CVE-2015-8103

The Jenkins CLI subsystem in CloudBees Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-*.jar file and the “Groovy variant in ‘ysoserial'”.

RHSA-2015:2515-1: Moderate: git19-git security update

Red Hat Enterprise Linux: Updated git19-git packages that fix one security issue are now available
for Red Hat Software Collections 2.

Red Hat Product Security has rated this update as having Moderate security
impact. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available from the CVE link in the
References section.

USN-2818-1: OpenJDK 7 vulnerability

Ubuntu Security Notice USN-2818-1

25th November, 2015

openjdk-7 vulnerability

A security issue affects these releases of Ubuntu and its
derivatives:

  • Ubuntu 15.10
  • Ubuntu 15.04
  • Ubuntu 14.04 LTS

Summary

A security issue was fixed in OpenJDK 7.

Software description

  • openjdk-7
    – Open Source Java implementation

Details

It was discovered that rebinding of the receiver of a
DirectMethodHandle may allow a protected method to be accessed. Am
attacker could use this to expose sensitive information or possibly
execute arbitrary code.

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 15.10:
openjdk-7-jre-lib

7u91-2.6.3-0ubuntu0.15.10.1
openjdk-7-jre-zero

7u91-2.6.3-0ubuntu0.15.10.1
icedtea-7-jre-jamvm

7u91-2.6.3-0ubuntu0.15.10.1
openjdk-7-jre-headless

7u91-2.6.3-0ubuntu0.15.10.1
openjdk-7-jre

7u91-2.6.3-0ubuntu0.15.10.1
Ubuntu 15.04:
openjdk-7-jre-lib

7u91-2.6.3-0ubuntu0.15.04.1
openjdk-7-jre-zero

7u91-2.6.3-0ubuntu0.15.04.1
icedtea-7-jre-jamvm

7u91-2.6.3-0ubuntu0.15.04.1
openjdk-7-jre-headless

7u91-2.6.3-0ubuntu0.15.04.1
openjdk-7-jre

7u91-2.6.3-0ubuntu0.15.04.1
Ubuntu 14.04 LTS:
openjdk-7-jre-lib

7u91-2.6.3-0ubuntu0.14.04.1
openjdk-7-jre-zero

7u91-2.6.3-0ubuntu0.14.04.1
icedtea-7-jre-jamvm

7u91-2.6.3-0ubuntu0.14.04.1
openjdk-7-jre-headless

7u91-2.6.3-0ubuntu0.14.04.1
openjdk-7-jre

7u91-2.6.3-0ubuntu0.14.04.1

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to restart any Java
applications or applets to make all the necessary changes.

References

CVE-2015-4871

US-CERT Alerts Users to Holiday Phishing Scams and Malware Campaigns

Original release date: November 25, 2015

US-CERT reminds users to remain vigilant when browsing or shopping online this holiday season. E-cards from unknown senders may contain malicious links. Fake advertisements or shipping notifications may deliver infected attachments. Spoofed e-mail messages and fraudulent posts on social networking sites may request support for phony causes.

To avoid seasonal campaigns that could result in security breaches, identity theft, or financial loss, US-CERT encourages users to take the following actions:

  • Avoid following unsolicited links or downloading attachments from unknown sources.

If you believe you are a victim of a holiday phishing scam or malware campaign, consider the following actions:

  • Contact your financial institution immediately and close any accounts that may have been compromised. Watch for any unexplainable charges to your account.
  • Immediately change any passwords you might have revealed and do not use that password in the future. Avoid reusing passwords on multiple sites.

This product is provided subject to this Notification and this Privacy & Use policy.

‘Tis the Season to Shop Online

The holiday season is coming up and we expect that many will opt to shop online to avoid the big crowds in city centers, malls and stores. 

In America, Cyber Monday, the cyber version of shopping day Black Friday, was born in the mid 2000s. Cyber Monday sales have steadily increased since its inception and according to IBM Digital Analytics, sales grew 8.5% in 2014. According to ComScore, purchases are now also being made from smartphones with overall spending from mobile devices in the millions.

Americans aren’t the only ones who have embraced Cyber Monday, many other retailers around the world have come together to offer deals on the Monday after U.S. Thanksgiving and in China, Singles’ Day (November 11th) has become a major ecommerce day with 27,000 online merchants participating in 2014

via v3.co.uk

via v3.co.uk

This is not only an exciting time for online retailers and online shoppers but also for cyber criminals. I spoke with our senior malware analyst, Jaromír Hořejší about how cybercriminals are preparing for Cyber Monday:

Cybercriminals will use the same tactics they always do, but target consumers more during Black Friday with “special” offers via fake email campaigns to trick people into shopping on fraudulent sites to steal their information and money.

It is, therefore, vital you have antivirus installed on all of your devices. Antivirus software, like Avast, will detect and block phishing attacks before they can affect consumers.

Consumers should also make sure all of the software on their devices is up-to-date. Attackers often exploit vulnerabilities, which can be found in outdated software and by exploiting outdated software they can infect your device to then steal your financial information while you shop online.

In addition, consumers should shop at online stores that are known and credible. Credible sites usually use the HTTPS protocol, assuring secure communication. You can recognize if a site is using the HTTPS protocol by the little padlock in the address bar of your browser. If you are on a check out page and you don’t see the HTTPS padlock, do not enter your personal data and financial information!

How to minimize risks while shopping online

  • Use a payment service or your credit card – Experts agree that payment services like PayPal are safe because of their security practices and the encryption technology they use. Link it to a credit card so you get your credit card’s fraud protections in addition to PayPal’s. If you only use a credit card, designate one card for online purchases so if something unusual happens, you don’t have to track down all your other cards.
  • Keep a paper trail – Once you place your order, print or save records of the transaction. Check your credit card statement to make sure transactions match and there were no unauthorized charges.
  • Avoid shopping while using public Wi-Fi – Unsecure public Wi-Fi hotspots do not give you any protection from hackers who want to monitor what you are doing online. It’s not difficult for someone to intercept and modify communications between you and another site. If you have to do it, then use a Virtual Private Network (VPN) so your communications will be encrypted.
  • Use a secure browser – the new premium versions of Avast 2016 include SafeZone browser, which isolates banking and payment sites in a protected space, so users have an extra secure place to bank and pay bills online.

 Follow Avast on Facebook and Twitter  for more security tips, news, and trends. 

CIS Manager Content Management System 2015Q4 – SQL Injection Vulnerability

Posted by Vulnerability Lab on Nov 25

Document Title:
===============
CIS Manager Content Management System 2015Q4 – SQL Injection Vulnerability

References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1652

Release Date:
=============
2015-11-25

Vulnerability Laboratory ID (VL-ID):
====================================
1652

Common Vulnerability Scoring System:
====================================
8.3

Product & Service Introduction:…

Suricata IDPE 2.0.10

Suricata is a network intrusion detection and prevention engine developed by the Open Information Security Foundation and its supporting vendors. The engine is multi-threaded and has native IPv6 support. It’s capable of loading existing Snort rules and signatures and supports the Barnyard and Barnyard2 tools.

Debian Security Advisory 3403-1

Debian Linux Security Advisory 3403-1 – This update backports changes from the commons-collections 3.2.2 release which disable the deserialisation of the functors classes unless the system property org.apache.commons.collections.enableUnsafeSerialization is set to ‘true’. This fixes a vulnerability in unsafe applications deserialising objects from untrusted sources without sanitizing the InstantiateFactory, InstantiateTransformer, InvokerTransformer, PrototypeCloneFactory, PrototypeSerializationFactory and WhileClosure.