CONTENTS:

NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES 2016-02-16 - 2016-02-23

TOP VULNERABILITY THIS WEEK: Patches for buffer overflow flaw in glibc

client-side DNS resolver rolling out

NOTABLE RECENT SECURITY ISSUES SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

Title: Comodo Internet Security Found to Install and Expose a VNC Server
Description: Tavis Oramandy of Google Project Zero has identified and
disclosed a security flaw within Comodo Internet Security suite. During
installation of Comodo Internet Security, it’s found that the default
configuration will also install an application called “GeekBuddy” which
contains a VNC server that is enabled by default. The password to the
VNC has been found to be weakly generated which could allow an attacker
to connect to a system where this application is installed and execute
arbitrary commands on the targeted machine. Comodo has released a hotfix
to address the flaw.
Reference: https://code.google.com/p/google-security-research/issues/detail?id=703

Title: Linux Mint Website Compromised, Found to Redirect Users to ISOs
Containing Malware
Description: The Linux Mint Project has disclosed that over the weekend
its website was compromised and redirected users who were looking to
download a Linux Mint 17.3 Cinnamon ISO to one containing a backdoor.
The Linux Mint Project has also disclosed that forums were also
compromised and attackers potentially stole usernames, email addresses,
encrypted copies of passwords, and other personal information that a
user might have put into their forum profile. Note that users who
download Linux Mint 17.3 Cinnamon via a direct HTTP link or via torrents
are unaffected. Researchers have indicated that the compromised ISO
contains malware identified as Tsunami. The Linux Mint website has been
fixed and no longer point users to the malicious ISO.
Reference: http://blog.linuxmint.com/?p=2994

INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY

Apple CEO Tim Cook Opposes Court Order to Hack San Bernardino Shooter’s
Phone
https://threatpost.com/apples-cook-opposes-court-order-to-hack-san-bernardino-shooters-phone/116274/

Using EMET To Disable EMET
https://www.fireeye.com/blog/threat-research/2016/02/using_emet_to_disabl.html

Analysis of CVE-2016-0059 - Microsoft IE Information Disclosure
Vulnerability
http://blog.fortinet.com/post/analysis-of-cve-2016-0059-microsoft-ie-information-disclosure-vulnerability-discovered-by-fortinet

A curated list of awesome Windows Exploitation resources
https://n0where.net/awesome-windows-exploitation-resources/

QAKBOT Resurges: Despite Takedowns, Online Banking Threats Persist
http://blog.trendmicro.com/trendlabs-security-intelligence/despite-arrests-and-takedowns-online-banking-threats-persist/?

RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM

This is a list of recent vulnerabilities for which exploits are
available. System administrators can use this list to help in
prioritization of their remediation activities. The Qualys Vulnerability
Research Team compiles this information based on various exploit
frameworks, exploit databases, exploit kits and monitoring of internet
activity.

ID: CVE-2016-1909
Title: SSH Backdoor for FortiGate OS Version 4.x up to 5.0.7
Vendor: Fortinet
Description: FortiOS 4.x before 4.3.17 and 5.0.x before 5.0.8 has a
hardcoded passphrase for the Fortimanager_Access account, which allows
remote attackers to obtain administrative access via an SSH session.
CVSS v2 Base Score: 10.0 (HIGH) (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: CVE-2015-8651
Title: Adobe Flash Player Unspecified Code Execution Vulnerability
Vendor: Adobe
Description: Integer overflow in Adobe Flash Player before 18.0.0.324
and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before
11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before
20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows
attackers to execute arbitrary code via unspecified vectors.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: CVE-2015-7755
Title: Juniper ScreenOS Multiple Security Issues
Vendor: Juniper
Description: Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before
6.3.0r12b, 6.3.0r13 before 6.3.0r13b, 6.3.0r14 before 6.3.0r14b,
6.3.0r15 before 6.3.0r15b, 6.3.0r16 before 6.3.0r16b, 6.3.0r17 before
6.3.0r17b, 6.3.0r18 before 6.3.0r18b, 6.3.0r19 before 6.3.0r19b, and
6.3.0r20 before 6.3.0r21 allows remote attackers to obtain
administrative access by entering an unspecified password during a (1)
SSH or (2) TELNET session.
CVSS v2 Base Score: 10.0 (HIGH) (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: CVE-2015-6132
Title: Microsoft Windows Library Loading Input Validation Remote Code
Execution Vulnerability
Vendor: Microsoft
Description: Microsoft Windows Vista SP2, Windows Server 2008 SP2 and
R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold
and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 mishandle
library loading, which allows local users to gain privileges via a
crafted application, aka “Windows Library Loading Remote Code Execution
Vulnerability.”
CVSS v2 Base Score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)

ID: CVE-2014-4114
Title: Microsoft Windows OLE - Remote Code Execution “Sandworm” Exploit
(MS14-060)
Vendor: Microsoft
Description: Microsoft Windows Vista SP2, Windows Server 2008 SP2 and
R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold
and R2, and Windows RT Gold and 8.1 allow remote attackers to execute
arbitrary code via a crafted OLE object in an Office document, as
exploited in the wild with a “Sandworm” attack in June through October
2014, aka “Windows OLE Remote Code Execution Vulnerability.”
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: CVE-2015-7645
Title: Adobe Flash Player Code Execution Vulnerability (APSB15-27)
Vendor: Adobe
Description: Adobe Flash Player 18.x through 18.0.0.252 and 19.x through
19.0.0.207 on Windows and OS X and 11.x through 11.2.202.535 on Linux
allows remote attackers to execute arbitrary code via a crafted SWF
file, as exploited in the wild in October 2015.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: CVE-2015-2509
Title: Microsoft Windows Media Center MCL Vulnerability (MS15-100)
Vendor: Microsoft
Description: Windows Media Center in Microsoft Windows Vista SP2,
Windows 7 SP1, Windows 8, and Windows 8.1 allows user-assisted remote
attackers to execute arbitrary code via a crafted Media Center link
(mcl) file, aka “Windows Media Center RCE Vulnerability.”
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: CVE-2014-6332
Title: Microsoft Windows OLE Automation Array Memory Corruption Code
Execution Vulnerability (MS14-064)
Vendor: Microsoft
Description: OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2,
Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1,
Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT
Gold and 8.1 allows remote attackers to execute arbitrary code via a
crafted web site, as demonstrated by an array-redimensioning attempt
that triggers improper handling of a size value in the SafeArrayDimen
function, aka “Windows OLE Automation Array Remote Code Execution
Vulnerability.”
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

MOST PREVALENT MALWARE FILES 2016-02-16 - 2016-02-23 COMPILED BY TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

SHA 256: 3B17689A486D68813C31BF2BA610BF36F4B1F5B0403B0316C9833348845306FC
MD5: 37ee9a5257102d876cfae15bccfbbf78
VirusTotal:
https://www.virustotal.com/file/3B17689A486D68813C31BF2BA610BF36F4B1F5B0403B0316C9833348845306FC/analysis/#additional-info
Typical Filename: WebSocketServerApp
Claimed Product: WebSocketServerApp
Detection Name: W32.Auto.3b1768.182243.in01

SHA 256: CAD3D318A665D3186378A92974E971D763BE8F47EC3CAD23C09A16782C5D50A1
MD5: aa0274b4d13dc0bc46995f9f7c4b7437
VirusTotal:
https://www.virustotal.com/file/CAD3D318A665D3186378A92974E971D763BE8F47EC3CAD23C09A16782C5D50A1/analysis/#additional-info
Typical Filename: application.htm
Claimed Product: N/A
Detection Name: OSX.Variant:GenieoAQ.18k0.1201

SHA 256: AC59FB59BBD17C0DBED4A9B2AD12865E8A6C2E77EC88A6F426F8BE676C650CBC
MD5: 5e19f560eaac49ec518f8a8f1e644275
VirusTotal:
https://www.virustotal.com/file/AC59FB59BBD17C0DBED4A9B2AD12865E8A6C2E77EC88A6F426F8BE676C650CBC/analysis/#additional-info
Typical Filename: UpdatePlatform.exe
Claimed Product: Update Platform Application
Detection Name: W32.AC59FB59BB-100.SBX.VIOC

SHA 256: 3C1CBEB2A8162D01AA12DFACFF7AB3DC01CF22B7225B466D588923DE2E992898
MD5: 596c8a11b03c2ef9d890f85c631ba5e8
VirusTotal:
https://www.virustotal.com/file/3C1CBEB2A8162D01AA12DFACFF7AB3DC01CF22B7225B466D588923DE2E992898/analysis/#additional-info
Typical Filename: ads.php.swf
Claimed Product: N/A
Detection Name: SWF.Exploit.Kit.tht.Talos

SHA 256: 56CCB8B34246A278CB2A6BA4396C88D58C587BB37894D048AB9943DB8F8B8532
MD5: c56c5a9510d0c36bbfe871abd4be5403
VirusTotal:
https://www.virustotal.com/file/56CCB8B34246A278CB2A6BA4396C88D58C587BB37894D048AB9943DB8F8B8532/analysis/#additional-info
Typical Filename: XLGameBoxLite_jingjian3.0.2.0075.exe
Claimed Product: “??????????”
Detection Name: W32.56CCB8B342.Ramnit.tht.Talos