CONTENTS:

NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES 6/4/2014 - 6/10/2014

TOP VULNERABILITY THIS WEEK: Microsoft Patch Tuesday for June 2014

NOTABLE RECENT SECURITY ISSUES SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM

Title: Microsoft Updates June 2014 - Almost 60 IE and GDI+/TrueType RCE
Description: Microsoft releases patches for 66 CVEs, many of them
affecting Microsoft Internet Explorer, with critical severity.
Reference: https://technet.microsoft.com/library/security/ms14-jun
Snort SID: 31188-31194, 31196-31209, 31215-31217, 31219-31220

Title: Linux kernel futex local privilege escalation (CVE-2014-3153)
Description: A privilege escalation bug was discovered that allows a
local user to gain ring 0 control via the futex syscall.
Reference: http://seclists.org/oss-sec/2014/q2/467^([Title|Description|Reference|Snort SID|ClamAV|ID|Vendor|CVSS v2 Base Score|SHA 256|MD5|VirusTotal|Claimed Product|Claimed Publisher|Typical Filename|Malwr]+):

Title: Security updates available for Adobe Flash Player (APSB14-16)
Description: Adobe releases security updates for Flash Player affecting
Windows, Mac, and Linux. Four of the eight vulnerabilities are
critical.
Reference: http://helpx.adobe.com/security/products/flash-player/apsb14-16.html
Snort SID: Coverage is pending.

INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY

Simplocker: First Confirmed File-Encrypting Ransomware for Android
http://www.symantec.com/connect/blogs/simplocker-first-confirmed-file-encrypting-ransomware-android

RIG Exploit Kit Strikes Oil
http://sfi.re/1llBLrg

Defeating UEFI’s SecureBoot
http://www.net-security.org/article.php?id=2037

Black marketed Windows banking & POS Trojan Minerva turns in-the-wild
https://blog.avast.com/2014/06/04/black-marketed-windows-banking-pos-trojan-minerva-turns-in-the-wild/

RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM

This is a list of recent vulnerabilities for which exploits are
available. System administrators can use this list to help in
prioritization of their remediation activities. The Qualys Vulnerability
Research Team compiles this information based on various exploit
frameworks, exploit databases, exploit kits and monitoring of internet
activity.

ID: CVE-2014-3120
Title: Elasticsearch Remote Code Execution
Vendor: Elasticsearch
Description: Elasticsearch has a flaw in its default configuration which
makes it possible for any webpage to execute arbitrary code on visitors
with Elasticsearch installed.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/AU:N/C:C/I:C/A:C)

ID: CVE-2014-0515
Title: Adobe Flash Player Shader Buffer Overflow
Vendor: Adobe
Description: Buffer overflow in Adobe Flash Player before 11.7.700.279
and 11.8.x through 13.0.x before 13.0.0.206 on Windows and OS X, and
before 11.2.202.356 on Linux, allows remote attackers to execute
arbitrary code via unspecified vectors, as exploited in the wild in
April 2014.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/AU:N/C:C/I:C/A:C)

ID: CVE-2014-0094
Title: Apache Struts ClassLoader Manipulation Remote Code Execution
Vendor: Apache
Description: The ParametersInterceptor in Apache Struts before 2.3.16.1
allows remote attackers to “manipulate” the ClassLoader via the class
parameter, which is passed to the getClass method.
CVSS v2 Base Score: 5.0 (AV:N/AC:L/AU:N/C:N/I:P/A:N)

ID: CVE-2014-0497
Title: Adobe Flash Player Integer Underflow Remote Code Execution
Vendor: Adobe
Description: Integer underflow in Adobe Flash Player before 11.7.700.261
and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and
before 11.2.202.336 on Linux, allows remote attackers to execute
arbitrary code via unspecified vectors.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/AU:N/C:C/I:C/A:C)

ID: CVE-2014-1776
Title: Microsoft Internet Explorer Use-after-Free Vulnerability
Vendor: Microsoft
Description: Use-after-free vulnerability in VGX.DLL in Microsoft
Internet Explorer 6 through 11 allows remote attackers to execute
arbitrary code or cause a denial of service (memory corruption) via
unspecified vectors, as exploited in the wild in April 2014.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/AU:N/C:C/I:C/A:C)

ID: CVE-2014-0160
Title: OpenSSL TLS Heartbeat Extension Buffer Oveflow Information
Disclosure Vulnerability (Heartbleed)
Vendor: OpenSSL Project
Description: The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1
before 1.0.1g do not properly handle Heartbeart Extension packets, which
allows remote attackers to obtain sensitive information from process
memory via crafted packets that trigger a buffer over-read, as
demonstrated by reading private keys, related to d1_both.c and t1_lib.c.
CVSS v2 Base Score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)

MOST PREVALENT MALWARE FILES 6/4/2014 - 6/10/2014 COMPILED BY SOURCEFIRE

SHA 256: 37840A8EF03A5F4F9AED68C9E759D1B268E8335EE4D6C7C1774517BA9650B376
MD5: b13d123ceeaff81d2ba217cb74c7698e
VirusTotal:
https://www.virustotal.com/file/37840A8EF03A5F4F9AED68C9E759D1B268E8335EE4D6C7C1774517BA9650B376/analysis/#additional-info
Typical Filename: b13d123ceeaff81d2ba217cb74c7698e
Claimed Product: webget
Detection Name: Adware:MegaBrowse-tpd

SHA 256: D6585C5D5F85E8289C9EE8E6EECBAFD21B26B9DABA8561EDA12A91D5E484702C
MD5: cb963faf704f22473375856e3c2fcde3
VirusTotal:
https://www.virustotal.com/file/D6585C5D5F85E8289C9EE8E6EECBAFD21B26B9DABA8561EDA12A91D5E484702C/analysis/#additional-info
Typical Filename: CltMngSvc.exe
Claimed Product: ClientConnect
Detection Name: Win.Adware.SearchProtect.VRT

SHA 256: FA802EA3C3F8FBB3EF946A43B757E84A2D2AFD42BC9B035F71CC989A7E349081
MD5: 5454873bb620e77dcb10db8f23529877
VirusTotal:
https://www.virustotal.com/file/FA802EA3C3F8FBB3EF946A43B757E84A2D2AFD42BC9B035F71CC989A7E349081/analysis/#additional-info
Typical Filename: APISupport.dll
Claimed Product: ClientConnect
Detection Name: W32.FA802EA3C3-66.SBX.VIOC

SHA 256: D97C674896D54BF10EB4B26F39DF7E2AD3494C7B09C6634F17B8218CC6BDBF1A
MD5: 179b515a61e6d0c038dff57e0cec1a65
VirusTotal:
https://www.virustotal.com/file/D97C674896D54BF10EB4B26F39DF7E2AD3494C7B09C6634F17B8218CC6BDBF1A/analysis/#additional-info
Typical Filename: APISupport.dll
Claimed Product: Client Connect
Detection Name: W32.D97C674896-86.SBX.VIOC

SHA 256: DE79E5A4356CA0EFA56B69E6EDE21DD8E12FC16E2196B7B7366A0D76C65D3ED5
MD5:
VirusTotal:
https://www.virustotal.com/file/DE79E5A4356CA0EFA56B69E6EDE21DD8E12FC16E2196B7B7366A0D76C65D3ED5/analysis/#additional-info
Typical Filename: wajam_update.exe
Claimed Product: Wajam Updater
Detection Name: W32.AdwaregenAdw:Application.17g3.dk