CONTENTS:

NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES 2016-08-09 - 2016-08-16

TOP VULNERABILITY THIS WEEK: Researchers at USENIX Security Symposium Disclose Flaw in Automotive Remote Keyless Entry Systems

NOTABLE RECENT SECURITY ISSUES

SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

Title: Researchers at USENIX Security Symposium Disclose Flaw in Automotive Remote Keyless Entry Systems
Description: Researchers at the USENIX Security Symposium unveiled new research into the security of remote keyless entry systems for automobiles. In the presentation, researchers disclosed that “most VW Group vehicles manufactured between 1995 and today [rely] on a few, global master keys” for keyless entry. Additionally, the Hitag2 rolling code scheme used by a variety of other manufacturers was identified, enabling researchers to conduct “correlation-based attack[s] on Hitag2.” This could lead to an attacker recovering the cryptographic key and gaining the ability to clone the “remote control with four to eight rolling codes and a few minutes of computation on a laptop.”
Reference: https://www.usenix.org/system/files/conference/usenixsecurity16/sec16_paper_garcia.pdf

Title: Undocumented SNMP Credential Flaw Identified in Rockwell Automation MicroLogix 1400 PLCs
Description: Researchers at Cisco Talos have identified an undocumented SNMP credential vulnerability in Rockwell Automation MicroLogix 1400 Programmable Logic Controllers (PLCs). The flaw “is due to the presence of an undocumented SNMP community string that could be leveraged by an attacker to gain full control of affected devices.” However, due to “the nature of this product’s firmware update process,” the flaw cannot be patched. Rockwell has instead released mitigation guidelines to reduce the risk of compromise for affected devices.
Reference: https://ics-cert.us-cert.gov/advisories/ICSA-16-224-01
http://blog.talosintel.com/2016/08/rockwell-snmp-vuln.html
Snort SID: 39876-39877

Title: Cisco IOS XR Software for Cisco ASR 9001 Aggregation Services Routers Fragmented Packet Denial of Service Vulnerability
Description: Cisco has released a security advisory for a fragmented packet denial-of-service vulnerability within Cisco IOS XR Software. This flaw manifests in Cisco ASR 9001 Aggregation Services Routers and could be exploited by a remote, unauthenticated attacker. Exploitation of this vulnerability could “cause a memory leak on the route processor (RP) of an affected device, which could cause the device to drop all control-plane protocols and lead to a denial of service.” Cisco has released a software update to address the flaw along with mitigations.
Reference: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160810-iosxr

INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY

Further simplifying servicing models for Windows 7 and Windows 8.1
https://blogs.technet.microsoft.com/windowsitpro/2016/08/15/further-simplifying-servicing-model-for-windows-7-and-windows-8-1/

The World Series of Hacking – without humans
http://arstechnica.com/information-technology/2016/08/the-world-series-of-hacking-without-humans/

“Fileless” UAC Bypass Using Eventvwr.exe and Registry Hijacking
https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/

Abusing Kerberos to NTLM fallback to defeat BitLocker FDE
https://blog.ahmednabeel.com/abusing-kerberos-to-ntlm-fallback-to-defeat-windows-authentication/

There are really only two effectively distinct settings for the UAC slider
https://blogs.msdn.microsoft.com/oldnewthing/20160816-00/?p=94105

RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM

This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.

ID: CVE-2016-1017
Title: Adobe Flash Player “AS2 LoadVars” Use-after-free Code Execution Vulnerability (APSA16-10)
Vendor: Adobe
Description: Use-after-free vulnerability in the LoadVars.decode function in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1011, CVE-2016-1013, CVE-2016-1016, and CVE-2016-1031.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: CVE-2016-4171
Title: Adobe Flash Code Execution Vulnerability (APSA16-03)
Vendor: Adobe
Description: Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in June 2016.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: CVE-2016-0185
Title: Microsoft Windows Media Center Input Validation Remote Code Execution Vulneraiblity (MS16-059)
Vendor: Microsoft
Description: Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, and Windows 8.1 allows remote attackers to execute arbitrary code via a crafted Media Center link (aka .mcl) file, aka “Windows Media Center Remote Code Execution Vulnerability.”
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: CVE-2016-4117
Title: Adobe Flash Player Integer Overflow Code Execution Vulnerability (APSA16-02)
Vendor: Adobe
Description: Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: CVE-2016-0189
Title: Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability
Vendor: Microsoft
Description: The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka “Scripting Engine Memory Corruption Vulnerability,” a different vulnerability than CVE-2016-0187.
CVSS v2 Base Score: 7.6 (AV:N/AC:H/Au:N/C:C/I:C/A:C)

ID: CVE-2016-1287
Title: Cisco ASA Software IKEv1 and IKEv2 Buffer Overflow Vulnerability
Vendor: Cisco
Description: Buffer overflow in the IKEv1 and IKEv2 implementations in Cisco ASA Software before 8.4(7.30), 8.7 before 8.7(1.18), 9.0 before 9.0(4.38), 9.1 before 9.1(7), 9.2 before 9.2(4.5), 9.3 before 9.3(3.7), 9.4 before 9.4(2.4), and 9.5 before 9.5(2.2) on ASA 5500 devices, ASA 5500-X devices, ASA Services Module for Cisco Catalyst 6500 and Cisco 7600 devices, ASA 1000V devices, Adaptive Security Virtual Appliance (aka ASAv), Firepower 9300 ASA Security Module, and ISA 3000 devices allows remote attackers to execute arbitrary code or cause a denial of service (device reload) via crafted UDP packets, aka Bug IDs CSCux29978 and CSCux42019.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: CVE-2016-3081
Title: Apache Struts Input Validation Remote Code Execution Vulnerability
Vendor: Apache Structs
Description: Apache Struts 2.x before 2.3.20.2, 2.3.24.x before 2.3.24.2, and 2.3.28.x before 2.3.28.1, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

MOST PREVALENT MALWARE FILES 2016-08-09 - 2016-08-16:

COMPILED BY TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

SHA 256: BCFFDA040C93B743BCA1A67128EC1F60595DC0B14655AFD7949B6C779E0E997F
MD5: 2dbf779808d2ec3f5121891be9f4b1cf
VirusTotal: https://www.virustotal.com/file/BCFFDA040C93B743BCA1A67128EC1F60595DC0B14655AFD7949B6C779E0E997F/analysis/#additional-info
Typical Filename: helperamc
Claimed Product: (none)
Detection Name: OSX.Variant:AMCZ.19if.1201

SHA 256: 5698B51686F47133E584B0B07B38933B70B05CCF9D3ABD195FDF1C533D8D102C
MD5: 0260613f570ec46bb5c4629a5cc4705c
VirusTotal: https://www.virustotal.com/file/5698B51686F47133E584B0B07B38933B70B05CCF9D3ABD195FDF1C533D8D102C/analysis/#additional-info
Typical Filename: contract_019459.doc
Claimed Product: N/A
Detection Name: W32.5698B51686-100.SBX.TG

SHA 256: 699590CFD11C8306DDADA9F9F5C33FF02210D1896457CA004D3571929AC91CC4
MD5: be7dd3e4363902530ac608936068f850
VirusTotal: https://www.virustotal.com/file/699590CFD11C8306DDADA9F9F5C33FF02210D1896457CA004D3571929AC91CC4/analysis/#additional-info
Typical Filename: seupdater.dll
Claimed Product: (unknown)
Detection Name: W32.699590CFD1-100.SBX.VIOC

SHA 256: 20B9DE2D98B5A93F09CBAE55589A281153AE1B73BD04AF89BEA060E803A4E124
MD5: da63295955daa1e356031e5af09e9ce6
VirusTotal: https://www.virustotal.com/file/20B9DE2D98B5A93F09CBAE55589A281153AE1B73BD04AF89BEA060E803A4E124/analysis/#additional-info
Typical Filename: business_deal_855048.doc
Claimed Product: N/A
Detection Name: W32.20B9DE2D98-100.SBX.TG

SHA 256: 4760FB5F0A5095FF612287EDDBD2B8E64314A48AB097BC9B9A640A222F909475
MD5: af8049cd7848e55ea164ecefc43f29e6
VirusTotal: https://www.virustotal.com/file/4760FB5F0A5095FF612287EDDBD2B8E64314A48AB097BC9B9A640A222F909475/analysis/#additional-info
Typical Filename: radb35dc.tmp.exe
Claimed Product: (unknown)
Detection Name: GenericKD:ZPACK-tpd

Research
Sans At Risk
Week 33 2016