Weekly Web Security News

Our weekly report of web security and PHP vulnerabilities returns with some interesting articles including one reporting a seven year old weakness with GitHub resulting in compromised accounts. We have even included an article about the upcoming Windows 10 operating system!

General

• ‘Adversary Intelligence’ Finds Criminals Not As Smart As Their Code (Dark Reading)

• After email blunder, Woolworths cancels $1M worth of gift cards (SC Magazine)

• Assume your GitHub account is hacked, users with weak crypto keys told (ArsTechnica)

• Auditing GitHub users’ SSH key quality (Reddit)

• Black mirror: SourceForge has now seized Nmap audit tool project (ArsTechnica)

• Logical Flaw in Google’s OAuth

• Privacy Commissioner may investigate Woolworths gift card blunder (ZDNet)

• Sourceforge Hijacks the Nmap Sourceforge Account (Reddit)

• Woolworths’ Self-Inflicted Breach A Clear Example Of Insider Negligence (Dark Reading)

ionCube24

• Vuln: WordPress ReFlex Gallery Plugin ‘php.php’ Arbitrary File Upload Vulnerability – WordPress ReFlex Gallery Plugin ‘php.php’ Arbitrary File Upload Vulnerability

Infrastructure

• Adallom Brings Protection to Dropbox for Business

• CVE-2014-9727 – AVM Fritz!Box allows remote attackers to execute arbitrary commands via shell metacharacters in the var:lang parameter to cgi-bin/webcm.

• Hungarian lab adds storage to D-Link SOHOpeless list (The Register)

• Logjam TLS vulnerability is academic, not catastrophic (TechRepublic)

• More than 60 undisclosed vulnerabilities affect 22 SOHO routers

• [SEARCH-LAB advisory] More than fifty vulnerabilities in D-Link NAS and NVR devices

Malware

• Alleged Author of Locker Ransomware Publishes Decryption Keys (SecurityWeek)

• Destructive Rombertik Sample Traced Back to Nigerian Man: ThreatConnect (SecurityWeek)

• Locker ransomware author quickly apologizes, decrypts victims’ files (SC Magazine)

• Multinational firm paid ransom in bitcoins to hackers who broke into systems

• Phished IT bod opens door to 40,000 finance folks’ personal details (The Register)

• Phishers Registered More Malicious Domain Names Than Ever in Second Half of 2014: Report (SecurityWeek)

• Researchers observe SVG files being used to distribute ransomware (SC Magazine)

• Skype crashing for you today? Here’s why (ZDNet)

• Skype leveraged to distribute adware (SC Magazine)

PHP Security

• Bugtraq: Local PHP File Inclusion in ResourceSpace – Local PHP File Inclusion in ResourceSpace

• CVE-2015-0211 – mod/lti/ajax.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 does not consider the moodle/course:manageactivities and mod/lti:addinstance capabilities before proceeding with registered-tool list searches, which allows remote authenticated users to obtain sensitive information via requests to the LTI Ajax service.

• CVE-2015-0212 – Cross-site scripting (XSS) vulnerability in course/pending.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted course summary.

• CVE-2015-0213 – Multiple cross-site request forgery (CSRF) vulnerabilities in (1) editcategories.html and (2) editcategories.php in the Glossary module in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allow remote attackers to hijack the authentication of unspecified victims.

• CVE-2015-0214 – message/externallib.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote authenticated users to bypass a messaging-disabled setting via a web-services request, as demonstrated by a people-search request.

• CVE-2015-0215 – calendar/externallib.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote authenticated users to obtain sensitive calendar-event information via a web-services request.

• CVE-2015-0216 – access.php in the Lesson module in Moodle 2.8.x before 2.8.2 does not set the RISK_XSS bit for graders, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via crafted essay feedback.

• CVE-2015-0217 – filter/mediaplugin/filter.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote authenticated users to cause a denial of service (CPU consumption or partial outage) via a crafted string that is matched against an improper regular expression.

• CVE-2015-0218 – Cross-site request forgery (CSRF) vulnerability in auth/shibboleth/logout.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote attackers to hijack the authentication of arbitrary users for requests that trigger a logout.

• CVE-2015-1493 – Directory traversal vulnerability in the min_get_slash_argument function in lib/configonlylib.php in Moodle through 2.5.9, 2.6.x before 2.6.8, 2.7.x before 2.7.5, and 2.8.x before 2.8.3 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the file parameter, as demonstrated by reading PHP scripts.

• CVE-2015-2266 – message/index.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 does not consider the moodle/site:readallmessages capability before accessing arbitrary conversations, which allows remote authenticated users to obtain sensitive personal-contact and unread-message-count information via a modified URL.

• CVE-2015-2267 – mdeploy.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to bypass intended access restrictions and extract archives to arbitrary directories via a crafted dataroot value.

• CVE-2015-2268 – filter/urltolink/filter.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to cause a denial of service (CPU consumption or partial outage) via a crafted string that is matched against an improper regular expression.

• CVE-2015-2269 – Multiple cross-site scripting (XSS) vulnerabilities in lib/javascript-static.js in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allow remote authenticated users to inject arbitrary web script or HTML via a (1) alt or (2) title attribute in an IMG element.

• CVE-2015-2270 – lib/moodlelib.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4, when the theme uses the blocks-regions feature, establishes the course state at an incorrect point in the login-validation process, which allows remote attackers to obtain sensitive course information via unspecified vectors.

• CVE-2015-2271 – tag/user.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 does not consider the moodle/tag:flag capability before proceeding with a flaginappropriate action, which allows remote authenticated users to bypass intended access restrictions via the _Flag as inappropriate_ feature.

• CVE-2015-2272 – login/token.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to bypass a forced-password-change requirement by creating a web-services token.

• CVE-2015-2273 – Cross-site scripting (XSS) vulnerability in mod/quiz/report/statistics/statistics_question_table.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the student role for a crafted quiz response.

• CVE-2015-3174 – mod/quiz/db/access.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 does not set the RISK_XSS bit for graders, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via crafted gradebook feedback during manual quiz grading.

• CVE-2015-3175 – Multiple open redirect vulnerabilities in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving an error page that links to a URL from an HTTP Referer header.

• CVE-2015-3176 – The account-confirmation feature in login/confirm.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote attackers to obtain sensitive full-name information by attempting to self-register.

• CVE-2015-3177 – Moodle 2.8.x before 2.8.6 does not consider the tool/monitor:subscribe capability before entering subscriptions to site-wide event-monitor rules, which allows remote authenticated users to obtain sensitive information via a subscription request.

• CVE-2015-3178 – Cross-site scripting (XSS) vulnerability in the external_format_text function in lib/externallib.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to inject arbitrary web script or HTML into an external application via a crafted string that is visible to web services.

• CVE-2015-3179 – login/confirm.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to bypass intended login restrictions by leveraging access to an unconfirmed suspended account.

• CVE-2015-3180 – lib/navigationlib.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to obtain sensitive course-structure information by leveraging access to a student account with a suspended enrolment.

• CVE-2015-3181 – files/externallib.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 does not consider the moodle/user:manageownfiles capability before approving a private-file upload, which allows remote authenticated users to bypass intended file-management restrictions by using web services to perform uploads after this capability has been revoked.

• Enhanced SQL Portal 5.0.7961 XSS Vulnerability

• Freebox OS Web interface 3.0.2 XSS, CSRF

• vfront-0.99.2 CSRF & Persistent XSS

User Space

• Holy SSH-it! Microsoft promises secure logins for Windows PowerShell (The Register)

• Mac bug makes rootkit injection as easy as falling asleep (The Register)

• So, EE. Who IS this app on your HTC M9s sneakily texting, hmm? (The Register)

• The Empire Strikes Back Apple ? How your Mac firmware security is completely broken

• Windows 10 is coming. be prepared (IT Toolbox Blogs)

WordPress

• Bugtraq: CVE-2015-4038 – WordPress WP Membership plugin [Privilege escalation]

• Bugtraq: CVE-2015-4039 – WordPress WP Membership plugin [Stored XSS]

• CVE-2015-3904 – Multiple cross-site scripting (XSS) vulnerabilities in roomcloud.php in the Roomcloud plugin before 1.3 for WordPress

• CVE-2015-4038 – WordPress WP Membership plugin [Privilege escalation]

• CVE-2015-4039 – WordPress WP Membership plugin [Stored XSS]