Execution
Description: Unspecified vulnerability in Adobe Flash Player before
11.3.300.271 on Windows and Mac OS X and before 220.127.116.11 on Linux
allows remote attackers to execute arbitrary code or cause a denial
of service (application crash) via crafted SWF content, as exploited
in the wild in August 2012 with SWF content in a Word document.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
ID: : CVE-2012-2516
Title: GE INTELLIGENT PLATFORMS PROFICY HTML HELP VULNERABILITIES
Description: An ActiveX control in KeyHelp.ocx in KeyWorks KeyHelp
Module (aka the HTML Help component), as used in GE Intelligent
Platforms Proficy Historian 3.1, 3.5, 4.0, and 4.5; Proficy HMI/SCADA
iFIX 5.0 and 5.1; Proficy Pulse 1.0; Proficy Batch Execution 5.6;
SI7 I/O Driver 7.20 through 7.42; and other products, allows remote
attackers to execute arbitrary commands via crafted input, related to a
“command injection vulnerability.”
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Typical Filename: activator.exe.xxx
Claimed Product: activator.exe.xxx
Claimed Publisher: activator.exe.xxx
Typical Filename: winhsebb.exe
Claimed Product: winhsebb.exe
Claimed Publisher: winhsebb.exe
Typical Filename: 123
Claimed Product: 123
Claimed Publisher: 123