CONTENTS:

NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES 2015-12-22 - 2015-12-29

TOP VULNERABILITY THIS WEEK: Adobe Releases January Flash Player Update

Early To Address Zero-day Vulnerability Under Active Exploitation

NOTABLE RECENT SECURITY ISSUES SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

Title: Adobe Releases January Flash Player Update Early To Address
Zero-day Vulnerability Under Active Exploitation
Description: Adobe has released its January Flash Player security
bulletin early to address critical vulnerabilities in Flash Player,
including CVE-2015-8651 which is under active exploitation in the wild.
Eighteen other vulnerabilities were also addressed in the security
bulletin addressing various type confusion, use-after-free, and memory
corruption flaws that could lead to arbitrary code execution. Flash
Player versions 20.0.0.235 and earlier; 18.0.0.268 and earlier, and
11.2.202.554 and earlier have been identified as vulnerable. Users and
administrators should update as soon as possible.
Reference: https://helpx.adobe.com/security/products/flash-player/apsb16-01.html
Snort SID: 37195-37198. Additional detection pending release of
vulnerability information

Title: AVG Anti-virus “Web TuneUp” Chrome Extension Found to Contain
Multiple Vulnerabilities
Description: A researcher on Google’s Project Zero team has found that
AVG Anti-virus automatically installs “Web TuneUp,” a Chrome extension
that contained multiple vulnerabilities. One of the vulnerabilities
identified allows a man-in-the-middle to “inject javascript into any
origin, even a secure origin.” The other vulnerability is a possible
cross-site scripting vulnerability on avg.com that could be abused to
compromise Chrome users. AVG has released an update to the extension
addressing these flaws.
Reference: https://code.google.com/p/google-security-research/issues/detail?id=675

INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY

191 Million US Voter Registration Records Leaked In Mystery Database
http://www.forbes.com/sites/thomasbrewster/2015/12/28/us-voter-database-leak/

MMD-0047-2015 - SSHV: SSH bruter ELF botnet malware w/hidden process
kernel module
http://blog.malwaremustdie.org/2015/12/mmd-0047-2015-sshv-ssh-bruter-elf.html

Firmware Analysis Tool: Binwalk
https://n0where.net/firmware-analysis-tool/

Introducing EvilAbigail
http://blog.gdssecurity.com/labs/2015/12/23/introducing-evilabigail.html

Neutrino Exploit Kit - One Flash File to Rule Them All
https://www.trustwave.com/Resources/SpiderLabs-Blog/Neutrino-Exploit-Kit---One-Flash-File-to-Rule-Them-All/

RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM

This is a list of recent vulnerabilities for which exploits are
available. System administrators can use this list to help in
prioritization of their remediation activities. The Qualys Vulnerability
Research Team compiles this information based on various exploit
frameworks, exploit databases, exploit kits and monitoring of internet
activity.

ID: CVE-2015-8651
Title: Adobe Flash Player Unspecified Code Execution Vulnerability
Vendor: Adobe
Description: Integer overflow in Adobe Flash Player before 18.0.0.324
and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before
11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before
20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows
attackers to execute arbitrary code via unspecified vectors.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: CVE-2015-7755
Title: Juniper ScreenOS Multiple Security Issues
Vendor: Juniper
Description: Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before
6.3.0r12b, 6.3.0r13 before 6.3.0r13b, 6.3.0r14 before 6.3.0r14b,
6.3.0r15 before 6.3.0r15b, 6.3.0r16 before 6.3.0r16b, 6.3.0r17 before
6.3.0r17b, 6.3.0r18 before 6.3.0r18b, 6.3.0r19 before 6.3.0r19b, and
6.3.0r20 before 6.3.0r21 allows remote attackers to obtain
administrative access by entering an unspecified password during a (1)
SSH or (2) TELNET session.
CVSS v2 Base Score: 10.0 (HIGH) (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: CVE-2015-6132
Title: Microsoft Windows Library Loading Input Validation Remote Code
Execution Vulnerability
Vendor: Microsoft
Description: Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2
SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and
R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 mishandle
library loading, which allows local users to gain privileges via a
crafted application, aka “Windows Library Loading Remote Code Execution
Vulnerability.”
CVSS v2 Base Score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)

ID: CVE-2014-4114
Title: Microsoft Windows OLE - Remote Code Execution “Sandworm” Exploit
(MS14-060)
Vendor: Microsoft
Description: Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2
SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and
R2, and Windows RT Gold and 8.1 allow remote attackers to execute
arbitrary code via a crafted OLE object in an Office document, as
exploited in the wild with a “Sandworm” attack in June through October
2014, aka “Windows OLE Remote Code Execution Vulnerability.”
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: CVE-2015-7645
Title: Adobe Flash Player Code Execution Vulnerability (APSB15-27)
Vendor: Adobe
Description: Adobe Flash Player 18.x through 18.0.0.252 and 19.x through
19.0.0.207 on Windows and OS X and 11.x through 11.2.202.535 on Linux
allows remote attackers to execute arbitrary code via a crafted SWF
file, as exploited in the wild in October 2015.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: CVE-2015-2509
Title: Microsoft Windows Media Center MCL Vulnerability (MS15-100)
Vendor: Microsoft
Description: Windows Media Center in Microsoft Windows Vista SP2,
Windows 7 SP1, Windows 8, and Windows 8.1 allows user-assisted remote
attackers to execute arbitrary code via a crafted Media Center link
(mcl) file, aka “Windows Media Center RCE Vulnerability.”
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: CVE-2014-6332
Title: Microsoft Windows OLE Automation Array Memory Corruption Code
Execution Vulnerability (MS14-064)
Vendor: Microsoft
Description: OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2,
Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1,
Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT
Gold and 8.1 allows remote attackers to execute arbitrary code via a
crafted web site, as demonstrated by an array-redimensioning attempt
that triggers improper handling of a size value in the SafeArrayDimen
function, aka “Windows OLE Automation Array Remote Code Execution
Vulnerability.”
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

MOST PREVALENT MALWARE FILES 2015-12-22 - 2015-12-29 COMPILED BY TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

SHA 256: 8448C562D0BDED7F77294549BB95F3013E13B001DE51DEBD33B21439779770AB
MD5: 8b97c933a6917752e2ca6bd67d605d77
VirusTotal:
https://www.virustotal.com/file/8448C562D0BDED7F77294549BB95F3013E13B001DE51DEBD33B21439779770AB/analysis/#additional-info
Typical Filename: ApplicationManager
Claimed Product: N/A
Detection Name: OSX.Variant:SpigotD.18nk.1201

SHA 256: AC59FB59BBD17C0DBED4A9B2AD12865E8A6C2E77EC88A6F426F8BE676C650CBC
MD5: 5e19f560eaac49ec518f8a8f1e644275
VirusTotal:
https://www.virustotal.com/file/AC59FB59BBD17C0DBED4A9B2AD12865E8A6C2E77EC88A6F426F8BE676C650CBC/analysis/#additional-info
Typical Filename: UpdatePlatform.exe
Claimed Product: Update Platform Application
Detection Name: W32.AC59FB59BB-100.SBX.VIOC

SHA 256: 4B85FC862283FA66ACABE7423E8C581CA3805D30C38FE6F2F4126F9AEAEA7C7F
MD5: 022f3544841058c3b3e8126d21d49a60
VirusTotal:
https://www.virustotal.com/file/4B85FC862283FA66ACABE7423E8C581CA3805D30C38FE6F2F4126F9AEAEA7C7F/analysis/#additional-info
Typical Filename: BrowserInfo.exe
Claimed Product: Browser Info
Detection Name: W32.4B85FC8622-100.SBX.VIOC

SHA 256: E0EB5171C5B0FE23B9C7FC9B29FC19775B2AEC96D10E8F0ED66B4BB39D991C2E
MD5: b3dae11b5316528e6853a94d39e141e3
VirusTotal:
https://www.virustotal.com/file/E0EB5171C5B0FE23B9C7FC9B29FC19775B2AEC96D10E8F0ED66B4BB39D991C2E/analysis/#additional-info
Typical Filename: 65barsvc.exe
Claimed Product: Mindspark Toolbar Platform for Internet Explorer
Detection Name: W32.Adware:MindsparkA.18mp.1201

SHA 256: 7AE9E1292F37AF7A1EAC50288BBD244452040A22B1C02B314E004795A68CC2B7
MD5: 30b2ffdd6560a61fd5cc8092065897fd
VirusTotal:
https://www.virustotal.com/file/7AE9E1292F37AF7A1EAC50288BBD244452040A22B1C02B314E004795A68CC2B7/analysis/#additional-info
Typical Filename: winufremm.exe
Claimed Product: N/A
Detection Name: FYdld:Sality-tpd