CONTENTS:

NOTABLE RECENT SECURITY ISSUES
LATEST IN THE NEWS
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES 11/8/2012 - 11/15/2012

TOP VULNERABILITY THIS WEEK: Microsoft released six bulletins as part

of their monthly “Patch Tuesday” release. Some of these are rated
critical and all should be patched immediately if possible.

NOTABLE RECENT SECURITY ISSUES SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM

Title: Microsoft Patch Tuesday
Description: Six Microsoft Security Bulletins covering 19 CVE and
Operating Systems from Windows Server 2003 to the brand new Microsoft
Windows 8 and Windows RT. This patch release contains vulnerability
patches for Microsoft IIS, Internet Explorer, .NET, Microsoft Office
Excel, as well as vulnerabilities in the Windows OS itself.
Reference:
https://isc.sans.edu/diary/Microsoft+November+2012+Black+Tuesday+Update+-+Overview/14503
http://blog.snort.org/2012/11/sourcefire-vrt-certified-snort-rules_14.html
Snort SID:
24653, 24654, 24660, 24661, 24662, 24663, 24652, 24671, 24655, 2565, 25664, 24665, 24649, 24650, 24657, 24658, 24659, 24673, 24674, 24666, 16654
ClamAV: HTML.Exploit.CVE_2012_1538, BC.Exploit.CVE_2012_1539,
PUA.Script.CVE_2012_4776, Win.Exploit.CVE_2012_2519,
Win.Exploit.CVE_2012_1895, Win.Exploit.CVE_2012_2897,
BC.Exploit.CVE_2012-1886,BC.Exploit.CVE_2012-1885,Win.Exploit.CVE_2012_1887,BC.Exploit.CVE_2012-2543,

Title: Blackhole Exploit Kit changes structure
Description: In the constant fight against Exploit Kits, the Blackhole
exploit kit seems to be the one that evolves the most rapidly. The
Sourcefire Vulnerability Research Team keeps a close on this and other
exploits kits in order to provide the best detection possible. When
detection is published for these exploit kits, we place it in the
“Exploit-Kit” category. The Blackhole exploit kit, aside from recently
evolving into “Version 2”, can be in almost any delivery method, email,
drive-by web contact, pdf, java, etc. It’s highly recommended that the
latest Java, Flash, Adobe Reader, and Microsoft be applied, and even go
so far as to disable these plugins where possible.
Snort SID: Recent additions: 24636, 24637, 24638
ClamAV: HTML.Trojan.Blackhole, Java.Trojan.Blackhole, Win.Trojan.Blackhole*

Title: KaiXin Exploit pack is back
Description: Much like the Blackhole exploit kit, the KaiXin exploit
pack can be seen in nearly any delivery method. Heavily obfuscated
javascript, Java delivery and attack methods, Flash delivery and attack
are hallmarks of this exploit kit. Pay particular attention to this
attack method and read the references below.
Reference:
http://ondailybasis.com/blog/?p=1610
http://www.kahusecurity.com/2012/new-chinese-exploit-pack/
Snort SID: 24667,24668,24669,24670
ClamAV: Win.Exploit.KaiXin, Win.Exploit.KaiXin-1

Title: New Skype Advisory
Description: ‘….We have had reports of a new security vulnerability
issue. As a precautionary step we have temporarily disabled password
reset as we continue to investigate the issue further. We apologize for
the inconvenience but user experience and safety is our first
priority…..’
Reference:
http://heartbeat.skype.com/2012/11/security_issue.html
Snort SID: N/A
ClamAV: N/A

LATEST IN THE NEWS

Infamous Hacker Heading Chinese Antivirus Firm?:
https://krebsonsecurity.com/2012/11/infamous-hacker-heading-chinese-antivirus-firm/

Mac Trojan Targeting Tibet Sympathizers Discovered:
http://www.theepochtimes.com/n2/china-news/mac-trojan-targeting-tibet-sympathizers-discovered-314082.html

Yes, the FBI and CIA can read your email. Here’s how:
http://www.zdnet.com/yes-the-fbi-and-cia-can-read-your-email-heres-how-7000007319/

Federal agencies, private firms fiercely compete in hiring cyber experts:
http://www.washingtonpost.com/world/national-security/federal-agencies-private-firms-fiercely-compete-in-hiring-cyber-experts/2012/11/12/a1fb1806-2504-11e2-ba29-238a6ac36a08_story.html

Adobe investigates alleged customer data breach:
http://www.pcadvisor.co.uk/news/security/3410815/adobe-investigates-alleged-customer-data-breach/

Websense 2013 Security Predictions report:
https://www.websense.com/content/2013-security-predictions-report.aspx?

RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM

This is a list of recent vulnerabilities for which exploits are
available. System administrators can use this list to help in
prioritization of their remediation activities. The Qualys Vulnerability
Research Team compiles this information based on various exploit
frameworks, exploit databases, exploit kits and monitoring of internet
activity.

ID: : CVE-2012-0507
Title: Oracle Java SE Remote Java Runtime Environment Code Execution Vulnerability
Vendor: Oracle
Description: Unspecified vulnerability in the Java Runtime Environment
(JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30
and earlier, and 5.0 Update 33 and earlier allows remote attackers to
affect confidentiality, integrity, and availability via unknown vectors
related to Concurrency.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: : CVE-2012-4681
Title: Java 7 Applet Remote Code Execution
Vendor: Oracle
Description: Oracle Java 7 Update 6, and possibly other versions, allows
remote attackers to execute arbitrary code via a crafted applet, as
exploited in the wild in August 2012 using Gondzz.class and
Gondvv.class.
CVSS v2 Base Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)

ID: : CVE-2012-4501
Title: Citrix CloudStack and CloudPlatform Default Credentials Design Error Vulnerability
Vendor: Citrix
Description: Citrix Cloud.com CloudStack, and Apache CloudStack
pre-release, allows remote attackers to make arbitrary API calls by
leveraging the system user account, as demonstrated by API calls to
delete VMs.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: : CVE-2012-5076
Title: Java Applet JAX-WS Remote Code Execution
Vendor: Oracle
Description: Unspecified vulnerability in the Java Runtime Environment
(JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote
attackers to affect confidentiality, integrity, and availability,
related to JAX-WS.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: : CVE-2012-5692
Title: Invision Power Board “unserialize()” PHP Code Execution Vulnerability
Vendor: Invision Power Services
Description: Unspecified vulnerability in admin/sources/base/core.php
in Invision Power Board (aka IPB or IP.Board) 3.1.x through 3.3.x has
unknown impact and remote attack vectors.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

MOST PREVALENT MALWARE FILES 11/8/2012 - 11/15/2012 COMPILED BY SOURCEFIRE

SHA 256: B7B28E855B8C6225C605330760FF4DC407EFC83F72F1A04E974A72189D0F1D96
MD5: 573b6cc513e1b7cd9e35b491eacc38f3
VirusTotal: https://www.virustotal.com/file/B7B28E855B8C6225C605330760FF4DC407EFC83F72F1A04E974A72189D0F1D96/analysis/

Typical Filename: winhblmdx.exe
Claimed Product: winhblmdx.exe
Claimed Publisher: winhblmdx.exe

SHA 256: DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C
MD5: 25aa9bb549ecc7bb6100f8d179452508
VirusTotal: https://www.virustotal.com/file/DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C/analysis/

Typical Filename: smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin
Claimed Product: smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin
Claimed Publisher: smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin

SHA 256: AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615
MD5: 3291e1603715c47a23b60a8bf2ca73db
VirusTotal: https://www.virustotal.com/file/AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615/analysis/

Typical Filename: 01.tmp
Claimed Product: 01.tmp
Claimed Publisher: 01.tmp

SHA 256: 358289754D01E20D564E39D79124AFA9BED4D35B3BC22F4E09210EC75E6461B2
MD5: b94b0c0efb6f33bddd2f16907a3a9cd1
VirusTotal: https://www.virustotal.com/file/358289754D01E20D564E39D79124AFA9BED4D35B3BC22F4E09210EC75E6461B2/analysis/

Typical Filename: unp151145116.tmp
Claimed Product: 7zS.sfx.exe
Claimed Publisher: Mozilla

SHA 256: 0585CDC0293EA6B8C86482608C08C583BF32E12CFA59D143F4A0411D2894C0F3
MD5: b3b9295385f4e74d023181e5a24f4d83
VirusTotal: https://www.virustotal.com/file/0585CDC0293EA6B8C86482608C08C583BF32E12CFA59D143F4A0411D2894C0F3/analysis/

Typical Filename: test.exe
Claimed Product: none
Claimed Publisher: none