SysAdmin 24x7

Vulnerabilidad en Routers TP-Link permite el inicio de sesión sin contraseña https://unaaldia.hispasec.com/2019/12/vulnerabilidad-en-routers-tp-link-permite-el-inicio-de-sesion-sin-contrasena.html

[SECURITY] [DLA 2038-1] libssh security update Package : libssh Version : 0.6.3-4+deb8u4 CVE ID : CVE-2019-14889 Debian Bug : 946548 It was found that libssh, a tiny C SSH library, does not sufficiently sanitize path parameters provided to the server, allowing an attacker with only SCP file access to execute arbitrary commands on the server. https://lists.debian.org/debian-lts-announce/2019/12/msg00020.html

Múltiples vulnerabilidades en XtremIO de Dell EMC Fecha de publicación: 17/12/2019 Importancia: 5 - Crítica Recursos afectados:  Dell EMC XtremIO X2 XMS, versiones anteriores a la 6.3.0. Descripción:  Lukasz Plonka ha identificado 3 vulnerabilidades, una de ellas con severidad crítica y las otras de severidad media, en el producto XtremIO de Dell EMC. La explotación de estas vulnerabilidades permitiría a un atacante remoto comprometer el sistema afectado. Solución:  Actualizar Dell EMC XtremIO XMS a la versión 6.3.0 o posterior. https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/multiples-vulnerabilidades-xtremio-dell-emc

#Ryuk #Ransomware Likely Behind New Orleans Cyberattack Based on files uploaded to the VirusTotal scanning service, the ransomware attack on the City of New Orleans was likely done by the Ryuk Ransomware threat actors. https://www.bleepingcomputer.com/news/security/ryuk-ransomware-likely-behind-new-orleans-cyberattack/

Hot Disaster recovery on Google Cloud for applications running on-premises https://medium.com/google-cloud/hot-disaster-recovery-on-google-cloud-for-applications-running-on-premises-da7048d1a57b

Hack The Box - Smasher2 https://0xrick.github.io/hack-the-box/smasher2/

A malvertising campaign targets iPhone users with Krampus-3PC A malvertising campaign that involved more than 100 publisher websites targeted iPhone users to deliver the Smart Krampus-3PC Malware. https://securityaffairs.co/wordpress/95122/malware/krampus-3pc-iphone-malvertising.html

ICS Advisory (ICSA-19-346-01) Advantech #DiagAnywhere Server 1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Advantech Equipment: DiagAnywhere Server Vulnerability: Stack-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of this vulnerability may allow remote code execution. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of DiagAnywhere Server, used for remotely monitoring and controlling other Windows based devices, are affected: DiagAnywhere Server Versions 3.07.11 and prior https://www.us-cert.gov/ics/advisories/icsa-19-346-01

La rocambolesca historia detrás de la clave Secure Enclave publicada Twitter y su impacto en la seguridad https://www.seguridadapple.com/2019/12/la-rocambolesca-historia-detras-de-la.html

What I Learned from Reverse Engineering Windows Containers https://unit42.paloaltonetworks.com/what-i-learned-from-reverse-engineering-windows-containers/

GitHub Urges “Critical” Updates After Nine Git Vulnerabilities Spotted GitHub has urged users to make “critical” Git project code updates after nine security vulnerabilities were found in the open source version-control system. https://www.cbronline.com/news/git-project-patches/

#GALLIUM Hacking Group Attack Telecom Networks Using Publicly Available Hacking Tools & Exploiting Unpatched Vulnerabilities Microsoft issued a warning about the new threat groups called GALLIUM that attack Telecommunication providers by exploiting the internet-facing services vulnerabilities in WildFly/JBoss. https://gbhackers.com/gallium-hacking-group/

Actualización de seguridad 5.3.1 para WordPress Fecha de publicación: 13/12/2019 Importancia: 4 - Alta Recursos afectados:  WordPress, versiones 5.3 y anteriores. Descripción:  Esta versión de seguridad y mantenimiento incluye 46 correcciones y mejoras. Además, agrega una serie de correcciones de seguridad. Solución:  Ha sido publicada la versión 5.3.1 del gestor de contenidos, WordPress, para solucionar dichas vulnerabilidades, disponible desde su página de descarga. https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/actualizacion-seguridad-531-wordpress

New Echobot Variant Exploits 77 Remote Code Execution Flaws The Echobot botnet is still after the low hanging fruit as a new variant has been spotted with an increased number of exploits that target unpatched devices, IoT for the most part. A variant discovered this summer included more than 50 exploits that allow remote code execution. A security researcher noticed that a new version emerged with even more exploits, 77 of them. https://www.bleepingcomputer.com/news/security/new-echobot-variant-exploits-77-remote-code-execution-flaws/

Múltiples vulnerabilidades en Xen Fecha de publicación: 12/12/2019 Importancia: 4 - Alta Recursos afectados:  Todas las versiones de Xen. Citrix Hypervisor 8.0 y anteriores. Citrix XenServer 7.6. Citrix XenServer 7.1 LTSR CU2. Citrix XenServer 7.0. Descripción:  Xen ha descubierto siete vulnerabilidades que afectan a sus productos. Un atacante remoto podría causar un cierre inesperado, generar una condición de denegación de servicio (DoS), escalar privilegios o divulgar información. https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/multiples-vulnerabilidades-xen-2

#Plundervolt https://plundervolt.com/

New Plundervolt attack impacts Intel CPUs Intel desktop, server, and mobile CPUs are impacted. Intel has released firmware patches today. [...] According to Intel, the following CPU series are vulnerable to Plundervolt attacks: Intel® 6th, 7th, 8 th, 9th & 10th generation CoreTM processors Intel® Xeon® Processor E3 v5 & v6 Intel® Xeon® Processor E-2100 & E-2200 families Plundervolt is nothing that end-users should worry about. It's an attack vector that is of little interest for malware authors since it's hard to automate at scale. It is, however, an attack vector that could be weaponized in targeted attacks, against specially selected targets. If Plundervolt is a serious threat depends on each user's threat matrix. [...] https://www.zdnet.com/article/new-plundervolt-attack-impacts-intel-cpus/

#Plundervolt : A new attack on #Intel processors threatening SGX data Simply put; Plundervolt flaw lets attackers manipulate voltage delivered to targeted CPU and steal data.  Altering Intel’s CPU voltages and frequency directly in the operating system is a feature that many users appreciate as it allows them to use all those software-based utilities that aid in overclocking. Now, this feature may not be as secure as previously anticipated. https://www.hackread.com/plundervolt-attack-intel-processors-threat-sgx-data/

New Zeppelin #Ransomware Targeting Tech and Health Companies A new variant of Vega ransomware family, dubbed Zeppelin, has recently been spotted in the wild targeting technology and healthcare companies across Europe, the United States, and Canada. https://thehackernews.com/2019/12/zeppelin-ransomware-attacks.html

WordPress: Stored XSS on Wordpress 5.3 via Title Post2019-12-09 13:22:18 ID H1:754352 Type hackerone Reporter md15ev Modified 2019-12-10 09:58:14 Description I have identified a WordPress security vulnerability , a Stored XSS vulnerability that affects latest version of WordPress (5.3) https://vulners.com/hackerone/H1:754352