CONTENTS:

NOTABLE RECENT SECURITY ISSUES
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES 8/27/2013 - 9/3/2013

TOP VULNERABILITY THIS WEEK: A pre-authentication bug in the SSH daemon

on Mikrotik-branded routers was announced this week by noted security
researcher “kingcope”, who included a simple Perl one-liner that would
cause a crash and detailed information on system state for another bug
that could lead to remote code execution. Over a quarter-million
Internet-facing systems appear to be vulnerable at this time, and no
patch is currently available from the manufacturer.

NOTABLE RECENT SECURITY ISSUES SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM

Title: Intel microcode update fixes potential DoS for huge array of
processors
Description: An update to the software that helps translate assembler
instructions into hardware operations on CPUs was released by Intel to
little fanfare last month, but is now raising eyebrows after a message
posted to the Debian-User and Debian-Security lists this week, which
stated that the update fixes a potential crash across a huge swath of
modern Intel processors. While no details are publicly available at this
time about what is required to trigger such a crash - Intel describes
the cause as “a complex sequence of internal processor
micro-architectural events” in its official Erratum AAK167 - the
emergence of an exploit for this issue has the potential to cause an
unprecedented worldwide denial of service, given the range of impacted
processors. Concerned administrators of Debian stable systems have
instructions on how to apply the update now, and will have it
automatically at the next point release; users of other Linux
distributions can get the patch from Intel directly or look for it in
their OS’ update mechanism. Windows users should look to their hardware
manufacturer for BIOS updates.
Reference:
http://lists.debian.org/debian-user/2013/09/msg00126.html
https://downloadcenter.intel.com/Detail_Desc.aspx?DwnldID=23082
http://www.intel.com/content/dam/www/public/us/en/documents/specification-updates/xeon-5500-specification-update.pdf
Snort SID: N/A
ClamAV: N/A

Title: Remotely exploitable, pre-authentication vulnerability announced
in Mikrotik routers
Description: Well-known security researcher “kingcope” posted an
announcement this week of a trivially-triggered, pre-authentication heap
corruption vulnerability in the custom SSH daemon shipping with
Mikrotik-branded routers, which have thrived as a low-cost alternative
to better-known router brands. Systems can be crashed with a single line
of Perl provided in the post; remote command execution is not provided
at this time, but is likely in the future as other researchers take note
of the bug. As no updates are available from the manufacturer at this
time, users of impacted devices - which number over 290,000 according
to popular device search engine Shodan - are urged to monitor their logs
for any signs of suspicious activity, particularly since the fact that
the attack occurs after the SSH stream has gone encrypted means that
network-based detection will be limited at best.
Reference:
http://kingcope.wordpress.com/2013/09/02/mikrotik-routeros-5-and-6-sshd-remote-preauth-heap-corruption/
http://www.shodanhq.com/search?q=ROSSSH+port%3A22
Snort SID: N/A
ClamAV: N/A

Title: Malware authors capitalize on PRISM concerns
Description: In a move that many would consider surprising only in that
it took so long to happen, malware authors have recently begun
distributing “ransomware” - malware that promises to unlock a victim’s
system only they have paid the specified ransom - claiming that the
infected user has been detected committing a computer crime by the NSA’s
PRISM apparatus. While current-event flavored malware is nothing new,
this particular strain appears to be the among the first to capitalize
on government surveillance concerns raised recently by Edward Snowden’s
document-leaking campaign.
Reference:
http://malware.dontneedcoffee.com/2013/08/prism-themed-ransomware.html
Snort SID: 27801 - 27804
ClamAV: Win.Trojan.PRISM

Title: Sophisticated Linux malware spotted in the wild
Description: A new backdoor for Linux systems, capable of data theft,
update blocking, and with a full-featured command execution interface,
has recently been spotted in the wild. While discovery is a
straightforward process for system administrators searching for
appropriate processes, infected systems have the potential to stay that
way for longer than their Windows counterparts, as many Linux users do
not expect to find malware on their desktops.
Reference:
http://blog.avast.com/2013/08/27/linux-trojan-hand-of-thief-ungloved/
Snort SID: 27746
ClamAV: Unix.Trojan.Hanthie

USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK

Shady paths: Leveraging surfing crowds to detect malicious web pages:
http://cs.ucsb.edu/~gianluca/papers/redirections-ccs2013.pdf

Deobfuscating the CK exploit kit:
http://www.kahusecurity.com/2013/deobfuscating-the-ck-exploit-kit/

Anatomy of a dropped call - how to jam a city with 11 customized mobile phones:
http://nakedsecurity.sophos.com/2013/08/29/anatomy-of-a-dropped-call-how-to-jam-a-city-with-11-customised-mobile-phones/

Building a multiplatform shellcode header:
http://www.chokepoint.net/2013/09/building-multiplatform-shellcode-header.html

Heap spraying browsers using Adobe Flash’s ActionScript:
http://www.greyhathacker.net/?p=717

Cybercrime-friendly underground traffic exchanges:
http://blog.webroot.com/2013/08/29/cybercrime-friendly-underground-traffic-exchanges-help-facilitate-fraudulent-and-malicious-activity-part-two/

Compiling payloads on the fly for PostgreSQL:
https://community.rapid7.com/community/metasploit/blog/2013/01/08/compiling-payloads-on-the-fly-for-postgresql

PE runtime structures:
http://uncomputable.blogspot.com/2013/08/pe-runtime-data-structures-v1.html

Visualization of a DDoS attack:
http://www.youtube.com/watch?v=hNjdBSoIa8k

RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM

This is a list of recent vulnerabilities for which exploits are
available. System administrators can use this list to help in
prioritization of their remediation activities. The Qualys Vulnerability
Research Team compiles this information based on various exploit
frameworks, exploit databases, exploit kits and monitoring of internet
activity.

ID: CVE-2013-2370
Title: HP LoadRunner Remote Code Execution
Vendor: HP
Description: Unspecified vulnerability in HP LoadRunner before 11.52
allows remote attackers to execute arbitrary code via unknown vectors,
aka ZDI-CAN-1671.
CVSS v2 Base Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

ID: CVE-2013-3763
Title: Oracle Endeca Server Remote Command Execution
Vendor: Oracle
Description: Unspecified vulnerability in the Oracle Endeca Server
component in Oracle Fusion Middleware 7.4.0 and 7.5.1.1 allows remote
authenticated users to affect confidentiality and integrity via unknown
vectors, a different vulnerability than CVE-2013-3764.
CVSS v2 Base Score: 5.5 (AV:N/AC:L/Au:S/C:P/I:P/A:N)

ID: Not Available
Title: Joomla! Unauthorised Uploads
Vendor: Joomla!
Description: Inadequate filtering leads to the ability to bypass file
type upload restrictions. Affects Joomla! version 2.5.13 and earlier
2.5.x versions; and version 3.1.4 and earlier 3.x versions
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: CVE-2013-2465
Title: Java storeImageArray() Invalid Array Indexing Vulnerability
Vendor: Oracle
Description: Unspecified vulnerability in the Java Runtime Environment
(JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45
and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote
attackers to affect confidentiality, integrity, and availability via
unknown vectors related to 2D. NOTE: the previous information is from
the June 2013 CPU. Oracle has not commented on claims from another
vendor that this issue allows remote attackers to bypass the Java
sandbox via vectors related to “Incorrect image channel verification”
in 2D.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: CVE-2013-2251
Title: Apache Struts 2 DefaultActionMapper Prefixes OGNL Code Execution
Vendor: Apache
Description: Apache Struts 2.0.0 through 2.3.15 allows remote attackers
to execute arbitrary OGNL expressions via a parameter with a crafted (1)
action: , (2) redirect:, or (3) redirectAction: prefix.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: CVE-2013-2460
Title: Java Applet ProviderSkeleton Insecure Invoke Method
Vendor: Oracle
Description: Unspecified vulnerability in the Java Runtime Environment
(JRE) component in Oracle Java SE 7 Update 21 and earlier, and OpenJDK
7, allows remote attackers to affect confidentiality, integrity, and
availability via unknown vectors related to Serviceability. NOTE: the
previous information is from the June 2013 CPU. Oracle has not commented
on claims from another vendor that this issue allows remote attackers
to bypass the Java sandbox via vectors related to “insufficient access
checks” in the tracing component.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

MOST PREVALENT MALWARE FILES 8/27/2013 - 9/3/2013 COMPILED BY SOURCEFIRE

SHA 256: CB85D393C4E0DB5A1514C21F9C51BA4C12D82B7FABD9724616758AE528A5B16B
MD5: 7961a56c11ba303f20f6a59a506693ff
VirusTotal: https://www.virustotal.com/file/CB85D393C4E0DB5A1514C21F9C51BA4C12D82B7FABD9724616758AE528A5B16B/analysis/

Typical Filename: m3SrchMn
Claimed Product: m3SrchMn
Claimed Publisher: m3SrchMn

SHA 256: D14B66BD4C4C8F66A6EDF2820FD4162D09B326BEAF6A42014596571E81A1A503
MD5: 68b7f7a26b76805432e3d50009d2ab1f
VirusTotal: https://www.virustotal.com/file/D14B66BD4C4C8F66A6EDF2820FD4162D09B326BEAF6A42014596571E81A1A503/analysis/

Typical Filename: winmjtas.exe
Claimed Product: winmjtas.exe
Claimed Publisher: winmjtas.exe

SHA 256: E0B193D47609C9622AA018E81DA69C24B921F2BA682F3E18646A0D09EC63AC2B
MD5: bf31a8d79f704f488e3dbcb6eea3b3e3
VirusTotal: https://www.virustotal.com/file/E0B193D47609C9622AA018E81DA69C24B921F2BA682F3E18646A0D09EC63AC2B/analysis/

Typical Filename: mhjsm.sys
Claimed Product: mhjsm.sys
Claimed Publisher: mhjsm.sys

SHA 256: AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615
MD5: 3291e1603715c47a23b60a8bf2ca73db
VirusTotal: https://www.virustotal.com/file/AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615/analysis/

Typical Filename: 02.tmp
Claimed Product: 02.tmp
Claimed Publisher: 02.tmp

SHA 256: 144A9D9A35A2210FDAC2CA23660671C7C9A2905EA5A7EC9220ADC336A84BAF93
MD5: d2a67ee9141d02336760a11919891038
VirusTotal: https://www.virustotal.com/file/144A9D9A35A2210FDAC2CA23660671C7C9A2905EA5A7EC9220ADC336A84BAF93/analysis/

Typical Filename: BrowserDefender.dll
Claimed Product: BrowserDefender.dll
Claimed Publisher: BrowserDefender.dll