New Brute-Force #Botnet Targeting Over 1.5 Million #RDP Servers Worldwide

https://thehackernews.com/2019/06/windows-rdp-brute-force.html

Execution Trace Viewer

Execution Trace Viewer is an application for viewing, editing and analyzing execution traces. It was originally made for reverse engineering obfuscated code, but it can be used to analyze any kind of execution trace.

https://github.com/teemu-l/execution-trace-viewer

#Microsoft warns about email #spam campaign abusing #Office vulnerability

Dangerous spam campaign targets European users with backdoor trojan.

https://www.zdnet.com/article/microsoft-warns-about-email-spam-campaign-abusing-office-vulnerability/

#VLC 3.0.7 is Biggest Security Release Due to EU #Bounty Program

VLC Media Player 3.0.7 was released on Friday and contained the most security updates ever in one release of the program. The president of the VideoLan non-profit organization states that this was due to their inclusion in the EU-FOSSA #bugbounty program.

https://www.bleepingcomputer.com/news/software/vlc-307-is-biggest-security-release-due-to-eu-bounty-program/

#Exim 4.9.1 #RCE Remote Command Execution

Qualys discovered a remote command execution vulnerability in Exim versions 4.87 to 4.91.

https://packetstormsecurity.com/files/153218/QSA-CVE-2019-10149.txt

Los canales públicos de Telegram vía web desde el 1 de junio, sin necesidad de aplicación:

https://t.me/s/sysadmin24x7

Nueva Botnet ataca mediante fuerza bruta servidores RDP

https://unaaldia.hispasec.com/2019/06/nueva-botnet-ataca-mediante-fuerza-bruta-servidores-rdp.html

#Adobe Issues Critical Patches for ColdFusion, #FlashPlayer, Campaign Software

Adobe has just released the latest June 2019 software updates to address a total 11 security vulnerabilities in its three widely-used products Adobe ColdFusion, Flash Player, and Adobe Campaign.

https://thehackernews.com/2019/06/adobe-patch-june.html

#Microsoft June 2019 Patch Tuesday fixes many of #SandboxEscaper zero-days

Microsoft patches four of five zero-days published by SandboxEscaper.

https://www.zdnet.com/article/microsofts-june-2019-patch-tuesday-fixes-many-of-sandboxescapers-zero-days/

Bad Cert Vulnerability Can Bring Down Any #WindowsServer

A Google security expert today revealed that an unpatched issue in the main cryptographic library of Microsoft's operating system can cause a denial-of-service ( #DoS ) condition in Windows 8 servers and above.

https://www.bleepingcomputer.com/news/security/bad-cert-vulnerability-can-bring-down-any-windows-server/

#Microsoft #NTLM Flaws Expose All Windows Machines to RCE Attacks

Two critical vulnerabilities in Microsoft's NTLM authentication protocol consisting of three logical flaws make it possible for attackers to run remote code and authenticate on machines running any Windows version.

https://www.bleepingcomputer.com/news/security/microsoft-ntlm-flaws-expose-all-windows-machines-to-rce-attacks/

We’re currently experiencing a powerful DDoS attack, #Telegram users in the Americas and some users from other countries may experience connection issues.

https://twitter.com/telegram/status/1138768124914929664

Múltiples vulnerabilidades en productos #Intel

Fecha de publicación: 12/06/2019
Importancia: 4 - Alta

Recursos afectados: 
Intel® Accelerated Storage Manager en Intel® RSTe, versiones anteriores a 5.5.0.2015
Intel® RAID Web Console 3 para Windows, versión 4.186 y anteriores
Intel® NUC Kit, consultar el apartado referencias para ver las versiones afectadas
Intel® Compute Card, consultar el apartado referencias para ver las versiones afectadas
Intel® Compute Stick, consultar el apartado referencias para ver las versiones afectadas
Open CIT y OpenAttestation, todas las versiones
Intel® Omni-Path Fabric Manager GUI, versiones anteriores a 10.9.2.1.1
Intel® PROSet/Wireless WiFi Software, versiones anteriores a 21.10 para Microsoft Windows 7, 8.1 y 10
Intel® Turbo Boost Max Technology 3.0 driver, versión 1.0.0.1035 y anteriores
Intel® SGX Linux client driver, versiones anteriores a 2.5
Intel® SGX DCAP Linux driver, versiones anteriores a 1.1
ITE Tech* Consumer Infrared Driver para Windows 10, versiones anteriores a 5.4.3.0
Intel® Chipset Device Software (INF Update Utility), versiones anteriores a 10.1.1.45

Descripción: 
Intel ha publicado múltiples vulnerabilidades que afectan a varios de sus productos.

https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/multiples-vulnerabilidades-productos-intel-10

Boletín de seguridad de #Microsoft de junio de 2019

Fecha de publicación: 12/06/2019
Importancia: 5 - Crítica

Recursos afectados: 
Adobe Flash Player
Microsoft Windows
Internet Explorer
Microsoft Edge
Microsoft Office y Microsoft Office Services y Web Apps
ChakraCore
Skype para Business y Microsoft Lync
Microsoft Exchange Server
Azure

Descripción: 
La publicación de actualizaciones de seguridad de Microsoft de este mes consta de 87 vulnerabilidades, 21 clasificadas como críticas y 66 como importantes.

https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/boletin-seguridad-microsoft-junio-2019

Actualización de seguridad de #SAP de junio de 2019

Fecha de publicación: 12/06/2019
Importancia: 5 - Crítica

Recursos afectados: 
SAP Business Client, versión 6.5
Solution Manager, versión 7.2
SAP E-Commerce (Business-to-Consumer application), versiones: SAP-CRMJAV, SAP-CRMWEB, SAP-SHRWEB, SAP-SHRJAV, SAP-CRMAPP, SAP-SHRAPP 7.30, 7.31, 7.32, 7.33, 7.54
SAP R/3 Enterprise Application, versiones: EA-APPL  600, 602, 603, 604, 605, 606, 616, 617
SAP BusinessObjects Business Intelligence Platform (Administration Console), versiones 4.2, 4.3
SAP NetWeaver Process Integration (PI Integration Builder Web UI), versiones: SAP_XIESR: 7.10 hasta 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; SAP_XITOOL: 7.10 hasta 7.11, 7.30, 7.31, 7.40, 7.50, SAP_XIPCK 7.10 hasta 7.11, 7.20, 7.3
SAP Work Manager and SAP Inventory Manager, versiones SAP Work Manager 6.3.0, 6.4.0, 6.5 
SAP NetWeaver AS ABAP Platform, versiones KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73, KERNEL 7.21, 7.45, 7.49, 7.53, 7.73
SAP NetWeaver Process Integration, versiones SAP_XIESR: 7.10 hasta 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; SAP_XITOOL: 7.10 hasta 7.11, 7.20, 7.30, 7.31, 7.40, 7.50
SAP HANA Extended Application Services (advanced model), versión 1
SAP Enterprise Financial Services, versiones SAPSCORE 1.13, 1.14, 1.15; S4CORE 1.01, 1.02, 1.03; EA-FINSERV 1.10, 2.0, 5.0, 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0; Bank/CFM 4.63_20

Descripción: 
SAP ha publicado varias actualizaciones de seguridad de diferentes productos en su comunicado mensual.

https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/actualizacion-seguridad-sap-junio-2019

Actualización de seguridad de #Joomla!

Fecha de publicación: 12/06/2019
Importancia: Baja

Recursos afectados
Joomla! CMS, versiones desde 3.6.0 hasta 3.9.6.

Descripción
Joomla! ha publicado dos nuevas versiones, la 3.9.8 y la 3.9.7, incluyendo en esta última la solución de tres vulnerabilidades de criticidad baja en su núcleo.

https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/actualizacion-seguridad-joomla

Coding a reliable CVE-2019-084 bypass

https://0x00-0x00.github.io/research/2019/05/30/Coding-a-reliable-CVE-2019-0841-Bypass.html

Your Session Key is My Session Key: How to Retrieve the Session Key for Any Authentication

https://blog.preempt.com/your-session-key-is-my-session-key

#Sysmon 10.0 - New features and changes

Mark Russinovich released a new version of Sysmon, raising it to 10.0, and this is a great upgrade!


https://medium.com/@olafhartong/sysmon-10-0-new-features-and-changes-e82106f2e00

#Cisco Releases Security Update for Cisco IOS XE

Cisco has released a security update to address a vulnerability in Cisco IOS XE. A remote attacker could exploit this vulnerability to take control of an affected system.

The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review the Cisco Security Advisory and apply the necessary update.

https://www.us-cert.gov/ncas/current-activity/2019/06/12/Cisco-Releases-Security-Update-Cisco-IOS-XE

#Exim Mail Server Remote Code Execution (CVE-2019-10149)

Severity:Critical

Who is Vulnerable?
Exim Mail Server versions 4.87 to 4.91 (inclusive)

Vulnerability Description:
A remote code execution vulnerability exists in Exim Mail Server. A remote attacker can exploit this issue by sending a specially crafted packet to the target server. Successful exploitation could result in execution of arbitrary code on the affected system.

https://www.checkpoint.com/defense/advisories/public/2019/cpai-2019-0743.html