Researchers discover a new worm and botnet dubbed Gitpaste-12 for its ability to spread via GitHub and Pastebin.
The post New Gitpaste-12 Botnet Exploits 12 Known Vulnerabilities appeared first on Malware Devil.
A survey of 350 security professionals in the U.S., Singapore, Germany, Australia and the United Kingdom suggests younger cybersecurity professionals tend to be more conflicted about advances in artificial intelligence (AI) than their older colleagues. Conducted by the research firm Censuswide on behalf of Exabeam, a provider of a security information event management platform, the..
The post Survey Sees AI, Automation Cast Shadow Over Security Careers appeared first on Security Boulevard.
The post Survey Sees AI, Automation Cast Shadow Over Security Careers appeared first on Malware Devil.
The post Commandant’s 245th Marine Corps Birthday Message appeared first on Security Boulevard.
The post Commandant’s 245th Marine Corps Birthday Message appeared first on Malware Devil.
Security continues to be a top concern for cloud customers, and therefore continues to be a driver of our business at Google Cloud. However, specific security priorities vary wildly by vertical, by organization size, and by many other factors.
In fact, many “CISO priorities lists” are floating out there online and many people claim to know “what CISOs want.” My analyst years taught me to be skeptical about such claims, if only because there are vast differences between CISOs of different organizations, in terms of security maturity, for example. Specifically, my interactions with CISOs showed me that while one CISO of a large enterprise is expanding his or her threat hunting team, another may be dealing with the more mundane challenge of patching Windows servers in time (BTW, CSO or CISO?).
Naturally, many of us in the Google Cloud Security business speak with customer security teams every day, and they often ask how Google performs certain security operations internally, how we think about certain problems, and how our security offerings will evolve. These conversations often involve Alphabet CISO, Royal Hansen, and we want to have these in-depth conversations as much as possible with our customers.
To make that possible, Google Cloud has created the Office of the CISO. It is made up of senior security executives with experience managing large security organizations across multiple industries. These executives serve as the trusted security and compliance advisors and advocates for customers. Additionally, they leverage their expertise to inform product security and compliance priorities in accordance with industry needs.
Interested in meeting some of these security leaders? We regularly hold Google Cloud Security Talks, and during our next set of talks, on November 18, the Office of the CISO members will participate in a panel discussion on security evolution during cloud migration. You can register for the talk here, and we look forward to having you join us.
Furthermore, Google Cloud Security is putting together hot topics for future CISO discussions. We plan to hit the range of CISO interests and operational maturity levels. Other topics the panel is considering for future events include:
We hope to see you on the 18th to start our journey!
Hearing from CISOs at Google Cloud and Beyond was originally published in Anton on Security on Medium, where people are continuing the conversation by highlighting and responding to this story.
The post Hearing from CISOs at Google Cloud and Beyond appeared first on Security Boulevard.
The post Hearing from CISOs at Google Cloud and Beyond appeared first on Malware Devil.
The illegal marketplace was hacked prior to it’s takedown — the IRS has now tracked down those stolen funds, it said.
Read More
The post Feds Seize $1B in Bitcoin from Silk Road appeared first on Malware Devil.
The vulnerabilities include three for which exploits have already been seen in the wild.
The post Apple Patches 24 Vulnerabilities Across Product Lines appeared first on Malware Devil.
The Ragnar Locker operators released a stolen contract between Wild Turkey and actor Matthew McConaughey, as proof of compromise.
Read More
The post Campari Site Suffers Ransomware Hangover appeared first on Malware Devil.
This week, Dr. Doug Talks Billion USD Bitcoin Mystery Solved, Russian Bears Doxed, Oracle, Zoom Snooping, and Drugs, all this and show wrap ups on the Security Weekly News Wrap Up!
Visit https://www.securityweekly.com/swn for all the latest episodes!
Show Notes: https://securityweekly.com/swn80
The post Billions of Bitcoins, Zoom Snooping, & Doxing Russian Bears – Wrap Up – SWN #80 appeared first on Malware Devil.
This week, Dr. Doug Talks Billion USD Bitcoin Mystery Solved, Russian Bears Doxed, Oracle, Zoom Snooping, and Drugs, all this and show wrap ups on the Security Weekly News Wrap Up!
Visit https://www.securityweekly.com/swn for all the latest episodes!
Show Notes: https://securityweekly.com/swn80
The post Billions of Bitcoins, Drugs, Zoom Snooping, & Doxing Russian Bears – SWN #80 appeared first on Malware Devil.
The social media deal raises issues involving data custodianship and trusted tech partnerships.
The post The Oracle-Walmart-TikTok Deal Is Not Enough appeared first on Malware Devil.
Many thanks to DEF CON and Conference Speakers for publishing their outstanding presentations; of which, originally appeared at the organization’s DEFCON 28 SAFE MODE Conference, and on the DEF CON YouTube channel. Enjoy!
The post DEF CON 28 Safe Mode ICS Village – Can Kumaz’ ‘ICS SecOps Active Defense Concept With Effective Incident Response’ appeared first on Security Boulevard.
The post DEF CON 28 Safe Mode ICS Village – Can Kumaz’ ‘ICS SecOps Active Defense Concept With Effective Incident Response’ appeared first on Malware Devil.
Over the past few months, our team has been working on something, both prudent and special, that we are excited to officially share with the world – The DIVERSE Commitment at Keyfactor. Diversity and inclusion is something Keyfactor has always supported across our global team and communities.
The post The DIVERSE Commitment at Keyfactor | Keyfactor appeared first on Security Boulevard.
The post The DIVERSE Commitment at Keyfactor | Keyfactor appeared first on Malware Devil.
Securing Remote Collaboration – Tackling Fat Finger Errors Previous Next John, who is REALLY enjoying working from home, gets a call from his manager Kevin requesting for a sales report one afternoon. While sitting on his couch enjoying a favorite show and “working” he quickly sends the report to […]
The post CipherCloud Chronicles #6: Tackling Fat Finger Errors appeared first on CipherCloud.
The post CipherCloud Chronicles #6: Tackling Fat Finger Errors appeared first on Security Boulevard.
The post CipherCloud Chronicles #6: Tackling Fat Finger Errors appeared first on Malware Devil.
The post Too Late appeared first on Security Boulevard.
The post Too Late appeared first on Malware Devil.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2020.3901
freerdp and vinagre security, bug fix, and enhancement update
6 November 2020
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: freerdp
vinagre
Publisher: Red Hat
Operating System: Red Hat
Impact/Access: Denial of Service -- Existing Account
Access Confidential Data -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2020-13397 CVE-2020-13396 CVE-2020-11526
CVE-2020-11525 CVE-2020-11522 CVE-2020-11089
CVE-2020-11088 CVE-2020-11087 CVE-2020-11086
CVE-2020-11085 CVE-2020-11058 CVE-2020-11049
CVE-2020-11048 CVE-2020-11047 CVE-2020-11046
CVE-2020-11045 CVE-2020-11044 CVE-2020-11043
CVE-2020-11042 CVE-2020-11041 CVE-2020-11040
CVE-2020-11039 CVE-2020-11038 CVE-2020-11019
CVE-2020-11018
Reference: ESB-2020.3398
ESB-2020.2979
ESB-2020.2847
ESB-2020.2611
Original Bulletin:
https://access.redhat.com/errata/RHSA-2020:4647
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: freerdp and vinagre security, bug fix, and enhancement update
Advisory ID: RHSA-2020:4647-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2020:4647
Issue date: 2020-11-03
CVE Names: CVE-2020-11018 CVE-2020-11019 CVE-2020-11038
CVE-2020-11039 CVE-2020-11040 CVE-2020-11041
CVE-2020-11042 CVE-2020-11043 CVE-2020-11044
CVE-2020-11045 CVE-2020-11046 CVE-2020-11047
CVE-2020-11048 CVE-2020-11049 CVE-2020-11058
CVE-2020-11085 CVE-2020-11086 CVE-2020-11087
CVE-2020-11088 CVE-2020-11089 CVE-2020-11522
CVE-2020-11525 CVE-2020-11526 CVE-2020-13396
CVE-2020-13397
=====================================================================
1. Summary:
An update for freerdp and vinagre is now available for Red Hat Enterprise
Linux 8.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat CodeReady Linux Builder (v. 8) - aarch64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux AppStream (v. 8) - aarch64, ppc64le, s390x, x86_64
3. Description:
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP),
released under the Apache license. The xfreerdp client can connect to RDP
servers such as Microsoft Windows machines, xrdp, and VirtualBox.
The vinagre packages provide the Vinagre remote desktop viewer for the
GNOME desktop.
The following packages have been upgraded to a later upstream version:
freerdp (2.1.1). (BZ#1834287)
Security Fix(es):
* freerdp: Out of bound read in cliprdr_server_receive_capabilities
(CVE-2020-11018)
* freerdp: Out of bound read/write in usb redirection channel
(CVE-2020-11039)
* freerdp: out-of-bounds read in update_read_icon_info function
(CVE-2020-11042)
* freerdp: out-of-bounds read in autodetect_recv_bandwidth_measure_results
function (CVE-2020-11047)
* freerdp: Out-of-bounds read in ntlm_read_ChallengeMessage in
winpr/libwinpr/sspi/NTLM/ntlm_message.c. (CVE-2020-13396)
* freerdp: Out-of-bounds read in security_fips_decrypt in
libfreerdp/core/security.c (CVE-2020-13397)
* freerdp: Out of bound read in update_recv could result in a crash
(CVE-2020-11019)
* freerdp: Integer overflow in VIDEO channel (CVE-2020-11038)
* freerdp: Out of bound access in clear_decompress_subcode_rlex
(CVE-2020-11040)
* freerdp: Unchecked read of array offset in rdpsnd_recv_wave2_pdu
(CVE-2020-11041)
* freerdp: out of bound read in rfx_process_message_tileset
(CVE-2020-11043)
* freerdp: double free in update_read_cache_bitmap_v3_order function
(CVE-2020-11044)
* freerdp: out of bounds read in update_read_bitmap_data function
(CVE-2020-11045)
* freerdp: out of bounds seek in update_read_synchronize function could
lead out of bounds read (CVE-2020-11046)
* freerdp: out-of-bounds read could result in aborting the session
(CVE-2020-11048)
* freerdp: out-of-bound read of client memory that is then passed on to the
protocol parser (CVE-2020-11049)
* freerdp: stream out-of-bounds seek in rdp_read_font_capability_set could
lead to out-of-bounds read (CVE-2020-11058)
* freerdp: out-of-bounds read in cliprdr_read_format_list function
(CVE-2020-11085)
* freerdp: out-of-bounds read in ntlm_read_ntlm_v2_client_challenge
function (CVE-2020-11086)
* freerdp: out-of-bounds read in ntlm_read_AuthenticateMessage
(CVE-2020-11087)
* freerdp: out-of-bounds read in ntlm_read_NegotiateMessage
(CVE-2020-11088)
* freerdp: out-of-bounds read in irp functions (CVE-2020-11089)
* freerdp: out-of-bounds read in gdi.c (CVE-2020-11522)
* freerdp: out-of-bounds read in bitmap.c (CVE-2020-11525)
* freerdp: Stream pointer out of bounds in update_recv_secondary_order
could lead out of bounds read later (CVE-2020-11526)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat
Enterprise Linux 8.3 Release Notes linked from the References section.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1761144 - Remove unsupported options from xfreerdp /help
1803054 - SCARD_INSUFFICIENT_BUFFER error when connecting to Windows 10 system
1834287 - Update freerdp to 2.1.1
1835382 - CVE-2020-11042 freerdp: out-of-bounds read in update_read_icon_info function
1835391 - CVE-2020-11044 freerdp: double free in update_read_cache_bitmap_v3_order function
1835399 - CVE-2020-11045 freerdp: out of bounds read in update_read_bitmap_data function
1835403 - CVE-2020-11046 freerdp: out of bounds seek in update_read_synchronize function could lead out of bounds read
1835762 - CVE-2020-11047 freerdp: out-of-bounds read in autodetect_recv_bandwidth_measure_results function
1835766 - CVE-2020-11048 freerdp: out-of-bounds read could result in aborting the session
1835772 - CVE-2020-11049 freerdp: out-of-bound read of client memory that is then passed on to the protocol parser
1835779 - CVE-2020-11058 freerdp: stream out-of-bounds seek in rdp_read_font_capability_set could lead to out-of-bounds read
1836223 - CVE-2020-11522 freerdp: out-of-bounds read in gdi.c
1836239 - CVE-2020-11525 freerdp: out-of-bounds read in bitmap.c
1836247 - CVE-2020-11526 freerdp: Stream pointer out of bounds in update_recv_secondary_order could lead out of bounds read later
1839744 - Rebuild vinagre against new freerdp
1841189 - CVE-2020-13396 freerdp: Out-of-bounds read in ntlm_read_ChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlm_message.c.
1841196 - CVE-2020-13397 freerdp: Out-of-bounds read in security_fips_decrypt in libfreerdp/core/security.c
1844161 - CVE-2020-11085 freerdp: out-of-bounds read in cliprdr_read_format_list function
1844166 - CVE-2020-11086 freerdp: out-of-bounds read in ntlm_read_ntlm_v2_client_challenge function
1844171 - CVE-2020-11087 freerdp: out-of-bounds read in ntlm_read_AuthenticateMessage
1844177 - CVE-2020-11088 freerdp: out-of-bounds read in ntlm_read_NegotiateMessage
1844184 - CVE-2020-11089 freerdp: out-of-bounds read in irp functions
1848008 - CVE-2020-11018 freerdp: Out of bound read in cliprdr_server_receive_capabilities
1848012 - CVE-2020-11019 freerdp: Out of bound read in update_recv could result in a crash
1848018 - CVE-2020-11038 freerdp: Integer overflow in VIDEO channel
1848022 - CVE-2020-11039 freerdp: Out of bound read/write in usb redirection channel
1848029 - CVE-2020-11040 freerdp: Out of bound access in clear_decompress_subcode_rlex
1848034 - CVE-2020-11041 freerdp: Unchecked read of array offset in rdpsnd_recv_wave2_pdu
1848038 - CVE-2020-11043 freerdp: out of bound read in rfx_process_message_tileset
6. Package List:
Red Hat Enterprise Linux AppStream (v. 8):
Source:
freerdp-2.1.1-1.el8.src.rpm
vinagre-3.22.0-23.el8.src.rpm
aarch64:
freerdp-2.1.1-1.el8.aarch64.rpm
freerdp-debuginfo-2.1.1-1.el8.aarch64.rpm
freerdp-debugsource-2.1.1-1.el8.aarch64.rpm
freerdp-libs-2.1.1-1.el8.aarch64.rpm
freerdp-libs-debuginfo-2.1.1-1.el8.aarch64.rpm
libwinpr-2.1.1-1.el8.aarch64.rpm
libwinpr-debuginfo-2.1.1-1.el8.aarch64.rpm
libwinpr-devel-2.1.1-1.el8.aarch64.rpm
vinagre-3.22.0-23.el8.aarch64.rpm
vinagre-debuginfo-3.22.0-23.el8.aarch64.rpm
vinagre-debugsource-3.22.0-23.el8.aarch64.rpm
ppc64le:
freerdp-2.1.1-1.el8.ppc64le.rpm
freerdp-debuginfo-2.1.1-1.el8.ppc64le.rpm
freerdp-debugsource-2.1.1-1.el8.ppc64le.rpm
freerdp-libs-2.1.1-1.el8.ppc64le.rpm
freerdp-libs-debuginfo-2.1.1-1.el8.ppc64le.rpm
libwinpr-2.1.1-1.el8.ppc64le.rpm
libwinpr-debuginfo-2.1.1-1.el8.ppc64le.rpm
libwinpr-devel-2.1.1-1.el8.ppc64le.rpm
vinagre-3.22.0-23.el8.ppc64le.rpm
vinagre-debuginfo-3.22.0-23.el8.ppc64le.rpm
vinagre-debugsource-3.22.0-23.el8.ppc64le.rpm
s390x:
freerdp-2.1.1-1.el8.s390x.rpm
freerdp-debuginfo-2.1.1-1.el8.s390x.rpm
freerdp-debugsource-2.1.1-1.el8.s390x.rpm
freerdp-libs-2.1.1-1.el8.s390x.rpm
freerdp-libs-debuginfo-2.1.1-1.el8.s390x.rpm
libwinpr-2.1.1-1.el8.s390x.rpm
libwinpr-debuginfo-2.1.1-1.el8.s390x.rpm
libwinpr-devel-2.1.1-1.el8.s390x.rpm
vinagre-3.22.0-23.el8.s390x.rpm
vinagre-debuginfo-3.22.0-23.el8.s390x.rpm
vinagre-debugsource-3.22.0-23.el8.s390x.rpm
x86_64:
freerdp-2.1.1-1.el8.x86_64.rpm
freerdp-debuginfo-2.1.1-1.el8.i686.rpm
freerdp-debuginfo-2.1.1-1.el8.x86_64.rpm
freerdp-debugsource-2.1.1-1.el8.i686.rpm
freerdp-debugsource-2.1.1-1.el8.x86_64.rpm
freerdp-libs-2.1.1-1.el8.i686.rpm
freerdp-libs-2.1.1-1.el8.x86_64.rpm
freerdp-libs-debuginfo-2.1.1-1.el8.i686.rpm
freerdp-libs-debuginfo-2.1.1-1.el8.x86_64.rpm
libwinpr-2.1.1-1.el8.i686.rpm
libwinpr-2.1.1-1.el8.x86_64.rpm
libwinpr-debuginfo-2.1.1-1.el8.i686.rpm
libwinpr-debuginfo-2.1.1-1.el8.x86_64.rpm
libwinpr-devel-2.1.1-1.el8.i686.rpm
libwinpr-devel-2.1.1-1.el8.x86_64.rpm
vinagre-3.22.0-23.el8.x86_64.rpm
vinagre-debuginfo-3.22.0-23.el8.x86_64.rpm
vinagre-debugsource-3.22.0-23.el8.x86_64.rpm
Red Hat CodeReady Linux Builder (v. 8):
aarch64:
freerdp-debuginfo-2.1.1-1.el8.aarch64.rpm
freerdp-debugsource-2.1.1-1.el8.aarch64.rpm
freerdp-devel-2.1.1-1.el8.aarch64.rpm
freerdp-libs-debuginfo-2.1.1-1.el8.aarch64.rpm
libwinpr-debuginfo-2.1.1-1.el8.aarch64.rpm
ppc64le:
freerdp-debuginfo-2.1.1-1.el8.ppc64le.rpm
freerdp-debugsource-2.1.1-1.el8.ppc64le.rpm
freerdp-devel-2.1.1-1.el8.ppc64le.rpm
freerdp-libs-debuginfo-2.1.1-1.el8.ppc64le.rpm
libwinpr-debuginfo-2.1.1-1.el8.ppc64le.rpm
s390x:
freerdp-debuginfo-2.1.1-1.el8.s390x.rpm
freerdp-debugsource-2.1.1-1.el8.s390x.rpm
freerdp-devel-2.1.1-1.el8.s390x.rpm
freerdp-libs-debuginfo-2.1.1-1.el8.s390x.rpm
libwinpr-debuginfo-2.1.1-1.el8.s390x.rpm
x86_64:
freerdp-debuginfo-2.1.1-1.el8.i686.rpm
freerdp-debuginfo-2.1.1-1.el8.x86_64.rpm
freerdp-debugsource-2.1.1-1.el8.i686.rpm
freerdp-debugsource-2.1.1-1.el8.x86_64.rpm
freerdp-devel-2.1.1-1.el8.i686.rpm
freerdp-devel-2.1.1-1.el8.x86_64.rpm
freerdp-libs-debuginfo-2.1.1-1.el8.i686.rpm
freerdp-libs-debuginfo-2.1.1-1.el8.x86_64.rpm
libwinpr-debuginfo-2.1.1-1.el8.i686.rpm
libwinpr-debuginfo-2.1.1-1.el8.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2020-11018
https://access.redhat.com/security/cve/CVE-2020-11019
https://access.redhat.com/security/cve/CVE-2020-11038
https://access.redhat.com/security/cve/CVE-2020-11039
https://access.redhat.com/security/cve/CVE-2020-11040
https://access.redhat.com/security/cve/CVE-2020-11041
https://access.redhat.com/security/cve/CVE-2020-11042
https://access.redhat.com/security/cve/CVE-2020-11043
https://access.redhat.com/security/cve/CVE-2020-11044
https://access.redhat.com/security/cve/CVE-2020-11045
https://access.redhat.com/security/cve/CVE-2020-11046
https://access.redhat.com/security/cve/CVE-2020-11047
https://access.redhat.com/security/cve/CVE-2020-11048
https://access.redhat.com/security/cve/CVE-2020-11049
https://access.redhat.com/security/cve/CVE-2020-11058
https://access.redhat.com/security/cve/CVE-2020-11085
https://access.redhat.com/security/cve/CVE-2020-11086
https://access.redhat.com/security/cve/CVE-2020-11087
https://access.redhat.com/security/cve/CVE-2020-11088
https://access.redhat.com/security/cve/CVE-2020-11089
https://access.redhat.com/security/cve/CVE-2020-11522
https://access.redhat.com/security/cve/CVE-2020-11525
https://access.redhat.com/security/cve/CVE-2020-11526
https://access.redhat.com/security/cve/CVE-2020-13396
https://access.redhat.com/security/cve/CVE-2020-13397
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/
8. Contact:
The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2020 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBX6I0INzjgjWX9erEAQh3aA//RtOjgT5U/N0RZODK/NW0Ie1HZFE1NIlA
P6lqlGko8xf7ojkAfzKYqsfipMmencaYrVc0dqCUd5WoJttkVQzWpsTZb8qDaCW8
Q7ps0gwyLYZnTCFc1j0NYV35E8tSoyRj+IkDTdpTiSQlr6+bczxhIILqi1hoM3fa
IJ91rqM4JzhXlFzOZMMi+xCHVxoszrbFf2ivJkCr9esJF+4N0R1ec31JhtxPEcc7
rG5eB1c3sIoKeIn4PYJ9duj6i+0AOcBuhbFArXqE1aPy/InfVaQltgwzR1ZF9HVS
SFompoeTPs6iEp0KpcoM7xNtGeUO50OhR3j2NRseiS72+TB+N3091wwHBWZ1n7Jb
SWCV1ZduvfQcnIWRMUjtgk5lPzuRTvotip/BwOaaKMOs7Xzh7Y6wvlIbFMDWt2YY
V5qbxKG32Zt53Sq9m8KJ15aRKJt5K1UdPDV6KnKzjHATcIazWyCWhy5c/T5zWcMq
qk+dmZv8/EA4pKaXYxkG836ZTccOftXAM3U6zUfB60Bm5ehXR45HRRuZub4C97to
+eP+HvgIR5+mCO62hEZfjnC8c4mJIryJaAWnb8hpaQgWXZnTdEl4oQAh/zIJl61X
BkYiCJ0fgTO6D7CGe72mORCx1FQ7Sjq1chhqpl8CZQKLaqJx1xbJ2ZZwuhg5OriJ
FwblVM9hMdA=
=mptC
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBX6TFw+NLKJtyKPYoAQgLwBAApKDeLOTBCoFIQePJCGD7guuIekLeAcVP
3gq4wikveS8qkUzu3xV0SPbchksON0cJHmaiAj4GoxTO+RZbvqENgykcHGRj4AwI
AFsL6o5hZPtKMSCsENsEdW0NJT3lpn9erBEG+sNrNXcM/F9+7uzz0gf0n3iBjRPY
LdyZlJl47nFR5UB7c7iYwSSReL389/xe0D8CHJohiqYcSqyi5e+m7qY/fJLr5JQC
YXKQWZaotkG3UDEVigwWpye7P8dGKz6iSWkfY7HCzhQ5JpsoKeK/uo3VlQ4+P1cI
Moush+ybAOwME1i4ueWtFK5SZMvmhsVZpE23Cw1OpKnl+l2wgDowVTexZETMPf88
3Auh8MDJWru1WO4CixEPzu3ZqvAqWoTTGK36sHw2WnCeAwLuUQRMojqgosvw2Djf
/YBGIVl2kvgEzICQAovJYbmkv5vcr8o4hotcxE71x94dtAnOHQTl9OdUpjGJcGfK
AokzRn2HEGASaoDQ7G0WzKlVk7yBXtes5wykKc0aEL+Pfczku31iz/WeekefVb0U
Obk0dGCt8Qt6xfsDCinialw3u5+Z6H+YSq9wWn4108gR9CB2OrIhIKh696f40XGl
7lbr9l/miTnGyvjBpB00DzkLbQNgcuy8/8ObKx0+nmg3BmyAwk7sIIEHjTx95zPC
bPuhpPylT6g=
=d7Vt
-----END PGP SIGNATURE-----
The post ESB-2020.3901 – [RedHat] freerdp and vinagre: Multiple vulnerabilities appeared first on Malware Devil.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2020.3900
SDL security update
6 November 2020
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: SDL
Publisher: Red Hat
Operating System: Red Hat
Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Denial of Service -- Remote/Unauthenticated
Access Confidential Data -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2019-7638 CVE-2019-7637 CVE-2019-7636
CVE-2019-7635 CVE-2019-7578 CVE-2019-7577
CVE-2019-7576 CVE-2019-7575 CVE-2019-7574
CVE-2019-7573 CVE-2019-7572
Reference: ESB-2020.3383
ESB-2020.0169
ESB-2019.3862
ESB-2019.3857
Original Bulletin:
https://access.redhat.com/errata/RHSA-2020:4627
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: SDL security update
Advisory ID: RHSA-2020:4627-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2020:4627
Issue date: 2020-11-03
CVE Names: CVE-2019-7572 CVE-2019-7573 CVE-2019-7574
CVE-2019-7575 CVE-2019-7576 CVE-2019-7577
CVE-2019-7578 CVE-2019-7635 CVE-2019-7636
CVE-2019-7637 CVE-2019-7638
=====================================================================
1. Summary:
An update for SDL is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AppStream (v. 8) - aarch64, ppc64le, s390x, x86_64
3. Description:
Simple DirectMedia Layer (SDL) is a cross-platform multimedia library
designed to provide fast access to the graphics frame buffer and audio
device.
Security Fix(es):
* SDL: buffer over-read in IMA_ADPCM_nibble in audio/SDL_wave.c
(CVE-2019-7572)
* SDL: heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c
(CVE-2019-7575)
* SDL: heap-based buffer over-read in SDL_GetRGB in video/SDL_pixels.c
(CVE-2019-7636)
* SDL: heap-based buffer overflow in SDL_FillRect in video/SDL_surface.c
(CVE-2019-7637)
* SDL: heap-based buffer over-read in Map1toN in video/SDL_pixels.c
(CVE-2019-7638)
* SDL: heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c
(CVE-2019-7573)
* SDL: heap-based buffer over-read in IMA_ADPCM_decode in audio/SDL_wave.c
(CVE-2019-7574)
* SDL: heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c
(CVE-2019-7576)
* SDL: buffer over-read in SDL_LoadWAV_RW in audio/SDL_wave.c
(CVE-2019-7577)
* SDL: heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c
(CVE-2019-7578)
* SDL: heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c
(CVE-2019-7635)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat
Enterprise Linux 8.3 Release Notes linked from the References section.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1676509 - CVE-2019-7577 SDL: buffer over-read in SDL_LoadWAV_RW in audio/SDL_wave.c
1676743 - CVE-2019-7575 SDL: heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c
1676749 - CVE-2019-7574 SDL: heap-based buffer over-read in IMA_ADPCM_decode in audio/SDL_wave.c
1676751 - CVE-2019-7573 SDL: heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c
1676753 - CVE-2019-7572 SDL: buffer over-read in IMA_ADPCM_nibble in audio/SDL_wave.c
1676755 - CVE-2019-7576 SDL: heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c
1676781 - CVE-2019-7578 SDL: heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c
1677143 - CVE-2019-7638 SDL: heap-based buffer over-read in Map1toN in video/SDL_pixels.c
1677151 - CVE-2019-7637 SDL: heap-based buffer overflow in SDL_FillRect in video/SDL_surface.c
1677156 - CVE-2019-7636 SDL: heap-based buffer over-read in SDL_GetRGB in video/SDL_pixels.c
1677158 - CVE-2019-7635 SDL: heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c
6. Package List:
Red Hat Enterprise Linux AppStream (v. 8):
Source:
SDL-1.2.15-38.el8.src.rpm
aarch64:
SDL-1.2.15-38.el8.aarch64.rpm
SDL-debuginfo-1.2.15-38.el8.aarch64.rpm
SDL-debugsource-1.2.15-38.el8.aarch64.rpm
SDL-devel-1.2.15-38.el8.aarch64.rpm
ppc64le:
SDL-1.2.15-38.el8.ppc64le.rpm
SDL-debuginfo-1.2.15-38.el8.ppc64le.rpm
SDL-debugsource-1.2.15-38.el8.ppc64le.rpm
SDL-devel-1.2.15-38.el8.ppc64le.rpm
s390x:
SDL-1.2.15-38.el8.s390x.rpm
SDL-debuginfo-1.2.15-38.el8.s390x.rpm
SDL-debugsource-1.2.15-38.el8.s390x.rpm
SDL-devel-1.2.15-38.el8.s390x.rpm
x86_64:
SDL-1.2.15-38.el8.i686.rpm
SDL-1.2.15-38.el8.x86_64.rpm
SDL-debuginfo-1.2.15-38.el8.i686.rpm
SDL-debuginfo-1.2.15-38.el8.x86_64.rpm
SDL-debugsource-1.2.15-38.el8.i686.rpm
SDL-debugsource-1.2.15-38.el8.x86_64.rpm
SDL-devel-1.2.15-38.el8.i686.rpm
SDL-devel-1.2.15-38.el8.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2019-7572
https://access.redhat.com/security/cve/CVE-2019-7573
https://access.redhat.com/security/cve/CVE-2019-7574
https://access.redhat.com/security/cve/CVE-2019-7575
https://access.redhat.com/security/cve/CVE-2019-7576
https://access.redhat.com/security/cve/CVE-2019-7577
https://access.redhat.com/security/cve/CVE-2019-7578
https://access.redhat.com/security/cve/CVE-2019-7635
https://access.redhat.com/security/cve/CVE-2019-7636
https://access.redhat.com/security/cve/CVE-2019-7637
https://access.redhat.com/security/cve/CVE-2019-7638
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/
8. Contact:
The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2020 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBX6I2G9zjgjWX9erEAQjnCBAAnAeTnQGAIRZiwyhzOUN5vvtVQdIYif42
Ek4NaB4T8Yoq72s1Iae++8RGeI891Lp0GWLhcVpZT/1gwBRacrapPoQ2OG+29baJ
rxO5a00gYtPn7SVqNOpoViecP1BGq8M6M6Yn8btn7oXlfDDBwXhgz4L8fsGBoFdq
iiSafojwXT1jFECuMpNxB9/0DwaEkzjuVoGO40FsGSgklUB8NXTLWg0T+YP4gQQl
WgmCJ4Bu16pEm9e59DPUsGSvgj6ymMp1KGKy2XObaymIMcas9NtgkXsI6FZBc4aM
EKcDi+/Y8SIfdB0b4r/Ey9Y8mLLA5rvv2JrsNvg0JIn1Ym/Ah8CDUcnDZL2drkGy
S1nVQLgtQWL7o5JpubdiXoqKXH2xWKOfpIpjMvVxxPDwo5qztenVa5/Vb4eFsxWn
5f4/tfGVeCgW3w7dFRLqTFkIlHoRP7++lWarLbzgJrwYnQhAJuaMmMtQ2DkaKOxt
cw/izAzqNCJfiQxLkYMx0/oz9WbrCoYa1bgVAR/npWEoFt3K3THdlUz33e5UiV/O
YpZ3kjSiQJKl7dA2euUn0r3rfr6G8sj7RhLpkHfommBjbj3UBXQ78+7hvOfncOGz
BcremoCLJZl/9vHtBpd2ailN1YVbKnFJ8UfdbZdjzv+64dyJdONUb2SgJJhj/edW
V9y2K3/vRUo=
=vXxa
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBX6TFtONLKJtyKPYoAQghdw//dk+szyMo82/2pBtjlSJi6wq14lOzkFZS
hQt6S5AyrTjFjTXm5uwCNEL6vPcrk7mdSBGLlv2thLuT9njvtj40MeTupzKTFULy
nJDLsJuDnp4ACZMnE5oyIKQvgTahZG7lpIhEigEYU8DqNwhjXAU6UXJWr2JqP2Bq
2CPE4kCcMEoW5/V2iMnnuUJNl4v9GsyFSk4QHni5qEX6bPLIhk9jRKmQlN4qO0T6
zTlCMWJlUAneg8WZMlXs+VH4h/FeTcnf+d1vgAxEFhueW9kjNlgnkhvXB18np/lt
fCh/11HJCHg6kXIiVUOZk7FOOcz1NFRdZltibq1BPYoU7SBNjp2K0bo0B5Ysm+ra
KvmNgOAsuZXVRldg1A0RBraWRFZMokc83OWsu/gC2NiqIRytLuUXMy7LQrpOwcd2
M+muKe7GaVl7hXhfeMwtY0tsOM7ngNsaCXNwinc95mIrQjxDMoNsqmAAQ4hoS1NE
ayywRqoYDYhbzPQoKF1c3zhZ+j5aJLWa9BQZuf2tol1rZK+q8QUxYLWwOXs9gK3a
VgQmawgb5OewiiwPlJMPRLrRETsGqmN9DFw6m87+uPkS3NHbi6f/GFb7Nb6H0m5N
YC4x1+ydj5gK8ikE337gG7kOqpqW3pddUyTrAsVPLf8RtCyQnvfrMTpqtylPfPXN
JHvoesfp+jk=
=DnuF
-----END PGP SIGNATURE-----
The post ESB-2020.3900 – [RedHat] SDL: Multiple vulnerabilities appeared first on Malware Devil.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2020.3899
libonig security update
6 November 2020
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: libonig
Publisher: Debian
Operating System: Debian GNU/Linux
Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Denial of Service -- Remote/Unauthenticated
Access Confidential Data -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2020-26159 CVE-2019-19246 CVE-2019-19204
CVE-2019-19203 CVE-2019-19012 CVE-2019-16163
CVE-2019-13224
Reference: ESB-2020.3072
ESB-2020.2827
ESB-2019.4556
ESB-2019.3485
Original Bulletin:
https://lists.debian.org/debian-lts-announce/2020/11/msg00006.html
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- - -------------------------------------------------------------------------
Debian LTS Advisory DLA-2431-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Markus Koschany
November 05, 2020 https://wiki.debian.org/LTS
- - -------------------------------------------------------------------------
Package : libonig
Version : 6.1.3-2+deb9u1
CVE ID : CVE-2019-13224 CVE-2019-16163 CVE-2019-19012
CVE-2019-19203 CVE-2019-19204 CVE-2019-19246
CVE-2020-26159
Debian Bug : 931878 939988 944959 945312 945313 946344 972113
Several vulnerabilities were discovered in the Oniguruma regular
expressions library, notably used in PHP mbstring.
CVE-2019-13224
A use-after-free in onig_new_deluxe() in regext.c allows
attackers to potentially cause information disclosure, denial of
service, or possibly code execution by providing a crafted regular
expression. The attacker provides a pair of a regex pattern and a
string, with a multi-byte encoding that gets handled by
onig_new_deluxe().
CVE-2019-16163
Oniguruma allows Stack Exhaustion in regcomp.c because of recursion
in regparse.c.
CVE-2019-19012
An integer overflow in the search_in_range function in regexec.c in
Onigurama leads to an out-of-bounds read, in which the offset of
this read is under the control of an attacker. (This only affects
the 32-bit compiled version). Remote attackers can cause a
denial-of-service or information disclosure, or possibly have
unspecified other impact, via a crafted regular expression.
CVE-2019-19203
An issue was discovered in Oniguruma. In the function
gb18030_mbc_enc_len in file gb18030.c, a UChar pointer is
dereferenced without checking if it passed the end of the matched
string. This leads to a heap-based buffer over-read.
CVE-2019-19204
An issue was discovered in Oniguruma. In the function
fetch_interval_quantifier (formerly known as fetch_range_quantifier)
in regparse.c, PFETCH is called without checking PEND. This leads to
a heap-based buffer over-read.
CVE-2019-19246
Oniguruma has a heap-based buffer over-read in str_lower_case_match
in regexec.c.
CVE-2020-26159
In Oniguruma an attacker able to supply a regular expression for
compilation may be able to overflow a buffer by one byte in
concat_opt_exact_str in src/regcomp.c
For Debian 9 stretch, these problems have been fixed in version
6.1.3-2+deb9u1.
We recommend that you upgrade your libonig packages.
For the detailed security status of libonig please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libonig
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
- -----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEErPPQiO8y7e9qGoNf2a0UuVE7UeQFAl+jVXVfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEFD
RjNEMDg4RUYzMkVERUY2QTFBODM1RkQ5QUQxNEI5NTEzQjUxRTQACgkQ2a0UuVE7
UeRyuA/8DsmKwP4PqQ7ud9HQ/jkpqF6EdEpYJKTWFLvpeNW5RKuwRwI0XVXEfaVE
IQKdtu17GUYJIWDvvvS0RLzlqoEeiHvEfKZBMHRid7sxn6ydu3w4NE4vL1j5joIo
aNSRXWwSe6a5Z17x9n6QJ9QRgKCtWCCnO7H4iYM7WUzcXQqcT+EIj3CPnBcz2Yz1
kd/1csK8JJms2quxFdI34I+fdr1lIhX+KPWzGxcBs5cmKQ/Tk8NV5pCt77dfyGzk
dFiu6UivaAvcwmi3edvLT+lFkZF05j27hIyt+RbMjDzQ0E4hYeYqGAVrJVUkZyFT
dB+7gGHxD2xYgox3G5AAIfBCxEe88VY+w1JsV51NztRYZLi2xJPwnjZnVv10ZaG1
mA47tbeiSrc6iOHXZgw/kr1LL0+5/LxvtOMhC5Z5VwTAdk8SvUGU/eN1vnhYw5Jw
G1tIssLYddKj9ttIbpm/gzC3fm4QyxjYETg3q7275eq1E2hCWqD81SCwszjVe+sV
IPn84OokjMo5SWkX6YSunGXCGYD9MIkGeHkFKoDhI2DKbbBJcdEbb5iFAkG/sZLf
U7hABzCVVE6ZSdwq20yjuHBpxqUZeKeog6O/L20TzsVvGNeHMJAyb8L+5kNDpoZU
EbG57R3WtwP5UbGUvGnLsIUBrKrpvNXdpq+4Fh1KKd2L8byQk1g=
=JaKD
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBX6TFhONLKJtyKPYoAQjK/BAAqGwycn311v2rUn0BcnyejNxAtzhLxMrF
Y4DDXvRiL07dEx+utrVIni4kQVitV700Sqr3gTgFKiV1zxLKj353xd8zstfqkwYe
ynVxFiUKdcm0BYBEQc1UZx45ezbwIggNe/hQ3CQUiikw76bC0Uk8djVEmsAah2iR
PrbRbYOXmxbr9456nW2NvwGSsQ3l1YApljxZNpxOW5HzXQayg8a9Ra+/e0TvIwCH
1u/h9esAiRqO18ln5dmJFdNEK0sZl6ypFNRpc1utcawyVAn07AseCo2PYdNTSA/V
WLcABcEmZCa4fKZ9TaPp6WpxLu3Zha0JuNi6a9b0/Y3UzXuXLQKpAdCNgmus735x
xo6smGbXxkK//gA08sizBdcbPMU5rwJSjKB5ntqp/nSQWIo/sVAzBZuthutywihK
1c5q3grS0PeofWubRKyS013ZF5wZhmrXYvAf3+Rvs9pOLV9e4EM27iDZrHnU9IsU
Rc421RQtwtKwmsAnqO2Mrl80oTbbv73K5aHvBlaMNZxekU4RF/x/McdQdTEIiKyW
qZlxydFwkikDvh1BfwNRw08rAIJxVKGLWgFBuBZ9tSxhExORromIaMVqgfDGnXWF
MkUWORlxfNeINTJ5kYwKIM8qyfeZg5sw7yvhtPBUDJP5YnWeeLhnWe+O1epLRf6v
XiPFDbx1eCQ=
=dYWp
-----END PGP SIGNATURE-----
The post ESB-2020.3899 – [Debian] libonig: Multiple vulnerabilities appeared first on Malware Devil.
Learn how JWTs are implemented, both the correct way and the insecure way. Spoiler alert, most implement them insecurely. Sven will also show you some of the common attacks against JWTs, for use in your next penetration test, bug bounty, or conversation with your developers!
This segment is sponsored by Netsparker.
Visit https://securityweekly.com/netsparker to learn more about them!
Visit https://www.securityweekly.com/psw for all the latest episodes!
Show Notes: https://wiki.securityweekly.com/psw673
The post Abusing JWT (JSON Web Tokens) – Sven Morgenroth – PSW #673 appeared first on Malware Devil.
Emotet is a modular malware delivery platform that has consistently dominated the commodity malware threat landscape over the past couple of years. It has evolved from a straightforward banking trojan into a full-fledged malware distribution service, delivering a variety of payloads for other threat actor groups. The U.S. Department of Homeland Security states that Emotet infections cost state and local governments up to $1 million to remediate. Emotet is operated by the threat group tracked as Mummy Spider.
Emotet is commonly delivered in phishing campaigns via a macro-enabled Word document. I recently had a newer Emotet maldoc, come across my desk. The part that interested my about this document was that the PowerShell obfuscation scheme had changed significantly for the first time in a few months. I thought it would be worthwhile to write a quick post with a few details about this new PowerShell script and provide a handy CyberChef recipe so that analysts and responders could quickly decode these PowerShell Scripts.
I won’t dig as deep as I usually do here as Brad Duncan has already done a nice writeup on this campaign over at the SANS ISC blog. If readers are interested in seeing more details regarding dynamic analysis, I highly recommend checking it out here.
The overall infection chain in this case remains pretty much the same: a malicious Word document that is weaponized with macros is opened, which invokes a WMI process call that spawns a PowerShell script. That script attempts to download the core binary from a septet of URL resources.
This document was related to the spam runs from 10/29/20 and leveraged a Halloween Party-themed social engineering lure.
I pulled the document down from VirusTotal. These campaigns still appear to using the “upgrade your edition of Microsoft Word” template in order to induce the victim into enabling macros. Much more about related campaigns is available thanks to the incredible work of the Cryptolaemus team here.
The PowerShell script that is executed when macros are enabled is base64 encoded per usual. Peeling back the first layer of obfuscation reveals the following:
The URLs that are hosting the next stage payload, which is the Emotet loader are obfuscated with a string replacement operation. This is slightly more complex that in the recent techniques, but still leverages an empty string replacement for ‘[]w’ and ‘ jjkgS []’, while a character replacement is used to swap ‘][ 1’ for the slash ‘/’ character. At that point, an analyst would just need to split the the string at the “@” delimeter, use a regular expression to isolate URL patterns, and then defang for sharing.
hxxps[://]enjoymylifecheryl[.]com/wp-includes/FPNxoUiCz3/
hxxps[://]homewatchamelia[.]com/wp-admin/qmK/
hxxps[://]seramporemunicipality[.]org/replacement-vin/Ql4R/
hxxps[://]imperfectdream[.]com/wp-content/xb2csjPW6/
hxxps[://]mayxaycafe[.]net/wp-includes/UxdWFzYQj/
hxxps[://]420extracts[.]ca/cgi-bin/Ecv/
hxxps[://]casinopalacett[.]com/wp-admin/voZDArg/Here is the code for the recipe in Chef format, which I also have on my GitHub:
From_Base64('A-Za-z0-9+/=',true)
Remove_null_bytes()
Find_/_Replace({'option':'Simple string','string':'+'},'',true,false,true,false)
Find_/_Replace({'option':'Simple string','string':'('},'',true,false,true,false)
Find_/_Replace({'option':'Simple string','string':')'},'',true,false,true,false)
Find_/_Replace({'option':'Simple string','string':'''},'',true,false,true,false)
Find_/_Replace({'option':'Simple string','string':'[]w'},'',true,false,true,false)
Find_/_Replace({'option':'Simple string','string':' jjkgS []'},'',true,false,true,false)
Find_/_Replace({'option':'Simple string','string':'][ 1'},'/',true,false,true,false)
Split('@','\n')
Remove_whitespace(true,false,false,false,false,false)
Regular_expression('URL','([A-Za-z]+://)([-\w]+(?:\.\w[-\w]*)+)(:\d+)?(/[^.!,?"<>\[\]{}\s\x7F-\xFF]*(?:[.!,?]+[^.!,?"<>\[\]{}\s\x7F-\xFF]+)*)?',true,true,false,false,false,false,'List matches')
Defang_URL(true,true,true,'Valid domains and full URLs')This Direct Link has the recipe already preloaded in CyberChef.
So that’s it. Just a quick look at some new PowerShell obfuscation used by Mummy Spider in recent campaigns. These tactics used to change quite frequently but the cadence of updates has slowed considerably as of late. As always, CyberChef is my preferred tool for de-obfuscating these scripts to quickly extract the network indicators of compromise in order to increase velocity during and Incident Response investigation.
https://malpedia.caad.fkie.fraunhofer.de/details/win.emotet
https://www.us-cert.gov/ncas/alerts/TA18-201A
https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-february-mummy-spider/
https://gchq.github.io/CyberChef/
https://isc.sans.edu/forums/diary/Emotet+Qakbot+more+Emotet/26750/
https://www.virustotal.com/gui/file/ed51269c3602786ff6ddef3a808d8178d26e4e5960f4ac7af765e4bd642128dd/detection
https://paste.cryptolaemus.com/emotet/2020/10/29/emotet-malware-IoCs_10-29-20.html
https://github.com/Sec-Soup/CyberChef-Recipes/blob/master/Emotet-Recipe_20200826The post Quick Post: Spooky New PowerShell Obfuscation in Emotet Maldocs appeared first on Malware Devil.
A brief daily summary of what is important in cybersecurity. The podcast is published every weekday and designed to get you ready for the day with a brief, usually about 5 minutes long, summary of current network security-related events. The content is late breaking, educational and based on listener input as well as on input received by the SANS Internet Storm Center. You may submit questions and comments via our contact form at https://isc.sans.edu/contact.html .
The post Network Security News Summary for Friday November 6 2020 appeared first on Malware Devil.
In 1801, the United States had a small Navy. Thomas Jefferson deployed almost half that Navy—three frigates and a schooner—to the Barbary C...
