DoS Vulnerability Found in Scapy Packet Manipulation Tool

Scapy, the free and open source packet manipulation tool, is affected by a denial-of-service (DoS) vulnerability, Imperva revealed on Tuesday.

Developed in Python, Scapy is a powerful tool that allows users to forge, decode, send, capture, store, and read packets. It can be used for network discovery, attacks, scans, tracerouting and probing, and its developers say it can replace tools such as hping, nmap, arp-sk, Wireshark, arping, tcpdump, and arpspoof.

While looking into more efficient ways of detecting and mitigating distributed denial-of-service (DDoS) attacks, Imperva researchers noticed that a specially crafted packet can cause Scapy to enter a DoS condition.

Specifically, experts says the algorithm used by the tool to determine the type of an inspected packet relies on port numbers, allowing the packet type to be easily spoofed. If an attacker sends a specially crafted packet that appears to be a RADIUS packet, Scapy enters an infinite loop.

“This can potentially affect the health of an enterprise network – for instance, if Scapy is being used by IT to monitor network traffic, the monitoring process will stop functioning,” Imperva’s Johnathan Azaria and Koby Kilimnik said in a blog post.

Imperva reported the vulnerability to Scapy developers and a patch has been released. However, when Imperva published its blog post, it warned that the current Scapy version (2.4.0) from the Python pip repositories had still contained the vulnerability. Users have been advised to build Scapy using code obtained directly from the official GitHub account.

“The potential impact is large – Scapy is quite a popular tool, and other libraries that depend on Scapy might be vulnerable as well. Networks relying on Scapy for traffic monitoring or other functions can also be affected,” explained Azaria and Kilimnik.

Imperva noted that some libraries with a Scapy dependency may be affected as well. The list includes IcmpTool, jldcmds, mim, ooniprobe, pyersinia, scapy-http and pysap.

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/Efg9gebqa7Q/dos-vulnerability-found-scapy-packet-manipulation-tool

SAP Releases ‘Hot News’ Security Notes on First Patch Day of 2019

SAP released its first Security Patch Day for 2019 this week, which includes a total of 11 Security Notes, two of which are rated as Hot News.

The most important of the Security Notes addresses vulnerabilities in SAP Cloud Connector. Tracked as CVE-2019-0246 and CVE-2019-0247, the bugs both have a CVSS score of 9.3.

This is the second Security Note that SAP publishes for the platform, and is the first to feature a Critical severity rating (the only other note for Cloud Connector was published in April 2018 with a Medium severity rating), Onapsis, a firm that specializes in securing Oracle and SAP applications, points out.

An attacker exploiting the vulnerability could gain access to service and read, modify or delete information, while also being able to access administrative or privileged functionalities, ERPScan, another company that secures Oracle and SAP products, explains.

“The attacker can also use an OS command execution vulnerability for unauthorized execution of operating system commands. Executed commands will run with same privileges of the service that executed a command. The hacker can access arbitrary files and directories located in an SAP server filesystem including application source code, configuration, and critical system files,” ERPScan says.

The second Hot News Security Note published by SAP this week addresses an information disclosure issue in Landscape Management. Tracked as CVE-2019-0249, the vulnerability carries a CVSS score of 9.1.

An attacker could abuse the information disclosure flaw to reveal additional information such as system data, debugging information, and the like, which could then be abused to explore the system and plan other attacks, ERPScan points out.

SAP’s January 2019 patches also include one High severity Security Note. Tracked as CVE-2019-0243 and featuring a CVSS score of 7.1, the vulnerability is a Missing Authorization check that impacts SAP BW/4HANA.

All of the remaining Security Notes address Medium risk vulnerabilities such as Information Disclosure, Cross-Site Scripting, Denial of Service, and Missing Authorization check.

Impacted SAP products include Financial Consolidation Cube Designer, Commerce, Work Manager, CRM WebClient UI, Business Objects, Gateway of ABAP Application Server, and Enterprise Financial Services.

The new set of SAP patches also includes 7 Support Package Notes, for a total of 18 Security Notes. One of the patches is an update to a previously release note.

Cross-Site Scripting was the most encountered vulnerability type, followed by Implementation Flaw and Information Disclosure. The remaining bugs were Missing Authorization Check issues, Denial of Service vulnerabilities, and one OS Command Execution flaw.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/qSqpIcUpO1o/sap-releases-hot-news-security-notes-first-patch-day-2019

Microsoft Patches Critical Flaws in Edge, Hyper-V, DHCP

Microsoft has fixed nearly 50 vulnerabilities with its Patch Tuesday updates for January 2019, including some critical flaws affecting Edge, Hyper-V and DHCP. None of the vulnerabilities patched this month appear to have been exploited, but one of them has been publicly disclosed.

The publicly disclosed flaw, tracked as CVE-2019-0579 and rated “important,” affects the Windows Jet database engine. It can be exploited by a remote attacker to execute code on a targeted system by getting a user to open a specially crafted file.

Microsoft has credited researchers from ACROS’s 0patch, Palo Alto Networks, and Flexera for reporting the vulnerability.

It’s possible that the flaw is related to CVE-2018-8423, a Jet database engine issue which Microsoft patched in October, after the details of the security hole were disclosed in the previous month by Trend Micro’s ZDI. 0patch provided two micro-patches for the vulnerability – one when there was no fix from Microsoft, and one a few weeks later after it was determined that the tech giant’s patch was incomplete.

ACROS CEO Mitja Kolsek told SecurityWeek that they will be conducting tests to confirm it, but he believes CVE-2019-0579 is most likely the result of an incomplete patch for CVE-2018-8423.

This month’s Patch Tuesday updates also address four critical vulnerabilities affecting Edge. They are all memory corruption bugs, mostly related to the Chakra scripting engine, and they all allow arbitrary code execution in the context of the current user.

Another critical flaw, CVE-2019-0547, allows an attacker to execute arbitrary code on a Windows DHCP client machine by sending it specially crafted DHCP responses.

The last two critical vulnerabilities resolved this month are CVE-2019-0551 and CVE-2019-0550, which allow remote code execution on Hyper-V host operating systems.

One of this month’s advisories details an information disclosure and privilege escalation vulnerability affecting Skype for Android. Details of the flaw were disclosed recently by a researcher who showed how the weakness can be exploited to view photos and contacts, and even open links in a phone’s web browser. This vulnerability has only been rated “moderate” by Microsoft, likely due to the fact that exploitation requires physical access to the targeted device.

One of the Office vulnerabilities patched this month is CVE-2019-0560, which allows an attacker to obtain information from the memory that can later be used to compromise a device or data. Exploitation requires the targeted user to open a specially crafted document.

The vulnerability was reported to Microsoft by Mimecast, which has published an advisory and a blog post detailing its findings. The company discovered that Office files with ActiveX controls were consistently causing memory leaks.

“In fact, this memory leak leads to the permanent writing of memory content into different Microsoft Office files and thus, the potential for the unintended leakage of sensitive information and local machine information. If known, this is the type of data could be useful to cybercriminals for executing a malware-enabled, remote execution attack and at least as important—to steal sensitive information,” Mimecast said. “The Mimecast team has evidence of this leak in documents dating years back. Some documents were even found online containing sensitive user information.”

Adobe also released security updates on Tuesday, but only to resolve two “important” vulnerabilities in Connect and Digital Editions.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/zIFV2tmTbpY/microsoft-patches-critical-flaws-edge-hyper-v-dhcp

Serious DoS Flaw Impacts Several Yokogawa Products

A serious denial-of-service (DoS) vulnerability impacts several industrial automation products from Japanese electrical engineering and software company Yokogawa Electric.

The flaw exists in the Open Communication Driver for Vnet/IP, a real-time plant network system for process automation. The problematic driver is present in several Yokogawa products, including CENTUM CS 3000 and CENTUM VP distributed control systems, the Exaopc OPC interface package, the Plant Resource Manager (PRM) platform, ProSafe-RS safety instrumented systems, the FAST/TOOLS SCADA solution, and the CENTUM VP-based B/M9000 paper quality measurement and control system.

ICS-CERT says the impacted products are used worldwide, mainly in the critical manufacturing, energy, and food and agriculture sectors.

Yokogawa products impacted by CVE-2018-16196

The vulnerability is tracked as CVE-2018-16196 and it has a CVSS score of 7.5, which puts it in the “high severity” category. It’s worth noting that DoS vulnerabilities can pose a serious risk in the case of industrial control systems (ICS), as opposed to IT systems where they are often seen as having a low impact.

Learn More About ICS Vulnerabilities at SecurityWeek’s ICS Cyber Security Conference

The security hole was apparently discovered by Yokogawa itself, which informed Japan’s JPCERT of its existence last month. JPCERT forwarded the information to ICS-CERT in the United States.

The advisories from Yokogawa, ICS-CERT and JPCERT (written in Japanese) reveal that the vulnerability can be exploited by a remote and unauthenticated attacker — even one with a low skill level — to disrupt the communications functionality of the Vnet/IP Open Communication Driver.

Yokogawa has released patches that can be applied to several of the impacted products. Some of the affected software versions have reached end of support and they will not receive patches — the vendor has advised customers to consider upgrading their system to the latest version.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/Pnvu40-CQMI/serious-dos-flaw-impacts-several-yokogawa-products

Vulnerability in Skype for Android Exposes User Data

A vulnerability in Skype for Android allows an unauthenticated attacker to view photos and contacts, and even open links in the browser, a security researcher has discovered.

Found by Florian Kunushevci, a 19-year-old researcher from Kosovo, the vulnerability requires for the attacker to have physical access to the target device. Next, they would need to receive a Skype call and answer it, which would then allow them to access user data even if the device is locked.

Normally, with the device locked, a user should not have access to data such as photos and contacts without authenticating with a password, a PIN, a lock-screen pattern, or a fingerprint.

Kunushevci, however, discovered that a code error in Skype for Android led to the application not following the rule, thus providing an attacker with the possibility to access photos, view contacts, and even send messages without having to authenticate first.

Furthermore, the young security researcher discovered that it was also possible to launch the browser on the device, straight from Skype. For that, the attacker would only need to type a link in a new message, send the message, and then click the link.

The security researcher discovered the vulnerability in October and reported it to Microsoft immediately. The company responded fast and addressed the issue in a new version of Skype released on December 23.

According to Kunushevci, the vulnerability likely impacts all Android devices using a Skype version without the patch (the app version differs depending on the Android iteration running on the device).

A video demonstrating the lockscreen bypass can be seen embedded below.

[embedded content]

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/Gz6azlh91ZM/vulnerability-skype-android-exposes-user-data

Multiple Vulnerabilities Patched in CleanMyMac Utility

Recently addressed vulnerabilities in the popular macOS cleanup application CleanMyMac X could allow attackers to modify the file system as root, Cisco Talos security researchers reveal.

Created by MacPaw, CleanMyMac X allows users to scan their macOS machines for unused or unnecessary files and delete them to free up extra space. The application includes various other optimization and performance monitor functions, and can also remove malware.

Talos’ security researchers found a total of 13 vulnerabilities in version 4.04 of the application, 12 of which are privilege escalation flaws, while the last is a denial-of-service issue.

Tracked as CVE-2018-4032 and CVE-2018-4033, the first two privilege escalation bugs reside in the `moveItemAtPath` and `moveToTrashItemAtPath` functions of the helper protocol, respectively. Because CleanMyMac X improperly validates inputs, an attacker can use `nil` to function arguments, resulting in any other application accessing that function and deleting files from the root file system.

Three other flaws, CVE-2018-4034, CVE-2018-4035, and CVE-2018-4036, impact the `removeItemAtPath`, `truncateFileAtPath`, and `removeKextAtPath` functions of the helper protocol, respectively. Lack of validation makes it possible for any application to access these functions and run them as root, which could allow an attacker to delete files from the root file system.

The next three flaws, CVE-2018-4037, CVE-2018-4041, and CVE-2018-4042, impact the `removeDiagnosticsLogs`, the `enableLaunchdAgentAtPath`, and the `removeLaunchdAgentAtPath` functions of the helper protocol and could be exploited by a non-root user to delete the main log data from the system.

The CVE-2018-4043 and CVE-2018-4044 flaws reside in the `removeASL` and the `removePackageWithID` functions of the helper protocol and could be exploited by non-root users to delete a package’s privileged information.

Also a privilege escalation vulnerability, CVE-2018-4045 impacts the `securelyRemoveItemAtPath` function of the helper protocol and could allow non-root users to delete files from the root file system.

CleanMyMac X’s helper service is also impacted by a denial-of-service issue, due to improper input validation. Residing in the `pleaseTerminate` function, the vulnerability is caused by the lack of validation of the calling application, which allows non-root users to terminate this root daemon.

Another privilege escalation vulnerability in the software’s helper service impacts the `disableLaunchdAgentAtPath` function and is also the result of lack of validation, potentially allowing any non-root users to uninstall `launchd` scripts as root.

“It is recommended that users update to the latest version of this software (CleanMyMac X version 4.2.0). There are several ways in which an attacker could bypass the usual protections in place to acquire greater access to the machine and modify the file system as root,” Talos concludes.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/Hi9TvRjgtzA/multiple-vulnerabilities-patched-cleanmymac-utility

Two Critical Flaws Patched in Adobe Acrobat, Reader

Adobe’s first round of security updates for 2019 resolve two critical vulnerabilities in the company’s Acrobat and Reader products, but administrators should not be too concerned about the flaws being exploited in the wild any time soon.

The latest versions of Acrobat DC, Acrobat Reader DC, Acrobat 2017 and Acrobat Reader DC 2017 for Windows and macOS patch a use-after-free bug that can lead to arbitrary code execution in the context of the current user (CVE-2018-16011), and a security bypass issue that can result in privilege escalation (CVE-2018-19725).

The first vulnerability was discovered by Sebastian Apelt and the second by Abdul Aziz Hariri. Both security holes were reported to Adobe via Trend Micro’s Zero Day Initiative (ZDI).

While both flaws are considered critical, Adobe has assigned them a priority rating of 2, which means exploits are not imminent and administrators are advised to install the patches within 30 days.

Adobe patched hundreds of vulnerabilities in Acrobat products last year, including one that it failed to fix properly on the first try and a zero-day flaw exploited by malicious actors for arbitrary code execution.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/ebwuJUNi0hE/two-critical-flaws-patched-adobe-acrobat-reader

New Crypto-Mining Attacks Leverage NSA-Linked EternalBlue Exploit

A new version of the NRSMiner is actively spreading in the southern region of Asia. The majority of detections (54%) have been found in Vietnam, followed by Iran (16%) and Malaysia (12%). The new version either updates existing NRSMiner infections, or spreads to new systems using the EternalBlue exploit.

EternalBlue, one of the NSA exploits stolen by the Shadow Brokers and leaked to the public, is infamously known for the WannaCry and NotPetya outbreaks in 2017. It was patched by Microsoft in March 2017, leaked by Shadow Brokers in April 2017, and used by WannaCry in May 2017.

That EternalBlue is still being used to spread malware nearly two years after it was patched by Microsoft points to a massive failure in patching.

“Falling behind basic security practices, like patching, is usually the main culprit in these situations,” Jarno Niemela, principal researcher ata F-Secure Labs told SecurityWeek. “And use of pirated software and how popular Windows is compared to other platforms are probably playing a role here.”

However, he continued, “I think the biggest reason this is limited to certain countries has to do with resourcing. Security investments help ensure IT admins have time and money to create and maintain secure systems. And investments that build a culture of security is how those resources become allocated. Some parts of the world have invested in security education for decades, and we don’t see this malware achieving the same prevalence in those regions.”

The new version of NRSMiner is discussed by F-Secure researcher Neeraj Singh in a report published today. It updates existing infections by downloading new modules and deleting the files and services installed by its own previous versions. Existing infections with the wmassrv service running will connect to tecate[.]traduires[.]com to download an updater module.

The updater module checks to see if the new version is already installed. If it is, it deletes itself. If not, it downloads the malware from one of a series of hardcoded URLs. This malware performs the necessary housekeeping before installing a service named snmpstorsrv, with snmpstorsrv.dll registered as servicedll. It then deletes itself.

The new service creates multiple threads for different purposes, including the exfiltration of processor and system information, checking for a new module, and running the miner. The updated miner is injected into svchost.exe to start crypto-mining. If this fails, the miner is written to TrustedHostex.exe in the system32 folder and executed.

snmpstorsrv also decompresses a wininit.exe file and ejects it into svchost.exe. Failing this, wininit is written to \AppDiagnostics\wininit.exe and executed. Wininit is responsible for further propagation. One of the files it unzips and places in the AppDiagnostics folder is called svchost.exe but is actually the EternalBlue – 2.2.0 exploit executable.

Wininit.exe scans the local network on TCP port 445 looking for other accessible devices, and executes the EternalBlue exploit on any found and vulnerable systems. If successful, it installs the DoublePulsar backdoor on the new system. The new system is infected, and the process begins again.

The cryptominer used is the XMRig Monero CPU miner, employed to generate units of the Monero cryptocurrency. Monero has suffered the same decline in value experienced by all cryptocurrencies during 2018, peaking at around $542 in January 2018 and currently trading at less than $50. Nevertheless, it is gaining in popularity for both legitimate and illegitimate reasons.

On January 1, 2019, Monero tweeted, “The official Fortnite Merch Store is now exclusively accepting #Monero as a cryptocurrency payment option!” Fortnite is an online video game developed by Epic Games and released in July 2017. It reportedly has 125 million players throughout the world.

The bad guys simply like the increased privacy Monero provides over Bitcoin.

Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing about high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines.

Previous Columns by Kevin Townsend:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/3PQlENs7L4w/new-crypto-mining-attacks-leverage-nsa-linked-eternalblue-exploit

Vulnerability in Chrome for Android Patched Three Years After Disclosure

A vulnerabilitiy recently patched by Google in Chrome for Android was an information disclosure bug that was originally reported in 2015, but not patched until the release of Chrome 70 in October 2018, security researchers say.

The issue is that the browser – along with WebView and Chrome Tabs for Android – discloses information about the hardware model, firmware version, and security patch level of the device it is installed on. Applications using Chrome to render web content are also impacted.

This behavior, however, is defined in the Chrome docs, which state that the Chrome for Android User Agent string includes the Android version number and build information. The information is also sent to apps using WebView and Chrome Tabs APIs, and, although an option is offered to override the default, most applications choose not to do so.

“Aggravating this issue is that the user agent header is sent always, with both HTTP and HTTPS requests, often by processes running in background. Also, unlike the desktop Chrome, on Android no extensions or overrides are possible to change the header other than the ‘Request Desktop Site’ option on the browser itself for the current session,” security researchers with Nightwatch Cybersecurity explain.

While many browsers have been long identifying the operating system and version on both desktop and mobile devices, the fact that the build tag (which identifies the device name and firmware build) is also disclosed represents the root cause of the issue, the researchers say.

They also argue that, for many devices, this build tag can be used to identify not only the device, but also the carrier and country. The information could also be used to determine the security patch level on the device.

The disclosed information, the researchers say, can be used to track users and fingerprint devices. Furthermore, attackers could use the information to learn whether specific devices contain certain vulnerabilities and target those with their exploits.

The security issue was initially reported to Google in 2015, but the vendor rejected the bug report. Chrome 70, however, arrived in October 2018 with a partial fix, hiding the firmware information but still revealing the hardware model identifier.

“Since this fix doesn’t apply to WebView usage, app developers should manually override the User Agent configuration in their apps,” Nightwatch Cybersecurity notes.

The security researchers believe that all prior versions of Chrome for Android are affected by the vulnerability and advise all users to upgrade to version 70 or later. Google continues to treat the issue as not being security related, and a CVE number hasn’t been issued, the researchers say.

When contacted about the issue in 2015, the vendor said all is working as intended. Last year, however, a new bug was filed by the vendor, along with a feature request, and Chrome 70 for Android brought the aforementioned partial fix, which only applies to the browser itself.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/2tyUXYg9BLU/vulnerability-chrome-android-patched-three-years-after-disclosure

EU to Run Bug Bounty Programs for 14 Free Software Projects

The European Union is offering a total of more than €850,000 – nearly $1 million – for vulnerabilities found in 14 widely used free and open source software projects.

The announcement was made last week by Julia Reda, who represents the German Pirate Party in the European Parliament. Reda and Max Andersson, a member of Sweden’s Green Party in the European Parliament, are the creators of the Free and Open Source Software Audit (FOSSA) project.

FOSSA, run by the European Commission, was launched in 2014 in response to the OpenSSL vulnerability known as Heartbleed. Its goal is to help improve the overall security of the Internet through bug bounty programs, audits, hackathons and other initiatives.

Starting this month, as part of FOSSA, the European Commission will launch 14 bug bounty programs for free software projects, including Filezilla, Apache Kafka, Apache Tomcat, Notepad++, PuTTY, VLC, FLUX TL, KeePass, 7-Zip, Digital Signature Services (DSS), Drupal, glibc, PHP Symfony, WSO2, and midPoint.

Rewards range between €25,000 ($28,000) and €90,000 ($103,000). Some of the programs will run until the summer of 2019, while others will accept submissions until the end of the year and even towards the end of 2020.

The highest rewards are being offered for PuTTY and Drupal. The PuTTY bug bounty will run until December 15, 2019, and the one for Drupal, which is the longest, has an end date of October 15, 2020.

Researchers who want to take part in these programs will be invited to submit their findings via the HackerOne and Deloitte’s Intigriti crowdsourced security platforms.

EU launches bug bounty programs for open source projects

The first phase of FOSSA ran in 2015-2016 and it involved creating an inventory of the free software used by the European Parliament, an analysis of how developers handle security, and security audits of the Apache web server and the KeePass password manager.

The second phase of FOSSA – the project was renewed in 2017 for another 3 years – involves bug bounty programs, with a test targeting VLC conducted last year.

Josh Bressers, who leads product security at Elastic, noted on his Open Source Security blog that bug bounties are a step in the right direction, but more needs to be done.

“If nothing changes and bug bounties are the only way to spend money on open source, this will fizzle out as there isn’t going to be a massive return on investment. The projects are already overworked, they don’t need a bunch of new bugs to fix. We need a ‘next step’ that will give the projects resources. Resources aren’t always money, sometimes it’s help, sometimes it’s gear, sometimes it’s pizza. An organization like the EU has money, they need help turning that into something useful to an open source project,” Bressers said.

“I don’t know exactly what the next few steps will look like, but I do know the final step is going to be some framework that lets different groups fund open source projects. Some will be governments, some will be companies, some might even be random people who want to give a project a few bucks,” he added.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/XTk1y3BgzBg/eu-run-bug-bounty-programs-14-free-software-projects