CONTENTS:

NOTABLE RECENT SECURITY ISSUES
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES 6/6/2013 - 6/11/2013

TOP VULNERABILITY THIS WEEK: A mass exploitation campaign using a public

script recently released on the Full-Disclosure list hit Plesk servers
worldwide this week, with security researchers confirming that
compromised systems have already been used in other attacks. While there
is some dispute about which versions of Plesk are vulnerable,
administrators are urged to ensure the patch for CVE-2012-1823 is
applied to their underlying Apache servers, as it provides the mechanism
by which the Plesk exploits are gaining code execution.

NOTABLE RECENT SECURITY ISSUES SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM

Title: Mass Plesk exploit hits hole left by CVE-2012-1823
Description: Exploit code was dropped on the Full-Disclosure mailing
list last Friday by known researcher Kingcope, who claimed that it was
a 0-day attack against the popular Plesk server management system. Other
members of the list verified that it is, instead, simply a new vector
for targeting CVE-2012-1823, a major remote code execution bug in PHP.
Mass attacks have been confirmed in the wild, with security researchers
noting that compromised systems were being used in other attacks within
a matter of days.
Reference:
http://seclists.org/fulldisclosure/2013/Jun/38
Snort SID: 22063
ClamAV: N/A

Title: Microsoft releases month’s patches
Description: Microsoft this Tuesday released its standard monthly
patches, covering 23 CVEs across 5 distinct bulletins. In addition to
the local kernel vulnerability disclosed by Google researcher Tavis
Ormandy in mid-May, the patches include a fix for a remotely exploitable
issue in Microsoft Office (CVE-2013-1331) that Microsoft notes has been
exploited in the wild. As always, system administrators should update
their machines as soon as feasible.
Reference:
http://vrt-blog.snort.org/2013/06/microsoft-update-tuesday-june-2013.html
http://technet.microsoft.com/en-us/security/bulletin
http://archives.neohapsis.com/archives/fulldisclosure/2013-05/0090.html
Snort SID: 6700, 26843-26849, 26851-26853, 26867-26878, 26882-26890
ClamAV: HTML.Exploit.CVE_2013_3116, HTML.Exploit.CVE_2013_3119,
HTML.Exploit.CVE_2013_3118, HTML.Exploit.CVE_2013_3139,
HTML.Exploit.CVE_2013_3112

Title: New Pwn2Own Java vulnerability hits Metasploit - CVE-2013-1488
Description: Another Java remote code execution vulnerability from this
year’s Pwn2Own contest has had its first public exploit released in
Metasploit this week. Researcher James Forshaw, who had discussed the
bug in some detail in an April blog entry, is responsible for the
Metasploit module. While patches have been available since April,
systems administrators are urged to verify the deployment of those
patches, as exploits have presumably already begun in the wild.
Reference:
http://www.metasploit.com/modules/exploit/multi/browser/java_jre17_driver_manager
http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html
http://www.contextis.com/research/blog/java-pwn2own/
Snort SID: 26898-26901
ClamAV: Java.Exploit.CVE_2013_1488

USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK

iOS 7 and Mavericks - new feature roundup from a security perspective:
http://intrepidusgroup.com/insight/2013/06/ios-7-and-mavericks-new-feature-roundup-from-a-security-perspective/

Working with unmanaged callback functions in PowerShell:
http://www.exploit-monday.com/2013/06/PowerShellCallbackFunctions.html

Transformation-aware exploit generation using a HI-CFG:
http://www.eecs.berkeley.edu/Pubs/TechRpts/2013/EECS-2013-85.pdf

Washington Free Beacon story on NSA serves Java malware:
http://www.invincea.com/2013/06/kia-the-washington-free-beacon-compromised-to-serve-up-malware/

The value of a hacked email account:
http://krebsonsecurity.com/2013/06/the-value-of-a-hacked-email-account/

Detecting Ghostery:
http://blog.securitee.org/?p=277

Volume shadow copy NTDS.DIT domain hashes remotely:
http://www.room362.com/blog/2013/6/10/volume-shadow-copy-ntdsdit-domain-hashes-remotely-part1.html

GameOver Zeus in-depth analysis:
https://www.cert.pl/PDF/2013-06-p2p-rap_en.pdf

RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM

This is a list of recent vulnerabilities for which exploits are
available. System administrators can use this list to help in
prioritization of their remediation activities. The Qualys Vulnerability
Research Team compiles this information based on various exploit
frameworks, exploit databases, exploit kits and monitoring of internet
activity.

ID: CVE-2013-1311
Title: Microsoft Internet Explorer textNode Use-After-Free
Vendor: Microsoft
Description: Use-after-free vulnerability in Microsoft Internet Explorer
8 allows remote attackers to execute arbitrary code via a crafted web
site that triggers access to a deleted object, aka “Internet Explorer
Use After Free Vulnerability.”
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: CVE-2013-1559
Title: Oracle WebCenter Content CheckOutAndOpen.dll ActiveX Remote Code
Execution
Vendor: Oracle
Description: Unspecified vulnerability in the Oracle WebCenter Content
component in Oracle Fusion Middleware 10.1.3.5.1 and 11.1.1.6.0 allows
remote authenticated users to affect availability via unknown vectors
related to Content Server.
CVSS v2 Base Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)

ID: CVE-2012-5946
Title: IBM SPSS SamplePower C1Tab ActiveX Heap Overflow
Vendor: IBM
Description: Buffer overflow in the c1sizer ActiveX control in
C1sizer.ocx in IBM SPSS SamplePower 3.0 before FP1 allows remote
attackers to execute arbitrary code via a long TabCaption string.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: CVE-2013-2028
Title: Nginx HTTP Server 1.3.9-1.4.0 Chuncked Encoding Stack Buffer
Overflow
Vendor: nginx.org
Description: Remote exploitation of an integer overflow vulnerability
in version 1.4.0 of nginx, as included in various vendors’ operating
system distributions, could allow attackers to execute arbitrary code
on the targeted host.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: CVE-2013-2423
Title: Java Applet Reflection Type Confusion Remote Code Execution
Vendor: Oracle
Description: Unspecified vulnerability in the Java Runtime Environment
(JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK
7, allows remote attackers to affect integrity via unknown vectors
related to HotSpot. NOTE: the previous information is from the April
2013 CPU. Oracle has not commented on claims from the original
researcher that this vulnerability allows remote attackers to bypass
permission checks by the MethodHandles method and modify arbitrary
public final fields using reflection and type confusion, as demonstrated
using integer and double fields to disable the security manager.
CVSS v2 Base Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)

ID: CVE-2013-1493
Title: Oracle Java SE JVM 2D Subcomponent Remote Code Execution
Vulnerability (Oracle Security Alert for CVE-2013-1493)
Vendor: Oracle
Description: The color management (CMM) functionality in the 2D
component in Oracle Java SE 7 Update 15 and earlier, 6 Update 41 and
earlier, and 5.0 Update 40 and earlier allows remote attackers to
execute arbitrary code or cause a denial of service (crash) via an image
with crafted raster parameters, which triggers (1) an out-of-bounds read
or (2) memory corruption in the JVM, as exploited in the wild in
February 2013.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

MOST PREVALENT MALWARE FILES 6/6/2013 - 6/11/2013 COMPILED BY SOURCEFIRE

SHA 256: 94A1A26F61B015C2CED2FD50BDBA4070B6C9AEC7D2938FBF7EB9E99960D3B7A9
MD5: bfacf78644ca41fd6d4b23976e7574a1
VirusTotal: https://www.virustotal.com/file/94A1A26F61B015C2CED2FD50BDBA4070B6C9AEC7D2938FBF7EB9E99960D3B7A9/analysis/

Typical Filename: RemoveWAT.exe
Claimed Product: RemoveWAT.exe
Claimed Publisher: RemoveWAT.exe

SHA 256: AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615
MD5: 3291e1603715c47a23b60a8bf2ca73db
VirusTotal: https://www.virustotal.com/file/AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615/analysis/

Typical Filename: 01.tmp
Claimed Product: 01.tmp
Claimed Publisher: 01.tmp

SHA 256: 7BB7125EC5ECF99F975D7CB127009E615847D3FF05FA9F2F79F92CB480B28DC5
MD5: 2f0550df2d7e60752765b44aeb772091
VirusTotal: https://www.virustotal.com/file/7BB7125EC5ECF99F975D7CB127009E615847D3FF05FA9F2F79F92CB480B28DC5/analysis/

Typical Filename: pricepeep_130001_0101.exe
Claimed Product: pricepeep_130001_0101.exe
Claimed Publisher: pricepeep_130001_0101.exe

SHA 256: A6B140EC734C258C5EBF19C0BC0B414B5655ADC00108A038B5BE6A8F83D0BD03
MD5: 8ac1e580cf274b3ca98124580e790706
VirusTotal: https://www.virustotal.com/file/A6B140EC734C258C5EBF19C0BC0B414B5655ADC00108A038B5BE6A8F83D0BD03/analysis/

Typical Filename: Virus.Win32.Sality.ab
Claimed Product: Virus.Win32.Sality.ab
Claimed Publisher: Virus.Win32.Sality.ab

SHA 256: DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C
MD5: 25aa9bb549ecc7bb6100f8d179452508
VirusTotal: https://www.virustotal.com/file/DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C/analysis/

Typical Filename: ygrqpx.exe
Claimed Product: ygrqpx.exe
Claimed Publisher: ygrqpx.exe