CONTENTS:

NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES 5/27/2014 - 6/3/2014

TOP VULNERABILITY THIS WEEK: Adobe Flash Player Shader Buffer Overflow

(CVE-2014-0515)

NOTABLE RECENT SECURITY ISSUES SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM

Title: Heartbleed, Cupid and Wireless
Description: A security researcher has implemented the OpenSSL
Heartbleed attack for against the TLS/EAP key exchange for 802.11
wireless networks.
Reference: http://www.sysvalue.com/en/heartbleed-cupid-wireless/
Snort SID: 30514-30517, 30549, 30719-30726, 30735-30742, 30777-30788

Title: Recent Exploit for Adobe Flash Vulnerability Targeting Users in
Japan for Financial Information (CVE-2014-0515)
Description: Security researchers discovered strategic web compromises
focusing on Japanese consumers, leading to banking malware.
Reference:
http://www.symantec.com/connect/blogs/recent-exploit-adobe-flash-vulnerability-targeting-users-japan-financial-information
Snort SID: 30876, 30877

INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY

NEWSCASTER - An Iranian Threat Inside Social Media
http://www.isightpartners.com/2014/05/newscaster-iranian-threat-inside-social-media/

GameOver Zeus P2P Malware
http://www.us-cert.gov/ncas/alerts/TA14-150A

“Nemanja” Botnet Identified
http://intelcrawler.com/news-18

An Introduction to Recognizing and Decoding RC4 Encryption in Malware
http://sfi.re/1h5wc0C

Attack Analysis with a Fast Graph
http://sfi.re/1otR3tp

RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM

This is a list of recent vulnerabilities for which exploits are
available. System administrators can use this list to help in
prioritization of their remediation activities. The Qualys Vulnerability
Research Team compiles this information based on various exploit
frameworks, exploit databases, exploit kits and monitoring of internet
activity.

ID: CVE-2014-3120
Title: Elasticsearch Remote Code Execution
Vendor: Elasticsearch
Description: Elasticsearch has a flaw in its default configuration which
makes it possible for any webpage to execute arbitrary code on visitors
with Elasticsearch installed.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/AU:N/C:C/I:C/A:C)

ID: CVE-2014-0515
Title: Adobe Flash Player Shader Buffer Overflow
Vendor: Adobe
Description: Buffer overflow in Adobe Flash Player before 11.7.700.279
and 11.8.x through 13.0.x before 13.0.0.206 on Windows and OS X, and
before 11.2.202.356 on Linux, allows remote attackers to execute
arbitrary code via unspecified vectors, as exploited in the wild in
April 2014.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/AU:N/C:C/I:C/A:C)

ID: CVE-2014-0094
Title: Apache Struts ClassLoader Manipulation Remote Code Execution
Vendor: Apache
Description: The ParametersInterceptor in Apache Struts before 2.3.16.1
allows remote attackers to “manipulate” the ClassLoader via the class
parameter, which is passed to the getClass method.
CVSS v2 Base Score: 5.0 (AV:N/AC:L/AU:N/C:N/I:P/A:N)

ID: CVE-2014-0497
Title: Adobe Flash Player Integer Underflow Remote Code Execution
Vendor: Adobe
Description: Integer underflow in Adobe Flash Player before 11.7.700.261
and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and
before 11.2.202.336 on Linux, allows remote attackers to execute
arbitrary code via unspecified vectors.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/AU:N/C:C/I:C/A:C)

ID: CVE-2014-1776
Title: Microsoft Internet Explorer Use-after-Free Vulnerability
Vendor: Microsoft
Description: Use-after-free vulnerability in VGX.DLL in Microsoft
Internet Explorer 6 through 11 allows remote attackers to execute
arbitrary code or cause a denial of service (memory corruption) via
unspecified vectors, as exploited in the wild in April 2014.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/AU:N/C:C/I:C/A:C)

ID: CVE-2014-0160
Title: OpenSSL TLS Heartbeat Extension Buffer Oveflow Information
Disclosure Vulnerability (Heartbleed)
Vendor: OpenSSL Project
Description: The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1
before 1.0.1g do not properly handle Heartbeart Extension packets, which
allows remote attackers to obtain sensitive information from process
memory via crafted packets that trigger a buffer over-read, as
demonstrated by reading private keys, related to d1_both.c and t1_lib.c.
CVSS v2 Base Score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)

MOST PREVALENT MALWARE FILES 5/27/2014 - 6/3/2014 COMPILED BY SOURCEFIRE

SHA 256: F095974F28C10F44F18088D8F174C07714967E80CCD2607A4FBDE9E9AE538806
MD5: 59f0fab281ee4cc5a7aeebbeaf8d0cd8
VirusTotal:
https://www.virustotal.com/file/F095974F28C10F44F18088D8F174C07714967E80CCD2607A4FBDE9E9AE538806/analysis/#additional-info
Typical Filename: cltmng.exe
Claimed Product: Conduit SearchProtect
Detection Name: W32.F095974F28-100.SBX.VIOC

SHA 256: C7E2762651F4DD99326BAA1499761D1E1FCD48F6ADB8CA9096590E6CAB8E1AE5
MD5: e08bdcb2af67b0117fb34cf030f1e0ab
VirusTotal:
https://www.virustotal.com/file/C7E2762651F4DD99326BAA1499761D1E1FCD48F6ADB8CA9096590E6CAB8E1AE5/analysis/#additional-info
Typical Filename: cltmngui.exe
Claimed Product: Conduit SearchProtect
Detection Name: W32.C7E2762651-100.SBX.VIOC

SHA 256: 6AE1FD42D591136387A2169BAEDCA2529CE178F22EEAB244A227F08ED90C0692
MD5: 6b5b9dce3f762732273c76c3b99cb3ed
VirusTotal:
https://www.virustotal.com/file/6AE1FD42D591136387A2169BAEDCA2529CE178F22EEAB244A227F08ED90C0692/analysis/#additional-info
Typical Filename: Au_.exe
Claimed Product: Conduit SearchProtect
Detection Name: W32.6AE1FD42D5-100.SBX.VIOC

SHA 256: 59D6E69D8091D73643813706C144249492EA0461A9F5935011C67C02EAD0EF4D
MD5: 7c1b2daee1d399955b979c0559fcea0b
VirusTotal:
https://www.virustotal.com/file/59D6E69D8091D73643813706C144249492EA0461A9F5935011C67C02EAD0EF4D/analysis/#additional-info
Typical Filename: SPTool.dll
Claimed Product: Conduit SearchProtect
Detection Name: W32.59D6E69D80-100.SBX.VIOC

SHA 256: 87B690E4778E41B336B113E06767308DEFF4E217B0F12FB2B294849DC6D219C9
MD5: 9d34c62ac86d6f9e110dc94dd93cd072
VirusTotal:
https://www.virustotal.com/file/87B690E4778E41B336B113E06767308DEFF4E217B0F12FB2B294849DC6D219C9/analysis/#additional-info
Typical Filename: SPVC64Loader.dll
Claimed Product: Conduit SearchProtect
Detection Name: W32.87B690E477-100.SBX.VIOC