CONTENTS:

NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES 2016-01-19 - 2016-01-26

TOP VULNERABILITY THIS WEEK: Oracle Releases Quarterly Critical Patch

Update Advisory for Various Products

NOTABLE RECENT SECURITY ISSUES SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

Title: Oracle Releases Quarterly Critical Patch Update Advisory for
Various Products
Description: Oracle has released their quarterly Critical Patch Update
security advisory which addresses 248 vulnerabilities in various
products, such as Java, Oracle Database, and many others. Eight
vulnerabilities within Java were addressed in this advisory with three
of them receiving a CVSS 2.0 score of 10.0. Additionally, two
vulnerabilities which received a CVSS 2.0 score of 10.0 in Oracle
GoldenGate were addressed in this release.
Reference: http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
Snort SID: Detection pending release of vulnerability information

Title: FreeBSD Addresses SCTP ICMPv6 Error Message Flaw That Could
Result in a Kernel Panic
Description: The FreeBSD Project has release a security advisory for a
flaw that could cause a kernel panic, creating a denial of service
condition. CVE-2016-1879 manifests as a “lack of proper input checks in
the ICMPv6 processing in the SCTP stack” which results in a failed
kernel assertion or a NULL pointer dereference. A remote,
unauthenticated attacker could cause a vulnerable system to kernel
panic, creating a denial of service condition. Note that IPv4 ICMP
processing is not impacted. The FreeBSD Project has released an update
to address this flaw.
Reference: https://www.freebsd.org/security/advisories/FreeBSD-SA-16:01.sctp.asc
Snort SID: Detection pending

Title: Hardcoded Credentials Found within AMX Conferencing Products -
Patch Released
Description: Researchers at SEC Consult have discovered a set of
hardcoded credentials in AMX Conferencing Products that could be used
to log into devices with administrative privileges. Per the advisory,
the system inserts a set of administrative credentials into the internal
user database upon system boot. As a result, an attacker with knowledge
of the username and password would able to log into vulnerable devices
via the web interface or via SSH. Although AMX has released a patch to
address the issue, it has not been tested and verified to ensure the
credentials have been removed from the software.
Reference: http://blog.sec-consult.com/2016/01/deliberately-hidden-backdoor-account-in.html

INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY

Analysis of iOS & OS X Vulnerability: CVE-2016-1722
https://blog.zimperium.com/analysis-of-ios-os-x-vulnerability-cve-2016-1722/

Deep Analysis of CVE-2016-0010 - Microsoft Office RTF File Handling Heap
Overflow Vulnerability
http://blog.fortinet.com/post/deep-analysis-of-cve-2016-0010-microsoft-office-rtf-file-handling-heap-overflow-vulnerability

Amazon Certificate Manager Brings Free SSL Certs to AWS Users
https://threatpost.com/amazon-certificate-manager-brings-free-ssl-certs-to-aws-users/116025/

CVE-2015-8651 (Flash up to 20.0.0.228/235) and Exploit Kits
http://malware.dontneedcoffee.com/2016/01/cve-2015-8651.html

RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM

This is a list of recent vulnerabilities for which exploits are
available. System administrators can use this list to help in
prioritization of their remediation activities. The Qualys Vulnerability
Research Team compiles this information based on various exploit
frameworks, exploit databases, exploit kits and monitoring of internet
activity.

ID: CVE-2015-8651
Title: Adobe Flash Player Unspecified Code Execution Vulnerability
Vendor: Adobe
Description: Integer overflow in Adobe Flash Player before 18.0.0.324
and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before
11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before
20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows
attackers to execute arbitrary code via unspecified vectors.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: CVE-2015-7755
Title: Juniper ScreenOS Multiple Security Issues
Vendor: Juniper
Description: Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before
6.3.0r12b, 6.3.0r13 before 6.3.0r13b, 6.3.0r14 before 6.3.0r14b,
6.3.0r15 before 6.3.0r15b, 6.3.0r16 before 6.3.0r16b, 6.3.0r17 before
6.3.0r17b, 6.3.0r18 before 6.3.0r18b, 6.3.0r19 before 6.3.0r19b, and
6.3.0r20 before 6.3.0r21 allows remote attackers to obtain
administrative access by entering an unspecified password during a (1)
SSH or (2) TELNET session.
CVSS v2 Base Score: 10.0 (HIGH) (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: CVE-2015-6132
Title: Microsoft Windows Library Loading Input Validation Remote Code
Execution Vulnerability
Vendor: Microsoft
Description: Microsoft Windows Vista SP2, Windows Server 2008 SP2 and
R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold
and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 mishandle
library loading, which allows local users to gain privileges via a
crafted application, aka “Windows Library Loading Remote Code Execution
Vulnerability.”
CVSS v2 Base Score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)

ID: CVE-2014-4114
Title: Microsoft Windows OLE - Remote Code Execution “Sandworm” Exploit
(MS14-060)
Vendor: Microsoft
Description: Microsoft Windows Vista SP2, Windows Server 2008 SP2 and
R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold
and R2, and Windows RT Gold and 8.1 allow remote attackers to execute
arbitrary code via a crafted OLE object in an Office document, as
exploited in the wild with a “Sandworm” attack in June through October
2014, aka “Windows OLE Remote Code Execution Vulnerability.”
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: CVE-2015-7645
Title: Adobe Flash Player Code Execution Vulnerability (APSB15-27)
Vendor: Adobe
Description: Adobe Flash Player 18.x through 18.0.0.252 and 19.x through
19.0.0.207 on Windows and OS X and 11.x through 11.2.202.535 on Linux
allows remote attackers to execute arbitrary code via a crafted SWF
file, as exploited in the wild in October 2015.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: CVE-2015-2509
Title: Microsoft Windows Media Center MCL Vulnerability (MS15-100)
Vendor: Microsoft
Description: Windows Media Center in Microsoft Windows Vista SP2,
Windows 7 SP1, Windows 8, and Windows 8.1 allows user-assisted remote
attackers to execute arbitrary code via a crafted Media Center link
(mcl) file, aka “Windows Media Center RCE Vulnerability.”
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: CVE-2014-6332
Title: Microsoft Windows OLE Automation Array Memory Corruption Code
Execution Vulnerability (MS14-064)
Vendor: Microsoft
Description: OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2,
Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1,
Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT
Gold and 8.1 allows remote attackers to execute arbitrary code via a
crafted web site, as demonstrated by an array-redimensioning attempt
that triggers improper handling of a size value in the SafeArrayDimen
function, aka “Windows OLE Automation Array Remote Code Execution
Vulnerability.”
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

MOST PREVALENT MALWARE FILES 2016-01-19 - 2016-01-26 COMPILED BY TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

SHA 256: F0200428A8E7B6B51FF92C6D71D85B99AD8B80F0382C3A9C9C2F4DC73F3E5240
MD5: 188ff507561f9882729b117cb411af8e
VirusTotal:
https://www.virustotal.com/file/F0200428A8E7B6B51FF92C6D71D85B99AD8B80F0382C3A9C9C2F4DC73F3E5240/analysis/#additional-info
Typical Filename: ApplicationManager
Claimed Product: ApplicationManager
Detection Name: OSX.Variant:SpigotD.19cg.1201

SHA 256: 0D520C646F3B0DCDCDCF927BEA692EB9B1911A331164BD6CE60785CE786C97A7
MD5: 5d3ae75ff3271d99f883b02273a056cc
VirusTotal:
https://www.virustotal.com/file/0D520C646F3B0DCDCDCF927BEA692EB9B1911A331164BD6CE60785CE786C97A7/analysis/#additional-info
Typical Filename: PrinterInstallerClientUpdater.exe
Claimed Product: N/A
Detection Name: W32.0D520C646F-100.SBX.VIOC

SHA 256: AC59FB59BBD17C0DBED4A9B2AD12865E8A6C2E77EC88A6F426F8BE676C650CBC
MD5: 5e19f560eaac49ec518f8a8f1e644275
VirusTotal:
https://www.virustotal.com/file/AC59FB59BBD17C0DBED4A9B2AD12865E8A6C2E77EC88A6F426F8BE676C650CBC/analysis/#additional-info
Typical Filename: UpdatePlatform.exe
Claimed Product: Update Platform Application
Detection Name: W32.AC59FB59BB-100.SBX.VIOC

SHA 256: 1AAC3FAA856E033F73E3FC43E8434DFC6B317B7CE9FCE65BD63EFFB130E5D280
MD5: 702577de14f6456cfa96189ffac92d56
VirusTotal:
https://www.virustotal.com/file/1AAC3FAA856E033F73E3FC43E8434DFC6B317B7CE9FCE65BD63EFFB130E5D280/analysis/#additional-info
Typical Filename: SogouSoftwareInstPack.exe
Claimed Product: N/A
Detection Name: W32.Trojan.18n4.1201

SHA 256: 8CA8BBFE71341D3E55091BF073599BFB176ACFEBF08509E3D3C25F4DAEB6113A
MD5: d3b3f4319f5847b27cd66dbce901643d
VirusTotal:
https://www.virustotal.com/file/8CA8BBFE71341D3E55091BF073599BFB176ACFEBF08509E3D3C25F4DAEB6113A/analysis/#additional-info
Typical Filename: ProgramManager.exe
Claimed Product: Program Manager
Detection Name: W32.Droppergen.18n0.1201