CONTENTS:

NOTABLE RECENT SECURITY ISSUES
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES 4/9/2013 - 4/16/2012

TOP VULNERABILITY THIS WEEK: Microsoft is warning users not to install

MS13-036, as certain users’ systems are failing to boot after applying
the patch. The issue is, as of the time of writing, still being
diagnosed by Microsoft, who will presumably issue an updated patch as
soon as QA is complete.

NOTABLE RECENT SECURITY ISSUES SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM

Title: Microsoft patch causing systems to die after application
Description: Certain users are reporting that applying MS13-036 to their
Windows systems is causing those machines to fail to boot afterwards,
and Microsoft has officially warned users not to apply the patch until
a fix can be identified. The patch addresses locally exploitable bugs,
so the risk of breakage from the patch is most likely higher than the
risk of leaving the vulnerability open for the time being.
Reference:
http://support.microsoft.com/kb/2823324
Snort SID: N/A
ClamAV: N/A

Title: HP Intelligent Management Center arbitrary code execution exploit released
Description: A public exploit was released this week for an arbitrary
code execution identified in March for the HP Intelligent Management
Center product, an enterprise network management solution.
Administrators who have not previously patched should do so as soon as
possible.
Reference:
http://seclists.org/bugtraq/2013/Mar/45
Snort SID: 26416, 26417
ClamAV: N/A

Title: Asterisk SIP SDP header buffer overflow
Description: A pair of trivially exploitable buffer overflows were
patched in the Asterisk SIP SDP header parsing code recently, with
values as small as 17 bytes in certain fields sufficient to trigger
memory corruption. Administrators are urged to patch immediately, as
working exploits can be trivially crafted using existing shellcode
libraries for the target platforms.
http://osvdb.org/show/osvdb/91753
Snort SID: 26425, 26426
ClamAV: N/A

Title: Squid proxy server denial of service
Description: A surprisingly simple denial of service was patched earlier
this month in the popular Squid proxy server software package.
Specifically, if the “Accept-Language” header of an HTTP request begins
with a comma, an infinite loop in the product’s error routine will
ensue, rapidly leading to a service (and possibly operating system)
crash. Administrators should patch promptly, as this issue could be
exploited by the simplest of tools.
Reference:
http://osvdb.org/show/osvdb/90910
Snort SID: 26379
ClamAV: N/A

USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK

Java applet attack wipes out Bitcoin accounts on MtGox:
http://techcrunch.com/2013/04/11/mt-gox-cross-site-scripting-attack-wipes-out-bitcoin-accounts/

90% of game hacks infected with malware:
http://blogs.avg.com/news-threats/avg-insight-90-game-hacks-infected-malware/

Gaming company certificates stolen and used to attack activists:
http://www.wired.com/threatlevel/2013/04/gaming-company-certs-stolen/

How mobile spammers verify the validity of harvested phone numbers:
http://blog.webroot.com/2013/04/16/how-mobile-spammers-verify-the-validity-of-harvested-phone-numbers-part-two/

SET (Social Engineering Toolkit) 5.0 released:
https://www.trustedsec.com/april-2013/the-social-engineer-toolkit-set-version-5-0-the-wild-west/

The bug that caught PayPal with its pants down:
http://www.theregister.co.uk/2013/04/15/paypal_sql_injection/

RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM

This is a list of recent vulnerabilities for which exploits are
available. System administrators can use this list to help in
prioritization of their remediation activities. The Qualys Vulnerability
Research Team compiles this information based on various exploit
frameworks, exploit databases, exploit kits and monitoring of internet
activity.

ID: CVE-2013-0632
Title: Adobe ColdFusion APSB13-03 Remote Exploit
Vendor: Adobe
Description: Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote
attackers to bypass authentication and possibly execute arbitrary code
via unspecified vectors, as exploited in the wild in January 2013.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: CVE-2013-1080
Title: Novell ZENworks Configuration Management Remote Execution
Vendor: Novell
Description: The web server in Novell ZENworks Configuration Management
(ZCM) 10.3 and 11.2 does not properly perform authentication for
zenworks/jsp/index.jsp, which allows remote attackers to conduct
directory traversal attacks, and consequently upload and execute
arbitrary programs, via a request to TCP port 443.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: CVE-2013-1892
Title: MongoDB nativeHelper.apply Remote Code Execution
Vendor: MongoDB.org
Description: Remote exploitation of an input validation error
vulnerability in versions 2.2.3 of mongoDB, as included in various
vendors’ operating system distributions, could allow attackers to
execute arbitrary code on the targeted host. An input validation error
vulnerability exists in monogoDB. Specifically, the vulnerable
server-side process fails to sanitize user input passed through the
“nativeHelper.apply()” function.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: CVE-2012-5879
Title: McAfee Virtual Technician ActiveX Control Insecure Method
Vendor: McAfee
Description: An ActiveX control in McHealthCheck.dll in McAfee Virtual
Technician (MVT) and ePO-MVT 6.5.0.2101 and earlier allows remote
attackers to modify or create arbitrary files via a full pathname
argument to the Save method.
CVSS v2 Base Score: 8.2 (AV:N/AC:M/Au:S/C:C/I:C/A:P)

ID: CVE-2013-1493
Title: Oracle Java SE JVM 2D Subcomponent Remote Code Execution Vulnerability (Oracle Security Alert for CVE-2013-1493)
Vendor: Oracle
Description: The color management (CMM) functionality in the 2D
component in Oracle Java SE 7 Update 15 and earlier, 6 Update 41 and
earlier, and 5.0 Update 40 and earlier allows remote attackers to
execute arbitrary code or cause a denial of service (crash) via an image
with crafted raster parameters, which triggers (1) an out-of-bounds read
or (2) memory corruption in the JVM, as exploited in the wild in
February 2013.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

MOST PREVALENT MALWARE FILES 4/9/2013 - 4/16/2012 COMPILED BY SOURCEFIRE

SHA 256: D14B66BD4C4C8F66A6EDF2820FD4162D09B326BEAF6A42014596571E81A1A503
MD5: 68b7f7a26b76805432e3d50009d2ab1f
VirusTotal: https://www.virustotal.com/file/D14B66BD4C4C8F66A6EDF2820FD4162D09B326BEAF6A42014596571E81A1A503/analysis/

Typical Filename: winijskuo.exe
Claimed Product: winijskuo.exe
Claimed Publisher: winijskuo.exe

SHA 256: 5A9AFC24B0B0C8E565094EA386A7E9369BAB7BCBA9B1D5A992EE3A7FD69D9F81
MD5: 59f9f5ce65a6b2e3ec401b585ab90ba1
VirusTotal: https://www.virustotal.com/file/5A9AFC24B0B0C8E565094EA386A7E9369BAB7BCBA9B1D5A992EE3A7FD69D9F81/analysis/

Typical Filename: b4182854f7531e4f363e641ebdba33e3d9dfa691
Claimed Product: b4182854f7531e4f363e641ebdba33e3d9dfa691
Claimed Publisher: b4182854f7531e4f363e641ebdba33e3d9dfa691

SHA 256: E0B193D47609C9622AA018E81DA69C24B921F2BA682F3E18646A0D09EC63AC2B
MD5: bf31a8d79f704f488e3dbcb6eea3b3e3
VirusTotal: https://www.virustotal.com/file/E0B193D47609C9622AA018E81DA69C24B921F2BA682F3E18646A0D09EC63AC2B/analysis/

Typical Filename: klplmq.sys
Claimed Product: klplmq.sys
Claimed Publisher: klplmq.sys

SHA 256: F09AFC177AFBC8E2D36A57D105D3F79A70EC2E36701C9759E19D54A009279F11
MD5: 3b7a992ae53ebb41dd1e566e4172e9c0
VirusTotal: https://www.virustotal.com/file/F09AFC177AFBC8E2D36A57D105D3F79A70EC2E36701C9759E19D54A009279F11/analysis/

Typical Filename: winxeyfe.exe
Claimed Product: winxeyfe.exe
Claimed Publisher: winxeyfe.exe

SHA 256: 1A5997406EF0960F86D31E404B95A40CC03DE4DB6279B16030ACCFC62F97CF3E
MD5:
VirusTotal: https://www.virustotal.com/file/1A5997406EF0960F86D31E404B95A40CC03DE4DB6279B16030ACCFC62F97CF3E/analysis/

Typical Filename:
Claimed Product:
Claimed Publisher: