CONTENTS:

NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES 7/5/2016 - 7/12/2016

TOP VULNERABILITY THIS WEEK: Google Releases Android Security Bulletin

NOTABLE RECENT SECURITY ISSUES SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

Title: Android Security Bulletin Features Two Patch Levels
Description: Google has released a security bulletin addressing a group of vulnerabilities including seven remote code execution bugs and a dozen high severity flaws.
Reference: https://threatpost.com/android-security-bulletin-features-two-patch-levels/119056/

Title: Serious flaw fixed in widely used WordPress plug-in
Description: A persistent XSS vulnerability in All in One SEO Pack Wordpress plug-in was patched. This popular wordpress plug-in vulnerability could result in the hijacking of the sites admin account.
Reference: http://www.pcworld.com/article/3094029/security/serious-flaw-fixed-in-widely-used-wordpress-plug-in.html

INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY

Jigsaw Ransomware Decrypted Again
https://threatpost.com/jigsaw-ransomware-decrypted-again/119186/

New ‘Ranscam’ Ransomware Lowers The Bar But Raises The Stakes
http://www.darkreading.com/threat-intelligence/new-ranscam-ransomware-lowers-the-bar-but-raises-the-stakes/d/d-id/1326223

10 million Android phones infected by all-powerful auto-rooting apps
http://arstechnica.com/security/2016/07/virulent-auto-rooting-malware-takes-control-of-10-million-android-devices/

RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM

This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.

ID: CVE-2016-4171
Title: Adobe Flash Code Execution Vulnerability (APSA16-03)
Vendor: Adobe
Description: Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in June 2016.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: CVE-2016-0185
Title: Microsoft Windows Media Center Input Validation Remote Code
Execution Vulneraiblity (MS16-059)
Vendor: Microsoft
Description: Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, and Windows 8.1 allows remote attackers to execute arbitrary code via a crafted Media Center link (aka .mcl) file, aka “Windows Media Center Remote Code Execution Vulnerability.”
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: CVE-2016-4117
Title: Adobe Flash Player Integer Overflow Code Execution Vulnerability
(APSA16-02)
Vendor: Adobe
Description: Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: CVE-2016-0189
Title: Microsoft Internet Explorer Scripting Engine Memory Corruption
Vulnerability
Vendor: Microsoft
Description: The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka “Scripting Engine Memory Corruption Vulnerability,” a different vulnerability than CVE-2016-0187.
CVSS v2 Base Score: 7.6 (AV:N/AC:H/Au:N/C:C/I:C/A:C)

ID: CVE-2016-1287
Title: Cisco ASA Software IKEv1 and IKEv2 Buffer Overflow Vulnerability
Vendor: Cisco
Description: Buffer overflow in the IKEv1 and IKEv2 implementations in Cisco ASA Software before 8.4(7.30), 8.7 before 8.7(1.18), 9.0 before 9.0(4.38), 9.1 before 9.1(7), 9.2 before 9.2(4.5), 9.3 before 9.3(3.7), 9.4 before 9.4(2.4), and 9.5 before 9.5(2.2) on ASA 5500 devices, ASA 5500-X devices, ASA Services Module for Cisco Catalyst 6500 and Cisco 7600 devices, ASA 1000V devices, Adaptive Security Virtual Appliance (aka ASAv), Firepower 9300 ASA Security Module, and ISA 3000 devices allows remote attackers to execute arbitrary code or cause a denial of service (device reload) via crafted UDP packets, aka Bug IDs CSCux29978 and CSCux42019.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: CVE-2016-3081
Title: Apache Struts Input Validation Remote Code Execution Vulnerability
Vendor: Apache Structs
Description: Apache Struts 2.x before 2.3.20.2, 2.3.24.x before 2.3.24.2, and 2.3.28.x before 2.3.28.1, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: CVE-2016-1019
Title: Adobe Flash Player Code Execution Vulnerability
Vendor: Adobe
Description: Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors, as exploited in the wild in April 2016.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

MOST PREVALENT MALWARE FILES 7/05/2016 - 7/12/2016:

COMPILED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

SHA 256: 4B0438ADDD6586DC7F4A65BFBD4388FA5AAB40F8514F4AA715092B42617AC4A9
MD5: ffb6038e1e949a7a3103ffda1e7243b4
VirusTotal:
https://virustotal.com/en/file/4B0438ADDD6586DC7F4A65BFBD4388FA5AAB40F8514F4AA715092B42617AC4A9/analysis/
Typical Filename: SGDownload.exe
Claimed Product: N/A
Detection Name: W32.4B0438ADDD-100.SBX.VIOC

SHA 256: 5C8BAA8DF91318CE0972098DA142BB615A78B0B57AA1E1F433EBB38190527FBE
MD5: f9f1746015c18a2383c70a4f7b378ac8
VirusTotal:
https://www.virustotal.com/en/file/5C8BAA8DF91318CE0972098DA142BB615A78B0B57AA1E1F433EBB38190527FBE/analysis/
Typical Filename: activationproce.pdf
Claimed Product: N/A
Detection Name: W32.5C8BAA8DF9-95.SBX.TG

SHA 256: 0071AA6B7423442FF35C7389AE50C786B5DC7C0D1CEF0E5288DCD18AA9804024
MD5: 80a4ba84e4955d03fc472f905ab7ceaa
VirusTotal:
https://www.virustotal.com/en/file/0071AA6B7423442FF35C7389AE50C786B5DC7C0D1CEF0E5288DCD18AA9804024/analysis/
Typical Filename: Purchase Order.exe
Claimed Product: N/A
Detection Name: W32.0071AA6B74-96.SBX.VIOC

SHA 256: AD8039EFAAE4DF4027DE300C137B617B15CBD36A523B2D6622126322A2194D1E
MD5: 4c67cf28605a580021ab0073a1ace9af
VirusTotal:
https://www.virustotal.com/en/file/AD8039EFAAE4DF4027DE300C137B617B15CBD36A523B2D6622126322A2194D1E/analysis/
Typical Filename: MG–KVIS.exe
Claimed Product: N/A
Detection Name: W32.AD8039EFAA-95.SBX.VIOC

SHA 256: EE3D776A5DA74C00FAD15A1B50E42C091CEC6A9A89C13428F9277C6007D4007F
MD5: a3730e445244791b37af42763603d87f
VirusTotal:
https://www.virustotal.com/en/file/EE3D776A5DA74C00FAD15A1B50E42C091CEC6A9A89C13428F9277C6007D4007F/analysis/
Typical Filename: iKernel.dll
Claimed Product: N/A
Detection Name: W32.Generic.19cn.1201