Code Execution Flaw Found in LibreOffice, OpenOffice

A researcher has identified a serious remote code execution vulnerability affecting the LibreOffice and Apache OpenOffice open-source productivity suites, but a patch has only been released for the former.

Researcher Alex Inführ discovered that a malicious actor could use specially crafted documents to execute arbitrary code without any warning message being seen by the victim. All the targeted user needs to do is open a malicious ODT file and move the mouse anywhere over the document.

The expert has published a blog post detailing his findings and a video showing how the attack works. While the post and proof-of-concept (PoC) code focus on LibreOffice, the attack can be adapted for OpenOffice as well. Inführ says both Linux and Windows systems are impacted.

The vulnerability, tracked as CVE-2018-16858, has been described as a path traversal issue that allows an attacker to execute a Python file located anywhere on the targeted system. The attack is made easier by the fact that Python is bundled with LibreOffice and OpenOffice, which means the attacker does not need to worry about this component being installed on the targeted device.

The malicious document needs to contain a specially crafted link pointing to a Python method from a script. Using the onmouseover event, a piece of malware present on the system can be executed when the victim hovers over the link, without raising any suspicion.

In the demo created by Inführ, the color of the link has been set to white and the link covers an entire page in the document. The victim only sees a blank page, but the malicious code gets executed when they move their mouse over it.

The issue was reported to LibreOffice developers on October 18, 2018, and it was fixed less than two weeks later with the release of versions 6.0.7 and 6.1.3. OpenOffice developers have also been alerted, but they have yet to release a patch. Until a fix becomes available, users can disable Python support by removing or renaming the pythonscript.py file in the installation folder.

SecurityWeek has reached out to OpenOffice developers for comment and will update this article if they respond.

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/N79WwXTNrco/code-execution-flaw-found-libreoffice-openoffice

New Backdoor Targets Linux Servers

A new backdoor is targeting Linux servers in East Asia and Latin America, including Amazon Web Services (AWS) hosted machines, Check Point security researchers say.

Dubbed ‘SpeakUp’, the new Trojan targets known vulnerabilities in six different Linux distributions and attempts to propagate internally and beyond via remote code execution vulnerabilities. The malware also has the ability to infect Mac devices.

Check Point was able to link SpeakUp’s author with the malware developer operating under the name of Zettabithf. The new backdoor is implemented differently, but has a lot in common with the developer’s craftsmanship, Check Point says.

For initial infection, the attacks target a recently disclosed vulnerability in ThinkPHP (CVE-2018-20062), a Chinese-made PHP framework highly popular among developers in the country.

The analyzed backdoor sample was observed targeting a machine in China on January 14, 2019. Although it was first submitted to VirusTotal on January 9, 2019, it had no detection in the online scanner at the time of analysis, Check Point’s security researchers reveal.

After infection, the SpeakUp Trojan establishes communication with the command and control (C&C) server to register the victim machine. The malware establishes persistence by using cron and an internal mutex to ensure only one instance remains alive at all times.

The C&C server can send three commands to the backdoor: newtask – to execute arbitrary code, download and execute a file, kill or uninstall a program, and send updated fingerprint data; notask – sleep for 3 seconds and ask for additional command; newerconfig – to update the downloaded miner configuration file.

The backdoor also includes a python script employed for scanning and infecting more Linux servers within internal and external subnets. The script attempts to brute-force admin panels, and can also scan the network environment for specific ports and servers.

Furthermore, the script attempts to exploit various remote code execution flaws: CVE-2012-0874 (JBoss Enterprise Application Platform), CVE-2010-1871 (JBoss Seam Framework), CVE-2017-10271 (Oracle WebLogic wls-wsat), CVE-2018-2894 (Oracle Fusion Middleware), and CVE-2016-3088 (Apache ActiveMQ Fileserver).

It also includes exploits for a JBoss AS 3/4/5/6 remote command execution and a Hadoop YARN ResourceManager command execution bug.

While hunting for the actor behind the backdoor, the security researchers found the liteHTTP GitHub project, which has modules somewhat similar to the SpeakUp Trojan (download and execute, persistence, collection of system information, self-update, and uninstall).

The project was created by a user called Zettabithf. A Hack Forums profile with the same name reveals the actor might be Russian speaking and could also be a botnet developer, the security researchers say.

“SpeakUp`s obfuscated payloads and propagation technique is beyond any doubt the work of a bigger threat in the making. It is hard to imagine anyone would build such a compound array of payloads just to deploy few miners. The threat actor behind this campaign can at any given time deploy additional payloads, potentially more intrusive and offensive,” Check Point says.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/ZWA9jRJ2wsk/new-backdoor-targets-linux-servers

Flaw Possibly Affecting 500,000 Ubiquity Devices Exploited in the Wild

Nearly half a million Ubiquity devices may be affected by a vulnerability that has already been exploited in the wild, security experts warned last week.

Jim Troutman, consultant and director of the Northern New England Neutral Internet Exchange (NNENIX), revealed last week on Twitter that hackers had been remotely targeting Ubiquity networking devices exposed via a discovery service accessible on UDP port 10001.

Troutman said attackers had been launching denial-of-service (DoS) attacks that caused a device’s management features to become unavailable. He also warned that it’s possible to exploit the flaw for weak distributed DoS (DDoS) attacks.

The issue has been discussed on Ubiquity forums since at least last summer and Rapid7 has reported seeing traffic destined for port 10001 for more than a year. However, Ubiquity appears to have been aware of the weakness and it alerted users after Troutman’s warning on Twitter.

The vendor claims it has been working on a firmware update that should address the problem. In the meantime, it has advised users to block the problematic port at the network perimeter as a temporary workaround.

Interestingly, the company told customers that the flaw cannot be exploited to “create a DDoS attack.” It also told users that the vulnerability does not allow an attacker to gain control of devices.

However, Troutman, who says Ubiquity’s suggested workaround could disrupt some services, claims to have seen DDoS amplification attacks, but with a fairly small amplification rate (“56 bytes in, 206 bytes out”). He is also not convinced that it’s not possible to exploit the vulnerability to remotely hack devices.

Rapid7 researchers have also monitored these attacks and warned that the problematic service could have other management capabilities either “baked in or nearby.” As for the possibility of DDoS attacks, Rapid7’s Jon Hart noted in a blog post that UDP amplification vulnerabilities can typically allow attacks with an amplification rate that reaches up to 30-35X.

An Internet scan conducted using Rapid7’s Sonar project revealed roughly 490,000 unique devices accessible on UDP port 10001. More than half are located in Brazil, but significant numbers have also been identified in the United States, Spain and other countries.

Location of exposed Ubiquity devices

A majority of the exposed Ubiquity devices are NanoStation (172,000), AirGrid (131,000), LiteBeam (43,000), PowerBeam (40,000), and NanoBeam (21,000) products.

The names of 17,000 of these devices – they contain the string “HACKED-ROUTER-HELP-SOS” – suggest that they have already been hacked via other vulnerabilities. This is not surprising as Rapid7 claims most of the discovered devices are running outdated versions of the firmware.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/-V8MQunxIIY/flaw-possibly-affecting-500000-ubiquity-devices-exploited-wild

Apple Partially Fixes FaceTime Spying Bug

Apple reported on Friday that the FaceTime spying bug that has been making headlines in the past days has been partially fixed, but users will have to wait until next week for a software update.

According to Apple, a server-side patch has been implemented, but the application update that re-enables the Group FaceTime feature will only be rolled out next week. The company initially promised to patch the flaw this week.

The security bug allows an attacker to spy on FaceTime users through their microphone and camera simply by calling the targeted user and adding the attacker’s own number to a group chat. While the hacker can hear and, in some cases, see the victim, on the victim’s side it appears as if the call still hasn’t been answered. Apple fixes FaceTime bug

Apple suspended the Group FaceTime feature after the bug became widely known, but it may have already been too late. A lawyer from Texas has filed a lawsuit against the tech giant, claiming that the vulnerability was exploited to record a client’s private deposition.

The flaw was discovered by Grant Thompson, a 14-year-old from Arizona, who, with the help of his mother, attempted to report the issue to Apple more than 10 days before its existence became public. They claimed that their attempts to inform the company were ignored.

In its latest statement, Apple has thanked the Thompson family for reporting the bug and it has promised to improve the process for receiving and escalating these types of reports to ensure that they get to the right people faster.

“We sincerely apologize to our customers who were affected and all who were concerned about this security issue. We appreciate everyone’s patience as we complete this process,” Apple stated.

“We want to assure our customers that as soon as our engineering team became aware of the details necessary to reproduce the bug, they quickly disabled Group FaceTime and began work on the fix,” it added.

This bug has caused a lot of problems for Apple. In addition to bad PR and a lawsuit, it also triggered an investigation in New York. The New York attorney general and governor announced a probe into the company’s failure to warn customers and its relatively slow response.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/qnsw8LJuLlc/apple-partially-fixes-facetime-spying-bug

GitHub Helps Developers Keep Dependencies Secure via Dependabot

Microsoft-owned GitHub informed developers on Thursday that they can easily ensure that the dependencies used by their applications are always secure and up to date through an integration of its Security Advisory API with Dependabot.

Created by London-based developer Grey Baker, Dependabot is a management tool that helps GitHub users keep their dependencies up to date. The tool checks a user’s dependency files every day and creates pull requests in case an update is available. Users can manually review the requests and merge them, or they can configure Dependabot for automatic merger based on certain criteria.

Dependabot now also integrates with GitHub’s Security Advisory API, which gives users access to its “carefully curated” database of vulnerabilities. According to GitHub, the Security Advisory service was used last year to send out over 10 million alerts related to more than 1,000 flaws.

By tapping into the Security Advisory API, Dependabot can check if a project’s dependencies are affected by any known vulnerabilities and create pull requests for updates. Dependabot includes support for Ruby, JavaScript, PHP, Java, Python, .NET, Rust and Elixir security advisories.

Ensuring that dependencies are always updated is not an easy task if an automated system is not used. For example, Baker pointed out that JavaScript has 30 direct dependencies and 712 indirect dependencies. Ruby has a total of 125 dependencies, Rust has 98, PHP has 73, and Python has 68.

“Dependabot automatically creates pull requests in response to security advisories. Every day it pulls down your dependency files, parses them, and checks for any out-of-date or insecure dependencies. If it finds any it creates a pull request on GitHub, isolating the specific dependency that needs updating, with details of what has changed,” Baker explained.

In order to make it easier for developers to decide if they want to merge a pull request, information is provided on the continuous integration (CI) pass rate for all projects performing a certain update. If the pass rate is high, developers can be more confident in their decision to merge.

“A typical ruby project (with 38 top-level dependencies) normally receives two dependency updates a week. Of those updates, 94% are non-breaking, which means that on average you’ll only need to write any code in response to a dependency update once every two months. The rest of the time you can just click “merge” and work with secure, up-to-date dependencies,” Baker said.

Dependabot is free for open source and personal projects, and companies have to pay between $15 and $100 per month to ensure that their dependencies are always up to date.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/O1L85p4VYiU/github-helps-developers-keep-dependencies-secure-dependabot

Researcher Escalates Privileges on Exchange 2013 via NTLM Relay Attack

Microsoft Exchange 2013 and newer versions allow an attacker to escalate privileges when performing a NT LAN Manager (NTLM) relay attack, a security researcher warns.

According to Dirk-jan Mollema, who discovered the vulnerability, the attack is in fact a combination of multiple known flaws and could be exploited by any user with a mailbox to escalate privileges to Domain Admin access.

The first issue is that, in organizations using Active Directory and Exchange, Exchange servers have high-enough privileges to allow an admin on the Exchange server to escalate to Domain Admin. With NTLM authentication vulnerable to relay attacks, one can get Exchange to authenticate to an arbitrary URL over HTTP via the PushSubscription feature, the researcher says.

“Connections made using the PushSubscription feature will attempt to negotiate with the arbitrary web server using NTLM authentication. Starting with Microsoft Exchange 2013, the NTLM authentication over HTTP fails to set the NTLM Sign and Seal flags. The lack of signing makes this authentication attempt vulnerable to NTLM relay attacks,” a CERT/CC vulnerability note reads.

The ability to force Exchange to authenticate via the PushSubscription feature was initially discovered by researchers with ZDI, who used it to perform a reflection attack (they relayed the NTLM authentication back to Exchange).

Mollema, however, discovered that this could be combined with the high privileges in Exchange to perform a relay attack and gain DCSync rights. An option in the push notification service makes it possible to send a message every X minutes, and the attack ensures that Exchange connects even when there is no activity in an inbox.

“Microsoft Exchange is by default configured with extensive privileges with respect to the Domain object in Active Directory. Because the Exchange Windows Permissions group has WriteDacl access to the Domain object, this means that the Exchange server privileges obtained using this vulnerability can be used to gain Domain Admin privileges for the domain that contains the vulnerable Exchange server,” CERT/CC explains.

Mollema also reveals that the attack can be performed using compromised credentials, but that an actor in a position to perform a network attack could trigger Exchange to authenticate even if they don’t have credentials.

Some of the mitigations organizations could apply include removing unnecessary high privileges that Exchange has on the Domain object, enabling LDAP signing and enable LDAP channel binding to prevent relaying to LDAP and LDAPS respectively, and blocking Exchange servers from making connections to workstations on arbitrary ports.

The CERT/CC also notes that, while it isn’t aware of a practical solution to this problem, a workaround developed by a third party does exist, and that impacted organizations should consider applying the mitigations proposed by Mollema.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/qfltk9Z0vuI/researcher-escalates-privileges-exchange-2013-ntlm-relay-attack

Apple Working on Patch to Prevent FaceTime Spying

A critical vulnerability in Apple’s FaceTime chat application can be exploited to spy on people. The tech giant has disabled a FaceTime feature in an effort to prevent abuse until a patch is made available.

Videos and descriptions of the vulnerability have been making the rounds on social media websites. The attack does not require any technical knowledge and it can be carried out in seconds.

The attacker calls the targeted user via FaceTime and then immediately initiates a group chat by using the “Add person” button from the bottom of the screen. The attacker adds their own number to the group chat and FaceTime treats this action as if the targeted user answered the call, thus allowing the attacker to hear the victim.

On the victim’s side, it appears that they haven’t answered the call and there is no indication that the person on the other end can hear them.

Even more worrying, as The Verge and others have discovered, if the victim presses their device’s power button during the incoming call, the attacker also sees them through their camera. At this point, the victim can also hear the attacker, but the screen still shows the incoming call. Some have reported that there are also other ways to get access to video using this flaw.

Facetime vulnerability

The bug reportedly affects FaceTime on the latest versions of iOS and macOS. Apple says it’s working on a fix and in the meantime it has suspended the Group FaceTime feature to prevent abuse.

While the origin of the flaw has not been confirmed, one US-based individual who uses the online moniker “MGT7” claims his 14-year-old discovered the issue. He said the bug was reported to Apple more than 10 days ago, but he never heard back from the company.

Google Project Zero researcher Natalie Silvanovich, who in the past discovered several potentially serious FaceTime vulnerabilities, has a theory on the possible cause of the bug.

Facetime vulnerability cause

Industry professionals have commented on the impact of the bug and Apple’s response.

Facetime vulnerability

This is not the first time someone has found a way to abuse the recently introduced Group FaceTime feature. A few months ago, an iPhone enthusiast demonstrated that the feature could have been used to bypass a device’s lockscreen and gain access to contact information saved on a device.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/SMs8jQk5n_c/apple-working-patch-prevent-facetime-spying

Check Point ZoneAlarm Flaw Allows Privilege Escalation

A vulnerability in Check Point’s popular ZoneAlarm antivirus and firewall allows attackers to escalate their privileges on a system running the security software. The vendor has released an update that should address the flaw.

The issue was discovered last year by Illumant, a company that provides security assessment and compliance solutions. The firm said the vulnerability exists due to the way the application’s developers used Microsoft’s Windows Communication Foundation (WCF) framework. Since WCF was initially codenamed “Indigo,” Illumant has dubbed the vulnerability “OwnDigo.”

Illumant’s findings are based on previous research by Fabius Artrel on privilege escalation and code execution vulnerabilities in applications that use .NET-based WCF services, and research by Matt Graeber on code-signing attacks.

According to Illumant, the vulnerability allows an attacker with limited access to the targeted device to execute arbitrary commands with SYSTEM privileges by abusing a vulnerable ZoneAlarm service. This can be leveraged to add a low-privileged user account to the administrators group.

However, an attack can only be conducted if the attacker’s exploit and payload files are or appear to be signed by Check Point. In order to achieve this, Illumant researchers created a fake code-signing certificate that impersonates Check Point – a user with limited privileges can do this – and installed it on the targeted system. The certificate was then used to sign the exploit and payload code, which could then be executed to elevate privileges.

Illumant recently published a blog post containing technical details and a video showing an overview of the attack.

The company praised Check Point for the way it handled the vulnerability report. The vendor patched the security bug in October with the release of ZoneAlarm Free Antivirus + Firewall version 15.4.062.17802.

Check Point’s security acknowledgements page shows that only a handful of issues were discovered in ZoneAlarm in the past couple of years.

While Illumant demonstrated the attack against ZoneAlarm, the company warns that this is a new class of vulnerabilities that could impact any .NET application using WCF. It has advised software developers to assess their own apps and WCF implementations to ensure that they are not impacted.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/lyyWWMI6rN8/check-point-zonealarm-flaw-allows-privilege-escalation

Flaws Expose Phoenix Contact Industrial Switches to Attacks

The latest firmware updates released by Phoenix Contact for its FL SWITCH industrial ethernet switches address a total of six vulnerabilities that can be exploited to obtain credentials for the web interface, conduct unauthorized activities, cause a denial-of-service (DoS) condition, and launch man-in-the-middle (MitM) attacks.

Phoenix Contact is a Germany-based provider of industrial automation, connectivity and interface solutions. Its FL switches are used worldwide in sectors such as critical manufacturing, IT, and communications.

Researchers from Positive Technologies discovered that 3xxx, 4xxx and 48xx series switches running a version of the firmware prior to 1.35 are vulnerable to attacks.

Phoenix Contact industrial switch vulnerabilities Based on their CVSS score, four of the flaws have been assigned a severity rating of “high.” One of them is a cross-site request forgery (CSRF) issue that allows an attacker to conduct unauthorized activities on the device by getting a legitimate user to click on a malicious link.

Another serious vulnerability is related to the lack of a mechanism for preventing automated and repeated attempts to access the user interface. This allows a malicious actor to obtain the username and password for a device’s interface using a brute force attack.

The researchers also noticed that the web interface is accessed by default over HTTP, which allows an MitM attacker to intercept credentials as they travel from the user’s browser to the switch.

An attacker can prevent others from accessing the web interface by initiating over 120 connections, which causes a DoS condition. This prevents not only new connections, but also disrupts existing ones.

The remaining flaws, with a severity rating of “medium,” allow attackers to obtain the device’s default private keys from the firmware and use them for MitM attacks, and cause certificates to be displayed incorrectly by exploiting a weakness in the switch’s security library.

Learn More About ICS Flaws at SecurityWeek’s 2019 ICS Cyber Security Conference

The vendor has released firmware updates for each of the impacted products. ICS-CERT and its German counterpart [email protected] have released advisories describing the vulnerabilities.

It’s worth mentioning that versions 1.33 and 1.34 of the firmware for Phoenix Contact FL switches also address vulnerabilities discovered by Positive Technologies. Those flaws were disclosed last year in January and May.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/row-DaHmVTY/flaws-expose-phoenix-contact-industrial-switches-attacks

Data Leak in Ghostscript Could Allow Command Execution

Data leak vulnerabilities in Ghostscript could allow an attacker to take over a routine and even execute commands on systems, Google Project Zero researcher Tavis Ormandy has discovered.

A suite of software based on an interpreter for Adobe’s PostScript and PDF page description languages, Ghostscript is maintained by Artifex and is widely used in both stand-alone and web applications, including highly popular packages such as GIMP and ImageMagick.

The software is not vulnerability-free, and some of the security bugs found in it were previously exploited by North Korea-linked hackers. Last year, Ormandy revealed that multiple critical vulnerabilities in Ghostscript also impacted ImageMagick, Evince, GIMP, and most other PDF/PS tools.

In December 2018, a month after Ghostscript 9.26 was released, the security researcher discovered that Ghostscript didn’t protect subroutines correctly, which could result in data leaks and in an attacker taking over the routine.

The researcher explains that the manner in which subroutines are defined in PostScript could allow users to “peek inside and get references to operators they shouldn’t be allowed to use” if subroutines are not marked as executeonly when using system operators.

Furthermore, he notes that, even if subroutines are properly marked, they could still expose the contents to error handlers, meaning that they need to be made pseudo-operators with odef.

On top of that, contents need to be bind, otherwise “name resolution happens on execution, not when you define it,” allowing an intruder to change the dictstack “so that commands and operators do something different than when you defined the subroutine.”

However, it’s not only simple routines that need to be marked executeonly, made pseudo-operators with odef, and bind to be protected, but the more complicated ephemeral routines as well, and Ghostscript failed to apply the proper protections to some ephemeral routines, Ormandy discovered.

The researcher also published proof-of-concept code that works with Ghostscript 9.26 and which allows the user to take over names that couldn’t be resolved at define time, thus providing a high degree of control over the routine.

“This exploit should work via evince, ImageMagick, nautilus, less, gimp, gv, etc, etc. It might require some adjustment to work on older versions, because it requires precise alignment of the operand stack, but 9.26 and earlier are all affected,” Ormandy says.

The researcher reported the discovery to Artifex in early December. After a series of failed fixes, the maintainers managed to address the bugs with patches released earlier this month. The vulnerability is tracked as CVE-2019-6116.

The fix replaces references to operators with name objects in saved stacks for error handlers; makes all ephemeral procedures that contain dangerous operators executeonly, and any outer procedures; changes how error handlers behave in executeonly procedures so that faulting operators don’t leak; rewrites code so fewer pseudo-operators are exposed to users.

“I think this will work, although it’s hard to be confident they found all the transient routines – PostScript is really hard to read,” Ormandy says.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/V8zqpHh6g4I/data-leak-ghostscript-could-allow-command-execution