Another day, another zero-day – Internet Explorer's turn (CVE-2015-0072)
Posted by Jose Barajas on 05 February 2015 07:30 AM
Websense® Security Labs™ researchers are aware of a zero-day vulnerability affecting Internet Explorer that could allow a remote, unauthenticated attacker to bypass the Same-Origin Policy (SOP) to hijack the user’s session. The vulnerability is being called Universal Cross Site Scripting (XSS), as it allows the attacker to hijack the session using any third-party website, as long as the victim uses the Internet Explorer browser.
The Same-Origin Policy (SOP) is a critical security measure used in web applications to ensure the confidentiality and integrity of information. Scripts running on different websites are not permitted to interact with each other, and cookies use SOP to ensure that the information for a given user's activity pertains to only one site. This mechanism allows for secure communication across multiple web properties and allows user sessions to be maintained without the need for re-authentication.
Microsoft has not yet released a patch for the vulnerability, which has been assigned the identifier CVE-2015-0072.
Successful exploitation could allow an attacker to hijack the user’s session or gain access to sensitive information. The vulnerability could also be used in phishing attacks. Once the attacker has access to the user's cookies, all data normally restricted for use by the user would be available to the attacker and the attacker could impersonate the victim. The vulnerability can be easily exploited and is rated critical.
Websense customers are protected against attacks targeting the vulnerability (CVE-2015-0072) with ACE, our Advanced Classification Engine, which is used to prevent the malicious scripts from being downloaded to the victim’s machine.
Websense researchers are not aware of active exploitation of this vulnerability at the time of publication of the blog, although, as mentioned earlier, proof of concept code is publicly available.
Customers are encouraged to apply the patch from Microsoft as soon as it becomes available. You could also decide to use an alternative browser in place of the vulnerable versions of Internet Explorer.
Websense Security Labs will continue to monitor the situation and provide updates as needed.
Read more »
CVE-2015-0235 - how to handle the "GHOST" vulnerability affecting Linux distributions
Posted by Carl Leonard on 28 January 2015 08:45 AM
Websense® Security Labs™ are aware that a vulnerability has been identified in the GNU C Library that can lead to remote code execution under certain circumstances. The GNU C Library (glibc) is a core component of GNU systems and those with the Linux kernel; thus it has potential for a very significant attack surface area.
The vulnerability has been assigned CVE-2015-0235 and is being referred to as "GHOST".
How is it exploited?
Although we have not seen web-based or email-based attacks, Qualys, the team who discovered the bug, do have evidence to show how an MTA (mail transfer agent) can be exploited by sending a specially crafted packet to trigger a buffer overflow and subsequent arbitrary code execution.
How do you know if your instance is vulnerable?
It is known that the following distributions are amongst those affected: Debian 7 (wheezy), Red Hat Enterprise Linux 6 & 7, CentOS 6 & 7, Ubuntu 12.04.
Code that tests for the vulnerability has been made available on the github forum. Of course, we extend a word of caution to use such code at your own risk. You can also check which version of glibc you are running by executing the command ldd --version at your command prompt.
The difficulty of exploitation depends on the target system implementation. In a post to the OpenWall security forum Qualys do note that the vulnerable functions are no longer always called having been replaced by the getaddrinfo() function in IPV6 implementations, that pre-validation of the argument sent to the function removes the potential for exploitation and that glibc itself was patched in 2013.
However, when these conditions do not apply the risk is deemed critical.
Fortunately various product vendors are rolling out updates to patch their affected distributions. We strongly recommend that you check with your Linux distribution vendor to see if they have a patch available. If so, you should review how to apply this patch to your environment as soon as possible in order to mitigate potential risk, not least because the bug is deemed critical.
Websense Security Labs will continue to investigate the implications of this vulnerability.
Read more »