CONTENTS:

• NOTABLE RECENT SECURITY ISSUES
• USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
• VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
• MOST POPULAR MALWARE FILES 6/19/2012 - 6/26/2012

Top Vulnerability this week: CVE-2012-0469 in Mozilla Firefox,
Thunderbird and SeaMonkey: patched as of April 2012, however recent
information has been released on how to take advantage the vulnerability
and bypass DEP/ASLR. It is likely that we will see several attacks in
the wild in the near future.”

NOTABLE RECENT SECURITY ISSUES SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM

Title: CVE-2012-0469 Use-after-free vulnerability in the “IDBKeyRange”
interface affecting Mozilla Firefox, Thunderbird and SeaMonkey
Description: This vulnerability was patched in April 2012, however,
newly released information by security firm VUPEN highlights how the
vulnerability can be leveraged in order to bypass DEP and ASLR. We
believe it will only be matter of time before unpatched versions of
Firefox, Thunderbird and SeaMonkey are targeted.
Reference:
http://www.mozilla.org/security/announce/2012/mfsa2012-22.html
http://www.vupen.com/blog/20120625.Advanced_Exploitation_of_Mozilla_Firefox_UaF_CVE-2012-0469.php
Snort SID: 23212
ClamAV: N/A

Title: CVE-2010-0188 Adobe Reader malformed TIFF remote code execution
Description: Several malicious PDF documents found in the wild are
leveraging this vulnerability in order to drop malware on Windows and
Macintosh systems. These PDFs are being used by the Blackhole exploit
kit in “drive by” exploits. You may have seen examples of this in your
environment’s email in the form of USAirways reservations, Amazon.com
orders, and other false emails. The vulnerability is a boundary check
error in the ‘Libtiff’ library when parsing specially crafted PDF
documents. Successful exploitation would cause a stack-based buffer
overflow that may lead to arbitrary code execution in the security
context of the logged in user, or terminate the application abnormally.
Reference: www.adobe.com/support/security/bulletins/apsb10-07.html
Snort SID: 23089
ClamAV: Exploit.PDF-13527, Exploit.PDF.Dropped-17

Title: Worm targeting AutoCAD
Description: A worm specially crafted to steal AutoCAD files has been
found in the wild. While the origin of this worm is unknown, AutoCAD
files are then sent to email accounts provided by 163.com and qq.com,
both Chinese companies. The malware is written in AutoLISP, a scripting
language for AutoCAD.
Reference:
http://securityaffairs.co/wordpress/6677/cyber-crime/a-virus-specialized-for-autocad-a-perfect-cyber-espionage-tool.html
Snort SID: (In testing)
ClamAV: Worm.ACAD, Worm.ACAD-1
Title: CVE-2010-2729 and Stuxnet
Description: June 24, 2012 is when Stuxnet’s replication mechanism
leveraging CVE-2010-2729 is programmed to be deactivated. This means
that that Stuxnet will no longer spread to USB keys using that
vulnerability. This is a welcome relief in the fight against the spread
of the worm, even two years after the initial outbreak. Users need to
be aware that Stuxnet has not always taken advantage of the Windows
Print Spooler Service vulnerability. Prior to March 2010, Stuxnet used
a trick in Autorun in order to spread and this technique may still be
used.
Reference:
http://technet.microsoft.com/en-us/security/bulletin/MS10-061
http://www.symantec.com/connect/blogs/stuxnet-lnk-file-vulnerability
https://www.securelist.com/en/blog/208193609/The_Day_The_Stuxnet_Died
Snort SID: 17044, 20523, 20524
ClamAV: Worm.Stuxnet -> Worm.Stuxnet-9

USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK

Advanced Exploitation of Mozilla Use-after-free vulnerability
http://www.vupen.com/blog/20120625.Advanced_Exploitation_of_Mozilla_Firefox_UaF_CVE-2012-0469.php

Why do Nigerian Scammers Say They are from Nigeria?
http://research.microsoft.com/pubs/167719/WhyFromNigeria.pdf

RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM.

This is a list of recent vulnerabilities for which exploits are
available. System administrators can use this list to help in
prioritization of their remediation activities. The Qualys Vulnerability
Research Team compiles this information based on various exploit
frameworks, exploit databases, exploit kits and monitoring of internet
activity.

ID: CVE-2012-1493
Title: F5 BIG-IP SSH Private Key Exposure
Vendor: F5 Networks Inc
Description: Remote exploitation of a configuration error vulnerability
in multiple F5 Networks Inc. products could allow an attacker to gain
escalated “root” privileges.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: CVE-2011-2110
Title: Adobe Flash Player AVM Verification Logic Array Indexing Code Execution
Vendor: Adobe
Description: Adobe Flash Player before 10.3.181.26 on Windows, Mac OS
X, Linux, and Solaris, and 10.3.185.23 and earlier on Android, allows
remote attackers to execute arbitrary code or cause a denial of service
(memory corruption) via unspecified vectors, as exploited in the wild
in June 2011.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: CVE-2012-0779
Title: Adobe Flash Player Object Type Confusion
Vendor: Adobe
Description: Adobe Flash Player before 10.3.183.19 and 11.x before
11.2.202.235 on Windows, Mac OS X, and Linux; before 11.1.111.9 on
Android 2.x and 3.x; and before 11.1.115.8 on Android 4.x allows remote
attackers to execute arbitrary code via a crafted file, related to an
“object confusion vulnerability,” as exploited in the wild in May 2012.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: CVE-2012-2171
Title: IBM System Storage Manager Profiler SQL Injection and Cross Site
Scripting Vulnerabilities
Vendor: IBM
Description: SQL injection vulnerability in ModuleServlet.do in the
Storage Manager Profiler in IBM System Storage DS Storage Manager before
10.83.xx.18 on DS Series devices allows remote authenticated users to
execute arbitrary SQL commands via the selectedModuleOnly parameter in
a state_viewmodulelog action to the ModuleServlet URI.
CVSS v2 Base Score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)

ID: CVE-2012-2329
Title: PHP apache_request_headers Function Buffer Overflow
Vendor: The PHP Group
Description: Buffer overflow in the apache_request_headers function in
sapi/cgi/cgi_main.c in PHP 5.4.x before 5.4.3 allows remote attackers
to cause a denial of service (application crash) via a long string in
the header of an HTTP request.
CVSS v2 Base Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)

MOST POPULAR MALWARE FILES 6/19/2012 - 6/26/2012: COMPILED BY SOURCEFIRE

SHA 256: 1481ACE90584C46406259C653D2BD3457A2E5F44781E907731C9A618F96C7442
MD5: bb74024a1d4e4808562c090980151653
VirusTotal: https://www.virustotal.com/file/1481ACE90584C46406259C653D2BD3457A2E5F44781E907731C9A618F96C7442/analysis/
Malwr: http://malwr.com/analysis/bb74024a1d4e4808562c090980151653

Typical Filename: mwssvc.exe
Claimed Product: My Web Search Bar
Claimed Publisher: MyWebSearch.com
SHA 256: CB85D393C4E0DB5A1514C21F9C51BA4C12D82B7FABD9724616758AE528A5B16B
MD5: 7961a56c11ba303f20f6a59a506693ff
VirusTotal: https://www.virustotal.com/file/CB85D393C4E0DB5A1514C21F9C51BA4C12D82B7FABD9724616758AE528A5B16B/analysis/
Malwr: http://malwr.com/analysis/7961a56c11ba303f20f6a59a506693ff

Typical Filename: m3SrchMn.exe
Claimed Product: My Web Search Bar
Claimed Publisher: MyWebSearch.com
SHA 256: A6B140EC734C258C5EBF19C0BC0B414B5655ADC00108A038B5BE6A8F83D0BD03
MD5: 8ac1e580cf274b3ca98124580e790706
VirusTotal: https://www.virustotal.com/file/A6B140EC734C258C5EBF19C0BC0B414B5655ADC00108A038B5BE6A8F83D0BD03/analysis/
Malwr: http://malwr.com/analysis/8ac1e580cf274b3ca98124580e790706

Typical Filename: lpkjnn.sys
Claimed Product: -
Claimed Publisher: -
SHA 256: E2C3896C24FD45DD8092AF10DE84B1A4FAF4FC37A1E9772C56148FE982B44181
MD5: cce8aeb6b86e89280e703608eb252e62
VirusTotal: https://www.virustotal.com/file/E2C3896C24FD45DD8092AF10DE84B1A4FAF4FC37A1E9772C56148FE982B44181/analysis/
Malwr: http://malwr.com/analysis/cce8aeb6b86e89280e703608eb252e62

Typical Filename: M3SKPLAY.EXE
Claimed Product: My Web Search Skin Tools
Claimed Publisher: MyWebSearch.com
SHA 256: E0B193D47609C9622AA018E81DA69C24B921F2BA682F3E18646A0D09EC63AC2B
MD5: bf31a8d79f704f488e3dbcb6eea3b3e3
VirusTotal: https://www.virustotal.com/file/E0B193D47609C9622AA018E81DA69C24B921F2BA682F3E18646A0D09EC63AC2B/analysis/
Malwr: http://malwr.com/analysis/bf31a8d79f704f488e3dbcb6eea3b3e3

Typical Filename: pspprn.sys
Claimed Product: -
Claimed Publisher: -