CONTENTS:

NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES 6/11/2014 - 6/17/2014

TOP VULNERABILITY THIS WEEK: Thousands still at risk from Gameover Zeus

NOTABLE RECENT SECURITY ISSUES SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM

Title: Mozilla multiple vulnerabilities patched MFSA 2014-48 though MFSA 2014-55
Description: The Mozilla foundation resolved multiple vulnerabilities
last week, six of which are critical - affecting Firefox, Thunderbird,
and Seamonkey
Reference: https://www.mozilla.org/security/announce/
Snort SID: Detection is pending.

Title: BIND named can crash due to a defect in EDNS printing processing
Description: A specially crafted query sent to a BIND nameserver can
cause it to crash with a REQUIRE assertion error.
Reference: https://kb.isc.org/article/AA-01166/
Snort SID: Detection is pending.

Title: NCA warns ‘thousands’ still at risk from Gameover Zeus and Cryptolocker malware
Description: Thousands of systems are still at risk from the Gameover
Zeus (Gozeus) and Cryptolocker malware variants, the UK National Crime
Agency (NCA) has warned, despite having told users to lock down their
systems two weeks ago.
Reference:
http://www.theinquirer.net/inquirer/news/2350303/nca-warns-thousands-still-at-risk-from-gameover-zeus-and-cryptolocker-malware

INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY

The Best Of Both Worlds - Soraya
http://www.arbornetworks.com/asert/2014/06/the-best-of-both-worlds-soraya/

Advanced Exploit Techniques Attacking the IE Script Engine
http://blog.fortinet.com/Advanced-Exploit-Techniques-Attacking-the-IE-Script-Engine/

The never ending Exploit Kit shift - Bleeding Life
http://vrt-blog.snort.org/2014/06/the-never-ending-exploit-kit-shift.html

Project Dyre: New RAT Slurps Bank Credentials, Bypasses SSL
http://phishme.com/project-dyre-new-rat-slurps-bank-credentials-bypasses-ssl/

Mimikatz Against Virtual Machine Memory Part 2
http://carnal0wnage.attackresearch.com/2014/06/mimikatz-against-virtual-machine-memory.html

RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM

This is a list of recent vulnerabilities for which exploits are
available. System administrators can use this list to help in
prioritization of their remediation activities. The Qualys Vulnerability
Research Team compiles this information based on various exploit
frameworks, exploit databases, exploit kits and monitoring of internet
activity.

ID: CVE-2014-3120
Title: Elasticsearch Remote Code Execution
Vendor: Elasticsearch
Description: Elasticsearch has a flaw in its default configuration which
makes it possible for any webpage to execute arbitrary code on visitors
with Elasticsearch installed.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/AU:N/C:C/I:C/A:C)

ID: CVE-2014-0515
Title: Adobe Flash Player Shader Buffer Overflow
Vendor: Adobe
Description: Buffer overflow in Adobe Flash Player before 11.7.700.279
and 11.8.x through 13.0.x before 13.0.0.206 on Windows and OS X, and
before 11.2.202.356 on Linux, allows remote attackers to execute
arbitrary code via unspecified vectors, as exploited in the wild in
April 2014.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/AU:N/C:C/I:C/A:C)

ID: CVE-2014-0094
Title: Apache Struts ClassLoader Manipulation Remote Code Execution
Vendor: Apache
Description: The ParametersInterceptor in Apache Struts before 2.3.16.1
allows remote attackers to “manipulate” the ClassLoader via the class
parameter, which is passed to the getClass method.
CVSS v2 Base Score: 5.0 (AV:N/AC:L/AU:N/C:N/I:P/A:N)

ID: CVE-2014-1776
Title: Microsoft Internet Explorer Use-after-Free Vulnerability
Vendor: Microsoft
Description: Use-after-free vulnerability in VGX.DLL in Microsoft
Internet Explorer 6 through 11 allows remote attackers to execute
arbitrary code or cause a denial of service (memory corruption) via
unspecified vectors, as exploited in the wild in April 2014.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/AU:N/C:C/I:C/A:C)

ID: CVE-2014-0160
Title: OpenSSL TLS Heartbeat Extension Buffer Oveflow Information
Disclosure Vulnerability (Heartbleed)
Vendor: OpenSSL Project
Description: The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1
before 1.0.1g do not properly handle Heartbeart Extension packets, which
allows remote attackers to obtain sensitive information from process
memory via crafted packets that trigger a buffer over-read, as
demonstrated by reading private keys, related to d1_both.c and t1_lib.c.
CVSS v2 Base Score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)

MOST PREVALENT MALWARE FILES 6/11/2014 - 6/17/2014 COMPILED BY SOURCEFIRE

SHA 256: C7E2762651F4DD99326BAA1499761D1E1FCD48F6ADB8CA9096590E6CAB8E1AE5
MD5: e08bdcb2af67b0117fb34cf030f1e0ab
VirusTotal:
https://www.virustotal.com/file/C7E2762651F4DD99326BAA1499761D1E1FCD48F6ADB8CA9096590E6CAB8E1AE5/analysis/#additional-info
Typical Filename: cltmngui.exe
Claimed Product: Search Protect
Detection Name: W32.C7E2762651-100.SBX.VIOC

SHA 256: F095974F28C10F44F18088D8F174C07714967E80CCD2607A4FBDE9E9AE538806
MD5: 59f0fab281ee4cc5a7aeebbeaf8d0cd8
VirusTotal:
https://www.virustotal.com/file/F095974F28C10F44F18088D8F174C07714967E80CCD2607A4FBDE9E9AE538806/analysis/#additional-info
Typical Filename: cltmng.exe
Claimed Product: Search Protect
Detection Name: W32.F095974F28-100.SBX.VIOC

SHA 256: 8679C8E6388FD3F927F7AC8ADCEB2CFECD0CEC3B95EA98F79D54119EFBD68034
MD5: 2b76e26f8314246c2a0f7968f73f00bb
VirusTotal:
https://www.virustotal.com/file/8679C8E6388FD3F927F7AC8ADCEB2CFECD0CEC3B95EA98F79D54119EFBD68034/analysis/#additional-info
Typical Filename: 39SrchMn.exe
Claimed Product: Mindspark Toolbar Platform SearchScope Monitor
Detection Name: W32.MindsparkA.17hd.1201

SHA 256: AC4F967E68098093E09B39192B1FCE7B36D28F74A616C9ED6B8448B9E39C58AA
MD5: 446657099d979ecfc1b930bd6bcba4c3
VirusTotal:
https://www.virustotal.com/file/AC4F967E68098093E09B39192B1FCE7B36D28F74A616C9ED6B8448B9E39C58AA/analysis/#additional-info
Typical Filename: 39brmon.exe
Claimed Product: Mindspark Toolbar Platform SearchScope Monitor
Detection Name: W32.MindsparkA.17hd.1201

SHA 256: 97667487392ACA1D94C0043FB725FE31855D5B65B1BDEBE58E0AC7E147D05BE4
MD5: 466af3fbfdd028b3d90238425c367b7e
VirusTotal:
https://www.virustotal.com/file/97667487392ACA1D94C0043FB725FE31855D5B65B1BDEBE58E0AC7E147D05BE4/analysis/#additional-info
Typical Filename: 14SrchMn.exe
Claimed Product: Mindspark Toolbar Platform SearchScope Monitor
Detection Name: W32.MindsparkA.17hd.1201