CONTENTS:

NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES 11/6/2013 - 11/13/2013

TOP VULNERABILITY THIS WEEK: Microsoft Office TIFF Integer Overflow

NOTABLE RECENT SECURITY ISSUES SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM

Title: Microsoft Office TIFF Integer Overflow
Description: An unpatched integer overflow vulnerability exists in a
graphic rendering library used by Office products or by some versions
of Windows.
References:
http://blogs.technet.com/b/srd/archive/2013/11/05/cve-2013-3906-a-graphics-vulnerability-exploited-through-word-documents.aspx
http://blog.snort.org/2013/11/sourcefire-vrt-certified-snort-rules.html

Snort SID: 28464-28471
ClamAV: BC.Exploit.CVE_2013_3906-2

Title: Microsoft Office Patch Tuesday Release
Description: This month’s Microsoft Tuesday Update brings us 8 bulletins
for a total of 19 CVEs.
References:
http://blog.snort.org/2013/11/sourcefire-vrt-certified-snort-rules_13.html
http://technet.microsoft.com/en-us/security/bulletin/ms13-091
http://technet.microsoft.com/en-us/security/bulletin/ms13-095
http://technet.microsoft.com/en-us/security/bulletin/ms13-093
http://technet.microsoft.com/en-us/security/bulletin/ms13-092
http://technet.microsoft.com/en-us/security/bulletin/ms13-089
http://technet.microsoft.com/en-us/security/bulletin/ms13-088
http://technet.microsoft.com/en-us/security/bulletin/ms13-094
http://technet.microsoft.com/en-us/security/bulletin/ms13-090

Snort SID: See Sourcefire advisory above
ClamAV: Multiple

Title: CryptoLocker Ransomware Gets a Decryption Service
Description: As CryptoLocker Ransomware makes its rounds, criminals have
launched a “CryptoLocker Decryption Service”.
Reference:
http://thehackernews.com/2013/11/CryptoLocker-Ransomware-Decryption-service-malware-keys.html
Snort SID: 28044, 28416
ClamAV: Multiple

INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY

ELF Carver - Recovering Linux Binaries
http://www.utdallas.edu/~shand/papers/elf_carver.pdf

Malicious PDF Analysis Evasion Techniques
http://blog.trendmicro.com/trendlabs-security-intelligence/malicious-pdf-analysis-evasion-techniques/

Introduction to reverse engineering for beginners
http://yurichev.com/writings/RE_for_beginners-en.pdf

Sality gets an upgrade
http://www.totaldefense.com/blogs/2013/11/12/sality-gets-upgrade.aspx

Resources for reversing OSX
http://samdmarshall.com/re.html

Sinowal attempts to disable Rapport, aid Zbot
http://blog.trendmicro.com/trendlabs-security-intelligence/sinowal-attempts-to-disable-rapport-aid-zbot/

RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM

This is a list of recent vulnerabilities for which exploits are
available. System administrators can use this list to help in
prioritization of their remediation activities. The Qualys Vulnerability
Research Team compiles this information based on various exploit
frameworks, exploit databases, exploit kits and monitoring of internet
activity.

ID: CVE-2013-3918
Title: Microsoft ActiveX Controls “InformationCardSigninHelper Class”
Out-of-Bounds Memory Access Vulnerability
Vendor: Microsoft
Description: A remote code execution vulnerability exists in the
InformationCardSigninHelper Class ActiveX control.
Specifically the issue occurs in the way “InformationCardSigninHelper
Class” ActiveX control (icardie.dll) is loaded into Internet Explorer
and causes system state corruption.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: CVE-2013-3906
Title: Microsoft Graphics Component Could Allow Remote Code Execution
Vendor: Microsoft
Description: Remote exploitation of a memory corruption vulnerability
in multiple Microsoft products could allow attackers to execute
arbitrary code on the targeted host. The issue occurs with how the TIFF
codec in Microsoft’s graphics component handles crafted TIFF files.
Processing crafted TIFF files can corrupt system memory and create an
exploitable condition.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: CVE-2012-1823
Title: PHP Group PHP CGI Query String Parameter Processing Remote Code
Execution
Vendor: PHP
Description: sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before
5.4.2, when configured as a CGI script (aka php-cgi), does not properly
handle query strings that lack an = (equals sign) character, which
allows remote attackers to execute arbitrary code by placing
command-line options in the query string, related to lack of skipping a
certain php_getopt for the ‘d’ case.
CVSS v2 Base Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

ID: Not Available
Title: D-Link Authentication Security Bypass Vulnerability
Vendor: D-Link
Description: A remote exploitation of a design error vulnerability in
D-Link Systems Inc.’s routers could allow attackers to bypass
authentication security restrictions. The router allows any user with a
Web browser having the user agent string
“xmlset_roodkcableoj28840ybtide” to gain access to the Web interface of
the device without the requirement for any authentication credentials.
Affects D-Link Firmware v1.13 and other versions may also be affected.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: CVE-2013-2251
Title: Apache Struts 2 DefaultActionMapper Prefixes OGNL Code Execution
Vendor: Apache
Description: Apache Struts 2.0.0 through 2.3.15 allows remote attackers
to execute arbitrary OGNL expressions via a parameter with a crafted (1)
action: , (2) redirect:, or (3) redirectAction: prefix.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

MOST PREVALENT MALWARE FILES 11/6/2013 - 11/13/2013 COMPILED BY SOURCEFIRE

SHA 256: 00B7ACFCACD70642EB75871708D59F8D1A7DBCF813F235B7C2B37AC2DF7F87B7
MD5: e66e725e10b9cb8a6f5c74d7ca9e98a9
VirusTotal:
https://www.virustotal.com/en/file/ 00B7ACFCACD70642EB75871708D59F8D1A7DBCF813F235B7C2B37AC2DF7F87B7/analysis/
Typical Filename: BitGuard.exe
Claimed Product: Protector
Claimed Publisher: MediaTechSoft Inc.

SHA 256: ca24a8f7c04fe15a758f3360c8e5619205c53807bfc65f82c028cdf808bf2189
MD5: ec63f649f7090f885ebd4770ffb92fcb
VirusTotal:
https://www.virustotal.com/en/file/ CA24A8F7C04FE15A758F3360C8E5619205C53807BFC65F82C028CDF808BF2189/analysis/
Typical Filename: UpdateTask.exe
Claimed Product: W32.Trojan.16l1
Claimed Publisher: None.

SHA 256: a1f8f37d2d5646e06201ae961e6246337ee73569c8e157d21b9211a75fc26630
MD5: dad6f82c589cd0d558374a8b5fa293b2
VirusTotal:
https://www.virustotal.com/en/file/ A1F8F37D2D5646E06201AE961E6246337EE73569C8E157D21B9211A75FC26630/analysis/
Typical Filename: smodsulog.exe
Claimed Product: Worm.Palevo
Claimed Publisher: None

SHA 256: df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c
MD5: 25aa9bb549ecc7bb6100f8d179452508
VirusTotal:
https://www.virustotal.com/en/file/ DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C/analysis/
Typical Filename: ygrqpx.exe
Claimed Product: W32.Sality
Claimed Publisher: None.

SHA 256: b2cad8322db85f67db6ea074d00c2ed56ce1fa92952d07b70baac249fa18236d
MD5: 249a44dcfa2500eb1c020e33a3e9f25b
VirusTotal:
https://www.virustotal.com/en/file/ B2CAD8322DB85F67DB6EA074D00C2ED56CE1FA92952D07B70BAAC249FA18236D/analysis/
Typical Filename: FlashPlayerUpdateService.exe
Claimed Product: W32.Downloader:AgentASEBTrj.16mc.1201
Claimed Publisher: None

(c) 2013. All rights reserved. The information contained in this

newsletter, including any external links, is provided “AS IS,” with no
express or implied warranty, for informational purposes only.

Please feel free to share this with interested parties via email, but
no posting is allowed on web sites. For a free subscription, (and for
free posters) or to update a current subscription, visit
https://www.sans.org/account