Feed aggregator

TA16-187A: Symantec and Norton Security Products Contain Critical Vulnerabilities

US Cert latest breaches - Tue, 07/05/2016 - 14:50
Original release date: July 05, 2016
Systems Affected

All Symantec and Norton branded antivirus products

Overview

Symantec and Norton branded antivirus products contain multiple vulnerabilities. Some of these products are in widespread use throughout government and industry. Exploitation of these vulnerabilities could allow a remote attacker to take control of an affected system.

Description

The vulnerabilities are listed below:

CVE-2016-2207

  • Symantec Antivirus multiple remote memory corruption unpacking RAR [1]

CVE-2016-2208

  • Symantec antivirus products use common unpackers to extract malware binaries when scanning a system. A heap overflow vulnerability in the ASPack unpacker could allow an unauthenticated remote attacker to gain root privileges on Linux or OSX platforms. The vulnerability can be triggered remotely using a malicious file (via email or link) with no user interaction. [2]

CVE-2016-2209 

  • Symantec: PowerPoint misaligned stream-cache remote stack buffer overflow [3]

CVE-2016-2210

  • Symantec: Remote Stack Buffer Overflow in dec2lha library [4]         

CVE-2016-2211

  • Symantec: Symantec Antivirus multiple remote memory corruption unpacking MSPACK Archives [5]

CVE-2016-3644

  • Symantec: Heap overflow modifying MIME messages [6]      

CVE-2016-3645

  • Symantec: Integer Overflow in TNEF decoder [7]       

CVE-2016 -3646

  • Symantec: missing bounds checks in dec2zip ALPkOldFormatDecompressor::UnShrink [8]

 

Impact

The large number of products affected (24 products), across multiple platforms (OSX, Windows, and Linux), and the severity of these vulnerabilities (remote code execution at root or SYSTEM privilege) make this a very serious event. A remote, unauthenticated attacker may be able to run arbitrary code at root or SYSTEM privileges by taking advantage of these vulnerabilities. Some of the vulnerabilities require no user interaction and are network-aware, which could result in a wormable-event.

Solution

Symantec has provided patches or hotfixes to these vulnerabilities in their SYM16-008 [9] and SYM16-010 [10] security advisories.

US-CERT encourages users and network administrators to patch Symantec or Norton antivirus products immediately. While there has been no evidence of exploitation, the ease of attack, widespread nature of the products, and severity of the exploit may make this vulnerability a popular target.

References Revision History
  • July 5, 2016: Initial Release

This product is provided subject to this Notification and this Privacy & Use policy.


TA16-144A: WPAD Name Collision Vulnerability

US Cert latest breaches - Mon, 05/23/2016 - 11:38
Original release date: May 23, 2016 | Last revised: June 01, 2016
Systems Affected
  • Windows, OS X, Linux systems, and web browsers with WPAD enabled
  • Networks using unregistered or unreserved TLDs
Overview

Web Proxy Auto-Discovery (WPAD) Domain Name System (DNS) queries that are intended for resolution on private or enterprise DNS servers have been observed reaching public DNS servers [1]. In combination with the new generic top level domain (gTLD) program’s incorporation of previously undelegated gTLDs for public registration, leaked WPAD queries could result in domain name collisions with internal network naming schemes [2] [3]. Opportunistic domain registrants could abuse these collisions by configuring external proxies for network traffic and enabling man-in-the-middle (MitM) attacks across the Internet.

Description

WPAD is a protocol used to ensure all systems in an organization use the same web proxy configuration. Instead of individually modifying configurations on each device connected to a network, WPAD locates a proxy configuration file and applies the configuration automatically.

The use of WPAD is enabled by default on all Microsoft Windows operating systems and Internet Explorer browsers. WPAD is supported but not enabled by default on Mac OS X and Linux-based operating systems, as well as Safari, Chrome, and Firefox browsers.

With the New gTLD program, previously undelegated gTLD strings are now being delegated for public domain name registration [3]. These strings may be used by private or enterprise networks, and in certain circumstances, such as when a work computer is connected from a home or external network, WPAD DNS queries may be made in error to public DNS servers. Attackers may exploit such leaked WPAD queries by registering the leaked domain and setting up MitM proxy configuration files on the Internet.

Other services (e.g., mail and internal web sites) may also perform DNS queries and attempt to automatically connect to supposedly internal DNS names [4].

Impact

Leaked WPAD queries could result in domain name collisions with internal network naming schemes. If an attacker registers a domain to answer leaked WPAD queries and configures a valid proxy, there is potential to conduct man-in-the-middle (MitM) attacks across the Internet.

The WPAD vulnerability is significant to corporate assets such as laptops. In some cases, these assets are vulnerable even while at work, but observations indicate that most assets become vulnerable when used outside an internal network (e.g., home networks, public Wi-Fi networks).

The impact of other types of leaked DNS queries and connection attempts varies depending on the type of service and its configuration.

Solution

US-CERT encourages users and network administrators to implement the following recommendations to provide a more secure and efficient network infrastructure:

  • Consider disabling automatic proxy discovery/configuration in browsers and operating systems unless those systems will only be used on internal networks.
  • Consider using a registered and fully qualified domain name (FQDN) from global DNS as the root for enterprise and other internal namespace.
  • Consider using an internal TLD that is under your control and restricted from registration with the new gTLD program. Note that there is no assurance that the current list of “Reserved Names” from the new gTLD Applicant Guidebook (AGB) will remain reserved with subsequent rounds of new gTLDs [5].
  • Configure internal DNS servers to respond authoritatively to internal TLD queries.
  • Configure firewalls and proxies to log and block outbound requests for wpad.dat files.
  • Identify expected WPAD network traffic and monitor the public namespace or consider registering domains defensively to avoid future name collisions.
  • File a report with ICANN if your system is suffering demonstrable severe harm due to name collision by visiting https://forms.icann.org/en/help/name-collision/report-problems.
References Revision History
  • May 23, 2016: Initial Release
  • June 1, 2016: Added information on using TLDs restricted from registration with the gTLD program

This product is provided subject to this Notification and this Privacy & Use policy.


TA16-132A: Exploitation of SAP Business Applications

US Cert latest breaches - Wed, 05/11/2016 - 11:31
Original release date: May 11, 2016
Systems Affected

Outdated or misconfigured SAP systems

Overview

At least 36 organizations worldwide are affected by an SAP vulnerability [1]. Security researchers from Onapsis discovered indicators of exploitation against these organizations’ SAP business applications.

The observed indicators relate to the abuse of the Invoker Servlet, a built-in functionality in SAP NetWeaver Application Server Java systems (SAP Java platforms). The Invoker Servlet contains a vulnerability that was patched by SAP in 2010. However, the vulnerability continues to affect outdated and misconfigured SAP systems.

Description

SAP systems running outdated or misconfigured software are exposed to increased risks of malicious attacks.

The Invoker Servlet vulnerability affects business applications running on SAP Java platforms.

SAP Java platforms are the base technology stack for many SAP business applications and technical components, including:

  • SAP Enterprise Resource Planning (ERP),
  • SAP Product Lifecycle Management (PLM),
  • SAP Customer Relationship Management (CRM),
  • SAP Supply Chain Management (SCM),
  • SAP Supplier Relationship Management (SRM),
  • SAP NetWeaver Business Warehouse (BW),
  • SAP Business Intelligence (BI),
  • SAP NetWeaver Mobile Infrastructure (MI),
  • SAP Enterprise Portal (EP),
  • SAP Process Integration (PI),
  • SAP Exchange Infrastructure (XI),
  • SAP Solution Manager (SolMan),
  • SAP NetWeaver Development Infrastructure (NWDI),
  • SAP Central Process Scheduling (CPS),
  • SAP NetWeaver Composition Environment (CE),
  • SAP NetWeaver Enterprise Search,
  • SAP NetWeaver Identity Management (IdM), and
  • SAP Governance, Risk & Control 5.x (GRC).

The vulnerability resides on the SAP application layer, so it is independent of the operating system and database application that support the SAP system.

Impact

Exploitation of the Invoker Servlet vulnerability gives unauthenticated remote attackers full access to affected SAP platforms, providing complete control of the business information and processes on these systems, as well as potential access to other systems.

Solution

In order to mitigate this vulnerability, US-CERT recommends users and administrators implement SAP Security Note 1445998 and disable the Invoker Servlet. For more mitigation details, please review the Onapsis threat report [1].

In addition, US-CERT encourages that users and administrators:

  • Scan systems for all known vulnerabilities, such as missing security patches and dangerous system configurations.
  • Identify and analyze the security settings of SAP interfaces between systems and applications to understand risks posed by these trust relationships.
  • Analyze systems for malicious or excessive user authorizations.
  • Monitor systems for indicators of compromise resulting from the exploitation of vulnerabilities.
  • Monitor systems for suspicious user behavior, including both privileged and non-privileged users.
  • Apply threat intelligence on new vulnerabilities to improve the security posture against advanced targeted attacks.
  • Define comprehensive security baselines for systems and continuously monitor for compliance violations and remediate detected deviations.

These recommendations apply to SAP systems in public, private, and hybrid cloud environments.

Note: The U.S. Government does not endorse or support any particular product or vendor.

References Revision History
  • May 11, 2016: Initial Release

This product is provided subject to this Notification and this Privacy & Use policy.


IBM PowerVC Version 1.2.3 Introduction and Configuration

IBM News Feed - Wed, 09/02/2015 - 13:30
Draft Redbook, last updated: Wed, 2 Sep 2015

- OpenStack compatibility for integration with cloud software stacks
- Integration of server and storage virtualization
- IBM PowerVM virtualization management

IBM® Power Virtualization Center (PowerVC) is an advanced enterprise virtualization management offering for IBM Power Systems™, based on the OpenStack framework.

IBM PowerVP: Introduction and Technical Overview

IBM News Feed - Fri, 08/14/2015 - 13:30
Redpaper, published: Fri, 14 Aug 2015

This IBM® Redpaper™ publication is a comprehensive guide that covers IBM Power Virtualization Performance (PowerVP™) for IBM Power Systems™ Version 1.1.3.

IBM PowerVP: Introduction and Technical Overview

IBM News Feed - Fri, 07/24/2015 - 13:30
Draft Redpaper, last updated: Fri, 24 Jul 2015

This IBM® Redpaper™ publication is a comprehensive guide that covers IBM Power Virtualization Performance (PowerVP™) for IBM Power Systems™ Version 1.1.3.

IBM Power System E850 Technical Overview and Introduction

IBM News Feed - Wed, 06/17/2015 - 13:30
Redpaper, published: Wed, 17 Jun 2015

This IBM® Redpaper™ publication is a comprehensive guide covering the IBM Power System E850 (8408-E8E) server that supports IBM AIX®, and Linux operating systems.

Syndicate content