CONTENTS:

NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES 10/14/2013 - 10/18/2013

TOP VULNERABILITY THIS WEEK: Multiple Backdoors in Routers

NOTABLE RECENT SECURITY ISSUES SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM

Title: Tenda W302R wireless router w302r_mfg remote code execution
Description: By sending a UDP packet with a certain string in the
content, the user is able to make the router execute commands remotely.
This backdoor only works on the local lan. This backdoor was likely
first implemented in Tendas W302R router, although it also exists in the
Tenda W330R, as well as re-branded models, such as the Medialink
MWN-WAPR150N.
Reference:
http://www.devttys0.com/2013/10/from-china-with-love/
Snort SID: 28289-28290
ClamAV: N/A

Title: WHMCS 5.2.8 Vulnerability
Description: Through the manipulation of variables, files are able to
be written to a remote install of WHMCS.
Reference:
http://thehackernews.com/2013/10/web-hosting-software-whmcs-vulnerable.html
Snort SID: 28299
ClamAV: N/A

Title: Kore, Nuclear, and Magnitude Exploit Kits are on the rise
Description: Various Exploit Kits are scrambling to take the “King of
the Hill” title after the arrest of ‘pauch’ the author of the Blackhole
and Cool Exploit Kits.
Reference:
http://vrt-blog.snort.org/2013/10/sweet-orange-exploit-kit-was-new-king.html
Snort SID: Multiple
ClamAV: Multiple

Title: Apple Releases OSX Mavericks, iOS 7.0.3
Description: Apple has released the newest version of their OS for both
the iOS platform and the Desktop. Many security vulnerabilities are
fixed in these releases, and both releases are free.
Reference:
http://www.apple.com
Snort SID: N/A
ClamAV: N/A

INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY

Apache fixes Information Disclosure Vulnerability in Shindig
http://threatpost.com/apache-fixes-information-disclosure-vulnerability-in-shindig/102650

Court Rules Probable-Cause Warrant Required for GPS Trackers
http://www.wired.com/threatlevel/2013/10/warrant-required-gps-trackers/

Social Threats of Greatest Risk Concern for Executives
https://www.infosecisland.com/blogview/23434-Social-Threats-of-Greatest-Risk-Concern-for-Executives.html

Generation Y Users Say They Will Break Corporate BYOD Rules
http://www.darkreading.com/management/generation-y-users-say-they-will-break-c/240162955

RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM

This is a list of recent vulnerabilities for which exploits are
available. System administrators can use this list to help in
prioritization of their remediation activities. The Qualys Vulnerability
Research Team compiles this information based on various exploit
frameworks, exploit databases, exploit kits and monitoring of internet
activity.

ID: CVE-2013-2333
Title: HP Data Protector Cell Request Service Buffer Overflow
Vendor: HP
Description: Unspecified vulnerability in HP Storage Data Protector
6.20, 6.21, 7.00, and 7.01 allows remote attackers to execute arbitrary
code via unknown vectors, aka ZDI-CAN-1680.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: Not Available
Title: D-Link Authentication Security Bypass Vulnerability
Vendor: D-Link
Description: A remote exploitation of a design error vulnerability in
D-Link Systems Inc.’s routers could allow attackers to bypass
authentication security restrictions. The router allows any user with a
Web browser having the user agent string
“xmlset_roodkcableoj28840ybtide” to gain access to the Web interface of
the device without the requirement for any authentication credentials.
Affects D-Link Firmware v1.13 and other versions may also be affected.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: CVE-2013-3897
Title: Microsoft Internet Explorer CDisplayPointer Use-After-Free (MS13-080)
Vendor: Microsoft
Description: Use-after-free vulnerability in the CDisplayPointer class
in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote
attackers to execute arbitrary code or cause a denial of service (memory
corruption) via crafted JavaScript code that uses the onpropertychange
event handler, as exploited in the wild in September and October 2013,
aka “Internet Explorer Memory Corruption Vulnerability.”
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: Not Available
Title: Joomla! Unauthorised Uploads
Vendor: Joomla!
Description: Inadequate filtering leads to the ability to bypass file
type upload restrictions.
Affects Joomla! version 2.5.13 and earlier 2.5.x versions; and version
3.1.4 and earlier 3.x versions
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: CVE-2013-2251
Title: Apache Struts 2 DefaultActionMapper Prefixes OGNL Code Execution
Vendor: Apache
Description: Apache Struts 2.0.0 through 2.3.15 allows remote attackers
to execute arbitrary OGNL expressions via a parameter with a crafted (1)
action: , (2) redirect:, or (3) redirectAction: prefix.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

MOST PREVALENT MALWARE FILES 10/14/2013 - 10/18/2013 COMPILED BY SOURCEFIRE

SHA 256: CA66FE4F11D4CE764F9348BEA9EBDE18A57F9DA928FE381D434A9DE2882D1BB1
MD5: 8ed6e23731912c9a1da25223422487b3
VirusTotal:
https://www.virustotal.com/en/file/ CA66FE4F11D4CE764F9348BEA9EBDE18A57F9DA928FE381D434A9DE2882D1BB1/analysis/
Typical Filename: Random
Claimed Product: None
Claimed Publisher: None
Detection Name: Sality

SHA 256: 6F2717BCC3428D7044C488976788695B60F1C3F9F29AA791DEAA31E21A3F049D
MD5: a2a4e91cdf63cfdd05592d355335bcaa
VirusTotal:
https://www.virustotal.com/en/file/ 6F2717BCC3428D7044C488976788695B60F1C3F9F29AA791DEAA31E21A3F049D/analysis/
Typical Filename: Random
Claimed Product: None
Claimed Publisher: None
Detection Name: Sality

SHA 256: 7BEB3EAED035809B9F9DC11ABBD8B33ADC534ED1F2AC80D096C57820330A6E80
MD5: 0b62417da5719b3ea1d343da3431c97f
VirusTotal:
https://www.virustotal.com/en/file/ 7BEB3EAED035809B9F9DC11ABBD8B33ADC534ED1F2AC80D096C57820330A6E80/analysis/
Typical Filename: FLVPlayerUpdate_downloader_by_FLVPlayerUpdate.exe
Claimed Product: Somoto
Claimed Publisher: BetterInstaller
Detection Name: Somoto

SHA 256: d14b66bd4c4c8f66a6edf2820fd4162d09b326beaf6a42014596571e81a1a503
MD5: 68b7f7a26b76805432e3d50009d2ab1f
VirusTotal:
https://www.virustotal.com/en/file/ D14B66BD4C4C8F66A6EDF2820FD4162D09B326BEAF6A42014596571E81A1A503/analysis/
Typical Filename: W32.Agent:B.16lp.1201
Claimed Product: W32.Agent:B.16lp.1201
Claimed Publisher: W32.Agent:B.16lp.1201
Detection Name: W32.Agent:B.16lp.1201

SHA 256: D41F20AF6D1664BEDC12DF152849BC058D31D9563B9FA973B71BCCEEE17EDB80
MD5: 918007c1311c833b58f50b59b454266d
VirusTotal:
https://www.virustotal.com/en/file/ D41F20AF6D1664BEDC12DF152849BC058D31D9563B9FA973B71BCCEEE17EDB80/analysis/
Typical Filename: WebCakeDesktop.exe
Claimed Product: WebCakeDesktop.exe
Claimed Publisher: WebCakeDesktop.exe
Detection Name: W32.WebCake:WebcakeAAdw.16lo.hw