Search

See Resources

@RISK: The Consensus Security Vulnerability Alert
Week 53 2013



This is a weekly newsletter that provides in-depth analysis of
the latest vulnerabilities with straightforward remediation advice. Qualys
supplies a large part of the newly-discovered vulnerability content used in
this newsletter.

@RISK: The Consensus Security Vulnerability Alert
Week 53 2013

CONTENTS
NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES 12/24/2013 - 12/31/2013


TOP VULNERABILITY THIS WEEK: Adobe Flash & Adobe AIR Vulnerabilities


NOTABLE RECENT SECURITY ISSUES SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM

TitleAdobe Flash and Adobe AIR Vulnerabilities
Description Several vulnerabilities were disclosed recently by Adobe in their Flash and AIR platforms.  Coverage has been provided for these vulnerabilities in the form of Snort Rules.
Reference
http://www.snort.org/vrt/docs/ruleset_changelogs/changes-2013-12-24.html
Snort SID 29047-29054

Title NSA’s secret toolbox of exploits and vulnerabilities
DescriptionDer Spiegal, a German publication, has publicized a “catalogue” of security vulnerabilities and Spy Gear available to the NSA.  In the article several vendors are specifically named as having vulnerabilities. These vendors have put out statements in regards to this article.
Reference
http://www.spiegel.de/international/world/catalog-reveals-nsa-has-back-doors-for-numerous-devices-a-940994.html
http://blogs.cisco.com/news/comment-on-der-spiegel-articles-about-nsa-tao-organization/
Snort SIDN/A


INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY

30th Birthday of DNS
http://www.circleid.com/posts/20131127_the_30th_birthday_of_dns/

Linux Worm targeting hidden devices
http://www.symantec.com/connect/blogs/linux-worm-targeting-hidden-devices

Microsoft investigates zero-day attacks on Windows XP
http://www.pcpro.co.uk/news/security/385693/microsoft-investigates-zero-day-attacks-on-windows-xp


RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM

This is a list of recent vulnerabilities for which exploits are
available. System administrators can use this list to help in
prioritization of their remediation activities. The Qualys Vulnerability
Research Team compiles this information based on various exploit
frameworks, exploit databases, exploit kits and monitoring of internet
activity.

ID    CVE-2013-0074
Title Microsoft Silverlight Double Dereference Vulnerability
VendorMicrosoft
DescriptionMicrosoft Silverlight 5, and 5 Developer Runtime, before 5.1.20125.0 does not properly validate pointers during HTML object rendering, which allows remote attackers to execute arbitrary code via a crafted Silverlight application, aka "Silverlight Double Dereference Vulnerability."
CVSS v2 Base Score9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID    CVE-2013-3346
Title Adobe Reader and Acrobat "ToolButton" Use-after-Free Vulnerability
VendorAdobe
DescriptionAdobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-2718, CVE-2013-2719, CVE-2013-2720, CVE-2013-2721, CVE-2013-2722, CVE-2013-2723, CVE-2013-2725, CVE-2013-2726, CVE-2013-2731, CVE-2013-2732, CVE-2013-2734, CVE-2013-2735, CVE-2013-2736, CVE-2013-3337, CVE-2013-3338, CVE-2013-3339, CVE-2013-3340, and CVE-2013-3341.
CVSS v2 Base Score10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID    CVE-2013-2068
Title Red Hat CloudForms Management Engine Path Traversal
VendorRed Hat
DescriptionMultiple directory traversal vulnerabilities in the AgentController in Red Hat CloudForms Management Engine 2.0 allow remote attackers to create and overwrite arbitrary files via a .. (dot dot) in the filename parameter to the (1) log, (2) upload, or (3) linuxpkgs method.
CVSS v2 Base Score9.4 (AV:N/AC:L/Au:N/C:N/I:C/A:C)

ID    CVE-2013-5331
Title Adobe Flash Player Memory Corruption Code Execution Vulnerability (APSB13-28)
VendorAdobe
Description Remote exploitation of a memory corruption vulnerability in Adobe System Inc.'s Flash Player versions 11.9.900.152 and earlier versions for Windows and Macintosh and Adobe Flash Player 11.2.202.327 and earlier versions for Linux. This could allow an attacker to execute arbitrary code. Adobe is aware of reports that an exploit designed to trick the user into opening a Microsoft Word document with malicious Flash (.swf).
CVSS v2 Base Score9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID    CVE-2013-5065
Title Microsoft Windows Kernel "NDProxy.sys Driver" Input Validation Code Execution Vulnerability
VendorMicrosoft
DescriptionNDProxy.sys in the kernel in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in November 2013.
CVSS v2 Base Score7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)

ID    CVE-2013-3906
Title Microsoft Graphics Component Could Allow Remote Code Execution
VendorMicrosoft
DescriptionGDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and Lync 2010, 2010 Attendee, 2013, and Basic 2013 allows remote attackers to execute arbitrary code via a crafted TIFF image, as demonstrated by an image in a Word document, and exploited in the wild in October and November 2013.
CVSS v2 Base Score9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)


MOST PREVALENT MALWARE FILES 12/24/2013 - 12/31/2013 COMPILED BY SOURCEFIRE

SHA 256180C6035CA44C270B8E1556A7B2E9FAF442D1B4323EF6D8E93B7E759AF169C96
MD544e5b5dc6a27ea109b8a234e640bb5fd
VirusTotalhttps://www.virustotal.com/en/file/ 180C6035CA44C270B8E1556A7B2E9FAF442D1B4323EF6D8E93B7E759AF169C96/analysis/
Typical FilenameBitGuard.exe
Claimed ProductBitGuard.exe
Detection NameW32.Agent:Generic.16no.dk

SHA 256df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c
MD525aa9bb549ecc7bb6100f8d179452508
VirusTotalhttps://www.virustotal.com/en/file/ DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C/analysis/
Typical Filename Random
Claimed ProductRandom
Detection NameW32.DF83A0D694-100.SBX.VIOC

SHA 256aa0bbaecb678868e1e7f57c7ca9d61b608b3d788be490790eb1d148beadf4615
MD53291e1603715c47a23b60a8bf2ca73db
VirusTotalhttps://www.virustotal.com/en/file/ AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615/analysis/
Typical FilenameRandom
Claimed ProductRandom
Detection Name Confiker

SHA 25639b8205ecae929e91ffcefe9fb45497040b3f26ab57df607ea1c3724b699009d
MD544d52cedf8d3dd2ca2325a031dc0ecf1
VirusTotalhttps://www.virustotal.com/en/file/ 39B8205ECAE929E91FFCEFE9FB45497040B3F26AB57DF607EA1C3724B699009D/analysis/
Typical FilenameUpdater.exe
Claimed ProductNone
Detection NameW32.39B8205ECA-100.SBX.VIOC

Email or call us at +1 800 745 4355 or try our Global Contacts
Subscription Packages
Qualys Solutions
Qualys Community
Company
Free Trial & Tools
Popular Topics