CONTENTS:

NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES 6/11/2013 - 6/18/2013

TOP VULNERABILITY THIS WEEK: Vulnerability in Microsoft Internet Explorer 8

NOTABLE RECENT SECURITY ISSUES SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM

Title: Secclean fake antivirus
Description: FakeAV continues to be a prevalent threat in the wild
surrounding the Microsoft Windows Operating system, typically loaded in
the Trojan method.
Ref: http://blog.0x3a.com/post/63080734846/analysis-of-the-security-cleaner-pro-fake-antivirus
Snort SID: 28248-28250
ClamAV: Win.Downloader.Seclean, Win.Trojan.Seclean

Title: DLink DIR-100 User-Agent Backdoor
Description: By setting a User-Agent to a specific value, as detailed
in the below link, certain DLink devices can be accessed without
authorization or security.
Reference: http://www.devttys0.com/2013/10/reverse-engineering-a-d-link-backdoor/
Snort SID: 28240
ClamAV: N/A

Title: MS IE cdisplaypointer 0-day metasploit module
Description: This week a Metasploit module released for Microsoft
Internet Explorer CVE-2013-3897 was released. This makes a previously
not-well-known vulnerability in Microsoft Internet Explorer more
available to penetration testers and researchers.
Reference: http://www.rapid7.com/db/modules/exploit/windows/browser/ms13_080_cdisplaypointer
Snort SID: 28091-28092, 28207-28208
ClamAV: BC.Exploit.CVE_2013_3897

INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY

Vulnerabilities Discovered in Global Vessel Tracking Systems:
http://blog.trendmicro.com/trendlabs-security-intelligence/vulnerabilities-discovered-in-global-vessel-tracking-systems/

What will the cybersecurity landscape look like in 2020?
https://www.icspa.org/uploads/media/ ICSPA_Project_2020_%E2%80%93_Scenarios_for_the_Future_of_Cybercrime.pdf
“Dexter” malware infects South African restaurants, costs banks millions
http://arstechnica.com/security/2013/10/dexter-malware-infects-south-african-restaurants-costs-banks-millions/

SafeSlinger App for mobile devices
https://www.cmu.edu/news/stories/archives/2013/october/oct7_safeslingerapp.html

RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM

This is a list of recent vulnerabilities for which exploits are
available. System administrators can use this list to help in
prioritization of their remediation activities. The Qualys Vulnerability
Research Team compiles this information based on various exploit
frameworks, exploit databases, exploit kits and monitoring of internet
activity.

ID: Not Available
Title: D-Link Authentication Security Bypass Vulnerability
Vendor: D-Link
Description: A remote exploitation of a design error vulnerability in
D-Link Systems Inc.’s routers could allow attackers to bypass
authentication security restrictions. The router allows any user with a
Web browser having the user agent string
“xmlset_roodkcableoj28840ybtide” to gain access to the Web interface of
the device without the requirement for any authentication credentials.
Affects D-Link Firmware v1.13 and other versions may also be affected.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: CVE-2013-3897
Title: Microsoft Internet Explorer CDisplayPointer Use-After-Free (MS13-080)
Vendor: Microsoft
Description: Use-after-free vulnerability in the CDisplayPointer class
in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote
attackers to execute arbitrary code or cause a denial of service (memory
corruption) via crafted JavaScript code that uses the onpropertychange
event handler, as exploited in the wild in September and October 2013,
aka “Internet Explorer Memory Corruption Vulnerability.”
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: CVE-2013-3576
Title: HP System Management Homepage “ginkgosnmp.inc” Command Injection Vulnerability
Vendor: HP
Description: ginkgosnmp.inc in HP System Management Homepage (SMH)
allows remote authenticated users to execute arbitrary commands via
shell metacharacters in the PATH_INFO to smhutil/snmpchp.php.en.
CVSS v2 Base Score: 9.0 (AV:N/AC:L/Au:S/C:C/I:C/A:C)

ID: Not Available
Title: Joomla! Unauthorised Uploads
Vendor: Joomla!
Description: Inadequate filtering leads to the ability to bypass file
type upload restrictions. Affects Joomla! version 2.5.13 and earlier
2.5.x versions; and version 3.1.4 and earlier 3.x versions
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: CVE-2013-2251
Title: Apache Struts 2 DefaultActionMapper Prefixes OGNL Code Execution
Vendor: Apache
Description: Apache Struts 2.0.0 through 2.3.15 allows remote attackers
to execute arbitrary OGNL expressions via a parameter with a crafted (1)
action: , (2) redirect:, or (3) redirectAction: prefix.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

MOST PREVALENT MALWARE FILES 6/11/2013 - 6/18/2013 COMPILED BY SOURCEFIRE

SHA 256: 6090C85CF5750E141F2BD6D2334EC0EB79188E2DE05DE06235726E73C0B0D792
MD5: 2ebbe2521176388c7bc5365e197bf801
VirusTotal:
https://www.virustotal.com/en/file/ 6090C85CF5750E141F2BD6D2334EC0EB79188E2DE05DE06235726E73C0B0D792/analysis/

Typical Filename: BitGuard.dll
Claimed Product: Protector
Claimed Publisher: MediaTechSoft Inc.

SHA 256: 440BB8C5BF684C60CA4725FA43DB52EF471E9C7B47834E82B8E2B76656312EDF
MD5: da25422dd2ef0a33bb5725bfe5be1367
VirusTotal:
https://www.virustotal.com/en/file/ 440BB8C5BF684C60CA4725FA43DB52EF471E9C7B47834E82B8E2B76656312EDF/analysis/

Typical Filename: Random
Claimed Product: Trojan.Zeroaccess
Claimed Publisher: None

SHA 256: 1DCAD6AE885A6D24662982290D9CE62DC0C708786025C297E85118236FF61E64
MD5: 3aec103d38c7520229e18af260c5a00d
VirusTotal:
https://www.virustotal.com/en/file/ 1DCAD6AE885A6D24662982290D9CE62DC0C708786025C297E85118236FF61E64/analysis/

Typical Filename: (Random)
Claimed Product: Sirefef
Claimed Publisher: None.

SHA 256: A6B140EC734C258C5EBF19C0BC0B414B5655ADC00108A038B5BE6A8F83D0BD03
MD5: 8ac1e580cf274b3ca98124580e790706
VirusTotal:
https://www.virustotal.com/file/A6B140EC734C258C5EBF19C0BC0B414B5655ADC00108A038B5BE6A8F83D0BD03/analysis/

Typical Filename: Virus.Win32.Sality.ab
Claimed Product: Virus.Win32.Sality.ab
Claimed Publisher: Virus.Win32.Sality.ab

SHA 256: A97BA73A76DF83CA934700B1F3F61851BEEE3A9AF21272323408A4FA3424A64B
MD5: 1ec55311a564f8272d62ccb621a8b513
VirusTotal:
https://www.virustotal.com/en/file/ A97BA73A76DF83CA934700B1F3F61851BEEE3A9AF21272323408A4FA3424A64B/analysis/

Typical Filename: Random
Claimed Product: Trojan.Sisron
Claimed Publisher: None.