CONTENTS:

NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES 7/9/2014 - 7/15/2014

TOP VULNERABILITY THIS WEEK: Oracle Critical Patch Update - July 2014 -

20 Java vulnerabilities patched

NOTABLE RECENT SECURITY ISSUES SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM

Title: Oracle Critical Patch Update - July 2014 - 20 Java vulnerabilities patched
Description: Oracle releases their Critical Patch Update for July,
multiple critical updates for Java that a high chance of remote
exploitation.
Reference: http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
https://isc.sans.edu/diary/Oracle+Java%3A+20+new+vulnerabilities+patched/18395
Snort SID: Detection is pending.
ClamAV: Detection is pending.

Title: Hacking Password Managers
Description: Security Researchers to present at the USENIX conference
in August discovered multiple security vulnerabilities in password
manager applications, such as LastPass.
Reference:
http://www.darkreading.com/cloud/hacking-password-managers/d/d-id/1297250
http://devd.me/papers/pwdmgr-usenix14.pdf (PDF)

Title: “Rosetta Flash” tool, JSONP callback API vulnerability CVE-2014-4671
Description: Security Researcher Michele Spagnuolo released a Rosetta”
Flash” utility to convert SWF files to alphanumeric content that can be
embedded within a webpage to exploit CVE-2014-4671.
Reference: http://miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta-flash/
Snort SID: 31392-31397, 31399-31401

INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY

Snort Blog: OpenAppId Detector Developer Guide has been posted!
http://sfi.re/oadguide

New Strategies and Features to Help Organizations Better Protect Against
Pass-the-Hash Attacks
blogs.technet.com/b/security/archive/2014/07/08/new-strategies-and-features-to-help-organizations-better-protect-against-pass-the-hash-attacks.aspx

Active Directory Vulnerability Disclosure: Weak encryption enables
attacker to change a victim’s password without being logged
http://www.aorato.com/blog/active-directory-vulnerability-disclosure-weak-encryption-enables-attacker-change-victims-password-without-logged/

RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM

This is a list of recent vulnerabilities for which exploits are
available. System administrators can use this list to help in
prioritization of their remediation activities. The Qualys Vulnerability
Research Team compiles this information based on various exploit
frameworks, exploit databases, exploit kits and monitoring of internet
activity.

ID: CVE-2014-3936
Title: D-Link HNAP Request Remote Buffer Overflow
Vendor: D-Link
Description: Stack-based buffer overflow in the do_hnap function in
www/my_cgi.cgi in D-Link DSP-W215 (Rev. A1) with firmware 1.01b06 and
earlier, DIR-505 with firmware before 1.08b10, and DIR-505L with
firmware 1.01 and earlier allows remote attackers to execute arbitrary
code via a long Content-Length header in a GetDeviceSettings action in
an HNAP request.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: CVE-2014-2969
Title: Netgear GS105PE Prosafe Plus Switch Contains Hard-Coded Login
Credentials
Vendor: Netgear
Description: NETGEAR GS108PE Prosafe Plus switches with firmware 1.2.0.5
have a hardcoded password of debugpassword for the ntgruser account,
which allows remote attackers to upload firmware or read or modify
memory contents, and consequently execute arbitrary code, via a request
to (1) produce_burn.cgi, (2) register_debug.cgi, or (3)
bootcode_update.cgi.
CVSS v2 Base Score: 8.3 (AV:A/AC:L/Au:N/C:C/I:C/A:C)

ID: CVE-2012-1876
Title: Microsoft Internet Explorer Col Element Memory Corruption Vulnerability
Vendor: Microsoft
Description: Microsoft Internet Explorer 6 through 9, and 10 Consumer
Preview, does not properly handle objects in memory, which allows remote
attackers to execute arbitrary code by attempting to access a
nonexistent object, leading to a heap-based buffer overflow, aka “Col
Element Remote Code Execution Vulnerability,” as demonstrated by VUPEN
during a Pwn2Own competition at CanSecWest 2012.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: N/A
Title: Supermicro Server Motherboard Credential Disclosure Vulnerability
Vendor: Supermicro
Description: Supermicro motherboards store administrator passwords in
plain text, which is available to any attacker who can connect to TCP
port 49152.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/AU:N/C:C/I:C/A:C)

ID: CVE-2014-0160
Title: OpenSSL TLS Heartbeat Extension Buffer Oveflow Information
Disclosure Vulnerability (Heartbleed)

Vendor: OpenSSL Project
Description: The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1
before 1.0.1g do not properly handle Heartbeart Extension packets, which
allows remote attackers to obtain sensitive information from process
memory via crafted packets that trigger a buffer over-read, as
demonstrated by reading private keys, related to d1_both.c and t1_lib.c.
CVSS v2 Base Score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)

MOST PREVALENT MALWARE FILES 7/9/2014 - 7/15/2014 COMPILED BY SOURCEFIRE

SHA 256: 1A84759D615916B53F8F41C9928C48FF005A970D6FA35893F9A7EC074DD77864
MD5: 738a57e0d8dd303b87220f209bd49024
VirusTotal:
https://www.virustotal.com/file/1A84759D615916B53F8F41C9928C48FF005A970D6FA35893F9A7EC074DD77864/analysis/#additional-info
Typical Filename: updater.exe
Claimed Product: Backup Software Limited
Detection Name: W32.1A84759D61-78.SBX.VIOC

SHA 256: 3CC8E2184D73E9B99592CD9399ECB294BEB1AECE3C21903C09F059DFAC44DAC6
MD5: a5d9e1fa931b1002c7a798448496e04c
VirusTotal:
https://www.virustotal.com/file/3CC8E2184D73E9B99592CD9399ECB294BEB1AECE3C21903C09F059DFAC44DAC6/analysis/#additional-info
Typical Filename: Service Start.exe
Claimed Product: Backup Software Limited
Detection Name: W32.3CC8E2184D-77.SBX.VIOC

SHA 256: DE79E5A4356CA0EFA56B69E6EDE21DD8E12FC16E2196B7B7366A0D76C65D3ED5
MD5: 11fcb6824b912480af7d54a8547dfcb8
VirusTotal:
https://www.virustotal.com/file/DE79E5A4356CA0EFA56B69E6EDE21DD8E12FC16E2196B7B7366A0D76C65D3ED5/analysis/#additional-info
Typical Filename: wajam_update.exe
Claimed Product: Wajam Internet Technologies Inc
Detection Name: W32.Application:Adwaregen.17ib.1201

SHA 256: 97667487392ACA1D94C0043FB725FE31855D5B65B1BDEBE58E0AC7E147D05BE4
MD5: 466af3fbfdd028b3d90238425c367b7e
VirusTotal:
https://www.virustotal.com/file/97667487392ACA1D94C0043FB725FE31855D5B65B1BDEBE58E0AC7E147D05BE4/analysis/#additional-info
Typical Filename: t8SrchMn.exe
Claimed Product: Mindspark Toolbar Platform SearchScope Monitor
Detection Name: W32.MindsparkA.17hd.1201

SHA 256: F8EA2EFA24813F1159ADCEF510EA33DCCEE50A5EF9F9C98EAE840AFAAB8DE8F8
MD5: 2c0a45683112082493b1fb3c09c60184
VirusTotal:
https://www.virustotal.com/file/F8EA2EFA24813F1159ADCEF510EA33DCCEE50A5EF9F9C98EAE840AFAAB8DE8F8/analysis/#additional-info
Typical Filename: 9tbrmon.exe
Claimed Product: Mindspark Toolbar Platform SearchScope Monitor
Detection Name: W32.MindsparkA.17hd.1201