CONTENTS:

NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES 12/1/2013 - 12/7/2013

TOP VULNERABILITY THIS WEEK: Microsoft Tuesday Updates

NOTABLE RECENT SECURITY ISSUES SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM

Title: Microsoft Tuesday Updates
Description: 24 CVEs have been fixed in the latest rounds of Microsoft
Tuesday Updates. 7 CVEs in Internet Explorer alone. For a full breakdown
of the CVEs and the vulnerabilities see below:
Reference:
http://vrt-blog.snort.org/2013/12/microsoft-update-tuesday-december-2013.html
https://isc.sans.edu/diary/Microsoft+December+Patch+Tuesday/17198
Snort SID: 27823, 28464-28473, 28487-28488, 28525-28526, 28862-28863,
28865-28878, 28880-28882

Title: Adobe Flash and Shockwave Player Updates
Description: This vulnerability is of an extremely low priority being
that you have to be logged in and the traffic is SSL encrypted, however,
it is possible for users to retrieve sensitive information, to create
additional accounts and to perform remote code execution.
Reference:
https://isc.sans.edu/diary/Adobe+Updates+today+as+well./17201
Snort SID: Detection is forthcoming
ClamAV: Detection is forthcoming

Title: Dexter2/Stardust POS Malware
Description: A new version of POS Malware known as “Dexter2” or
“Stardust” has been discovered and disclosed on the internet.
Reference:
http://www.arbornetworks.com/asert/2013/12/happy-holidays-point-of-sale-malware-campaigns-targeting-credit-and-debit-cards/
Snort SID: 28891-28892, 25553
ClamAV: N/A

INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY

When an Exploit Kit is VERY Simple
http://vrt-blog.snort.org/2013/12/when-exploit-kit-is-very-simple.html

Look what I found, Moar Pony!
http://blog.spiderlabs.com/2013/12/look-what-i-found-moar-pony.html

Malicious multi-hop iframe campaign affects thousands of Web sites,
leads to a cocktail of client-side exploits - part two
http://www.webroot.com/blog/2013/12/09/malicious-multi-hop-iframe-campaign-affects-thousands-web-sites-leads-cocktail-client-side-exploits-part-two/

RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM

This is a list of recent vulnerabilities for which exploits are
available. System administrators can use this list to help in
prioritization of their remediation activities. The Qualys Vulnerability
Research Team compiles this information based on various exploit
frameworks, exploit databases, exploit kits and monitoring of internet
activity.

D: CVE-2013-5331
Title: Adobe Flash Player Memory Corruption Code Execution
Vulnerability (APSB13-28)
Vendor: Adobe
Description: Remote exploitation of a memory corruption vulnerability
in Adobe System Inc.’s Flash Player versions 11.9.900.152 and earlier
versions for Windows and Macintosh and Adobe Flash Player 11.2.202.327
and earlier versions for Linux. This could allow an attacker to execute
arbitrary code. Adobe is aware of reports that an exploit designed to
trick the user into opening a Microsoft Word document with malicious
Flash (.swf).
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: CVE-2013-5065
Title: Microsoft Windows Kernel “NDProxy.sys Driver” Input Validation
Code Execution Vulnerability
Vendor: Microsoft
Description: NDProxy.sys in the kernel in Microsoft Windows XP SP2 and
SP3 and Server 2003 SP2 allows local users to gain privileges via a
crafted application, as exploited in the wild in November 2013.
CVSS v2 Base Score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)

ID: CVE-2013-5486
Title: Cisco Prime Data Center Network Manager (DCNM)
“fileUploadServlet” Command Execution Vulnerability
Vendor: Cisco
Description: DCNM-SAN Server in Cisco Prime Data Center Network Manager
(DCNM) before 6.2(1) allows remote attackers to execute arbitrary
commands via unspecified vectors, aka Bug IDs CSCue77035 and CSCue77036.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: CVE-2013-0074
Title: Microsoft Silverlight Double Dereference Vulnerability
Vendor: Microsoft
Description: Microsoft Silverlight 5, and 5 Developer Runtime, before
5.1.20125.0 does not properly validate pointers during HTML object
rendering, which allows remote attackers to execute arbitrary code via
a crafted Silverlight application, aka “Silverlight Double Dereference
Vulnerability.”
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: CVE-2013-3906
Title: Microsoft Graphics Component Could Allow Remote Code Execution
Vendor: Microsoft
Description: GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2;
Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility
Pack SP3; and Lync 2010, 2010 Attendee, 2013, and Basic 2013 allows
remote attackers to execute arbitrary code via a crafted TIFF image, as
demonstrated by an image in a Word document, and exploited in the wild
in October and November 2013.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: CVE-2013-6026
Title: D-Link Authentication Security Bypass Vulnerability
Vendor: D-Link
Description: The web interface on D-Link DIR-100, DIR-120, DI-624S,
DI-524UP, DI-604S, DI-604UP, DI-604+, and TM-G5240 routers; Planex
BRL-04R, BRL-04UR, and BRL-04CW routers; and Alpha Networks routers
allows remote attackers to bypass authentication and modify settings via
an xmlset_roodkcableoj28840ybtide User-Agent HTTP header, as exploited
in the wild in October 2013.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

MOST PREVALENT MALWARE FILES 12/1/2013 - 12/7/2013 COMPILED BY SOURCEFIRE

SHA 256: DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C
MD5: 25aa9bb549ecc7bb6100f8d179452508
VirusTotal:
https://www.virustotal.com/en/file/ DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C/analysis/
Typical Filename: Random
Claimed Product: Random
Detection Name: W32.DF83A0D694-100.SBX.VIOC

SHA 256: 180c6035ca44c270b8e1556a7b2e9faf442d1b4323ef6d8e93b7e759af169c96
MD5: 44e5b5dc6a27ea109b8a234e640bb5fd
VirusTotal:
https://www.virustotal.com/en/file/ 180C6035CA44C270B8E1556A7B2E9FAF442D1B4323EF6D8E93B7E759AF169C96/analysis/
Typical Filename: BitGuard
Claimed Product: BitGuard
Detection Name: W32.Agent:BProtector.16nb.dk

SHA 256: 5b8a898d66a1cb12ab682799cbb501699faf860b5f98a6a37068963ac1c844ac
MD5: 9b32cd6e776ee3abd010f44fecd7edfc
VirusTotal:
https://www.virustotal.com/en/file/ 5B8A898D66A1CB12AB682799CBB501699FAF860B5F98A6A37068963AC1C844AC/analysis/
Typical Filename: hao123Inst.exe
Claimed Product: hao123Inst.exe
Detection Name: W32.Auto:5b8a89.TG.VRT

SHA 256: aa0bbaecb678868e1e7f57c7ca9d61b608b3d788be490790eb1d148beadf4615
MD5: 3291e1603715c47a23b60a8bf2ca73db
VirusTotal:
https://www.virustotal.com/en/file/ AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615/analysis/
Typical Filename: 08.tmp
Claimed Product: None
Detection Name: Confiker