Threat Level: green Handler on Duty: Rob VandenBrink

SANS ISC InfoSec Handlers Diary Blog


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

Conficker Working Group site down

Published: 2009-04-09
Last Updated: 2009-04-10 03:53:54 UTC
by Jim Clausing (Version: 3)
3 comment(s)

Yes, we've noticed it too.  The Conficker Working Group website appears to be down at the moment.  We're trying to find out what the problem is and we'll let you know when we know.

Update 1: (2009-04-09 15:20UTC) Apparently there is a fiber problem at one of the sites.  They are aware of it and hoping for a resolution soon.

 Update 2: (2009-04-10 03:30UTC) Sorry to be so late in reporting they are back live.

Keywords: conficker
3 comment(s)

Cisco security advisory

Published: 2009-04-09
Last Updated: 2009-04-09 19:02:05 UTC
by donald smith (Version: 1)
0 comment(s)

Cisco Security Advisory: Multiple Vulnerabilities in Cisco ASA and PIX appliances.
http://www.cisco.com/en/US/products/products_security_advisory09186a0080a994f6.shtml
* VPN Authentication Bypass when Account Override Feature is Used vulnerability
* Crafted HTTP packet denial of service (DoS) vulnerability
* Crafted TCP Packet DoS vulnerability
* Crafted H.323 packet DoS vulnerability
* SQL*Net packet DoS vulnerability
* Access control list (ACL) bypass vulnerability

The VPN authentication bypass depends on having Override Account Disabled Feature which is disabled by default.

The crafted http/https vulnerability is triggered by specially crafted packets, can be triggered on any interface with ASDM enabled and does not require a 3-way handshake be completed (spoofable).

The TCP packet DOS vulnerability also requires specially crafted packets, can be triggered when crafted packets are sent to any TCP based service on the router, can be triggered on transient traffic if the TCP intercept features are enabled and doesn’t require a 3-way handshake be completed (spoofable).

The H.323 packet DOS relies on having H.323 inspection turned on but that is enabled by default, again requires specially crafted packets and doesn’t require a 3-way handshake be completed (spoofable).

The SQL net packet DOS relies on having SQLnet inspection turned on but it is enabled by default, requires specially crafted packets and does not require a 3-way handshake be completed (spoofable).

The ACL bypass vulnerability is a bypass of the implicit deny at the end of the rule set so if your rule sets have an explicit deny at the end, your not vulnerable.  You should ALWAYS put an explicit deny rule at the end of all firewall rule sets!
 

Keywords:
0 comment(s)

Wireshark 1.0.7 released

Published: 2009-04-09
Last Updated: 2009-04-09 14:12:14 UTC
by Jim Clausing (Version: 1)
0 comment(s)

In case you hadn't noticed yet, they've updated one of our favorite tools, Wireshark.  The new version includes some security fixes in several of the protocol dissectors (including LDAP).  For the Mac fans, there is also an experimental package for MacOS X 10.5.5 and above.

 

References:

Release announcement: http://www.wireshark.org/news/20090408.html

Advisory: http://www.wireshark.org/security/wnpa-sec-2009-02.html

Keywords: wireshark
0 comment(s)

Conficker update with payload

Published: 2009-04-09
Last Updated: 2009-04-09 13:44:52 UTC
by Johannes Ullrich (Version: 1)
1 comment(s)

Various sources report that some conficker infected systems are receiving updates now. The update may include a keylogger and other code to exfiltrate data. We will keep this diary updates as we hear more. The update is delivered using the P2P mechanism and not the (disfunct) web sites.

 

------
Johannes B. Ullrich, Ph.D.
SANS Technology Institute     Follow me on Twitter

1 comment(s)
Diary Archives