CONTENTS::

NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES 10/21/2013 - 10/25/2013

TOP VULNERABILITY THIS WEEK: Magnitude Exploit Kit on the rise

NOTABLE RECENT SECURITY ISSUES SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM

Title: Magnitude Exploit Kit on the rise
Description: The Sourcefire VRT monitors the activity of Exploit Kits
throughout the day, and the activity of which exploit kit would be
clamoring for the “top title” since the arrest of Blackhole/Cool Exploit
Kits author ‘paunch’ has been interesting to watch. Sweet Orange Exploit
Kit had a sharp rise right after the arrest, but as of the writing of
this, Magnitude/PopAds seems to be the most active.
Magnitude is currently using ports
51423
44449
33300
and g01pack has been observed on port
15489

Reference:
http://vrt-blog.snort.org/2013/10/sweet-orange-exploit-kit-was-new-king.html
Snort SID: Multiple
ClamAV: Multiple

Title: EMC AlphaStor Device Manager Format String Vulnerability
Description: EMC AlphaStore uses a proprietary protocol to handle
tape-backup tasks. It is vulnerable to a format string attack in five
of the EMC NetWorker commands when a certain OpCode is used.
Reference:
http://www.osvdb.org/show/osvdb/89435
Snort SID: 28394-28398
ClamAV: N/A

Title: HP Intelligent Management Center BIMS UploadServlet Arbitrary File Upload
Description: An arbitrary file upload vulnerability exists in the HP
Intelligent Management Center Branch Intelligent Management Software
module.
Reference:
http://www.osvdb.org/show/osvdb/98247
Snort SID: 28407
ClamAV: N/A

INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY

Meet ‘Muscular’: NSA accused of tapping links between Yahoo, Google
datacenters
http://www.zdnet.com/meet-muscular-nsa-accused-of-tapping-links-between-yahoo-google-datacenters-7000022624/

A Malware Classification
http://blog.kaspersky.com/a-malware-classification/

Tech Support Scam Update: Still Flourishing, Still Evolving
http://www.welivesecurity.com/2013/10/29/tech-support-scam-update-still-flourishing-still-evolving/

Infection rates and end of support for Windows XP
http://blogs.technet.com/b/mmpc/archive/2013/10/29/infection-rates-and-end-of-support-for-windows-xp.aspx

Rent-A-Hacker
http://www.f-secure.com/weblog/archives/00002629.html

Legislation Unveiled to Bar NSA’s Bulk Phone Metadata Collection
http://feeds.wired.com/c/35185/f/661467/s/330ec4d6/sc/1/l/ 0L0Swired0N0Cthreatlevel0C20A130C10A0Cusa0Efreedom0Eact0C/story01.htm

Researchers Detail Widespread iOS Application Vulnerability
http://www.tripwire.com/state-of-security/top-security-stories/researchers-detail-widespread-ios-app-vulnerability/

Obama Administration to Review NSA Capabilities
http://threatpost.com/obama-administration-to-review-nsa-capabilities/102730

Cutwail Spam Campaign Changes Tactics
http://www.allspammedup.com/2013/10/cutwail-spam-campaign-changes-tactics/

RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM

This is a list of recent vulnerabilities for which exploits are
available. System administrators can use this list to help in
prioritization of their remediation activities. The Qualys Vulnerability
Research Team compiles this information based on various exploit
frameworks, exploit databases, exploit kits and monitoring of internet
activity.

ID: CVE-2013-4822
Title: HP Intelligent Management Center BIMS UploadServlet Directory Traversal
Vendor: HP
Description: Unspecified vulnerability in HP Intelligent Management
Center (iMC) and HP IMC Branch Intelligent Management System Software
Module (aka BIMS) allows remote attackers to execute arbitrary code via
unknown vectors, aka ZDI-CAN-1606.

ID: CVE-2013-6021
Title: WatchGuard Firewall XTM 11.7.4u1 Remote Buffer Overflow
Vendor: WatchGuard
Description: Buffer overflow in WGagent in WatchGuard WSM and Fireware
before 11.8 allows remote attackers to execute arbitrary code via a long
sessionid value in a cookie.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: Not Available
Title: D-Link Authentication Security Bypass Vulnerability
Vendor: D-Link
Description: A remote exploitation of a design error vulnerability in
D-Link Systems Inc.’s routers could allow attackers to bypass
authentication security restrictions. The router allows any user with a
Web browser having the user agent string
“xmlset_roodkcableoj28840ybtide” to gain access to the Web interface of
the device without the requirement for any authentication credentials.
Affects D-Link Firmware v1.13 and other versions may also be affected.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: CVE-2013-3897
Title: Microsoft Internet Explorer CDisplayPointer Use-After-Free (MS13-080)
Vendor: Microsoft
Description: Use-after-free vulnerability in the CDisplayPointer class
in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote
attackers to execute arbitrary code or cause a denial of service (memory
corruption) via crafted JavaScript code that uses the onpropertychange
event handler, as exploited in the wild in September and October 2013,
aka “Internet Explorer Memory Corruption Vulnerability.”
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: CVE-2013-2251
Title: Apache Struts 2 DefaultActionMapper Prefixes OGNL Code Execution
Vendor: Apache
Description: Apache Struts 2.0.0 through 2.3.15 allows remote attackers
to execute arbitrary OGNL expressions via a parameter with a crafted (1)
action: , (2) redirect:, or (3) redirectAction: prefix.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

MOST PREVALENT MALWARE FILES 10/21/2013 - 10/25/2013 COMPILED BY SOURCEFIRE

SHA 256: DAD74779542E84D9358B7F24CC21A831C2F63BAB4931C2DD2A4D561A24794AB6
MD5: b0709680a86bdd99f968752c9449b809
VirusTotal:
https://www.virustotal.com/en/file/ DAD74779542E84D9358B7F24CC21A831C2F63BAB4931C2DD2A4D561A24794AB6/analysis/
Typical Filename: Bitguard.dll
Claimed Product: Bitguard.dll
Claimed Publisher: Bitguard.dll
Detection Name: W32.Variant:BProtector.16l1.1201

SHA 256: DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C
MD5: a2a4e91cdf63cfdd05592d355335bcaa
VirusTotal:
https://www.virustotal.com/en/file/ 6F2717BCC3428D7044C488976788695B60F1C3F9F29AA791DEAA31E21A3F049D/analysis/
Typical Filename: Random
Claimed Product: None
Claimed Publisher: None
Detection Name: Sality

SHA 256: 7BEB3EAED035809B9F9DC11ABBD8B33ADC534ED1F2AC80D096C57820330A6E80
MD5: 25aa9bb549ecc7bb6100f8d179452508
VirusTotal:
https://www.virustotal.com/en/file/ DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C/analysis/
Typical Filename: Random
Claimed Product: None
Claimed Publisher: None
Detection Name: W32.Sality:StubOfSalityTrj.16g1

SHA 256: d14b66bd4c4c8f66a6edf2820fd4162d09b326beaf6a42014596571e81a1a503
MD5: 68b7f7a26b76805432e3d50009d2ab1f
VirusTotal:
https://www.virustotal.com/en/file/ D14B66BD4C4C8F66A6EDF2820FD4162D09B326BEAF6A42014596571E81A1A503/analysis/
Typical Filename: W32.Agent:B.16lp.1201
Claimed Product: W32.Agent:B.16lp.1201
Claimed Publisher: W32.Agent:B.16lp.1201
Detection Name: W32.Agent:B.16lp.1201

SHA 256: AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615
MD5: 3291e1603715c47a23b60a8bf2ca73db
VirusTotal:
https://www.virustotal.com/en/file/ AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615/analysis/
Typical Filename: Confiker
Claimed Product: None
Claimed Publisher: None
Detection Name: Confiker