CONTENTS:

NOTABLE RECENT SECURITY ISSUES
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES 7/3/2013 - 7/10/2013

TOP VULNERABILITY THIS WEEK: A bug that spans nearly every known version

of Android was announced last week, which allows for arbitrary
modification of APK contents without compromising its digital signature.
Public proof-of-concept already exists, and while rooted users with
Cyanogenmod are already patched, users of mainstream, carrier-provided
Android phones may be waiting for months before patches appear.

NOTABLE RECENT SECURITY ISSUES SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM

Title: Android “master key” bug allows tampering with APKs without
voiding crypto signatures
Description: A vulnerability that allows attackers to make arbitrary
modifications to the code of an Android APK without compromising its
digital signature was announced late last week in a blog post by Bluebox
Security, with a promise to release full details at the Black Hat
security conference later this month. Within days, public proof of
concept tools for implementing this attack emerged, as it became clear
that the bug centers around duplicate internal file names. While the
popular Cyanogenmod Android distribution has already patched their code
base, users of carrier-provided phones are looking at a wait that could
stretch out for months before an update arrives. As with most Android
security issues, users are urged to refrain from installing apps from
outside the official marketplace to lower their risk until a patch is
available.
Reference:
http://peternbiddle.wordpress.com/2013/07/04/code-identity-and-the-android-master-key-bug/
https://plus.google.com/113331808607528811927/posts/GxDA6111vYy:
http://www.theregister.co.uk/2013/07/09/android_sig_vuln_exploit_seen_in_the_wild/
Snort SID: N/A
ClamAV: N/A

Title: Microsoft Tuesday release covers 34 CVEs over 7 patches
Description: This week’s patch release from Microsoft was a particularly
busy one, with six of the seven bulletins being marked as critical, and
a total of 34 CVEs fixed across those bulletins. While only one of the
issues were confirmed as being exploited in the wild prior to release -
CVE-2013-3660, which was being leveraged in targeted attacks for
escalation of privilege - several other issues had been publicly
disclosed, and exploits are likely to begin emerging in the coming days.
Reference:
http://technet.microsoft.com/en-us/security/bulletin/ms13-jul
http://vrt-blog.snort.org/2013/07/microsoft-update-tuesday-july-2013.html
Snort SID: 27126 - 21739, 27147 - 27154, 27156, 27157
ClamAV: HTML.Exploit.CVE_2013_3147, HTML.Exploit.CVE_2013_3145,
Win.Html.Exploit.CVE_2013_3144, HTML.Exploit.CVE_2013_3164,
HTML.Exploit.CVE_2013-3153, Exploit.HTML.CVE_2013_3151,
HTML.Exploit.CVE_2013_3150, HTML.Exploit.CVE_2013_3148,
HTML.Exploit.CVE_2013_3143

Title: Emergency responder systems vulnerable to multiple issues
Description: A slew of vulnerabilities were announced this week by
IOActive in Digital Alert Systems’ DASDEC machines - used by emergency
responders throughout the United States - including a default SSH key
that allows for root logins, and a web application that allows full view
of logs without authentication. The vulnerabilities have already been
used to send fake national alerts about zombies; at this time, no patch
is available from the manufacturer.
Reference:
http://www.ioactive.com/pdfs/IOActive_DASDEC_vulnerabilities.pdf
http://www.kb.cert.org/vuls/id/662676
http://www.zdnet.com/u-s-emergency-alert-system-open-to-more-zombie-hackers-after-accidental-ssh-key-disclosure-7000017811/
Snort SID: 27161 - 27164
ClamAV: N/A

USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK

Dubious HTTP II - Unusual HTTP Content-Encodings:
http://noxxi.de/research/unusual-http-content-encoding.html

Another year, another rogue. Not what the doctor ordered:
http://blogs.technet.com/b/mmpc/archive/2013/06/27/another-year-another-rogue-not-what-the-doctor-ordered.aspx

Skype for Android lockscreen bypass:
http://seclists.org/fulldisclosure/2013/Jul/6

Cybercriminals experiment with Tor-based C&C, ring-3 rootkit empowered,
SPDY form-grabbing bot:
http://blog.webroot.com/2013/07/02/cybercriminals-experiment-with-tor-based-cc-ring-3-rootkit-empowered-spdy-form-grabbing-malware-bot/

Securing Microsoft Windows 8: AppContainers:
http://news.saferbytes.it/analisi/2013/07/securing-microsoft-windows-8-appcontainers/

A penetration tester’s guide to IPMI and BMCs:
https://community.rapid7.com/community/metasploit/blog/2013/07/02/a-penetration-testers-guide-to-ipmi

Analysis of CVE-2013-0809:
http://axtaxt.wordpress.com/2013/07/06/analysis-of-cve-2013-0809/

Postpwnium writeup:
http://rpw.io/blog/2013/06/11/postpwnium_writeup/

RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM

This is a list of recent vulnerabilities for which exploits are
available. System administrators can use this list to help in
prioritization of their remediation activities. The Qualys Vulnerability
Research Team compiles this information based on various exploit
frameworks, exploit databases, exploit kits and monitoring of internet
activity.

ID: CVE-2013-3660
Title: Microsoft Windows “win32k!EPATHOBJ::pprFlattenRec” Privilege
Escalation Vulnerability
Vendor: Microsoft
Description: The EPATHOBJ::pprFlattenRec function in win32k.sys in
Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista
SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8,
Windows Server 2012, and Windows RT does not properly initialize a
pointer for the next object in a certain list, which allows local users
to obtain write access to the PATHRECORD chain, and consequently gain
privileges, by triggering excessive consumption of paged memory and then
making many FlattenPath function calls.
CVSS v2 Base Score: 6.9 (AV:L/AC:M/Au:N/C:C/I:C/A:C)

ID: CVE-2013-2688
Title: QNX Phrelay Buffer Overflow Vulnerability
Vendor: QNX Software Systems Ltd
Description: Remote exploitation of a buffer overflow vulnerability in
QNX Software Systems Ltd.’s Phrelay could allow attackers to execute
arbitrary code on the targeted host.
CVSS v2 Base Score: 5.4 (AV:N/AC:H/Au:N/C:N/I:N/A:C)

ID: CVE-2013-2687
Title: QNX Multiple Products “bpe_decompress” Stack-based Buffer
Overflow Vulnerability
Vendor: QNX Software Systems Ltd
Description: Remote exploitation of a buffer overflow vulnerability in
QNX Software Systems Ltd.’s multiple products could allow attackers to
execute arbitrary code on the targeted host.
CVSS v2 Base Score: 7.3 (AV:N/AC:L/Au:N/C:N/I:N/A:C)

ID: CVE-2013-2460
Title: Java Applet ProviderSkeleton Insecure Invoke Method
Vendor: Oracle
Description: Unspecified vulnerability in the Java Runtime Environment
(JRE) component in Oracle Java SE 7 Update 21 and earlier, and OpenJDK
7, allows remote attackers to affect confidentiality, integrity, and
availability via unknown vectors related to Serviceability. NOTE: the
previous information is from the June 2013 CPU. Oracle has not commented
on claims from another vendor that this issue allows remote attackers
to bypass the Java sandbox via vectors related to “insufficient access
checks” in the tracing component.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: CVE-2013-2551
Title: Microsoft Internet Explorer COALineDashStyleArray Integer
Overflow (MS13-009)
Vendor: Microsoft
Description: Use-after-free vulnerability in Microsoft Internet Explorer
6 through 10 allows remote attackers to execute arbitrary code via a
crafted web site that triggers access to a deleted object, as
demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2013,
aka “Internet Explorer Use After Free Vulnerability,” a different
vulnerability than CVE-2013-1308 and CVE-2013-1309.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: CVE-2012-1533
Title: Java Web Start Double Quote Injection Remote Code Execution
Vendor: Oracle
Description: Unspecified vulnerability in the Java Runtime Environment
(JRE) component in Oracle Java SE 7 Update 7 and earlier, and 6 Update
35 and earlier, allows remote attackers to affect confidentiality,
integrity, and availability via unknown vectors related to Deployment.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

MOST PREVALENT MALWARE FILES 7/3/2013 - 7/10/2013 COMPILED BY SOURCEFIRE

SHA 256: AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615
MD5: 3291e1603715c47a23b60a8bf2ca73db
VirusTotal: https://www.virustotal.com/file/aa0bbaecb678868e1e7f57c7ca9d61b608b3d788be490790eb1d148beadf4615/analysis/

Typical Filename: -
Claimed Product: -
Claimed Publisher: -

SHA 256: B7B28E855B8C6225C605330760FF4DC407EFC83F72F1A04E974A72189D0F1D96
MD5: 573b6cc513e1b7cd9e35b491eacc38f3
VirusTotal: https://www.virustotal.com/file/B7B28E855B8C6225C605330760FF4DC407EFC83F72F1A04E974A72189D0F1D96/analysis/

Typical Filename: 573b6cc513e1b7cd9e35b491eacc38f3
Claimed Product: 573b6cc513e1b7cd9e35b491eacc38f3
Claimed Publisher: 573b6cc513e1b7cd9e35b491eacc38f3

SHA 256: 0585CDC0293EA6B8C86482608C08C583BF32E12CFA59D143F4A0411D2894C0F3
MD5: b3b9295385f4e74d023181e5a24f4d83
VirusTotal: https://www.virustotal.com/file/0585CDC0293EA6B8C86482608C08C583BF32E12CFA59D143F4A0411D2894C0F3/analysis/

Typical Filename: -
Claimed Product: -
Claimed Publisher: -

SHA 256: DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C
MD5: 25aa9bb549ecc7bb6100f8d179452508
VirusTotal: https://www.virustotal.com/file/DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C/analysis/

Typical Filename: -
Claimed Product: -
Claimed Publisher: -

SHA 256: A6B140EC734C258C5EBF19C0BC0B414B5655ADC00108A038B5BE6A8F83D0BD03
MD5: e010f298c086c2e1d7265fd18aea2dfbaa9dcd35
VirusTotal: https://www.virustotal.com/file/A6B140EC734C258C5EBF19C0BC0B414B5655ADC00108A038B5BE6A8F83D0BD03/analysis/

Typical Filename: -
Claimed Product: -
Claimed Publisher: -