Detecting unsafe path access patterns with PathAuditor

Posted by Marta Rożek, Google Summer Intern 2019, and Stephen Röttger, Software Engineer 

https://security.googleblog.com/2019/12/detecting-unsafe-path-access-patterns.html

Microsoft to end updates to Windows 7's free AV software, Security Essentials

When support for Windows 7 ends on Jan. 14, Microsoft will also stop providing new malware signatures for its home-grown Security Essentials software.

https://www.computerworld.com/article/3489036/microsoft-to-end-updates-to-windows-7s-free-av-software-security-essentials.html

Cuenta IPMI por defecto en DataPower Gateway de IBM

Fecha de publicación: 10/12/2019
Importancia: 4 - Alta

Recursos afectados: 
IBM DataPower Gateway, versiones 2018.4.1.0-2018.4.1.5 y 7.6.0.0-7.6.0.14.

Descripción: 
Cuando se activa la opción IPMI sobre LAN también se habilita, automáticamente, la cuenta de administrador por defecto.

Solución: 
Actualizar a:
IBM DataPower Gateway 2018.4.1.6 (APAR IT29004);
IBM DataPower Gateway 7.6.0.15 (APAR IT29004);

https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/cuenta-ipmi-defecto-datapower-gateway-ibm

Vulnerabilidad de ejecución remota en productos VMware

Fecha de publicación: 10/12/2019
Importancia: 5 - Crítica

Recursos afectados: 
VMware ESXi, versiones:
6.7,
6.5,
6.0.
VMware Horizon DaaS, rama de versiones 8.x.

Descripción: 
El equipo de 360Vulcan, de la competición Tianfu Cup Pwn Contest 2019, ha detectado una vulnerabilidad de severidad crítica que afecta a múltiples productos de VMware. Un atacante remoto podría ejecutar código en el sistema.

https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/vulnerabilidad-ejecucion-remota-productos-vmware

Múltiples vulnerabilidades en productos de Dell EMC

Fecha de publicación: 10/12/2019
Importancia: 5 - Crítica

Recursos afectados: 
Dell EMC Data Protection Advisor, versiones:
6.3;
6.4;
6.5;
18.1;
18.2 anterior al patch 83;
19.1 anterior al patch 71.
Integrated Data Protection Appliance, versiones:
2.0;
2.1;
2.2;
2.3;
2.4.

Descripción: 
El API REST de la aplicación DPA, dentro del software Dell EMC Data Protection Advisor, contiene correcciones para múltiples vulnerabilidades que pueden ser explotadas por atacantes para comprometer el sistema afectado.

https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/multiples-vulnerabilidades-productos-dell-emc

Detectando técnicas y tácticas ATT&CK en Linux

El australiano Krishna aka Kirtar22 ha creado un interesante proyecto en Github para asentar una buena base de conocimiento que ayude a crear/mejorar las capacidades de detección de amenazas en Linux. Los vectores de ataque están alineados con el framework ATT&CK de MITRE.

https://www.hackplayers.com/2019/12/detectando-tecnicas-y-tacticas-att-en-linux.html

Adobe Releases Security Updates

Adobe has released security updates to address vulnerabilities in multiple Adobe products. An attacker could exploit some of these vulnerabilities to take control of an affected system.

The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review the following Adobe Security Bulletins and apply the necessary updates.
ColdFusion APSB19-58
Brackets APSB19-57
Photoshop CC APSB19-56
Acrobat and Reader APSB19-55

https://www.us-cert.gov/ncas/current-activity/2019/12/10/adobe-releases-security-updates

Samba Releases Security Updates

The Samba Team has released security updates to address vulnerabilities in multiple versions of Samba. An attacker could exploit one of these vulnerabilities to take control of an affected system.

The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review the Samba Security Announcements for CVE-2019-14861 and CVE-2019-14870 and apply the necessary updates and workarounds.

https://www.us-cert.gov/ncas/current-activity/2019/12/10/samba-releases-security-updates

Latest Microsoft Update Patches New Windows 0-Day Under Active Attack

With its latest and last Patch Tuesday for 2019, Microsoft is warning billions of its users of a new Windows zero-day vulnerability that attackers are actively exploiting in the wild in combination with a Chrome exploit to take remote control over vulnerable computers.

https://thehackernews.com/2019/12/windows-zero-day-patch.html

Microsoft Releases December 2019 Security Updates

Microsoft has released updates to address multiple vulnerabilities in Microsoft software. A remote attacker could exploit some of these vulnerabilities to take control of an affected system.

The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review Microsoft’s December 2019 Security Update Summary and Deployment Information and apply the necessary updates.

https://www.us-cert.gov/ncas/current-activity/2019/12/10/microsoft-releases-december-2019-security-updates

Google Releases Security Updates for Chrome

Google has released security updates for Chrome version 79.0.3945.79 for Windows, Mac, and Linux. This version addresses vulnerabilities that an attacker could exploit to take control of an affected system.

The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review the Chrome Release and apply the necessary updates.

https://www.us-cert.gov/ncas/current-activity/2019/12/10/google-releases-security-updates-chrome

Apple Releases Multiple Security Updates

Apple has released security updates to address vulnerabilities in multiple products. An attacker could exploit some of these vulnerabilities to take control of an affected system.

https://www.us-cert.gov/ncas/current-activity/2019/12/10/apple-releases-multiple-security-updates

Intel Releases Security Updates

Intel has released security updates to address vulnerabilities in multiple products. An authenticated attacker with local access could exploit some of these vulnerabilities to gain escalation of privileges.

https://www.us-cert.gov/ncas/current-activity/2019/12/10/intel-releases-security-updates

Vulnerabilidad en Spectrum Scale de IBM

Fecha de publicación: 11/12/2019
Importancia: 4 - Alta

Recursos afectados: 
IBM Spectrum Scale, versiones 5.0.0.0 - 5.0.4.0 y 4.2.0.0 - 4.2.3.18.

Descripción: 
IBM ha identificado una vulnerabilidad de seguridad en IBM Spectrum Scale que podría permitir a un atacante remoto autenticado, ejecutar comandos arbitrarios en el sistema.

https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/vulnerabilidad-spectrum-scale-ibm

Actualización de seguridad de SAP de diciembre de 2019

Fecha de publicación: 11/12/2019
Importancia: 5 - Crítica

Recursos afectados: 
SAP Business Client, versión 6.5;
SAP Adaptive Server Enterprise, versiones 15.7 y 16.0;
SAP BusinessObjects Business Intelligence Platform (Fiori BI Launchpad), versión 4.2;
SAP ERP HCM (SAP_HRCES), versión 3;
SAP Enable Now, versión 1911;
SAP Portfolio and Project Management, versiones S4CORE 102, 103, EPPM 100, CPRXRPM 500_702, 600_740 y 610_740;
SAP BusinessObjects Business Intelligence Platform (Monitoring Application), versiones 4.1, 4.2 y 4.3.

Descripción: 
SAP ha publicado varias actualizaciones de seguridad de diferentes productos en su comunicado mensual.

https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/actualizacion-seguridad-sap-diciembre-2019

Boletín de seguridad de Microsoft de diciembre de 2019

Fecha de publicación: 11/12/2019
Importancia: 5 - Crítica

Recursos afectados: 
Microsoft Windows,
Internet Explorer,
Microsoft Office, Microsoft Office Services y Web Apps,
SQL Server,
Visual Studio,
Skype for Business.

https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/boletin-seguridad-microsoft-diciembre-2019

Vulnerabilidades en múltiples productos de Intel

Fecha de publicación: 11/12/2019
Importancia: 4 - Alta

Descripción: 
Intel ha descubierto siete vulnerabilidades de criticidad alta en múltiples productos. Un atacante local podría realizar una escalada de privilegios o revelar información sensible.

https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/vulnerabilidades-multiples-productos-intel

Microsoft Office December Security Updates Fix Remote Execution Bugs

Microsoft released the December 2019 Office security updates, bundling a total of 16 security updates and five cumulative updates for five different products, three of them patching flaws allowing remote code execution.

https://www.bleepingcomputer.com/news/microsoft/microsoft-office-december-security-updates-fix-remote-execution-bugs/

WordPress: Stored XSS on Wordpress 5.3 via Title Post2019-12-09 13:22:18

ID H1:754352
Type hackerone
Reporter md15ev
Modified 2019-12-10 09:58:14

Description
I have identified a WordPress security vulnerability , a Stored XSS vulnerability that affects latest version of WordPress (5.3)

https://vulners.com/hackerone/H1:754352

New Zeppelin #Ransomware Targeting Tech and Health Companies

A new variant of Vega ransomware family, dubbed Zeppelin, has recently been spotted in the wild targeting technology and healthcare companies across Europe, the United States, and Canada.

https://thehackernews.com/2019/12/zeppelin-ransomware-attacks.html

#Plundervolt : A new attack on #Intel processors threatening SGX data

Simply put; Plundervolt flaw lets attackers manipulate voltage delivered to targeted CPU and steal data. 

Altering Intel’s CPU voltages and frequency directly in the operating system is a feature that many users appreciate as it allows them to use all those software-based utilities that aid in overclocking. Now, this feature may not be as secure as previously anticipated.

https://www.hackread.com/plundervolt-attack-intel-processors-threat-sgx-data/