@RISK Newsletter for March 14, 2019
The consensus security vulnerability alert.
Vol. 19, Num. 11
This is a weekly newsletter that provides in-depth analysis of the latest vulnerabilities with straightforward remediation advice. Qualys supplies a large part of the newly-discovered vulnerability content used in this newsletter.
Archived issues may be found at the SANS @RISK Newletter Archive.
CONTENTS:
NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES March 7 - 14
TOP VULNERABILITY THIS WEEK: Microsoft discloses 64 vulnerabilities as part of Patch Tuesday
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP
Title: Patch Tuesday includes 17 critical Microsoft vulnerabilities
Description: Microsoft released its monthly security update today, disclosing a variety of vulnerabilities in several of its products. The latest Patch Tuesday covers 64 vulnerabilities, 17 of which are rated critical, 45 that are considered important and one moderate and low vulnerability each. This release also includes two critical advisoriesone covering security updates to Adobe Flash Player and another concerning SHA-2.
Reference: https://blog.talosintelligence.com/2019/03/microsoft-patch-tuesday-march-2019.html
Snort SIDs: 45142, 45143, 46554, 46555, 48051, 48052, 49172, 49173, 49364 - 49369, 49371, 49372, 49378 - 49395, 49400 - 49403
Title: Multiple vulnerabilities in Pixar Renderman
Description: The MacOS version of Pixar Renderman contains three local vulnerabilities in its install helper tool. An attacker could exploit these bugs to escalate their privileges to root. Renderman is a rendering application used in animation and film production produced by Pixar, a well-known film studio. When installing the application, a helper tool is installed and launched as root. This service continues to listen even after installation is complete. These vulnerabilities lie in the Dispatch
function of this helper tool.
Reference: https://blog.talosintelligence.com/2019/03/vuln-spotlight-pixar-renderman-local-2019.html
Snort SIDs: 48450 - 48453, 49088, 49089
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
Iranian hackers stole an estimated six terabytes of data off of Citrix networks, including e-mails and files stored on sharing services.
Several popular car alarm systems can be bypassed and turned off remotely by attackers, according to new research.
https://www.bbc.com/news/technology-47485731
Google Chrome pushed users to upgrade to Windows 10 after the web browser disclosed a zero-day bug in Windows 7 and Chrome that could allow attackers to push malicious code to users.
A new report from the U.S.s Office of the Inspector General warns that NASA has serious cybersecurity holes that could open the space agency to an attack from a nation-state actor.
https://www.infosecurity-magazine.com/news/nasas-poor-cybersecurity-1-1-1/
Adobe patched critical vulnerabilities in Photoshop and Digital Editions as part of its monthly security update.
Social media hackers have stepped up their efforts over the past few months to reinforce pro-Brexit sentiment as the British government works on a deal to leave the European Union.
https://www.securityweek.com/pro-brexit-twitter-manipulation-continues
RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM
This is a list of recent vulnerabilities for which exploits are
available. System administrators can use this list to help in
prioritization of their remediation activities. The Qualys Vulnerability
Research Team compiles this information based on various exploit
frameworks, exploit databases, exploit kits and monitoring of internet
activity.
IID: | CVE-2019-5786
Title: | Google Chrome User After Free Arbitrary Code Execution Vulnerability
Vendor: Microsoft
Description: A use-after-free vulnerability exists in the FileReader component of Google Chrome. It could be exploited by unprivileged attackers to gain privileges on the Chrome web browser and to escape the sandbox to run arbitrary code.
CVSS v2 Base Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
ID: | CVE-2019-0187
Title: | Apache JMeter Remote Code Execution Vulnerability
Vendor: Apache
Description: An unauthenticated RCE is possible when JMeter is used in distributed mode. Attacker can establish a RMI connection to a jmeter-server using RemoteJMeterEngine and proceed with an attack using untrusted data deserialization. Apache JMeter versions 4.0, 5.0 are vulnerable.
CVSS v2 Base Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
ID: | CVE-2019-1596
Title: | Cisco NX-OS Software Bash Shell Local Privilege Escalation Vulnerability
Vendor: Cisco
Description: A vulnerability exists in the Bash shell implementation for Cisco NX-OS Software. This could allow an authenticated, local attacker to escalate their privilege level to root due to incorrect permissions of a system executable. An attacker could exploit this vulnerability by authenticating to the device and entering a crafted command at the Bash prompt.
CVSS v2 Base Score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)
ID: | CVE-2019-1707
Title: | Cisco DNA Center Access Contract HTML Injection Vulnerability
Vendor: Cisco
Description: Cisco DNA Center Access Contract is exposed to an HTML-injection vulnerability that could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
CVSS v2 Base Score: 3.5 (AV:N/AC:M/Au:S/C:N/I:P/A:N)
ID: | CVE-2019-0809
Title: | Microsoft Visual Studio Remote Code Execution Vulnerability
Vendor: Microsoft
Description: A remote code execution vulnerability exists when the Visual Studio C++ Redistributable Installer improperly validates input before loading dynamic link library (DLL) files. An attacker who successfully exploited the vulnerability could execute arbitrary code.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
ID: | CVE-2019-0603
Title: | Microsoft Windows TFTP Server Remote Code Execution Vulnerability
Vendor: Microsoft
Description: A remote code execution vulnerability exists in the way that Windows Deployment Services TFTP Server handles objects in memory.Successful exploitation allows an attacker to remote code execution and take control of an affected system.
CVSS v2 Base Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
ID: | CVE-2019-0808, CVE-2019-0797
Title: | Microsoft Windows Win32k Elevation of Privilege Vulnerability
Vendor: Microsoft
Description: An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode.
CVSS v2 Base Score: 6.3 (AV:L/AC:H/Au:N/C:C/I:C/A:C)
ID: | CVE-2019-7816
Title: | Adobe ColdFusion Arbitrary File-Upload Vulnerability
Vendor: Adobe
Description: Adobe ColdFusion is exposed to an arbitrary file-upload vulnerability. An attacker could exploit this vulnerability to upload a malicious file and execute arbitrary code in the context of the running ColdFusion service.
CVSS v2 Base Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
MOST PREVALENT MALWARE FILES March 7 - 14:
COMPILED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP
SHA 256: 9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f
MD5: 38de5b216c33833af710e88f7f64fc98
VirusTotal: https://www.virustotal.com/#/file/9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f/details
Typical Filename: SECOH-QAD.exe
Claimed Product: N/A
Detection Name: W32.Hacktool.22ei.1201
SHA 256: 225bb8a1bdcd0132a3624fde62f109a4d59056bc7418a7838b6ac0997127259b
MD5: f953dd9537961aa72648f39379b7ff51
VirusTotal: https://www.virustotal.com/#/file/225bb8a1bdcd0132a3624fde62f109a4d59056bc7418a7838b6ac0997127259b/details
Typical Filename: SOA.doc
Claimed Product: N/A
Detection Name: W32.225BB8A1BD-95.SBX.TG
SHA 256: 6d36f92ee3f1a7be56e00118cebf62fc4f3f127e307f5a4e7f008793ca549671
MD5: b23f736c46d9fa238b02c9eb0cea37cf
VirusTotal: https://www.virustotal.com/#/file/6d36f92ee3f1a7be56e00118cebf62fc4f3f127e307f5a4e7f008793ca549671/details
Typical Filename: CONFIGURETGN.EXE
Claimed Product: N/A
Detection Name: Win.Malware.Generic::in03.talos
SHA 256: 18042540b39d543e9e648e5d0b059d2e8c74889bb9353674be59c94da265f393
MD5: 1a5a7532854ab45ac74b1c657fe47941
VirusTotal: https://www.virustotal.com/#/file/18042540b39d543e9e648e5d0b059d2e8c74889bb9353674be59c94da265f393/details
Typical Filename: helperamc.zip
Claimed Product: Advanced Mac Cleaner
Detection Name: W32.18042540B3-95.SBX.TG
SHA 256: 60c5f5f3b78b151fe6a01d4957ad536496b646e9d8288703d10fb8a03afb3b64
MD5: efcaf7a94501ad0c9a37f459a91e493f
VirusTotal: https://www.virustotal.com/#/file/60c5f5f3b78b151fe6a01d4957ad536496b646e9d8288703d10fb8a03afb3b64/details
Typical Filename: 1SOAJAN19_exe.bin
Claimed Product: MONARCHOMACHIC9
Detection Name: W32.60C5F5F3B7-100.SBX.T